New York State’s stringent new hospital cybersecurity requirements will have a ripple effect, raising security standards and expectations for healthcare providers across many other states, predicts Chris Stucker, deputy CISO at Wisconsin-based Froedtert ThedaCare Health.
On Oct. 1, the compliance deadline for most provisions of New York State’s cybersecurity regulations for general hospitals went into effect. Those requirements include everything from multifactor authentication and risk analysis to incident response and designating a CISO.
The latest requirements follow a rule requiring hospitals to report cyber incidents to the state health department within 72 hours, which took effect in October 2024 (see: New York State Enacts New Cyber Requirements for Hospitals).
“The 72-hour incident reporting – that’s not a huge deal, that’s not that bad,” Stucker said. But other requirements of the regulations will prove to become more complicated – and not just for hospitals in New York, he said.
“We talk about the designation of a CISO, a qualified CISO. It can’t just be ‘Brad’ from accounting anymore, who built a PC once. And the need for each hospital to appoint a qualified CISO is something that I think will have broad ripples, because we don’t have enough of those,” he said in an interview with Information Security Media Group.
“I do think everyone is watching New York right now. I think it’s a huge test lab for all of us to see what works and doesn’t work, and be prepared. And you’re going to see organizations aligning. You’re going to see insurance aligning,” he said.
“I absolutely predict that within a year or two, one of the questions on many cyber insurance questionnaires will be: ‘Are you aligning to the regulations set forth in New York?'” he said. “So it’s going to raise the bar for everyone, which is a really good thing.”
In the interview (see audio link below photo), Stucker also discussed:
- Why hospitals in New York state might consider recruiting hospital CISOs from other states, and the cybersecurity workforce impact that could result;
- The effect of civil class action lawsuit safe harbors in some other states, such as Utah;
- Top priorities and projects at Froedtert ThedaCare in the months ahead, including an identity “overhaul.”
As deputy CISO at Froedtert ThedaCare Health, a large integrated healthcare system, Stucker leads enterprise security strategy through rapid modernization, including identity transformation, zero trust and cloud resilience at scale. Over his more than 20-year tenure, Stucker has led teams through mergers, crisis response and transformation projects. He is also an adjunct professor at Southern Utah University. Prior to joining Foredtert ThedaCare Health, Stucker held various leadership roles at Banner Health, Taghleef Industries, Applied Extrusion Technologies and Thomas Jefferson University Hospitals. He began a career in military intelligence as an officer in the U.S. Army.