The proposed bill, introduced last month by Sens. Ron Wyden and Mark Warner, is a good step forward, but hospitals may need more funds to boost their cybersecurity practices, experts say.

New federal legislation that aims to set cybersecurity standards for healthcare organizations is needed, but many hospitals will likely require more funds to bring their defenses into compliance — and maintain those improvements, experts say.

The Health Infrastructure Security and Accountability Act, introduced by Sens. Ron Wyden, D-Ore., and Mark Warner, D-Va., last month, would direct the HHS to develop minimum cybersecurity standards for providers, health plans, claims clearinghouses and business associates, including stronger requirements for systemically important entities and those deemed key to national security. 

It also would require covered entities to conduct annual security risk audits, and provide funds to hospitals to help them adopt cybersecurity practices. The bill was referred late last month to the Senate Committee on Finance for consideration. 

“With hacks already targeting institutions across the country, it’s time to go beyond voluntary standards and ensure health care providers and vendors get serious about cybersecurity and patient safety,” Warner said in a statement when the bill was released. 

Experts say the bill is a good starting point to boost cyber preparedness, especially because the healthcare sector is often vulnerable to dangerous attacks.

“We can’t really just let the whole industry do what it wants to do,” said Steve Cagle, MBA, HCISPP, CHISL, CDH-E, CEO of healthcare cybersecurity firm Clearwater. “It’s a bit of the Wild West.”

https://www.linkedin.com/feed/update/urn:li:activity:7253025063875084288