« Press Releases
  

EHNAC Applauds Health Care Industry Cybersecurity (HCIC) Task Force Report and Recommendations


 
 
The Electronic Healthcare Network Accreditation Commission (EHNAC), a non-profit standards development organization and accrediting body for organizations that electronically exchange healthcare data, today announced its support of the Health Care Industry Cybersecurity (HCIC) Task Force's June 2 report to Congress titled Report on Improving Cybersecurity in the Health Care Industry and the recommendations therein.

The Health Care Industry Cybersecurity (HCIC) Task Force was established by the Department of Health and Human Services (HHS) in March 2016 per the Cybersecurity Act of 2015, Section 405(c). EHNAC applauds HHS and the expert panel of subject matter experts on the HCIC Task Force who contributed to develop these recommendations to strengthen the privacy and security of U.S. healthcare data. The pace of technology is rapidly changing which coincides with increased threats and actual breach incidents occurring.

"The incidence of cyberattacks across healthcare have more than doubled in the last five years, and it's estimated that data breaches cost the healthcare industry $6.2 billion annually," said Lee Barrett, executive director, EHNAC. "This report - and most importantly its recommendations for action contained in Appendix A - together with the National Institute of Standards and Technology (NIST) framework, and the important work of accrediting and certification bodies such as HITRUST and EHNAC, can collectively contribute to transform the HCIC recommendations into attainable and operational actions across the healthcare industry."

Most importantly, the HCIC has identified within the report and recommendations the following premises:
  • Solutions must be appropriate for all healthcare organizations from the smallest single provider office to the most sophisticated and regulated business environment. EHNAC's multiple accreditation programs specialize in being flexible and scalable, whether dealing with a small office or a complex business.
  • Many regulations and best practices (including but not limited to HIPAA, ISO, NIST, FEDRAMP and others) already set forth methods to strengthen data protection. These should be further leveraged to apply to cybersecurity risk in areas that are not currently subject to such regulations (such as the Internet of Things and current wearable health/medical devices). In this mode, current standards and proven best practices could be extended. Much of the effort ahead is based upon our ability to identify those standards and best practices across our industry and communicate and educate others effectively about them.
Specific examples where the HCIC Report recommends scalability are as follows:
  • Recommendation 1.2 Action Item 1.2.3 - Industry and government should partner to establish an evaluation mechanism and prioritized best practices to support the range of small to large organizations to consistently apply the NIST Cybersecurity Framework.
  • Recommendation 1.4 Action Item 1.4.1 - Industry should establish scalable best practices for governance of cybersecurity across the health care industry.
  • Recommendation 3.4 Action Item 3.4.3 - Federal regulatory agencies should provide additional guidance to service providers (including HHS-compliant Business Associate Agreements) that wish to align their security management practices with HIPAA and create increased awareness among health care providers that alternative technologies exist to store, access share, and process their data.
  • Recommendation 3.4 Action Item 3.4.4 - Industry should develop user cases and contracts tailored for these small and medium-sized organizations.
Specific examples where the HCIC Report recommends education and communication are as follows:
  • Recommendation 4.1 Action Item 4.1.1 - Trade and professional associations should ensure cyber workforce training and education focuses on corporate officers and boards of Directors communication.
  • Recommendation 4.1 Action Item 4.1.2 - Trade and professional associations in the health care industry should develop materials for CISOs and security leaders to better communicate with executive level leadership and Boards of Directors regarding security risks, priorities, and cyber hygiene posture.
For more information on EHNAC's cybersecurity efforts within the industry, see the primer on "Cybersecurity Protection in Healthcare: How Accreditation Can Mitigate Your Risk" on the EHNAC website.


June 23, 2017


Topic Area: Press Release

Recent Posts

Case Study: How NYU Langone Rebuilt for Resilience After Superstorm Sandy

Although the damage was severe, it provided a valuable opportunity for NYU Langone to assess structural vulnerabilities and increase facility resilience.

Frederick Health Hospital Faces 5 Lawsuits Following Ransomware Attack

The lawsuits accuse FHH of inadequate cybersecurity, poor breach notification and failing to protect patients from identity theft risks.

Arkansas Methodist Medical Center and Baptist Memorial Health Care to Merge

They have signed a non-binding letter of intent to complete a shared mission agreement to merge the two organizations.

Ground Broken on Intermountain Saratoga Springs Multi-Specialty Clinic

The clinic is scheduled to open and start seeing patients in the fall of 2026.

Electrical Fire Tests Resilience of Massachusetts Hospital

Signature Healthcare Brockton Hospital used opportunity to renovate key systems and components and expand facility operations.

 
 


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!

 
 
 


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.