HHS Urges Health Sector to Harden Security of PHI, Devices

Federal regulators are advising regulated healthcare firms and third-party vendors to harden their systems, software and medical devices to better safeguard protected health information.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

That includes ensuring that organizations continually patch vulnerabilities, update software, properly configure security settings and disable or remove unneeded software.

Easier said than done, acknowledged guidance the U.S. Department of Health and Human Services’ Office for Civil Rights issued. “Defining, creating and applying system hardening techniques is not a one-and-done exercise,” it said.

Hardening is a necessary measure for protecting data privacy and security – but also in protecting patient safety, the department warned. Medical device security is especially important because these systems are frequently overlooked and difficult to update.

Vulnerability management in the healthcare sector “is both critically important and fantastically difficult,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

The Food and Drug Administration, also a HHS component, requires manufacturers to assess devices for cybersecurity risk prior to ushering new products into market – but ensuring that devices are patched and segmented is a responsibility of medical practices. HHS advised medical practices to consult earlier FDA guidance on medical devices. Medical devices come with a label that includes hardening instructions, OCR noted.

As for data breaches, incidents involving exploited unpatched vulnerabilities, outdated software and misconfigured security settings litter the HHS OCR’s HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

“Most healthcare breaches result from basic security gaps rather than sophisticated attacks, which is why it is so important to assess and address these gaps,” said regulatory attorney Layna Rush of the law firm Baker Donelson. “A security risk analysis that does not result in remediation of the identified deficiencies is meaningless,” she said.

Operating systems, electronic health records, databases, web servers, mobile applications, office applications, email software – as well as firmware, should all figure in vulnerability mitigation and hardening activities, HHS OCR said.

This difficulty of hewing systems to a secure baseline is that “many technologies in healthcare cannot use current operating systems or applications because of the FDA’s glacial approval process,” which results in the ongoing use of devices with outdated legacy operating systems and software that is no longer supported by vendors, said Hamilton.

Nonetheless, entities need to take critical actions to address mitigation of vulnerabilities and patching, he said. “Criminal and nation-state actors are using automated vulnerability detection and exploit mere minutes after announcement and patch release,” he said.

Rush recommends that entities regularly review and update to asset inventories, and incorporate decommission processes in asset inventory policies. This “can help weed out unneeded IT and the risks associated with unnecessary legacy systems and/or devices.”

The security hardening guidance also appears to fall in line with HHS OCR recently signaling that it will more closely scrutinize the overall security risk management practices of regulated entities, including the steps these organizations take to mitigate issues identified during HIPAA security risk analysis.

Hardening guides abound, “but because of the highly regulated nature of covered entities and the potential threat to patient care, only those that are approved by HHS or the FDA should be used to limited liability on those technologies that are already in operation,” Hamilton said.