Healthcare Cyber Invoice Requires ‘Company Accountability’

A pair of Democrat senators are proposing stricter security mandates for healthcare sector entities. The bill provides funding to help hospitals adopt enhanced requirements, but it lifts the cap on HIPAA enforcement fines and holds top executives accountable with threats of financial penalties and prison time for falsely attesting their organizations’ compliance in security audits.

See Also: Identity Security Trailblazers – Health First

The Well being Infrastructure Safety and Accountability Act, unveiled on Thursday by Senate Finance Committee Chair Ron Wyden, D-Ore., and Sen. Mark Warner, D-Va., is the newest – however most sweeping – of a number of payments launched into Congress this 12 months that purpose to bolster healthcare sector cybersecurity – particularly following the massively disruptive cyberattack on Change Healthcare in February.

Not like among the other latest healthcare cybersecurity proposals launched by lawmakers which have bipartisan sponsorship, the Wyden-Warner invoice doesn’t but have a Republican co-sponsor (see: CISA, HHS Would Team Up in Health Sector Under House Bill).

In any case, the probability of the Wyden-Warner invoice – or any of the opposite proposed payments – gaining traction throughout election season might be fairly low, some specialists mentioned.

“I’m not assured this laws will transfer out of committee as a result of present political and geopolitical points dealing with the sponsors of the invoice and all legislators,” mentioned Todd Weber, vice chairman {of professional} providers at safety agency Semperis.

In the meantime, the U.S. Division of Well being and Human Providers is already engaged on proposed rulemaking anticipated by year-end to change the HIPAA Safety Rule and strengthen the cybersecurity of digital protected well being info (see: They’re Back: HHS OCR Plans to Resurrect Random HIPAA Audits).

HHS additionally can be engaged on associated laws that may mandate sure important and enhanced cybersecurity performance goals for healthcare sector entities – largely doubtless hospitals – that could possibly be tied to Medicare funds (see: Feds Wave Sticks, Carrots at Health Sector to Bolster Cyber).

“With hacks already concentrating on establishments throughout the nation, it’s time to transcend voluntary requirements and guarantee healthcare suppliers and distributors get severe about cybersecurity and affected person security,” Warner mentioned in an announcement.

Wyden-Warner Proposals

Below the Wyden-Warner invoice, HHS is required to undertake enhanced minimal safety necessities inside two years “to guard well being info, defend affected person security, and make sure the availability and resiliency of healthcare info programs and healthcare transactions.”

The minimal requirements would apply to all lined organizations and enterprise associates, whereas the improved safety necessities would pertain to lined entities and enterprise associates which can be “of systemic significance,” or are vital to nationwide safety, as decided by HHS and CISA.

The invoice additionally proposes necessary safety audits, together with HHS yearly auditing the information safety practices of at the very least 20 lined entities or enterprise associates. In deciding on organizations for audit, HHS “shall take into account whether or not the entity is of systemic significance, complaints made with respect to the information safety practices, and historical past of earlier violations.”

Failure by lined entities and enterprise associates to adjust to the auditing necessities “can be topic to fines no better than $5,000 per day, and felony penalties for whoever knowingly submits a report containing false info.”

Additionally, the invoice creates civil cash penalties for violations of safety requirements and necessities starting from $500 for “no information” of the noncompliance to $250,000 for willful neglect uncorrected.

The invoice additionally goals to “improve company accountability” by requiring high executives to yearly certify compliance with the necessities. “Congress already requires execs to log off on monetary statements, as a part of Sarbanes-Oxley, and it’s a felony to deceive the federal government,” mentioned a fact sheet concerning the Wyden-Warner invoice.

Below the laws, people who “submit, or causes to be submitted, any documentation or report required of a lined entity or enterprise affiliate” associated to the necessary safety compliance audits would face fines of as much as $1 million and/or imprisonment for as much as 10 years, if convicted.

“The healthcare trade has among the worst cybersecurity practices within the nation regardless of its crucial significance to Individuals’ well-being and privateness,” Wyden mentioned in an announcement. “These commonsense reforms, which embrace jail time for CEOs that deceive the federal government about their cybersecurity, will set a course to beef up cybersecurity amongst healthcare firms throughout the nation and stem the tide of cyberattacks that threaten to cripple the American healthcare system,” he mentioned.

If something, the invoice is once more placing a highlight on crucial healthcare cybersecurity points, some specialists mentioned.

“I feel that this proposal within the invoice will assure that cybersecurity is a standing agenda merchandise on all board of administrators conferences,” mentioned Toby Gouker, chief safety officer of presidency and scientific innovation at consulting agency First Well being Advisory.

The invoice’s different proposals embrace offering $800 million in up-front funding funds over two years for two,000 rural and concrete security internet hospitals to undertake important cybersecurity commonplace; and $500 million to incentivize all hospitals to undertake enhanced cybersecurity practices.

Hospitals can be topic to a Medicare fee penalty if they don’t undertake these enhanced practices after two years.

“Sadly, I do assume that consequential fines will make boards, CEOs and CFOs pay extra consideration to the dangers that not addressing cybersecurity current,” mentioned former healthcare CIO David Finn, govt vice chairman of governance, danger and compliance at First Well being Advisory.

“Change Well being, Ascension, and the CrowdStrike outages have created plenty of dialogue about controls, third-party danger, and the large operational and monetary impacts of ‘shutting down,'” he mentioned.

“On the finish of the day, you both pay to do safety up entrance, otherwise you pay after the occasion to repair it. Fixing issues after an outage will all the time value greater than doing it accurately and addressing your safety and resiliency earlier than you might be depending on some new expertise.”