Health records securityBetter cybersecurity for the healthcare industry

Healthcare organizations face ever more threatening cyber attacks. In response, the Health Information Trust Alliance (HITRUST) has established the HITRUST Cybersecurity Incident Response and Coordination Center to provide support for the healthcare industry. HITRUST says this support includes facilitating the early identification of cybersecurity attacks, coordination of response activities, and creation of best practices. In addition, the center will make available cyber threat information to the broader industry.

The center was created to protect the U.S. healthcare industry from disruption by cyber attacks. HITRUST says that with timely alerting and sharing of relevant information on cybersecurity threats and events, the center will be in a position to manage a major industry concern, and move the industry forward by distributing timely information, including identification, corrective actions and lessons learned. The group will focus on cybersecurity threats and events targeted at healthcare organizations in areas, including networks, mobile devices, workstations, servers, and medical devices. “This sharing of information is crucial for organizations’ preparedness, protection and crisis management,” HITRUST says.

“Cyber attacks are an increasing concern for every organization and Wellpoint recognizes an important component of our strategy is to collaborate with industry and government to most effectively address this issue,” said Roy Mellinger, vice president and chief information security officer, Wellpoint.

The center is working initially with fourteen industry organizations, representing health plans and health systems, and the U.S. Department of Health and Human Services to share incident information. The center will collaborate with HITRUST and others to identify and correct incidents, and will also obtain and synthesize cyber threat and response information from other sources to make the information more readily available to center participants. HITRUST will also lead the center’s participants in evaluating appropriate tools and related security mechanisms to support the center’s efforts.

“The center represents a collaborative effort between industry leaders and government to ensure the industry as a whole is better prepared for cyber attacks,” said Daniel Nutkis, chief executive officer, HITRUST. “The commitment of these founding organizations to provide their time, experiences and resources in support of the broader industry is what will make it a success. The support of these organizations combined with the experience HITRUST has in developing and communicating information security concepts to organizations in various segments, of varying sizes and with varying levels of technical knowledge will be crucial in ensuring we arm the industry to respond more timely and aggressively to future cyber attacks.”

HITRUST says its experience during the past five years in supporting the healthcare industry’s efforts for information protection has shown that the wide variety of types, sizes, and competencies of organizations are not well suited to a one-size-fits-all approach. Therefore, the center’s initial focus will be on early threat detection, alerting, correction, and notification to organizations capable of consuming more technical alerting information. The center will also work with industry, service, and solution providers to identify and implement a method to provide meaningful information to all types of organizations and technical competency levels within the entire industry. Once the method has been implemented the center will transition to a formal Information Sharing and Analysis Center (ISAC).

“As the healthcare industry continues its conversion process to full patient electronic medical records, it will most certainly become a more frequent target of cybersecurity attacks, and having such a system in place in the near future will be key to collaboratively responding and preventing such attacks,” said Jorge DeCesare, chief data security administrator, Dignity Health.