FTC, others call for action on ransomware in healthcare, improved cybersecurity preparedness

A member of the U.S. House of Representatives and a Federal Trade Commission official have called for greater protections against and notification of ransomware attacks – and bolstered cybersecurity for healthcare overall.

These calls come on the heels of an increasing number of ransomware attacks in healthcare, including high-profile ones against Methodist Hospital in Kentucky and Hollywood Presbyterian Medical Center in California.

[Also: Methodist Hospital recovering from five day ransomware attack, claims it did not pay up]

The HITECH Act has "cybersecurity requirements and requires notification for data breaches, but the law says nothing about notification for data that is frozen or held hostage where it is stored," said Rep. Ted Lieu, D-Calif., referring specifically to ransomware attacks.

Lieu, speaking at a joint hearing yesterday of the House Subcommittee on Information Technology and the House Subcommittee on Health Care, Benefits and Administrative Rules, added that healthcare requires "some combination of regulation and forcible guidance to protect the public."

The FTC shares the concerns of the subcommittees over the need to protect the privacy and security of consumers' health data, according to a statement it issued to the committee.

"Although the agency is using a variety of tools to promote better privacy and security of this data, additional tools would enhance the agency's ability to protect consumers," the statement read. "To this end, the commission reiterates its longstanding, bipartisan call for federal legislation that would (1) strengthen its existing data security authority and (2) require companies, in appropriate circumstances, to provide notification to consumers when there is a security breach."

[Also: Experts: Data, devices, employees pose biggest challenges to hospital cybersecurity]

"Legislation in both areas – data security and breach notification – should give the FTC the ability to seek civil penalties to help deter unlawful conduct, jurisdiction over non-profits, and rulemaking authority under the Administrative Procedure Act."

FTC is especially concerned over the proliferation of health data thanks to such advancements as consumer healthcare apps and patient portals, which, among other things, can potentially open doors for attackers to launch ransomware attacks on organizations.

"Consumers are increasingly taking a more active role in managing their health data," the FTC statement read. "It seems like every day a company announces a new health-related app, device or service. In addition, consumers are downloading their medical information into personal health records and using this information to make decisions about their health. Much of this activity now takes place outside of doctors' offices and other traditional medical contexts, and the tremendous growth in this area is not slowing down. These products and services also raise privacy and security concerns."

[Also: Hackers take aim at two more California hospitals]

Healthcare cybersecurity experts say threats to healthcare organizations are only getting worse, especially threats from ransomware attacks. This is especially so because other industries such as retail and finance have learned lessons and bolstered cybersecurity, so hackers are setting their sights on healthcare, which has not yet invested heavily in cybersecurity like other industries.

"Ransomware has been an inconvenient truth for a while, a tried and tested dance where an attack is launched and the ransom is modest, just enough where many organizations just pay it to make the problem go away," said Ryan Witt, vice president and managing director of the healthcare industry practice at Fortinet Inc., an information security technology vendor.

"However, demands for funds are soaring, and the problem is organizations are paying," he added. "Ransomware will get worse before it gets better. You don't want to think of return on investment as it pertains to criminal activity, but there is a strong ROI, and these attackers are quite sophisticated and know there is money to be made."

Twitter: @SiwickiHealthIT