AHA comments on NIST proposed cybersecurity framework

In response to the National Institute of Standards and Technology's (NIST) call for comments regarding a cybersecurity framework, the American Hospital Association (AHA) is urging the agency to ensure that the framework remains flexible and voluntary within the healthcare industry's private sector.

NIST opened a comment period on a proposed cybersecurity framework on Oct. 29.

NIST's data encryption standards are used in electronic healthcare data security and exchange. In November, the institute announced that its processes for developing data encryption standards would undergo internal and independent formal reviews.

AHA's letter was sent to Patrick Gallagher, under secretary of commerce for standards and technology at NIST, and agrees with the five core functions of the proposed framework--identify; protect; detect; respond; and recover. However, the association believes the framework should include the following, according to its letter:

• Consider how to reconcile disparate cybersecurity implementation standards;
• Provide ample time for implementing changes; and
• Include existing data security rules that are applicable to health care groups, such as HIPAA and the HITECH Act.

Entities that interact with hospitals, such as medical device companies, physician practices, insurers and individual patients, should be involved in cybersecurity risk assessment and reduction activities as well, AHA wrote.