U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

25–828 PDF 2017

CYBERSECURITY IN THE HEALTHCARE SECTOR: 

STRENGTHENING PUBLIC-PRIVATE PARTNERSHIPS 

HEARING 

BEFORE THE

SUBCOMMITTEE ON OVERSIGHT AND 

INVESTIGATIONS 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

APRIL 4, 2017 

Serial No. 115–24 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

GREG WALDEN, Oregon 

Chairman 

JOE BARTON, Texas 

Vice Chairman 

FRED UPTON, Michigan 

JOHN SHIMKUS, Illinois 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

GUS M. BILIRAKIS, Florida 

BILL JOHNSON, Ohio 

BILLY LONG, Missouri 

LARRY BUCSHON, Indiana 

BILL FLORES, Texas 

SUSAN W. BROOKS, Indiana 

MARKWAYNE MULLIN, Oklahoma 

RICHARD HUDSON, North Carolina 

CHRIS COLLINS, New York 

KEVIN CRAMER, North Dakota 

TIM WALBERG, Michigan 

MIMI WALTERS, California 

RYAN A. COSTELLO, Pennsylvania 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

FRANK PALLONE, JR., New Jersey 

Ranking Member 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

G.K. BUTTERFIELD, North Carolina 

DORIS O. MATSUI, California 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

JERRY MCNERNEY, California 

PETER WELCH, Vermont 

BEN RAY LUJA ́ N, New Mexico 

PAUL TONKO, New York 

YVETTE D. CLARKE, New York 

DAVID LOEBSACK, Iowa 

KURT SCHRADER, Oregon 

JOSEPH P. KENNEDY, III, Massachusetts 

TONY CA ́ RDENAS, California 

RAUL RUIZ, California 

SCOTT H. PETERS, California 

DEBBIE DINGELL, Michigan 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS

TIM MURPHY, Pennsylvania 

Chairman 

H. MORGAN GRIFFITH, Virginia 

Vice Chairman 

JOE BARTON, Texas 

MICHAEL C. BURGESS, Texas 

SUSAN W. BROOKS, Indiana 

CHRIS COLLINS, New York 

TIM WALBERG, Michigan 

MIMI WALTERS, California 

RYAN A. COSTELLO, Pennsylvania 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GREG WALDEN, Oregon (ex officio) 

DIANA DEGETTE, Colorado 

Ranking Member 

JANICE D. SCHAKOWSKY, Illinois 

KATHY CASTOR, Florida 

PAUL TONKO, New York 

YVETTE D. CLARKE, New York 

RAUL RUIZ, California 

SCOTT H. PETERS, California 

FRANK PALLONE, JR., New Jersey (ex 

officio) 

(II) 

(III) 

C O N T E N T S 

Page 

Hon. Tim Murphy, a Representative in Congress from the Commonwealth 

of Pennsylvania, opening statement ................................................................... 1 

Prepared statement .......................................................................................... 3 

Hon. Diana DeGette, a Representative in Congress from the State of Colorado, opening statement ...................................................................................... 4 

Hon. Greg Walden, a Representative in Congress from the State of Oregon, 

opening statement ................................................................................................ 6 

Prepared statement .......................................................................................... 7 

Hon. Frank Pallone, Jr., a Representative in Congress from the State of 

New Jersey, opening statement .......................................................................... 7 

Prepared statement .......................................................................................... 8 

WITNESSES

Denise Anderson, President, National Health Information Sharing and Analysis Center ............................................................................................................ 10 

Prepared statement .......................................................................................... 13 

Answers to submitted questions ...................................................................... 81 

Michael C. McNeil, Global Product Security and Services Officer, Philips 

Healthcare, and Chairman, Cybersecurity Working Group, AdvaMed ........... 28 

Prepared statement .......................................................................................... 30 

Answers to submitted questions ...................................................................... 90 

Terence M. Rice, Vice President and Chief Information Security Officer, 

Merck & Company, Inc. ....................................................................................... 34 

Prepared statement .......................................................................................... 36 

Answers to submitted questions ...................................................................... 109 

SUBMITTED MATERIAL

Subcommittee memorandum .................................................................................. 74 

Letter of November 3, 2016, from Ms. DeGette and Mrs. Brooks to Robert 

M. Califf, Commissioner, Food and Drug Administration, and Jeffrey 

Shuren, Director, Center for Devices and Radiological Health, Food and 

Drug Administration, submitted by Mrs. Brooks .............................................. 79 

(1) 

CYBERSECURITY IN THE HEALTHCARE SECTOR: STRENGTHENING PUBLIC-PRIVATE 

PARTNERSHIPS 

TUESDAY, APRIL 4, 2017 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS, 

COMMITTEE ON ENERGY AND COMMERCE, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:17 a.m., in Room 

2322 Rayburn House Office Building, Hon. Tim Murphy (chairman 

of the subcommittee) presiding. 

Members present: Representatives Murphy, Griffith, Burgess, 

Brooks, Collins, Walberg, Walters, Costello, Carter, Walden (ex officio), DeGette, Schakowsky, Clarke, Ruiz, and Pallone (ex officio). 

Staff present: Jennifer Barblan, Chief Counsel, Oversight and Investigations; Elena Brennan, Legislative Clerk, Oversight and Investigations; David DeMarco, Deputy Information Technology Director; Blair Ellis, Press Secretary/Digital Coordinator; Adam 

Fromm, Director of Outreach and Coalitions; John Ohly, Professional Staff Member, Oversight and Investigations; Jennifer Sherman, Press Secretary; Hamlin Wade, Special Advisor for External 

Affairs; Jessica Wilkerson, Professional Staff Member, Oversight 

and Investigations; Jeff Carroll, Minority Staff Director; Christopher Knauer, Minority Oversight Staff Director; Miles Lichtman, 

Minority Staff Assistant; Kevin McAloon, Minority Professional 

Staff Member; Jon Monger, Minority Counsel; Dino Papanastasiou, 

Minority GAO Detailee; and C.J. Young, Minority Press Secretary. 

OPENING STATEMENT OF HON. TIM MURPHY, A REPRESENTATIVE IN CONGRESS FROM THE COMMONWEALTH OF PENNSYLVANIA 

Mr. MURPHY. Good morning, and welcome to our Oversight and 

Investigations hearing on Cybersecurity in the Healthcare Sector: 

Strengthening Public-Private Partnerships. We are here today to 

talk about cybersecurity in the healthcare sector. Strong cybersecurity practices are essential in this industry. This isn’t just about 

protecting data or information, this is about patient safety. 

For nearly two decades, a cornerstone of the Nation’s efforts to 

combat cyber threats have been public-private partnerships designed to facilitate engagement and collaboration between the Government and private sector. Over time, this model has evolved, but 

the objective remains the same, the unity of effort between those 

2 

responsible for protecting the Nation and those who own and operate the infrastructure that is critical to that mission. 

The focal point of these efforts are 16 critical infrastructure sectors, one of which is the healthcare sector. Each sector is organized 

around several key institutions: a Sector-Specific Agency, that is 

SSA; Government Coordinating Council, GCC; Sector Coordinating 

Council, SCC; and Information Sharing and Analysis Center. I 

hope you all have that. Each of these institutions plays an important role in ensuring participation, collaboration, and unity of effort 

of the Government and private-sector participants within each sector. 

Despite a number of efforts to improve this model over the years, 

it has achieved mixed results across the various sectors. Some sectors have succeeded in developing robust support and engagement 

with both Government and industry participants. The gold standard to date has been the financial sector. This sector enjoys a 

strong collaborative relationship with our Government partner, the 

Department of the Treasury, which is noteworthy because Treasury 

is also the regulator. 

In addition, despite having a very diverse sector, they have succeeded in encouraging support and participation from a wide variety of institutions from small community banks to large multinational financial institutions. This extensive membership has 

helped the sector to establish the Nation’s most sophisticated and 

well-resourced ISAC, which improves its value to the entire sector. 

Another more recent success story has been the electricity sector. 

This sector of energy has improved collaboration and engagement 

both with Government partners at the Department of Energy and 

across private industry through senior executive participation on 

the Sector Coordinating Council. In addition to elevating the priority for industry partners, it has improved coordination and unity 

of effort with the Government. 

Despite the relative success of these and several others, every 

sector has unique characteristics and challenges that influence the 

pace of adoption and engagement in these institutions. What works 

for one sector may not work for others, and as each sector figures 

out what works best for their participants, however, the lessons 

from others should not be overlooked or ignored especially for those 

sectors that continue to evolve. 

What brings us to today’s hearing, the healthcare sector focus— 

this sector has long struggled to coalesce around the public-private 

partnership model especially with respect to cybersecurity. This 

may be partially attributable to the fact that cybersecurity is a relatively new challenge for much of this sector. However, as health 

care becomes increasingly digitized, the need to improve cybersecurity must be a priority. 

Gaining the acceptance and support necessary to overcome historical obstacles will not be easy for this sector. To start, health 

care is an incredibly diverse and complex sector, with a wide range 

of industries and institutions of various sizes, technological sophistication, and resources. It is also a sector where cybersecurity often 

becomes conflated with privacy or compliance, complicating the discussion. This, in turn, is exacerbated by the fact that a successful 

public-private partnership depends on collaboration and trust with 

3 

HHS, an understandable challenge given the many participants in 

this sector who are regulated by various entities within the Department. 

These and other challenges are understandable and daunting. If 

I am a small, rural healthcare institution where cybersecurity falls 

to one employee who is also responsible for managing IT systems 

and, well, fixing copiers among other duties, what value do I get 

for the cost of joining the ISAC or listening to guidance from the 

Sector Coordinating Council? At present, it is hard to answer that 

question, especially for those institutions already operating on negative margins. 

These challenges, however, must be overcome. The cost of failure 

for patients, as well as healthcare institutions, is too great. Cybersecurity incidents can result in life or death situations if a medical 

device is hacked or an attack shuts down a hospital’s computer systems. And cybersecurity is a collective responsibility and that is 

why it is imperative that this sector find a way to come together 

to find a sustainable path forward. 

I look forward to hearing more from our witnesses today about 

the challenges of this sector and what is needed to bring unity and 

commitment from all participants. These are the folks working in 

the trenches, and while the sector has shown signs of progress, 

what we will find out today is that much work needs to be done. 

[The statement of Mr. Murphy follows:] 

PREPARED STATEMENT OF HON. TIM MURPHY

We are here today to talk about cybersecurity in the healthcare sector. Strong cybersecurity practices are essential in this industry. This isn’t just about protecting 

patient data or information—this is about patient safety. 

For nearly two decades, a cornerstone of the Nation’s efforts to combat cyber 

threats have been public-private partnerships designed to facilitate engagement and 

collaboration between the Government and private sector. Over time this model has 

evolved, but the objective remains the same—unity of effort between those responsible for protecting the Nation and those who own and operate the infrastructure 

that is critical to that mission. 

The focal point of these efforts are 16 critical infrastructure sectors—one of which 

is the healthcare sector. Each sector is organized around several key institutions— 

a Sector-Specific Agency, Government Coordinating Council, Sector Coordinating 

Council, and Information Sharing and Analysis Center. Each of these institutions 

plays an important role in ensuring participation, collaboration, and unity of effort 

of the Government and private-sector participants within each sector. 

Despite a number of efforts to improve this model over the years, it has achieved 

mixed results across the various sectors. Some sectors have succeeded in developing 

robust support and engagement with both Government and industry participants. 

The gold standard, to date, has been the financial sector. This sector enjoys a 

strong, collaborative relationship with their Government partner—the Department 

of the Treasury—which is noteworthy because Treasury is also their regulator. In 

addition, despite having a very diverse sector, they have succeeded in encouraging 

support and participation from a wide variety of institutions—from small community banks to large multinational financial institutions. This extensive membership 

has helped the sector to establish the Nation’s most sophisticated and wellresourced ISAC, which improves its value to the entire sector. 

Another, more recent, success story has been the electricity sector. This sector has 

improved collaboration and engagement—both with Government partners at the Department of Energy and across private industry—through senior executive participation on the Sector Coordinating Council. In addition to elevating the priority for industry partners, it has improved coordination and unity of effort with the Government. 

Despite the relative success of these and several others, every sector has unique 

characteristics and challenges that influence the pace of adoption and engagement 

4 

in these institutions. What works for one sector may not work for others. As each 

sector figures out what works best for their participants, however, the lessons from 

others should not be overlooked or ignored—especially for those sectors that continue to evolve. 

Which brings us to the focus of today’s hearing—the healthcare sector. This sector 

has long struggled to coalesce around the public-private partnership model, especially with respect to cybersecurity. This may be partially attributable to the fact 

that cybersecurity is a relatively new challenge for much of this sector. However, 

as health care becomes increasingly digitized, the need to improve cybersecurity 

must be a priority. 

Gaining the acceptance and support necessary to overcome historical obstacles 

will not be easy for this sector. To start, health care is an incredibly diverse and 

complex sector, with a wide range of industries and institutions of varying sizes, 

technological sophistication, and resources. It is also a sector where cybersecurity 

often becomes conflated with privacy or compliance, complicating the discussion. 

This, in turn, is exacerbated by the fact that a successful publicprivate partnership 

depends on collaboration and trust with HHS—an understandable challenge given 

the many participants in the sector who are regulated by various entities within the 

Department. 

These and other challenges are understandable and daunting. If I am a small, 

rural healthcare institution—where cybersecurity falls to one employee who is also 

responsible for managing IT systems and fixing copiers, among other duties—what 

value do I get for the cost of joining the ISAC or listening to guidance from the Sector Coordinating Council? At present, it is hard to answer that question, especially 

for those institutions already operating on negative margins. 

These challenges, however, must be overcome. The cost of failure—for patients, 

as well as healthcare institutions—is too great. Cybersecurity incidents can result 

in life or death situations if a medical device is hacked, or an attack shuts down 

a hospital’s computer systems. Cybersecurity is a collective responsibility and that 

is why it is imperative that this sector find a way to come together to find a sustainable path forward. 

I look forward to hearing more from our witnesses about the challenges of this 

sector and what is needed to bring unity and commitment from all participants. 

These are the folks working in the trenches and while the sector has shown signs 

of progress, much work remains to be done. 

Mr. MURPHY. Now I would like to recognize for 5 minutes Ms. 

DeGette of Colorado. 

OPENING STATEMENT OF HON. DIANA DEGETTE, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF COLORADO 

Ms. DEGETTE. Thank you very much, Mr. Chairman. Every day, 

our infrastructure is under attack by those with malicious intent. 

We are constantly seeing new headlines about vulnerabilities and 

cyber attacks against our systems which are becoming more frequent and more sophisticated. Cyber threats are a reality we must 

face. Information systems connected to the internet are integral to 

the operation of our economy and our Government. 

While this interconnection is essential, it also brings 

vulnerabilities that bring serious challenges. They have affected 

companies from various industries like retail and banking, and 

now, as the chairman said, we are seeing increasing vulnerability 

in the health sector. For example, in 2015, more than 113 million 

medical records were reportedly compromised in cyber attacks. In 

one wildly publicized case, a cybersecurity breach at Anthem compromised the personal information of nearly 79 million people. 

These attacks are a stark reminder that all industries are vulnerable and neither the private sector nor the Government is safe 

from cyber attacks. I am particularly concerned about these 

vulnerabilities faced by the healthcare sector as more and more 

5 

Americans suffer the loss of personally identifiable information and 

private medical records. 

Defending our Nation’s healthcare sector against a wide range of 

cyber threats will require a coordinated effort involving many players and approaches. I am very interested to hear today about the 

information sharing and analysis center, or ISAC. Several industries have established ISACs to encourage private companies to 

share information about cyber vulnerabilities and attacks. These 

ISACs have provided valuable assistance to industry in their efforts to bolster cybersecurity. 

Federal agencies also collaborate with these ISACs to facilitate 

the sharing of important information about cyber threats and incidents. I am so happy to have before us today the new head of the 

National Health ISAC, which is the ISAC that coordinates information sharing among our Nation’s healthcare industry. The National 

Health ISAC shares information on vulnerabilities relating to 

healthcare providers, health IT companies, insurers, medical device 

manufacturers, and pharmaceutical organizations. 

I should note though that the National Health ISAC is a relatively new player. I am still interested though in learning about 

how it can leverage the experience of ISACs in other industries to 

assist us in the healthcare sector. I am also interested to hear how 

the National Health ISAC is helping its members in the healthcare 

sector prevent the kind of breaches that we have been seeing. 

I look forward to hearing the witnesses’ perspectives on what 

challenges and vulnerabilities we face, and what is being done, and 

how we can improve. Alongside that is the question of the appropriate role of Government in encouraging and supporting these efforts. Because this is such an important area, I also hope in general we can continue to look for ways to strengthen our cybersecurity systems. Particularly as it relates to health care, I hope we can 

have more hearings about solutions to the threats that we face, including ransomware, hospital cyber attacks, and the theft of millions of Americans’ medical information. 

Finally, Mr. Chairman, I want to remind the committee that I 

along with my fellow committee member Susan Brooks, sitting 

right over there, sent a letter to the FDA last year asking about 

cyber vulnerabilities in medical devices. As these devices become 

more advanced and integrated into our networks, they are increasingly vulnerable to dangerous cyber attacks. Because of the urgency of this issue, Mr. Chairman, I hope that we can expand in 

future hearings how the FDA will address emerging threats to 

medical devices. 

While there is certainly no silver bullet when it comes to solving 

cybersecurity threats, I am looking forward to hearing from our 

witnesses about the role that the National Health ISAC can play. 

I would like to see us take any steps we can to improve healthcare 

cybersecurity and this may be a valuable piece of that approach. 

Thanks again, Mr. Chairman, for having this hearing. I think 

this is another bipartisan issue that we can all agree that we need 

to work together to address and to strengthen the integrity of our 

medical records. I yield back. 

Mr. MURPHY. The gentlewoman yields back, and now the chairman of the full committee, Mr. Walden. 

6 

OPENING STATEMENT OF HON. GREG WALDEN, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF OREGON 

Mr. WALDEN. I thank the gentleman, and I thank our witnesses 

for your testimony. 

We are well aware of the threats posed by our increasingly connected society, but nowhere do these risks hit closer to home than 

on the very technology we rely upon for our own health care. The 

threats range from ransomware, breaches of patient data at 

healthcare organizations, to the vulnerabilities of pacemakers and 

other medical devices. Taken in isolation, these and other threats 

pose serious challenges to healthcare organizations. Collectively, 

they demonstrate the breadth, complexity, and unavoidable nature 

of cyber threats in modern society both now and for the foreseeable 

future. 

You know, as technology becomes increasingly integrated with all 

levels of our health care, cyber threats pose a challenge to the entire sector. Everyone from the smallest rural hospitals to large providers and device manufacturers face some level of exposure and 

risk. Breaches, exploits, and vulnerabilities are inevitable realities 

of modern society even for the most well-resourced and sophisticated organizations. 

But this does not mean doom and gloom for everyone with an 

internet connection. It simply is reality and must serve as the baseline for any discussion about cybersecurity. We may not be able to 

stop every attack, but as the threats continue to escalate, we must 

do more to minimize the risk. Improving security is a collective responsibility. When we work together, Government and private sector, large companies and small, we can do more to improve security 

than if we attempt to solve it on our own. 

An attack on one organization may be prevented elsewhere if we 

have the infrastructure and mechanisms necessary to communicate 

effectively with others across the sector. Further, if an event has 

widespread or national implications, we need to coordinate an effective and efficient response with unity of effort not confusion over 

roles and responsibilities. That is why for almost two decades the 

United States has worked to establish public-private partnerships 

to coordinate security planning and information sharing within and 

across our 16 critical infrastructure sectors which include health 

care. 

Effective collaboration between Government and the private sector is vital to elevating our security posture. These partnerships 

provide a vital link between those responsible for the safety and security of the Nation and those who own and operate the infrastructure critical to those objectives. 

To date, these public-private partnerships have experienced 

mixed results. Some sectors have been more successful than others 

in coming together both with private-sector and Government partners. The healthcare sector in particular has struggled to coalesce 

around these public-private partnerships for cybersecurity. It is 

this shared goal and that brings us together today. 

This hearing marks the important opportunity to hear from our 

distinguished panelists about what is necessary to bring the 

healthcare sector together and continue building momentum in the 

right direction. Simply put, the cost of inaction is too great. As the 

7 

threats continue to escalate, so do our cybersecurity challenges. We 

have seen the headlines, we know the attacks will continue, but 

today is about what improvements can be made so we can be better 

prepared for the inevitable. 

With that Mr. Chairman, unless anybody wants the remainder 

of my time I would yield it back. 

PREPARED STATEMENT OF HON. GREG WALDEN

We are well aware of the threats posed by our increasingly connected society, but 

nowhere do these risks hit closer to home than on the very technology we rely on 

for our own health care. The threats range from ransomware, breaches of patient 

data at heath care organizations, to the vulnerabilities in pacemakers and other 

medical devices. Taken in isolation, these and other threats pose serious challenges 

to healthcare organizations. Collectively, they demonstrate the breadth, complexity, 

and unavoidable nature of cyber threats in modern society—both now and for the 

foreseeable future. 

As technology becomes increasingly integrated with all levels of our health care, 

cyber threats pose a challenge to the entire sector. Everyone—from the smallest 

rural hospitals, to large providers and device manufacturers—faces some level of exposure and risk. 

Breaches, exploits, and vulnerabilities are inevitable realities of modern society, 

even for the most well-resourced and sophisticated organizations. But this does not 

mean doom-and-gloom for everyone with an internet connection. It is simply reality 

and must serve as the baseline for any discussion about cybersecurity. We may not 

be able to stop every attack, but as the threats continue to escalate, we must do 

more to minimize the risk. 

Improving security is a collective responsibility. When we work together—Government and private sector, large companies and small—we can do more to improve 

security than if we attempt to solve it on our own. 

An attack on one organization may be prevented elsewhere if we have the infrastructure and mechanisms necessary to communicate effectively with others across 

the sector. Further, if an event has widespread or national implications, we need 

to coordinate an effective and efficient response—with unity of effort, not confusion 

over roles and responsibilities. 

That is why, for almost two decades, the U.S. has worked to establish public-private partnerships to coordinate security planning and information sharing within 

and across our 16 critical infrastructure sectors, which includes health care. 

Effective collaboration between Government and the private sector is vital to elevating our security posture,. These partnerships provide a vital link between those 

responsible for the safety and security of the Nation with those who own and operate the infrastructure critical to those objectives. 

To date, these public private partnerships have experienced mixed results. Some 

sectors have been more successful than others in coming together—both with private-sector and Government partners. The healthcare sector, in particular, has 

struggled to coalesce around these publicprivate partnerships for cybersecurity. It 

is this shared, goal that brings us together today. 

This hearing marks an important opportunity to hear from our distinguished panelists about what is necessary to bring the healthcare sector together and continue 

building momentum in the right direction. Simply put, the cost of inaction is too 

great. As the threats continue to escalate, so too do our cybersecurity challenges. 

We’ve seen the headlines—we know the attacks will continue. But today is about 

what improvements can be made so we can be prepared for the inevitable. 

Mr. MURPHY. The Chairman yields back. I now recognize the 

ranking member of the full committee, the gentleman from New 

Jersey, for 5 minutes. 

OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE IN CONGRESS FROM THE STATE OF NEW JERSEY 

Mr. PALLONE. Thank you, Mr. Chairman, for convening this 

hearing today. 

8 

This committee has a long history of examining cybersecurity 

and, while we have made progress, it is clear that we still have a 

lot of work to do. We continue to see increasingly frequent and severe cyber attacks in both the public and private sectors, and yet 

our dependence on the internet and interconnected information systems only continues to grow. Faced with these realities we must 

find ways to bolster our defenses. 

And this is especially true in the critical sector of health care. 

Reports of cyber breaches such as the Anthem case highlight the 

need for all industry members to come together and find solutions. 

With the interconnection of health records and now with networkconnected medical devices, this problem is becoming more urgent. 

While there is no single solution to guarantee that sensitive data 

will not be compromised, it appears that the Information Sharing 

and Analysis Centers, ISACs, may play an important role in our 

overall cyber defense strategy. Other industries have used the 

ISAC model to encourage private companies to share information 

about cyber threats, and today we will hear about similar efforts 

at the National Health ISAC. 

Personal information and medical records are increasingly at risk 

of cyber attack and therefore it is crucial for members of the 

healthcare sector to have access to information about threats and 

vulnerabilities. If the National Health ISAC can leverage and share 

that information, it may be able to help strengthen the cybersecurity of the healthcare community. 

I am also interested in hearing about what capabilities the National Health ISAC can offer the health industry and what challenges it faces. I am pleased to welcome Merck, which has a major 

presence in my district and in New Jersey, at the hearing today, 

represented by Mr. Terry Rice, who is vice president for IT Risk 

Management at Merck. An effective national strategy for security 

depends on a close partnership between Government and the private sector, so I look forward to hearing the perspectives of Merck, 

Philips and other companies in the health sector. 

We are faced with increasing threats in the healthcare sector and 

that requires us to continue to identify effective ways to strengthen 

our cybersecurity. And Mr. Chairman, these problems do not have 

easy solutions. In order to prevent and defend against a growing 

number of cyber attacks, we will need long-term commitments from 

many players, and I look forward to hearing from our witnesses 

about how the National Health ISAC can enhance our cybersecurity and how this committee can support those efforts. 

And unless somebody else wants my time I yield back. 

[The statement of Mr. Pallone follows:] 

PREPARED STATEMENT OF HON. FRANK PALLONE, JR. 

Mr. Chairman, thank you for convening this hearing today. This committee has 

a long history of examining cybersecurity, and while we have made progress, it is 

clear we still have work to do. 

We continue to see increasingly frequent and severe cyberattacks in both the public and private sectors. And yet, our dependence on the Internet and interconnected 

information systems only continues to grow. Faced with these realities, we must 

find ways to bolster our defenses. 

This is especially true in the critical sector of health care. Reports of cyber 

breaches such as the Anthem case highlight the need for all industry members to 

9 

come together and find solutions. With the interconnection of health records-and 

now with network-connected medical devices-this problem is becoming more urgent. 

While there is no single solution to guarantee that sensitive data will not be compromised, it appears that the Information Sharing and Analysis Centers (ISAC) may 

play an important role in our overall cyber-defense strategy. 

Other industries have used the ISAC model to encourage private companies to 

share information about cyber threats, and today we will hear about similar efforts 

at the National Health ISAC. 

Personal information and medical records are increasingly at risk of cyberattack, 

and therefore it is crucial for members of the healthcare sector to have access to 

information about threats and vulnerabilities. If the National Health ISAC can leverage and share that information, it may be able to help strengthen the cybersecurity of the healthcare community. 

I am interested in hearing about what capabilities the National Health ISAC can 

offer the health industry, and what challenges it faces. 

I am also pleased to welcome Merck to the hearing today, represented by Mr. 

Terry Rice, Vice President for IT Risk Management at Merck. An effective national 

strategy for cybersecurity depends on a close partnership between Government and 

the private sector, so I look forward to hearing the perspectives of Merck, Philips, 

and other companies in the health sector. 

We are faced with increasing threats in the healthcare sector, and that requires 

us to continue to identify effective ways to strengthen our cybersecurity. 

These problems do not have easy solutions. In order to prevent and defend against 

a growing number of cyberattacks, we will need long-term commitments from many 

players. I look forward to hearing from our witnesses about how the National 

Health ISAC can enhance our cybersecurity, and how this committee can support 

those efforts. 

Thank you, and I yield back. 

Mr. MURPHY. All right, the gentleman yields back, and so now 

let’s begin here. I ask unanimous consent that the Members’ written opening statements be introduced into the record and, without 

objection, the documents will be entered into the record. 

So now I would like to introduce our panelists of security and 

privacy experts for today’s hearing. First, we welcome Ms. Denise 

Anderson, who serves as president of the National Health Information Sharing and Analysis Center, NH–ISAC, as well as chair of 

the National Council of Information Sharing and Analysis Centers. 

Prior to this appointment, Ms. Anderson served as vice president 

of the Financial Services ISAC. 

Next, we welcome Mr. Michael McNeil, who serves as the global 

product security and services officer for Philips. In this role, Mr. 

McNeil is responsible for leading the global product security program for the company and ensuring consistent, repeatable processes that are deployed throughout their products and services in 

the healthcare market. Mr. McNeil is also here today representing 

AdvaMed, the Advanced Medical Technology Association, as chair 

of AdvaMed’s cybersecurity working group. Welcome. 

And lastly, we would like to welcome Mr. Terry Rice, vice president of IT risk management and chief information security officer 

at Merck. Mr. Rice is also a member of the board of directors for 

the National Health ISAC. 

I want to thank all of our witnesses for providing testimony 

today and sharing your insights on the current state of public-private partnerships and coordinating with cybersecurity in the 

healthcare arena. Now you are all aware that the committee is 

holding an investigative hearing and when doing so has the practice of taking testimony under oath. Do any of you have any objection to taking testimony under an oath? 

10 

Seeing none, the Chair then advises you that, under the rules of 

the House and rules of the committee, you are entitled to be advised by counsel. Do any of you desire to be advised by counsel during today’s hearing? And seeing none, in that case will you all 

please rise, raise your right hand, and I will swear you in. 

[Witnesses sworn.] 

Mr. MURPHY. Thank you. You are now duly sworn in and are 

under oath and subject to the penalties set forth in Title 18 Section 

1001 of the United States Code. Let’s have you each begin with a 

5-minute summary of your written statement, and we will begin 

with you, Ms. Anderson. Make sure your microphone is on and 

pulled close to you. 

STATEMENT OF DENISE ANDERSON, PRESIDENT, NATIONAL 

HEALTH INFORMATION SHARING AND ANALYSIS CENTER; 

MICHAEL C. McNEIL, GLOBAL PRODUCT SECURITY AND 

SERVICES OFFICER, PHILIPS HEALTHCARE, AND CHAIRMAN, 

CYBERSECURITY WORKING GROUP, ADVAMED; AND TERENCE M. RICE, VICE PRESIDENT AND CHIEF INFORMATION 

SECURITY OFFICER, MERCK & COMPANY, INC. 

STATEMENT OF DENISE ANDERSON 

Ms. ANDERSON. Good morning, Chairman Murphy and members 

of the subcommittee. I want to thank you for this opportunity to 

address this subcommittee. 

ISACs are primarily all-hazard, trusted communities that promote the sharing of timely, actionable, and relevant information 

and provide forums for sharing around threats, incidents, 

vulnerabilities, best practices, and mitigation strategies. ISACs 

gather and disseminate information quickly and efficiently. Numerous incidents have shown that effective information sharing works. 

The ISACs collaborate and coordinate on a daily basis through 

the National Council of ISACs and work with the Sector Coordinating Councils. ISACs also work very closely with various Government agencies. In partnership with DHS, several ISACs participate 

in the National Cybersecurity and Communications Integration 

Center, the NCCIC, as well as the National Infrastructure Coordinating Center, the NICC, where they play a vital role in incident 

response and collaboration. 

The NH–ISAC is a global, nonprofit organization and its members represent approximately one-third of the U.S. health and public health GDP. In addition to its many services, the NH–ISAC has 

a representative on the NCCIC floor and fosters a robust machineto-machine or automated sharing environment. The NH–ISAC is 

also engaged in two groundbreaking initiatives. The first is the 

CyberFit suite of services that allows members to leverage the NH– 

ISAC community to realize cost savings and efficiencies. The second is the Medical Device Security Information Sharing Council, a 

forum for manufacturers and hospitals to interact and collaborate 

in order to advance medical device security and safety. 

Under an MOU between the NH–ISAC, the Medical Device Innovation, Safety and Security Consortium, MDISS, and the FDA, a 

number of initiatives are underway including a program for coordinated medical device vulnerability disclosure and a program for 

11 

medical device assessments. The highly collaborated partnership 

with FDA, NH–ISAC, and MDISS, is a great example of how industry and Government can come together to address cybersecurity 

issues. 

