On October 29, Deputy Secretary of the Department of Health and Human Services (“HHS”) Eric Hargan announced the official opening of the Health Sector Cybersecurity Coordination Center (“HC3”). Deputy Secretary Hargan commented that “HHS is proud to work with the health community to better protect Americans’ health data and confidential information.”
The HC3 is designed to support and improve cybersecurity information sharing within the healthcare sector, provide timely and actionable cybersecurity intelligence to healthcare organizations, and promote a cybersecurity community through strategic partnerships. The announcement was made at HHS headquarters in Washington, D.C., and supports the Trump Administration’s National Cyber Strategy, announced in September. According to the National Cyber Strategy, the Department of Homeland Security (“DHS”) is the lead organization to protect against cyberattacks and develop preventive strategies, with HHS directed to focus on the healthcare and public health (“HPH”) sector.
According to Jeanette Manfra, DHS Assistant Secretary for Cybersecurity and Communications, “[w]e know that the majority of the cybersecurity attacks that occurred over the past year could have been prevented with quality and timely information—and the heightened importance of sharing information cannot be stressed enough. The HC3 is a vital capability for the early detection and coordination of information between the private sector and the federal government, and with cyber professionals across the federal government.”
The HC3 replaces the Healthcare Cybersecurity and Communications Integration Center (“HCCIC”), which was announced in April 2017 with few details and drew scrutiny from Congress. Bipartisan leaders of the House Energy and Commerce Committee, as well as of the Senate Health, Education, Labor, and Pensions Committee, wrote a letter in June 2018 to HHS Secretary Alex Azar, seeking clarity about the role and status of the HCCIC and citing concerns about leadership changes. The letter noted that “[s]takeholders have informed our staffs that they no longer understand whether the HCCIC still exists, who is running it, or what capabilities and responsibilities it has.” In contrast to the perception of the HCCIC among HPH stakeholders, Deputy Secretary Hargan emphasized the involvement of these stakeholders in the development of the HC3, stating, “[t]oday’s announcement is a recognition of the importance we place on stakeholder engagement as part of our cybersecurity work.”
