I. Background

While the push toward EHRs was perhaps officially spurred with the enactment of the Health Insurance Portability and Accountability Act of 1996 (HIPAA),²⁶ it has taken the health care industry a number of years and different legislative efforts to achieve more widespread EHR adoption.^{Reference Blumenthal, Tavenner and Charles27} Finally, following enactment of the Health Information Technology for Economic and Clinical Health Act (HITECH) in 2009, health care providers undertook rapid and widespread adoption of EHR systems.²⁸ By 2017, nearly eighty-six percent (86%) of physicians used an EHR system (with just over seventy-nine percent (79%) using a certified EHR system),²⁹ and ninety-six percent (96%) of all hospitals possessed a certified EHR system.³⁰

While more comprehensive use of EHRs across various providers has had certain positive impacts on health care services and quality care through a decrease in prescribing errors, reduction of duplication of services, compliance with standards of care, and improvement of patient safety,^{Reference Yanamadala31} the transition to an electronic format has been challenging and not without controversy.^{Reference Freudenheim and Arndt32} Certainly, regulators anticipated the need for increased privacy and security measures once data was transferred into an electronic format and more widely shared among providers and suppliers, as evidenced by enactment of HIPAA and its privacy and security regulations.^{Reference Solove33} But, the modern day sophistication and skill of internet hackers and other cyber criminals and associated tactics could not yet have been imagined.^{Reference Zetter and Farringer34} Thus, while the health care industry and its patients are by now well trained on standard HIPAA privacy protections, many providers remain unaware or unprepared for more comprehensive cybersecurity risks posed by deliberate third party actors.³⁵

Certainly, the health care industry has not been alone in facing a frightening new reality of cyber-espionage and theft of intellectual property, trade secrets, and government information.^{Reference Tran36} Noting an 1100% increase in incidents of loss, theft, and exposure of personally identifiable information from 2006 to 2015,³⁷ U.S. Congress reacted to this new threat by enacting the CISA.³⁸ The CISA established the Task Force and tasked it to to address cybersecurity in the unique setting of the health care industry in the form of six tasks.³⁹ The Task Force issued six imperatives and related recommendations and action items.⁴⁰ Noting the challenges in attempting to create uniform recommendations for an industry described as a “mosaic,”⁴¹ the Task Force identified three major risk areas across the industry.⁴² First, it noted that there is a distribution of different types of risks across the health care value chain in the context of cybersecurity, which includes risk to: the confidentiality of medical records data; the availability of the data; the integrity of the data; and patient safety.⁴³ Further, these risks vary across the numerous sectors that comprise the health care industry.⁴⁴ For example, the greatest cybersecurity risk to a healthcare provider in the provider's daily practice might be of little to no risk to an equipment manufacturer. Ensuring protection of each part of the EHR system, however, is critical to the protection of the system as a whole.⁴⁵ Second, the Task Force considered risks to EHRs specifically and noted that while lack of interoperability is one of the obstacles that creates the greatest risk to achieving cybersecurity, interoperability through a “shared, publicly-available application interface could expose EHRs to additional attack vectors.”⁴⁶ Thus, any potential solutions or a regulatory framework designed to establish interoperability must be developed with these increased risks in mind.⁴⁷ Interoperability and how to achieve it has been a particularly vexing issue over the years, as a number of initiatives for health information exchanges have been attempted, but few successes have been realized in achieving wide-spread use or adoption.^{Reference Miliard48} Achieving greater data sharing while simultaneously protecting this now consolidated data remains a key area of concern. Lastly, the Task Force considered risks posed through medical devices, software, and other connected devices that are not themselves a medical record, but compromise the integrity of the whole because of the connectedness to an EHR network more generally.⁴⁹

Acknowledging these differing risks and having established the lens through which the Task Force worked in trying to consider the best approach for cybersecurity, the Task Force provided recommendations and action items both specific to particular sectors or devices and broadly directed to the industry more generally.⁵⁰ The breadth and depth of the recommendations and action items demonstrate how challenging mitigating cyber risk is and will continue to be in the health care setting.⁵¹ As contrasted by HIPAA statutes and regulations, the imperatives encompass confidentiality and security related to the maintenance of such confidentiality, along with the competing concerns of access to information, integrity of information, and related potential harm to patients if the information is either inaccessible or compromised.⁵² Thus, the Report considers numerous ways in which the industry is vulnerable to cyber threats and addresses each particular threat, presenting action items for how each could be remedied or approached.⁵³ The Task Force concedes that its structure could encourage industry participants to implement only such action items that pertain to one's specific needs.⁵⁴ The Task Force warns against adopting only some of the action items, however, because it will not likely achieve the same benefits and will not “maximize [one's] financial investments and personnel resources.”⁵⁵

