Cybersecurity

A key House health care committee suggested Tuesday that Congress bolster efforts by federal regulators to get medical device makers and other industries to ferret out cybersecurity vulnerabilities by offering a liability shield for independent cybersecurity researchers when vulnerabilities are reported, and by helping to distinguish between hacking and good-faith efforts to discover security lags.

An array of stakeholders voiced their support for the cross-industry role laid out in a set of sweeping cybersecurity initiatives unveiled by FDA Commissioner Scott Gottlieb this week, including new cybersecurity information sharing agreements, a playbook for hospitals to prepare for cybersecurity breaches and plans for an updated agency guidance document.

The House on Tuesday (Sept. 25) passed its hazard preparedness reauthorization bill by voice vote.

A major hospital group says FDA needs to step up and mandate cybersecurity for medical devices, a move intended to address risks related to legacy products that can't be updated or adequately patched as Congress considers steps to protect patients from cyber attacks.

In an unusual show of bipartisanship, key lawmakers from the Senate and House sent a letter to HHS Secretary Alex Azar that castigates the department for failing to follow through on key provisions of the Cybersecurity Act of 2015, which tasked HHS with developing industry-based approaches to mitigating cyber attacks.

FDA is seeking $70 million to create a Center of Excellence on Digital Health, which would be tasked with crafting a new regulatory approach toward these products, akin to what FDA is already piloting with its software pre-cert program, according to budget material sent to congressional appropriators.

An FDA-sponsored survey on enhanced cybersecurity for medical devices has found competing influences -- from regulatory requirements to purchasing demands -- that must be overcome to ensure device safety and improved medical treatments.

HHS Secretary Alex Azar is being pressed to weigh in on a dispute over alleged mismanagement of the department's recently established cyber-threat sharing center, which is undergoing a restructuring that a leading HHS cybersecurity official says could undermine the department's ability to assist the health sector in anticipating and responding to cyber attacks.

The Healthcare Information and Management Systems Society in its third annual cybersecurity survey found the Department of Homeland Security's National Cybersecurity and Communications Integration Center ranked among the bottom third of sources for cyber threat intelligence, with “word of mouth” at the top with nearly 70 percent of respondents.