« Press Releases
  

EHNAC Applauds Health Care Industry Cybersecurity (HCIC) Task Force Report and Recommendations


 
 
The Electronic Healthcare Network Accreditation Commission (EHNAC), a non-profit standards development organization and accrediting body for organizations that electronically exchange healthcare data, today announced its support of the Health Care Industry Cybersecurity (HCIC) Task Force's June 2 report to Congress titled Report on Improving Cybersecurity in the Health Care Industry and the recommendations therein.

The Health Care Industry Cybersecurity (HCIC) Task Force was established by the Department of Health and Human Services (HHS) in March 2016 per the Cybersecurity Act of 2015, Section 405(c). EHNAC applauds HHS and the expert panel of subject matter experts on the HCIC Task Force who contributed to develop these recommendations to strengthen the privacy and security of U.S. healthcare data. The pace of technology is rapidly changing which coincides with increased threats and actual breach incidents occurring.

"The incidence of cyberattacks across healthcare have more than doubled in the last five years, and it's estimated that data breaches cost the healthcare industry $6.2 billion annually," said Lee Barrett, executive director, EHNAC. "This report - and most importantly its recommendations for action contained in Appendix A - together with the National Institute of Standards and Technology (NIST) framework, and the important work of accrediting and certification bodies such as HITRUST and EHNAC, can collectively contribute to transform the HCIC recommendations into attainable and operational actions across the healthcare industry."

Most importantly, the HCIC has identified within the report and recommendations the following premises:
  • Solutions must be appropriate for all healthcare organizations from the smallest single provider office to the most sophisticated and regulated business environment. EHNAC's multiple accreditation programs specialize in being flexible and scalable, whether dealing with a small office or a complex business.
  • Many regulations and best practices (including but not limited to HIPAA, ISO, NIST, FEDRAMP and others) already set forth methods to strengthen data protection. These should be further leveraged to apply to cybersecurity risk in areas that are not currently subject to such regulations (such as the Internet of Things and current wearable health/medical devices). In this mode, current standards and proven best practices could be extended. Much of the effort ahead is based upon our ability to identify those standards and best practices across our industry and communicate and educate others effectively about them.
Specific examples where the HCIC Report recommends scalability are as follows:
  • Recommendation 1.2 Action Item 1.2.3 - Industry and government should partner to establish an evaluation mechanism and prioritized best practices to support the range of small to large organizations to consistently apply the NIST Cybersecurity Framework.
  • Recommendation 1.4 Action Item 1.4.1 - Industry should establish scalable best practices for governance of cybersecurity across the health care industry.
  • Recommendation 3.4 Action Item 3.4.3 - Federal regulatory agencies should provide additional guidance to service providers (including HHS-compliant Business Associate Agreements) that wish to align their security management practices with HIPAA and create increased awareness among health care providers that alternative technologies exist to store, access share, and process their data.
  • Recommendation 3.4 Action Item 3.4.4 - Industry should develop user cases and contracts tailored for these small and medium-sized organizations.
Specific examples where the HCIC Report recommends education and communication are as follows:
  • Recommendation 4.1 Action Item 4.1.1 - Trade and professional associations should ensure cyber workforce training and education focuses on corporate officers and boards of Directors communication.
  • Recommendation 4.1 Action Item 4.1.2 - Trade and professional associations in the health care industry should develop materials for CISOs and security leaders to better communicate with executive level leadership and Boards of Directors regarding security risks, priorities, and cyber hygiene posture.
For more information on EHNAC's cybersecurity efforts within the industry, see the primer on "Cybersecurity Protection in Healthcare: How Accreditation Can Mitigate Your Risk" on the EHNAC website.


June 23, 2017


Topic Area: Press Release

Recent Posts

State of the Facilities Management Industry in 2025

Many facility managers cite budget constraints and the rise in operating concerns as their top concerns heading into the new year.

City of Hope to Open New Cancer Specialty Hospital in California

This 72-acre academic research campus offers patients access to the full continuum of advanced cancer care.

Montefiore Einstein Opening New Inpatient Center for Youth in the Bronx

New 21-bed inpatient pediatric mental health center adds critical care beds to address behavioral and mental health needs in the Bronx, nearly doubling inpatient capacity.

Skill Stacking: How Micro-Credentials Are Reshaping Trades

Micro-credentials can keep skilled trade workers up to speed with modern systems and complement longer, more formal training programs.

Prima Medicine Opens New Location in Tysons, Virginia

The Tysons location becomes Prima Medicine's fifth practice in the Washington metropolitan area.

 
 


FREE Newsletter Signup Form

News & Updates | Webcast Alerts
Building Technologies | & More!

 
 
 


All fields are required. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.