Healthcare providers in the US may soon need to ramp up their cybersecurity efforts, thanks to new proposals from the US Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR).
The proposed measures include implementing multi-factor authentication and encrypting patient data to protect it in case of a data breach. Organizations in the healthcare sector would also have to undergo compliance checks to ensure they meet cybersecurity standards.
While industry players, like healthcare firms, have the opportunity to provide feedback during the 60-day public comment period, the changes won’t come cheap. According to Reuters, Anne Neuberger, the US deputy national security advisor for cyber and emerging technology, estimates that the proposals could cost $9 billion in the first year and $6 billion in the following two years.
Neuberger emphasized the rise of ransomware in the healthcare industry, noting that large breaches from hacking and ransomware have increased significantly since 2019. She also highlighted the concerning trend of healthcare data being traded on the dark web for blackmail purposes.
These proposals come in response to a series of high-profile data breaches in the healthcare sector, which have exposed the personal information of millions of Americans and disrupted patient care. In one instance, a ransomware attack on UnitedHealth subsidiary Change Healthcare exposed the data of over 100 million individuals and disrupted pharmacy services and billing.
In another incident, healthcare provider Ascension experienced a cyberattack that took down IT systems at multiple hospitals, leading doctors to resort to pen-and-paper records.
According to Change Healthcare’s CEO Andrew Witty, hackers exploited compromised credentials to access a Citrix portal used for remote desktop access. Witty noted that the portal lacked multi-factor authentication, a security measure that would be required under the new proposals.