The new Protecting and Transforming Cyber Health Care Act would implement a series of new requirements for medical device and network security.

WHY IT MATTERS
The bipartisan bill was introduced in the Senate this week by Sens. Tammy Baldwin, D-Wisconsin, and Dr. Bill Cassidy, R-Louisiana. There is already companion legislation in the House of Representatives sponsored by Reps. Dr. Michael C. Burgess, R-Texas, and Angie Craig, D-Minnesota.

The aim is to "help ensure that the U.S. healthcare system’s cyber infrastructure remains safe and secure" even as ransomware and other cyberattacks have increased in scope and severity in recent years.

 The PATCH Act would:

• Impose a series of cybersecurity requirements for manufacturers applying for premarket approval through the Food and Drug Administration
• Enable manufacturers to design, develop and maintain processes and procedures to update and patch the device and related systems throughout device lifecycles
• Establish a Software Bill of Materials for devices that will be provided to users
• Require development of plans to monitor, identify and address postmarket cybersecurity vulnerabilities
• Request a Coordinated Vulnerability Disclosure to demonstrate safety and effectiveness of a device

"In recent years, we’ve seen a significant increase in cyber-attacks that have exposed vulnerabilities in our health care infrastructure," said Baldwin, in a statement. "We must take these lessons learned to better protect patients."

She added: "The bipartisan PATCH Act [ensures] that innovative medical technologies are better protected from cyber threats, and keep personal health information safe while also finding new ways to improve care."

THE LARGER TREND
As was discussed in-depth this past month at HIMSS22, hospital security efforts are "not just about privacy and confidentiality anymore. Cybersecurity is patient safety."

In few areas is that truer than with networked medical devices and the internet of things.

With ransomware attacks now commonplace, risks of Russian and other state-sponsored threats on the rise and remote patient monitoring newly in cyberattackers' sights, it's more critical than ever to keep patients safe by ensuring devices are built and deployed with strong security baked in.

Beyond federal policy, however, hospitals and health systems themselves have an important role to play in device security.

ON THE RECORD
"New medical technologies have incredible potential to improve health and quality of life," said Cassidy of the Senate Bill. "If Americans cannot rely on their personal information being protected, this potential will never be met."

"Throughout the pandemic, there was a spike in ransomware attacks within medical devices and larger networks," added Burgess, about the House's companion bill. "This legislation will implement cybersecurity protocols and procedures for manufacturers applying for premarket approval through the Food and Drug Administration to ensure that users are properly equipped to deal with foreign or domestic ransomware attacks. It is time to examine how to modernize and protect our health care infrastructure."

Twitter: @MikeMiliardHITN
Email the writer: mike.miliard@himssmedia.com
Healthcare IT News is a HIMSS publication.