As White House preps new cyber rules for healthcare, Neuberger says backlash is unwarranted
The Record
|
Contributed by: Drex DeFord
Summary
At the RSA Conference, White House official Anne Neuberger announced impending cybersecurity regulations for the healthcare sector, amid concerns over industry pushback following high-profile cyber incidents that could have been mitigated with basic protections. Despite over a decade of urging for the adoption of multi-factor authentication, offline backups, and data encryption, these practices have largely been ignored by the sector, prompting the need for regulatory action. Neuberger criticized the healthcare industry for negligence, particularly highlighting the failure of UnitedHealth Group to encrypt patient data in its Change Healthcare unit prior to a ransomware attack. She disclosed the plan to introduce minimum cybersecurity requirements for hospitals and a free cybersecurity program for the country's rural healthcare networks. The announcement comes in the wake of the Change Healthcare ransomware attack that significantly impacted the healthcare industry, with lawmakers now showing interest in establishing a cybersecurity baseline for healthcare firms. However, opposition from industry groups like the American Hospital Association underscores the challenge of balancing regulatory measures with the pursuit of proactive cybersecurity strategies.
