[{"innerBlocks":[],"name":"core\/freeform","postId":1387,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"New cybersecurity best practices from the Department of Health and Human Services are more than helpful suggestions for provider organizations\u2014they set security practices that are likely to become the de facto standard industry wide.

The new guidance, available here<\/a>, should not be ignored, says Bruce Armon, a health law partner in Philadelphia-based Saul Ewing Arnstein & Lehr. The federal agency expects its guidance to be followed, he says.

HHS wants to see adequate cybersecurity technology and processes, personnel trained in cyber awareness and additional appropriate controls, emphasizes Marcus Christian, a partner in the Mayer Brown law firm in Washington.

\u201cThis is not just an IT problem, as the legal, privacy and HR departments will all be involved. Regulators are being more actively involved in high-level standards and particular guidance, and they want to see a formal security program with a customized incident response plan,\u201d Christian says. \u201cFailure to implement will lead to negative consequences in the future if appropriate controls are not put in place.\u201d

Christian also cautions that state attorneys\u2019 general and other regulators also are becoming more active in overseeing the health industry\u2019s progress toward improved data security. \u201cThe HHS publication is intended to highlight the need to improve. This year, HHS will look at how well the industry is taking security seriously.\u201d

Dedicating resources to maintain oversight of security is a challenge for all healthcare entities, particularly smaller ones. Smaller organizations are particularly at risk, because hackers often focus on these practices looking for easy areas of access to their networks because a practice or small hospital likely will not have sophisticated cyber expertise, adds Karilynn Bayus, vice chair of the healthcare practice at the law firm.

For the most part, the HHS best practices are not costly measures to implement, and the practices are especially helpful for organizations that don\u2019t know where to start, according to Bayus.

\u201cYou have to commit to examining and understanding where data is and the threats, vulnerabilities and risk levels,\u201d she notes. \u201cA thoughtful plan needs to be put in place.\u201d

Also See<\/b>: 8 ways IOT devices could affect cybersecurity and privacy risks<\/a>

\u201cTake a risk-based approach and examine the biggest threats and the potential for impact on the data, which could affect patient care,\u201d she advises. If the organization doesn\u2019t have a cyber-awareness culture, it must develop one, regardless of size, attorneys warn.

Often, a cyber attack will come in the form of ransomware, which can happen anytime and anywhere, Armon says. If a provider cannot fight off an attack, its ability to pay a ransom depends on the scope of the attack and the level of insurance that the organization has. \u201cBut first, make sure this is a real threat and the information systems are actually handicapped, and then contact law enforcement officials,\u201d he counsels.

\u201cA ransomware attack must be treated as a potential data breach and as a security incident,\u201d Bayus adds. \u201cYou need to understand what happened to the data. Was it deleted or manipulated?\u201d

Regardless of the size and sophistication of an organization, certain tasks should be done regularly to ensure the practice or hospital is ready at all times if an attack be launched. These include regular reminders from IT or security leaders not to click on emails that look suspicious, not working with protected health information in public areas such as a coffee shop, and frequently conducting drills on employees and executives to see if they are clicking on rogue data links.

These drills should continue over time, Armon cautions. \u201cEvery institution, regardless of size, will always be playing catchup.\u201d

Armon advises that even if the organization does a good job educating the workforce on cyber security, some employees may not expect the unexpected when an incident occurs and that\u2019s okay because it will be a teachable moment.

Most importantly, he adds, the organization must emphasize that employees cannot assume the information technology department is taking care of data security\u2014everyone must be involved in protecting the data.
","saveContent":"New cybersecurity best practices from the Department of Health and Human Services are more than helpful suggestions for provider organizations\u2014they set security practices that are likely to become the de facto standard industry wide.

The new guidance, available here<\/a>, should not be ignored, says Bruce Armon, a health law partner in Philadelphia-based Saul Ewing Arnstein & Lehr. The federal agency expects its guidance to be followed, he says.

HHS wants to see adequate cybersecurity technology and processes, personnel trained in cyber awareness and additional appropriate controls, emphasizes Marcus Christian, a partner in the Mayer Brown law firm in Washington.

\u201cThis is not just an IT problem, as the legal, privacy and HR departments will all be involved. Regulators are being more actively involved in high-level standards and particular guidance, and they want to see a formal security program with a customized incident response plan,\u201d Christian says. \u201cFailure to implement will lead to negative consequences in the future if appropriate controls are not put in place.\u201d

Christian also cautions that state attorneys\u2019 general and other regulators also are becoming more active in overseeing the health industry\u2019s progress toward improved data security. \u201cThe HHS publication is intended to highlight the need to improve. This year, HHS will look at how well the industry is taking security seriously.\u201d

Dedicating resources to maintain oversight of security is a challenge for all healthcare entities, particularly smaller ones. Smaller organizations are particularly at risk, because hackers often focus on these practices looking for easy areas of access to their networks because a practice or small hospital likely will not have sophisticated cyber expertise, adds Karilynn Bayus, vice chair of the healthcare practice at the law firm.

For the most part, the HHS best practices are not costly measures to implement, and the practices are especially helpful for organizations that don\u2019t know where to start, according to Bayus.

\u201cYou have to commit to examining and understanding where data is and the threats, vulnerabilities and risk levels,\u201d she notes. \u201cA thoughtful plan needs to be put in place.\u201d

Also See<\/b>: 8 ways IOT devices could affect cybersecurity and privacy risks<\/a>

\u201cTake a risk-based approach and examine the biggest threats and the potential for impact on the data, which could affect patient care,\u201d she advises. If the organization doesn\u2019t have a cyber-awareness culture, it must develop one, regardless of size, attorneys warn.

Often, a cyber attack will come in the form of ransomware, which can happen anytime and anywhere, Armon says. If a provider cannot fight off an attack, its ability to pay a ransom depends on the scope of the attack and the level of insurance that the organization has. \u201cBut first, make sure this is a real threat and the information systems are actually handicapped, and then contact law enforcement officials,\u201d he counsels.

\u201cA ransomware attack must be treated as a potential data breach and as a security incident,\u201d Bayus adds. \u201cYou need to understand what happened to the data. Was it deleted or manipulated?\u201d

Regardless of the size and sophistication of an organization, certain tasks should be done regularly to ensure the practice or hospital is ready at all times if an attack be launched. These include regular reminders from IT or security leaders not to click on emails that look suspicious, not working with protected health information in public areas such as a coffee shop, and frequently conducting drills on employees and executives to see if they are clicking on rogue data links.

These drills should continue over time, Armon cautions. \u201cEvery institution, regardless of size, will always be playing catchup.\u201d

Armon advises that even if the organization does a good job educating the workforce on cyber security, some employees may not expect the unexpected when an incident occurs and that\u2019s okay because it will be a teachable moment.

Most importantly, he adds, the organization must emphasize that employees cannot assume the information technology department is taking care of data security\u2014everyone must be involved in protecting the data.
","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

HHS cybersecurity guidance ramps up pressure to protect data

More for you