News Events – Page 8 – RISC Management and Consulting

The White House has been in the news over the past two weeks in reports from USA Today, CNN, NBC News, and many more sources. Officials informed NBC News (Mitchell, 2015 April) that it is believed the Russians accessed the system through State Department computers which contained private unpublished schedule of President Obama. While attribution usually takes weeks or months for the FBI’s Cyber Division to determine and publish, the sources of the attacks are less important than the objective. The objective is similar across all of these attacks; to retrieve classified information. According to former FBI official Shawn Henry and the president and CSO of CrowdStrike Services cyber-attacks occur because countries such as China and Russia have the need to look at U.S. polices, how policies are created, new initiatives that are under consideration, basically anything that these foreign countries can get that will provide them with some advantage at the next level of trade talks and collect intelligence against the US for personal gains.

Healthcare organizations need to understand the criticality, reasoning, and determination for these attacks as well. When VIPs such as political or military leaders are seen or treated by their facility, or by a facility they are affiliated or networked with, their systems, networks, and data become a high priority target for foreign threat actors. Healthcare organizations often fail to realize how important their health information data repositories are for reasons entirely Unrelated to identity theft or medical billing fraud. Basic healthcare information about a head of state, a state department official involved in a negotiations process, senior leadership in the military or a congressional committee is incredibly important to both Nation-State actors and Terrorist organizations. Healthcare providers have no idea that cyber-bullets are flying by their ears in this electronic war!

On April 1^st, 2015, President Barack Obama sent out an Executive Order titled “Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled activities”. Here’s a short excerpt from the Executive Order:

Only a few months ago on January 13th, President Obama announced a legislative National Data Breach Notification standard and miscellaneous cybersecurity legislative proposals and efforts. The Executive Order should provide the U.S. government the tools needed to combat the expanding malicious cyber activities. The Executive Order enables the Treasury Department along with the Attorney General and the Secretary of State to impose sanctions on the unlawful actions created by hackers. The goal would be to freeze targets’ assets when operating in the U.S. financial system and prohibiting them from having transaction with American companies.

Both Public and Government sectors must pay immediate and substantial attention to this existing and evolving threat!

References

Henry.S. (2014, November 17). Cyber attacks hit State department email, web. Retrieved from http://www.cnn.com/videos/bestoftv/2014/11/17/lead-intv-henry-state-department-hacking.cnn

Hollywood Reporter. (2015, April 1). Obama creates federal sanctions to deal with cyber attacks. Retrieved from https://www.youtube.com/watch?v=dNFdUphnU18

Mitchell, A.(2015, April). Russia hacked White House last year, U.S. officials says. Retrieved from http://www.nbcnews.com/news/us-news/russia-hacked-white-house-last-year-u-s-officials-say-n337521

Whitehouse.gov. (2015, April 1). The White House: Executive order. Retrieved from https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m

New rules expected to arrive sometime this spring should reduce the 2015 Meaningful Use reporting period to just 90 days from the previously required full year. Many hospitals and health IT organizations were clamoring for a change to reduce the reporting burden for eligible providers and hospitals.

This change and the other proposals listed below will potentially help many providers who have already made steps towards implementing EHR systems but were not capable of reporting for the full year.

Realigning hospital reporting periods to the calendar year to allow eligible hospitals more time to incorporate 2014 Edition software into their workflows and to better align with other quality program.
Modifying other aspects of the programs to match long-term goals, reduce complexity and lessen providers’ reporting burden

The new rules are a welcome reaction to a letter written to CMS this past September co-signed by healthcare industry heavyweights CHIME, HIMSS, MGMA, AHA, and the AMA, urging the agency to address 2015 reporting period requirements. While adoption of EHRs has risen steadily since the first year of the EHR Incentive Program, many providers are struggling to provide all the necessary information in the time frame required. The letter proposed that HHS should “provide for a shortened, 90-day EHR reporting period in 2015, which would give time for providers to continue their transition without having to drop out of the program.”

The new rule “would be intended to be responsive to provider concerns about software implementation, information exchange readiness, and other related concerns in 2015,” wrote Patrick Conway, MD, chief medical officer at CMS, in a Jan. 29 blog post announcing the agency’s decision. “It would also be intended to propose changes reflective of developments in the industry and progress toward program goals achieved since the program began in 2011.”

Source: http://blog.cms.gov/2015/01/29/cms-intends-to-modify-requirements-for-meaningful-use/