Category: NIST



Page 2 of 2

Time to Focus on Cybersecurity in Health Care

Share

In the wake of the WannaCry global attack that impacted the U.K.’s National Health Service, the need to protect valuable health care data has never been more urgent. The U.S. government has begun to take steps in the right direction with the passing of executive orders on cybersecurity, the Cybersecurity Act of 2015, and the Government Accountability Office report on the Internet of Things.

Continue reading

Disrupting the Health Care Cybersecurity Model (or Lack Thereof): Health Care Industry Cybersecurity Task Force Calls Out Regulatory Barriers

Share

In a previous blog post, our team evaluated the draft recommendations prepared by the Health Care Industry Cybersecurity Task Force in its “Report on Improving Cybersecurity in the Health Care Industry.”  

We recently examined three of the six major recommendations in the report and their potential impact on the existing health care regulatory environment. These include:

  • HHS and a Comprehensive Health Care Security Framework
  • Government and Private Incentives to Migrate Vulnerable Health Care Providers to More Secure Environments
  • Development of Fraud and Abuse Exemptions to Foster Collaboration and Permit Shared Resources

For more insight, read our detailed review of the health care security recommendations above.

An Early Review of the Trump Administration’s Health Care Cybersecurity Task Force Report

Share

Formed by the Cybersecurity Act of 2015, a task force established to share cybersecurity information between federal government and private industry representatives has released its “Report on Improving Cybersecurity in the Health Care Industry.” They presented six major action items for Congress, the Department of Health and Human Services, other government agencies and private industry.

The Report organized its recommendations under six Imperatives:

  • Define and streamline leadership, governance, and expectations for health care industry cybersecurity;
  • Increase the security and resilience of medical devices and health IT;
  • Develop the health care workforce capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities;
  • Increase health care industry readiness through improved cybersecurity awareness and education;
  • Identify mechanisms to protect research and development efforts and intellectual property from attacks or exposure; and
  • Improve information sharing of industry threats, weaknesses, and mitigations.

In a recent alert, we evaluated the action items and draft recommendations prepared by the Task Force, = and discuss how the Trump administration will react to these new proposals.

Read our review of the Health Care Cybersecurity Task Force Report

Executive Orders Require Review of Federal IT and Cybersecurity Resources

Share

The Trump administration has issued two executive orders focusing on national cybersecurity. The first establishes the American Technology Council, tasking it with developing policy around the use of information technology by the federal government and providing insight into how information technology policy is delivered to the president.

The orders include aggressive deadlines for federal agencies to submit reports on the cybersecurity of critical infrastructure entities, which may be difficult to meet.

For more insight, read our detailed review of the executive orders.

Proposed Changes to the NIST Cybersecurity Framework

Share

The National Institute of Standards and Technology (NIST) issued an update to its Framework for Improving Critical Infrastructure Cybersecurity on January 10, 2017. The updated draft Version 1.1 was issued after NIST’s review of considerable public and private-sector feedback on Version 1.0.

The updated five Framework Core Functions remain the same as the previous iteration: Identify, Protect, Detect, Respond and Recover. Version 1.1 now includes enhanced categories, subcategories and guidance, including cyber supply chain risk management, safer information sharing, cybersecurity measurement and stronger measures for device authentication.

The updated draft includes improvements but is intended to remain a voluntary cyber risk management tool that organizations can customize.

Read our overview of the updates and insights on some of the highlights.

Newer posts »

© 2018 Drinker Biddle & Reath LLP. All Rights Reserved. Lawyer Advertising.

Disclaimer/Privacy Policy