In the two years since the issuance of the Report, Congress has taken additional legislative action to address some of the specific challenges of interoper-ability and connectivity.⁵⁶ The 21st Century Cures Act (the “Cures Act”),⁵⁷ enacted in 2016,^{Reference Loumbas58} seeks to promote(s) nationwide interoperability that thus far has been plagued by “deficits in trust between organizations and by anti-competitive behavior that results in the holding of patient [electronic health information]”⁵⁹ and by the sheer number of EHR vendors that exist, each on different platforms and designed for different specialties.^{Reference Sullivan60} The Cures Act requires the Office of the National Coordinator for Health Information Technology (ONC) to “defin[e] the requirement for health IT developers of certified health IT to publish application programming interfaces (APIs) that can be used ‘without special effort’ to drive individual, clinician, and payer access to clinical data; and [to develop] a comprehensive approach to address information blocking.”⁶¹ Further, the Cures Act directs the ONC to “develop or support a trusted exchange framework, including a common agreement among health information networks (HINs) nationally.”⁶² The ONC has released two drafts of the Trusted Exchange Framework and Common Agreement, which endeavor to create the necessary rules and regulations for sharing electronic health information across networks and develop a governance structure that can eventually spur interoperability between disparate networks to increase quality care and patient safety.⁶³ While the ONC acknowledges the need for HINs to establish baseline privacy and security requirements as required by HIPAA, the Common Agreement does not utilize HIPAA requirements as a baseline.⁶⁴

It cannot be overstated that interoperability poses its own unique set of challenges, including the fact that one effect of interoperability is greater amounts of data consolidated into one place.^{Reference Gering65} Certainly, this is a reason to be both cautious and thoughtful when considering implementation and infrastructure of interoperability. While these concerns remain, the Task Force recognizes that increased interoperability and promotion of a common security framework can have a positive impact on curbing cyberattacks⁶⁶ and as progress towards achievement of its ultimate goals.⁶⁷

In addition to interoperability, the Task Force has reported some progress in each of the six imperatives, ranging from development or participation on certain committees to the creation of educational and resource materials to inform the industry about the need for action and diligence.⁶⁸ As with the imperatives themselves and the impacts of the associated action items, progress has been variable across sectors,^{Reference Snell69} but no changes have been able to fundamentally transform cybersecurity wholesale.⁷⁰ Thus, various sectors of the industry are taking action on certain items, but widespread movement towards an industry-wide effort to tackle common and complex security issues remains stagnant. It is not surprising that early efforts have concentrated primarily on educational efforts, as the Task Force recognizes that one of the biggest challenges to addressing cybersecurity will be mitigating the current fatigue that many providers in the industry are already feeling with the move into the digital space.⁷¹

II. Structural Challenges to Cybersecurity Recommendations

The Report has elicited certain themes regarding the key structural challenges that exist within the health care industry that make addressing cybersecurity risks especially difficult.⁷² First, the size and structure of the various organizations that comprise the health care industry across all of its sectors are hugely diverse, which often results in a disparity of resources to implement system-wide change.⁷³ This structural reality creates implementation barriers across a number of different imperatives and recommendations.⁷⁴ Although diversity of size, scale, and scope by itself is not necessarily a detriment to the patient-level delivery of health care services^{Reference Squires and Blumenthal75} or to the provision of quality care, it does create a significant incongruence in how differing components of the health care industry — even within sectors — are reacting and responding to cyber-security risks.⁷⁶ Thus, while large systems might have the resources, infrastructure, governance support, and personnel to implement the necessary tools to be prepared for a cyberattack, a small physician practice might have limited resources and little motivation to dedicate hard-earned practice dollars to security for EHRs.⁷⁷ Similarly, large-scale medical device manufacturers might have an entire team of people focused on ongoing data security and protection, whereas a small manufacturer might have limited resources beyond basic production and maintenance.⁷⁸ This resource disparity is not an issue that is easily addressed at the sector-level or at the industry-level given that the dichotomy of organizational size and financial capabilities is at least in some part a product of the existing legal framework that hinders consolidation and collaboration rather than encourages or promotes resource sharing.⁷⁹ That said, even when legal waivers have been granted to try and ease these regulatory burdens, moving into a new and different payment structure has been difficult and challenging.^{Reference Hush80}

