Audit slams HHS' cybersecurity oversight

​The U.S. Department of Health and Human Services' oversight of privacy and cybersecurity regulations in the healthcare sector is deeply flawed, even as the agency is promoting the online digitization and storage of Americans' health records, according to congressional investigators.

The U.S. Department of Health and Human Services’ oversight of privacy and cybersecurity in the healthcare sector is deeply flawed, even as the agency is promoting the online digitization and storage of Americans’ health records, according to congressional investigators.

HHS regulates the security and privacy of healthcare records — generally considered highly valuable and private forms of personal data. The department also has an Office of Civil Rights charged with auditing healthcare insurers’ and providers’ compliance with those rules, as well investigating security and privacy complaints. Nearly 18,000 of the latter were received in 2014.

But in some cases it investigated, OCR “provided technical assistance that was not pertinent to identified problems, and in other cases it did not always follow up to ensure that agreed-upon corrective actions were taken once investigative cases were closed,” reported the Government Accountability Office this week.

Of the 18,000 complaints it received in 2014, OCR closed 89 percent of them without investigation, GAO found. “Of the remaining 11 percent, four percent had no violation found after investigation and seven percent resulted in corrective action.”

Moreover, GAO auditors concluded, OCR had no metrics for assessing “the effectiveness of its audit program” which was not yet fully operational.

HHS investigations have revealed that healthcare providers and insurers “have struggled to select appropriate security and privacy controls,” auditors concluded, especially with regard to mandatory risk assessments. But the department’s cybersecurity guidance to regulated companies did not align with the NIST Cybersecurity Framework — considered the gold standard for critical infrastructure cybersecurity.

HHS officials, in comments on the report included in an appendix, agreed that their guidance should “more fully address the implementation of controls described in the NIST Cybersecurity Framework.” But they pointed out the “extreme diversity” of the healthcare organizations covered by their rules — from a single doctor’s practice, through small local clinics, to multi-national hospital networks and insurance companies.

Any new guidance, HHS said, must be “flexible and scalable …[and] technology neutral.” OCR would work on revising guidance “to the extent feasible, given … resource constraints and other priorities.”

And the department’s supporters agree that OCR isn’t really resourced for such a huge role.

“Given the rising incidence of cyberattacks on health organizations across the country, we need to make sure that HHS has the resources and support it needs to implement security tools that will protect personal information, whether it be held by patients, families, providers, or insurers,” Sen. Patty Murray, D-Wash, told FedScoop in an email. Murray is ranking member of the Senate Health, Education, Labor, and Pensions Committee.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure