Greg Garcia helps health care organizations partner with the government in the fight against hackers. The members of the Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group that he leads — health systems, insurers and health tech companies, among others — face serious threats. Those threats include ransomware attacks that jeopardize patient safety and bottom lines. Ben caught up with Garcia to discuss new guidance his group helped write with the Department of Health and Human Services on cybersecurity standards and the possibility that Congress will mandate minimum security procedures for health care organizations. This interview has been edited for length and clarity. How do you assess the level of adoption of cybersecurity best practices? Adoption is constantly increasing. What we’re trying to do is get the small and mid-sized organizations to up their game. What are the biggest barriers for them? We’re working to bear down on how they’re getting beat. What are the vulnerabilities or lack of controls that hackers are exploiting? Email security is one of the most basic ones. Another one is the need for multifactor authentication. Things like that are fairly simple. Not everything takes a lot of money. The bigger issue with the small hospitals is that we are still in the post-pandemic or near-post-pandemic environment. The existential questions these hospitals have to go through — cybersecurity does not always rise to the top of their priority list. Senate Intelligence Chair Mark Warner is mulling legislation that could set minimum cybersecurity standards for health organizations. What do you think about that? We have minimum standards. Whether or not the government wants to make them mandatory, that’s going to be up to them. If you’re going to regulate us, show us the money. The government can provide reimbursement incentives, subsidies and outright grants. Let’s think creatively about that.
| 
