Deborah R. Farringer, J.D., is the Director of Health Law Studies and an Associate Professor at Belmont University College of Law. Her scholarship explores the operation and impact of health laws and health policy on providers and suppliers.
J Law Med Ethics. 2019 Dec;47(4_suppl):91-102. doi: 10.1177/1073110519898046.
The health care industry has moved at a rapid pace away from paper records to an electronic platform across almost all sectors - much of it at the encouragement and insistence of the federal government. Such rapid expansion has increased exponentially the risk to individuals in the privacy of their data and, increasingly, to their physical well-being when medical records are inaccessible through ransomware attacks. Recognizing the unique and critical nature of medical records, the United States Congress established the Health Care Industry Cybersecurity Task Force under the Cybersecurity Information Sharing Act of 2015 for the purpose of reviewing cybersecurity risks within the health care industry and identifying who will lead and coordinate efforts to address such risks among the various agencies. The Task Force has since issued a report setting forth six high-level imperatives that the health care industry needs to achieve in order to combat cybersecurity, and, notably, many of the vulnerabilities plaguing the industry identified in the Report as requiring correction are not necessarily related to specific flaws in the current cybersecurity framework, but rather susceptibilities presented by the infrastructure and associated regulatory regime that has evolved over the last few decades over the health care industry generally. That is, the current health care infrastructure by its nature exacerbates cybersecurity risk. Between a lack of information sharing of industry threats, risks, and mitigations, disparate leadership and governance goals for cybersecurity, the confluence and contradiction of existing federal and state laws, fragmentation in the fee-for-service delivery system, lack of care coordination, and disparate resources across and among sectors, the industry suffers from heightened cyber risk. Solutions that are reactive to problems within the current infrastructure will likely have little long term impact toward reducing cybersecurity vulnerabilities because they do not address the underlying system challenges. All of these confluences causes one to wonder whether if in fact the current health care delivery infrastructure is a contributing factor to the incidents of cybersecurity attacks and the exorbitant costs associated with resolving data breaches, should Congress look not just to curb breach incidents, but to address root cause systematic challenges in the health industry infrastructure that create increased exposure of cybersecurity threats? This article argues that cybersecurity risks will continue to be heightened and more costly to the health care industry as compared to other industries unless and until some general system redesign is achieved that allows for (1) greater sharing of resources among industry participants to ensure the same protections are implemented at all levels of the industry, which can be strengthened through greater interoperability of systems across the health care industry; and (2) increased focus and attention on the importance of cybersecurity issues as a priority among system reforms.
医疗保健行业已经迅速从纸质记录转向电子平台，几乎涵盖了所有领域——这在很大程度上是受到联邦政府的鼓励和坚持。这种快速扩张使得个人数据的隐私风险呈指数级增长，而且越来越多的是，当医疗记录因勒索软件攻击而无法访问时，他们的身体健康也受到影响。美国国会认识到医疗记录的独特和关键性质，根据 2015 年《网络安全信息共享法案》设立了医疗保健行业网络安全工作组，目的是审查医疗保健行业内的网络安全风险，并确定谁将领导和协调各机构之间的努力来解决这些风险。自那时以来，该工作组发布了一份报告，其中列出了医疗保健行业需要实现的六项高级别要务，以打击网络安全，值得注意的是，报告中确定需要纠正的许多困扰该行业的漏洞并不一定与当前网络安全框架的具体缺陷有关，而是与过去几十年中医疗保健行业普遍发展起来的基础设施和相关监管制度的脆弱性有关。也就是说，目前的医疗保健基础设施本质上加剧了网络安全风险。由于行业威胁、风险和缓解措施的信息共享不足、网络安全领导和治理目标不一致、现有联邦和州法律的融合与矛盾、按服务收费提供系统的碎片化、护理协调不足以及各部门之间资源分散，该行业面临着更高的网络风险。针对当前基础设施内问题的反应式解决方案可能对降低网络安全漏洞的影响不大，因为它们没有解决潜在的系统挑战。所有这些融合都让人不禁怀疑，事实上，当前的医疗保健提供基础设施是否是网络安全攻击事件和与解决数据泄露相关的高昂成本的一个促成因素，如果国会不仅要遏制违规事件，还要解决导致网络安全威胁暴露增加的医疗行业基础设施中的根本系统挑战，那么国会是否应该考虑？本文认为，除非实现了一些总体系统重新设计，否则网络安全风险将继续加剧，并给医疗保健行业带来比其他行业更高的成本，这些设计允许（1）在行业参与者之间更大程度地共享资源，以确保在行业的各个层面实施相同的保护措施，这可以通过提高医疗保健行业内系统的互操作性来加强；（2）在系统改革中更加关注网络安全问题的重要性。