Today, because of advances in technology and the efficiencies of 

connecting devices by the internet, the cyber threat surface in 

health care has ballooned and the threat actors have followed. The 

stakes are very high. The focus has traditionally been on data and 

privacy, but if organizations cannot deliver services, as was seen in 

ransomware attacks recently, or data is manipulated or destroyed, 

patient lives are at risk. 

Congress can help meet this challenge by focusing on four key 

areas: Education and facilitation of the importance of information 

sharing. One of the great challenges for the ISAC and all ISACs 

is the lack of awareness among the owners and operators that the 

ISACs exist and are a valuable tool. Government should regularly 

and consistently encourage owner-operators especially at the board 

and CEO level to join their respective ISACs. 

A policy statement that provides explicit guidance to SSAs and 

their sector constituents to integrate into their cyber risk management and preparedness programs their participation in and collaboration in ISACs is key. Another way to facilitate sharing is providing financial incentives through tax breaks or other means to organizations that join their respective ISACs. 

Two, protect information sharing. Recently, the Automotive ISAC 

was served a subpoena to furnish all documentation related to communications between the ISAC and one of its members. While the 

subpoena was quashed, the concern is that if courts were to allow 

broad sweeps for information and using ISACs as one-stop shops 

to accomplish it, such actions would effectively kill information 

sharing. The confidential information shared amongst the members 

of an ISAC should be protected and not subject to disclosure. 

Three, eliminate the confusion with the terms ISAC and ISAO. 

The February 15th, 2015 executive order called on the formation of 

Information Sharing and Analysis Organizations, or ISAOs. ISACs 

were the original ISAOs. However, ISACs are much more than 

ISAOs. It is absolutely essential that the successful efforts ISACs 

have established over the years not be disrupted. The EO and 

prominent coverage of ISAOs has led to much confusion within industry regarding ISACs. 

We have seen this clearly in the health sector. When FDA announced the need for manufacturers to participate in an ISAO, confusion ensued. The NH–ISAC is effectively serving as the ISAO, 

but the FDA guidance by using the term ISAO resulted in a lot of 

confusion that is still being sorted out. Government needs to call 

out, recognize, and support the unique role ISACs play and not 

apply ISAO as a blanket term for information sharing. 

Four, establish cybersecurity professionals as SSA liaisons. It has 

become increasingly apparent that industry needs an experienced 

Government representative at the SSA level who understands cybersecurity issues, threats, vulnerabilities, and impacts, as well as 

the blended threats between physical and cybersecurity. Having an 

established, clear go-to lead in this area is imperative. 

12 

Thank you. This concludes my testimony and I thank you for the 

opportunity and I look forward to your questions. 

[The prepared statement of Ms. Anderson follows:] 

13 


Testimony of 

Denise Anderson 

On Behalf of the 

The National Health Information Sharing & Analysis Center and the 

National Council of Information Sharing and Analysis Centers 

Before the 

United States House of Representatives 

Committee on Energy and Commerce 

Subcommittee on Oversight and Investigations 

Apri/4, 2017 
14 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April 4, 2017 

ISAC BACKGROU:';D 

Chairman Murphy and members of the Subcommittee, my name is Denise Anderson. I am 

President of the National Health Information Sharing & Analysis Center (NH-JSAC) and Chair 

of the National Council of !SACs (NCI). l want to thank you for this opportunity to address the 

Oversight and Investigations Subcommittee about the industry perspective on cybersecurity and 

information sharing as well as the importance of collaboration and coordination between the 

public and private sectors. 

!SACs were formed in response to the 1998 Presidential Decision Directive 63 (PDD 63), which 

called for the public and private sectors to work together to address cyber threats to the nation's 

critical infrastructures. After 9/11, in response to Homeland Security Presidential Directive 7 (its 

2013 successor, Presidential Policy Directive 21) and the Homeland Security Act, !SACs 

expanded their role to encompass physical threats to their respective sectors. Many !SACs have 

been in existence over a decade and in some cases almost two decades. 

!SACs arc primarily trusted communities that promote the sharing of timely, actionable and 

reliable information for their respective critical infrastructure sectors and provide forums for 

owner and operator sharing around threats, incidents, vulnerabilities, best practices and 

mitigation strategies. !SACs are operational in nature and have strong reach into their sectors in 

order to gather and disseminate information quickly and efficiently. !SACs have been thriving 

and growing in recent years as owners and operators have seen the benefit to participating in 

these trusted communities, which is a testament to the value !SACs deliver to their members. 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 2 
15 


Cybersecurity, Information Sharing and Partnership Nl-l-ISAC Testimony April4, 2017 

NCI BACKGROUND 

The NCI is a voluntary organization oflSACs formed in 2003 in recognition of the need for the 

!SACs to share information with each other about common threats and issues. The mission of the 

NCI is to advance the physical and cyber security of critical infrastructure in North America by 

establishing and maintaining a framework for valuable interaction among and between the 

I SACs and with government. There are currently 21 individuallSACs that represent their 

respective critical infrastructure sectors or sub-sectors and 3 like organizations who are members 

of the NCI. The NCI has made it a goal to be inclusive of each critical infrastructure sector and 

sub-sector's operational arm. 

The !SACs collaborate with each other daily through the NCI daily operations centers cyber call, 

and the NCI listserver. The NCI also hosts a weekly operations centers physical call and meets 

monthly to discuss issues and threats. The organization is a true cross-sector partnership engaged 

in sharing cyber and physical threats, mitigation strategies and working together and with 

government partners during incidents requiring cross-sector response as well as addressing issues 

affecting industry. In addition, the NCI conducts and participates in cross-sector exercises, works 

with the National Infrastructure Coordinating Center (NICC) and the National Cybersecurity and 

Communications Integration Center (NCCIC) during steady-state and incidents, holds 

emergency calls as needed and develops joint white papers around threats. The !SACs have been 

instrumental in embracing, developing and advancing the automatic exchange of data within 

their memberships and across the !SACs. as well as with government as possible. 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 3 
16 


Cybersecurity, Information Sharing and Partnership NH-JSAC Testimony April4, 2017 

ISACs AND GOVERNMENT PARTNERSHIPS 

!SACs, which are not-for-profit organizations, work closely with various government agencies 

including their respective Sector Specific Agencies (SSAs) where they exist, intelligence 

agencies, law enforcement and state and local governments. In partnership with the Department 

of I Iomeland Security (DHS), severallSACs participate in the National Cybersecurity and 

Communications Integration Center (NCCIC) watch floor, !SAC representatives, cleared at the 

Top Secret I Sensitive Compartmented Information (TS/SCI) level, attend the daily briefs and 

other NCCIC meetings to share information on threats, vulnerabilities, incidents, and potential or 

known impacts to the critical infrastructure sectors. Having !SACs on the floor has allowed for 

effective collaboration on threats and incidents and there have been many examples of successful 

information sharing. The !SACs also serve as liaisons to the National Infrastructure Coordinating 

Center (NICC) and play a vital role in incident response and collaboration under the Critical 

Infrastructure Partner Annex to the Incident Management Plan. 

Finally, it should be noted that the !SACs collaborate with their sector coordinating councils as 

applicable and work with other critical infrastructure partners during steady state and incidents. 

National Council of I SACs and National Health Information Sharing & Analysis Center Page 4 
17 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April4,2017 

NH-ISAC BACKGROUND 

The NH-ISAC, founded in 2010, is a 50l(c)6 nonprofit organization and is funded primarily by 

its member firms through member dues. Since 2010 the membership has expanded to over 200 

organizations including healthcare delivery organizations (liDOs), pharmaceutical and medical 

device manufacturers, retail pharmacy, laboratory and radiological, electronic medical record 

providers and payers representing approximately one-third of the US Health and Public Health 

GOP*. 

The NH-ISAC is a global organization that has members in several diftcrent countries and 

membership is growing rapidly. 

Besides offering a trusted forum and community for sharing, the NH-ISAC offers a number of 

other services such as workshops, two annual summits, webinars, a daily report, monthly 

newsletter, white papers, special interest groups, a number of working groups and committees 

and various technical tools for member sharing. The !SAC provides alerts, has a representative 

on the NCCIC floor, and participates in exercises such as the national Cyberstorm series. The 

Nll-ISAC was one of the first organizations to adopt STIX and TAXI!, which are protocols for 

automated indicator and intelligence sharing and fosters a robust member machine to machine 

sharing environment. 

'Based on the annual revenue of all NH-ISAC member organizations. ($1.3 Trillion). 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 5 
18 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April 4, 2017 

The Nl-1-ISAC is also engaged in two ground-breaking initiatives. The first is the CyberFit suite 

of services that allows members to leverage the Nl-1-ISAC community to realize cost savings and 

efficiencies. 

Included in the initial suite of services is a third party risk assessment platform with over 80 

questions tailored for healthcare organizations that will then be stored in an accessible database 

for the benetlt of participating members, a benchmarking offering, as well as a 'shared security 

operations center (SOC)' program that will offer affordable services for malware analysis, 

penetration testing, vulnerability scanning and incident response. 

The second is the Medical Device Security Information Sharing Council that is advancing efforts 

in the area of medical device security and safety. Under a Memorandum of Understanding 

between the Nl-1-ISAC, the Medical Device Innovation, Safety and Security Consortium 

(MDISS), and the FDA; a number of national initiatives are underway to improve the security 

and safety of medical devices. These include: (I) MD-VIPER launched early this year to support 

the reporting of vulnerabilities and responsible medical device vulnerability disclosure per the 

FDA post market guidance (2) the National Cyber Safety Network for Health Technology, which 

leverages best public health practices to achieve national scale impact on patient safety and 

critical infrastructure and (3) the Medical Device Risk Assessment Platform, funded by Dl-IS 

Cyber Security Division, a program for medical device assessments and threat intelligence with a 

database that l-IDOs use to understand and secure devices in their environment. Our programs 

include collaborations with DHS ICS-CERT, FDA, NIST National Cybersecurity Center of 

National Council of I SACs and National Health Information Sharing & Analysis Center Page 6 
19 


Cybersecurity, Information Sharing and Partnership NH-lSAC Testimony April 4, 2017 

Excellence, the Advanced Medical Technology Association (AdvaMed), manufacturers and 

national hospital networks as well as many other stakeholders. 

NH-ISAC and MDISS also otTer a community forum for manufacturers and HDOs to interact 

and collaborate through listservers, meetings, tracks at NH-ISAC summits, and workshops, 

among other things. The group has already held two medical device security workshops this year 

with many more scheduled and in February 2017, NH-ISAC and MDISS held an all-day medical 

device cybersecurity symposium at HIMSS, an industry conference. 

The FDA has been very forward leaning in the medical device security collaboration space and 

the partnership with FDA, NH-ISAC and MD ISS is a great example of how industry and 

government can come together to address cybcrsecurity issues. The partnership ha'> been highly 

collaborative and is governed by a Memorandum of Understanding. Some examples ofthis 

public/private partnership include co-sponsoring of the FDA public workshop in January 2016, 

co-presenting at the FDA webinar on the post market guidance this past January 2017, presenting 

together at Nl !-!SAC Summits, and in particular, leveraging the NH-ISAC infrastructure for 

medical device vulnerability information sharing to meet the '!SAO functionality' as described 

in FDA's post market guidance, as a regulatory incentive. 

THE UNIQUE NATURE OF HEALTH AND CYBER 

Six years ago, 'cyber' and 'healthcarc' were not even placed in the same sentence. Today 

because of the proliferation of advances in technology and the efficiencies of connecting devices 

and data via the internet, the cyber threat surface in healthcare has ballooned and the threat actors 

National Council of!SACs and National Health Information Sharing & Analysis Center Page 7 
20 


Cybersecurity, Information Sharing and Partnership Nl-1-!SAC Testimony April4, 2017 

have followed. Threat actors have many motivations to attack whether for financial reasons, 

disruption, intellectual prope1ty theft, revenge or to make a political statement. Unfortunately, 

the stakes arc very high. The focus has traditionally been on data and privacy but if l-IDOs cannot 

deliver services, as was seen in several recent ransom ware attacks, or data is manipulated or 

destroyed, patient lives can be at risk. 

Unlike in other sectors, healthcare data must be p01table. Sensitive patient information must 

move between various medical providers, pharmacies, diagnostic facilities and payers to 

facilitate proper patient care and history as well as payment for those services. Many hcalthcare 

facilities such as hospitals operate in environments that are accessible to the public. Hospitals 

employ tens of thousands of medical devices, many using outdated operating systems, and many 

of which are connected to a network. These devices arc made by a variety of manufacturers with 

various levels of security and patching protocols built in. Coupled with a diverse base within the 

sector, complex siloed departments, a lack of skilled cyber staff, a lack of cyber security 

situational awareness, a lack of knowledge and training for the medical staff as well as the CEO 

and Board level, and lack of cybcr security strategy including a risk management approach, the 

health and public health sector faces an enormous challenge. 

MEETING THE CHALLENGE 

There are a number of great initiatives and efforts underway within the sector but there is still a 

lot more that can be done. Congress can help meet this challenge by focusing on four key areas: 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 8 
21 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April 4, 2017 

I-EDUCATION, RECOGNITION AND FACILITATION OF THE IMPORTANCE OF 

INFORMATION SHARING 

One of the greatest challenges for the NH-ISAC and all !SACs is the lack of awareness amongst 

the critical infrastructure owners and operators, particularly the smaller owners and operators, 

that the !SACs exist and are a valuable tool. Numerous incidents have shown that effective 

information sharing amongst robust trusted networks of members works in combatting cyber 

threats. 

Government, and specifically the Sector Specific Agencies (SSAs) should regularly and 

consistently encourage owner/operators and especially at the Board and CEO level to join their 

respective !SACs. This has been very e!Tcctive in the financial sector where the United States 

Department of the Treasury, the regulators and state agencies have been strongly encouraging 

membership in the FS-ISAC as a best practice. Currently, not all SSAs support their sector 

designated !SACs in the same manner. 

The SSAs indeed have a policy reference for this kind of advisory to their sector representatives: 

the NIST Cybersecurity Framework. This Framework, developed over the course of a year 

collaboratively by government and private sector stakeholders, lays out a cyber risk management 

framework linked to five core functions: identify, protect, detect, respond and recover. Among 

the functional categories identified as part of a mature cyber risk management strategy is external 

communications and coordination around cyber security threats, response and best practices. In 

other words, membership in an !SAC or !SAO is an essential element of a successful cyber risk 

management strategy. Likewise, the most recent draft of the White House cybersecurity 

National Council of!SACs and National Health Information Sharing &Analysis Center Page 9 
22 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April4, 2017 

executive order calls for an assessment of how government can support critical sectors' cyber 

risk management programs. Accordingly, one of our key recommendations in response to that 

review would be a policy statement that provides explicit guidance to SSA 'sand their sectors to 

integrate into their cyber risk management and preparedness programs their participation in and 

collaboration with these information sharing and incident response organizations where 

applicable. 

Another way to facilitate sharing and build robust communities is by providing financial 

incentives through tax breaks or other means to critical infrastructure organizations that join their 

respective !SACs. 

2-PROTECT INFORMATION SHARING 

Recently, the Automotive !SAC was served a non-party deposition subpoena to furnish all 

documentation related to communications between the Auto !SAC and one of its members. The 

Auto lSAC with the help of other !SACs was able to quash the subpoena with Judge Wilkerson 

of the U.S. District Court for the Southern District of lllinois effectively ruling that the subpoena 

was nothing more than a fishing expedition. 

The concern with this subpoena however, is that if Courts were to allow broad sweeps for 

information and using !SACs as "one-stop-shops" to accomplish it, such actions would 

effectively kill information sharing and undermine Congress' important information sharing 

goals set forth by the Cybersecurity Information Sharing Act (CISA) and the government's 

interest in promoting national security through the !SACs and public-private information sharing. 

National Council of I SACs and National Health Information Sharing & Analysis Center Page 10 
23 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April4, 2017 

The confidential information shared amongst the members of an !SAC should be considered 

protected information and not subject to disclosure. 

3-ELIMINA TE THE CONFUSION BETWEEN THE TERMS !SAC AND !SAO 

The Executive Order, Promoting Private Sector Cybersecurity Information Sharing, signed 

February 15,2015 by President Obama is commendable in its intent to foster information 

sharing. Information Sharing and Analysis Organizations (lSAOs) were first defined in the 

Homeland Security Act of2002. !SACs were created under Presidential Decision Directive 63 

(PDD-63). Effectively !SACs were the original lSAOs and are the subject matter experts in 

information sharing with a majority of! SACs having been in existence for over a decade. 

Indeed, there is a need for many groups that may not fall in with the critical infrastructure sectors 

such as legal and media and entertainment organizations, who are increasingly becoming targets 

for cyber incidents and attacks, to share information. The private sector is already organizing 

efforts in this area and as an example; the FS-ISAC, working with the legal industry, formed the 

Lega!ISAO. 

However, !SACs are much more than ISAOs. !SACs offer several vehicles to share effective 

techniques and practices for preventing, detecting and managing cyber security risk that arc often 

un-conventional controls (definition: controls that are designed and implemented independent of 

any risk framework, standard or regulatory guidance). ISAOs don't offer vehicles tor this type of 

sharing. 

National Council of! SACs and National Health Information Sharing & Analysis Center Page 11 
24 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April 4, 2017 

For example: enterprises can choose to obtain an intelligence feed to identify newly registered 

domains and choose to drop all email originating from newly registered domains. This is an 

example of a technique shared at last year's NH-ISAC Summit. This information is not shared in 

any other forum or event. Another example is the focus put on the adoption of the use of 

DMARC as a standard for improving trust in email and constraining the use of email for 

phishing attacks. This was initially shared at the FS-ISAC and today is offered through the 

NH-lSAC. These two examples have a material impact on improving industry resiliency and 

these techniques, !ike many others, are indicative of the unique services an !SAC offers to its 

members. 

!SACs also serve a special role in critical infrastructure protection and resilience and play a 

unique role in the sector partnership mode!. While the White House has noted that the EO seeks 

to "not limit effective existing relationships that exist between the government and the private 

sector" the EO and prominent coverage of ISAOs has led to much confusion within industry as 

to the impacts to !SACs. It is absolutely essential that the successful efforts !SACs have 

established over the years should not be disrupted. It is clear that !SACs by their success meet 

the distinct and unique needs of each of their sectors and the owner and operator members of 

those sectors. 

We have seen this clearly in the Health and Public Health Sector. When the FDA in its post 

market guidance for medical device security announced the need for manufacturers to participate 

in an !SAO, confusion ensued. The NH-ISAC is effectively serving as the !SAO and as 

mentioned is doing a large ground-breaking body of work in the medical device arena with the 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 12 
25 


Cybersecurity, Information Sharing and Partnership NI-I-ISAC Testimony April4, 2017 

FDA, but the guidance by using the term !SAO resulted in sector stakeholders immediately 

thinking some new organization needed to be created and has caused a lot of confusion that is 

still being sorted out. 

The solution to easing this confusion is very simple. The White House, SSAs and other relevant 

agencies need to call out, recognize and support the unique role !SACs play in critical 

infrastructure protection and resilience and not apply the term !SAO as a blanket term for all 

information sharing. For instance, !SACs have the responsibility to maintain sector wide threat 

awareness within their respective sectors. It is critical that our federal partners continue to 

respect and support that role to avoid undermining one of the main duties of !SACs to their 

members and sectors. It is vital that the process is not diluted and remains streamlined to 

facilitate effective situational awareness and response activities particularly when an incident 

occurs. 

4-ESTABLISH CYBER SECURITY PROFESSIONALS AS SSA LIAISONS 

Given that cyber security has only recently come to healthcare, it is understandable that there has 

not been a need previously for a cyber security professional to act as a strong, government 

liaison and advocate for the public private partnership when it comes to cyber matters. It has 

become increasingly apparent that industry needs a government representative who understands 

cyber security issues, threats, vulnerabilities and impacts as well as the blended threats between 

physical and cyber security. Having an established, clear government 'go to' lead in this area is 

imperative to strengthening the partnership and improving the overall cyber security posture of 

the health and public health sector. 

National Council of!SACs and National Health Information Sharing & Analysis Center Page 13 
26 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April 4, 2017 

EFFECTIVE INFORMATION SHARING 

It is important to note that the goal of information sharing is not to share information in and of 

itself but to create situational awareness in order to inform risk based decisions as well as allow 

operational components within owner/operation organizations that have direct actionable control 

over the content they are sharing, to perform an action. The focus needs to be on enhancing the 

ability of operational groups to work closely with each other. 

The !SACs are successful organizations with almost two decades of proven case studies of 

information sharing and collaboration. They are the subject matter experts on information 

sharing. For information sharing to be effective it must be: 

• Voluntary not mandated or regulated 

• Industry Driven 

• Actionable, Timely and Relevant 

• Bi-directional and Collaborative 

Government can help this effort by: 

• Encouraging owners and operators of critical infrastructure to join their respective sector 

!SACs 

• Offering financial incentives such as tax breaks for owners and operators to join !SACs 

• Recognizing !SACs and the unique operational role that they play in critical 

infrastructure protection and resilience 

National Council of I SACs and National Health Information Sharing & Analysis Center Page 14 
27 


Cybersecurity, Information Sharing and Partnership NH-ISAC Testimony April4,2017 

• Protecting information sharing by ensuring confidential data shared amongst members is 

protected from disclosure 

• Place strong, defined and permanent cyber security liaisons and leadership within the 

SSAs to advocate the public private partnership when it comes to cyber matters. Cyber 

security liaisons and their leadership, should be experienced and certified cyber security 

professionals. 

This concludes my testimony. Thank you again for the opportunity to present this testimony and 

I look forward to your questions. 

National Council of !SACs and National Health Information Sharing & Analysis Center Page 15 
28 

Mr. MURPHY. Thank you. Mr. McNeil, you are recognized for 5 

minutes. 

STATEMENT OF MICHAEL C. McNEIL 

Mr. MCNEIL. Thank you, Chairman Murphy, Ranking Member 

DeGette, and members of the committee for the opportunity to testify today. 

It is critical to both patient well-being and the medical technology industry that medical devices are safe and that risk, including cybersecurity threats, are appropriately managed. AdvaMed, 

the world’s largest trade association representing medical technology manufacturers and its member companies, including Philips, are committed to a robust cybersecurity framework as part of 

the development and postmarket management of medical technologies. 

Our strategies include not just staying on top of emerging software-based vulnerabilities and potential external threats while anticipating how they might affect our products and solutions, it also 

includes collaborating with regulatory agencies, industry partners, 

and healthcare providers to close security loopholes. This includes 

participation in the Healthcare Industry Cybersecurity Task Force 

sponsored by Health and Human Services, HHS. 

I’d like to emphasize, one, medical device development and security risk management. Medical device manufacturers must address 

cybersecurity throughout the product lifecycle. This includes the 

design, development, production, distribution, deployment, maintenance, and disposal of devices and associated data. Second, system 

level security. AdvaMed member companies have developed 

foundational principles for the management of medical device cybersecurity and believe that medical technology cybersecurity is a 

shared responsibility among all stakeholders within the healthcare 

community including manufacturers, hospitals, physicians, and our 

patients. 

Third, we need to have coordinated disclosure. Medical device 

manufacturers should deploy a coordinated disclosure process that 

provides a pathway for researchers and others to submit information including potential vulnerabilities. Coordinated disclosure 

processes should define the responsibilities of both the manufacturers and researchers. Whenever potential vulnerabilities involving a 

medical device are discovered, findings should first be brought to 

the attention of the manufacturer and/or the FDA for review, analysis, and possible remediation. 

Third, information sharing. The industry should share threat 

and vulnerability information to assist manufacturers in continuously managing their devices’ cybersecurity throughout the product’s lifecycle. And then fourth, a consensus around our standards, 

regulatory requirements, and education. The development of cybersecurity-related consensus standards and regulations should be accomplished collaboratively among the regulators, medical device 

manufacturers, independent security experts, academia, and 

healthcare delivery organizations. 

The U.S. Food and Drug Administration, the FDA, should be 

commended for leadership in medical device cybersecurity. The 

FDA and its cybersecurity staff have worked closely with the medVerDate Mar 15 2010 11:11 Jun 21, 2017 Jkt 037690 PO 00000 Frm 00032 Fmt 6633 Sfmt 6633 C:\USERS\WLAUFERT\DESKTOP\115X24SECUREHEALTHCAREPENDING WAYNE
29 

ical technology industry and the broader healthcare ecosystem to 

ensure medical device cybersecurity is considered and addressed 

throughout all stages of the product design and use. 

AdvaMed and Philips are among the organizations that look forward to continuing to work with Congress and the administration 

to ensure that the medical technology industry maintains a forward-leaning approach to cybersecurity and the devices that they 

produce are safe for our patients. 

Thank you very much for this opportunity. 

[The prepared statement of Mr. McNeil follows:] 

30 


~ AdvaMed 

Michael C. McNeil, Philips 

AdvaMed, the Advanced Medical Technology Association 

Testimony 

Energy & Commerce Committee, Subcommittee on Oversight and Investigations 

"Cybersecurity in the Heath Care Sector: Strengthening Public-Private Partnerships." 

Tuesday, April4, 2017 

Thank you Chairman Murphy, Ranking Member DeGette, and members of the Committee for 

the opportunity to testify today. My name is Michael C. McNeil, and I am testifying on behalf of 

Philips and our trade association, AdvaMcd. As the Global Product Security and Services Officer 

at Philips, a leading healthcare technology company, my responsibility is to oversee efforts to 

ensure that consistent repeatable cybersecurity processes are deployed throughout the 

development and maintenance of products. Philips is driving the convergence between 

professional health systems and personal consumer technologies to seamlessly and securely 

connect devices. data, systems and people across the entire health continuum. from the hospital 

to the home. 

AdvaMed is the world's largest trade association representing medical technology 

manufacturers. AdvaMed member companies produce the medical devices, diagnostic products 

and health information systems that arc transforming health care through earlier disease 

detection. less invasive procedures and more effective treatments. Collectively, we arc 

committed to ensuring patient access to life-saving and life-enhancing devices and other 

advanced medical technologies. 

Let me first say a few words about Philips' cybersecurity strategy. Our strategy includes not just 

staying on top of emerging software-based vulnerabilities and potential external threats while 

anticipating how they might affect Philips products, it also includes collaborating with regulatory 

agencies, industry partners, and health care providers to close security loopholes. This includes 

participating in the Health Care Industry Cyber Security Task Force, under the auspices of the 

Department of Health and Human Services. 

Working with these organizations, we can understand how other industries have addressed 

cybersecurity threats, identified challenges to health care environments, and provide health care 

industry stakeholders guidance on preparing for, and responding to, cybersecurity threats. 

Moreover, we can help develop effective and uniform application of practical, innovative 

security technologies and methodologies that enhance the country's ability to address current and 

future computer and information security challenges. 

We also work with health system partners like Augusta University Health, as part of visionary 

public-private programs like the one created by Governor Nathan Deal in Georgia, to address the 

cyber security challenges facing the US hcalthcare system. We also actively participate in 

industry groups like AdvaMed. 
31 


Overview of Medical Technology Sector and Cybersecurity 

Let me now describe an overview of the medical technology sector and cybersecurity. AdvaMed 

and its member companies, are committed to a robust cybersecurity framework as part of the 

development and postmarket management of medical technologies. Medical device 

manufacturers address cybersccurity throughout the product lifecycle, including during the 

design, development, production, distribution, deployment, maintenance and disposal of the 

device and associated data. Similarly, manufacturers implement proactive measures to manage 

medical device cybcrsecurity, including but not limited to routine device cyber maintenance, 

assessing postmarket information, employing risk-based approaches to characterizing 

vulnerabilities, and timely implementation of necessary actions. 

Principles for Robust Medical Technology Cybersecurity 

Working with my colleagues at AdvaMed, we have developed the following five foundational 

principles for the management of medical device cybersecurity: 

1. Medical device development and security risk management 

First, an effective cybersecurity risk management program should incorporate both premarket 

and postmarket lifecycle phases and address cybersecurity from medical device conception to 

disposal. In addition. medical device security risks should be addressed through a risk 

management process that is based on consensus-driven recognized standards and reference 

documents. This risk management process should include a process to monitor the ongoing 

security of devices in usc. 

2. System-Level Security 

Second, medical technology cybersecurity is a shared responsibility among all stakeholders 

within the healthcare community. Because systems are only as secure as their weakest point, all 

clements ofthe system must be appropriately managed and secured. 

3. Coordinated Disclosure 

Third, medical device manufacturers should deploy a coordinated disclosure process that 

provides a pathway for researchers and others to submit information, including potential 

vulnerabilities, to the organization. Coordinated disclosure processes should clearly define the 

responsibilities of both the manufacturer and researcher. It is important to emphasize that 

whenever potential vulnerabilities involving a medical device are discovered, these findings 

should first be brought to the attention of the manufacturer and I or fDA for review, analysis, 

and possible remediation. Any other approach potentially places patients' lives at risk. 
32 


4. Information Sharing 

Fourth, to assist manufacturers in continuously managing their device's cybersecurity throughout 

the product's lifecycle, industry should judiciously share threat and vulnerability information. 

5. Consensus Standard~. Regu/at01y Requiremenls, and Education 

Finally, the development of cybersecurity-related consensus standards and regulations should be 

accomplished collaboratively among regulators, medical device manufacturers, independent 

security experts, academia, and health care delivery organizations. We also believe the health 

care industry should leverage the experiences and expertise of other critical infrastructure sectors 

and government agencies, such as NIST. 

Engagement with FDA and Public-Private Partnerships 

I would also like to take this opportunity to commend the U.S. Food and Drug Administration 

("FDA" or "Agency") for its proactive leadership role over medical device cybersecurity. The 

FDA has worked closely with the medical technology industry and the broader healthcare 

ecosystem to ensure medical device cybersecurity is considered and addressed throughout all 

stages of product design and use. For example, in 2013, FDA released final guidance concerning 

premarket cybersecurity-related issues device manufacturers must consider when designing a 

connected medical device. And most recently, in December 2016, FDA released final guidance 

addressing the postmarket management of medical device cybersecurity. Taken together, these 

documents represent significant and welcomed- achievements by the Agency to inform 

manufacturers of their medical device cybersecurity obligations. 

Moreover, the FDA entered into a Memorandum of Understanding ("MOlT') with the National 

Health Information Sharing and Analysis Organization ("NH-ISAC") and the Medical Device 

Innovation, Safety and Security Consortium ("MDISS") to promote cybersccurity information 

sharing for medical devices. These efforts have led to the creation of a medical device-specific 

information sharing and analysis organization, which has recently launched a program called the 

Medical Device Vulnerability Intelligence Program for Evaluation and Response, or MDVIPER. MD-VIPER provides a streamlined mechanism for medical device manufacturers to 

submit and share information concerning cybersecurity-related issues, as well as other members 

of the broader healthcare ecosystem. 

In light of the FDA's significant work and achievements to date, and the Agency's staff ongoing 

engagement with industry, we believe that the FDA serves as an example to all regulatory bodies 

with respect to the type of interaction, collaboration, and guidance an agency should provide to 

its regulated industry. 

Conclusion 

I want to underscore how critical it is to our industry that medical devices arc safe for patients 

and risks, including cybersccurity threats, arc appropriately and safely managed. Healthcare 

technology companies, like Philips, take seriously the need to continuously assess the security of 
33 


~ ~~,~~,~~~'"'''"'" their devices in a world where the risks, no matter how remote, evolve. Manufacturers make 

every effort to address cybersecurity throughout the product lifecyclc, including during the 

design, development, production, distribution, deployment, maintenance and disposal of the 

device and associated data. Similarly, manufacturers implement proactive measures to manage 

medical device cybersecurity, including but not limited to routine device cyber maintenance, 

assessing postmarket information, employing risk-based approaches to characterizing 

vulnerabilities, and timely implementation of necessary actions. 

We work very closely with the FDA and look forward to continuing to work with Congress and 

the Administration to ensure that the medical technology industry maintains a collaborative 

approach to cybersecurity and device safety. 
34 

Mr. MURPHY. Thank you, Mr. McNeil. Mr. Rice, you are recognized for 5 minutes. 

