As if it were not facing enough challenges, the health care industry is now becoming a more frequent target for hacking and ransomware by miscreants both domestic and foreign. Health care organizations have lagged behind other business sectors in protecting data, which is hard to understand given the extreme sensitivity of the data in their possession: personal and health information on individual patients; confidential information on internal quality assurance, risk management and utilization; results of clinical research on drugs, medical devices, and therapies; personal information on employees; sensitive internal financial information; confidential information on potential partnerships and deals with other organizations; and so on. Of even greater concern is the reality that hackers can interfere with web-connected medical equipment and devices and physically harm patients.

The Health Care Industry Cybersecurity Task Force, which was established by Congress in 2015, is comprised of representatives from both the government and private sector, and is charged with analyzing and making recommendations regarding securing and protecting the health care sector against cybersecurity incidents. S.754—114th Congress: Cybersecurity Information Sharing Act of 2015. The Task Force recently issued its “Report on Improving Cybersecurity in the Health Care Industry” (Report). The Report highlights the vulnerabilities to cyberattacks of organizations involved directly or indirectly in providing health care services and products, and makes recommendations to both the government and the industry to enhance awareness and improve protections.

Industry

The Report begins by describing the industry as a “mosaic” of large health care systems, physician practices, public and private payors (e.g., Medicare, Medicaid, private insurers and plans), research institutions, medical device developers and manufacturers, software companies, as well as a large and diverse population of patients. It observes that the continuing evolution of electronic health records and the health care industry's extensive connectivity to the Internet have led to major improvements in both the quality and timeliness of patient care. The Report notes that the downside to these advances is that they have resulted in an increased attack surface for health care providers, medical device companies, and many other parts of the health care industry. The Report emphasizes that securing health care data as well as securing the operation of medical devices is essential to protecting patients and providing them with the highest level of medical care.

Turning to the reality of cybersecurity and preparedness in the industry, the Report found that many health care organizations