OIG: Cybersecurity One of Top 10 Management and Performance Challenges Faced by HHS
The Department of Health and Human Services’ Office of Inspector General (OIG) has published its annual report on the top management and performance challenges faced by the HHS.
The report lists 12 major challenges that the HHS must overcome to ensure the department achieves its aims. Given the scale of the current opioid crisis in the United States and its impact, the prevention and treatment of opioid misuse has topped this year’s list.
The report also draws attention to the importance of cybersecurity protections to mitigate threats to be confidentiality, integrity, and availability of health data. Protecting HHS data, systems, and beneficiaries from cybersecurity threats made 10th spot in this year’s list.
In the report, OIG explained that “data management, use, and security are essential to the effective and efficient operation of HHS’ agencies and programs.” Ensuring the integrity of IT systems and the confidentiality and availability of healthcare data are critically important to the health and well-being of Americans.
The HHS has a $5 billion annual budget for IT; a proportion of which is devoted to cybersecurity to ensure data and IT systems are kept secure. The HHS faces major challenges securing its highly complex systems and must store ever increasing volumes of data securely: Data which are spread across multiple locations and are accessible by many entities and individuals. Further, in recent years there has been a major expansion in the use of IoT technology and networked devices, which introduce many new risks. The HHS must ensure its internal systems are protected and is required to oversee the security of cloud data and ensure providers, contractors, and grantees are adhering to cybersecurity best practices.
OIG explained that the types of data used, stored, and transmitted by the HHS are of high value to cybercriminals and are up to ten times more valuable than credit card numbers. Consequently, the HHS is a major target for hackers.
If the HHS fails to secure its data and systems, not only could patients come to harm, it has potential to hinder Federal initiatives such as the NIH ‘All of Us’ Research program, preventing them from achieving their full potential.
OIG reports that the HHS lacks robust resources to prepare cybersecurity staff to respond to cyberattacks and has not thoroughly tested its incident response and recovery procedures, although significant progress has been made in improving cybersecurity protections.
The HHS budget for 2017 allocated $50 million to meet the HHS’s cybersecurity needs and ensure that sensitive data, and the systems on which the information is stored, are kept secure. Part of that budget has been spent on monitoring tools to ensure security compliance, threat hunting technologies have been deployed in some HHS agencies, and the staff of all agencies is now provided with ongoing cybersecurity awareness training.
Cybersecurity testing is conducted in conjunction with the Department of Homeland Security and there is a continuous dialogue across HHS agencies on the cybersecurity and operational challenges faced by the department. While significant progress has been made, there is still a great deal of work to be done.
OIG explained that the HHS needs to develop a well-designed contingency program for cyber-defenses, in addition to those for natural disasters. HHS must also take a more proactive approach to identify and address current and future vulnerabilities before they are exploited, including addressing vulnerabilities that have previously been discovered by OIG and other agencies. HHS must also focus on its capabilities to respond efficiently to a wide range of cybersecurity threats.
The HHS also needs to assist healthcare organizations address threats, which is best achieved through information sharing. Dissemination of threat information and strategies to mitigate threats is essential to ensure that cyberthreats do not result in widespread disruption in the healthcare sector.
The HHS should therefore continuously seek opportunities to partner with other government agencies, academia, private sector companies, and state governments to share cybersecurity information on emerging risks, threats, and best practices.
The HHS must also engage the healthcare and public health sectors to ensure that threat intelligence is communicated effectively and foundational cybersecurity best practices are made available.