STATEMENT OF TERENCE M. RICE 

Mr. RICE. Thank you. Chairman Murphy, Ranking Member 

DeGette, and members of the subcommittee, my name is Terry Rice 

and I have been involved in healthcare cybersecurity for 15 years. 

I also participate in a number of public-private partnerships that 

are working diligently to improve the cybersecurity across the 

healthcare sector and I appreciate the opportunity to testify on this 

important matter. 

Nowhere is the cybersecurity challenge more acute today than in 

the healthcare industry. In just the last few years, as has already 

been mentioned, we’ve seen more than a hundred million health 

records of American citizens in a couple of well-publicized incidents. We have seen how software vulnerabilities in insulin pumps 

and pacemakers can be exploited to cause potentially lethal attacks. And we have witnessed entire hospitals in the United States 

and the U.K. shutting down for multiple days to combat 

ransomware infections in critical systems. 

Unfortunately, I believe these incidents underrepresent the risk 

we are facing in the industry and I make this statement based on 

five observations. First, the total number of cybersecurity incidents 

is significantly underreported due to current disclosure laws. Number two, electronic evidence gathered through normal security monitoring suggests there are a lot more breaches and incidents than 

what is currently reported. Three, the healthcare industry consists 

of many small to midsized businesses that lack the capital and personnel to deal effectively with all but the most basic cybersecurity 

issues. 

Fourth, in our industry, the need for portability of health information to adequately care for patients increases the risk unlike 

many other sectors. Five, recent advances in healthcare technology 

along with the proliferation of electronic health records and 

healthcare applications has opened up a much wider array of cybersecurity risks and exposures. The combination of these observations leads me and many of my peers to believe that the cybersecurity situation in the healthcare industry is far worse than what 

current reporting indicates. 

Neither the private sector nor the Government can solve this 

problem alone. We must work collaboratively and transparently to 

reduce this risk. As a participant and user of services provided 

through multiple public-private partnerships identified in my written submission, I feel each provides tremendous value and has become an integral and essential part of the defense of my organization. 

We consume intelligence from the NH–ISAC on a 24 by 7 basis 

to update our defenses, we utilize digital identities from the SAFE 

BioPharma Association to protect sensitive data, and we participate in the Sector Coordinating Council meetings to discuss emerging topics in the cybersecurity area. 

But I think there’s a lot of opportunity to do more and I’ll cover 

five of the observations, or five of the items that I hit in my written 

testimony. 

35 

First, HHS should appoint a senior cybersecurity professional 

with healthcare-sector experience as the primary liaison to industry. Today, there are multiple offices within the Department that 

have some responsibility for cybersecurity outreach, but none of 

them have it as their primary task. Furthermore, few organizations 

have the detailed cybersecurity knowledge and experience to engage with their private industry peers. This new role would be the 

focal point for all cybersecurity interactions with the private sector 

and would serve as the Government lead on the rest of the opportunities. 

Number two, HHS should work with the Sector Coordinating 

Council and private sector to develop a more comprehensive cybersecurity protection plan for the industry. While the high-level cybersecurity plans were captured in the latest iteration of the 

Healthcare and Public Health Sector Specific Plan dated May 2016, 

a more thorough and detailed plan should be developed. The current plan is only two pages. Third, HHS and the NH–ISAC should 

work with DHS, law enforcement, and the intelligence community 

to increase the quality of intelligence and the speed with which it 

is shared to the private industry. 

Fourth, HHS and the Sector Coordinating Council, the NH– 

ISAC, should work with the private sector to schedule and execute 

tabletop exercises and other simulations to assess the effectiveness 

of the cybersecurity plan within the healthcare environment. These 

events would be similar to the Hamilton series of exercises conducted by the Department of Treasury and the financial services 

sector that led to the creation of capabilities such as the Sheltered 

Harbor concept that is scheduled to go operational this year. 

Fifth and finally, HHS, DHS, and the Sector Coordinating Council should collaborate with global agencies and institutions to share 

intelligence best practices and emerging concerns. This is a global 

problem. Thank you. 

[The prepared statement of Mr. Rice follows:] 

36 


Written Testimony of 

Terence M. Rice 

On Behalf of 

Merck & Co., Inc. 

Before the 

United States House of Representatives 

Committee on Energy and Commerce 

Subcommittee on Oversight and Investigations 

Apri/4, 2017 
37 


Cybersecurity in the Healthcarc Sector: Strengthening Public-Private Partnerships 

INTRODUCTION 

Chairman Murphy, Ranking Member DeGettc, and Members of the Oversight and 

Investigations Subcommittee, my name is Terry Rice. I have been involved in healthcare 

cybersecurity for more than fifteen years in a wide variety of roles including my current 

assignment as the Vice President and Chief Information Security Officer (CISO) at Merck & 

Co., Inc. I also participate in a number of public-private partnerships that are working to 

improve cybersecurity across the health care sector. These partnerships include the National 

Health-Information Sharing and Analysis Center (NI l-ISAC), the Healthcarc Sector 

Coordinating Council (SCC), the SAFE BioPharma Association, and the Healthcare Industry 

Cybsecurity Task Force, the latter of which was created by the Cybersecurity Information 

Sharing Act of2015. I appreciate the opportunity to testify before you on the topic of 

cybersecurity in the healthcare industry and to discuss how public-private partnerships have 

assisted and can do even more to address the complex challenges we arc facing. 

THE STATE OF HEAL THCARE CYBERSECURITY 

Cybersccurity has rapidly become a top concern for governments and industries around 

the world. In just the last lour years, cybersecurity has jumped from the fifteenth greatest risk 

facing companies to the third highest risk in the Allianz Annual Risk Barometer, a global survey 

that measures the sentiments of corporate risk professionals., Cybersecurity has also been listed 

as a top concern by many national governments and has been included as a top risk in the US 

Intelligence Community's annual Worldwide Threat Assessment since at least 2013.;; Nowhere 

is the situation more acute than in the healthcare industry. In just the last few years we have seen 

over one hundred million health records exposed in a number of well-publicized security 

breaches, we have observed cybersecurity researchers demonstrate how software vulnerabilities 

Page 2 
38 


Cybersecurity in the Healthcarc Sector: Strengthening Public-Private Partnerships 

in insulin pumps and pacemakers could be exploited to cause a lethal attack, and we have 

witnessed entire hospitals in the United States and the United Kingdom shutting down for 

periods of time to combat a ransomware infection on critical systems. It is because of these 

events and many others that IBM named the healthcare industry as the most attacked industry in 

its 2016 IBM Cyber Security Intelligence lndeX.lii 

Unfortunately, I believe the news stories and reports underrepresent the risk we are facing as 

an industry. I make this statement based on five observations: 

1. The total number of cybersccurity incidents is significantly underreported. Today, 

organizations are only required to report cybersecurity incidents when a) personal health 

information is breached, b) the incident directly impacts patient safety, or c) the loss of 

information or disruption of service would be considered a financially material eventiv. 

Organizations are unlikely to report security incidents if not required to do so given the 

potential reputational harm that might occur. The reports we read about are only a small 

fraction of the incidents that actually occur. Furthermore, the incidents that do get 

reported (e.g. breaches of personal health information) also create a narrow focus on 

privacy protections for personal health information instead of considering the full 

spectrum of impacts caused by healthcare cyber incidents. 

2. The healthcare industry consists of many small to mid-sized businesses that lack the 

capital and personnel to deal effectively with all but the most basic cybersecurity issues. 

According to one statistic, more than 90% oftirms in the healthcare services subsector 

employ less than l 00 people and about 70% of these firms employ less than I 0 

employees.v To complicate this, the healthcare services and hospital subsectors have 

some of the lowest profit margins across industry. vi These two factors make it difficult 

Page 3 
39 


Cybersecurity in the llealthcare Sector: Strengthening Public-Private Partnerships 

for these firms to acquire the advanced tools and services necessary to prevent, or at least 

detect, sophisticated attacks, These small to mid-sized firms often face the difficult 

choice of investing in the latest cybersecurity tool or purchasing a crucial medical system. 

More often than not the latter will win. Even if these entities are able to make the capital 

investments required, they arc almost always unable to acquire the talent necessary to 

install, operate, and maintain these capabilities and develop a broader cybersecurity 

program. 

3. The portability ofhealthcare information increases the risk. Unlike other industries, the 

healthcarc industry requires information to be shared among multiple companies to 

provide patient care. Primary care physicians must share data with specialists, specialists 

must share data with labs, labs provide intcmnation to pharmacies and pharmaceutical 

benetits managers, and all of them share subsets of this data with insurance companies. 

To facilitate this information sharing, most of these entities interconnect their networks 

and systems. Consequently, a failure anywhere in the ecosystem may lead to impacts 

across the sector. 

4. Proliferation of software into the hcalthcare ecosystem increases the attack surface. The 

healthcare industry was somewhat of a laggard in the adoption of software services and 

solutions. The Health Information Technology for Economic and Clinical Health 

(HITECH) provisions of the American Recovery and Reinvestment Act of2009 provided 

both incentives and penalties to increase the adoption of electronic health records. This 

rapid adoption of electronic health record technology has spurred the development of new 

software solutions and services that can create, input, and analyze patient health 

information. While these advances offer tremendous potential healthcare benefits and 

Page 4 
40 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

may help to reduce cost across the industry, we are rapidly increasing the cyber attack 

surface in the healthcare sector. The risk is exacerbated by the fact that software 

developers have not yet come up with a way to prevent errors and mistakes in the 

software they create. In fact, computer programmers continue to make many of the same 

mistakes in their code that were made 15-20 years ago. Today we measure software 

errors in the number of defects per thousand lines of code; many of medical applications 

being developed contain millions if not tens of millions of lines of software code. We 

will be dealing with these inadvertent flaws for a decade or more from now. So we must 

account for this with additional preventative and detective controls. 

5. Anecdotal electronic evidence also suggests there arc a lot more security incidents than 

what is currently reported. As part of normal information security monitoring, it is quite 

common to find information about other companies that have been attacked or even 

compromised. These indicators might be something as simple as mal ware traffic 

emanating from a partner's network or the observation of another company's name 

showing up in a data dump released by an attacker. In fact, there arc web services like 

Shodan that specialize in identifying and cataloging vulnerable systems and devices 

including many from the healthcare industry in an easily searchable web interface. 

When all of these observations are combined, it leads me, and many of my peers, to believe 

that the cybersecurity situation in the healthcare industry is far worse than what public reporting 

indicates. Neither private industry nor the government can solve this problem alone; we must 

work collaborativcly and transparently to reduce this risk. 

Page 5 
41 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

THE VALUE OF PUBLIC-PRIVATE PARTNERSHIPS IN CYBERSECURITY 

The notion of public- private partnerships for cybersecurity first gained traction in 1997 

following the publication of recommendations from the President's Commission on Critical 

Infrastructure Protection. These recommendations were codified in Presidential Decision 

Directive/NSC 63- Critical Infrastructure Protection which specified the industry segments that 

should be considered critical infrastructure, appointed a sector specific agency to coordinate the 

public-private partnership, and identified ten tasks that should be accomplished by each sector. 

A Government Coordinating Council and Sector Coordinating Council were created to represent 

the myriad of government departments/agencies and private sector participants respectively. The 

tasks included an assessment of threats and vulnerabilities that might impact the sector, the 

development of a sector-wide remediation/protection plan, and the sharing of intelligence 

information between the government and private sector. Although subsequent administrations 

have tweaked the industries and functions that make up the critical infrastructure and have made 

minor modifications to the tasks on which each sector should focus, by and large there has been 

support for the concept for two decades. 

The healthcare and public health sector has been designated a part of the critical 

infrastructure since PDD-63. The Department of Health and Human Services (HHS) has been 

the sector specific agency since that time. However, it is only in recent years that the topic of 

cybersecurity has become a prominent issue. The Sector Coordinating Council now devotes a 

regular portion of its meetings and monthly teleconferences to discussing developments in the 

cybersecurity space and has established working groups to tackle items of common interest 

among the members. The NH-ISAC, created in 20 I 0, has grown from about a dozen original 

members to more than 200 participating companies and it continues to attract more and more of 

Page 6 
42 


Cybersecurity in the Healthcarc Sector: Strengthening Public-Private Partnerships 

the thousands of healthcare entities that exist in the United States. More importantly the quantity 

and quality of actionable intelligence shared by members has increased substantially in the last 

12-18 months. The NH-ISAC has stood up working groups that work collaboratively to identify 

new sources of threat intelligence and ways to disseminate to all parties in the most effective 

manner, and to collaborate on ways to more effectively secure "big data'' within the healthcare 

industry, but both organizations have the potential to do even more. 

At the same time, other public-private partnerships have grown out of a desire to reduce 

the cost and complexity of business. The SAFE BioPharma Association was founded more than 

a decade ago out of a shared desire between the government and private industry to reduce the 

cost and complexity of submitting new drug applications to the Food and Drug Administration 

(FDA). In order to move away from paper-based submissions, all parties needed to agree on a 

mechanism that would ensure data integrity, provide for non-repudiation, and ensure trust in the 

identity ofthe signer. The members of SAFE BioPharma worked closely with the FDA, the 

National Institute for Standards and Technology (NlST), the General Services Administration 

(GSA), and regulators in the European Union and Japan to create a digital identity and digital 

signature standard that today is accepted by all parties. The standard creates an interoperable 

digital identity ecosystem in which all identities can be trusted at known risk-levels. It allows 

government agencies and private sector healthcare providers to have standardized trust for 

authentication and signing. Vendors have a tool for standardizing trust in their products and 

applications and the user can have a single identity for use across the ecosystem. The standard 

has been certified to meet US government federal identity standardsv.; and is used on electronic 

submissions, contracts, and other critical worktlows that require integrity, identity trust, and nonrepudiation around the world. More importantly, the industry has recently started adopting this 

Page 7 
43 


Cybcrsecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

digital identity standard for authentication purposes, much in the manner the US Federal 

Government rapidly adopted the use of Personal Identity Verification (PlY) cards for strong 

authentication following the Office of Personal Management (OPM) breach. According to 

Yerizon's 20161-lealthcare Data Breach Reportvdi, two out of every three healthcare data 

breaches have been caused by hijacked user names and passwords. SAFE BioPharma members 

hope to increase the use of standards-based authentication credentials across the healthcare 

industry. Particular emphasis is being placed on multi-factor authentication capabilities across 

the healthcare industry using the SAFE BioPharma standard and other recognized standards that 

meet the same level of security- all based on NIST and GSA standards. 

As a participant and user of services provided by all three public-private partnerships, I 

feel each provides tremendous value and has become an essential part of my organization's 

cybersecurity program. We leverage the intelligence provided by the NH-ISAC to update our 

defenses on a continuous, 24x7 basis, we use the NH-ISACs benchmarking service to identify 

areas in where we may learn fi·om our peers, we leverage SAFE BioPharma compliant digital 

identities in collaborating with peer organizations, and we actively participated in the recent 

Df-!S Cyberstorm table top exercise. But there are many opportunities to further mature and 

develop these capabilities. 

OPPORTUNITIES I<'OR FURTHER PARTNERSHIP AND COLLABORATION 

l. Appoint a Healthcare Sector Cybcrsecnrity Liaison. HHS should appoint a senior 

cybersecurity professional as a liaison to the private sector. Today the Assistant Secretary 

for Preparedness and Response (ASPR) has the responsibility for ensuring the healthcare 

sector is prepared to respond to a critical health emergency such as a pandemic flu outbreak 

or the disruption of critical health infrastructure from a natural disaster as occurred in New 

Page 8 
44 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

Orleans during Hurricane Katrina. The Office of National Coordinator (ONC) has a Chief 

Privacy Officer who, along with the HHS Office of Civil Rights (OCR), works with the 

private sector on privacy policies and implements enforcement actions when necessary. 

HHS also has a Chief Information Security Officer (C!SO) within the Office of the Chief 

Information Officer (C!O) who is primarily responsible for protection of HHS systems and 

services. All four of these offices interact with the private sector but none of them have 

cybersecurity outreach as their primary mission. A cybersecurity liaison would be the 

primary focal point for outreach to the private industry on topics of cybersecurity. The role 

would not supplant current responsibilities, but instead focus on education and awareness of 

cybersecurity risks within the sector, advocacy for the use of cybersecurity tools and 

capabilities provided by the Department of Homeland Security (DHS), and collection of key 

issues from the sector. The liaison would also chair a GCC working group on cybersecurity 

that would work closely with the Sector Coordinating Council equivalent. 

2. Develop Cybcrsecurity Appendix to Healthcare & Public Sector Specific Plan. While 

cybcrsecurity concerns were captured in the latest iteration of the Hcalthcare and Public 

Health Sector Specific Plan May 20 l6ix, a more thorough and detailed appendix should be 

added to the existing plan to better assist public and private sector entities in developing their 

own cybersecurity incident response plans. This appendix should include templates and 

guidelines to help smaller and less mature organizations create at least a rudimentary 

cybersecurity response plan. 

3. Increase the Quality of Cybcrsecurity Intelligence and the Speed with Which It is 

Shared. While there has been a significant increase in the quantity and timeliness of 

information shared by government agencies via DHS over the last 24 months, there is still 

Page 9 
45 


Cybersccurity in the Healthcarc Sector: Strengthening Public-Private Partnerships 

opportunity to improve both the quality of information and speed at which it is shared. 

Cybersecurity defenders need to respond to threats in minutes, if not seconds. Waiting days 

or even weeks for information to be shared diminishes the value of the information. For 

example, if an entity discovers a sophisticated phishing email that has been able to bypass an 

organization's email filters, it is critical that information on the subject line. sender's address, 

and other data about the message be sent out to others as quickly as possible so that the other 

security teams can search for and delete these messages before their users fall victim to an 

attack. Today, members of the NH-ISAC are sharing this type of information in near realtime. We still need to increase the percentage of members willing to share but we also need 

the government to share healthcare related cyber intelligence at similar speeds. Ultimately, 

we need to automate the entire process to minimize any delays in responding to rapidly 

changing threats. 

4. Facilitate Healthcare Cybersecurity Table Top Exercises and Simulations. DHS 

conducts a nation-wide, cybcrsecurity exercise every two years. The latest exercise, Cyber 

Storm V, was conducted March 8-l 0, 2016. It was the first year in which the health care 

sector had dedicated participation in the exercise. The exercise included a number of 

healthcare specific scenarios that tested the readiness of the sector to respond to a 

cybersecurity emergency. The lessons learned were invaluable . As the SSA for the 

health care sector, 1-IHS should consider conducting smaller and more frequent exercises with 

a broader array ofhealthcare firms and include scenarios that substantially test the resilience 

of the sector. 

5. Collaborate on the Implementation of a Digital Healthcare Identity Based on Leading 

Government and Private Sector Standard That Are Mature and In Place. Passwords 

Page 10 
46 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

are still the most frequently used authentication mechanism to gain access to healthcare data 

and systems and should not be. Passwords are one of the least effective mechanisms to 

protect sensitive data and applications. Users tend to select easy to remember passwords that 

can be defeated with widely available password guessing tools. If users employ complex 

passwords, they tend to reuse these on different systems. Consequently, if one system gets 

breached the attacker can use the same password to access other systems and potentially 

escalate the breach/attack. Most security professionals recommend utilizing multi-factor 

authentication solutions to protect critical systems. This technique combines a token (e.g. 

smartcard, smartphone, or one-time password generating device) or a biometric method (e.g. 

fingerprint reader) plus a password to reduce the likelihood of a breach. The problem with 

this approach is that without standards that allow a digital identity to be reused, users will 

quickly be encumbered with a wide array of smartcards, devices, and biometric readers to 

gain access to the many systems they need. This would be costly and extremely complex to 

manage and would create significant confusion for the user. The government and industry 

The government and industry have standards and solutions today that will work for patients 

and healthcare. 

In some respects, the government and private sector are de facto administrators of a 

public-private partnership for the healthcare sector. Government agencies are responsible for 

public health, for regulation of therapies, medicines, and healthcare providers, and tor 

insurance coverage of a significant portion of the US population. The private sector provides 

the services, products, medicines and delivery system. Government agencies and larger 

healthcare firms should build out the healthcare identity ecosystem by implementing existing 

Healthcare Digital Identity standards. Such an ecosystem would not only significantly 

Page 11 
47 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

improve cybersecurity, but also streamline business processes and rationalize the current 

fragmented, redundant identity trust issue in healthcarc. Further, government agencies and 

private sector entities should facilitate the adoption of strong authentication by their small 

firm partners. 

6. Develop Ilealthcare Sector Implementation Guide to Complement the NIST 

Cybersecurity Framework (CSF). Under Executive 13636 Improving Critical 

Infrastructure Cybcrsecurity, the White House tasked N !ST to develop a cybersecurity 

t1·amcwork that "shall include a set of standards, methodologies, procedures, and processes 

that align policy, business, and technological approaches to address cyber risks." NIST 

published the first version of the Cybersecurity Framework in February 2014. The 

Framework has been quickly adopted by many industry sectors as the baseline against which 

the members measure the maturity of their cybersecurity programs. A recent study by 

HIMSSx found that 61% ofhealthcare companies have already adopted the standard to some 

degree. However, there is a growing demand within the sector for implementation guidelines 

that specify how to align with the NIST controls given the unique nature of industry. NIST 

has already developed a draft implementation guideline for the critical manufacturing 

industry. HHS should consider working with NlST and the private sector to produce a set of 

specific guidelines for the implementation of the NIST Cybersecurity Framework within 

healthcare entities. 

7. Collaborate with Global Agencies and Institutions. Although healthcare delivery and 

healthcare insurance are conducted by and large nationally based companies, 

pharmaceuticals, medical device companies, research facilities, and some public health 

entities operate at an international scale. It is critical that HHS and the private sector work 

Page 12 
48 


Cybcrsecurity in the 1-Iealthcare Sector: Strengthening Public-Private Partnerships 

together with peers in other countries to ensure the adoption of common cybersecurity 

standards and· identify ways in which threat intelligence may be shared more broadly across 

borders. 

8. Collaborate on Ways to Address the Small Business Challenge. One of the growing 

challenges we face in sharing threat intelligence throughout the sector is that smaller, less 

mature entities without cybcrsecurity teams have a significant challenge consuming the 

information that is shared among NII-ISAC members. This is particularly true for the rapid 

dissemination of indicators of compromise that are in a machine-readable format. This 

information facilitates the rapid response necessary to deal with quickly evolving threats, but 

it hinders the ability of less mature entities to consume the information. As larger 

organizations move to automated sharing and response. this is likely to increase the gap 

between them and the small entities. HHS should work with the private sector to identify 

ways in which smaller entities can stay aligned with the quickly changing methods of 

automated sharing. 

9. Recruit Departing Service Members to Help Offset the Shortage ofCybersecurity 

Personnel in the Critical Infrastructure Segments 

One of the greatest challenges we face in the healthcarc sector and many other critical 

infrastructure segments is the shortage of adequately trained personnel to address the rapidly 

changing cybersecurity threat. Some studies have indicated that there as many as 200,000 

open cybersecurity roles in the United States alone and that number is sure to rise as new 

software and devices work their way into every aspect of our livesxi. lUIS, DHS, and other 

Sector Specific Agencies should work with private industry to identify critical cybersecurity 

roles within the private sector for departing military personnel. The departing military 

Page 13 
49 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

personnel would be required to take a basic cybersecurity curriculum at Cyber Command 

before leaving active duty. In return for this valuable training, the service member would be 

required to serve an additional period of time in the National Guard or Reserves during 

which time the service member would be subject to recall in a national or state-level cyber 

emergency within any critical infrastructure segment. The private sector would assist the 

service member in the completion of any degree required for the private sector role. This 

would provide an immediate pipeline of cybersecurity talent to the private sector. It would 

also provide states and the federal government with a cadre of trained cyber professionals 

upon which they could draw. Finally, and perhaps most importantly, it would create 

opportunities for departing service members to enter a lucrative and growing field. 

I believe that if these recommendations were implemented, we would significantly improve 

the state of cybersecurity in the hcalthcare industry. We would be able to respond to emerging 

threats in a more rapid and effective manner while we made it harder for those threat actors to 

gain a foothold in any healthcare entity. More importantly, these recommendations would help 

create a greater level of trust among public and private members of the sector which would 

ensure better collaboration in a time of crisis. 

I will conclude my testimony on one final note. If we are unsuccessful in these endeavors 

and we are unable to significantly reduce the cybersecurity risk that we face, we may delay or 

even lose the opportunity to utilize promising new health information technology that has the 

potential to save and improve lives around the world. We may also hinder the ability to take cost 

out of the healthcare system through more aggressive automation. We cannot let that happen. 

Thank you again for the opportunity to present and !look forward to your questions. 

Page 14 
50 


Cybcrsccurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

; http://www .agcs.all ianz.com/insights/white-papers-and-case-stud ies/all ianz-risk -barometer2017/ 

;; https://www.dni.gov/flles/documents/SASC Unclassified 2016 ATA SFR FINAL.pdf 

Page 15 
51 


Cybersecurity in the Healthcare Sector: Strengthening Public-Private Partnerships 

,,, http:/ /www-0 I. ibm.com/common/ssi/cgi-bin/ssial ias?htm lfid=SEJ03 320 US EN 

"The reporting of material events is only required at publicly traded companies. Many, if not 

most, of the healthcare delivery entities are privately-held or operate as non-profit associations 

and this requirement would not apply. 

v https://www .aei.org/wp-content/uploads/20 14/06/-american-health-economyillustrated 145021349951.pdf 

" http://pages.stern.nyu.edu/-adamodar/Ncw Home Page/datafile/margin.html 

vii The SAFE BioPharma standard meets both the US Federal Public Key Infrastructure (PKl) 

and Federal Identity, Credential, & Access Management (FlCAM) standards. The SAFE 

BioPharma PKl Certificate Authority is cross-certified with the US Federal PKI Bridge. 

"'' http://www. verizonenterprise.corn/verizon-insights-lab/dbir/20 16/ 

" https://www .dhs.gov /sites/defau ltlfi les/pu b I ications/nipp-ssp-healthcare-publ ic-health-20 15-

508.pdf 

x The second annual HIMSS Analytics HIT Security and Risk Management Study 

xi http://peninsulapress.com/20 15/03/31/cybersecurity-jobs-growth/ 

Page 16 
52 

Mr. MURPHY. Thank you. I will now recognize myself for 5 minutes of questions. So let’s start off in identifying what this is, because this gets into a lot of weeds and pretty technical for us. 

So what is the worst-case scenario? What happens if these problems aren’t fixed? What happens in the healthcare sector with everything from medical devices to medical records to pharmaceuticals, all these things, what problems? I mean what is the problem that emerges here, Ms. Anderson? 

Ms. ANDERSON. I think one of the big problems would be if manipulation of data. So if, for example, if a threat actor went in and 

said I’m going to, if you have a hundred medical records I’m only 

going to change two or three of them and you have to figure out 

which ones were manipulated that could actually have a huge impact on patient care and safety, because if someone were a diabetic, 

for example, and that was taken from their record, or allergic to 

a particular medicine that could be, you know, very detrimental. 

Mr. MURPHY. So that would be someone who just for malicious 

intent, they just wanted to cause problems or they would want 

to—— 

Ms. ANDERSON. Maybe to—— 

Mr. MURPHY. Ransom. 

Ms. ANDERSON [continuing]. Ransomware as well, yes. So we 

have seen that as, you know, where people have held things for a 

ransom, ransomware attacks obviously, or even access to their Web 

sites or access to information. So that would be a criminal motivation as well. 

Mr. MURPHY. Mr. McNeil? 

Mr. MCNEIL. So I would build upon the information that Denise 

just stated and elaborate that, if you do manipulate some of the information, at least as it pertains to the medical devices, that could 

lead to patient safety directly with the patient’s health in terms of 

either misinformation that is used in diagnosis and treatment as 

well as the manipulation of how those devices can function. 

Mr. MURPHY. So real life-and-death harm, or certainly causing 

complications in the hospital. Expensive difficulties emerge from 

this if we don’t fix this. 

Mr. MCNEIL. Correct. 

Mr. MURPHY. Mr. Rice, do you have anything to add to that? 

Mr. RICE. Sure. The patient safety issue is top of mind, but that 

also would further break down trust and potentially the adoption 

of new medical technology which could have ramifications on 

healthcare delivery. There’s also the issue of continuity of service 

as we’ve seen with the ransomware issues that have come up in 

hospitals and not able to provide critical care. And then, finally, 

the loss of intellectual property and trade secret information, which 

could have long lasting economic impacts. 

Mr. MURPHY. Thank you. We will see if we can take care of the 

technical problems of our sound system. I apologize for that. 

So, Ms. Anderson, I understand that NH–ISAC and—it is being 

held ransom—has historically struggled to be effective and a reliable resource for the sector. So, based upon your previous experience with the financial-sector ISAC, which is often considered to be 

the gold standard among these organizations, what is necessary for 

NH–ISAC to succeed and are there any unique aspects of the 

53 

healthcare sector that are particular challenges for you and your 

organization? 

Ms. ANDERSON. Absolutely. So, you know, with health care, for 

example, the smaller—there are many, many smaller organizations 

that—you know, your small physician practices. If you go down the 

street, you’ll see a chiropractor’s practice, a dentist’s office, these 

are all very vulnerable to cyber attacks or incidents, and they are 

probably the lowest-hanging fruit and don’t have the cybersecurity 

practices in place. 

So being able to encourage those smaller practices, being able 

make them cyber savvy, being able to educate them on their staff 

and why it’s important to be aware of cybersecurity and things that 

they can do to protect themselves against it is important. With the 

Financial Services ISAC, we’re actually now with the National 

Health ISAC delivering many of the services if not more that the 

Financial Services ISAC has been able to do for their members. But 

they have been able to grow over time and they have a successful 

community of sharing and that’s something that we need to build 

within the NH–ISAC. 

Mr. MURPHY. Well, let me ask that maybe Mr. McNeil and Mr. 

Rice can weigh in this. So, when we talk about the membership involved, that information flows two ways. It flows down to the members, the doctor’s office, the medical supply companies, the hospital, 

but it also flows upwards, and does that help? Does a membership 

size affect this? 

Mr. RICE. It actually flows also a third direction, which is laterally, and that actually is the greatest volume today. So, when one 

member of the 200-plus companies that are in the ISAC today sees 

something that is hitting their network, they take the information 

and rapidly pass it to other individual companies that are members 

of the ISAC. That allows us to take that information, update our 

defenses before that same actor is able to attack us, almost like a 

neighborhood watch program. 

Mr. MURPHY. But with this, and we saw this in the financial sector, many banks were hesitant to share information laterally because it made them look more vulnerable, it affects their stock, et 

cetera, et cetera. So is this lateral sharing working out OK, Mr. 

McNeil? 

Mr. MCNEIL. I believe that the lateral sharing will continue to 

grow. I think it’s still in its infancy, to be quite honest, for our particular industry. I think that we’re putting in the appropriate 

mechanisms, one being the postmarket guidance from the medical 

device sector with the FDA, so that it affords us much more ability 

for that sharing as a part of the process of us reporting our 

vulnerabilities to the Government and to our constituents. 

Mr. MURPHY. Thank you. My time has expired. I recognize Ms. 

DeGette for 5 minutes. 

Ms. DEGETTE. I have several questions, but I want to ask something that I have been wondering about. We keep talking about 

vulnerabilities of medical devices, and I am the co-chair of the Diabetes Caucus in Congress so that kind of worries me about the insulin pumps, but there is lots of other kinds of medical devices that 

can be vulnerable too. And I know that Johnson & Johnson warned 

customers about a security bug in one of its insulin pumps last fall, 

54 

and then St. Jude dealt with some vulnerabilities in defibrillators, 

pacemakers, other medical electronics. 

I don’t know, Mr. Rice, maybe Mr. McNeil, have we actually had 

examples of these pumps being, or these various medical devices 

actually people taking them over or is it just an identification of 

a threat? Have we actually had attacks? 

Mr. MCNEIL. So I’ll speak first. 

Ms. DEGETTE. Yes. 

