HHS releases concept paper on cybersecurity for healthcare sector

Editor's Note

The US Department of Health and Human Services (HHS) released a new concept paper on the department’s strategy regarding cybersecurity for the healthcare sector, a December 6 HHS press release reports. The paper details four pillars for action: 

• publishing new voluntary healthcare-specific cybersecurity performance goals
• working with Congress to develop resources and incentives for hospitals to improve cybersecurity
• implementing an HHS-wide strategy to increase enforcement and accountability
• expanding and refining the “one-stop shop” within HHS for healthcare sector cybersecurity and coordination within the healthcare sector.

The agency notes that cyber incidents in healthcare are increasing. From 2018 to 2022, there was a 93% increase in large breaches reported (369 to 712), with a 278% increase in large breaches involving ransomware. These cyber incidents have had serious consequences, including disrupted care, the need to divert patients to other facilities, and delayed medical procedures.