In a proposal posted on Friday in the Federal Register, the Office for Civil Rights of the US Department of Health and Human Services (HHS) outlined several new requirements that could improve the cybersecurity practices of healthcare organizations. The proposal, which includes requirements for multifactor authentication, data encryption, and routine vulnerability and breach scans, was posted to the Federal Register on Friday.
Furthermore, anti-malware protection for systems handling sensitive information will be mandated, network segmentation will be implemented, backup and recovery controls will be separated, and yearly audits will be conducted to ensure compliance with the law. Additionally, the new requirements will require that sensitive information systems be protected against malware, the network must be segmented, backup and recovery controls must be separate, and compliance with these requirements must be monitored annually.
Since healthcare organizations hold such sensitive data and provide critical services to society, they have become increasingly vulnerable to threat actors. As a result of this, organizations have become increasingly forced to pay large ransoms for their systems and information to continue to operate as a consequence of the attacks.
HHS' Office for Civil Rights (OCR) has proposed strict cybersecurity rules that will be published as a final rule within 60 days, and they will be issued by the Office of Civil Rights.
Under these regulations, healthcare organizations will be required to protect protected health information by encrypting it, using multifactor authentication, and segmenting their networks to prevent attackers from moving laterally through the networks.
It was announced on Thursday that Anne Neuberger, U.S. deputy national security advisor for cyber and emerging technology, said that it is necessary to establish these requirements in light of the huge number of Americans whose data was compromised due to large healthcare information breaches.
As part of the proposals, data will be encrypted so that it cannot be accessed, even if it is leaked, and compliance checks will be required to ensure networks are compliant with cybersecurity regulations.
Moreover, HHS has shared a fact sheet outlining the proposal, which will update the HIPAA Security Rule to include information about health insurance portability and accountability. It is expected that the public comment period will be open for 60 days.
Reuters reports that during a press briefing, US Deputy National Security Advisor Anne Neuberger stated the plan would cost $9 billion in the first year, and $6 billion in the subsequent four years, as outlined in a press briefing.
A significant increase in large-scale data breaches has taken place over the past few years, and just in the last year, the healthcare industry has been victimized by several large-scale cyberattacks, including hacking into the Ascension and UnitedHealth systems that have disrupted hospitals, doctors' offices, and pharmacies.
There has been a considerable amount of evidence over the years pointing to Chinese state-sponsored actors as responsible for cyberattacks on American companies and agencies.
There has been a massive hack on US telecom companies in the last year, which was blamed on "PRC-affiliated actors" by the FBI. According to The Post, the actors, known by the name Salt Typhoon, targeted the mobile phones of diplomats, government officials, and people associated with both presidential campaigns, allegedly. Chinese officials have called the allegations of their country participating in the attack on the Treasury Department "groundless" and emphasized that "the government has always been opposed to all hacker attacks," according to The Post.
Not only does not acting cost a lot of money, but it also endangers critical infrastructure and patients' safety and has other harmful consequences," says a recent statement by one of the largest private healthcare organizations in the country, Ascension Healthcare System. In May, a ransomware attack stole nearly 5.6 million people's personal and health information.
After the cyberattack, Ascension employees were inevitably forced to keep track of medications and procedures on paper because electronic patient records could no longer be accessed.
To prevent triage delays, the healthcare giant also took some devices offline and diverted emergency medical services to other hospitals.
As a result of a hacking attack on UnitedHealth Group, more than 100 million US customers were exposed to data that was sold on the dark web, causing significant disruption for patients and staff at the hospital.
The hospitals were forced to operate by hand. Neuberger asserted that Americans' sensitive healthcare data, mental health information, and other data are being "leaked onto the dark web with the possibility that individuals could be blackmailed as a result of the leak,"
