HHS program launches web resource on cybersecurity best practices

The Department of Health and Human Services yesterday launched a central web resource for information on cybersecurity best practices recognized by its 405(d) program. A legislative provision (H.R. 7898) enacted by Congress this year allows the Department of Health and Human Services' Office for Civil Rights to recognize certain recommended security practices when making determinations related to Health Insurance Portability and Accountability Act audits, fines and resolution agreements associated with a cyberattack, including practices recognized by the 405(d) program. AHA has urged OCR to quickly initiate rulemaking for the legislative provision, and strongly advocated for regulatory relief for hospital and health system victims of cyberattacks in testimony before a Senate hearing last year.

"We believe our prominent advocacy on this issue assisted with the passage of H.R. 7898, and we will continue to aggressively pursue timely enactment of this much needed legislation," said John Riggi, AHA senior advisor for cybersecurity and risk.