Call us now:
The enclosed hearing by the House Sub Committee on Energy and Commerce on the recent United Healthcare cyber attack is worth a quick review. Sub Committee members spent 3 hours asked questions of industry representatives. The hearing highlighted the substantial effect the cyber attack had on the U.S healthcare system and patients. Raising many questions and concerns of the cybersecuirty risk management of the U.S healthcare system, including consolidation of the healthcare system. United Healthcare were asked to attend, but did not. It appears that United health has not provided information to regulators or industry representatives to date relating to the cyber attack.
The subcommittee was informed that the United Health Attack was a threat to healthcare solvency, as United healthcare are responsible for 100 critical functions that keep the healthcare sector operating in the U.S. It remains unclear how long it will take for Change Healthcare services to normal. Healthcare concentration risk was raised as an issue by the American Hospital Association when it was announced that United Health was acquiring Change Health. A lack of understanding by healthcare providers of the connected relationships between healthcare providers and the health insurance industry was also raised as a concern. One that only came to light during the cyber attack when healthcare providers were unable to receive funding, disrupting patient care.
The United Health attack was larger than WannaCry.
The committee members wanted to know why the healthcare sector was not managing cybersecurity, given the amounts of money spent on cybersecurity? Why has the healthcare sector, healthcare providers and technology providers not stayed on top of cybersecurity risk management. Why should the U.S government fund healthcare cybersecurity? How much money is enough for Federal government and the healthcare sector to spend on cybersecurity.
It was reiterated to the subcommittee that cyber regulation is advancing in the healthcare sector and providers are affected by regulations such as HIPAA, the SEC Final Cyber Rule and state level cyber regulations and voluntary rules.
This hearing has to be the most thorough that one has heard discussing cybersecurity and risk management of any sector. One suspects regulators will be taking a close look at the hearing and preparing responses to their oversight of the attack against United Health and Change Healthcare.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA
Veritas GRC UnitedHealth Group Federal Trade Commission U.S. Department of Health and Human Services (HHS) U.S. Securities and Exchange Commission House Committee on Energy and Commerce
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7186638442322145280