The U.S. Department and Health and Human Services (HHS) this week officially opened the Health Sector Cybersecurity Coordination Center (HC3), designed to strengthen coordination and cybersecurity information sharing within the healthcare sector and promote cybersecurity resilience.
According to HHS officials, HC3 is an operational cybersecurity center designed to support and improve the cyber defense of the healthcare and public health sector. The center will work to cultivate cybersecurity resilience by providing timely and actionable cybersecurity intelligence to health organizations and developing strategic partnerships between these organizations.
The Administration, under President Donald Trump, has designated the Department of Homeland Security (DHS) as the lead organization to combat cyber threats and develop preventive strategies across the entire economy, with HHS given the role to focus cybersecurity support on information sharing within the healthcare and public health (HPH) sector.
“HHS is proud to work with the health community to better protect Americans’ health data and confidential information,” HHS Deputy Secretary Eric Hargan said in a statement, adding that the announcement “is a recognition of the importance we place on stakeholder engagement as part of our cybersecurity work.”
Jeanette Manfra, assistant secretary for cybersecurity and communications in DHS, said in a statement that HC3 is a “vital capability for the early detection and coordination of information between the private sector and the federal government, and with cyber professionals across the federal government.”
“We believe that when a risk is shared across sectors, the only way to manage that risk successfully is to manage it collectively. We know that the majority of the cybersecurity attacks that occurred over the past year could have been prevented with quality and timely information - and the heightened importance of sharing information cannot be stressed enough,” Manfra said.
The opening of HC3 respresents the second healthcare-focused cybersecurity center in two years. In June 2017, the Healthcare Cybersecurity and Communications Integration Center (HCCIC) launched and was designed to focus its efforts on analyzing and disseminating cyberthreats across the healthcare industry in real time. However, the fledgling HCCIC was almost immediately mired in controversy due to abrupt changes in leadership. In just six months after HCCIC began operations, the HCCIC’s top leaders were reassigned.
In November 2017, there were reports that HCCIC's work was stalled as it was at the center of an investigation into contracting irregularities and possible fraud allegations. The cyber operations center was “paralyzed” by the removal of its top two officials, according to reports. Leo Scanlon, deputy chief information security officer at HHS, who ran the HCCIC, was put on administrative leave in September 2017 and his deputy, Maggie Amato, left the government. The HHS Office of the Inspector General then confirmed, at the time, an ongoing investigation into the reassignment of HCCIC leadership.
About a week letter, the House Committee on Energy and Commerce issued a letter saying it was examining whether HHS retaliated against two key HHS cybersecurity officials and whether those actions weakened the federal agency’s role in responding to healthcare cybersecurity incidents.
During the summer of 2017, HHS officials had touted the center’s success in light of the WannaCry ransomware attack back in March 2017, in which the U.S. healthcare system saw minimal impact. In an interview with Healthcare Informatics this past March, former HHS Deputy CISO Scanlon said the HCCIC, which played such a promising role during the WannaCry incident, had been "derailed" by the leadership reassignments.
There also were rumors back in March that the HCCIC would be rebranded and housed within Homeland Security in order to align with DHS’s information-sharing efforts. Scanlon said at the time that the effort to create a healthcare-specific cybersecurity information-sharing center was now "back to square one.”
It seems those rumors bore out as the new cyber center, HC3, is housed within DHS, whereas HCCIC, which is now gone, was intended to be a standalone entity partnering with NH-ISAC.
In the past year and a half, Congressional leaders have voiced concerns about the lack of clarity on the direction of HCCIC and HHS’ overall cybersecurity capabilities. Back in June, members of the House Energy and Commerce Committee and the Senate Committee on Health, Education, Labor and Pensions wrote a letter to HHS leaders citing concerns about the leadership changes, specifically the reassignment of senior officials responsible for the day-to-day operation of the HCCIC. “HHS’s removal of senior HCCIC personnel has had undeniable impacts on HCCIC and HHS’s cybersecurity capabilities.”
According to HHS and DHS officials, the mission of the new cybersecurity center, HC3, is now more important than ever with the healthcare sector reporting over 400 major breaches from 2017 to 2018. “Within the HPH sector, the threats are significant and hackers covet having the potential to access sensitive medical data, damage medical equipment, secure intellectual property for financial gain, or even conduct terrorist attacks. The HC3 provides a service to healthcare organizations that enables them to protect their assets and patients,” Administration officials said in a press release.
To address these threats to the sector, HHS has developed a “coordination center” in the HC3 to coordinate the activities across the sector and report to DHS threats, profiles, and preventive strategies. The HC3’s role is to work with the sector, including practitioners, organizations, and cybersecurity information sharing organizations to understand the threats it faces, learn the bad guys’ patterns and trends, and provide information and approaches on how the sector can better defend itself, officials said.
