White House: HHS has sufficient cybersecurity regulations

The Department of Health and Human Services (HHS) need not issue any more regulations governing cybersecurity.

The “administration has determined that existing regulatory requirements, when complemented with strong voluntary partnerships, are capable of mitigating cyber risks to our critical systems and information,” according to a blog post from White House Cybersecurity Coordinator Michael Daniel.

Other agencies not required to issue additional regulations include the Department of Homeland Security and the Environmental Protection Agency.

In February 2013, a presidential executive order required agencies to determine whether existing regulations were sufficient and could be better aligned with the National Institute of Standards and Technology’s cybersecurity framework issued earlier this year. The HHS had determined that its regulatory requirements were adequate.

While the White House agreed more regulations are unneeded, Daniel stressed that cybersecurity efforts are ongoing.

"This doesn’t mean that we don’t have more work to do to secure our critical systems and information throughout the country. Nor does it mean that we can stop working to ensure that regulations as written are clear, streamlined and harmonized. It does mean that agencies with regulatory authority have determined that existing regulatory requirements, when complemented with strong voluntary partnerships, are capable of mitigating cyber risks to those systems," Daniel wrote. "Over the next two years, these departments and agencies will jointly investigate and leverage opportunities to improve the efficiency, clarity and coordination of existing regulations."

Read the blog post here.