April 25, 2022 

Page 2 

in protecting the consumers they serve and diligently work to stay ahead of trends as they face 

these real-life situations and potential consequences. 

We appreciate the ongoing collaboration between NIST and public and private sector entities, 

which are the end-users of the Cybersecurity Framework. By enabling public and private sector 

input into the Framework, the process serves as a current and “living document” that keeps pace

with innovations, technological developments, and new and emerging threats. 

Our comments are focused on the following key issues: 

• Entities should be encouraged to use the NIST and/or other cybersecurity 

frameworks that are best suited for them based on their business operations and 

potential risks. Implementing strong protections for consumers is the goal. Alignment of 

the various cybersecurity frameworks (e.g., HITRUST Common Security Framework, the 

Health Information Sharing and Analysis Center (H-ISAC), internal corporate proprietary 

solutions) is valuable, as such coordination would ensure that organizations will 

consistently cover all core domains involved in assessment of their risks. Likewise, this 

approach allows entities to implement protections based on their unique administrative, 

financial, technical, and administrative resources. 

• We support maturity targets and similar criteria for risks based on an entity’s size, 

scale, preparedness, and history of events. While there is more work to be done and 

public discussions to be held on this topic, we are open to exploring maturity targets to 

measure the success of ongoing cybersecurity methods. Entities across different sectors 

compare their environments and risks to other entities that are similarly situated in terms 

of type, function, and use. For example, leveraging “lessons learned” from broadscale or 

common attacks, as well as comprehensive cyber campaigns, can be “use cases” for 

developing criteria that may be used by public or private entities and similarly situated 

events. 

• Where possible, we support aligning the various NIST frameworks2 with the 

Cybersecurity Framework. These NIST tools, Supplemental and Special Publications, 

and the variety of NIST resources can then be utilized for various functions that intend to 

accomplish the same objectives. NIST should either cross-reference or integrate these 

resources to prevent a siloed approach and to permit businesses to use the NIST tools in 

an integrative and cohesive approach. 

• The Health / Public Health Sector (HPH) Coordinating Council (SCC) should be 

leveraged to promote the NIST Cybersecurity Framework. Much education has been 

done to date. Future collaboration between NIST and the HPH SCC, as well as other 

similar activities across other critical business partners, would be beneficial. 

2 E.g., The Privacy Framework, the future Artificial Intelligence Framework, the Integrating Cybersecurity and 

Enterprise Risk Management Resource (NISTIR 8286), and Special Publications such as 800 -53. 
April 25, 2022 

Page 3 

• The Health Insurance Portability and Accountability Act (HIPAA) should be 

referenced and discussed where possible in the Cybersecurity Framework. The 

HIPAA Privacy and Security rules have been effective for establishing physical, 

administrative, and technical safeguards, which can encompass cybersecurity protections. 

We recognize that the NIST Cybersecurity Framework is intended to be agnostic and 

applicable to sectors beyond health care. NIST should include discussions of the existing 

HIPAA privacy and security protections when possible, and when issuing guidance and 

related educational materials that can be used by health care entities. 

• NIST should consider the bipartisan omnibus spending bill for the Cybersecurity 

Framework and should work with the U.S. Department of Homeland Security, 

Cybersecurity and Infrastructure Security Agency (CISA) to help inform future 

regulations. The new law entitled the “Cyber Incident Reporting for Critical 

Infrastructure Act of 2022” includes several important cybersecurity reporting provisions. 

A Center will be established within CISA to receive these reports from "critical 

infrastructure sectors," which includes HPH entities within specific timeframes. A future 

Notice of Proposed Rulemaking (NPRM) will be issued with details for implementation. 

In the attached chart (labeled “Attachment A”), we address more specific, substantive topics to 

help inform updates to the Cybersecurity Framework. We stand ready to support NIST’s work 

and look forward to public dialogue on these important topics. Please contact me at 

 if you have any questions. 

Sincerely, 

Marilyn Zigmund Luke 

Vice President 
 

April 25, 2022 

Page 4 

AHIP 

Attachment A 

NIST Cybersecurity RFI 

Our specific comments below address issues raised in the Cybersecurity Framework. Our 

comments are organized to correspond with the sections and questions listed in the RFI. 

Cybersecurity Framework AHIP Comment AHIP Recommendation 

Relationship of the NIST 

Cybersecurity 

Framework to Other Risk 

Management 

Resources 

The NIST Framework should 

be available to use on a 

voluntary basis, but NIST 

should recognize that other 

frameworks and tools may be 

used in conjunction with, 

apart from, or in place of the 

NIST Framework. 

Entities should remain free to 

develop proprietary resources 

for themselves, their business 

associates, customers, and 

partners. There are 

commonalities 

between the NIST framework 

and other voluntary, 

consensus resources. 

Existing efforts from 

HITRUST, the Electronic 

Health Network 

Accreditation Commission 

(EHNAC) and other groups 

and bodies can provide 

similar value. Entities should 

be free to select the tools and 

approaches that are best for 

them. For example, a 

“scorecard” is part of the

HITRUST certification and 

focuses on things to do to 

help an organization leverage 

strengths and weaknesses. 

NIST Frameworks can serve 

as a model but should not be 

a mandated approach. 

