HITRUST working group targets cyber threats

Laura Pedulli | | Health Exec | Cybersecurity

The Health Information Trust Alliance (HITRUST) is stepping to the plate to support a Feb. 12 White House Cybersecurity Executive Order that calls for enhanced government and industry collaboration against ongoing cyber threats.

HITRUST announced on Feb. 20 the convening of a working group to develop frameworks to prevent cyber attacks and intrusions, which the executive order describes as “one of the most serious national challenges we must confront.” Threats to the healthcare industry encompass the disruption of information systems and medical devices directly involved in patient care, as well as IT systems affecting manufacture and distribution of medications.

Policy orders specifically called for voluntary programs to develop a “Cybersecurity Framework” and identification of critical infrastructure most at risk. This framework “shall include a set of standards, methodologies, procedures and processes that align policy, business and technological approaches to address cyber risks … and shall incorporate voluntary consensus standards and industry practices to the fullest extent possible,” according to the order.

HITRUST said the working group dovetails existing public-private collaborations between the healthcare industry and government, including information sharing and incident response through the HITRUST Cyber Threat Intelligence and Incident Coordination Center.

“There is no doubt in my mind that the sharing of cyber threat information and coordinated incident response has benefited both industry and government,” said HITRUST CEO Daniel Lutkis in a statement.   

“The Department of Health and Human Services [HHS] has first-hand experience that collaboration with industry can provide value to both industry and government,” HHS Chief Information Security Officer Kevin Charest stated.

As HITRUST already has in place a widely used Common Security Framework (CSF), it said the working group’s efforts will include updates to the controls in the CSF and offer guidance of prioritizing the implementation and these controls based on current cyber security risks.

Laura Pedulli

Related Content

Healthcare hacker sentenced to 10 years in prison
Ransomware group deploys ticking clock to threaten Georgia hospital
Hackers were inside an Iowa hospital’s network for two weeks
Microsoft: Ransomware hit nearly 400 healthcare entities this year—a 300% rise since 2015
Feds make it official: Change data breach was the largest in healthcare history, impacting 100M
CMS contractor takes $1.2M loss after data breach, DOJ lawsuit

Around the web

Cardiovascular Business
Payment cuts and beyond: Key takeaways for cardiologists from the 2025 Medicare Physician Fee Schedule

The American College of Cardiology has shared its perspective on new CMS payment policies, highlighting revenue concerns while providing key details for cardiologists and other cardiology professionals. 

AI in Healthcare
A modest proposal to rally AI regulators around a simple game plan

As debate simmers over how best to regulate AI, experts continue to offer guidance on where to start, how to proceed and what to emphasize. A new resource models its recommendations on what its authors call the “SETO Loop.”

Cardiovascular Business
FDA commissioner urges clinicians to join fight against medical misinformation

FDA Commissioner Robert Califf, MD, said the clinical community needs to combat health misinformation at a grassroots level. He warned that patients are immersed in a "sea of misinformation without a compass."