Frank Konkel | Nextgov | April 4, 2017 | 0 Comments

Health Industry Needs Government Go-To for Cyber Threats, Expert Says

ESB Professional/

Congress is worried cybersecurity measures aren’t keeping up with technological advances in the health care industry and evolving medical devices, potentially putting millions of Americans at risk.

“The cost of inaction is too great,” said Rep. Frank Pallone, D-N.J., a member of the Energy and Commerce Committee’s Oversight and Investigations subcommittee. The subcommittee convened Tuesday to assess cybersecurity risks in health care and explore the use of more public-private partnerships to combat the problem.

Yet, much of the conversation revolved around just how much the cyber risk has increased in health care.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

“We’ve seen the headlines,” Pallone added, citing more than a dozen “ransomware” attacks on hospitals carried out last year.

In ransomware attacks, hackers exploit a security vulnerability to hold a hospital hostage in exchange for financial gain or other benefits. These attacks are becoming more frequent in part because rural hospitals, which sometimes lack funding of larger health care organizations in urban areas, are proving easier targets.

“The cyber threat surface has ballooned,” said Denise Anderson, president of the National Health Information Sharing and Analysis Center. NHISAC is a community of critical infrastructure owners and operators in the health care sector that shares information regarding cyber threats and mitigation strategies.

“The focus has traditionally been on data and privacy, but if organizations cannot deliver services—as seen in ransomware attacks—or if data is destroyed, the system is at risk,” Anderson said.

Subcommittee Chairman Tim Murphy, R-Pa., admitted government is unlikely to “stop every attack,” but sought solutions to reduce risks as the complexity of modern society grows. The influx and mass sharing of electronic health records and complexity of new internet-connected medical devices will only increase the attack vector further, he said.

Aside from simply promoting the existence of NHISAC and therefore further populating a forum whereby best practices and other relevant data can be exchanged, Anderson said the government would be wise to “establish cyber professionals as liaisons to industry.” In other words, the government and leading health care organizations ought to hire more cyber talent who understand the threats and how to mitigate them.

“Having an established go-to lead in this area is imperative,” said Anderson, adding automation of information sharing between appropriate parties could also improve security. In such a scenario, data regarding an attack—who, what and how of the attack—occurring on a member health care organization would be shared confidentially with other members so they could patch their systems.

Terry Rice, vice president of IT Risk Management at Merck & Co., also called for more cyber talent in government. Rice, who believes the number of attacks on health care organizations is significantly underrepresented, called on the Health and Human Services Department to “appoint a senior cyber executive” to engage as a government-lead in industry.

Rice also called upon HHS to work with federal partners to develop a cybersecurity protection plan for the health care industry. Each of the 16 critical infrastructures in the U.S. is tasked with developing sector-specific plans and updating them every few years, with federal agencies taking the lead role in coordinating those efforts. The health care sector plan, which includes how to deal with everything from “a pandemic flu to health care delivery in natural disasters,” Rice said, only dedicated two pages for its cybersecurity guidance.

“While the material in there is helpful, it needs to be significantly expanded, particularly for small entities that don’t have large security teams or professionals in their organizations,” Rice said.


Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.