Sen. Bill Cassidy (R-La.), a gastroenterologist, is a contender to chair the Health, Education, Labor and Pensions Committee if Republicans can eke out control of the Senate. He’s a telehealth proponent and has repeatedly warned about hackers targeting hospitals and other health care organizations. No matter who wins the majority, both issues have bipartisan support. In the current Congress, Cassidy has teamed with Nevada Democrat Jacky Rosen on a bill that would bolster cybersecurity by requiring HHS to work more closely with the Cybersecurity and Infrastructure Security Agency. Cassidy spoke with Ben about what the new political alignment in Washington means for health policy. The interview has been edited for length and clarity. Divided government is most likely coming in January. What can move that’s bipartisan? I’m hoping that there will be a bipartisan effort on telehealth so we can look at what worked and didn’t work under the public health emergency. Telemental health has been very valuable. There have been some issues that need to be worked through in terms of payment, but we can work through those. Telephysical health could be very valuable. I like to think we get something passed in the next Congress. Should eased pandemic telehealth rules be made permanent or do you favor a temporary extension? I want to talk to CMS about it because I’ve heard they’re concerned about the cost. Intuitively to me, it’d be less expensive to provide telehealth. Your overhead is dramatically different. If you reduce that overhead, is your cost basis for providing service the same? You need to make reimbursements for telehealth roughly equal to seeing people in person because nobody will want to see somebody in person otherwise. There are some times when you need to see somebody in person, so we can’t create a disincentive. How would you assess the state of cybersecurity in health care? It needs to get better. There are different reports on data breaches that are affecting providers significantly, including one in 2020 that cost $67 million in lost revenue. There are increasingly virtual components to medical devices, and they are programmable and can be monitored from afar. That creates vulnerability. It’s not just what has occurred but that which we can imagine. We need to address both. What should be done about it? You just have to assess the risk. On the one hand, we’re looking at these anecdotes and we’re using our imagination. But on the other hand, it has to be data, and it has to be an overall assessment. Studying the incidents that occur is going to help. Your Democratic colleague Mark Warner from Virginia released a report last week saying Congress should consider setting minimum standards for cybersecurity for health care organizations. How do you feel about that? That’s very reasonable. We like to think that everybody is automatically on top of everything, but particularly for smaller systems and even for bigger ones, there should be a list of standards. Warner also called on HHS to install a senior leader for cybersecurity to create a more unified approach. Should it? Leadership is always important. The degree to which the decision-making and accountability is diffuse is the degree to which it is less effective than it could be. What are the biggest obstacles right now to improving cybersecurity in health care? The reality is that legacy systems and facilities are potential points of vulnerability, but it’s going to be expensive for systems that have poor margins to change. We need to make the change, but there are structural issues.
| 
