A NOT-SO-SECRET WEAPON AGAINST HACKERS — As health care companies face a brutal one-two punch of pandemic chaos and ransomware attacks, a small unit inside HHS is helping them fight back. The department’s Health Sector Cybersecurity Coordination Center is a one-stop shop for information about hackers’ activities and ways to avoid being hacked. It distributes threat advisories, vulnerability announcements and other warnings to give executives and IT employees at health care firms a sense of how to spend their limited time and resources. HC3, as it’s known, has spent almost four years building up its capacity, and HHS’ partners in the industry say the center’s help has never been more critical. Cyberattacks against the health care sector have ballooned in recent years as poorly secured medical technology proliferates, pandemic disruptions strain workforces and ransomware gangs see opportunities to profit by extorting companies that can’t afford any downtime. More than a third of health care organizations reported experiencing ransomware attacks during the pandemic’s first year, and data breaches at health care firms hit an all-time high in 2021, according to the cyber firm Critical Insights. Health-technology vendors have been a prime target — a breach at prescription benefits technology vendor CaptureRx exposed the data of 17 hospitals and other customers and a ransomware attack on the health care system Scripps Health knocked multiple patient-care systems offline. “We’re literally under siege,” said Mari Savickis, vice president for public policy at the College of Healthcare Information Management Executives, which represents health care IT leaders. “It is relentless.” Health care cyber experts say HC3 has been an excellent partner. “It is a national asset,” Savickis said. “They really produce amazing material, and they've been doing it for years on a shoestring [budget].” John Riggi, the American Hospital Association’s national adviser for cybersecurity and risk, said HC3 excels at presenting information about cyber threats “through the lens of the health care sector” and highlighting how it’s relevant to those companies. The center’s guidance includes high-level overviews designed to grab the attention of board members, who can then pass it on to their companies’ cyber experts with instructions to act on its more technical recommendations. The American Hospital Association frequently shares HC3’s reports on its website , and Riggi said he regularly speaks with the center’s leader, Rahul Gaitonde. HC3’s advice and recommendations are especially critical for small health care providers, which often lack dedicated cyber teams. Cyber experts say that in any highly interconnected industry, those small firms represent weak links that hackers can use as springboards for breaching larger targets. By disproportionately straining small health care firms, the pandemic has exacerbated those risks for the industry. DHS’ Cybersecurity and Infrastructure Security Agency already provides cyber guidance and services to all manner of critical infrastructure operators, including hospitals and medical device makers. HC3 was created as the rebranding of a predecessor unit inside HHS that earned some criticism for potentially duplicating those efforts. The department relaunched and renamed the organization in 2018, the same year Congress created CISA and began building it up as the government’s central resource for cyber aid to the private sector. But it’s fitting that HHS runs its own cyber center, cyber experts said. “We have our own needs over here,” said Savickis, and HHS has a unique understanding of patient safety issues. Given the industry’s acute impact on public safety, Riggi added, it makes sense for the government to offer “extra resources to defend health care.” Still, these cyber professionals have concerns about how HC3 is funded and how its guidance is written. Riggi said the center should do more to “leverage the expertise of practitioners in the health care field” so its advice about implementing certain technologies better reflects the challenges of doing so. HC3 could also use more input from clinicians and health care professionals about the unique dangers that cyber threats pose to the sector. Meanwhile, Savickis wants Congress to boost HC3’s profile inside HHS by giving it a dedicated and increased budget. It currently draws money from the budget account for the department’s chief information officer, where it’s administratively housed. (HHS didn’t answer questions from POLITICO.) HC3 “is still young and maturing,” Riggi said, “and they have a long journey ahead.” Welcome back to Future Pulse, where we explore the convergence of health care and technology. Share your news, tips and feedback with Ben at bleonard@politico.com or @_BenLeonard_ and Ruth at rreader@politico.com or @RuthReader.
| 
