| |  | Industry Rx | The American Hospital Association, an industry group, “maintains a very robust and ongoing cyber and physical threat information exchange with the federal government,” John Riggi, senior adviser for cybersecurity and risk at AHA, tells me in an email. This includes the FBI and the Department of Health and Human Services. But the association is “not aware of any specific credible threats directed against U.S. health care at this time,” he said. At HHS, the Administration for Strategic Preparedness and Response serves as the risk management agency for cybersecurity within the health care system. The department didn’t respond to an inquiry about whether there is an elevated cyber risk for hospitals, health systems or insurers. The bottom line: Unlike attacks on financial institutions, cyber-intrusions that involve the health care system are more likely to come with immediate consequences for people’s well-being. “Ransomware and other cyberattacks on hospitals have evolved. The crime itself has changed from one that is financially motivated to an act that also represents a threat to life that endangers public health,” Riggi writes in a post about the topic. → It’s not just hospitals: Insurance information and clinical trial data and information stemming from medical research have also been targeted in cyberattacks, though necessarily not from Iranian-linked sources. Alexander Leslie, senior adviser for threat intelligence company Recorded Future, said that most of the cyber activity they’ve seen thus far is relatively “low-level,” and “not the sustained or destructive campaigns that would materially threaten health care networks.” “That said, hospitals remain chronically attractive targets for both state-sponsored actors seeking asymmetric pressure and opportunistic cybercriminals who exploit moments of heightened tension and distraction,” Leslie said. “In these scenarios, the risk calculus can shift quickly, and the health care sector cannot afford to assume it’s insulated.” Aneesh Chopra, who served as U.S. chief technology officer during the Obama administration, said that this is a moment for the information security officers at hospitals to “double down on core cyber hygiene.” This includes applying security updates to internet-facing systems, reviewing dependence on third-party software and increasing the adoption of multifactor authentication that’s resistant to phishing, a scam that tricks users into giving out their passwords or other sensitive information. Riggi said the AHA is telling its members to be extra vigilant with both cybersecurity and physical security measures “should Iran, its proxies or self-radicalized individuals attempt an attack in the U.S.” — and report suspicious activities to federal and local authorities where appropriate. | 
_tstmp_1756933376-1920-1080.png)
