Hospitals and other health care organizations are attractive targets for cyber-attacks, in part because their databases contain medical records and other sensitive information. Breaches of this information could have very serious implications for patients.  Moreover, electronics connected to a health care facility’s network keep people alive, distribute medicines, and monitor vital signs. As a result, disruption to the operations of health care facilities could pose a very real risk to health and safety.  Such risks are becoming more than theoretical.  For instance, the WannaCry attack disrupted a third of the United Kingdom’s Health Service organizations by cancelling appointments and disturbing operations.

In recognition of the imperative for cybersecurity in the health care sector, in late December 2018 the Department of Health and Human Services (“HHS”) released voluntary cybersecurity guidance, titled “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” (“HHS Cybersecurity Guidance”).  The HHS Cybersecurity Guidance is intended to shepherd healthcare organizations through the process of planning for and implementing cybersecurity controls. It was authored by the Health Sector Coordinating Council, comprised of more than 150 cybersecurity and healthcare experts from government and industry, and was required by Section 405(d) of the Cybersecurity Act of 2015.

Understanding that the needs and resources of different-sized health care organizations will differ, the HHS Cybersecurity Guidance divides its recommendations into those directed at small, medium, and large organizations and targets specific types of threats: email phishing attacks; ransomware; loss or theft of equipment or data; insider, accidental or intentional data loss; and attacks against connected medical devices that may affect patient safety.  Within each set of recommendations, each volume includes the ten most effective cybersecurity practices identified by the task force group to mitigate current threats and 88 Sub-Practices and implementation recommendations.  As an example, the cybersecurity practice “Asset Management” is accompanied by the following Sub-Practices: inventory, procurement, and decommissioning.  The document emphasizes that HHS does not intend to “reinvent the wheel” and made concerted efforts to leverage the NIST Cybersecurity Framework.  Because not all Sub-Practices will be effective for every hospital, clinic, and physician’s office, the HHS Cybersecurity Guidance recommends that organizations use the HHS Cybersecurity Guidance toolkit to conduct a review to determine the appropriate controls for that particular organization. The HHS Cybersecurity Guidance identifies what the authors believe to be the ten most effective cybersecurity practices:

• Email Protection Systems
• Endpoint Protection Systems
• Access Management
• Data Protection and Loss Prevention
• Asset Management
• Network Management
• Vulnerability Management
• Incident Response
• Medical Device Security
• Cybersecurity Policies

The HHS Cybersecurity Guidance comes amidst increased scrutiny by regulators over healthcare organizations’ cyber practices.  In October 2018, Anthem, Inc., agreed to pay the HHS Office for Civil Rights (“OCR”) $16 million and take substantial corrective action to settle regulatory enforcement after a series of cyberattacks led to the largest U.S. health data breach in history.  In the resolution agreement, HHS concluded that Anthem failed to conduct an enterprise-wide risk assessment, had insufficient procedures to regularly review information system activity, failed to identify and respond to suspected or known security incidents, and failed to implement adequate minimum access controls to prevent cyber-attackers from accessing sensitive data.  A cyber-attack compromised a network holding information for 4.5 million patients at the UCLA Health System in 2015.  A 2013 data breach at the University of Washington Medicine medical group, which exposed about 90,000 patients’ records and resulted in a $750,000 settlement with federal regulators, occurred after an employee downloaded an email attachment that contained malicious malware that compromised the organization’s IT system.  In light of these breaches, OCR Director Roger Severino said: “We know that large health care entities are attractive targets for hacks, which is why they are expected to have strong password policies and to monitor and respond to security incidents in a timely fashion or risk enforcement by OCR.”

It appears that courts are directing more attention to healthcare cyber controls, as well. A recent ruling by the Pennsylvania Supreme Court, issued November 21, 2018, found that an employer may be liable when it undertakes to protect the sensitive personal information of its employees.  Plaintiffs claimed the University of Pittsburgh Medical Center should be liable for a cyber-attack that compromised sensitive data of its employees.  The court found that the employer had a common law duty to exercise “reasonable care” to protect the data.

In the HHS Cybersecurity Guidance, HHS compares cybersecurity to fighting a deadly virus — it demands mobilization and coordination of resources across public and private stakeholders to mitigate risks and minimize impacts of a cyber-attack on a healthcare organization. Given the increased enforcement against healthcare organizations and the large costs associated with data breaches, healthcare organizations may want to critically examine their cyber practices and processes in light of the recent HHS Cybersecurity Guidance in order to mitigate vulnerabilities and legal risk.