HHS funds cybersecurity sharing center to disseminate information about health care threats

HHS agencies have awarded the National Health Information Sharing and Analysis Center (NH-ISAC) $350,000 in cooperative agreements to allow it to disseminate information about cybersecurity threats among health care stakeholders. The agency hopes that increased information sharing in the health care community will alert stakeholders to threats more quickly, so that they can avoid them or mitigate the damages caused by breaches more efficiently. This type of information sharing was one goal of the Cybersecurity Information Sharing Act (CISA), enacted as part of the Consolidated Appropriations Act, 2016 (P.L. 114-113) and is part of the HHS’ ongoing efforts to reduce breaches among Health Care Portability and Accountability Act (HIPPA) (P.L. 104-191) covered entities and business associates (see Changes to ACA requirements, COOL, cybersecurity, and more in Appropriations Act, Health Law Daily, December 21, 2015).

The NH-ISAC is a member-owned non-profit that that offers non-profit and for-profit health care stakeholders, including independent hospitals, health insurance payers, and medical schools, a forum for sharing cyber and physical threat indicators. The HHS funding will prepare NH-ISAC to receive cyberthreat information from HHS and share it with stakeholders. Small providers, in particular, are expected to benefit from this process, which will alert them to threats and provide them with advice for responding to those threats. The agreements will also support NH-ISAC’s ability to receive threat information from stakeholders to provide other stakeholders with information about system breaches, including ransomware attacks.

The Office of the National Coordinator for Health Information Technology (ONC), which coordinates national health information technology and promotes the exchange of electronic health information, awarded $250,000 to build NH-ISAC’s capacity to receive and share cyber threat information with stakeholders and HHS and provide education about cyberthreats and appropriate responses. The Assistant Secretary for Preparedness and Response (ASPR), which prepares the nation to respond and recover from adverse health effects of emergencies, awarded a separate $150,000.