Mr. MCNEIL. There has not been a direct communicated reportable hack of a device. It has been in demonstration that those activities could be taking place. At this point in time we don’t—— 

Ms. DEGETTE. And is the risk of these attacks an individual or 

is it a whole class of devices? 

Mr. MCNEIL. So the actual devices and what has been communicated are individual in terms of those attacks that have been 

demonstrated. But ideally, as you can know, if you have multiple 

devices that have the same types of vulnerabilities and defects then 

potentially those same issues would take place. 

Ms. DEGETTE. That is why it is so urgent that we try to—— 

Mr. MCNEIL. Correct. 

Ms. DEGETTE. OK. Ms. Anderson, I wanted to ask you a little bit 

about the ISACs. The purpose of an ISAC is to help private-sector 

entities share cyber-related threat information with one another; is 

that right? 

Ms. ANDERSON. That’s correct. 

Ms. DEGETTE. And the private sector can get this information 

from the Federal Government, often from the Department of Homeland Security; is that right? 

Ms. ANDERSON. That’s correct. 

Ms. DEGETTE. And the Financial Service ISAC where you used 

to work it was quite successful in allowing that sector to share 

threat information involving the banking sector. 

Ms. ANDERSON. Correct. 

Ms. DEGETTE. So, turning to the healthcare sector, the risks as 

we have heard today are getting greater which includes risks on insurance companies, hospitals, medical devices, et cetera. That is 

what you are looking at right now. 

Ms. ANDERSON. Absolutely. 

Ms. DEGETTE. And so, you know, the National Health ISAC has 

not been around as long as these other ISACs like the financial 

services or energy sectors, so I guess given your expertise with financial services what more do you think needs to be done to make 

the National Health ISAC meet its full potential to serve its members effectively? 

Ms. ANDERSON. So I think that being able to make the constituents within the sector aware of the fact that the ISAC exists and 

that—— 

Ms. DEGETTE. That is usually a fundamental—— 

Ms. ANDERSON. Yes, that’s—— 

Ms. DEGETTE [continuing]. Tenet. 

Ms. ANDERSON [continuing]. Key, right. You know, and to make 

sure that they know it’s a valuable tool that they can use to help 

protect them, because, as Terry mentioned, one person’s defense is 

55 

everybody else’s offense, and that’s kind of the concept behind the 

ISACs. So that is key. 

You know, mentioning what I mentioned in my oral testimony 

and written testimony about maybe tax breaks or incentives to get 

organizations to join, or any other means by through the SSA or 

others to encourage those constituents to join the ISAC is a best 

practice. 

Ms. DEGETTE. Now HHS has provided some funding through cooperative agreements to the National Health ISAC, so it looks like 

they support the concept of importance. What else can HHS, or 

what can we do to help achieve these goals that you are talking 

about? 

Ms. ANDERSON. I think again, you know, being able to build into 

the NIST Cybersecurity Framework that one of the best practices 

would be to participate in an information-sharing organization, or 

ISAC if it’s critical infrastructure, is something that should be built 

into those standards, I believe, and then also being able to encourage those players especially at the CEO level. 

I was recently at a conference of rural hospitals and cybersecurity wasn’t even spoken about or even on the radar. So there needs 

to be a huge education made at the CEO and board level that this 

is important. 

Ms. DEGETTE. Mr. McNeil, maybe Mr. Rice and then Mr. McNeil, 

you both sit on the board. Do you have any suggestions what can 

be done? 

Mr. RICE. Definitely. I believe as Denise was saying getting 

somebody in as the sector coordinating liaison to address at the 

board level. We have 200 members, which is a pretty decent start, 

but the FS–ISAC has 6,000 members. 

Ms. DEGETTE. Wow. 

Mr. RICE. And so we need to reach out a lot more to get all of 

those entities sharing information. And even if only a small percentage are active sharers, if you’ve got a base of 6,000 that’s a lot 

more data about attacks that are occurring across the ecosystem 

than even a small percentage of 200. 

One of the other challenges is as more and more attacks take 

place and more information is shared, you need to have the mechanisms to consume the data in an automated way. Humans cannot 

process that data. Larger entities have the capital and the wherewithal to be able to put in systems and capabilities to consume and 

immediately respond. The small rural hospitals are doing it manually. And so there needs to be a way where we can put in the automated capabilities to allow this sharing to occur more effectively. 

Ms. DEGETTE. Thank you. I am out of time, so I don’t know if 

you want to let Mr. McNeil—— 

Mr. MCNEIL. The only addition would be tenfold the growth and 

the education and the communication. That’s what we really need 

to have at this point. 

Ms. DEGETTE. Thank you. 

Mr. MURPHY. Thank you. I now turn towards the vice chair of 

the committee, Mr. Griffith, for 5 minutes. 

Mr. GRIFFITH. Thank you very much, Mr. Chair, and I appreciate 

it. I have got to tell you, I really like these hearings where we are 

learning all kinds of interesting information and where we have to 

56 

figure out how do we make the system better from our positions 

in Congress. 

So, Ms. Anderson, let me ask you. In your testimony you described how the Auto ISAC was recently subpoenaed by an entity 

looking for all communications between the Auto ISAC and one of 

its members. While the subpoena was ultimately rejected, you say 

that the incident itself was troubling. 

Why was this situation problematic, and if you know can you tell 

me, because I know the judge ruled that it was just a phishing expedition, but what were they looking for? 

Ms. ANDERSON. They were looking for any communications between that member and the ISAC, which there were a lot of nuances behind it because actually the ISAC didn’t exist when the alleged incident occurred, so they were just kind of throwing spaghetti against the wall. But the concern as I mentioned is that if 

there is a trend for going after ISACs for a one-stop shop shopping 

for information that could be detrimental to information sharing. 

Mr. GRIFFITH. And I do understand that. What specific protections exist or may be necessary to limit the negative consequences 

of this type of incident or subpoena? 

Ms. ANDERSON. If there were some way that, you know, Congress 

could help protect that information that gets shared confidentially 

amongst the members, because as we were talking a little bit earlier with the lateral sharing, trust is a key factor in that. And 

that’s the beauty of the ISACs, they are trusted communities. So 

being able to protect that trust is absolutely key. 

Mr. GRIFFITH. And I tend to agree that there ought to be some 

level of protection, but then I have also heard testimony and discussions today that make me think that maybe we ought to put 

some limitation on that. So, if we have that communication limited, 

but we said if there is clear or convincing evidence that would indicate that there may have been malfeasance or intentional tortious 

action, would you agree with that? 

Let me explain that so folks—I know you all get it. But if we 

have got a fear that insulin pumps or pacemakers or something 

else may be vulnerable and researchers share that with the ISAC 

and ISAC notifies the medical device production company or the 

company that has made it and they take no action and then there 

comes harm to some individual, obviously there you have, you 

know, a knowing and understanding that they are risking people’s 

lives by not taking preventive actions. And I would want that information to be able to be shared after a judge ruled that there was 

some pretty good evidence that something like that happened. 

Would you not agree with that? 

Ms. ANDERSON. I would agree with it, definitely, to some extent. 

I think the information that gets shared within the ISAC probably 

would not even fall along those lines—— 

Mr. GRIFFITH. OK. 

Ms. ANDERSON [continuing]. Because we’re sharing malicious IP 

addresses and we’re sharing malware and we’re sharing phishing 

emails and subject lines and things like that. So I believe personally that product liability issues probably will not be a factor in 

something that would want to be collected. 

57 

Mr. GRIFFITH. I guess I was thinking in that direction because 

there was an indication that some of the information that I saw indicated that there was a device that researchers found a vulnerability and, instead of going to the company, they went to a hedge 

fund. 

Ms. ANDERSON. Yes. 

Mr. GRIFFITH. I would want them to share that through some 

mechanism with the company so the company could fix it. 

Ms. ANDERSON. Correct. 

Mr. GRIFFITH. And then I would want to protect it up to that 

point, but then if the company shows in a total disregard for safety 

chose to ignore that information then I would want that information to be available. 

Ms. ANDERSON. Yes, I would agree with you. 

Mr. GRIFFITH. OK. And if we craft something like that you would 

be all right with that, but you do think there needs to be something 

that makes it clear they can’t just go on phishing expeditions every 

day because it makes it expensive for the ISAC and makes it troublesome for the companies who are trying to share info. 

Ms. ANDERSON. Absolutely. 

Mr. GRIFFITH. All right, I appreciate that. Mr. McNeil and Mr. 

Rice, on those situations that I put forward do you all have any 

suggestions, comments, advice? 

Mr. MCNEIL. Well, I think the first one is at least with the manufacturers and the researchers with the example you gave, if we 

are following the postmarket guidance which the FDA has issued, 

it would allow us to have more of that coordinated disclosure. And 

in the event that that coordinated disclosure does not take the fruit 

that it should bear, then yes, I would be supportive of what you’ve 

stated in terms of appropriate requirements from the Government 

associated with that. 

Mr. GRIFFITH. All right. And I should note before Mr. Rice speaks 

that I believe it was your testimony that said some nice things 

about the FDA. And oftentimes we are only dealing with problems 

in this committee so it is nice to hear some good things too. 

Mr. MCNEIL. Thank you. 

Mr. GRIFFITH. Mr. Rice? 

Mr. RICE. The only other point I would add is that after the computer information sharing act of 2015 that was passed we actually 

did see an uptick because there was some rudimentary liability 

protections that were put into that act. So I do believe Congress 

has a role in helping to foster these sharing communities. 

Mr. GRIFFITH. I appreciate that very much and with that Mr. 

Chairman, I yield back. 

Mr. MURPHY. The gentleman yields back. I now recognize Ms. 

Schakowsky for 5 minutes. 

Ms. SCHAKOWSKY. Thank you, Mr. Chairman. Seems to me that 

not only are we faced with cybersecurity threats targeting hospitals, insurance companies, and providers, but also the medical devices we use. And I wanted to quote from a 2017 article in Wired 

magazine that said, quote, Johnson & Johnson warned customers 

about a security bug in one of its insulin pumps last fall, and St. 

Jude has spent months dealing with the fallout of vulnerabilities 

in some of the company’s defibrillators, pacemakers, and other 

58 

medical electronics. You would think by now medical device companies would have learned something about security reform. Experts 

warn they haven’t, unquote. 

The cybersecurity warning pertaining to defibrillators manufactured by St. Jude Medical are particularly concerning to me. Right 

before these concerns were made public, St. Jude Medical and the 

FDA issued a voluntary recall for these devices due to premature 

battery depletion. Many patients including one of my staff were required to undergo surgery to replace the defective device. 

And I can’t imagine going through that ordeal only to find out 

that the new device, the new device could be vulnerable to a cybersecurity attack. Just to say this is a young woman on my staff that 

has a congenital heart condition and it is a really big deal to have 

to go through an additional surgery, which by the way St. Jude 

won’t pay for all of it. That is another matter. 

So, Mr. McNeil, what actions are medical device manufacturers 

taking to make sure medical devices are secure from cybersecurity 

threats both before and after they reach the market? 

Mr. MCNEIL. So one of the very first areas that a medical device 

manufacturer needs to maintain and be the mantra that they think 

about is patient safety. And when you look at the development and 

the programs that we put in place, we cannot look at the lifecycle 

of the development of the solutions as we did in the past and years 

before when you did not have connected environments and you did 

not have the access that currently exists with these types of products and solutions that are in our patients and in the marketplace. 

So, first and foremost, you need to make sure that through your 

development lifecycle that you are doing the appropriate testing 

and the risk assessments aligned to that clinical environment and 

the setting that those products and the solutions would be offered. 

And you have the continuous rigor within your cybersecurity program around the monitoring and the surveillance to ensure that 

those particular products are free and as much can be of any types 

of vulnerabilities. 

Ms. SCHAKOWSKY. Well, obviously that is what they should do. 

But, you know, how do we make sure they do that? And also, Mr. 

McNeil, how do medical device manufacturers alert customers of a 

potential security risk to their medical device? What policies and 

procedures do device manufacturers have in place to ensure consumers’ notification is timely and effective? 

Mr. MCNEIL. So, again, I think, number one, you need to be able 

to do the appropriate security program and initiatives that are 

stated. Secondly, as a part of that program, communications is one 

of those utmost areas of focus, communications not only with the 

actual patients or consumers, but also through the Federal drug 

administration, with the FDA, because of their direct oversight and 

guidance over these manufacturers in terms of the development of 

their products and solutions. 

And I think that if you align within those particular frameworks, 

it affords us the ability to get that effective communication in a 

timely manner, you know, throughout the system both with the 

regulation and with directly to the consumer. 

Ms. SCHAKOWSKY. Well, I understand the U.S. Food and Drug 

Administration entered into a Memorandum of Understanding with 

59 

the National Health ISAC and Medical Device Innovation, Safety 

and Security Consortium to promote cybersecurity information 

sharing for medical devices. In December of 2016, the FDA released 

final guidance on the postmarket management of cybersecurity and 

medical devices. 

And further, a medical device-specific information sharing and 

analysis organization, the Medical Device Vulnerability Intelligence 

for Evaluation and Response, has launched a streamlining effort to 

share the information regarding cybersecurity issues. I wondered if 

anyone wanted to respond to that. Mr. McNeil? 

Mr. MCNEIL. So, as a participant, I participate directly from a 

Philips perspective. We have been directly communicating and 

working with the NH–ISAC and the MDISS as well as the collaboration with the FDA, and we also have been working with external 

researchers within our products and solutions to make sure that 

we’re communicating any identified activities from a vulnerability 

perspective through that particular initiative with NH–ISAC. 

Ms. SCHAKOWSKY. I thank you. I yield back. 

Mr. MURPHY. The gentlelady yields back. I now recognize Dr. 

Burgess for 5 minutes. 

Mr. BURGESS. Thank you, Mr. Chairman, and I thank you for 

having this hearing. This is a timely topic and one that is, I think, 

important to every member of this subcommittee. In fact, on another subcommittee in the last Congress, I was chair of the Commerce, Manufacturing, and Trade Subcommittee. We did a lot of 

work on the ransomware issue, and it is one that continues to trouble me as a physician in my former life. 

Ms. Anderson, let me just ask you, and Chairman Murphy asked 

you about the Financial Services Information Sharing and Analysis 

Center. Are there lessons from the financial side that we could incorporate into the healthcare side? And one of the things that 

strikes me as you all were talking, on the financial side, if someone 

uses my credit card I will oftentimes get a call even if I give it to 

my staff member and say, ‘‘Go get us a hundred Chick-Fil-A’s for 

lunch,’’ I will get a call that says, ‘‘Is this really a legitimate purchase?’’ 

So that is not necessarily a bad thing. They see unusual activity 

on a financial transaction online and will call it to your attention. 

Do we have anything that is analogous in the healthcare sector 

where anyone is doing any kind of looking at a predictive modeling 

way of notifying a physician or a patient that there is unusual activity regarding their healthcare transaction? 

Ms. ANDERSON. Well, certainly, there are security vendors that 

offer that service, so they’re, you know, what we call managed service providers and they’re able to monitor the network traffic that 

you know, if they are employing those services they’re monitoring 

that traffic and then alerting them on that. 

And we’re also looking at some initiatives within NH–ISAC 

where we’ll be able to handle traffic that, network traffic for various members as they participate and be able to alert them on 

things, anomalies that we may be seeing in their environment. 

Mr. BURGESS. And yet when we do hearings and we talk about 

problems in the Medicaid system and the Medicare system, the 

GAO will report back to us that these are high-risk entities that 

60 

are at high risk for inappropriate payments. We won’t call them 

fraudulent, but let’s just put it in the inappropriate payments category. And is there any way we can improve upon what the GAO 

has told us for years are high-risk activities, can we improve on 

those with copying the lessons say from the financial sector? 

Ms. ANDERSON. Oh, I would say so, yes. I mean the banks are 

able, they’ve, over time they’ve been able to develop complex algorithms where they’re able to monitor traffic and behavior, you 

know, so payment behavior and pattern behavior of purchasing. So 

they’ve absolutely been able to do that, and I think it’s applicable 

to the Medicare and Medicaid systems. 

Mr. BURGESS. Do you know why we haven’t done that yet? 

Ms. ANDERSON. I’m sorry. I do not. 

Mr. BURGESS. OK, Mr. Chairman, there is the subject of another 

hearing. Really, this is for anyone. I guess, Mr. McNeil, it was in 

your testimony where you talked about the—no, I am sorry. Mr. 

Rice, it was your testimony. Anecdotal evidence suggests there is 

a lot more cybersecurity incidents than what are currently reported. 

You know, I have a newspaper article from a few days ago back 

home in Texas, where a practice in Austin was struck with a 

ransomware attack. They looked to me like they had done the right 

things. They didn’t pay any money. They had a back-up system. 

They wiped their servers. Patient care was perhaps interrupted 

briefly, but only for a period of 24 hours and they were able to be 

back up and running pretty quickly. 

So it almost sounds like a success story, but then further in the 

article it talks about now they are on the wall of shame from the 

Office of Civil Rights in Department of Health and Human Services. And you go to the Office of Civil Rights, Department of Health 

and Human Rights and look at the wall of shame and there are indeed almost 2,000 entities, I think 1,827. 

So—and I realize this was set up by a congressional directive in 

the HITECH Act, and we told them to open this portal and it goes 

back to 2009. But is this really serving a good purpose, to be punitive to people who—again, you read the first part of the article, it 

looks like they did everything correctly? 

And I identify another practice actually in my district in Denton, 

Texas that apparently they had some computer equipment stolen 

so that theft has now placed them on the wall of shame I guess 

in perpetuity. Is that the best way we can go about handling this? 

Mr. RICE. I think we need to look at each case based on its own 

merits. In some cases, there may be incidents that were well handled as the example that you pointed out. I think the Defense Industrial Base recently has moved to mandatory disclosure, nonpublicly, where there can be incident analysis done to determine what 

the threat actors were, what actions were taken, were the actions 

appropriate, much in the manner that the NTSB today investigates 

airline and other types of traffic safety issues. 

I think that would be a way to better understand and get a better baseline of the incidents that are actually happening across the 

board. 

Mr. BURGESS. But you can say we have got a problem with people underreporting and yet we clobber them when they do report 

61 

and we put them on this list that is in perpetuity. I just think, Mr. 

Chairman, I know I am way over time, but I think probably reasonable for us to re-look. 

In fairness, I did not vote for the HITECH Act. It was part of 

the stimulus bill in 2009, so it would be easy for me to say it is 

not my problem. But it is all of our problems and I do think that 

is something that needs to be fixed. Thank you, Mr. Chairman. I 

will yield back. 

Mr. MURPHY. Indeed, yes, good point. 

Ms. Clarke, you are recognized for 5 minutes. 

Ms. CLARKE. I thank you, Mr. Chairman, and I thank our ranking member. I thank our panelists for the expert testimony here 

this morning. 

Mr. Chairman, cybersecurity incidents continue to threaten our 

critical infrastructure including the healthcare sector. A 2015 Financial Times report on health cybersecurity discussed the Anthem 

breach that resulted in over 78 million people having personal and 

medical information compromised. This was a truly troubling revelation. 

The report said, quote, ‘‘Anthem’s breach sent a wave of panic 

through the healthcare industry. It exposed clients’ most sensitive 

and valuable personal information and revealed just how unprepared the health industry was to threats from increasingly sophisticated cyber criminals and from nation-states,’’ end quote. 

It is now 2017, and I would hope that we have made strides in 

preventing this type of breach from occurring at Anthem or any 

other health-sector company. So, Mr. McNeil, what actions do private-sector companies take to prevent breaches like the one that 

impacted Anthem? 

Mr. MCNEIL. I think very often companies need to make sure 

that they’re exercising within their own environment. As Mr. Rice, 

Terry, just stated earlier in his testimony, doing tabletop exercises 

so that you are exercising the rigors of incidents and activities and 

measurements. That you also, as I would do in our organization— 

for example, we have a group of actually security we call the 

ninjas, and my team of testers actually go out and test within our 

environment. 

So, if you’re not doing and exercising internally what potentially 

could be happening to your organizations from an external perspective, it’s hard to always be able to combat that activity. 

Ms. CLARKE. So to you, Mr. McNeil, and also Mr. Rice, is there 

significant variation in the cyber capabilities of companies in the 

healthcare sector? 

Mr. MCNEIL. Yes, there definitely is a variation of capabilities. 

Because you have very small to very large organizations, and even 

within the large organizations that doesn’t mean that they have 

the most adequate and up-to-date cybersecurity hygiene and discipline, it’s identifying the fact that you need to have a governance 

program from the top of whatever size that the organization is 

down to and throughout the organization. 

Based upon that governance you put in the appropriate acumen 

around doing the testing, developing your products from a secure 

perspective, understanding how you are developing the solutions, 

and then making sure that you’re testing and monitoring the 

62 

threats within your entire environment. But yes, I would say that 

there’s work that needs to be done and attention throughout the 

ecosystem of the organizations in health care. 

Mr. RICE. I would add that one of the things that has helped tremendously in the last couple of years is the publication of the NIST 

Cybersecurity Framework. That framework identifies a layered defense concept in which first you identify what are your most critical 

assets, then you try to prevent bad things from happening. But we 

realize that even the best protected organizations may have issues. 

So then you need to detect, respond, and ultimately recover if 

something really goes bad. 

Inside of that cybersecurity framework, there are maturity levels 

that allow organizations to start to assess themselves against those 

controls, and the latest HIMSS study showed that 61 percent of 

healthcare companies were in the process of adopting the NIST 

CSF. 

One of the things that Denise mentioned that we’re doing within 

the ISAC is this capability called CyberFit and we are creating a 

benchmarking capability to allow members to rate themselves 

across the sector as well as within the subsector. So a small 

healthcare provider compared to other healthcare providers versus 

a large pharmaceutical company, they get a good benchmark as to 

where they stand. 

Ms. CLARKE. So let me ask the panel, how can the National 

Health ISAC help some smaller companies bolster their defenses? 

Ms. ANDERSON. I think, you know, being able to bring them into 

the fold and share information with them make them aware of 

even why it’s important to engage in cybersecurity practices. I was 

just talking to someone that ran a medical practice and they were 

not aware, you know, they were told repeatedly by HR do these 

things, do these things, but they didn’t understand the consequences of the fact of when they didn’t do it. And so making people aware of the impacts and potential consequences I think is very 

important especially in these smaller organizations. 

Mr. MCNEIL. I would agree. As a board member, that’s one of our 

major focus areas within NH–ISAC is looking at how we can expand the growth and the breadth of the organizations that are participating. And so we are looking at different tiers in order to make 

sure that that outreach and that awareness, you know, increases. 

And again I would say our goal is looking at that tenfold growth 

which has to happen immediately. 

Mr. RICE. Under Denise’s leadership, we have greatly expanded 

the capabilities that the ISAC brings to the table. And one of the 

most recent initiatives just started was to divide up and have each 

member of the ISAC create portions of a security incident response 

plan or a security operations plan, and then when that is done to 

donate that into the public domain or at least into the healthcare 

sector. 

So the small entities that don’t have a security officer, they can 

take that document and start to use it at least as a bare-bones capability to deal with any incidents that they face. 

Ms. CLARKE. Thank you, Mr. Chairman. I yield back. 

Mr. MURPHY. Mrs. Brooks, you are recognized for 5 minutes. 

63 

Mrs. BROOKS. Thank you, Mr. Chairman. I do applaud the work 

that the industry and Federal Government have done together to 

ensure that all potential vulnerabilities for individual medical devices and large cyber threats are addressed. 

As my friend and colleague, the ranking member, Congressman 

DeGette, mentioned earlier, I am the vice chair of the Diabetes 

Caucus, and we did write a letter to the FDA outlining several 

questions about how the agency is working with the industry to 

mitigate existing vulnerabilities and prevent emerging threats. 

However, we are still waiting on a response. We sent the FDA, in 

November, two of the questions that we posed. At this point I 

would ask unanimous consent to enter our letter into the record. 

Mr. MURPHY. Without objection, so ordered. 

[The information appears at the conclusion of the hearing.] 

Mrs. BROOKS. And with that I would like to ask your experience 

with respect specifically to the FDA, and so Mr. McNeil and Mr. 

Rice, how has the FDA specifically been working with medical device manufacturers and other stakeholders to assist them regarding potential vulnerabilities and cyber threats in both premarket 

and postmarket context? Mr. McNeil? 

Mr. MCNEIL. Yes. I would state that approximately maybe 2 

1A1⁄2 years ago the fragmented system that we currently have from 

medical device manufacturers specifically, also looking at health 

delivery organizations that consume a lot of the product as well as 

the patients, the researchers’ organizations, it was extremely fragmented. 

I think that over the past 2 1A1⁄2 years, the FDA specifically has 

conducted workshops and specific outreach in order to make sure 

that they brought the ecosystem, as we call it, of the stakeholders 

together. It was the first time that that type of activity has truly 

taken place where you had all of the participants at the same table 

and exercising around one common goal. 

I think also in addition to that the passing of both the premarket 

guidance as well as the postmarket guidance also helped accelerate 

and consolidate direction around activities that need to take place 

from a medical device manufacturer in the development of our solutions and the type of requirements that should be included in our 

submissions in our 510(k) and other documentation also was very 

helpful, as well as how to manage and communicate from a 

postmarket perspective specifically around the coordinated disclosure. 

There was only a few of us from a company perspective over 2 

years ago, Philips being one that exercised the coordinated vulnerability disclosure to work with external researchers, now it is something that we look at as a requirement due to the postmarket guidance. So those are direct examples that I would look at and have 

appreciated by working with the FDA. 

Mrs. BROOKS. And Mr. Rice, anything additional you would like 

to add or could you share with us any further explanation about 

the postmarket guidance on vulnerabilities that need to be shared 

with patients and consumers? 

Mr. RICE. Since we’re not a medical device manufacturer, it’s 

probably beyond my ability to be able to really provide any additional comment. 

64 

Mrs. BROOKS. Can you share though with respect to how the 

FDA has worked with your sector? 

Mr. RICE. Yes. And the outreach that’s been done through the 

NH–ISAC particularly, we conduct semiannual summits to attract 

members. We generally have somewhere in the neighborhood of 

400 or 500 people, cybersecurity professionals from across the industry attend. The FDA, I believe, has been at every single one of 

those presenting, updating, listening, and participating actively in 

the dialogues and discussions. 

Mrs. BROOKS. Can you both share—there seem to be multiple 

agencies within HHS and I was a bit disturbed quite frankly, Mr. 

Rice, when you mentioned a two-page strategy. Can you please expand on that? Where did that two-page plan come from, and can 

you both talk a little bit about the various agencies that you work 

with within HHS? Mr. Rice? 

Mr. RICE. Each of the 16 critical infrastructures in the United 

States are asked to develop sector-specific plans. The Sector-Specific Agencies, Government agencies, are the coordinating point for 

that. So, every couple of years, the sector will develop and update 

its plan. Currently, the sector-specific plan, which covers everything from pandemic flu to healthcare delivery and natural disasters and a wide array of other risks—it’s about a 50-page document—there are 2 pages that are devoted to cybersecurity. 

I believe that while the material that’s in there is helpful, it 

needs to be significantly expanded particularly for those small entities that don’t have large security teams or security professionals 

even in their organizations. 

Mrs. BROOKS. Thank you, my time is up. I yield back. 

Mr. MURPHY. Thanks. Now Mr. Collins, you are recognized for 5 

minutes. 

Mr. COLLINS. Thank you, Mr. Chairman. I want to thank the witnesses today. This is certainly a timely topic. It is one that we are 

going to continue to have for as long we are here. 

And so I guess the question I have as an entrepreneur myself, 

the problem with a lot of what is going on today it is in the entrepreneurial world that most new medical devices are coming, most 

changes when kind of electronic medical records, these are startup 

companies spinning off of a university, spinning off of some research institutions, one- and two-man operations. Their total focus 

is getting their product funded, getting their product to the market. 

It is not, they are in total denial of anything related to what we 

are talking about here today, data breaches, or even in the case of 

a device somebody being able to access it. 

So I guess it begs the question on how to—you know, this is a 

start, education as you said. Is there a cost to join ISAC and if so, 

is there any thought—any time an entrepreneur has cost they are 

going to look at it and they are probably going to say no versus getting in early, so just kind of curious on that. 

Ms. ANDERSON. So, with the medical device manufacturers we actually, through the FDA and the partnership with MDISS as well, 

have created MD–VIPER which is a community where we can 

share responsibly disclosure around medical device security and 

vulnerabilities, and we’ll also be providing that situation awareness 

around the various threats that are out there. That’s still in develVerDate Mar 15 2010 11:11 Jun 21, 2017 Jkt 037690 PO 00000 Frm 00068 Fmt 6633 Sfmt 6633 C:\USERS\WLAUFERT\DESKTOP\115X24SECUREHEALTHCAREPENDING WAYNE
65 

opment; we’ve just launched it this year. It will be free to people 

that sign up to participate. 

The ISAC membership is a little bit different, but we’ve gone a 

long way. As Michael mentioned earlier, we see it as our mission 

to help everyone within the sector because a rising tide floats all 

boats. And so, you know, we’ve reduced our member fees, so our 

lowest tier right now is $1,200, which is less than a cup of coffee 

a day. And—— 

Mr. COLLINS. No, it is $1,200. 

Ms. ANDERSON. Twelve hundred dollars per year. 

Mr. COLLINS. Entrepreneur, it is $1,200. 

Ms. ANDERSON. Yes. But we are also working collaboratively. We 

share with many organizations, other ISACs as well as Government organizations at what we call the TLP white and green levels, so those threats that are possible we get those out there as 

broadly as we can. 

One of the things that we did was, actually a great public-private 

partnership story, is we worked together with two other ISACs, the 

Multi-State ISAC and Financial Services ISAC as well as FBI, Secret Service, and two providers, Symantec and Palo Alto, and we 

did a series of ransomware road shows across the country in 14 different cities, free to anybody that showed up, where they could 

learn about ransomware, why it was important to protect against 

it, and how they could do that. 

Mr. COLLINS. Well, again what I would say is the earlier you get 

someone in the better. If it costs anything, that is going to be a 

problem especially for these entrepreneurial companies. And clearly, some of the bigger corporations understand it and at some point 

you just do your civic duty and bring those folks alone. 

When I was the subcommittee chair on Technology on small business, we had a hearing, and part of the hearing came out if a small 

company has a significant data breach, 67 percent of the companies 

are bankrupt within 12 months. That piece of data alone was eyeopening enough to a lot of small businesses because we pushed it 

out, it is like, you know, that is an oh-my-God moment. 

And I just acknowledge that a lot of the products being developed, a lot of the software being developed, the developers would 

acknowledge that cybersecurity is an issue and then they are doing 

absolutely nothing about it. That is the reality. Wouldn’t you agree, 

Mr. Rice? 

Mr. RICE. Absolutely, and I think education is definitely one of 

the areas that needs work. It was just a couple of years ago that 

there was only one academic institution in the United States that 

required people graduating with a bachelor of science in computer 

science to take a course, a single course on cybersecurity. And 

those stats have improved significantly in the last couple years, but 

you have lots of individuals that learn how to program and want 

to go off and join a startup company and have not had any experience or exposure to security education. And that’s an area where 

there’s plenty of opportunity for improvements. 

Mr. MCNEIL. Again, the education piece is definitely critical, and 

as you just stated the earlier in the process that we can bring them 

to the table obviously the better for all of us. 

66 

Mr. COLLINS. Well, it is going to be a continued issue that we all 

face and it would be naive to think we can put an end to it. And 

I certainly agree with Representative Griffith that you can’t. If you 

continue just to punish people on a wall of shame there ought to 

be some due process to get them off because the next person might 

not disclose; they might look at that as the death of their company. 

I wasn’t even aware of that. That is thinking in the past. That is 

not forward-thinking, so maybe that is something Congress could 

work on. 

Thank you, Mr. Chairman. I yield back. 

Mr. MURPHY. The gentleman yields back. I now recognize Dr. 

Ruiz for 5 minutes. 

Mr. RUIZ. Thank you very much, Mr. Chairman. Our Nation’s 

healthcare system has been classified as a critical industry for almost 20 years, but still today we see cybersecurity breaches that 

expose millions of patient medical records to the highest bidder. 