Second, the existing regulatory scheme that governs the health care industry, including the affordable Care Act (ACA),⁸¹ HIPAA, HITECH, the Physician Self-Referral Law (known as the “Stark Law”),⁸² the Anti-kickback Statute (AKS),⁸³ the False Claims Act,⁸⁴ and various other state laws, provides significant barriers toward collaboration and interoperability. The Stark Law and the AKS often stand as obstacles toward the sharing of resources that could facilitate larger organizations assisting smaller organizations with technology and cybersecurity resource needs.⁸⁵ The Report stated: “We strongly encourage Congress to evaluate an amendment to [the Stark Law and the AKS] specifically for cybersecurity software that would allow health care organizations the ability to assist physicians in the acquisition of this technology, through either donation or subsidy.”⁸⁶ It should be noted that CMS published a proposed rule for modernizing the Stark Law on October 17, 2019.⁸⁷ Included in the proposed rule is an amendment to the existing Stark Law exception that would clarify the requirement regarding interoperability, prohibit information blocking and data locking, and further include software and hardware that is not only related to the EHR itself but is instead for cybersecurity purposes to “protect” EHRs.⁸⁸ CMS is seeking comments about whether to make the exception permanent or extend the current timeline, which contemplates the exception sunsetting after a time.⁸⁹

Although certain exceptions and safe harbors exist that provide health care organizations with some protections, those exceptions and safe harbors do not go far enough to assist with expenses and resource needs that extend beyond an initial purchase or implementation.^{Reference Greaney and Ross90} Additionally, some organizations are bound by state laws that apply similar restrictions as those imposed at the federal level.⁹¹ Moreover, even if hardware and software challenges are addressed under applicable exceptions and safe harbors, other federal laws such as HIPAA and HITECH create data sharing barriers.⁹² Indeed, the Task Force noted that even the threat of breaches and penalties, fines and public disclosure can chill an organization from sharing information with other providers.⁹³ While the ACA created some avenues for greater collaboration and data sharing,⁹⁴ programs such as the Medicare Shared Savings Program do not act as a complete waiver of existing constraints under the Stark Law, the AKS, the False Claims Act, and applicable antitrust law; rather these laws impose other obligations and requirements that have made widespread provider adoption incongruent.^{Reference Bleser and Castellucci95} Because mitigating cybersecurity risk is premised at least in part on the ability to share information and anticipate new attacks, the complicated and web-like regulatory structure remains a challenge for the industry, especially providers.

A third theme emerging from the Report is the challenges posed by the continued lack of consistent and secure interoperability among and between systems, providers, medical devices, medication delivery systems, and other “Internet of Things” (IoT).⁹⁶ Granted, of those systematic challenges that complicate meaningfully addressing cybersecurity risk, interoperability seems to be the area with the most currently active and ongoing reform efforts.^{Reference Pittman97} Such reform efforts, however, have been inconsistent in their application, beginning with attempts to implement state-led health information exchanges before moving to a more federally-led effort as set forth under the Trusted Exchange Framework.⁹⁸ The convenience and advantages of connectivity among various medical devices and other technology, such as wearable technology or programmable pacemakers, is prompting such connectivity to take place prior to any comprehensive regulations or requirements.^{Reference Tschider99} Absent clear guidance regarding a specific infrastructure for interoperability, many data users, including providers and patients, are creating their own mechanisms for sharing data, not all of which may be as secure as would be required or recommended by industry guidance.^{Reference Shackelford100}

Additionally, connecting all of the various sectors makes sense at the patient level, but the sectors themselves are not governed by the same agencies and therefore are subject to disparate rules and regulations.¹⁰¹ For example, the federal Food & Drug Administration (FDA) has created guidance for Postmarket Management of Cybersecurity in Medical Devices to address some of these vulnerabilities, but the guidance is voluntary and addresses a portion of the “stakeholders,” many of which are not regulated by the FDA.¹⁰² Thus, although interoperability could address some cybersecurity concerns, connectivity without interoperability creates greater risk and vulnerabilities for the industry as a whole.¹⁰³ Achieving interoperability can actually mitigate known risks if it promotes large, resource heavy industry leaders to implement necessary controls across the continuum.

