Top Six Actions to Manage Hospital Cybersecurity Risks

1. Establish procedures and a core cybersecurity team to identify and mitigate risks, including board involvement as appropriate.

2. Develop a cybersecurity investigation and incident response plan that is mindful of the Cybersecurity Framework being drafted by the National Institute of Standards and Technology.

3. Investigate the medical devices used by the hospital in accordance with the June 2013 Food and Drug Administration guidance to ensure that the devices include intrusion detection and prevention assistance and are not currently infected with malware.

4. Review, test, evaluate and modify, as appropriate, the hospital’s incident response plans and data breach plans to ensure that the plans remain as current as possible in the changing cyber threat environment.

5. Consider engaging in regional or national information-sharing organizations to learn more about the cybersecurity risks faced by hospitals.

6. Review the hospital’s insurance coverage to determine whether the current coverage is adequate and appropriate given cybersecurity risks.

aha-cyber-top6.pdf

Related Resources

Bibliography/Link Page
June 2018 June 29, 2018
Guides/Reports
At present, John Riggi, senior advisor for cybersecurity and risk, is available to provide:
Bibliography/Link Page
Member
Daily cybersecurity intelligence reports distributed from the National Health - ISAC for AHA members
Letter
May 31, 2018
Letter
Public
AHA responds to the Food and Drug Administration’s Medical Device Safety Action Plan, particularly with regard to advancing medical device cybersecurity.
Resources
A recent wave of cyber “ransomware” attacks has impacted healthcare and governmental organizations throughout the country.