IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Department of Health and Human Services must improve cyber security info sharing

GAO report finds HHS has made progress, but better coordination would increase health care security

Department of Health and Human Services building and sign

A new Government Accountability Office (GAO) report has found that while the Department of Health and Human Services (HHS) has made substantial efforts to share cyber security threat intel with the wider health care sector, it could do more to develop its collaboration and coordination within the department and the sector.

The recently published report said the GAO was tasked to review HHS’s organizational approach to address cyber security. It looked at documentation describing HHS’s cyber security roles and responsibilities, assessed those responsibilities for fragmentation, duplication and overlap, and evaluated the department’s collaborative efforts against GAO’s leading practices for collaboration. 

The report found that the recent coronavirus pandemic has “highlighted the need for HHS to pay continuous attention to cyber threats, which pose a serious challenge to national security, economic well-being, and public health and safety. “

“Since the start of the nation’s response to COVID-19 in March 2020, HHS and the HPH sector organizations have been targets for malicious cyber activity,” the report stated.

The report said HHS had clearly described roles and responsibilities for implementing its cyber security program, including the FISMA-required eight elements of the program. The department had also developed or contributed to developing policies, procedures, and plans that described the department’s roles and responsibilities for providing cyber security support to the healthcare and public health care (HPH) sector.

Related Resource

Owning your own access security

The key to building strong cloud security and avoiding the risk of vendor lock-in

Whitepaper front coverDownload now

However, the report said that procedures and plans did not describe coordination among two entities critical to the department’s cyber security information sharing with the HPH sector — the Health Sector Cybersecurity Coordination Center (HC3) and the Healthcare Threat Operations Center (HTOC).

“Without coordinating the responsibilities for sharing cyber security information to the HPH sector, HHS is missing an opportunity to strengthen those efforts for their intended audience,” the report warned.

The GAO said there were areas where HHS could improve, such as actionable threat sharing and better support for industry partnerships.

“Until HC3 and HTOC formalize coordination of their cyber security information sharing responsibilities, sector partners will likely be without important threat information,” said the report’s authors.

The GAO said that the secretary of HHS should direct its chief information officer to coordinate cyber security information sharing between the Health Sector Cybersecurity Coordination Center and Healthcare Threat Operations Center. 

It should also direct its CIO to monitor, evaluate, and report on the progress and performance of the HHS Chief Information Security Officer Council, Continuous Monitoring and Risk Scoring Working Group, and Cloud Security Working Group. 

The report said the HHS stated it is currently addressing the six recommendations it agreed with, but it did not agree with the GAO findings on cyber security coordination. HHS said there was “close coordination between HC3 and HTOC that takes into consideration the stakeholders and agreements between relevant partners and stakeholders.”

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Ransomware group Conti threatens to overthrow Costa Rican government
ransomware

Ransomware group Conti threatens to overthrow Costa Rican government

17 May 2022
Costa Rica declares state of emergency following Conti ransomware attack
ransomware

Costa Rica declares state of emergency following Conti ransomware attack

10 May 2022
LinkedIn to pay $1.8 million to employees after settling gender discrimination charges
Careers & training

LinkedIn to pay $1.8 million to employees after settling gender discrimination charges

4 May 2022
UK plan to abandon big tech regulator powers “makes no sense”
Policy & legislation

UK plan to abandon big tech regulator powers “makes no sense”

3 May 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
Microsoft to double salary budget to retain workers
Careers & training

Microsoft to double salary budget to retain workers

17 May 2022