Senators debut bill to reduce healthcare cyberattacks
The bill was conceived after the Change Healthcare attack, which lawmakers cited as evidence of a lack of preparation and training.
Photo: Weiquan Lin/Getty Images
U.S. Senators Jacky Rosen (D-Nev.), Todd Young (R-Ind.) and Angus King (I-Me.) have introduced legislation intended to reduce the relentless amount of cyberattacks targeting the healthcare industry.
The Healthcare Cybersecurity Act was conceived after a ransomware attack on the health payment platform Change Healthcare, which senators said highlighted a lack of preparation and training during the recovery process.
Optum, a subsidiary of UnitedHealth Group, acquired Change in October 2022. The cyberattack was discovered on February 21. The company confirmed in April that it had paid a ransom to protect the health information of patients – to the tune of $22 million in bitcoin.
The bill would direct the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to collaborate on improving cybersecurity, and make resources available to nonfederal entities relating to cyber threat indicators and appropriate defense measures.
It would also create a special liaison to HHS within CISA to coordinate during cybersecurity incidents and collaborate to support healthcare and public health sector entities.
WHAT'S THE IMPACT?
Senator Rosen, in a statement, said the healthcare industry is still reeling from recent cyberattacks, and that rural organizations in her state of Nevada have been hit especially hard.
"It's imperative that we take measures to improve cybersecurity in the health care sector to prevent data breaches and protect Nevadans, which is why I'm introducing this bipartisan legislation," she said.
Senator King, cochair of the Cyberspace Solarium Commission, said healthcare cyberattacks are a growing threat across the country, including Maine, where several major health systems have been compromised in recent years.
"These attacks and breaches of data can literally mean the difference between life and death for patients, significantly impact hospital operations, and – with the average hack costing millions to address – increase healthcare prices across the board," said King. "The bipartisan Healthcare Cybersecurity Act will take important steps toward protecting patients' data and healthcare provider capabilities, and bolstering our cybersecurity infrastructure and response."
THE LARGER TREND
Following the cyberattack on Change Healthcare earlier this year, Rosen called on the HHS and CISA to put forth a plan to help healthcare systems respond to the incident and prevent future attacks.
She has introduced bipartisan bills to bolster the cybersecurity of medical devices and records from the Department of Veterans' Affairs, both of which were signed into law.
The HIMSS Healthcare Cybersecurity Forum is scheduled to take place October 31-November 1 in Washington, D.C. Learn more and register.
Jeff Lagasse is editor of Healthcare Finance News.
Email: jlagasse@himss.org
Healthcare Finance News is a HIMSS Media publication.
