America’s Vulnerable Health Care System

This spring’s cyberattacks on health care providers and insurers had a devastating impact, with hospitals unable to treat patients and Americans nationwide facing challenges in accessing or affording their medications. These attacks are part of a significant surge in cyberattacks targeting the health care industry.

A February attack on Change Healthcare, a company that processes insurance claims, potentially exposed the data of up to one-third of Americans, as reported by the CEO of UnitedHealth, which owns Change Healthcare.

Health care organizations are prime targets for cyberattacks due to the valuable information they possess, as well as outdated software and infrastructure that make them vulnerable, according to experts.

Experts suggest that health care organizations have neglected cybersecurity measures due to high costs and the complexity of the industry, making them more susceptible to attacks.

The Biden administration has proposed fines for organizations that fall victim to cyberattacks to encourage better cybersecurity practices among insurers and providers. However, some experts believe that fines may not be the most effective approach.

The American Hospital Association opposes the idea of fines, arguing that it would impact their resources needed to combat cybercrime and hinder efforts to prevent attacks.

There is a call for a more effective approach to cybersecurity that focuses on patient and system security rather than just compliance. The attack on Change Healthcare in February sparked an antitrust debate in Congress.

Lawmakers and experts highlight the importance of being prepared for cyber threats, as hackers continue to target vulnerable sectors of the health care industry.

“You can measure the existence of a control, but assessing its effectiveness is more challenging,” said Alex Hamerstone, a cybersecurity expert. The industry must focus on enhancing security measures rather than just meeting regulatory requirements.

Experts emphasize the need for readiness and vigilance to combat cyber threats, especially in the wake of attacks that target critical sectors of the health care industry.