Senator: Health care needs mandatory ‘cyber hygiene’ standards for computer networks

© wladimir1804 - stock.adobe.com

Now is the time consider mandatory “cyber hygiene” standards for health care providers still dealing with the effects of the Change Healthcare computer hack, said a senator who has advocated for bolstered cybersecurity in health care.

The massive cyberattack against Change Healthcare should not be a surprise, said Sen. Mark R. Warner (D-Virginia). He launched the bipartisan Health Care Cybersecurity Working Group and is author of “Cybersecurity is Patient Safety,” a policy options paper to improve security of health care computer networks.

Sen. Mark R. Warner
_D-Virginia

The health care sector has been a target of local and regional computer hacks that have disrupted clinical care, Warner said in a statement. It was only a matter of time before a national scale attack disrupted ability to treat patients, he said.

The U.S. Department of Health and Human Services (HHS) is working to ensure all Medicare providers can receive advanced and accelerated payments, Warner said. He suggested HHS inform Congress as soon as possible if legislative action is needed.

“This attack demonstrates that we need to have backup plans in place for such incidents,” Warner said. “I plan to write and introduce legislation that would provide for accelerated and advanced payments to providers and vendors to protect them in the event of future disruptions, as long as they meet minimum cybersecurity standards.

“While the repercussions of this incident have been primarily – though not wholly – financial, what keeps me up at night is the possibility of a similar widespread attack directly affecting patient care and safety,” Warner said. “That is why it is time to consider mandatory cyber hygiene standards for health care providers and their vendors. Sterilization and hand hygiene practices prevent infections – and cyber hygiene practices prevent cyber intrusions. Both are critical to protect patients.”

Warner authored the “Internet of Things (IoT) Cybersecurity Improvement Act,” requiring minimum security standards for any IoT device bought with federal funds. President Donald J. Trump signed that bill in December 2020.