The Department of Health and Human Services Jan. 24 released voluntary Cybersecurity Performance Goals for the sector, which include 10 “essential” and 10 “enhanced" goals. The health care CPGs are based on multiple cybersecurity frameworks and directly address common attack vectors against U.S. domestic hospitals as identified in the 2023 Hospital Cyber Resiliency Landscape Analysis. AHA provided input on the resiliency report and the draft goals as a member of the Health Sector Coordinating Council’s Cybersecurity Working Group. 

“America’s hospitals and health systems are dedicated to protecting their patients and workforce against cyberattacks that can disrupt patient care and erode privacy by the loss of personal health care data,” said AHA President and CEO Rick Pollack. “To that end, the AHA supports voluntary consensus-based cybersecurity practices, such as those announced today by the Department of Health and Human Services. These cybersecurity performance goals are targeted at defending against the most common tactics used by cyber adversaries to attack health care and related third parties, such as exploitation of known technical vulnerabilities, phishing emails and stolen credentials. We recommend that all components of the health care sector implement these practices including third-party technology providers and business associates.

“As data theft and ransomware attacks targeting health care have increased dramatically over the past several years, the AHA has worked closely with federal agencies and the hospital field to build trusted relationships and channels for the mutual exchange of cyber threat information, risk mitigation practices and resources to implement these practices. 

“The AHA will continue to work collaboratively with HHS and other federal partners to enhance cybersecurity efforts for the entire health care field, including hospitals and health systems, technology providers, and other vendors, to ensure we are protected against the primary source of cyber risk — criminal and nation state-supported cyber adversaries.”

 

Related News Articles

Headline
New guidance released yesterday by the Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI informs health care and other…
Headline
A joint advisory released Nov. 20 by the Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency and international partners warns of…
Headline
The Department of Justice Nov. 18 announced criminal charges against Evgenii Ptitsyn, a Russian national, for allegedly administering the sale, distribution…
Headline
A United Nations Security Council meeting the week of Nov. 4 discussed ransomware and the severe impacts that cyberattacks can have on hospitals and health…
Headline
AHA President and CEO Rick Pollack was recently a guest on Pinkston's "To the Point" podcast to discuss the future of U.S. health care, touching on a range of…
Headline
The Cybersecurity and Infrastructure Security Agency, FBI and other federal agencies have created a webpage with the latest cyberthreat updates and information…