Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Connectivity

Your Doctor’s Office Is Vulnerable to Hackers, but Congress Could Change That

Creating exceptions to two anti-fraud laws could improve security for smaller health-care facilities ill-equipped to fend off cyber threats.

Small health-care facilities like doctors' offices are uniquely vulnerable to cyberattacks due to the sensitive information on their networks, and because many lack the resources to defend themselves. Congress could help change that by adjusting two laws designed to prevent improper business arrangements between doctors and hospitals.

That’s according to a new report by the Health Care Industry Cybersecurity Task Force, a group of 21 private sector and government cybersecurity experts and administrators convened by Congress as part of the landmark Cybersecurity Act of 2015.

Among other things, the report recommends that Congress explore changes to the so-called Physician Referral Law and the Anti-Kickback statute, which prevent doctors from receiving any kind of payment from a hospital or clinic in exchange for patient referrals or other business, like lab work, that is reimbursed by federal health-care programs including Medicare and Medicaid. According to the task force, many hospitals would like to help smaller business partners purchase cybersecurity tools so that they do not become a liability, but are afraid that would violate these laws.

Subscribe to Weekend Reads
Our guide to stories in the archives that put technology in perspective.
Manage your newsletter preferences

Hackers commonly target health-care facilities, thanks to the valuable information on their networks as well as their historically lax security practices. Facilities all over the world are vulnerable to attacks like the WannaCry ransomware attack that occurred last month. Last year, a ransomware attack disabled the medical-records system of a Los Angeles Hospital and forced it to transfer patients elsewhere (see “With Hospital Ransomware Infections, the Patients Are at Risk”).

One reason for the problem, according to the task force, is that many smaller facilities simply can’t afford to retain in-house cybersecurity expertise and maintain the necessary technological infrastructure. The group “strongly” recommends that Congress amend the Physician Self-Referral Law and the Anti-Kickback Statute to account for this by allowing more cybersecurity technology sharing between hospitals and their smaller partners.

If Congress doesn’t act, the department of Health and Human Services could pursue new regulations that would make exceptions to these laws. In fact, a model already exists for this. Regulatory exceptions and safe harbor provisions make it legal for hospitals and clinics to donate electronic health records technology to doctors’ offices and other business partners.

These exceptions exist because when hospitals began adopting electronic records in the mid-2000s, many physicians who sent patients to those hospitals could not afford to purchase interoperable technology for their offices. Just like today with cybersecurity, hospitals wanted to be able to buy this technology for them, says Bernadette Broccolo, a health-care attorney at the law firm McDermott Will & Emery.

Clearing the way for hospitals to buy cybersecurity technology for doctors’ offices without the threat of legal trouble would help reduce the overall risk, but it is only one piece of a complicated puzzle that policymakers must solve in order to truly fix health care’s cybersecurity woes. While many of the rules governing cybersecurity in health care are “well-meaning and individually effective,” write the report’s authors, “Taken together they can impose a substantial legal and technical burden on health-care organizations.”

Become an MIT Technology Review Insider for in-depth analysis and unparalleled perspective.

Subscribe today

Uh oh–you've read all of your free articles for this month.

Insider Premium
$179.95/yr US PRICE

More from Connectivity

What it means to be constantly connected with each other and vast sources of information.

Want more award-winning journalism? Subscribe to Insider Basic.
  • Insider Basic {! insider.prices.basic !}*

    {! insider.display.menuOptionsLabel !}

    Six issues of our award winning print magazine, unlimited online access plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Bimonthly print magazine (6 issues per year)

/
You've read all of your free articles this month. This is your last free article this month. You've read of free articles this month. or  for unlimited online access.