The USA Division of Well being and Human Companies’ (HHS) Workplace for Civil Rights (OCR) has proposed new cybersecurity necessities for healthcare organizations with an intention to safeguard sufferers’ information in opposition to potential cyber assaults.
The proposal, which seeks to switch the Well being Insurance coverage Portability and Accountability Act (HIPAA) of 1996, is a part of a broader initiative to bolster the cybersecurity of crucial infrastructure, the OCR stated.
The rule is designed to strengthen protections for digital protected well being info (ePHI) by updating the HIPAA Safety Rule’s requirements to “higher tackle ever-increasing cybersecurity threats to the healthcare sector.”
To that finish, the proposal, amongst different issues, requires organizations to conduct a evaluate of the expertise asset stock and community map, determine potential vulnerabilities that might pose a menace to digital info methods, and set up procedures to revive the lack of sure related digital info methods and information inside 72 hours.
Different notable clauses embrace finishing up a compliance audit a minimum of as soon as each 12 months, mandating encryption of ePHI at relaxation and in transit, implementing using multi-factor authentication, deploying anti-malware safety and eradicating extraneous software program from related digital info methods.
The Discover of Proposed Rulemaking (NPRM) additionally necessitates that healthcare entities implement community segmentation, arrange technical controls for backup and restoration, in addition to carry out vulnerability scanning a minimum of each six months and penetration testing a minimum of as soon as each 12 months.
The event comes because the healthcare sector continues to be a profitable goal with ransomware assaults, not solely posing monetary danger but in addition placing lives at stake by disrupting entry to diagnostic tools and significant methods that include affected person medical data.
“Healthcare organizations gather and retailer extraordinarily delicate information, which possible contributes to menace actors concentrating on them in ransomware assaults,” Microsoft famous in October 2024. “Nonetheless, a extra important cause these amenities are in danger is the potential for enormous monetary payouts.”
“Healthcare amenities situated close to hospitals which are impacted by ransomware are additionally affected as a result of they expertise a surge of sufferers needing care and are unable to assist them in an pressing method.”
In accordance with information compiled by cybersecurity firm Sophos, 67% of healthcare organizations had been hit by ransomware in 2024, up from 34% in 2021. The basis trigger behind a majority of those incidents have been traced again to exploited vulnerabilities, compromised credentials, and malicious emails.
Moreover, 53% of healthcare organizations that had information encrypted paid the ransom to revive entry. The median ransom fee was at $1.5 million.
The rise within the fee of ransomware assaults in opposition to the healthcare entities has additionally been complemented by longer restoration occasions, with solely 22% of victims absolutely recovering from an assault in every week or much less, a major drop from 54% in 2022.
“The extremely delicate nature of healthcare info and want for accessibility will all the time place a bullseye on the healthcare trade from cybercriminals,” Sophos CTO John Shier stated. “Sadly, cybercriminals have realized that few healthcare organizations are ready to reply to these assaults, demonstrated by more and more longer restoration occasions.”
Final month, the World Well being Group (WHO), a United Nations company targeted on world public well being, characterised the ransomware assaults on hospitals and healthcare methods as “problems with life and loss of life” and referred to as for worldwide cooperation to fight the cyber menace.
