Building the Battlements: Strengthening Our Defense Against Cyberattacks

In centuries past, a strong and high wall surrounding a city was absolutely essential in maintaining a reasonable defense against invading marauders and other belligerents.  Notice the wall was not just around a few buildings or individual homes in a piecemeal fashion; rather, it encompassed the entire corporate entity.  This means there was an organized attempt by the political leaders to defend all their citizens against hostile forces. 

In the same way, many believe that there must be a concerted effort by the federal government to build a single protective wall around all of the nation’s healthcare facilities and related industries.  This, of course, would require legislation with clear standards and with teeth.  Well, that process may have begun last week in the United States Senate. 

Signs of Building 

On September 17th, U.S. Senators Mark R. Warner (D-VA) and Ron Wyden (D-OR) reintroduced the Health Infrastructure Security and Accountability Act (HISAA).  The legislation is designed to improve the security of the American healthcare system in a concerted effort to combat a marked increase in cyberattacks against critical medical infrastructures and databases.  Here’s how Senator Warner characterized the current situation and the bill itself: 

Cyberattacks on our healthcare system compromise Americans’ most sensitive personal information, delay essential medical care, and put lives at risk.  As cybercriminals ramp up their attacks on hospitals and healthcare providers, it’s becoming increasingly clear that voluntary standards are not enough to protect Americans’ health, safety and privacy.  This legislation would establish strong, commonsense cybersecurity protocols for healthcare entities, while also getting resources to rural and underserved hospitals to strengthen their defenses and protect the patients who depend on them. 

According to many experts, the American healthcare system is particularly prone to cyberattacks due to its size, dependence on technology, collection of sensitive personal information and susceptibility to disruptions.  Based on these vulnerabilities, many believe a set of basic federal standards is needed to defend against hackers and bad actors targeting medical facilities.  Enter HISAA.  But what would the legislation accomplish and require if passed?  The following provides a brief summary. 

Security Requirements 

HISAA would require the secretary of the U.S. Department of Health and Human Services (HHS), hereinafter, “Secretary,” to adopt within two years minimum and enhanced security requirements to protect health information and patient safety.  The minimum standards would apply to covered entities and business associates.  Enhanced security requirements would apply to covered entities that are of systemic importance or important to national security.  The Secretary would be required to update the standards not less than every two years.  

Reporting and Auditing 

Not later than three years after enactment, covered entities and business associates would be required to conduct and document a security risk analysis that includes the following: 

• Manner and extent to which such entity or associate is exposed to risk through its business associates. 

• Document a plan for a rapid and orderly resolution in the event of a natural disaster, disruptive cyber incident, or other technological failure of information. 

• Conduct a “stress test” to evaluate whether such entity or associate has the ability to recover essential functions. 

• Document whether, based on the stress test, any changes are made to the plan for a rapid and orderly resolution in the event of an incident. 

• Provide a written statement signed by the chief executive officer and chief information security officer attesting that the company is in compliance with the applicable security standards and requirements.  

Entities and associates subject to the enhanced security requirements would be required to submit these documents to the Secretary on an annual basis; all other entities would be required to provide the documentation upon request.  

Not later than six months after enactment, covered entities or business associates are required to contract with an independent auditor that meets such requirements set by the inspector general of HHS to assess its compliance with security requirements.  The Secretary is required to annually audit the data security practices of at least 20 covered entities or business associates.  

Penalties 

Those covered entities and business associates failing to comply with these requirements would be subject to fines no greater than $5,000 per day, and criminal penalties for whoever knowingly submits a report containing false information.  HISAA also imposes the following civil penalties: a minimum of $500 for no knowledge, $5,000 for reasonable cause, $50,000 for willful neglect corrected, and $250,000 for willful neglect uncorrected.  

For the full text of the bill, you can click here. 

Cyberthreats are not going away, and the nation’s health infrastructure is at increased risk.  This may mean that a serious national effort to build a cyber wall around the entire industry is finally warranted.