Sen. Mark Warner (D-Va.) says he hopes to introduce legislation this quarter to bolster health care organizations’ defenses and possibly require them to meet minimum standards. Health care cybersecurity is a pressing issue. Nearly 50 million patients’ data was breached in 2021 alone, according to HHS. In November, Warner, who chairs the Intelligence Committee, released a report calling on Congress to bolster health care cybersecurity, including by ordering HHS to assign a “senior leader” to oversee the issue. Ben caught up with Warner to discuss his legislation, national security and Covid-19 and what he hopes to tackle in the new Congress. This interview has been edited for length and clarity. What’s the state of health care cybersecurity? This is the most attractive or lucrative part of ransomware. People’s personal health information is even more valuable than financial information. Nobody’s in charge. I went to go see the org chart again, and I counted four separate Cabinet secretaries that touch health care cybersecurity. You do need somebody in charge. Cyber is always an afterthought. It has to be built into health care as new applications and even treatment modalities are created. Do you have an idea of what the senior cyber leader at HHS you’ve proposed might look like? Even if you put someone in charge at HHS, how will that person have enough purview? We may even need to elevate this above HHS to some White House level so you can really have some juice with other secretaries. How should Congress set minimum standards for health care cybersecurity as you’ve proposed? The amount of damage that’s being done is going to require standards. Parts of the industry will resist that and say then you’ve got to replace all of our reimbursements. That’s just part of the normal process and back and forth. Maybe you make some reimbursements contingent on meeting minimum standards. Then we’ve got individual hospitals and practices saying we’re willing to take mandatory standards but don't tell anybody else. We’re one major breach away from draconian efforts. So let’s do it ahead of time rather than react. With Covid-19 spreading fast in China, do you see any national security implications? The real security implications will be not only potential spread of the virus or a new strain but the economic issues if China has to go into a massive shutdown again. It appears that you have a government that’s gone from no tolerance to basically no reporting and saying we’re going to let everyone get sick. You sit on the Senate Finance Health Subcommittee. What’s on the agenda? What I want to look at is cost containment. It’s all been about coverage. Remember all the promises of savings for the accountable care organizations? I’d color me skeptical in terms of thinking that we’ve really wrestled with the cost issues. Access to drugs used to treat opioid disorder and mental illness could suffer if the Drug Enforcement Administration doesn’t extend pandemic rules allowing prescribing by telehealth. What should be done? We all want to make sure that we have appropriate restrictions on opioids. Through Covid, they have worked through appropriate safeguards, maybe not perfectly but generally speaking. I hope the DEA gets the rulemaking done as quickly as possible. If there’s a gap, I would generally be supportive of maintaining the eased rules. I’ve not seen gross amounts of negligence here.
| 
