Create a cybersecurity leader role within HHS to align industry- facing efforts for health care cybersecurity.
Establish a consistent, consensus-based health care-specific Cybersecurity Framework
Require federal regulatory agencies to harmonize existing and future laws and regulations that affect health care industry cybersecurity.
Identify scalable best practices for governance of cybersecurity across the health care industry.
Explore potential impacts to the Physician Self-Referral Law, the Anti-Kickback Statute, and other fraud and abuse laws to allow large health care organizations to share cybersecurity resources and information with their partners.
Secure legacy systems.
Improve manufacturing and development transparency among developers and users.
Increase adoption and rigor of the secure development lifecycle (SDL) in the development of medical devices and EHRs.
Require strong authentication to improve identity and access management for health care workers, patients, and medical devices/EHRs.
Employ strategic and architectural approaches to reduce the attack surface for medical devices, EHRs, and the interfaces between these products.
Establish a Medical Computer Emergency Readiness Team (MedCERT) to coordinate medical device-specific responses to cybersecurity incidents and vulnerability disclosures.
Every organization must identify the cybersecurity leadership role for driving for more robust cybersecurity policies, processes, and functions with clear engagement from executives.
Establish a model for adequately resourcing the cybersecurity workforce with qualified individuals.
Create MSSP models to support small and medium-size health care providers
Small and medium-sized health care providers should evaluate options to migrate patient records and legacy systems to secure environments (e.g., hosted, cloud, shared computer environments).
Develop executive education programs targeting Executives and Boards of Directors about the importance of cybersecurity education.
Establish a cybersecurity hygiene posture within the health care industry to ensure existing and new products/systems risks are managed in a secure and sustainable fashion.
Establish a conformity assessment model for evaluating cybersecurity hygiene that regulatory agencies and industry could rely on, instead of a diversity of auditors.
The NIST Baldrige Cybersecurity Excellence Builder, should be further developed: 1) specific to health care, and 2) specific to the types of health care operations that are widely deployed across the industry and have limited access to cybersecurity resources (e.g., small hospitals or practices, rural locations with limited access to security resources).
Increase outreach and engagement for cybersecurity across federal, state, local, tribal, territorial, and the private sector partners through an education campaign including meetings, conferences, workshops, and tabletop exercises across regions and industry.
Provide patients with information on how to manage their health care data, including a cybersecurity and privacy grading system for consumers to make educated decisions when selecting services or products around non-regulated health care services and products.
Develop guidance for industry and academia on creating economic impact analysis and loss for cybersecurity risk for health care research and development.
Pursue research into protecting health care big data sets.
Tailor information sharing for easier consumption by small and medium-size organizations who rely on limited or part-time security staff.
Broaden the scope and depth of information sharing across the health care industry and create more effective mechanisms for disseminating and utilizing data.
Encourage annual readiness exercises by the health care industry.
Provide security clearances for members of the health care community.
HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE REPORT | June 2017
The Hill | Federal task force: Here’s how to fix healthcare cybersecurity