Alignment or integration of 

the NIST framework may be 

done with other international 

Entities vary in size, 

sophistication, and approach 

to cybersecurity. If possible, 
 

April 25, 2022 

Page 5 

approaches (e.g., the 

International Organization for 

Standardization or “ISO”). 

international standards could 

be referenced or “crosswalked” for use by U.S.-

entities. For entities who 

conduct business in other 

countries, and/or who use 

business associates or 

vendors on an international 

basis, the international 

standards can promote 

efficiency and effectiveness. 

Not all organizations may 

have the sophistication, need, 

or resources for international 

work, and in those cases, the 

international work can inform 

but not be made mandatory. 

NIST should consider 

updates to the Cybersecurity 

Framework as needed, as 

opposed to a scheduled 

interval review. 

Allowing for more-frequent 

or less-frequent updates will 

provide NIST with the ability 

to be nimble in response to 

industry needs and cyber 

threats. Updates done on a 

pre-scheduled basis may be 

unnecessary. 

NIST asked for comments The basic structure exists for 

related to background and background and backward 

backward compatibility in compatibility. If there is no 

relation to the Framework. specific function to 

accomplish from a cyber 

perspective, then backward 

compatibility appears 

unnecessary. 

Demonstrating conformance Existing private industry 

to the NIST guidance can be efforts exist for this purpose. 

done internally, but NIST We agree that it is outside the 

does not provide a “seal of scope of NIST’s role to 

approval,” certification or establish such review and 
 

April 25, 2022 

Page 6 

similar “qualified labeling 

program.”

approval processes given the 

agency does not operate as a 

regulatory oversight body 

(i.e., as opposed to the 

Centers for Medicare & 

Medicaid Services which 

oversees and is responsible 

for direct administration of 

the Medicare program). 

NIST helps organizations “Lessons learned” are helpful 

assess and understand what is to explain in practical terms 

important, why they are doing what cyber risks are and what 

what is important, and what to do when cyber events 

to do if a cyber event occurs. occur. Some organizations 

view cybersecurity 

individually rather than 

looking at it across a system 

or the nation. While each 

focus is important, systemic 

risks should be 

communicated so that 

individuals and organizations 

can be prepared. 

When a cybersecurity event 

occurs, time is of the essence. 

Helping establish a set of 

“what-to-do-when”

procedures can help entities 

respond and quickly recover. 

This is particularly important 

in health care and for other 

sectors that comprise the 

critical infrastructure. 

Cybersecurity Supply 

Chain Risk 

Management 

An entity will determine what 

its “supply chain” entails

based on its own unique 

business operations. 

The definition of a “supply 

chain” will vary by entity and

experience. For example, a 

retail supply chain will focus 

on products and availability 
April 25, 2022 

Page 7 

of supplies, whereas in health 

care a supply chain can be 

defined more broadly to 

include things such as 

devices, tests, blood and 

blood products, access to 

claims software, contingency 

sites for business operations, 

workforce availability, etc. 

NIST should define what is 

meant by “supply chains” and 

how the diverse and complex 

structures can be affected by 

cyber risks. 

NIST can build on the 

National Initiative for 

Improving 

Cybersecurity in Supply 

Chains (NIICS) with a focus 

on security and software 

security to increase trust and 

assurance in technology 

products, devices, and 

services. Likewise, NIST 

should discuss interoperable 

frameworks and potential 

cyber risks, such as the 

Trusted Exchange 

Framework and Common 

Agreement (TEFCA). 

While NIST documents are 

intended to be agnostic by 

industry sector, there is a 

specific need within health 

care to better understand the 

NIICS work and how it 

relates to software used 

within the industry. In 

addition, NIST should discuss 

the cyber risks inherent in 

interoperable frameworks 

including TEFCA and similar 

environments. NIST should 

outreach to other federal and 

state agencies to ensure that 

existing NIST tools and 

resources are understood and 

used as guidance for 

impending implementation 

efforts. 

For managing cybersecurityrelated risks 

in supply chains, NIST seeks 

input on resources in 

narrowly-defined 

To the extent a system design 

flaw presents a cyber risk, 

NIST could work with CISA 

and other agencies to better 

define those vulnerabilities on 
April 25, 2022 

Page 8 

areas (e.g., pieces of 

hardware or software 

assurance or assured services, 

or specific to only one or two 

sectors) that may be useful to 

utilize more 

broadly. 

an ongoing basis. In addition, 

NIST and CISA could be 

more transparent about the 

work they perform together 

or in consultation with each 

other. This transparency 

should extend to how the 

Federal Bureau of 

Investigation becomes 

involved and in what stages 

of the processes. 

Communications 

technology, the Internet of 

Things (IoT), metadata, the 

“dark web,” and technology 

that “scrapes” data can pose

cybersecurity risks and 

threats. 

NIST can do more to help 

individuals and entities better 

understand the threats from 

uncommon or nefarious 

applications, which may 

include tools available in the 

IoT space, metadata, the dark 

web, and scraping tools. 

NIST should integrate We do not recommend 

cybersecurity supply chain establishing a separate 

risks into the existing framework for Cybersecurity 

Cybersecurity Framework. and Supply Chains. If specific 

information is needed, 

educational materials or 

guidance could be developed 

by NIST as a companion 

piece or supplemental 

attachment to the 

Cybersecurity Framework.