New bill would transform cybersecurity at Dept. of Health and Human Services

The HHS Cybersecurity Modernization Act comes in response to congressional hearings on the state of cybersecurity in the health care sector.

A bill aimed to reorganize and sharply focus cybersecurity at the Department of Health and Human Services (HHS) was reintroduced on Wednesday by Reps. Billy Long, R-Miss., and Doris Matsui, D-Calif.

The HHS Cybersecurity Modernization Act comes in response to congressional hearings on the state of cybersecurity in the health care sector. A recent federal task force report on the state of hospital cybersecurity was starkly negative in its diagnosis.

“Many organizations cannot afford to retain in-house information security personnel, or designate an information technology (IT) staff member with cybersecurity as a collateral duty,” the task force reported. “These organizations often lack the infrastructure to identify and track threats, the capacity to analyze and translate the threat data they receive into actionable information, and the capability to act on that information.”

Critics say the federal effort toward cybersecurity in the health care sector lacks clear leadership and focus.

The new legislation would grant the chief information security officer increased responsibility and power and create a health care threat coordination center. It would also require the secretary of Health and Human Services to develop and submit a plan to Congress on how the HHS coordinates on cybersecurity challenges, the role of a CISO on internal HHS security versus improving health sector security at large, and on challenges the agency faces as a regulator involved in cybersecurity for the sector.

Across industries, private companies have hesitated or refused to share cybersecurity intelligence with regulators for fear of negative consequences. It remains to be seen how HHS will deal with this.

“We can always do more to boost our cybersecurity efforts, and while HHS has made some important strides in this effort, we think more can and should be done to help protect the sensitive information the department holds,” Long and Matsui said in a joint statement. “We are particularly hopeful for the results that could yield from HHS detailing such a plan and look forward to continued efforts to address potential cyber threats.”

Earlier this year, the WannaCry ransomware attack rippled through British National Health Service machines. At a June hearing, the HHS response was positively received.

“Clearly, the sector needs leadership,” said Energy and Commerce Committee Chairman Greg Walden, R-Ore. “HHS is uniquely situated to fill this void. Historically, the Department has struggled to effectively embrace this responsibility, but that trend cannot continue,” he went on, adding “The Department’s actions in response to the WannaCry ransomware — coordinated through the newly established HCCIC — have generally received praise from the sector.”

The US has seen its own share of health care cybersecurity disasters.

A hospital paid $17,000 in ransom in 2016 when hackers owned the institution’s machines with ransomware. The 40 bitcoin ransom is worth about $275,000 today.  More than 158 other hospitals reported major breaches to the federal government since 2010.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure