FRISCO, Texas--(BUSINESS WIRE)--HITRUST, in partnership with the U.S. Department of Health and Human Services is announcing they will conduct monthly cyber threat briefings. The briefings will aid organizations to better understand current and probable cyber threats relevant to organizations in the healthcare industry and share best practices for cyber threat defense and response. In addition, HITRUST has established a cyber threat alerting system to notify healthcare organizations when HITRUST’s Cyber Threat Intelligence and Incident Coordination Center (C3) identifies high probability and impact cyber threats targeted at the healthcare industry. The healthcare industry’s cyber alerting system, C3 Alert, is being coordinated with the Healthcare and Public Health Sector and Government Coordinating Councils.
“Government and industry cooperation and coordination are key to effectively and efficiently preparing the industry for cyber attacks,” said Dr. Earl Motzer, Co-Chair of the Healthcare Sector Coordinating Council established under the National Infrastructure Protection Plan (NIPP). “Availability of this information is a positive step in the industry’s cyber threat preparedness.”
The number of cyber attacks targeted at healthcare industry organizations of all types and sizes continue to increase, while research indicates that most healthcare organizations are not adequately addressing cyber threat preparedness and response. The unique, complex and ever changing aspects and complexities associated with cyber threats appear to have created challenges for many organizations to rapidly and effectively remediate. Some primary gaps include access to cyber-related intelligence specific toward healthcare organizations to aid in assessing and prioritizing threats and risks, better education on how to consume and react to cyber threat information and support for establishing their cyber incident response capability.
An analysis of HITRUST Common Security Framework (CSF) assessments performed over the last year indicates progress has been made in every information security control area across various segments and organizational sizes, although the most progress with regard to cyber security appears to be in larger organizations with annual revenues over $6 billion.
“Collaboration is crucial to reducing cyber threats for the entire healthcare industry, including the government,” said Kevin Charest, Chief Information Security Officer, U.S. Department of Health and Human Services. “These briefings and alerts allow us to better disseminate valuable and critical information to healthcare organizations more effectively so they can better prepare and respond to cyber threats and events.”
“Even with our size and level of our information security program’s maturity, I recognize that participating in a functional information sharing and analysis organization, like HITRUST C3, is key to ensuring we have access to the latest and most accurate threat intelligence,” said Roy Mellinger, Vice President and Chief Information Security Officer, WellPoint, Inc. “I also recognize that we need to make sure every organization in healthcare has access to cyber threat alerts, analysis and best practice information to better protect the entire healthcare industry.”
The health industry’s monthly threat briefings will be free of charge, leveraging the resources and content created by the HITRUST C3 and U.S. Department of Health and Human Services Computer Security Incident Response Center (HHS-CSIRC), in order to provide greater and more actionable information on recent, ongoing and prospective cyber threats and events, as well as any lessons learned. The briefings are intended to support healthcare organizations of all sizes as well as cyber-security maturity levels. The briefings begin in April 2014 and will be held online, lasting 60 – 75 minutes. In addition, the material presented will be made available to those registered. The C3 Alerts, free of charge, will be issued anytime HITRUST C3 identifies a present and immediate cyber threat relevant to a large number of healthcare organizations, medical devices or systems.
“Having access to alerts, threat intelligence and lessons learned that are relevant to our organization is important, as it helps ensure that we will maximize our efforts in addressing cyber threats. Information protection is a priority for our organization, but we need to be as efficient as possible in doing so,” explained Aaron Miri, Chief Technology Officer, Children’s Medical Center of Dallas. “The sharing of threat intelligence and best practices will aid the industry and help raise the maturity level of the entire industry by allowing all organizations, small and large, to have access to vital cyber threat and best practices through the industry’s information sharing and analysis organization, HITRUST C3.”
Recognizing the growing threats posed by cyber attacks targeted at healthcare organizations, over two years ago, HITRUST established a fully functional cyber-threat intelligence and response capability to protect the U.S. healthcare industry from disruption by these attacks. The HITRUST C3 is the single best source of intelligence on threats targeted at healthcare organizations, systems and medical devices, providing actionable information for strategic planning, tactical preparedness and coordinated responses for both small and large organizations. The center facilitates critical intelligence sharing with industry organizations, the Department of Homeland Security and U.S. Department of Health and Human Services.
“The healthcare industry now has access to many resources in order to prepare and respond to cyber threats and events, such as the C3 Monthly Briefings, C3 Alerts, C3 threat intelligence and incident coordination and the CSF,” said Daniel Nutkis, CEO, HITRUST. “HITRUST will continue working with the U.S. Department of Health and Human Services and HPH Sector Coordinating Council to aid organizations in using these tools to reduce the risk of cyber-related events.”
Recently, HITRUST released version 6 of the CSF, the most widely-adopted security control framework in the U.S. healthcare industry, with updates to CSF controls, control mappings and prescriptive guidance based on an analysis of the SANS Critical Security Controls for Effective Cyber Defense, cyber-related breach data and the NIST Cyber Security Framework. This allows healthcare organizations of all types and sizes to have one risk management framework for the protection of health information that contains the requirements and guidance relevant to the healthcare industry.
Most recently, HITRUST, in coordination with the U.S. Department of Health and Human Services, announced plans for the CyberRX exercises in 2014. The exercises will examine both broad and segment-specific scenarios targeting information systems, medical devices and other essential technology resources of the healthcare industry.
For more information or to register for the C3 Monthly Briefing or C3 Alerts please go to www.hitrustalliance.net/cyberupdates/.
About HITRUST
The Health Information Trust Alliance (HITRUST) was born out of the belief that information protection should be a core pillar of, rather than an obstacle to, the broad adoption of health information systems and exchanges. HITRUST, in collaboration with healthcare, business, technology and information privacy, risk and security leaders, has established a number of programs to support any and all organizations that create, access, store or exchange personal health and financial information. HITRUST is supporting the industry through its framework, assurance program, cyber center, risk management tools, education and leadership. It is also driving the widespread confidence in the industry’s safeguarding of health information through awareness, education, advocacy and other outreach activities. For more information, visit www.HITRUSTalliance.net.
All product and company names herein may be trademarks of their respective owners.