EHNAC Applauds Health Care Industry Cybersecurity (HCIC) Task Force Report and Recommendations

The Electronic Healthcare Network Accreditation Commission (EHNAC), a non-profit standards development organization and accrediting body for organizations that electronically exchange healthcare data, today announced its support of the Health Care Industry Cybersecurity (HCIC) Task Force's June 2 report to Congress titled Report on Improving Cybersecurity in the Health Care Industry and the recommendations therein.

The Health Care Industry Cybersecurity (HCIC) Task Force was established by the Department of Health and Human Services (HHS) in March 2016 per the Cybersecurity Act of 2015, Section 405(c). EHNAC applauds HHS and the expert panel of subject matter experts on the HCIC Task Force who contributed to develop these recommendations to strengthen the privacy and security of U.S. healthcare data. The pace of technology is rapidly changing which coincides with increased threats and actual breach incidents occurring.

"The incidence of cyberattacks across healthcare have more than doubled in the last five years, and it's estimated that data breaches cost the healthcare industry $6.2 billion annually," said Lee Barrett, executive director, EHNAC. "This report - and most importantly its recommendations for action contained in Appendix A - together with the National Institute of Standards and Technology (NIST) framework, and the important work of accrediting and certification bodies such as HITRUST and EHNAC, can collectively contribute to transform the HCIC recommendations into attainable and operational actions across the healthcare industry."

Most importantly, the HCIC has identified within the report and recommendations the following premises:

Solutions must be appropriate for all healthcare organizations from the smallest single provider office to the most sophisticated and regulated business environment. EHNAC's multiple accreditation programs specialize in being flexible and scalable, whether dealing with a small office or a complex business.
Many regulations and best practices (including but not limited to HIPAA, ISO, NIST, FEDRAMP and others) already set forth methods to strengthen data protection. These should be further leveraged to apply to cybersecurity risk in areas that are not currently subject to such regulations (such as the Internet of Things and current wearable health/medical devices). In this mode, current standards and proven best practices could be extended. Much of the effort ahead is based upon our ability to identify those standards and best practices across our industry and communicate and educate others effectively about them.

Specific examples where the HCIC Report recommends scalability are as follows:

Recommendation 1.2 Action Item 1.2.3 - Industry and government should partner to establish an evaluation mechanism and prioritized best practices to support the range of small to large organizations to consistently apply the NIST Cybersecurity Framework.
Recommendation 1.4 Action Item 1.4.1 - Industry should establish scalable best practices for governance of cybersecurity across the health care industry.
Recommendation 3.4 Action Item 3.4.3 - Federal regulatory agencies should provide additional guidance to service providers (including HHS-compliant Business Associate Agreements) that wish to align their security management practices with HIPAA and create increased awareness among health care providers that alternative technologies exist to store, access share, and process their data.
Recommendation 3.4 Action Item 3.4.4 - Industry should develop user cases and contracts tailored for these small and medium-sized organizations.

Specific examples where the HCIC Report recommends education and communication are as follows:

Recommendation 4.1 Action Item 4.1.1 - Trade and professional associations should ensure cyber workforce training and education focuses on corporate officers and boards of Directors communication.
Recommendation 4.1 Action Item 4.1.2 - Trade and professional associations in the health care industry should develop materials for CISOs and security leaders to better communicate with executive level leadership and Boards of Directors regarding security risks, priorities, and cyber hygiene posture.

For more information on EHNAC's cybersecurity efforts within the industry, see the primer on "Cybersecurity Protection in Healthcare: How Accreditation Can Mitigate Your Risk" on the EHNAC website.

June 23, 2017

Topic Area: Press Release

EHNAC Applauds Health Care Industry Cybersecurity (HCIC) Task Force Report and Recommendations

Recent Posts

Disinfectant Dispensers in Healthcare Facilities Often Fail to Deliver Safe Concentrations: Study

Duke University Health System Receives $50 Million for Proton Beam Therapy Center

UT Southwestern Experiences Data Breach Through Calendar Tool

Protecting Patient Data: Strategies and Tactics

Duke Health to Acquire Lake Norman Regional Medical Center