The fact is our healthcare system is only just entering the digital 

age, but we must be able to learn from cyber attacks on other industries and implement the best practices developed to respond to 

them. 

It is critical that the healthcare sector take advantage of the expertise developed in these other sectors to safeguard patient data 

and the integrity of a hospital system. Imagine if there was a cyber 

attack during a terrorist attack that took down the 911 system. 

Imagine during that time they also took down our system to communicate in a wireless form with other members. 

Imagine if they go into a large hospital network and change the 

drug allergy information, which leaves doctors blind and nurses 

blind to administer certain medications that may actually hurt and 

kill the patient. Imagine if they change the dosages of medications 

that patients say that they need for the illness that is under their 

medical record. Imagine if they made little tweaks here and there 

which can actually cause harm and kill patients. 

So my first question is for Denise. What metric are you using to 

define success for the National Health ISAC, Ms. Anderson? 

Ms. ANDERSON. So I think one of the key metrics is the membership renewals, so people join the ISAC because they find value in 

it and so that our renewal level is a hundred percent. We’ve not 

had anybody drop in the last year since I’ve come on board, and 

we’re growing. So, you know, the fact that people are finding value 

in what we’re doing is important. 

Also, we see it in the comments. We just had some threads 

shared yesterday, actually, where members were saying, ‘‘This 

ISAC is great, I’m seeing this as an extended arm to my threat intelligence team.’’ You know, so it’s like they’re almost seeing it as 

part of their organization in helping them do what they do. 

Mr. RUIZ. How about in terms of its effectiveness, and have there 

been any data that you are measuring in terms of attempts to 

enter the system and a decrease more that you have identified and 

those that you have prevented? 

Ms. ANDERSON. Not at this point in time because a lot of that 

comes from the members themselves. But we are doing some initiatives where we’re looking at deploying sensors onto member netVerDate Mar 15 2010 11:11 Jun 21, 2017 Jkt 037690 PO 00000 Frm 00070 Fmt 6633 Sfmt 6633 C:\USERS\WLAUFERT\DESKTOP\115X24SECUREHEALTHCAREPENDING WAYNE
67 

works where that network flow will come into the ISAC and we’ll 

be able to do some analysis on it. 

Mr. RUIZ. OK. 

Ms. ANDERSON. But we do have case studies where we’re seeing 

information sharing where there have been successes, one recently 

where we shared with the Multi-State ISAC some stuff that we 

were seeing in National Health. It was an email that was compromised, an account in a utility in actually California and we were 

able to stop that attack because of what was shared in the National 

Health ISAC and then working with our partner in the Multi-State 

ISAC. 

Mr. RUIZ. Thank you. Mr. McNeil, I have heard that there is a 

healthcare cybersecurity task force and that you are participating 

in it. Can you explain what it is, how it came to be, and what the 

task force is working on? 

Mr. MCNEIL. Yes. The task force started approximately 1 year 

ago with the auspice of an executive order, and based upon that executive order to be able to make recommendations around some of 

the critical areas within the healthcare industry. One of the communications was for us to take a look at other industries and understand the roads that they have traveled and to be able to leverage that activity in regards to the healthcare industry. 

We are right now in the process of finalizing that particular recommendation and it will be submitted. Our anticipated time frame 

here is the end of April, beginning of May, to the Government. 

Mr. RUIZ. That is great. So what is your utopian collaborative 

model between industry, private, public, and just getting everybody 

together to work on this? What does that vision look like? 

Mr. MCNEIL. I think that particular vision is for us to make sure 

that there’s the collaboration across the different agencies. I think 

we made the comment that I am governed as a medical device 

manufacturer by the FDA, which is a part of HHS. We have the 

OCR which also has privacy and other implications. The hospital 

organizations are also a, you know, participating stakeholder. 

Mr. RUIZ. So basically bringing everybody together. 

Mr. MCNEIL. Right. 

Mr. RUIZ. This last question is for you, Ms. Anderson. We have 

a severe cybersecurity expert shortage in this country. It is absolutely horrendous the need versus the supply that we have. There 

is a program at Cal State University San Bernardino that is training in cybersecurity. What educational pipelines do we need to 

meet the high demand in our Nation for cybersecurity? 

Ms. ANDERSON. Absolutely I think that education system is key 

to developing staff within the cyber skills area. As Mr. Rice mentioned, you know, being able to build cybersecurity into actual computer science programs is key. I know there’s a number of universities and educational institutions that are starting to work on that 

and certainly we have ISACs that—we have a REN–ISAC which is 

the Research and Education Network devoted to universities, and 

they also are working with it across the college and university 

level. 

Mr. RUIZ. Thank you very much. 

Mr. MURPHY. The gentleman’s time has expired. Now Mrs. Walters, you are recognized for 5 minutes. 

68 

Mrs. WALTERS. I would like to thank Chairman Murphy for holding this hearing, and the witnesses for their testimony. 

We are well aware of the growing cyber threats this Nation is 

facing. No industry is immune to the threat of a cyber attack which 

is why it is important we examine the ways that public and private 

sectors can work together to maximize our efforts to combat these 

attacks. There is no question health records contain an individual’s 

most personal and sensitive information. We can all agree that 

safeguarding confidential health records is critical. 

I would like to get some thoughts on how these efforts might be 

improved. The first question I have is for the entire panel. HHS is 

obviously a big organization with a diverse set of responsibilities 

and cybersecurity is just one of them. That said, I think we can all 

agree that cybersecurity in health care is immensely important and 

should be a priority for all stakeholders. 

Are there additional actions or initiatives regarding cybersecurity 

that HHS could take that you think would benefit the sector? And 

we will start with you, Ms. Anderson. 

Ms. ANDERSON. In my testimony, one of the things I pointed to 

was having the SSA recognize the ISAC as a best practice for organizations to join and to share information with each other around 

the incidents and vulnerabilities and mitigation strategies that 

they have in their environments, so I think that’s definitely one 

way. Another way is to have a clear go-to person who is a cybersecurity professional with experience in cybersecurity and understands the unique nuances of health care and cyber and the blended threats between physical and cyber. 

Mrs. WALTERS. OK. Mr. McNeil? 

Mr. MCNEIL. It think also in addition there’s an opportunity to 

improve transparency from medical device manufacturer and some 

of the processes that are used for the development of our solutions. 

One would be an example of a software bill of materials, which allows the manufacturers to describe what the components are, 

whether or not that’s open source code or material. But if we can 

increase that transparency that would also force us to have a greater visibility around what might be potential vulnerabilities in our 

solutions. 

Mrs. WALTERS. OK, thank you. Mr. Rice? 

Mr. RICE. I would argue that the NIST CIF which is the cybersecurity framework that NIST published and has been adopted by 61 

percent of the healthcare industry, if we could actually develop implementation guidelines, the NIST cybersecurity framework tells 

you what you should do. If we could develop guidelines particularly 

for those smaller entities that are tailored to the healthcare specific 

area, I think, would go a long way. 

And I’d also like to highlight what Mr. McNeil said with the software bill of materials. My daughter has celiac disease. When I go 

shopping for foods I look at the nutrition label on the package to 

see if it contains wheat or any type of gluten and obviously avoid 

that. Today when I’m purchasing software I don’t know what is inside that software. I don’t know what the components are and I 

don’t have the ability to select or deselect software based on its ingredients. 

69 

Mrs. WALTERS. OK, thank you. Now that I have asked you what 

HHS should be doing I am going to ask the opposite and this is 

another question for the entire panel. Are there issues related to 

cybersecurity that you believe are better left to industry to address 

and if yes, what are they and why are they better left to industry 

and if not, why not? 

And let’s start with Mr. Rice. 

Mr. RICE. I think that the understanding of the risks within the 

sector requires industry knowledge. We are a very diverse sector. 

So, if you look at the payer community, they’re worried about financial criminals. If you look at the pharmaceuticals, they’re worried about patient safety and the integrity of information and trade 

secret data. If you look at the hospitals, they’re worried about continuity of service and the protection of electronic health records. 

So industry is probably best at making those risk decisions as to 

what is the most effective way to address in each area, but it has 

to be done in collaboration with the Government. Thank you. 

Mrs. WALTERS. OK, thank you. 

Mr. MCNEIL. Again I would just build upon what Terry just stated in terms of that collaboration. Because of the diverse and the 

uniqueness of the healthcare industry, we definitely would like to 

see something aligned from a med-cert perspective. Right now we 

have a computer, you know, emerging response plan and a cert 

where we identify based upon the severities of the vulnerabilities, 

but it is not developed specifically to the healthcare industry based 

upon how those devices, products, or solutions are deployed in a 

clinical setting. 

So, through that collaboration, which has to be both public and 

private, I would want to see a reinforcement of that particular area 

of focus. 

Mrs. WALTERS. Ms. Anderson, do you have anything to add? 

Ms. ANDERSON. Very quickly, I think that information sharing 

should be encouraged but not mandated, and I think it should come 

from industry because when you share because you want to share 

it’s different from sharing because you have to share. 

Mrs. WALTERS. OK. All right, thank you. I am out of time. Thank 

you. 

Mr. MURPHY. I now recognize Mr. Costello for 5 minutes. 

Mr. COSTELLO. Thank you, Mr. Chairman, for holding this important hearing and thank you to our witnesses today for your insight. 

My home State of Pennsylvania is indeed a hub for life sciences 

and medical device manufacturing. AdvaMed companies alone employ over 22,000 Pennsylvanians with nine member companies located in my congressional district. These companies are as diverse 

as the patients they serve. Zimmer in Exton which specializes in 

joint replacements employs approximately 14 individuals, while 

Teleflex headquartered in nearby Wayne focuses on vascular solutions and has a team nearly 12,000 strong. 

The fact remains that, despite differences in size, specialty, and 

scope, these companies and all the others in between are prime targets for bad actors seeking to cause harm. We all agree that we 

must take every reasonable action to ensure these companies that 

specialize in the safeguarding of life have the resources they need 

70 

to defend themselves and the patient end users they serve against 

all kinds of cybersecurity threats. 

Ms. Anderson, I would like to ask you, regarding NH–ISAC could 

you describe some of the barriers to entry that do keep small to 

midsize companies from becoming members and, additionally, upon 

identifying those barriers to entry what can we do to mitigate 

them? 

Ms. ANDERSON. So I think first and foremost is the fact that they 

don’t even know that we exist. 

Mr. COSTELLO. Right. 

Ms. ANDERSON. And that we can be a valuable tool, so that’s 

huge. You know, when we are able to reach out to healthcare organizations and they see what we offer, we also are offering now a 

free trial program where they can be participants within the ISAC 

and get access to everything that’s done over a 6-month period. You 

know, the renewal rate is very high at that point. We saw that 

with FS–ISAC when they did that they had a 90 percent success 

rate in that. 

So people need to find, be even aware that it exists, then they 

need to see the value so they can join. I think money, you know, 

obviously money is always a factor, but the fact that we’ve been 

able to bring it down to less than a cup of coffee a day and we’re 

also exploring things such as scholarship programs and those type 

of things, bringing people to our conferences, doing free workshops 

which we do do, as well as, you know, maybe supplementing membership costs, are something that I think are very key. 

Mr. COSTELLO. Thank you. For Mr. McNeil and Mr. Rice I am 

going to run off a string of questions and take them as you find 

appropriate. In general, what does your interaction with NH–ISAC 

look like on a daily basis? Two, could you please describe further 

how NH–ISAC is structured in such a way as to facilitate information sharing even among industry competitors who may be otherwise disinclined to share sensitive information regarding their organization? Three, what more can be done to help organizations 

feel confident using NH–ISAC to its full potential? And the catchall, any additional comments you would like to offer? 

Mr. MCNEIL. So, from a daily basis in terms of the interaction 

that we have within NH–ISAC, we have, as Denise stated, there 

are alerts, so there’s direct emails that we receive on a daily basis. 

We also have the ability to participate in different committees and 

in different activities that the NH–ISAC provides so that also allows us to have a direct access. 

We have the biannual summits that is stated, so that is another 

form of participation. They also have workshops that they conduct 

and that they’ve rotated. Specifically in my arena, we’ve had these 

medical device workshops where myself and other members have 

been able to participate. Structurally, the NH–ISAC allows us to 

have a constituency of board members and your board member opportunities go from anywhere from 1-, 2- or 3-year slots that we 

have in place and as well as just our overall membership. 

From a competitive perspective in terms of my discussions there, 

I think the fact that we become, that the word when we said earlier from a trust perspective when you’re able to gain the trust 

among the members of the NH–ISAC and the trust is there, Terry 

71 

and I will share information just as much as I will share information with J&J, St. Jude, Medtronic, et cetera that you’d name it. 

But in order for us to get to that point we had to be able to participate in the initiatives that I’ve just described in order to help 

build that trust among our peer group as an example. 

Mr. RICE. As far as the NH–ISAC daily interaction, for me it’s 

the dozens, sometimes much more than that of emails that come 

in about member companies that are seeing a phishing attack, seeing a denial of service attack, taking that information and then updating our own defenses. 

We also see questions that come in through our list server that 

can be open-ended, like what are you doing about ransomware? 

And then member companies will respond back to how they’re 

working and operating, and the NH–ISAC staff will collate all that 

information and publish it into a document that’s easily 

consumable by the members. And as Mr. McNeil indicated, it’s also 

picking up the phone and knowing that somebody on the other side 

is dealing with the same issues as you and you can provide advice 

back and forth on how to handle a situation. 

As far as what more needs to be done, I stressed in my testimony 

the need for global engagement. The FS–ISAC is operating in 38 

countries today. Cybersecurity is an international problem, it 

doesn’t know boundaries. And so we should be actively addressing 

and trying to bring in multinational companies and other entities 

like Interpol and the European enforcement organizations to also 

share intelligence information about attacks. 

Mr. COSTELLO. Thank you. 

Mr. MURPHY. Thank you. I now recognize Mr. Carter for 5 minutes. 

Mr. CARTER. Thank you, Mr. Chairman, and thank all of you for 

being here today. Gentlemen, in the State of Georgia, where I am 

from, earlier this year Governor Nathan Deal, who is a former 

member of this committee, as a matter of fact, he announced $50 

million in funding for a Georgia Cyber Innovation and Training 

Center at Augusta University in Augusta; very excited about that. 

This is something that we see as being very progressive and very 

forward-looking and something that I hope that we are going to be 

able to bring in private industry and bring in, you know, Government to work together on these type of issues. 

Do you see this as being the trend to have academia involved like 

this? 

Mr. MCNEIL. Yes, I definitely believe this is the trend and the 

participation. Number one, I will be at Augusta University—— 

Mr. CARTER. Yes. 

Mr. MCNEIL [continuing]. To help in the next couple of weeks 

meeting with the team and going over strategically some of the key 

initiatives. Philips is in a long-term partner and relationship in 

order to build that out. We also have worked very closely with 

other academia and institutions in regards to this space, so I believe that it definitely starts there and you’ll see that as much 

more of a flourishing opportunity. 

Mr. CARTER. Great, great. 

Mr. RICE. I second the comments. We’ve sponsored an exercise at 

NC State recently which brought in universities from around the 

72 

Southeast to participate in a series of exercises that my staff and 

other cybersecurity professionals then graded so people would get 

practical experience in addition to the academic experience. I definitely think that this is one of the many opportunities we have to 

help address the shortfall in the cybersecurity work force. 

Mr. CARTER. Great. Mr. McNeil, I want to go back to you. Philips 

is obviously a key player in this area and in many different industries. But can you share with us just some public/private-sector collaboration that has been most successful with your company and 

with some of the private industry? 

Mr. MCNEIL. I think some of the most successful activities has 

been, one, working with the NH–ISAC, also working with the 

MDISS organization again getting the word and the education out 

there. I think that when you talk about for example NH–ISAC, it 

traditionally had a strong influx from the pharmaceutical and the 

insurance industries. And due to a number of the cybersecurity activities that the medical device manufacturers are seeing, it now 

provides us with that type of public-private community in terms of 

participation. 

I think also when I look at the activities specifically that we’re 

doing, it has afforded us that ability to increase our ability to grow 

from an information sharing as well as to coordinated disclosures 

around the researchers. I think also the partnership and the participation with the MDISS organization has reached out directly 

with the manufacturers and the researcher community. So there 

were researchers that had not originally been addressed or brought 

to the table that now are there. 

And then, finally, the work with the FDA. From the FDA’s perspective and their outreach with their post and premarket guidance 

as well as a number of the workshops that they’ve hosted, they 

have been the catalyst to truly bring the entire ecosystem together 

and work on issues. 

Mr. CARTER. Great. Mr. Rice, I want to ask you and I would be 

remiss if I didn’t point out my professional career I have been a 

pharmacist so I am particularly interested in the pharmaceutical 

industry and how cybersecurity really impacts you. And I would 

suspect, you know, in the practice of pharmacy we have HIPAA 

regulations so we pay particular attention to cybersecurity. That is 

very important to us. 

What about in the pharmaceutical industry? I suspect that with 

research and development this is critical for your industry. 

Mr. RICE. Yes. That is one area of concern within the pharmaceutical industry, and as you’re probably aware the healthcare sector outside of DoD is one of the largest, if not the largest, investor 

in research and development, and that includes both the Government as well as the private sector. 

So research and development is one aspect. Information about 

mergers and acquisitions prior to public disclosure, we saw in the 

FIN4 report from FireEye, a security research company, that there 

had actually been attacks. Not against the large companies but the 

smaller companies that were likely to be acquired, these actors 

would get in and they would be able to get information about which 

they could potentially trade on. 

73 

The second area would be around manufacturing. We run industrial control systems, SCADA systems that automate the manufacturing line, so potential disruptions of that equipment would also 

cause significant harm. And then finally, being able to disclose financial statements, the integrity of information, the integrity of information in the clinical trial processes that we have, all of those 

are areas of concern. So it’s across almost every aspect of the industry that we see challenges. 

Mr. CARTER. Great, thank you. And thank you all again for being 

here, and I yield back, Mr. Chairman. 

Mr. MURPHY. Thank you. Thank you. So, in conclusion, I want 

to thank all the witnesses and Members that participated in today’s hearing. This is a pretty difficult subject but something that 

we have to continue to pursue, as we heard the complex testimony. 

And I am learning quite a bit myself especially about these acronyms which are your daily breakfast, but as we go through this 

certainly what we have to pursue is ways of simplifying and making sure that all these different departments work together, especially given what you opened up with what the threats that are out 

there for life and functions within the hospital and healthcare system. 

So, again, I thank all the witnesses for participating today. I will 

remind all Members they have 10 business days to submit questions for the record. I ask all witnesses to agree to respond promptly to the questions. With that, this hearing is adjourned. 

[Whereupon, at 11:57 a.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

74 


U.S. HOUSE OF REPRESENTATIVES 

COMMITTEE ON ENERGY AND COMMERCE 

TO: Members, Subcommittee on Oversight and Investigations 

FROM: Committee Majority Staff 

I. INTRODUCTION 

Aprill, 2017 

On Tuesday, April4, 2017, at 10:15 a.m. in 2322 Rayburn House Office Building, the 

Subcommittee on Oversight and Investigations will hold a hearing entitled "Cybersecurity in the 

Heath Care Sector: Strengthening Public-Private Partnerships." This hearing will examine the 

current state of public-private partnerships for cybersecurity in health care, one of 16 critical 

infrastructure sectors. Health care has long struggled to coalesce around the institutions and 

infrastructure necessary to improve the security posture of the industry due to several complex 

factors. This hearing presents an opportunity to explore the challenges in health care 

cybersecurity and to identify opportunities to improve leadership and engagement across the 

sector. 

II. WITNESSES 

• Denise Anderson, President, National Health Information Sharing and Analysis 

Center; 

Michael McNeil, Glohal Product Security & Services Officer, Royal Philips; and, 

Terry Rice, Vice President, IT Risk Management & Chief Information Security 

Officer, Merck & Co., Inc. 

III. BACKGROUND 

A. Cybersecurity and tbe Public-Private Partnership Model 

Cybersecurity is a broad, dynamic, and rapidly evolving challenge for modern society. As 

we become more dependent on the Internet and information technologies, cyber threats will 

continue to proliferate at an exponential rate and the consequences of incidents will become 

increasingly profound. The evolution of cyber-physical systems such as cars, medical devices, 

the electric grid, and other connected consumer products not only increase the attack surface, but 

also escalate the threat from loss of information to potential physical harm. 

Given the scope and scale of society's dependence on connected technologies and the 

attendant cyber threat, cybersecurity is not something that can be "solved." As the threats 

proliferate and consequences become more severe, however, it is paramount that the nation 
75 


strengthen its approach to cybersecurity. The challenge lies in the fact that there is no single 

solution to better cybersecurity; it depends on multiple improvements, new approaches, and fresh 

thinking, as well as a commitment to strengthening existing institutions. A key factor is the 

coordination and engagement between government and private sector partners. After all, while it 

is the public sector's responsibility to protect critical infrastructure for the safety and security of 

society, 85% of that infrastructure is owned and operated by the private sector. 1 Thus, the 

relationships between the public and private sectors depend on a combination of trust, leadership, 

and commitment from both sides. 

To facilitate this relationship, the United States relies on a public-private partnership 

model that has evolved over the last two decades.' In this model, the private sector is split into 16 

critical infrastructure sectors, each of which in turn relies on four organizations either identified 

or created within the model; a Sector Specific Agency (SSA), a Government Coordinating 

Council (GCC), a Sector Coordinating Council (SCC), and an Information Sharing and Analysis 

Center (!SAC). Each of these organizations plays a unique and complimentary role in helping to 

shape and guide cybersecurity efforts throughout the sector. 

• Sector Specific Agencies (SSAs): For each sector, SSAs are tasked with 

representing and advocating for their sector's unique equities, providing support and 

guidance to their industry stakeholders, and implementing government-wide 

cybersecurity initiatives and strategies? 

• Government Coordinating Councils (GCCs): Led by a sector's SSA, GCCs bring 

together government stakeholders from federal, state, local, territorial, and tribal 

agencies to help coordinate and deconflict government efforts. 

• Sector Coordinating Councils (SCCs): Comprised of industry stakeholders from 

across the sector, SCCs are tasked with representing industry equities and needs, 

guiding and coordinating efforts among industry to address issues, and working with 

their designated SSA and GCC to help implement initiatives and mandates. 

• Information Sharing and Analysis Centers (ISACs): !SACs are meant to improve 

the cybersecurity of industries through the establishment of organizations whose 

primary purpose is to collect, analyze, and disseminate cybersecurity threat 

information. This information may then be shared between stakeholders. 

B. The Current Landscape of the Public-Private Partnership Model 

Every sector has unique characteristics and challenges that influence the success of the 

public-private partnership model. While the motivations for and paths to success differ across 

1 Critical Infrastructure and Key Resources, OFFICE OF THE DIRECTOR OF Ni\TIO~AL INTELLIGENCE, PA!ti'NER 

E!'JGA<~EMENT, hll.ps://www.ise gov/mission-partners/critical~infrastructure-and-key-resources. 

2 Over the course of the last two decades, the executive branch has issued a series of documents that either 

established or refined this model, including: Homeland Security Presidential Directive (HSD-7), Presidential Policy 

Directive 21 (PPD-21), and PPD-41. These in turn led to the design and implementation of the National 

Infrastructure Protection Plan (NIPP) and the National Cyber Incident Response Plan (NCJRP). 

3 !d. 
76 


sectors, those that are regarded as the most effective share similar traits. Specifically, they have 

robust engagement with their SSA and widespread buy-in from private industry across the sector. 

For example, in recent years the energy sector improved engagement and performance of its 

public-private institutions, including the E-ISAC, due to broad senior executive level 

representation on the SCC4 This has improved engagement across the sector and facilitated more 

effective collaboration with government partners at their SSA, the Department of Energy. s The 

Financial Services sector has experienced similar successes with the Financial Services-I SAC 

(FS-ISAC) and Financial Services-SCC (FSSCC) by fostering a strong relationship with its SSA, 

the Department of the Treasury, and by ensuring that industry engages regularly and effectively 

with both the FS-ISAC and FSSCC. 6 

By creating institutions where both public and private stakeholders actively coordinate 

efforts-as well as share information, incidents, and feedback-cybersecurity challenges that 

arise within the sector may he quickly addressed in a collaborative fashion. This helps reduce 

misunderstandings between the public and private sectors when cybersecurity incidents occur, 

facilitates the timely sharing of important information between stakeholders, and ensures that 

both public and private sector equities are considered. Critical infrastructure sectors like financial 

services, which includes small community-oriented credit unions all the way up to large multinational enterprises like Chase Bank, and health care, which includes rural hospitals, physician 

offices, and large insurance companies, are incredibly diverse. Further, for both sectors, their 

SSA is also their industry regulator. In comparison to a more homogenous sector like energy, this 

creates additional challenges for these sectors when leveraging the public-private partnership 

model. However, these examples are instructive of the benefits that result from strong leadership 

and prioritization of cybersecurity across a sector. 

C. Health Care Cybersecurity and the Public-Private Partnership Model 

The health care sector has been considered critical infrastructure for nearly twenty years, 

and has been successful in leveraging public-private partnerships in areas like physical security 

and disaster preparedness. 7 It has struggled to fully establish and leverage these institutions and 

partnerships with regards to cybersecurity, however. This is partially attributable to the fact that 

cybersecurity is a relatively new challenge for much of the health sector. In recent years, as the 

sector has become more digitized and therefore increasingly vulnerable to cybersecurity threats, 

the need for strong cybersecurity has become apparent. Large-scale malware infections, data 

breaches, and publicly-revealed vulnerabilities in medical devices are more frequent, adding 

4 Written Testimony, Scott Aaronson, Exec. Dir., Security and Business Continuity, Edison Electric Institute, before 

the House Comm. on Energy and Commerce, S.Comm on Energy (February 1, 2017), at 7. 

5 I d. 

6 Written Testimony, Gregory T. Garcia, Advisor, Financial Services Information Sharing and Analysis Center, 

before the House Comm. on Financial Services, S.Comm on Financial Institutions and Consumer Credit (March 5, 

2014). at 3. 

7 Healthcare and Public Health Sector-Specific Plan (May 2016), available at 

https:i/www.phe gov!Preparednesslplannin~/cip/Documents/2016-hph-ssp pdf. 
77 


scrutiny and pressure to improve cybersecurity. 8

•

9 This will only increase as technology continues 

to transform the sector. 

While much of the sector now recognizes its vulnerability to this threat, efforts to 

increase cybersecurity are sporadic, overly narrow, or become conflated with issues such as 

privacy or compliance, reducing their effectiveness. 10 This has several causes, including the fact 

that different parts of the health care sector are regulated by different agencies within the 

Department of Health and Human Services (HHS), existing regulation and legislation around 

medical privacy and cybersecurity such as the Health Information Portability and Accountability 

Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act 

(HJTECH), and the variety of actors within the sector, to include healthcare delivery 

organizations, insurance companies, and patients themselves. 11 

The diversity and complexity of the industry has affected the ability of 

cybersecurifocused public-private partnerships to take root. Organizations like the National 

Health Information Sharing and Analysis Center (NH-ISAC) and Health Care and Public Health 

Sector Coordinating Council (HPH-SCC) have strived to improve their cybersecurity capabilities 

in an effort to become as effective as their counterparts in other sectors. The NH-ISAC has 

existed since 2010, for example, but has apparently been forced to reconstitute to improve 

performance. While meaningful progress has recently been made, partially because of the 

appointment of an ISAC veteran as president, work remains to equip the !SAC with the 

organizational, fiscal, and technical capabilities it needs. 12 Similar works remains with the HPHSCC. Finally, the distributed nature of cybersecurity regulatory and oversight responsibilities at 

HHS-the SSA for health care--has contributed to a lack of coordinated, comprehensive 

leadership, which in turn has had ripple effects across the sector as stakeholders struggle to 

understand their roles and responsibilities. 

i. A Successful "Case Study": The Medical Device Industry 

While the broader health care sector has struggled to fully establish and leverage the 

public-private partnership model, the medical device industry has achieved success in its recent 

efforts to replicate the model within its subsector. The industry's regulator, the Food and Drug 

Administration (FDA), has essentially taken on the role of a medical device subsector "SSA" and 

has taken a forward-leaning, collaborative approach to medical device cybersecurity. FDA 

engages in regular discussions with its stakeholders, solicits and incorporates feedback into its 

processes and guidance, and maintains a visible, active presence with regards to cybersecurity 

8 Marla Durben Hirsch, Cybersecurity: What 2016 taught the healthcare industry, FIERCEHEALTHCARE, Dec. 19, 

2016, http://www. fiercehealthcare com/it/feature-cybersecurity-what-20 16-teachj ng-industry. 

9 Neil Verse!, 'Cybersecurity has become a full-time job' in heallhcare, MEDCTTvNr.ws, Nov. 28, 2016, 

http:L/medt:ilYJli:w~comDlQ l.f:i/1.1/;;y.llers~.curi.\Y:lul!::!im.e:lgll:_heal UlCi!ITL. 10 See supra note 8, 9. 

l1 Id. 

12 Marianne Kolbasuk MeGee, HHS to Fund a Cyber Threat Information Sharing Leader, R\NKINFOSECURITY, 

Aug. l, 2016, http://www.bankinfosecurity.com/hhs-to-fund-cyber-threat-information-sharing-Jeader-a-9300. 
78 


issues and incidents. u.r• Industry stakeholders, in addition to their robust engagement with FDA, 

regularly communicate at the senior executive level in ways very similar to an SCC. Finally, the 

industry has recently constituted an Information Sharing and Analysis Organization (!SAO), 

functionally like an ISAC, that focuses on medical device cybersecurity threats." 

In replicating the public-private partnership model within the subsector, the medical 

device industry has been able to quickly increase the cybersecurity posture of the subsector as a 

whole.'" While much work remains to be in done, by embracing this model, the industry and 

FDA have created a strong foundation on which to continue to improve the subsector's 

cybersecurity. The recent progress within the medical device sector may provide instructive 

lessons for the broader health care sector as it looks to strengthen engagement in public-private 

partnerships. 

This hearing will explore ways to strengthen the NH-ISAC and HPH-SCC, to include 

steps that the public and private sectors may take to better support and leverage these 

organizations. In addition, this hearing will examine HilS's role as the SSA and whether there 

are additional actions that the agency may take to contribute to improved cybersecurity across 

the health care sector. 

IV. ISSUES 

Are there additional ways that HHS can be a more effective SSA for the health care 

sector? 

How can the NH-ISAC be strengthened and better supported? 

• How can the HPH-SCC better represent and respond to the needs of industry? 

• Are there "lessons learned" that the health care sector may adapt from the medical 

device subsector or energy and financial services sectors? 

V. STAFF CONTACTS 

Please contact Jessica Wilkerson or John Ohly of the Committee staff at (202) 225-2927 

with any questions. 

13 Suzanne B. Schwartz, M.D., M.B.A., Managing Medical Device Cybersecurity in the Postrnarket: At the 

Crossroads ofCyber-safetyandAdvancing Technology, FDA VorcE, Dec. 27,2016, 

https://blogs.fda.gov/fdavoice/index php/2016112/managing-medical-device-cybersecurity-in-the-postmarket-at-thecrossroads-of-cyber-silfety-and-advancing-technology/. 

14 Christian Dame[[ et al., State of Healrhcare Cyber Security, BSIDESLV 2016, Aug. 2, 2016, 

https:/lwww,youtube.com/watcbov~!jHSUKWRtlo&app-desktop. 

15 Christina Hwang, FDA's MD-VIPER to help device stakeholders with cvh>ersecuritv 

HE,\JT!IC\1\EBUSINESS Dc\ILY NEWS, Feb. 2, 2017, !1!!!~0ill'Et{,QQl!Jl!:Mi2!ll'!lf''l:{';/_>lQ!s£;,~QZ. 