Finally, the fourth theme arising out of the Report regarding systematic obstacles relates to the myriad regulatory agencies that govern different aspects of the health care industry, which lack coordination and consistency in their approaches to cybersecurity risk mitigation.¹⁰⁴ Medical devices exemplify the quagmire that competing regulatory agencies create in the context of cybersecurity.¹⁰⁵ The FDA governs the manufacture and sale of medical devices, including the marketing of and the safety and efficacy of such devices.¹⁰⁶ Medical devices often times will contain personal health information, but manufacturers are not subject to HIPAA or the security regulations governing providers.^{Reference Wellington107} In contrast, the providers who use, install, and work with medical devices are subject to HIPAA for purposes of privacy and confidentiality of patient data, which is overseen by the Office for Civil Rights (OCR).¹⁰⁸ OCR imposes its own set of regulations and assesses applicable penalties for violations of HIPAA or HITECH regulations,¹⁰⁹ independent of other rules and regulations imposed by the CMS and enforced by the Office of Inspector General, and the Federal Trade Commission.¹¹⁰ Yet, in order to mitigate cybersecurity risk, there needs to be a consistent approach among all components of an electronic health system, including medical devices, EHRs, medication delivery systems, and other IoT items. Although agencies have promoted industry participants to follow the National Insitute of Standards and Technology (NIST) standards, all such recommendations are voluntary and do not necessarily align with existing regulatory structures.¹¹¹

Although some of the specific recommendations and action items can be accomplished, these four systematic issues seem to permeate through all of the six imperatives and impact the ability for the health care industry to focus its attention on specific cyber-security issues such as preventing ransomware attacks or shoring up other EHR vulnerabilities. Unless and until there are changes to the health care infrastructure itself, there is a danger that entities will undertake recommendations and action items that are the most easily accomplished, leaving some of the most vexing imperatives implemented only in part.¹¹² Unfortunately, this seems to be exactly what the Task Force was attempting to guard against when it stated that partial adoption of the recommendations and action items will not “maximize their financial investments and personnel resources.”¹¹³ Granted, wholesale adoption of all recommendations and action items will be challenging to achieve without comprehensive system reform.

III. Argument

What seems clear when considering these themes collectively is that identifying the structural issues that will create greater cybersecurity risk for the healthcare industry is a necessary first step because it narrows the scope of the types of reforms that will impact cyber risk. Many of the barriers to the industry, however, are not specific cybersecurity challenges, but are issues intertwined and endemic to the very nature of the current healthcare infrastructure. Therefore, while the Report is important work, it is insufficient to help fuel significant movement or change that will take adequate steps to enhance cybersecurity generally until more meaningful reform is enacted or implemented that addresses some of the systematic infrastructure issues that exacerbate cybersecurity risks.¹¹⁴

Health care “reform” has become a rather generic term, but can mean a number of different types of changes to healthcare delivery and payment mechanisms. Most, if not all, ongoing reform initiatives and current reform proposals address only some of the systematic barriers that complicate cybersecurity advancement. For example, so-called “Medicare for All” proposals that have been suggested by various Democratic candidates are largely focused on payment and access reform.¹¹⁵ While these goals are laudable, when considering cybersecurity specifically, a single payor system or public option that does not seek to address some of the interoperability and resource issues and help promote greater emphasis on the importance of cybersecurity efforts will do little to correct many of the systematic challenges mentioned above. The United Kingdom (U.K.)¹¹⁶ provides a case study of this point: in 2018, the U.K.'s National Health Service (NHS) experienced a massive data breach when it was attacked by the “WannaCry hack,” which shut down access to and demanded ransom payments from a third of hospital trusts in the U.K. and eight percent (8%) of primary care practices.^{Reference Field117} The attack was thought to have occurred due to the use by several hospital trusts and primary care practices of Windows XP, an operating system that dates back to 2001 and that Microsoft ceased to support in 2014.^{Reference Page118} While NHS provides health care services to any and all residents who need the services, similar to what is contemplated in a Medicare for All-type option, hospitals maintain their own systems and the U.K. has not yet transitioned to a common platform among all contracting providers.^{Reference Newdick and Maguire119} Thus, even with adoption of a Medicare For All-like plan, the same cybersecurity challenges would remain absent a specific focus on interoperability and common infrastructure and shared platforms as part of reform efforts.

