We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not a subscriber? Subscribe now for unlimited access to online articles.


Your Doctor’s Office Is Vulnerable to Hackers, but Congress Could Change That

Creating exceptions to two anti-fraud laws could improve security for smaller health-care facilities ill-equipped to fend off cyber threats.

Small health-care facilities like doctors' offices are uniquely vulnerable to cyberattacks due to the sensitive information on their networks, and because many lack the resources to defend themselves. Congress could help change that by adjusting two laws designed to prevent improper business arrangements between doctors and hospitals.

That’s according to a new report by the Health Care Industry Cybersecurity Task Force, a group of 21 private sector and government cybersecurity experts and administrators convened by Congress as part of the landmark Cybersecurity Act of 2015.

Among other things, the report recommends that Congress explore changes to the so-called Physician Referral Law and the Anti-Kickback statute, which prevent doctors from receiving any kind of payment from a hospital or clinic in exchange for patient referrals or other business, like lab work, that is reimbursed by federal health-care programs including Medicare and Medicaid. According to the task force, many hospitals would like to help smaller business partners purchase cybersecurity tools so that they do not become a liability, but are afraid that would violate these laws.

Sign up for Weekend Reads
Stories from our archives that put technology in perspective

Hackers commonly target health-care facilities, thanks to the valuable information on their networks as well as their historically lax security practices. Facilities all over the world are vulnerable to attacks like the WannaCry ransomware attack that occurred last month. Last year, a ransomware attack disabled the medical-records system of a Los Angeles Hospital and forced it to transfer patients elsewhere (see “With Hospital Ransomware Infections, the Patients Are at Risk”).

One reason for the problem, according to the task force, is that many smaller facilities simply can’t afford to retain in-house cybersecurity expertise and maintain the necessary technological infrastructure. The group “strongly” recommends that Congress amend the Physician Self-Referral Law and the Anti-Kickback Statute to account for this by allowing more cybersecurity technology sharing between hospitals and their smaller partners.

If Congress doesn’t act, the department of Health and Human Services could pursue new regulations that would make exceptions to these laws. In fact, a model already exists for this. Regulatory exceptions and safe harbor provisions make it legal for hospitals and clinics to donate electronic health records technology to doctors’ offices and other business partners.

These exceptions exist because when hospitals began adopting electronic records in the mid-2000s, many physicians who sent patients to those hospitals could not afford to purchase interoperable technology for their offices. Just like today with cybersecurity, hospitals wanted to be able to buy this technology for them, says Bernadette Broccolo, a health-care attorney at the law firm McDermott Will & Emery.

Clearing the way for hospitals to buy cybersecurity technology for doctors’ offices without the threat of legal trouble would help reduce the overall risk, but it is only one piece of a complicated puzzle that policymakers must solve in order to truly fix health care’s cybersecurity woes. While many of the rules governing cybersecurity in health care are “well-meaning and individually effective,” write the report’s authors, “Taken together they can impose a substantial legal and technical burden on health-care organizations.”

Keep up with the latest in cybersecurity at EmTech Digital.

The Countdown has begun.
March 25-26, 2019
San Francisco, CA

Register now
More from Connectivity

What it means to be constantly connected with each other and vast sources of information.

Want more award-winning journalism? Subscribe to All Access Digital.
  • All Access Digital {! insider.prices.digital !}*

    {! insider.display.menuOptionsLabel !}

    The digital magazine, plus unlimited site access, our online archive, and The Download delivered to your email in-box each weekday.

    See details+

    12-month subscription

    Unlimited access to all our daily online news and feature stories

    Digital magazine (6 bi-monthly issues)

    Access to entire PDF magazine archive dating back to 1899

    The Download: newsletter delivery each weekday to your inbox

You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.