16 See supra notes 12, 13, 14. 
79 


DIANA DeGETTE 

IJH Q,-;;rR,Cl, ColORA.O~ 

ZJJ!i l'\AYBL!I1N HmJH CHIC[ e WA;SHINGlN<~, fJC J:OSTS 

~2071225 4431 

FAX\202!125-5657 (!tnngr.ess of tq.e lltnit.e~ itnt.es DIS fRICT OfFICi; 

fiOO GAANT 5TfJt\, Sl.liH 202 

OHI\Ifll CO 60203 

!303!844-49118 

FAX!30J)844 4996 

Robert M. Califf, M.D. 

Commissioner 

U.S. Food and Drug Administration 

5630 Fishers Lane, Rm. 1061 

Rockville, MD 20852 

Jeffrey Shuren, M.D., J.D. 

ifous.e of it.epr.es.entutiu.es 

maslfhtgton, D<!i 20515-4329 

November 3, 2016 

Director, Center for Devices and Radiological Health 

U.S. Food and Drug Administration 

l 0903 New Hampshire Avenue 

W066-5429 

Silver Spring, MD 20993 

Dear Commissioner Califf and Director Shuren, 

CHIEF DEPUTY WHIP 

COMMiTTEE ON ENERGY AND 

COMMERCE 

RANKING MEMBER 

SUBCOMMITTEE ON OVERSIGf'IT ANO 

lNV£STIGATIOt·Hl 

SU-BCOMMITTEE ON 

ENVIRONMENT AND THE ECONOMY 

SUBCOMMITIEE ON COMMUNICATIONS 

ANO TECHNOlOGY 

We write to seek more information from FDA about potential cybersecurity vulnerabilities in medical devices. 

As the Internet of Things (loT) proliferates, so too does the number of networked medical devices. Numerous 

devices, ranging from monitors and infusion pumps, to ventilators and radiological technologies, arc integrated 

into the nation's digitized healthcare network, creating possible avenues for cyber·attacks. 

While the risks to patients may be low today, approximately 10 to 15 million medical devices in circulation across 

the United States use technologies that could be susceptible to cyber-attacks. This is especially important due to 

the rapidly evolving pace of cyber threats. as many of these existing devices are more than I 0 years old and when 

designed could have never anticipated the current cyber threat landscape. Individual medical devices could also 

potentially serve as an entry point for bad actors to use ransomware against healthcare providers, thus not only 

putting a single patient at risk, but jeopardizing the operations of entire health systems. 

We know medical device manufacturers are working closely with the U.S. Food and Drug Administration (FDA), 

securiry researchers, and other stakeholders to ensure that all potential vulnerabilities are addressed. We applaud 

FDA and other stakeholders for the steps that have already been taken to protect patients against potential 

emerging threats. Nevertheless, we have also seen recent headlines about the potential for unauthorized access in 

insulin pumps and implantable cardiac devices, among others. While innovative networked systems and the 

growth of wireless technology broaden the reach and effectiveness of lifesaving devices, they also increase the 

risk of cyber criminals taking advantage of technology's inherent weaknesses. As technology will undoubtedly 

continue to evolve at a rapid pace, we must ensure that FDA is equipped with the appropriate cybersecurity 

expertise and resources to evaluate not only the current risks to new medical devices, but also how new threats 

affect the medical devices already in use. 

We are pleased I'DA has identified mitigating medical device cybersecurity vulnerabilities as a regulatory science 

priority in 20 17-' We also appreciate I'D A's guidance in October 2014 on managing cybersecuriry issues in 

AAIMlW ON l'IEC'l'CLHt PAPHl. 

Q'{..g.l. 
80 


premarket submissions and draft guidance in January 2016 on postmarket cybersecurity management. As FDA 

encounters more complex issues and sophisticated devices, we would like to know more about how the Agency is 

working to prevent emerging threats, mitigate existing vulnerabilities, and assess the strength of a device's cyber 

resilience. 

What steps is FDA taking to notify device manufacturers and the provider community that cybersecurity 

vulnerability mitigation is a priority? 

How is the FDA working with medical device manufacturers and other stakeholders to assist them in 

protecting against potential vulnerabilities and emerging cybersecurity threats in both premarket and 

postmarket contexts? 

How is FDA working with medical device manufactures to ensure that known vulnerabilities to 

individual patients and/or entire health systems are mitigated and disclosed to all users? What efforts are 

currently underway to ensure that providers and patients are properly informed about known 

vulnerabilities among devices currently deployed for patient care? 

What is FDA doing to ensure that network owners, such as hospitals, implement practices and policies to 

keep their systems and connected devices secure? 

Given the potentially long lifecycle of some devices, what is the FDA doing to ensure that device security 

and patient privacy is accounted for throughout the prolonged use of devices despite the emergence of 

new threat vectors? 

Does the Agency have the personnel, policies and infrastructure necessary to evaluate how a device's 

security capabilities relate to the safety and efficacy of the device's functionality? 

How is the Agency coordinating its cybersecurity initiatives with other agencies, both within the 

Department of Health and Human Services (HHS), and across the federal government. including the 

Department of Homeland Security (DHS), Federal Bureau of Investigation (FBI) and the Federal Trade 

Commission (FfC)? 

Thank you for your attention to this important matter. We look forward to collaborating with FDA, device 

manufacturers, and other stakeholders to ensure that the nation's patients have access to safe and secure medical 

devices. We respectfully request a response from the Agency by December 16, 20! 6. 

Sincerely, 

Diana "~ DeGette /JJ?JJ!ti 

Member of Congress 

Susan W. Brooks 

Member of Congress 

Cc: Representative Fred Upton, Chairman, House Energy & Commerce Committee 

Representative Frank Pallone Jr., Ranking Member, House Energy & Commerce Committee 

2 
81 


GREG WALDEN, OREGON 

CHAIRMAN 

Ms. Denise Anderson 

President 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

ONE HUNDRED FIFTEENTH CONGRESS 

(!Congress of tbc Wnitcb $tatcs 

f!)ouse of l\eprescntattbes 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFICE BuiLDING 

WASHINGTON, DC 20515-6115 Majority (20?) 225-2"977 

Minority (202) 225-3641 

April 27, 2017 

National Health Information Sharing and Analysis Center 

226 Nm1h Nova Road 

Suite 391 

Ormond Beach, FL 32174 

Dear Ms. Anderson: 

Thank you for appearing before the Subcommittee on Oversight and Investigations on Tuesday, 

April 4, 2017, to testify at the hearing entitled "Cybersecurity in the Health Care Sector: Strengthening 

Public-Private Pa11nerships." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains open 

for ten business days to penn it Members to submit additional questions for the record, which are attached. 

The format of your responses to these questions should be as follows:(!) the name of the Member whose 

question you arc addressing, (2) the complete text of the question you are addressing in bold, and (3) your 

answer to that question in plain text. 

To facilitate the printing of the hearing record, please respond to these questions with a transmittal 

letter by the close of business on Thursday, May II, 2017. Your responses should be mailed to Elena 

Brennan, Legislative Clerk, Committee on Energy and Commerce, 2125 Rayburn House Office Building, 

Washington, DC 20515 and e-mailed in Word format to ElenaBscnJlilJ1~fl''"a_i.Ll12U'i£~. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

Sincerely, 

Tim 

~~ Murphy 

Chairman 

Subcommittee on Oversight and Investigations 

cc: The Honorable Diana DeGette, Ranking Member, Subcommittee on Oversight and Investigations 

Attachment 
82 


Answers to Additional Questions tor the Record ANDERSON May 9, 2017 

The Honorable Tim Murphy 

1-I understand that HHS, apparently at the request ofDHS, is establishing a Cybersecurity 

Communications and Integration Center specific to the health care sector, the "HCCIC." It 

would appear that this organization, at least on some level, replicates the role of an ISAC in 

other sectors. 

!a-QUESTION: What is your understanding of this effort and how does it relate to your 

organization? 

ANSWER: HilS recognizes the need to address the gaps in cybersecurity that are present within 

the llealth and Public Health (I IPI !) sector. One way that HHS is seeking to address this gap is 

by standing up a center where all of the components ofHHS; ONC, ASPR, FDA, for example, 

can come together to share and generate intelligence under one body and along with the private 

sector via the NH-ISAC in order to promote situational awareness and help mitigate against 

threats and incidents. HHS has reached out to NH-ISAC to take a collaborative partnership 

within the HCCIC in order to streamline information sharing broadly out to the HPH sector. The 

goal is to have NH-ISAC take a role in disseminating information from the HCCIC to the sector 

writ large through its established mechanisms. 

lb-QUESTION: Based on your experience, arc there other sectors that have their own 

CCIC? 

ANSWER: In 2014, The US Department of the Treasury stood up the Cyber Intelligence Group 

(CIG) that essentially serves as the CCIC for the financial sector. The CIG's primary function is 

to distribute timely and actionable information and analysis that financial institutions can use to 

protect themselves. The CIG works very closely with the Financial Services Sector Coordinating 

Council (FSSCC) and the FS-ISAC. The collaboration and products delivered to the sector have 

been well received within the public/private partnership. The interaction demonstrated the 

importance of threat intelligence sharing and Treasury's role as a non-regulatory partner. 

lc-QUESTION: Do you think this will be beneficial in addressing some of the challenges in 

the health care sector? 

ANSWER: If the CIG model in Treasury is any indicator, the HCCIC should be successful if 

carried out as envisioned and if it is voluntary and non-regulatory in nature. This will result in 

improved dissemination within the sector. In addition, by bringing all of the components ofHHS 

under one roof, increased situational awareness and cyber security efficiencies will result. 

ld-QUESTION: Are there any potential downsides to having an HCCIC? If so what arc 

they? 

ANSWER: One potential downside of pulling together HHS components into one floor could be, 

a slow down of sharing from the private sector as 'government' is involved, Another downside 

could be that even though all of the components arc brought together. sharing could still take 

place in a fragmented, unproductive manner. There could be risk of inadvertent disclosure or risk 
83 


Answers to Additional Questions for the Record ANDERSON May 9. 2017 

of post-hoc regulatory penalties for a reported breach. Finally if etTorts are not effectively 

differentiated from the NCCIC environment, duplication of effort and additional costs for 

staffing and resources can result. 

2-The public-private partnership model that we discussed at the hearing is designed so that 

the Sector Specific Agencies, Sector Coordinating Council, and Information Sharing and 

Analysis Centers work closely together to address sector challenges, in this case 

cybersecurity. QUESTION: How does the NH-ISAC work with HHS specifically as the 

health care SSA to address cyhersecurity incidents and challenges? 

ANSWER: NH-ISAC has worked with different components ofHHS at various points and 

times. For example in the medical device security field, NH-lSAC along with the Medical 

Device Innovation and Safety Consortium (MDISS), has worked with FDA to establish 

workshops, carry out a medical device track at the NH-ISAC Annual Summit and to develop 

initiatives for responsible disclosure of vulnerabilities such as the MD-VIPER program. In 

addition, the !SAC is working with ONC and ASPR on the cooperative agreements to meet the 

deliverables as outlined in the Grant awards. The !SAC also coordinates on the NCCIC floor 

with I!HS as applicable. NH-ISAC members are the first to work with MITRE and HHS to test 

out the A TT &CK model, a framework for describing the actions an adversary may take. The 

effort is currently underway. 

2a-QUESTION: How does the NH-ISAC work with the SCC? 

ANSWER: The Nl-1-ISAC is a member of the Healthcare SCC and participates in monthly 

meetings, as well as some SCC working groups. 

2b-QUESTION: Are there ways in which your organization could work more closely 

together with HHS and the Health care SCC? 

ANSWER: There are always ways in which the I SAC can work together more closely with the 

SSA and the SCC. With the SSA, having that central coordinator role is so important to make 

sure there is less duplication of effort across the sectors and one point of contact to streamline 

communications and interactions. The SCC is primarily driven by volunteers at this point. The 

sec requires a full-time dedicated resource(s) to drive the organization and the 

collaboration/mission of the private side ofthe HPH sector in order to be effective. The FS-ISAC 

funded such a full-time, Executive Director position at the FSSCC to serve the greater good of 

the sector. The NH-ISAC Board is currently exploring a similar type of funding/support 

situation. 

3-My understanding is that there are multiple agencies within HHS that have pieces of 

healthcare cybersecurity. For example, the Office of Civil Rights deals with data breaches, 

the Food and Drug Administration deals with medical devices, and the list goes on for other 

components of the agency. QUESTION: How does the division of responsibilities affect the 

NH-ISAC? 

2 
84 


Answers to Additional Questions for the Record A"'DERSON May 9, 2017 

ANSWER: With the preponderance of myriad components and roles within HHS, confusion, 

duplication of effort and a loss of threat landscape/situational awareness result. It is much easier 

to deal with one entity than several. The confusion is large. For example, when the HCCIC was 

announced questions immediately came from members regarding who they would report to. 

Would they report to the regulator, to the HCCIC, the NCCIC or other? Again, having one 

designated liaison/group to go to will be key to solving this problem. 

3a-QUESTION: Would additional coordination or clarity by HHS regarding which pieces 

of the agency have responsibility for cybcrsecurity, and when, help your organizations. 

ANSWER: Absolutely. It is very confusing and time consuming to try to figure out where to go 

to report and share information or seek coordination of efforts. During a time of crisis, time is of 

the essence so having one-stop sharing or at the very least a clear guideline as to where to go is 

essentiaL 

3b-QUESTION: Do you have any suggestions for actions that HHS could take to better 

coordinate or clarify its cybersecurity roles and responsibilities. 

ANSWER: The best step that HHS can take is to name a sector coordinator interfacing and 

speaking with one voice for HHS and with sufficient influence across the components, minimally 

at the assistant secretary level. Another step is to come up with a clear set of guidelines and 

definitions as to what the components are and what each role/responsibility is. 

4-QUESTION: Do you believe a robust, centralized ISAC is important to elevating the 

security of the health care sector? In other words, why is a centralized ISAC more 

beneficial to the sector than perhaps a number of smaller entities organized around specific 

sub-sectors like the medical device ISAO? 

ANSWER: Threats in general are typically seen across entire sectors. Differentiation amongst 

the sub-sectors usually lies in actors, actor motivation and then issues specific to the sub-sector. 

Having a centralized !SAC provides may benefits; one place to go during incidents and daily 

sharing, entire sector perspective and sharing, one coordinating point with other sectors via the 

!SACs and with government, a true community that collaborates and coordinates together. 

For example, one strength of the NH-ISAC is that we are able to bring all stakeholders together, 

providers and manufacturers, to address problems and threats together versus in silos. Indeed, as 

our industry expands and becomes increasingly internet connected and interconnected, threats 

seen in one subsector have rippling effects across other subsectors. 

What the NH-lSAC has done is create special interest councils for the various sub-sectors such 

as medical devices, providers and pharmaceuticals. The benefit to this is that these members not 

only get access to all of the threat intelligence, best practice sharing and activity seen across the 

sector writ large, but also can share around threats and issues particular to their sub-sector 

community. 

3 
85 


Answers to Additional Questions lor the Record ANDERSON May 9. 2017 

This has been done successfully in other !SACs such as the FS-ISAC where there are special 

interest groups for markets and exchanges, community banks and retail banks. 

As a point of clarification, the medical device '!SAO' is actually a special interest group within 

the NH-ISAC devoted to medical device security. The Council leverages the NH-ISAC 

infrastructure and member components. For example, the community includes health care 

delivery organizations (HDOs) as well as manufacturers and others across the sector who all 

have a stake in device security. The !SAC is able to build relationships and form partnerships so 

that all stakeholders can learn from each other and benefit by having one community instead of 

fragmented groups such as an HDO !SAO, a manufacturer !SAO or a pharmaceutical !SAO. 

There is less duplication of effort and less costs and resources required by owners and operators 

to participate in one !SAC versus several ISAOs. The sector is very unique in that data must be 

portable across all components so components are actually dependent on each other. Therefore 

having one !SAC is the most efficient and cost-effective solution. 

4a-QUESTION: What are the potential downsides or consequences of not having an 

effective ISAC for the entire sector? 

ANSWER: The potential downsides include; fragmented sharing, loss of sector perspective and 

metrics, loss of a community of members helping members, confusion as to where to share 

information or to respond to for collaboration and communication, multiple and duplicative 

channels leading to ineffective coordination and threats becoming successful because not all are 

getting the information or are not receiving it in a timely fashion, ineffective coordination 

amongst other critical infrastructure and government agencies, extra resources and costs needed 

to share and coordinate amongst multiple channels. The more we can work together as one sector 

the more effective we can be and the more we can stay ahead of or on top ofthreats. 

5.-My staff and I have heard from stakeholders in other industries, most notably the 

electricity sector, that they have broad, senior executive level engagement on their sec, 

and that this engagement has significantly increased the effectiveness of the council and 

other aspects of their public-private partnerships, such as their ISAC. QUESTION: Who 

from your organizations participates in the Healtheare SCC? 

ANSWER: If you look at the typical attendees of a health care SCC meeting, usually under 20 

attendees, about 113 are comprised of private sector organizations such as NH-ISAC and 

HITRUST and 2/3 are comprised ofGCC members and support staff. Very few owners and 

operators participate on the monthly calls. 

Sa-QUESTION: Would a similar model, with broad senior executive engagement on the 

SCC, work in the health care sector? Why or why not? 

ANSWER: I do not believe that having HPH sector CEOs engage in the health care SCC would 

be productive. CEOs are not the subject matter experts when it comes to cybersecurity and have 

not traditionally been focused on cybersecurity. The better solution would be to appeal to CEOs 

4 
86 


Answers to Additional Questions l(lr the Record ANDERSON May 9, 2017 

and other C-Suite executives to dedicate cybersccurity experts who are aware of the full-range of 

cybcr issues to participate in the sec. 

Sb-QUESTION: Do you have any other thoughts on the SCC and its importance or the 

roles it plays in health care sector cybersecurity? 

ANSWER: I think the SCC can play a very important role in assuring that cybersecurity policy is 

effective and aligned with the needs of the sector when it comes to its resilience and protection. 

As this sector is heavily dependent on other critical sectors like electricity, communications, and 

financial services, we need to work with those sectors to understand and manage 

interdependencies as they are affected by cyber threats, vulnerabilities and incident response. 

The SCC can ofter a leadership perspective on the impacts of policy and regulation and can help 

play a coordination role for making sure industry's voice is heard on policy and regulatory issues 

that can affect the sector. For example, the FSSCC took an active role in helping secure 

clearances, developing fast-track incident response assistance by the government for financial 

services firms hit with overwhelming eyber attacks, and in securing access credentials during a 

physical incident such as Hurricane Sandy. 

6-Based on the discussion from the hearing, it sounds like there is more that public-private 

partnerships could do to support smaller organizations. QUESTION: Do you have any 

suggestions for what HHS could do specifically to help smaller health care organizations 

better address cybersecurity? 

ANSWER: There are many things HHS could do to help smaller health care organizations when 

it comes to cybersecurity. First, HHS could require in its audit components such as for HIPPA 

audits that during the audit process, a question is asked if the organization being audited is a 

member of the NH-ISAC as a best practice. Second, llHS could provide financial support or tax 

breaks or other incentives to smaller organizations that cannot afford cybersecurity tools such as 

DMARC or memberships in organizations such as the NH-ISAC. HilS could develop materials 

or courses that cover basic cyber hygiene or again can incent organizations to hire cyber security 

skilled staff. The SSA can push out guides that stress enterprise risk management and look at the 

consequences and impacts of not having a cyber security program in place. Much of this work 

has already been done through collaborative efforts of the public private partnership; namely, the 

N 1ST Cybcrsecurity Framework, which is a voluntary, consensus-based standard of practice that 

is seeing increasing uptake across the cyber risk management ecosystem. 

6a-QUESTION: What about the Healthcare SCC? 

ANSWER: The SCC could do many of the same things such as delivering a guide on basic 

cybersecurity hygiene and best practices as well as enterprise risk management and the impacts 

and consequences of not having a cyber security program in place. It could also develop papers 

on blended threats such as physical and cyber and what organizations can do to be aware of 

them. 

5 
87 


Answers to Additional Questions for the Record ANDERSON May 9. 2017 

7-QUESTION: Are there lessons from the progress of cybersecurity in the medical device 

sector that can benefit other parts of the health care sector, as well as the sector as a whole? 

If so, what are some of those lessons? 

ANSWER: l think the major takeaway is that collaboration between all stakeholders, both public 

and private, is very important in order to create situational awareness and combat threats. We all 

need to work together to create an 'army of good guys'. Over and over we tend to see that 

technology, while a contributor, is not really the problem. The problem is one of process and 

communication. 

8-Your organization is the recent recipient of a grant from HHS for threat information 

sharing. Under that grant, the NH-ISAC is required to share threat information bidirectionally with the healthcare sector and HHS. 

Sa-QUESTION: Can you tell ns more about that grant? Why is it important? What will it 

enable your organization to do? 

ANSWER: There are two cooperative agreements, one issued by ONC and centered primarily on 

education and the other issued by ASPR and centered primarily on automated indicator sharing. 

The most important aspect for NH-ISAC when it comes to the agreements is that the !SAC was 

recognized as the channel for collaboration between HHS and the private sector. It takes any 

'noise' off the table and clearly states that this is how the sector will work together and engage. It 

will enable us to be more effective and eliminates any distraction from the mission to educate 

and share. Again it is important to note that we are not inventing anything new to accomplish 

this. We are leveraging the already established information sharing channels that our members 

successfully engage in to mitigate against incidents. 

8b-QUESTION: Have you seen an increase in NH-ISAC membership following the 

awarding of this grant? 

ANSWER: While we've definitely seen interest in the !SAC perk up after the grants were 

awarded, we haven't really seen a definitive up-tick in membership directly tied to the grant 

announcement at this point in time. The grant processes and milestones are still relatively new 

and we anticipate as goals are reached that over time we will be able to tie increased membership 

to some of the grant efforts. 

8c-QUESTION: Has the awarding of this grant allowed you to increase your services? If 

so, how? 

ANSWER: The grant processes and milestones are still relatively new and we anticipate as goals 

are reached that over time we will be able to tie increased services, such as basic cyber hygiene 

workshops and net flow traffic analysis and alerting to some of the grant efforts. It is important 

to note that many cyber security tools arc costly and there is a limited dollar component to the 

grants. We fully expect to supplement the services we want to deliver as part of the grant from 

other NH-lSAC funding. 

6 
88 


Answers to Additional Questions for the Record ANDERSON May 9, 20!7 

9-During the hearing, we talked a great deal about the HHS as the SSA, and the NH-ISAC, 

but we didn't really touch on the Government Coordinating Council. QUESTION: What 

role docs the GCC play for each of your organizations? 

ANSWER: Currently the role of the GCC is somewhat limited to the monthly meetings held 

between the GCC and the SCC I think some of that is the result of the sector GCC and SSA 

components being very fragmented. Having HHS designate a sector liaison would go a long way 

to making the partnership more visible and effective. 

9a-QUESTION: Are there additional initiatives that yon believe that the GCC could take, 

or roles that it could fill, that would help your organizations and the health care sector as a 

whole better address cybcrsecurity. 

ANSWER: I think as stated above, the more we can streamline and consolidate the interaction 

between the public and private sector collaboration, the better off all will be. If we can make the 

SCC and GCC more effective in what they do, collaboration and initiatives will be enhanced. 

There are also things like exercises that can be undertaken. A great example is the Hamilton 

series of exercises that were designed by the partnership and executed at the highest levels of 

Treasury, the financial GCC, the FSSCC and the FS-ISAC as well as eventually other sectors. 

Having the partnership in the HPH sector take the same steps would go a long way to identify 

and address gaps. 

10-In your testimony, when discussing ISAOs, you state, "It is vital that the process is not 

diluted and remains streamlined to facilitate effective situational awareness and response 

activities particularly when an incident occurs." 

lOa-QUESTION: Can you elaborate on this point? How wonld the information sharing 

process be di!nted and what are the potential consequences if this occurs? 

ANSWER: Presidential Decision Directive 63 (PDD-63) states: " ... requires a closely 

coordinated effort of both the government and the private sector. To succeed. this partnership 

must be genuine, mutual and cooperative. In seeking to meet our national goal to eliminate the 

vulnerabilities of our critical if!fras/ructure, therefore, we should, to the extent feasible, seek to 

avoid outcomes that increase government regulation or expand unjimded government mandates 

to the private sector . 

.. Close cooperation and coordination is essential for a robust andflexible infrastructure 

protecrion program . 

.... Information Sharing and Analvsis Center (!SAC!: The "government" shall consult with 

owners and operators of the critical inji·astructures to strongly encourage the creation of a 

private sector information sharing and analysis center. The actual design andjimctions ofthe 

center and its relation to the NIPC will be determined bv the private sector ... " 

The National Infrastructure Protection Plan calls for each sector to work together with its 

respective SSA, GCC, SCC and !SAC. During a time of crisis is is essential to have a 

streamlined process for sharing and a clearly designated body to collaborate and coordinate with. 

7 
89 


Answers to Additional Questions for the Record ANDERSON May 9, 2017 

Cyber threats and incidents happen instantaneously. When more than one body enters the mix, 

confusion ensues and efficiency and speed of information sharing and situational awareness is 

lost. Owners and Operators built the !SACs to serve as these conduits for information sharing 

and coordination. This model has existed for almost 20 years and it works. When owners and 

operators and the government do not know where to go or are forced to turn to several 

organizations, time and efficiency is wasted and attackers can get in. !SACs also offer a sector 

perspective. When other organizations chime in, the perspective is fragmented and the sector 

nuances are lost. For example, when the DDoS attacks of 2012/2013 occurred against the 

financial sector, the !SAC was able to report and provide analysis and information at a sector 

level versus having individual owners/operators or small groups report in. The information was 

coordinated and was instantaneous, relevant and actionable. 

lOb-QUESTION: Is that something that is happening in the health care sector or other 

sectors now'? 

ANSWER: Absolutely there is a lot of confusion in the HPH sector currently especially after 

FDA put out the Post-Market Guidance. The use of the term !SAO in the guidance has caused 

nothing but daily confusion and unnecessary effort. For some reason the expectation exists that a 

new !SAO needs to be stood up with all of the governance, legal, financial and other 

infrastructure required to effect information sharing. Instead the NH-ISAC is leveraging the 

power and the infrastructure that exists within the !SAC, which is essentially serving as the 

!SAO for medical devices. Manufacturers, stakeholders and government are getting 'hung up' on 

the term !SAO instead of using what already exists and running with it. It has stymied progress. 

Other sectors such as Finance are also encountering the confusion. There is a credit union !SAO, 

which is in conflict with the FS-ISAC. 

lOc-QUESTION: If so, how can we address it? 

ANSWER: Government can address the issue by recognizing !SACs and the special operational 

role they play in critical infrastructure protection and resilience. Furthermore, government can 

help by encouraging owners and operators of critical infrastructure to join their respective sector 

!SACs and offer tax incentives or audit incentives to do so. Finally, government should stop 

using the term !SAO as a blanket term for all information sharing activities and instead refer to 

!SACs as !SACs and JSAOs as ISAOs. 

This concludes my Answers to Additional Questions for the Record. 

8 
90 


GREG WALDEN, OREGON 

CHAIRMAN 

Mr. Michael McNeil 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

ONE HUNDRED FIFTEENTH CONGRESS 

~ongress of tbe mntteb .f$tates 

~ousc of l\cprescntattues 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFICE BuiLDING 

WASHINGTON, DC 20515-6115 Majority (202) 225-2927 

Mmority (202) 225-3641 

April 27, 2017 

Global Product and Services Security Officer 

Philips 

3000 Minuteman Road 

Andover, MA 01810 

Dear Mr. McNeil: 

Thank you for appearing bctorc the Subcommittee on Oversight and Investigations on Tuesday, 

Apri\4, 2017, to testify at the hearing entitled "Cybersccurity in the Health Care Sector: Strengthening 

Public-Private Partnerships." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains open 

for ten business days to permit Members to submit additional questions for the record, which arc attached. 

The format of your responses to these questions should be as follows: (I) the name of the Member whose 

question you are addressing, (2) the complete text of the question you are addressing in bold, and (3) your 

answer to that question in plain text. 

To facilitate the printing of the hearing record, please respond to these questions with a transmittal 

letter by the close of business on Thursday, May 11, 2017. Your responses should be mailed to Elena 

Brennan, Legislative Clerk, Committee on Energy and Commerce, 2125 Rayburn House Office Building, 

Washington, DC 20515 and e-mailed in Word format to EJcJHl,flrcnnanlil)naiLJ!ousc.gov. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

Sincerely, 

Tim~~ Chairman 

Subcommittee on Oversight and Investigations 

cc: The Honorable Diana DeGette, Ranking Member, Subcommittee on Oversight and Investigations 

Attachment 
91 


To: 

From: 

Philips 

Subject: 

Re: 

Via: 

Legislative 

Washington, 

The Honorable Tim Murphy 

Mr. Michael C. McNeil 

Global Product Security Services Officer 

Healthcare 

on behalf of AdvaMed, the Advanced Medical Technology Association 

Responses to Additional Questions for the Record 

Subcommittee on Oversight and Investigations hearing on 

Tuesday, April4, 2017 

Entitled "Cybersecurity in the Health Care Sector: Strengthening Public-Private 

Partnerships." 

Elena Brennan 

Clerk 

Committee on Energy and Commerce 

2125 Rayburn House Office Building 

DC 20515 

Dear Chairman Murphy: 

This letter is in response to your correspondence of Apri127, 2017 addressed to myself on behalf of 

AdvaMed, the Advanced Medical Technology Association concerning my testimony before the 

Subcommittee on Oversight and Investigations on Tuesday, April4, 2017, at the hearing entitled 

"Cybersecurity in the Health Care Sector: Strengthening Public-Private Partnerships." Cybersecurity 

vulnerabilities and threats are a persistent, significant and very real threat to many critical American 

industries. Philips shares your deep concern for and takes very seriously the risks to patients and 

infrastructure from those who would seek to exploit vulnerabilities in our sector. Philips and AdvaMed are 

committed to continuing to innovate and implement long-term strategic and effective measures to 

strengthen our public and private partnerships. We look forward to continuing this vitally important 

conversation, in order to help meet our goal of improving billions of lives worldwide. 

Sincerely, 

Mr. Michael C McNeil 

Global Product Security Services Officer 

Philips Healthcare 
92 


Responses to Questions for the Record 

The Honorable Tim Murphy 

Question 1: I understand that HHS, apparently at the request of DHS, is establishing a Cybersecurity 

Communications and Integration Center specific to the health care sector, the "HCCIC." It would appear 

that this organization, at least on some level, replicates the role of an I SAC in other sectors. 

Answer: We understand the effort to stand up the HCCIC is underway. AdvaMed member organizations 

understand and appreciate that cybersecurity is everyone's responsibility, and that it is in this power of 

shared responsibility and cooperation that we have the best opportunity to protect patients and the greater 

health care system. Philips is proud of our collaboration with AdvaMed members and the Health care 

Sector and is very supportive of HHS and the FDA's focus on increasing cyber resiliency. 

We are not adequately informed to provide comment on how other sector I SACs are organized as they 

relate to HHS's planning. 

a. What is your understanding of this effort and how does it relate to your organization? 

Answer: We understand that the Department of Health and Human Services is planning to launch 

the Health Care Cybersecurity & Communications Integration Center by June, as shared by HHS 

Chief Information Security Officer Chris Wlaschin during an ACT-lAC Mobile Health Forum panel in 

Washington on April 20. According to news reports, the center will educate health care 

organizations and patients about the risks associated with using mobile data and applications. The 

center will be modeled after the Homeland Security Department's NCCIC -- but with a focus on 

health care- and is scheduled to be operationally capable by June.1 

Our hope is that this entity will provide an opportunity to consolidate critical stakeholders for better 

alignment. 

b. Based on your experience, are there other sectors that have their own CCIC? 

Answer: No. I am unaware of other CCICs being stood up beyond HHS and DHS at this time. 

However, that does not mean it has not happened, it is just not part of my experience. Recent 

media reports indicate the Centers for Medicare and Medicaid Services are also considering a 

similar concept according to Mark Scrimshire, a CMS entrepreneur in residence as told to Federal 

News Radio.2 

c. Do you think this will be beneficial in addressing some of the challenges in the health care sector? 

