Earlier this year, we wrote about cybersecurity guidance and resources tailored to the health care industry released by the US Department of Health and Human Services (HHS). This guidance identified common cybersecurity issues faced by health care organizations and provided cybersecurity practices that could be implemented by these organizations to mitigate any identified threats or vulnerabilities.
On August 12, 2019, the NYS Department of Health (DOH) Office of Health Information Management followed suit in highlighting these concerns by releasing a letter to administrators and technology officers announcing new notification protocols that should be used by providers to inform the DOH when a potential cybersecurity incident has occurred at their facility or agency. These new changes were to take effect immediately and apply to the following providers: hospitals, nursing homes, diagnostic and treatment centers, adult care facilities, home health agencies, and licensed home care services agencies.
The DOH guidance defines a cybersecurity incident as “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of data or interference with an information system operations.” While acknowledging that providers are required to contact various other agencies when cybersecurity-related events occur, the DOH noted it has been able to provide significant assistance to providers when these types of events occur, so long as timely notice of these events is provided.
In order to obtain the DOH’s assistance, providers must:
- Notify law enforcement
- Notify the telephone numbers provided within the poster enclosed with the DOH letter
- In instances of immediate threat to public health or safety, provide an emergency notification by dialing 911
The DOH also advised that the poster must be posted in facilities and agencies to provide immediate awareness of the notification protocol to staff as well as to be used for reference purposes.
Moving forward, providers should consider adding the DOH notification to their existing cybersecurity-incident and breach-notification policies. However, the DOH’s new protocol does not relieve providers of their responsibility to make other required cybersecurity-related notifications, including to the individuals whose data has been compromised, the HHS, and, in the case of compromised private financial information, the state Attorney General’s Office, the Department of State, and the Division of State Police.
If you have any questions regarding the content of this alert, please contact Dena DeFazio, associate, at ddefazio@barclaydamon.com or another member of the firm’s Health Care & Health and Human Services Practice Area.