As if it were not facing enough challenges, the health care industry is now becoming a more frequent target for hacking and ransomware by miscreants both domestic and foreign. Health care organizations have lagged behind other business sectors in protecting data, which is hard to understand given the extreme sensitivity of the data in their possession: personal and health information on individual patients; confidential information on internal quality assurance, risk management and utilization; results of clinical research on drugs, medical devices, and therapies; personal information on employees; sensitive internal financial information; confidential information on potential partnerships and deals with other organizations; and so on. Of even greater concern is the reality that hackers can interfere with web-connected medical equipment and devices and physically harm patients.
The Health Care Industry Cybersecurity Task Force, which was established by Congress in 2015, is comprised of representatives from both the government and private sector, and is charged with analyzing and making recommendations regarding securing and protecting the health care sector against cybersecurity incidents. S.754—114th Congress: Cybersecurity Information Sharing Act of 2015. The Task Force recently issued its “Report on Improving Cybersecurity in the Health Care Industry” (Report). The Report highlights the vulnerabilities to cyberattacks of organizations involved directly or indirectly in providing health care services and products, and makes recommendations to both the government and the industry to enhance awareness and improve protections.
