Cyber Health Advocacy – Patient Safety and Sector Resilience

Our nation’s health sector cybersecurity preparedness needs a booster. Progress must be made to disrupt the actions and capabilities of those parties who would cause harm to the consumers and patients of health and care systems. The general lack of readiness in our sector also leaves our public safety and national security systems/infrastructure exposed to increasingly sophisticated means of cyber exploitation. It is imperative that we, as a community, establish the right balance of incentivized standards, coupled with purposeful cyber workforce assistance to improve health sector resilience and our nation’s security posture.

The health sector is replete with challenges, including pandemic induced revenue losses, professional labor shortages and discord, prolific growth in digital health alongside aging-out disparate technologies, and risk exposures to open-door attack surfaces.  First Health Advisory upholds the need for consensus-centered cyber standards and advocates caution in placing undue fiscal or baseline burdens on health entities.  Cyber Safety is Patent Safety is a shared journey of moving these initiatives forward to better prepare healthcare entities and protect those they serve.   

First Health Advisory is a vocal advocate for harmonized cybersecurity legislation, agency support, and executive actions for the greater good of our sector. We believe that the following critical actions should be at the heart of any forthcoming policies and legislation:

• A national cybersecurity gateway that promotes coordinated resilience and cross-sector collaboration with aligned standards.
• A national commitment from the public and private sectors that involves investment by individual entities and federal/state government(s) toward a strong cyber infrastructure and workforce.
• A national commitment that draws upon and includes experts and policymakers from all sides of this issue.

Federal Cybersecurity Funding Program

• First Health Advisory advocates that health organizations be incented to meet cybersecurity standards coupled with fiscal assistance. In addition, baseline (essential and enhanced) phased requirements should include demonstration of these capabilities and others as governed by HHS.
• First Health Advisory implores lawmakers to set and raise the bar for cyber hygiene, awareness, and preparedness with investment motivation for qualifying health entities. Support should be available to all health and public health entities, including IDNs, hospitals, clinics, dentistry, mental health, urgent care, virtual/digital health, alternative care delivery, community health, wellness, and health plan entities, regardless of size and scale.

Workforce Development Assistance

• First Health Advisory asks Congress for a commitment to developing people competencies and capabilities in healthcare cybersecurity disciplines and across workforce domains.

Standards Advancement

• First Health Advisory advocates for recalibrating cybersecurity standards in consultation with health industry stakeholders and regulators (OCR, ONC, CMS, FDA, CISA, 405(d), ASPR, HC3), aligning already codified recommendations (405d HICP and NIST CSF) in support of prioritized practices that advance the overall sector security posture while protecting patient safety.