Does it matter that the College of Healthcare Information Executives (CHIME) is trying to combat cybersecurity threats? Is it really the organization that should be tackling this issue?
Apparently, its leadership thinks so. Late last month, the organization released a statement announcing the creation of the CHIME Cybersecurity Center and Program Office. The center aims to lead efforts to improve information sharing, develop and spread best practices and "encourage greater collaboration across the industry and with federal agencies."
Not sure how that will help healthcare system battle cybersecurity threats, but CHIME is going to try. And maybe trying is better than doing nothing.
"Cyberthreats are becoming more sophisticated and more dangerous every day," CHIME President and CEO Russell Branzell said. "Today the focus is ransomware, tomorrow it will be something else. As an industry, we need to pull together and share what's working so that we can effectively safeguard our systems and protect patients."
While the program sounds a whole lot like a social network of healthcare professionals, the CHIME Cybersecurity Center will pull from resources inside and outside of healthcare to develop best practices, it said. Plus, CHIME plans to build on existing partnerships with federal agencies and other organizations, while partnering with Association for Executives in Healthcare Information Security (AEHIS) members. Both agencies' leaders will serve as advisors to the center and the industry.
Additionally, CHIME staff will operate the program office, with assistance from member volunteers. The creation of the best practice office — no details were released as to how much access to this information will cost — will attempt to serve as a "leading advocate for spreading cybersecurity best practices," an effort the group says it has been involved in for some time.
In testimony May 25 before the House Energy and Commerce Subcommittee on Health, CHIME board chair Marc Probst told lawmakers that coordination across federal programs and with the industry is essential to shoring up network defenses, essentially teasing the news of the new office CHIME was about to launch.
Unfortunately, best practices are not likely to solve the war on data by hackers.
According to a recent survey, 5,000 U.S. healthcare IT executives responsible for network security and network management of large enterprise networks said they felt inclined to detect breaches within one day. Thus, there's a great deal of pressure on the system to protect its data, but also to be aware of a breach once it occurs. Most breaches extend well past several months.
Likewise, according to a Mandiant 2015 Threat Report, only 31 percent of companies detected breaches on their own, using internal resources. Others learned they were compromised from a third party, such as a supplier, customer or law enforcement.
The threat of cybersecurity is growing, and attacks are growing more sophisticated. Applying best practices will help, but as the threats and those perpetrating them evolve, the best practices will have to keep ahead. That's a tough ask in an industry not known for its response dexterity.
On the bright side for CHIME, nearly one-half of respondents say there are key impediments to attaining network visibility: 48 percent mentioned the lack of comprehensive security intelligence available across the network, while 49 percent of respondents cited their inability to monitor every device on the network, particularly mobile or cloud instances. Nevertheless, CHIME is committed to educating the marketplace about best practices to protecting healthcare data.
"It is absolutely critical that we have collaboration across the industry," CHIME board member David Finn said. "We talk frequently about sharing cyberdata, but if that data isn't meaningful to those receiving it, if data can't be turned into useful intelligence, there is no real advantage to sharing. We need to make cyberinformation useful. We need to have clear direction on how to protect information across the continuum of care. It is like a chain; the strength of our security is only as good as the weakest link."
Good money after bad? We'll see.