1 Health care IT News- http://www.health careitnews.com/news/hhs-cybersecurity-center-helphealth care-orgs-fight-cyberthreats 

2 Federal News Radio- https://federalnewsradio.com/health-it/2017/04/hhs-to-stand-up-its-ownversion-of-the-nccic-for -health/ 

2 
93 


Answer Health care networks, like other critical infrastructures, are under persistent attack by bad 

actors and Philips welcomes new countermeasures and approaches to increase our resiliency 

across the sector. We understand from reports that HHS sees this kind of collaborative partnership 

as a logical step, as about 50 percent of U.S. health care organizations lack the adequate tools to 

deter and manage cyber breaches, according to a 2016 Ponemon Institute study. And as mobile 

health apps become more prevalent, the department also sees the HCCIC as an opportunity to 

work with developers to help them more securely safeguard patient data.3 

d. Are there any potential downsides to having an "HCCIC?" If so, what are they? 

Answer: As global threats to our critical infrastructures increase at an exponential rate its wise for 

HHS and the Health care sector to take innovative, bold approaches to protect our patients from 

bad actors. Everyday health care is becoming more integrated and interconnected, and we have a 

mutual responsibility to keep those systems safe. We want to continue to focus on entities such as 

the HCCIC that bring multiple stakeholders in the ecosystem (health delivery organizations, 

medical device manufacturers, pharmaceutical companies, researchers, government entities, etc.) 

together. This can only result in stronger collaboration and trust. 

Question 2: According to the membership roster, your organization is a member of the Health care and 

Public Health Sector Coordinating Council. We know the Health care SCC has many roles and 

responsibilities beyond cybersecurity, but as cybersecurity becomes more important across the industry, 

the sec will arguably have a big role to play. 

Answer: You are correct, Advanced Medical Technology Association is in-fact a member of the Health care 

SCC. The association believes patient safety is the number one priority of the medical technology industry, 

and member manufacturers are committed to having in place numerous safeguards to ensure the security 

and integrity of their devices. The ubiquity of digital technologies offers patients significant benefits, and 

the risk of a malicious cyber-attack is low when compared to these benefits. At the same time, 

manufacturers recognize the need for increased security with these devices, which is why we are invested 

in the success of organizations like the Health care sec. 

a. What services, products or value does the sec offer regarding cybersecurity? 

Answer: As detailed in the May 2016 Health care and Public Health Sector Specific Plan (SSP)-

since 2010, the HPH Sector partners in the public and private sectors have taken significant steps 

to reduce sector risk, improve coordination, and strengthen security and resilience capabilities: 

Both the SCC and GCC undertook extensive outreach programs. State, local, and private 

sector partners were recruited through presentations, webinars, and outreach to national 

associations. 

The Homeland Security Information Network portal for the HPH Sector was expanded to 

better meet the information sharing needs of the Sector including a lesson learned 

3 Federal News Radio- https:/lfederalnewsradio.com/health-it/2017/04/hhs-to-stand-up-its-ownversion-of-the-nccic-for-health/ 

3 
94 


repository and the addition of over 1300 documents to enhance relevant situational 

awareness for end-users. 

A full methodology is under development for use in assessing the risks to the Sector 

including cyber, physical, and human vulnerabilities and threats. 

The PH sec also maintains the standing workgroups on Risk Management and Cyber 

Security and Cyber Legislation. 

We participate in the reoccurring Health Care Industry Cybersecurity (HCIC) Task Force 

Meetings, which were established in 2016. 

Further, the SCC and GCC collaborated to establish a Joint Cyber Working Group to 

enhance cyber security engagement throughout the Sector.4 

b. Do you get the sense that their role and contributions are understood and appreciated across the 

sector? 

Answer: While many organizations are proactively engaged in the SCC more can, should, and 

must be done to bring in smaller partners with less resources. Effectively engaging with 

underfunded regional and local Health Sector partners so that they can contribute intelligence and 

benefit from information sharing to better protect the Health care sector from cyber vulnerabilities, 

remains an important goal. 

c. Are there ways that the sec could be more effective in assisting the sector with cybersecurity 

challenges? 

Answer: Any mechanism to allow more collaboration across the Sector and between its key 

constituents within the ecosystem (government, public-private partnerships, health delivery 

organizations, manufacturers, associations, research entities, etc.) is truly welcome. This 

collaboration will lead to better alignment, which in turn will lead to better efficiency. 

Question 3: My staff and I have heard from stakeholders in other industries, most notably the electricity 

sector, that they have broad, senior executive level engagement on their SCC, and that this engagement 

has significantly increased the effectiveness of the council and other aspects of their public-private 

partnerships, such as their I SAC. Who from your organization participates in the Health care SCC? 

Answer: AdvaMed is represented in the SCC by President and CEO Scott Whitaker. Philips participates in 

the Health care SCC through myself, as Global Product Security Services Officer for Philips Healthcare. 

a. Would a similar model, with broad senior executive engagement on the sec, work in the health 

care sector? Why or why not? 

• Health care and Public Health Sector-Specific Plan- May 2016: 

https://www.phe.gov/Preparedness/planning/cip/Documents/2016-hph-ssp.pdf 

4 
95 


Answer: Each organization's C-Suite is different, so a one-size fits all approach would be difficult in 

manifesting appropriate participation across the industry by title alone. The intent of SCC 

membership and involvement should leverage the right leaders with the right skills and portfolios to 

adequately represent the sector, their organization and area of expertise in creating greater 

resiliency, and collaboration. 

Participation in the sec with appropriate executives would clearly be warranted to assure there is 

the broadest visibility at the highest levels within an organization. Philips, through current 

participation in different industry associations such as AdvaMed, is deeply engaged. 

Brent Shafer (CEO, North America) sits on AdvaMed's board 

Joe Robinson (Sr. VP Health Systems Solutions) is Chairman of the Board of MIT A 

Michael McNeil (Global Product Security Services Officer) is on the board of directors for 

NH-ISAC as well as a participant In HHS Cybersecurity Task Force 

Philips believes that establishing visibility with strong executives across these associations, is a 

worthwhile avenue for building a fruitful collaboration. 

b. Do you have any other thoughts on the sec and its importance or the roles it plays in health care 

sector cybersecurity? 

Answer: As described in the SSP. the HPH Sector is large, diverse, and open, spanning both the 

public and private sectors. It includes publicly accessible health care facilities, research centers, 

suppliers, manufacturers, and other physical assets and vast, complex public-private information 

technology systems required for care delivery and to support the rapid, secure transmission and 

storage of large amounts of HPH data. Access to health care is critical in maintaining national 

health security. In 2011, Americans made 262 million visits to hospital emergency or outpatient 

departments. Over 14 million workers, representing more than 10 percent of the total American 

workforce, are employed in the HPH Sector throughout the U.S. This includes those who provide 

services directly to health care recipients and those who play a supporting role, such as vaccine 

manufacturers. Given this landscape, HPH Sector infrastructure security and resilience are 

ultimately defined by the ability of the Sector to prevent or mitigate negative impacts upon the 

delivery of HPH services. The sec is integral in our ability to prepare, respond and recover from 

continued threats.s 

Question 4: As the Sector Specific Agency for the health care sector, HHS has a big role to play in guiding 

and supporting industry cybersecurity efforts. Can each of you briefly tell us how HHS, as the SSA for your 

sector, provides cybersecurity guidance and support for your organization? 

Answer: Under Presidential Policy Directive 21 (PPD-21), HHS has Sector-Specific Agency (SSA) 

responsibility for the Health care and Public Health (HPH) Sector. HHS implements its SSA role for the 

HPH Sector through the Critical Infrastructure Protection Program within the Office of the Assistant 

Secretary for Preparedness and Response (ASPR). Through these programs. HHS works in voluntary 

s Health care and Public Health Sector-Specific Plan 

https:/ /www. phe .gov /Pre pared nesslplanni ng/cip/Docu ments/20 16-h ph-ssp. pdf 

5 
96 


partnership with public and private sector entities in the HPH and F&A Sectors to enhance their security 

and resilience with respect to all hazards, including cyber threats. 

Beginning in 2014 HHS focused on increasing the Sector's awareness of the Cybersecurity Framework and 

implementing the Critical Infrastructure Cyber Community (C3) Voluntary Program within the Sector. HHS 

announced the release of the Framework through a website posting and presented on the Framework at 

major national Sector meetings. These meetings included the Public Health Preparedness Summit, Health 

care Information Management System Society (HIMSS) Conference, and Public Health Informatics 

Conference. The Sector has also tasked its standing Risk Management Working Group to develop the 

Sector's approach to the C3 Voluntary Program. The Sector's approach is focused on the cataloging and 

prioritization of federal resources for cybersecurity for Sector partners to access.e 

Most recently and as the SSA for the Health care sector, HHS brought together members of the Health 

Care Industry Cybersecuri!y Task Force (initiated in 2016) of which I am a member. Our Task Force 

completed our report this month. Task Force members represent a wide variety of organizations within the 

health care and public health sector, including hospitals, insurers, patient advocates, security researchers, 

pharmacy and pharmaceutical companies, medical device manufacturers, health information technology 

developers and vendors, and laboratories. Many of my co-members are Chief Information Security Officers 

or equivalent positions within their organizations, while others have expertise in clinical medicine, software 

development, information security, and related fields.? 

a. Who in HHS, or what office, is considered the "go-to" contact for cybersecurity issues? 

Answer: Currently inside HHS, through the Health Care Industry Cybersecurity Task Force, CoChair is Emery Csulak, MS, CISSP, PMP, Chief Information Security Officer, Centers for Medicare 

and Medicaid Services, U.S, Department of Health and Human Services, is the 'go-to' contact. 

However, there clearly is not one official designated contact for cybersecurity issues that exists 

across all of HHS. And once the Cybersecurity Task Force is dissolved, Emory Csulak's 

responsibility will conclude. Therefore, this consideration must be addressed moving forward. 

Question 5: My understanding is that there are multiple agencies within HHS that have pieces of health 

care cybersecurity. For example, the Office of Civil Rights deals with data breaches, the Food and Drug 

Administration deals with medical devices, and the list goes on for other components of the agency. 

Answer: Correct· the response of the federal government to improving critical infrastructure cybersecurity 

in the health care sector is multi-pronged. Within the HHS, the Office for Civil Rights (OCR), CMS, the Food 

and Drug Mministration (FDA), the Ot!ice of the National Coordinator (ONC), and the Office of the 

Assistant Secretary for Preparedness and Response (ASPR) play important and diverse roles in 

cybersecurity. Other administrative agencies and independent commissions, for example, the Federal 

Trade Commission (FTC) also play a role in setting expectations for privacy and security of health 

information. 

s HHS activities to enhance cybersecurityhttps://www .phe.gov/Preparedness/planning/cip/Pages/eo 13636.aspx 

7 Health Care Industry Cybersecurity Task Force· 

https://www.phe.gov/Preparedness/planning/CyberTF/Pages/default.aspx 

6 
97 


The multiplicity of actors in this space is often necessary to address a wide range of cybersecurity 

challenges and system types, and can be helpful in allowing these challenges to be viewed and addressed 

from multiple perspectives. It also has the potential to create complications. Some entities may be subject 

to regulation and oversight by multiple federal government entities, each with their own rules, which may be 

difficult to reconcile. Product and technology innovations for medical devices and health IT outpace the 

development and creation of regulations.s 

a. Does this division of cybersecurity roles and responsibilities at HHS complicate the ability of Philips 

to address cybersecurity within its products and organization? 

Answer: Yes, while many regulations that apply to cybersecurity in health care are well-meaning 

and individually effective, taken together they can impose a substantial legal and technical burden 

on health care organizations. These organizations must continually review and interpret multiple 

regulations, some of which are vague, redundant, or both. In addition, organizations must dedicate 

resources to implement policy directives that may not have a material impact on reducing risks.9 

b. Would additional coordination or clarity by HHS regarding which pieces of the agency have 

responsibility for cybersecurity, and when, help your organizations? 

Answer: Yes- Philips supports the Task Force recommendations on Improving Health Care 

Industry Cybersecurity (May 2017). 

Task Force Recommendation 1.1 -Create a cybersecurity leader role within HHS to align industryfacing efforts for health care cybersecurity. 

Currently many different programs and agencies within and outside of HHS are responsible for 

health care industry cybersecurity. While it is appropriate that different HHS components have their 

own roles and responsibilities based on their legislative authorities, it is also important to have a 

single person who is responsible for coordinating these activities. The benefits of this coordination 

include: 

• Allows one individual to look at cyber risks comprehensively, without being confined to 

specific program authorities, so that gaps can be more easily identified and addressed; 

• Provides a single point of entry for health care industry partners to discuss cybersecurity 

concerns with HHS, so that they may be directed toward the appropriate points of contact 

without having to navigate a complex organizational structure; 

• Helps prevent various components of HHS from engaging in conflicting or duplicative 

activities related to cybersecurity while promoting harmonization of regulations and 

guidance; 

• Promotes consistent cyber incident response with industry; 

s Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 11 

e Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity- Page 12 

7 
98 


• Enables HHS to advocate more effectively for health care cybersecurity as a whole; 

• Allows HHS to leverage cyber expertise from multiple programs; and 

• Ensures that Vulnerability Equities Processes, or any process that replaces it, takes the 

specific rules and implications of health care technology into account.1o 

Task Force Recommendation 1.2 Establish a consistent, consensus-based health care-specific 

Cybersecurity Framework. 

As we observed in other critical infrastructure sectors, a framework helped establish a consensusbased standard for improving the conversation around cybersecurity. Although NIST has 

developed a generic framework, health care (like other sectors) has many unique aspects such as 

its diverse resource capabilities, legacy systems that will persist for years, and the burden of low 

barriers for sharing of data that is essential for collaborative patient-oriented care. The framework 

should build upon the minimum standard of security required by the NIST Cybersecurity 

Framework and the HIPAA Security Rule to promote a single lexicon for the health care sector as 

well as standards, guidelines, and best practices. The complex environment requires certain basic 

standards that all stakeholders must meet and guidelines that allow flexibility for select issues. 

Without this framework, any of the countless constituents may pose a risk to the health care 

ecosystem.11 

Task Force Recommendation 1.3 Require federal regulatory agencies to harmonize existing and 

future laws and regulations that affect health care industry cybersecurity. 

The health care industry faces significant challenges due to federal and state cybersecurity laws 

and regulations that can be inconsistent and establish conflicting standards of compliance. These 

laws work in conjunction with laws on data breach notification, data disposal, and data security, 

often dictating different responses than federal laws. Additionally, complying with these laws and 

regulations is resource intensive and creates financial burdens for the health care ecosystem. 

Because compliance with the various laws and regulations is burdensome, health care 

organizations often prioritize compliance over risk-based planning. A priority for regulatory 

agencies should be to ensure consistency among various federal and state cybersecurity 

regulations so that health care providers can focus on deploying their resources appropriately 

between securing patient information and the quality, safety, and accessibility of patient care 

instead of focusing on statutory and regulatory inconsistencies. 

To demonstrate the complicated patchwork of laws, consider that in 2016, in addition to federal 

laws and regulations, members of the health care industry needed to adhere to computer crime 

laws touching upon issues such as: 

Unauthorized access, malware, and viruses in all 50 states; 

10 Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 23 

11 Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 24 

8 
99 


Denial of service attack laws in 25 states; 

Ransomware laws in two states, with another four states currently under consideration; 

Spyware laws in 20 states and two territories; and 

Phishing laws in 23 states and one territory 12 

c. Do you have any suggestions for actions that HHS could take to better coordinate or clarify its 

cybersecurity roles and responsibilities? 

Answer: Yes- Philips supports the Task Force recommended Action Items on Improving Health 

Care Industry Cybersecurity. 

Task Force Recommendation U Create a cybersecurity leader role within HHS to align industryfacing efforts for health care cybersecurity. 

Action Item 1.1.1: The HHS Secretary must name and resource a cybersecurity leader for 

sector engagement. 

Action Item 1.1.2: The HHS Secretary must task the cybersecurity leader to work with 

federal, state, and industry partners to create a plan to establish goals and priorities for 

health care sector cybersecurity. 

Action Item 1.1.3: The HHS Secretary must authorize the cybersecurity leader to define 

the reporting lines directly to other federal agencies tasked with cybersecurity such as the 

Department of Homeland Security (DHS}, the Federal Bureau of Investigation (FBI), and 

others. 

Action Item i.1.4: The cybersecurity leader must assist in streamlining HHS' outreach in a 

consistent manner to industry (e.g., branding, alignment with the NIST Cybersecurity 

Framework). 

Action Item 1.1.5: The cybersecurity leader should establish a mechanism for partnering 

with and gathering industry input to prioritize short- and long-term goals, such as a federal 

advisory committee or similar mechanism. 

Action Item 1.1.6: The cybersecurity leader should coordinate with U.S. and international 

intelligence agencies to ensure that Vulnerability Equities Process-like processes respect 

the special nature of digital health technology. Additionally, the cybersecurity leader should 

contribute to ongoing international policymaking and best practice development in this 

area.n 

Task Force Recommendation 1.2 Establish a consistent, consensus-based health care-specific 

Cybersecurity Framework. 

Action Item 1.2.1: HHS should complete work on the Act Section 405 (d) for Aligning 

Health Care Industry Security Approaches through a consensus-based approach to 

develop a health care sector specific cybersecurity framework. 

Action Item 1.2.2: HHS and NIST must develop guidance about how to apply the 

framework to the health care sector. 

12 Health Care Industry Cybersecurity Task Force Report on lrnproving Health Care Industry 

Cybersecurity - Page 25 

13 Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity- Page 24 

9 
100 


Action Item 1.2.3: Industry and government should partner to establish an evaluation 

mechanism and prioritized best practices to support the range of small to large 

organizations to consistently apply the NIST Cybersecurity Framework.14 

Task Force Recommendation 1.3 Require federal regulatory agencies to harmonize existing and 

future laws and regulations that affect health care industry cybersecurity. 

Action Item 1.3.1: HHS, in coordination with the private sector, federal, and state partners 

should look across HHS to harmonize regulations that directly or indirectly apply 

cybersecurity standards or best practices to reduce the burden on the industry. 

Action Item 1.3.2: HHS should make recommendations to Congress about required 

statutory changes. 

Action Item 1.3.3: HHS must publish standards and guidance consistent with the NIST 

Cybersecurity Framework. These should be developed based on the structure of the 

framework, as opposed to a mapping after the fact.36 

Action Item 1.3.4: HHS should establish a Task Force to explore options to incentivize riskbased cybersecurity in alignment with their existing oversight roles. 

Action Item 1.3.5: HHS should develop a conformity assessment model37 built upon a 

public/private partnership to standardize cybersecurity compliance consistently across 

programs. Conformity assessments conducted by private sector organizations can 

increase productivity and efficiency and by encouraging federal agencies to standardize 

expectations.1s 

Question 6: The public-private partnership model depends on trust and collaboration between government 

and private sector participants. This can prove challenging in some sectors, such as health care, where the 

Sector Specific Agency (SSA) is also the regulator for that sector. Some sectors- such as financial 

services have overcome these challenges to develop a robust relationship with their SSA. How much 

does the success of a public private partnership for cybersecurity depend on the level of trust and 

collaboration between private sector participants and their government counterparts, especially their sector 

specific agency? 

Answer: We found that the public-private partnership cultivated by the Task Force, which resulted in the 

development of the Report on Improving Health Care Industry Cybersecurity, has provided an opportunity 

to address significant cybersecurity concerns in the health care industry. The Task Force members found 

this engagement with other federal and private sector partners beneficial to understand our common 

cybersecurity challenges and concerns. Therefore, we believe the establishment of an ongoing publicprivate forum would serve to enhance cybersecurity discussions and protections as a critical component for 

the health care industry to increase patient safety.16 

a. Is this a challenge in the health care sector, where HHS is the Sector Specific Agency but also 

serves as the regulator? 

1• Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 24 

1s Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 25 

1e Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity- Page 4 

10 
101 


Answer: We wholeheartedly support full participation within the public-private sector and agree 

trust is paramount for any type of major information sharing in that environment. We do find that 

there are sometimes obstacles to realizing that trust when your government regulatory agency is a 

participant. However, the role of HHS is critical and we are 100% supportive of their participation in 

this process. If we have the ability to leverage lessons learned from other industries or sectors who 

have overcome similar challenges, we must take full advantage. 

One of the best working relationships Philips has is with the FDA as they conduct their workshops. 

We have the FDA currently participating in their 'memorandum of understanding', with the NHISAC and the Medical Device Innovation Safety and Security organization (MDISS). This brings 

manufacturers, researchers, technologists and regulators to the same table in order to develop an 

information sharing model- the MD-VIPER. 

As mentioned before, it is important that HHS identify a single point of contact to coordinate with 

the private sector, federal, and state partners to harmonize regulations that directly or indirectly 

apply cybersecurity standards or best practices. 

b. Does the fact that different parts of the health care sector are regulated by different components of 

HHS complicate this relationship? 

Answer: Yes. As discussed in our Report the multiplicity of actors in this space is often necessary 

to address a wide range of cybersecurity challenges and system types, and can be helpful in 

allowing these challenges to be viewed and addressed from multiple perspectives. It also has the 

potential to create complications. Some entities may be subject to regulation and oversight by 

multiple federal government entities, each with their own rules, which may be difficult to reconcile. 

Product and technology innovations for medical devices and health IT outpace the development 

and creation of regulations. While many regulations that apply to cybersecurity in health care are 

well- meaning and individually effective, taken together they can impose a substantial legal and 

technical burden on health care organizations. These organizations must continually review and 

interpret multiple regulations, some of which are vague, redundant, or both. In addition, 

organizations must dedicate resources to implement policy directives that rnay not have a material 

impact on reducing risks. 

At the same time, gaps in protections can leave key health care issues unaddressed and create 

holes in cybersecurity infrastructure for health information. Consider, for example, the different 

roles of FDA and OCR with respect to health information cybersecurity. FDA is charged with 

ensuring approved and cleared medical devices are safe and efficacious, whereas OCR is charged 

with oversight of the privacy and security regulations under HIPAA, which applies only to "covered 

entities" (e.g., most health care providers, health plans, and health care clearinghouses), and 

contractors acting on their behalf, known as "business associates." With the recent publication of 

the FDA's final guidance for manufacturers on device cybersecurity, the FDA has taken more steps 

to address the patient safety concerns generated by cybersecurity risks to medical devices. 

However, FDA oversight is limited to patient safety and does not extend to patient privacy. HIPAA's 

regulations focus on both privacy and security; however, medical device manufacturers may not be 

covered entities or business associates under HIPAA. This leaves a health care provider using a 

medical device with potentially greater responsibility for assuring privacy and security protections 

11 
102 


for health information created and shared by the device. While many stakeholders agree that 

protecting against cybersecurity threats should be a shared responsibility, to date, health care 

providers have shouldered an inordinate amount of the burden even when actions needed to 

improve security in the device have been outside their control. 

The challenges around the push and pull of the regulatory complexity associated with ensuring 

patient safety and patient privacy is growing with an increasing amount of information that is being 

shared digitally and the proliferation of the use of devices. The Health Information Technology for 

Economic and Clinical Health Act spurred investment in EHRs through billions of dollars of 

incentives to hospitals and clinicians under the "Meaningful Use" of EHR program. The Meaningful 

Use program combined with the Merit-Based Incentive Payment System will continue to push 

providers to use EHRs and other technologies to exchange patient information electronically. In 

addition, alternate payment models of care which rely heavily on the use of health IT combined 

with the increased capacity of medical devices to store a growing amount of PHI, means more 

patient data is at risk for cybersecurity attacks. Data collected for the good of the patients and used 

to develop new treatments can also increase cybersecurity risks to the health care system. 

However. to date there has been little focus on cybersecurity- while at the same time, the 

techniques being used by cyber criminals are growing increasingly sophisticated. According to a 

recent KLAS12 report, many survey respondents widely reported that their EHRs placed little 

attention on cybersecurity. Providers also report that many device manufacturers treat security as 

either an afterthought or that the attention is woefully inadequate.11 

c. Based on your experience, have other industries managed to navigate a similar situation, where 

their Sector Specific Agency is also their regulator? Or are there challenges unique to the health 

care sector its relationship to HHS that further complicate this dynamic? 

Answer: Our sector is not unique in being regulated by our SSA. For example, the US Department 

of Treasury functions as the SSA for the finance sector and U.S. Department of Energy (DOE) for 

the Energy sector. The Health care community routinely shares best practices across sectors to 

leverage lessons learned and strengthen our capabilities. For example, last month members of the 

community heard from our counterparts from these two industries at the Health Care Industry 

Cybersecurity (HCIC) Task Force Meeting held at HHS on April 21st. 

Our speakers from the Finance and Energy sectors included: 

• Brian Peretti, Director, Office of Critical Infrastructure Protection and Compliance Policy, U.S. 

Department of the Treasury 

• John Carlson, Chief of Staff, Financial Services Information Sharing and Analysis Center 

• Mike Smith, Senior Cyber Policy Advisor, Office of Electricity Delivery and Energy Reliability, 

U.S. Department of Energy (DOE) 

17 Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 12 

12 
103 


• Fowad Muneer, Program Manager, Office of Electricity Delivery and Energy Reliability, DOE 

Nadya Bartol, Vice President, Industry Affairs and Security Strategist, Utilities Telecom 

Council18 

At a macro level one assumes challenges in coordination between regulator and industry. We 

have found similarities as well as differences in meeting with our counterparts from different 

sectors. 

Currently in the HC sector, medical devices are deployed in a clinical setting. We do not yet have, 

but should have a medical certification that rates the vulnerabilities specific to those products. 

HHS should develop a conformity assessment model built upon a public/private partnership to 

standardize cybersecurity compliance. 

The FDA is the overarching governing body for medical device manufacturers as well as 

pharmaceutical companies, but the CMS is the governing body over the health delivery 

organizations. This dichotomy can lead to unintentional regulatory/guidance confusion. 

Question 7: Your organization is obviously larger and more well-resourced than a rural hospital or small 

physician practice. We've seen in other cases like the Target breach, however, that smaller organizations 

can be the "infection points" for larger organizations, due to the way that business relationships and 

networks are set up. Recognizing that cybersecurity is a collective responsibility, how do- or can -larger 

organizations assist in bolstering awareness and engagement of smaller participants in the sector? 

Answer: The Federal government along with health care industry leaders can have a profound impact on 

the resilience of the entire industry through collaboration. We have specifically outlined several action 

items in our Report including those found in Imperative 4, which is described below. 

Imperative 4: "Increase health care industry readiness through improved cybersecurity awareness and 

education." 

Cybersecurity can be an enabler for the health care industry, supporting both its business and clinical 

objectives, as well as facilitating the delivery of efficient, high-quality patient care. However, this 

requires a holistic cybersecurity strategy, Organizations that do not adopt a holistic strategy not only 

put their data, organizations, and reputation at risk, but also-most importantly-the welfare and safety 

of their patients. 

Cybersecurity must be governed with a collaborative approach whereby all members of the health care 

industry work together toward the common goal of protecting one another and the sector's most critical 

assets- patients. To achieve this requires an educated workforce and an informed public who make 

evidence-based decisions that are reliant on cyber-secure data. As part of this holistic security strategy, 

it is critical that a thorough baseline is established whereby inherent trust can be established between 

patients and providers, technologies and processes, and ultimately institutions and patients. 

1a Summary: Health Care lndustrv Cybersecurity Task Force Meeting Summarv- April 21 2016 

13 
104 


This will lead to a high level of confidence in which the industry understands cybersecurity hygiene and 

ultimately establishes trust throughout the health care continuum. Once a baseline level of hygiene is 

established, the industry must come together to develop a methodology to audit, measure, and 

continually steer the industry progressively forward 

The health care industry must increase outreach for cybersecurity across all members of the health 

care workforce through ongoing workshops, meetings, conferences, and tabletop exercises. 

Additionally, the health care industry must provide patients with information on how to manage their 

health care data by developing consumer grading systems for non-regulated health care services and 

products. Lastly, the health care industry must develop cyber literacy programs to educate decision 

makers, executives, and boards of directors about the importance of cybersecurity education. 19 

a. Are there factors that impede collaboration within the sector? 

Answer: Yes. One example is the awareness that cybersecurity risks and threats are 

inconsistently understood across the sector when making both personal and organizational 

decisions regarding cybersecurity.2o The susceptibility to cyber threats exists for many 

organizations because most people are neither aware of the risks, nor have the tools to protect 

their systems. Cybersecurity is a shared responsibility that requires diligence from all who interact 

with or facilitate the collection, maintenance, and exchange of health care information and use 

interconnected medical systems. Poor cybersecurity practices at any level can become the cause 

of a breach and leave patients exposed to unexpected harm to their privacy or even the care they 

receive. 

There is currently a lack of shared awareness of cybersecurity risks and best practices among 

health care systems. The health care sector should engage with HHS and DHS to build on the 

established National Cybersecurity Awareness Campaign to ensure broad outreach to the sector 

and develop a baseline cybersecurity understanding at all levels, as well as tailored information for 

health care executives, clinical providers, patients, and other key groups that may not possess 

fluency in IT matters. This awareness will provide them the ability to use health care IT in a riskinformed manner so they can take the necessary steps to better protect health care information .21 

Question 8: Are there lessons from the progress of cybersecurity in the medical device sector that can 

benefit other parts of the health care sector, as well as the sector as a whole? If so, what are some of these 

lessons? 

Answer: Yes. One such example would be the development of the Medical Device Vulnerability 

Intelligence Program for Evaluation and Response (MD-VIPER). The goal of the program is to create an 

open community of Medical Device Cybersecurity stakeholders (Manufacturers, Health care Delivery 

1s Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 40 

2o Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity - Page 41 

21 Health Care Industry Cybersecurity Task Force Report on Improving Health Care Industry 

Cybersecurity- Page 44 

14 
105 


Organizations, Independent Security Researchers, Regulatory Agencies, etc.) to promote a consensus & 

consistency of approach and process, to contribute significantly to Medical Device Cybersecurity education, 

as well as to foster situational awareness of Medical Device threats, best practices and mitigation 

strategies. 

The MD-VIPER portal is hosted by the HS-ISAC, the reporting process is: 

Vulnerability reporting agent contacts MD-VIPER 

Conversation between reporting agent and MD-VIPER 

Reporting agent proceeds with sharing of vulnerability 

Once vulnerability is reported, all data is stationary until a data owner, manufacturer, advises in 

writing to share the data 

If a third party shares the data, they should be able to advise us, in writing, to share the data 

Participation in MD-VIPER is: 

Open to all medical device security stakeholders 

Free and voluntary (once registration and NDA process are complete) 

Tracking each event (submissions, data sharing event, communication event, etc.) 

Each event is triggered by the manufacturer 

Collaboration with manufacturer 

Responsible sharing of information regarding vulnerabilities and threats in light of specified 

vulnerabilities for stakeholder awareness 

Question 9: During the hearing, we talked a great deal about the HHS as the SSA, and the NH-ISAC, but 

we didn't really touch on the Government Coordinating Council. What role does the GCC play for each of 

your organizations? 

Answer: The work of the Health care and Public Health GCC includes, but is not limited to: 1) contributing 

information and data, and recruiting subject matter experts as needed to assist in the development and 

execution of the Sector Specific Plan (an annex to the NIPP) and Sector Annual Report; 2) collaborating 

with its private sector counterpart, the sec, to identify, prioritize and protect sector critical infrastructure; 3) 

collaborating with those sectors responsible for protection of assets, systems, networks, or services upon 

which the health care and public health sector is dependent; and 4) assisting in the development of 

products as requested by the Department of Homeland Security (DHS). 

The GCC will work toward accomplishing the following goals: 

1. The GCC membership will "leverage relationships and resources to assess and analyze threats to 

vulnerabilities of, and consequences to HPH Sector critical infrastructure to inform risk management 

activities. Ensure that approaches consider the physical, cyber, and human elements of critical 

infrastructure security and resilience, supply chain issues and interdependencies with other sectors". 

2. The GCC membership will "execute risk mitigation activities in a prioritized manner with clear plans 

and metrics for success". 