In contrast, while a single payor system or public option regime as currently contemplated would not address all infrastructure challenges that affect cyber-security, these systems could lessen the chaos and confusion caused by the multiplicity of laws, regulations, and regulatory agencies governing the industry to the extent that the payment reform eliminated or reduced the need for certain legal hurdles. For example, enactment of the Stark Law and renewed enforcement of the AKS arose out of a fee-for-service payment structure that incentivizes volume of services and services reimbursed at the highest rate.^{Reference Furrow120} Adopting payment reform that shifts the focus away from fee-for-service — or at least away from medical decision making that maximizes financial productivity as opposed to quality care — will reduce the need for application of laws that hinder collaboration or care coordination. Some of this payment reform has been ongoing through efforts to shift payment from volume-based to value-based — largely a focus on the twin goals of reducing cost and improving quality care in the form of enhanced outcomes.^{Reference Kane121} These efforts promote care coordination and reduction in duplication of services and could help to enhance cybersecurity if achievement of such goals promotes collaboration and data sharing. For example, in a bundled payment model, providers will need to focus on assuring that the most cost efficient and effective provider is rendering the necessary medical care, which can be achieved through shared protocols and shared access to the medical record. A large hospital system that operates a sophisticated cybersecurity program¹²² engaged in a bundled payment program with post-acute providers will likely require cyber-security controls of the hospital to govern the data exchange, providing greater protection over devices, records, and other connected systems. Additionally, to the extent that collaborating systems begin to promote greater emphasis on cyber protections, sectors might also experience cultural shifts as more providers and suppliers begin to truly understand and appreciate the importance of cybersecurity.

Independent of infrastructure challenges, perhaps the biggest barrier to mitigating cyber risk is convincing individuals and entities to make the necessary investments to properly combat the known risks, which disproportionately impacts smaller and less-resource intensive entities.¹²³ Promoting programs such as accountable care organizations (ACOs),¹²⁴ clinically integrated networks (CINs),^{Reference Bires125} and patient-centered medical homes that encourage larger, more financially stable entities to share resources with smaller, less financially stable entities,^{Reference Meidell126} will help spread cybersecurity resources to the most vulnerable areas.¹²⁷ A small physician office is unlikely to employ an IT professional whose sole focus is maintaining support for operating electronic systems and combating cyber threats,^{Reference Bates128} but that same office as a participant in an ACO is able to utilize the resources within the ACO, facilitating better protection of all data contained within the system.¹²⁹ ACOs and CINs are incentivized and encouraged to engage in collaboration and care coordination to achieve cost savings, and these efforts are most easily accomplished through interoperability or other coordinated data sharing.^{Reference Cohen130} Because managing cyber risk becomes the responsibility of the ACO, resources toward this effort can be pooled and coordinated. Such coordination may also prevent churn and system migration of small providers, both of which make electronic systems more vulnerable to threats due to lack of support from fledgling vendors and compatibility barriers that prevent system integration and then increase breach costs as providers migrate to new vendors after each breach incident.¹³¹

ACOs, CINs, and like structures will also assist in moving more rapidly toward interoperability, as interoperability (done properly) will aid in achieving quality metrics and reduce expense through reduction of duplication of services.¹³² The lack of interoperability in the current health care system has perpetuated make-shift data sharing mechanisms that are less secure and make data more vulnerable to cybersecurity risk.^{Reference Nussbaum133} Congress and CMS should move from voluntary recommendations for interoperability towards required security regulations and infrastructure standards. Such efforts will be easier to accomplish to the extent that resources can be allocated across the care continuum among larger and smaller actors in the market through reform efforts. Certainly, data breaches and cyberattacks will not be entirely prevented as a result of these incremental system reforms — such as ACOs and bundled payment models; however, the health care industry will be better poised and prepared to address and respond to attacks in a more efficient and less costly manner to the extent that this resource allocation can be spread across sectors.

Lastly, the confusion and chaos that is created by competing statutory and regulatory regimes and agencies remains a difficult issue to adequately address. There have been efforts by agencies to coordinate through deference to a common agency, such as recommendations to follow the NIST standards, or waivers of certain laws in lieu of others, such as waivers for ACOs under the ACA.¹³⁴ More coordination must take place, however. While agency consolidation or reconfiguration is unlikely, agencies could today mitigate existing barriers with promotion of increased coordination between agencies and adoption of regulations that apply across the industry. It is imperative in the context of cybersecurity that agencies engage in this coordinated effort because other initiatives to support care coordination will be thwarted to the extent that various sectors in the industry are forced to comply with disparate statutes, regulations, and directives.