In 2017, HHS delivered the report titled “Cyber Threat Preparedness Report” (CTPR) as required in Section 405 of the “Cybersecurity Information Sharing Act of 2015” (CISA) to the House Committee on Energy and Commerce https://energycommerce.house.gov and the Senate Committee on Health, Education, Labor & Pensions https://www.help.senate.gov.
Bipartisan Senators and Congressmen sent a letter to HHS Secretary Alex Azar https://www.hhs.gov on June 5, 2018, asking for clarification on several issues related to specific aspects of the report.
According to the letter, the CTPR report was intended to clarify HHS’s internal roles, responsibilities, and preparedness to address cyber threats in the healthcare section. The CTPR does provide a high level overview of the cybersecurity responsibilities for each HHS office and operating divisions, but there are a few details as to the specific office that might be responsible to handle cybersecurity incidents that may occur.
For example, if the cyber incident also compromised medical devices, would the FDA https://www.fda.gov need to respond as well? Also, would it be appropriate for one HHS operating division or office to share information with each other?
The authors of the letter, are also not clear as to how HHS would establish the Healthcare Cybersecurity and Communications Integration Center (HCCIC). Congress seeks clarity on how the HCCIC would fit into the larger healthcare cybersecurity picture and if the Center might duplicate work by other entities such as the Department of Homeland Security’s NCCIC Center or the DHS National Health-Information Sharing and Analysis Center (NH-ISAC).
The letter was signed by Lamar Alexander, Chairman, Senate, Committee in Health, Education, Labor, and Pension, and Patty Murray, Member of the Senate Committee on Health, Education, Labor, and Pensions. Also signing were Greg Walden, Chairman, House Committee on Energy and Commerce, and Frank Pallone Jr, Member, House Committee on Energy and Commerce.
Go to https://energycommerce.house.gov/wp content/upleads/2018/06/201806/o5HHS.pdf to view the letter.