3. The GCC membership will "enhance existing and develop new mechanisms to ensure bidirectional 

sharing of information··. 

4. The GCC membership will "exercise the ability of the sector to respond to natural or manmade 

disasters and incorporate lessons learned into future exercises and corrective actions". · 

15 
106 


5. The GCC membership will "regularly review and assess the active roster of participating members to 

ensure appropriate representation is maintained to enhance sector resilience, facilitate necessary 

information sharing within the public sector and private sector offices and respond to emergency 

events".22 

a. Are there additional initiatives that you believe that the GCC could take, or roles that it could fill, 

that would help your organizations and the health care sector as a whole better address 

cybersecurity? 

Answer: Neither Philips nor AdvaMed are current members of the Government Coordinating 

Council, however the Council's success will build upon the notion that public-private partnerships 

can help realign certain agencies inside the government to more efficiently address the challenges 

of cybersecurity. 

Question 10: Would you support HHS making a recommendation that encourages participation in !SAC? 

Answer: Yes, I would. Philips would also support the Department's enthusiastic recommendation to OEMs 

to join the HS-ISAC without reservation. 

We concur with the submitted testimony on behalf of the MH-ISAC: "One of the greatest challenges for the 

NH-ISAC and alii SACs is the lack of awareness amongst the critical infrastructure owners and operators, 

particularly the smaller owners and operators, that the I SACs exist and are a valuable tooL Numerous 

incidents have shown that effective information sharing amongst robust trusted networks of members works 

in combatting cyber threats. 

Government, and specifically the Sector Specific Agencies (SSAs) should regularly and consistently 

encourage owner/operators and especially at the Board and CEO level to join their respective !SACs. This 

has been very effective in the financial sector where the United States Department of the Treasury, the 

regulators and state agencies have been strongly encouraging membership in the FS-ISAC as a best 

practice. Currently, not all SSAs support their sector designated !SACs in the same manner."23 

a. Do you believe that it would improve the functioning of the !SAC, and therefore cybersecurity 

across the sector, for HHS to make such a recommendation? 

Answer: Yes. A recommendation from HHS for Health care OEMs to join the HS-IASC would 

directly benefit our combined efforts. As I stated in my prepared testimony "we commend the FDA 

for its proactive leadership role over medical device cybersecurity. The FDA has worked closely 

with the medical technology industry and the broader health care ecosystem to ensure medical 

device cybersecuri!y is considered and addressed throughout all stages of product design and use 

the FDA entered into a Memorandum of Understanding ("MOU") with the National Health 

22 Health care and Public Health Sector Government Coordinating Council Charter- Pages 2-3 

z> Testimony of Denise Anderson On Behalf of the National Health Information Sharing & 

Analysis Center- http://docs.house.gov/meetings/IFIIF0212017040411 058311HHRG-115-IF02-

Wstate-AndersonD-20170404.pdf 

16 
107 


Information Sharing and Analysis Organization ("NH-ISAC") and the Medical Device Innovation, 

Safety and Security Consortium ("MD ISS") to promote cybersecurity information sharing for 

medical devices."24 As I relayed in my written testimony HS-IASC has recently launched a program 

called the Medical Device Vulnerability Intelligence Program for Evaluation and Response, or MDVIPER. MD-VIPER provides a streamlined mechanism for medical device manufacturers to submit 

and share information concerning cybersecurity-related issues, as well as other members of the 

broader health care ecosystem. 

b. Do you think there are potential consequences- real or perceived- from HHS taking this 

approach? 

Answer: In light of the FDA's significant work and achievements to date, and the Agency's staff 

ongoing engagement with industry, we believe that the FDA's collaboration with the MS-IASC 

serves as an example to all regulatory bodies with respect to the type of interaction, collaboration, 

and guidance an agency should provide to its regulated industry. 

Question 11: Recently in the cybersecurity community, there has been some confusion regarding I SACs 

and ISAOs. Do you think that this confusion has caused any issues with regards to cybersecurity protocol 

-specifically facilitating effective situational awareness and response activities, particularly when an 

incident occurs? 

Answer During her testimony, National Health Information Sharing and Analysis Center (NH-ISAC) 

President Denise Anderson stated that the confusion between the ISAC definition and the I SAO definition 

must be eliminated.2s 

As you are aware the Department of Homeland Security states an I SAO is a group created to gather, 

analyze, and disseminate cyber threat information. Unlike I SACs, ISAOs are not directly tied to critical 

infrastructure sectors, as outlined in Presidential Policy Directive 21. ISAOs offer a more flexible approach 

to self-organized information sharing activities amongst communities of interest such as small businesses 

across sectors: legal, accounting, and consulting firms that support cross-sector clients, etc. 26 

ISAOs are useful communities. However, the flexibility within the construct of an I SAO that allows for 

broader communications, lacks protections that encourage vigorous sharing of information. 

During the hearing, Denise Anderson stated: "!SACs offer several vehicles to share effective techniques 

and practices for preventing, detecting and managing cyber security risk that are often un-conventional 

controls (definition: controls that are designed and implemented independent of any risk framework, 

standard or regulatory guidance), ISAOs don't offer vehicles for this type of sharing." 

a. What do you think should be done to address this confusion? 

2•Michael C. McNeil, Philips- AdvaMed, the Advanced Medical Technology Association 

Testimony - http://docs.house.gov/meetings/IFIIF0212017040411 05831 /HHRG-115-IF02-WstateMcNeiiM-20170404.pdf 

2s Health IT Security - http://healthitsecurity.com/newslhealth care-information-sharing-needstressed-in-recent-hearing 

2s DHS FAQ on ISAOs- https:l/www.dhs.gov/isao-faq 

17 
108 


Answer: As Denise Anderson stated at the hearing the government can aid information sharing 

by encouraging owners and operators of critical infrastructure to join their respective sector I SACs 

and to offer financial incentives (i.e. tax breaks) for owners and operators to join I SACs. 

Furthermore, the government can: 

Recognize I SACs and the role that they play in critical infrastructure protection and 

resilience 

Protect information sharing by ensuring data shared amongst members is protected 

Place strong, defined and permanent cybersecurity liaisons and leadership within the 

SSAs to advocate the public private partnership when it comes to cyber matters 

Information sharing is designed to "create situational awareness" so risk-based decisions can be 

made. It should also "allow operational components within owner/operation organizations that have 

direct actionable control over the content they are sharing, to perform an action. The focus needs 

to be on enhancing the ability of operational groups to work closely with each other."21 

1#1# 

21 Health IT Security- http://healthitsecuritv.com/newslhealth care-information-sharing-needstressed-in-recent-hearing 

18 
109 


GREG WALDEN, OREGON 

CHAIRMAN 

Mr. Terry Rice 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

ONE HUNDRED FIFTEENTH CONGRESS 

<!Congress of tbe mniteb ~tates 

J!)ousc of i'\cprescntatlbcs 

COMMITIEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFICE BuiLDING 

WASHINGTON, DC 20515-6115 Majority 12021 225-2927 

Minority l202l :?2&--3641 

April27, 2017 

Vice President, IT Risk Management 

Chief Information Security Officer 

Merck & Company, Inc. 

2000 Galloping !!ill Road 

Kenilw011h, NJ 07033 

Dear Mr. Rice: 

Thank you for appearing before the Subcommittee on Ove1·sight and Investigations on Tuesday, 

April 4, 2017, to testify at the hearing entitled "Cybersecurity in the Health Care Sector: Strengthening 

Public-Private Pminerships." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains open 

for ten business days to permit Members to submit additional questions for the record, which are attached. 

The format of your responses to these questions should be as follows: ( 1) the name of the Member whose 

question you arc addressing, (2) the complete text of the question you are addressing in bold, and (3) your 

answer to that question in plain text. 

To facilitate the printing of the hearing record, please respond to these questions with a trm1smittal 

letter by the close of business on Thursday, May ll, 2017. Your responses should be mailed to Elena 

Brennan, Legislative Clerk, Committee on Energy and Commerce, 2125 Rayburn House Office Building, 

Washington, DC 20515 and e-mailed in Word format to Elena.J1L\'!lll<]]J({J)JnaUJ)om;~,.,g\!_\!. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

Sit~~ 

Tim Murphy 

Chairman 

Subcommittee on Oversight and Investigations 

cc: The Honorable Diana DeGctte, Ranking Member, Subcommittee on Oversight and Investigations 

Attachment 
110 


DATE: May 30, 2017 

TO: House Energy & Commerce Committee, 

Subcommittee on Oversight and Investigations 

FROM: Terry Rice, VP, IT Risk Management & CISO, 

Merck & Co., Inc. 

SUBJECT: Answers to Follow-up Questions on 

Cybersecurity in the Health Care Sector: Strengthening 

Public-Private Partnerships 

ME I< 

INVENTING FOR LIFE 

2000 Galloping Hill Road 

Kenilworth, NJ 07033 U.S.A. 

T: 908-243-1929 

E: terence_rice@merck.com 

merck.com 

Thank you for the opportunity to provide additional input on this important topic. 

The Honorable Tim Murphy 

1. I understand that HHS, apparently at the request of DHS, is establishing a Cybersecurity 

Communications and Integration Center specific to the health care sector, the "HCCIC." It 

would appear that this organization, at least on some level, replicates the role of an /SAC in 

other sectors. 

a. What is your understanding of the effort and how does it relate to our organization? 

Representatives from HHS have discussed the notion of an HCCIC in conversation; 

however, I have not seen any written description of responsibilities and functions. 

Clearly, there is a need for better coordination among government healthcare entities 

at the federal, state, local, and tribal levels. This is an area in which the HCCIC 

could facilitate the flow of rapid and accurate information among all governmental 

healthcare entities. Information collected from state, local, and tribal entities could 

be correlated with federal data to present a more comprehensive picture of the threat 

facing the health care sector. 

The HCCIC could also serve as a bridge into the intelligence and law enforcement 

community on behalf of the sector. There is a strong argument given the diversity of 

the sector and the unique risks borne by each sub-sector component that an HCCIC 

could collect and process intelligence collection requirements against each of these 

risks. The HCCIC could aggregate information about sub-sector risks and convert 

those into a list of prioritized intelligence requirements/request for information against 

which the NCCICIDHS, the US intelligence community and law enforcement might 

provide actionable information. This role would be akin to the way each of the 

military services maintains a small coordination presence within each of the major 

Department of Defense (DoD) intelligence agencies. 

The HCCIC could also serve as the primary coordination entity with governmental 

healthcare organizations around the world. While the provider and payer 

subcomponents of the US healthcare system are mostly based within the US, many 
111 


of the pharmaceutical, life sciences, medical device manufacturers, and health 

technology companies operate on a global scale and need information from non-US 

governmental entities to protect their overseas assets. This applies to both the 

physical as well as cyber threats. 

The recent Wannacry ransomware incident is a great example of where international 

coordination among international healthcare entities could have helped to better 

protect multinational entities and arguably US domestic providers and payers. 

Apparently, lack of appropriate cyber intelligence sharing protocols and information 

dissemination policies hindered NHS from sharing actionable intelligence with its 

peers in HHS. The HCCIC could provide that bridge. 

b. Based on your experience, are there other sectors that have their own CCIC? I am 

not aware of any of any other sector having its own CCIC; however, the Department 

of Treasury and the financial services industry created the Treasury Cyber 

Intelligence Group (GIG) to serve as the primary intelligence clearing house to/from 

the private sector. The GIG helps coordinate the collection and dissemination of 

timely intelligence from the federal government through the FS-ISAC and the 

Homeland Security Information Network (HSIN) as GIG Circulars. An example GIG 

Circular is attached. 

My understanding is the GIG also helps to coordinate the collection of information 

against prioritized intelligence requirements and requests for information coming 

from the private sector through the FS-ISAC. Cleared intelligence analysts within the 

GIG can identify the right sources and agencies from which to provide the 

information requested by the private sector. 

c. Do you think this will be beneficial in addressing some of the challenges in the health 

care sector? Yes, it is likely be a positive development for the healthcare sector 

especially if the HCCIC were to operate the same roles and responsibilities as GIG. 

d. Are there any potential downsides to having an "HCCIC?" If so, what are they? I 

see two potential downsides to the use of an HCCIC. The first is the possibility of 

creating additional confusion among the smallest members in the sector. These 

small companies already have local law enforcement, their local FBI office, DHS, and 

multiple Information Sharing and Analysis Organizations (ISAOs) claiming to be the 

primary gateway for their cyber intelligence requirements. This situation is made 

worse by the rapidly expanding network of private security intelligence firms. Smaller 

entities might be overwhelmed by another entity entering the mix especially if they 

have to manually correlate the data that comes from different intelligence sources. 

The larger healthcare companies have the personnel and/or tools to handle multiple 

data feeds from each of these entities simultaneously. 

The second issue is the possible duplication of effort between the HCCIC and the 

NCCIC. Given the well-reported shortage of cybersecurity professionals to meet the 

needs of government and industry, any redundancy would be a misuse of critical 

resources. This risk could be mitigated by having well-defined roles and 

responsibilities for the HCCIC that ensures that they do not duplicate the work of the 

NCCIC. This risk could be further mitigated by co-locating the HCCIC and NCCIC 

staff. 

Page 2 
112 


2. According to the membership roster, each of your organization is a member of the 

Healthcare and Public Health Sector Coordinating Council. We know the Healthcare SCC 

has many roles and responsibilities beyond cybersecurity, but as cybersecurity becomes 

more important across the industry, the sec will arguably have a big role to play. What 

services, products, or value does the SCC offer regarding cybersecurity? The SCC 

currently conducts a monthly telecon for SCC members. Cybersecurity is a standing topic 

on the sec agenda. At least one member of the sec provides an update on cybersecurity 

matters; the update typically includes information on new threats, critical vulnerabilities, or 

emerging cybersecurity legislation and regulations. The SCC also conducts a joint session 

with the Government Coordinating Council (GCC) at least once a year. These tend to be 1-

2 day events and are held in person in the Washington DC area. The joint sessions also 

include cybersecurity as a recurring topic. 

a. Do you get the sense that their role and contributions are understood and 

appreciated across the sector? No, there is limited participation by key members of 

healthcare sector in the SCC meetings. We need to have a much broader and more 

senior membership to make the sec more effective. 

b. Are there ways that the sec could be more effective in assisting the sector with 

cybersecurity challenges? As I stated in my previous testimony, one of the most 

significant ways that HHS could facilitate the growth and development of the sec 

and the NH-ISAC is through the appointment and declaration of a private sector 

cybersecurity liaison whose primary purpose would be to educate senior executives 

within the sector on the benefits of participating in both of these organizations. The 

Financial Services SCC's and FS-ISAC's success was in part due to the strong and 

repeated endorsements by the Department of Treasury. 

3. My staff and I have heard from stakeholders in other industries, most notably the electricity 

sector, that they have broad, senior executive level engagement on their SCC, and that this 

engagement has significantly increased the effectiveness of the council and other aspects of 

their public-private partnerships, such as their /SAC. Who from your organizations 

participates in the Healthcare SCC? I am the primary participant in the SCC sessions. 

a. Would a similar model, with broad senior executive engagement on the SCC, work in 

the health care sector? Why or why not? Yes, as long as the agenda and topics of 

discussion were timely, relevant, and geared toward senior executive participation. 

There has been some inconsistency in the type and level of discussions within the 

Healthcare & Public Health (H&PH) SCC meetings most likely due to the broad 

backgrounds of those participating. The SCC should leverage more working groups 

and committees to increase participation at multiple levels. 

b. Do you have any other thoughts on the SCC and its importance or the roles it plays 

in health care sector cybersecurity? The sec is still early in its maturity with respect 

to the topic of cybersecurity. There is a lot more that can be done in this area. For 

example, there is a group of approximately 75 CISOs from the healthcare industry 

that meet independently on a semiannual basis to discuss common topics of interest 

within the sector. The group often includes a representative from HHS. This group 

has twice volunteered to be the cybersecurity working group for the sec. 

Page 3 
113 


The SCC should also consider the possibility of the NH-ISAC providing a full-time 

cybersecurity analyst to the sec to handle and coordinate cybersecurity matters 

across the organization. This approach is like the one adopted by the financial 

services industry. This would provide a much-needed full time analyst to track the 

wide array of threats, vulnerabilities, regulations, and other rapidly changing 

variables that impact each sec member's organization. The analyst would also 

handle any queries from the sec members related to cybersecurity and route those 

to the NH-ISAC, the HCCIC, and/or the entity in the best position to the answer the 

request. 

4. As the Sector Specific Agency for the healthcare sector, HHS has a big role to play in 

guiding and supporting industry cybersecurity efforts. Can each of you briefly tell us how 

HHS, as the SSA for your sector, provides cybersecurity guidance and support for your 

organization? HHS has several entities that provide some level of cybersecurity support 

and guidance for our organization. The Assistant Secretary for Preparedness and 

Response has the primary responsibility for healthcare and public health critical 

infrastructure protection. However, that organization's responsibilities go well beyond 

cybersecurity matters and cover any hazard that might disrupt or negatively impact the 

delivery. Consequently, there is limited depth in cybersecurity area. The HHS Chief 

Information Security Officer (CISO) is primarily responsible for protecting the assets, 

systems and information processed, stored, or transmitted within HHS. Traditionally, this 

role was focused internally. More recently the office has started working closely with the 

NH-ISAC and others to explore ways in which we can work together to secure the entire 

industry. The CISO's office has the greatest depth of cybersecurity skills and expertise. 

We also work with and receive guidance from the FDA's Center for Devices and 

Radiological Health. This organization has been the focal point for recent and emerging 

guidance concerning cybersecurity controls for medical devices and applications. Because 

the topic of cybersecurity often touches on the issue of privacy, we also work with the HHS 

Office of Civil Rights on privacy guidelines for the industry. Finally, given the rapidly 

expanding use of information technology within the healthcare industry, there are occasional 

interactions with the Office of the National Coordinator for Health IT. 

a. Who in HHS, or what office, is considered the "go-to" contact for cybersecurity 

issues? It is hard to pinpoint one office as the "go-to" contact today. The primary 

contact changes based on the specific topic and area in which a question or issue 

arises. 

5. My understanding is that that there are multiple agencies within HHS that have pieces of 

healthcare cybersecurity. For example, the Office of Civil Rights deals with data breaches, 

the Food and Drug Administration deals with medical devices, and the list goes on for other 

components of the agency. What parts of HHS does Merck work with when it comes to 

cybersecurity? See previous response. 

a. Does this division of cybersecurity roles and responsibilities at HHS complicate the 

ability of Merck to address cybersecurity within its products and organization? While 

the division of responsibilities can make seeking cybersecurity guidance more 

complicated, this complexity has had limited impact on the security of our products 

and our organization. However, the lack of a central, cybersecurity liaison to the 

Page 4 
114 


private sector is likely to have more significant benefit to the smallest members of the 

healthcare system. 

b. Would additional coordination or clarity by HHS regarding which pieces of the 

agency have responsibility for cybersecurity, and when, help your organizations? 

Yes, but the greatest beneficiaries are likely to be the smallest entities within the 

healthcare system 

c. Do you have any suggestions for actions that HHS could take to better coordinate or 

clarify its cybersecurity roles and responsibilities? HHS should establish and appoint 

a senior level cybersecurity liaison to the private sector whose primary responsibility 

would be to educate senior business executives within the sector on the increasing 

cybersecurity risks that could impact critical healthcare operations. HHS should also 

consider conducting a series of "table top" exercises across the sector that challenge 

the cybersecurity policies, processes and procedures. These exercises can help to 

identify gaps and overlaps in responsibility as well as highlight areas that need 

additional focus by HHS and the sector. Last year's Cyberstorm V exercise, which 

was hosted by DHS, focused on retail and healthcare. This three-day exercise 

quickly identified a number of gaps. Unfortunately, DHS only conducts these 

exercises every two years and focuses on different industry sectors each time. HHS 

should take on responsibility for hosting healthcare specific exercises on a more 

frequent basis. The Hamilton Series hosted by the Department of Treasury is 

arguably the gold standard in this area. 

Another critical activity that HHS should pursue is the identification of the most 

critical assets across the sector whose loss or disruption could cause a national 

emergency. This analysis has been done at the highest level and only in the 

abstract terms. The assessment needs to be more detailed and clearly identify the 

most critical systems and dependencies. The output of this work should be used to 

select the scenarios for the exercises mentioned in the previous paragraph. 

However, the aggregation of this type of extremely sensitive information might cross 

into the classified realm and HHS needs to be able to support any requirements that 

stem from this (e.g. clearances for private sector members). 

6. The public-private partnership model depends on trust and collaboration between 

government and private sector participants. This can prove challenging in some sectors, 

such as health care, where the Sector Specific Agency (SSA) is also the regulator for that 

sector. Some sectors, such as financial services, have overcome these challenges to 

develop a robust relationship with their SSA. How much does the success of a public private 

partnership for cybersecurity depend on the level of trust and collaboration between 

private sector participants and their government counterparts, especially their sector specific 

agency? Trust is the most critical enabler of any partnership, especially one in which parties 

agree to share sensitive information about their vulnerabilities and incidents. If a member 

feels that their information may be used for nefarious purposes or that others don't afford the 

information the same level of protection they would utilize in protecting this information 

internally, this will significantly inhibit information sharing. Trust is not something that can be 

regulated. Trust has to be developed and earned over time often with very small steps. 

One of the biggest challenges we had following the creation of the NH-ISAC was getting 

members to share data. Everyone was willing to receive data on Day 1. Very few were 

willing to share their own data. It took a couple of large companies which had previous 

Page5 
115 


experience with information sharing in the defense and finance industries to commit to share 

before we started gaining traction. The broad and deep information that was shared 

between HHS and the I SAC during the recent Wannacry worm was a crucial step in further 

building that trust. The I SAC even sent an employee from one of the member companies to 

HHS Headquarters to participate in the incident response activities. That individual served 

as a bridge to and from the private sector. That individual also helped facilitate HHS access 

into a real-time chat service that was being utilized by threat analysts within the private 

sector. This went a long way to establish trust between the two entities. 

a. Is this a challenge in the health care sector, where HHS is the Sector Specific 

Agency but also serves as the regulator? I don't think this is a specific problem 

within the healthcare sector. Many of the SSAs for other sectors also regulate the 

industries with whom they share intelligence. For example, the Department of 

Treasury (SSA for Finance) and the Department of Energy (SSA for Energy Sector). 

One issue that does create a unique disincentive within the health and public health 

sector is the publication of victims of breaches in which more than 500 health records 

have been exposed. This "wall of shame," as it is commonly referred to within the 

industry, does nothing to describe the state of security within the victim that was 

breached nor the sophistication of the attack used to gain access to the victim. 

Therefore, a well-defended organization that is breached by a nation-state actor 

suffers the same ignominy as a poorly defended organization that was breached by a 

novice hacker utilizing widely available tools. 

As I stated in my previous oral testimony, I believe that HHS should move toward a 

model more closely aligned with methods used by the National Transportation Safety 

Board investigates accidents and incidents with the goal of getting to the root cause 

and correcting any deficiencies especially those that might be systemic across the 

industry. 

b. Does the fact that different paris of the health care sector are regulated by different 

components of HHS complicate this relationship? No, I don't think this is an issue. I 

think the model established by the Department ofTreasury and its agencies (e.g. 

Office of the Comptroller of the Currency) have created an effective way to work 

together. 

c. Based on your experience, have other industries managed to navigate a similar 

situation, where their Sector Specific Agency is also their regulator? Or are there 

challenges unique to the health care sector its relationship to HHS that further 

complicate this dynamic? Yes, I believe the Financial Services Industry, the Energy 

Sector, and the Defense Industrial Base have established trust and processes to 

facilitate and encourage the sharing of threat, vulnerability, and incident data. 

7. Your organization is obviously larger and more we/1-resourced than a rural hospital or small 

physician practice. We've seen in other cases like the Target breach, however, that smaller 

organizations can be the "infection points" for larger organizations, due to the way that 

business relationships and networks are set up. Recognizing that cybersecurity is a 

collective responsibility, how do - or can - larger organizations assist in bolstering awareness 

and engagement of smaller participants in the sector? There is a tremendous potential for 

larger and better resourced organizations to share the policies, procedures, techniques, and 

Page6 
116 


solutions with smaller entities across the sector. To this end, the NH-ISAC has created a 

number of working groups that are seeking to leverage the resources of the larger members 

but with input from all to develop capabilities that can be shared across the sector. For 

example, the NH-ISAC Big Data and Analytics Working Group published a guide on the 

security of big data services that can be utilized by all members of the I SAC. The NH-ISAC 

Threat Intelligence Working Group has tasked a number of the largest members to write 

software code to help identify specific types of attacks within organization. This code will be 

donated freely to other healthcare members. Finally, approximately ten of the largest 

healthcare companies within the NH-ISAC have funded an effort called Cyberfit to create a 

suite of shared services that would have standardized terms and conditions of use and 

aggressive, pre-negotiated pricing. Initially these services would function as a group 

purchasing arrangement in which one or more vendors would provide the Cyberfit services 

but over time the NH-ISAC consider making these internal services provided by the NHISAC. 

a. Are there factors that impede collaboration within the sector? There are two issues 

that have been discussed as impeding collaboration with the sector. The first is the 

Stark Law which is designed to prohibit physician self-referral. Some entities, 

particularly providers, have raised concern that the use of shared cybersecurity 

services could be interpreted as a violation of the Stark Law. One way this issue 

could be addressed is to create a specific exemption for cybersecurity services. 

The second topic of concern is the potential for eDiscovery requests to impede 

sharing within an I SAC. If organization A suffered a breach and entered into 

litigation, there is the possibility that opposing council could serve the I SAC with a 

discovery request to show that organization A was less protected than other 

members of the I SAC or opposing council could use the same discovery request to 

find other victims of the same attack and potentially widen the case. We recently 

noted that the Auto-I SAC received a discovery request as a result of litigation one of 

its members was facing. Fortunately, the discovery request was quashed but the 

issue had a chilling effect on information sharing by a number of members within the 

healthcare industry. 

8. During the hearing, we talked a great deaf about the HHS as the SSA, and the NH-ISAC, 

but didn't really touch on the Government Coordinating Council. What role does the GCC 

play for your organization? The GCC plays a very limited role. In fact, the only interaction 

we have is during the semi-annual meetings that are conducted between the GCC and 

SCC. There is lots of room to improve this dialogue. In fact, I believe that both the GCC 

and sec should have cyber working groups that would work closely together throughout the 

years on cybersecurity topics that are relevant to the industry. If the such a mechanism were 

in place, the need for a Healthcare Industry Cybersecurity Task Force might have been 

obviated. 

a. Are there additional initiatives that you believe that the GCC could take, or roles that 

it could fill, that would help your organizations and the health care sector as a whole 

better address cybersecurity? The most immediate activity would be to take a cosponsorship role in conducting a series of cybersecurity "table top" exercises with the 

SCC, the HCCIC, and the NH-ISAC. It is very likely these exercises would highlight 

a large number of other possibilities for improvement. The Defense and Finance 

industries have found similar exercises invaluable. 

Page 7 
117 


9. Would you support HHS making a recommendation that encourages participation in the 

/SAC? Absolutely and unequivocally yes. 

a. Do you believe that it would improve the functioning of the /SAC, and therefore 

cybersecurity across the sector, for HHS to make such a recommendation? Yes, 

particularly if that recommendation were directed to the senior executives (e.g. CEO 

and executive committees) at each entity within the health care industry. Most of the 

cybersecurity professionals already understand the benefits of information sharing. 

Getting senior executive sponsorship is likely to remove any real or perceived 

obstacles to sharing. 

b. Do you think there are potential consequences- real or perceived- from HHS taking 

this approach? No. 

10. Recently in the cybersecurity community, there has been some confusion regarding /SACs 

and ISAOs. Do you think that this confusion has caused any issues with regards to 

cybersecurity protocol- specifically facilitating effective situational awareness and response 

activities, particularly when an incident occurs? Yes. I think there has been a tremendous 

amount of confusion in the use of the term I SAO and I SAC. I have rarely heard two or more 

individuals offer consistent definitions of these terms. Part of the confusion stems from the 

fact many of the sixteen critical infrastructure sectors had not established an effective or 

well-recognized !SAC when the concept of an !SAO was introduced through Executive Oder 

13691. Following publication of the EO, a wide array of existing associations, organizations, 

and companies attempted to brand themselves as ISAOs. While these additional groups 

may be helpful for sub-sector components or within geographic areas, it has made it hard for 

the NH-ISAC to recruit members. 

a. What do you think should be done to address this confusion? I think each sector 

specific agency should identify who the !SAC is for their respective sectors so there 

is no confusion. Additional information sharing mechanism should be encourage but 

there should be no dispute on which entity is the primary I SAC for each critical 

infrastructure sector. For the health care sector, HHS should clearly specify that the 

NH-ISAC is the I SAC for the health and public health sector but that it also 

encourages members of the sector to also participate in other ISAOs that help meet 

their business needs 

The Honorable Buddy Carter 

1. When we think about cybersecurity and health, most people seem to understand the 

dangers regarding privacy of their personal health information. But, what most people don't 

know is that this kind of theft can have a direct impact on your health. As a pharmacist, I 

also know that if we don't catch medical identity fraud, it can have serious physical 

consequences for patients. Can you elaborate on the consequences of medical identity 

theft? Cybersecurity professionals generally think about three consequences that stem from 

any security incident. First is the loss of confidentiality of sensitive information. Second, is 

the loss of integrity of critical data. The third is the loss of availability of data, service or 

function. In the case of medical identity theft, all three consequences can occur often each 

with the potential to cause significant patient harm. When confidential personal health 

information is exposed, the data can be used to conduct fraud. In fact, recent incident data 

Page8 
118 

Æ 


indicates there has been an uptick in Health Savings Account/Flexible Spending Account 

theft given the large amount of medical information that has been exposed over the past 

couple of years. Confidential healthcare information can also be used to extort money from, 

or blackmail victims, particularly if their compromised healthcare information includes 

medical issues that have a social stigma. Medical identity theft can also lead to data 

integrity issues in health records if the stolen information is used to receive medical services. 

In this situation, accurate information in the victim's medical file may be overwritten by data 

from the person impersonating the victim which could lead to harm the next time the victim 

receives medical treatment. Finally, a thief may use stolen credentials (e.g passwords) to 

gain access to the patient's records and delete data or modify data that could make the 

information inaccessible to the victim and/or medical professionals. This loss of availability 

could cause patient harm. 

2. The GAO recently released a study analyzing Identify Theft Services. The report details the 

dangers that we have discussed here. Have you reviewed the study? How do you propose 

we counter these very real threats to our health care? Yes, I am aware of and have 

reviewed the study. I believe there are at least two initiatives that could reduce the 

likelihood of medical identity theft. The first is to prohibit the use of the Social Security 

Number as a primary authenticator to any health system or service. Given the wide array of 

personal information breaches that have occurred over the last 5-10 years, SSNs are 

frequently available for sale on illicit online services. A criminal can often gain the SSN of a 

victim he/she wants to target by utilizing one of these illicit services. Therefore, SSNs should 

never be used as a mechanism for verifying a user's identity. 

The second recommendation is to use strong identity and access mechanisms to gain 

access to health information and services. The National Institute for Standards and 

Technology (NIST) and the office responsible for the National Strategy for Trusted Identity in 

Cyberspace (NSTIC) have developed standards that can be used to gain higher levels of 

assurance than a simple username and password. These standards are increasingly used 

throughout government and industry to protect the most sensitive transactions and 

information. In fact, following the OPM breach many government offices mandated the use 

of these standards for all federal employees. Within the healthcare and pharmaceutical 

industry, the SAFE Biopharma Association has adopted the sarne standards, with a few 

industry specific amendments, and they are used to protect clinical trials, sign drug 

prescriptions, and provide authentication into sensitive cloud services. Healthcare 

regulators in the US, EU, and Japan now accept the SAFE Biopharma standard as an 

authorized means of identity verification and validation in new drug application submissions. 

While there is still work that would need to be done to improve ease of use these standards 

offer a promising way to significantly reduce medical identity theft. 

Page 9