Stronger cyber protections in health care targeted in new Senate bill

The bipartisan legislation from four senators is aimed at strengthening providers’ cyber defenses and protecting Americans’ health data.

Protecting Americans’ health data and strengthening cybersecurity protections throughout the health care sector is the focus of a bill introduced Friday from a bipartisan quartet of Senate lawmakers.

The Health Care Cybersecurity and Resiliency Act of 2024 (S.5390) is the culmination of a yearlong effort from Sens. Bill Cassidy, R-La., Maggie Hassan, D-N.H., John Cornyn, R-Texas, and Mark Warner, D-Va., who formed a working group in November 2023 to examine cyber issues in health care.

Under the umbrella of the Senate Health, Education, Labor and Pensions Committee, the senators aimed to address a staggering stat from the Health and Human Services Department, which found that 89 million Americans’ health information was breached last year, more than twice as many as in 2022.  

“In an increasingly digital world, it is essential that Americans’ health care data is protected,” Cornyn said in a statement. “This commonsense legislation would modernize our health care institutions’ cybersecurity practices, increase agency coordination, and provide tools for rural providers to prevent and respond to cyberattacks.” 

Said Cassidy: “Cyberattacks on our health care sector not only put patients’ sensitive health data at risk but can delay life-saving care. This bipartisan legislation ensures health institutions can safeguard Americans’ health data against increasing cyber threats.” 

The legislation starts with improved coordination between HHS and the Cybersecurity and Infrastructure Security Agency, fostering additional communication so that the agencies can better protect against and respond to cyberattacks in the health care sector. 

It also requires the HHS secretary to develop and implement a cyber incident response plan within a year of the bill’s enactment. The directors of CISA, the Office of Management and Budget and the National Institute of Standards and Technology should be consulted in the development of that plan, the bill states.

There’s also a callout to modernize current regulations tied to the Health Insurance Portability and Accountability Act, making sure that covered entities under HIPAA are following best cyber practices. 

Other measures in the bill include the doling out of grants to providers to improve their cyberattack prevention-and-response protocols, delivering training sessions on cyber best practices to health care entities, and supporting rural health clinics through coordination with federal agencies on breach prevention, resilience and other mitigation tactics.

“Cyberattacks in the health care sector can have a wide range of devastating consequences, from exposing private medical information to disrupting care in ERs — and it can be particularly difficult for medical providers in rural communities with fewer resources to prevent and respond to these attacks,” Hassan said in a statement. “Our bipartisan working group came together to develop this legislation based on the most pressing needs for medical providers and patients, and I urge my colleagues to support it.”

Earlier this year, Warner and Sen. Ron Wyden, D-Ore., introduced a bill to create mandatory minimum cybersecurity standards for providers, health plans and connected entities, a response to the February ransomware attack on Change Healthcare, the UnitedHealth Group-owned payment processor. 

The breach impacted a record-high 100 million Americans, and Change Healthcare’s chief information security officer said the company was forced to “start over” with regard to its IT systems.

“Cyberattacks on our health care systems and organizations not only threaten personal and sensitive information, but can have life-and-death consequences with even the briefest period of interruption,” Warner said of the new bill. “I’m proud to introduce this bipartisan legislation that strengthens our cybersecurity and better protects patients.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure