The Health Infrastructure Security and Accountability Act (HISAA) introduced in the U.S. Senate on September 26 is another good step forward in addressing key factors contributing to the healthcare sector’s deficiency in establishing and maintaining adequate cybersecurity controls and risk management programs. While there are many in the sector that are already implementing recognized standards, having mandated standards would help to make sure everyone is playing by the same rules.
On September 4, 2024, the State of Texas filed a lawsuit in the U.S. District Court, Northern District of Texas, against the U.S. Department of Health and Human Services (HHS), challenging both the HIPAA Final Rule to Support Reproductive Health Care Privacy (issued April 22, 2024) and the HIPAA Privacy Rule (issued December 28, 2000).
Healthcare organizations reported the highest number of ransomware attacks among the 16 industries classified as critical U.S. infrastructure last year, according to the 2023 FBI report on Internet crime.
