U.S. Department of Health and Human Services in Washington, D.C. Photo: Michael A. Scarcella/ALM

In 2016, $6.2 billion was lost by U.S. health care systems because of data breaches, according to a new report by the U.S. Department of Health and Human Services. But the department is aiming to reduce that figure by providing voluntary cybersecurity practices to health care organizations of all sizes.

Dubbed “Health Insurance Cybersecurity Practices: Managing Threats and Protecting Patients,” the four-volume publication is the culmination of a two-year effort by 150 government and private health care and cybersecurity experts. The task force's work was legislatively mandated by a 2015 federal law that charges the group with analyzing and making recommendations regarding securing and protecting the health care sector against cybersecurity incidents.

“Given the increasingly sophisticated and widespread nature of cyberattacks, the health care industry must make cybersecurity a priority and make the investments needed to protect its patients,” the report stated.

The two volumes of the report discuss the 10 cybersecurity practices and subpractices for small health care organizations and medium-sized and large health care businesses, respectively. Both are intended for IT and/or IT security professionals.

“It is tempting for those who own a health care practice or are part of a small-to-medium–sized health care organization to think that cyberattacks only affect large hospitals and health care organizations,” the report said. “However, attackers [who targeted the health care industry] focused on smaller targets, resulting in a lower number of leaked records in that industry.”

A third portion of the report provides resources and templates, while its 36-page, anecdote- and statistic-laden main document discusses the current cybersecurity threats facing the health care industry and issues a call to action for the health care industry, especially executive decision makers, with the goal of raising general awareness of the issue.

“Like combatting a deadly virus, cybersecurity requires mobilization and coordination of resources across myriad public and private stakeholders, including hospitals, IT vendors, medical device manufacturers, and governments (state, local, tribal, territorial, and federal) to mitigate the risks and minimize the impacts of a cyberattack,” it said.

The document, its authors added, “does not create new frameworks, re-write specifications, or 'reinvent the wheel.'”

Rather, it attempts to “move the cybersecurity needle” by starting to “educate health sector professionals on an important and generally accepted language of cybersecurity and answering the prevailing question, 'Where do I start and how do I adopt certain cybersecurity practices?'”

Part of that process, the main document said, is understanding five of the most current and common cybersecurity threats to health care organizations, which the report identified as: e-mail phishing attack; ransomware attack; loss or theft of equipment or data; insider, accidental or intentional data loss; and attacks against connected medical devices that may affect patient safety.

“These threats can affect organizations in various parts of a hospital and in different health care settings,” according to the report. “Cyberattacks can happen anywhere, any time.”