Transcripts For CSPAN2 Health Care Cybersecurity Discussion 20240714

Im greg mathis, policy advisor to senator mark warner. Thank you for joining us for the Cyber Security caucus. As many of you know senator warner along with senator gardner started the Bipartisan Task force. And so hell be here to give a presentation to talk about this important topic as well as we have the ceo of dhi. Without further ado i let the first presentation get started. I very rarely give talks that are standing room only so really appreciate your interest today. As greg mentioned im robert lord, cofounder, president and chief Strategy Officer of protenus, and also a fellow at new america cybersecurity policy program. While a lot of information today im presenting comes from research weve done at protenus and some of the work we are currently building at new america on the speaking on behalf of either of those organizations today. Just talking from my experience and providing perspective on the challenges that we see in this space i guess to contextualize this because sometimes we talk about cybersecurity it can be a little too much and bites and people in hoodies. The first thing i always think about when i think about Health Care Cybersecurity is the patients i had when i was in medical school. I was fortunate to work in a clinic that focused on treating hivpositive patients in baltimore when i was in med school. One of the things you learn quickly about this population other than they are an absolutely wonderful really complex, rewarding population to work with is they have extraordinary concerns about the privacy and security of their information. They will go to extreme lengths to make sure people do not find out about their diagnosis, their treatment or that their coworkers or communities and so many others that might use this information against them, this extremely vulnerable community. One of the things i begin to think about treating these patients was what are we doing to defend their health data and information, these extremely sensitive records . The more you dig into that question, this is back in 20132014 when i started, the more horrifying the answers. The rally is the challenges we face in protecting health data are extraordinarily difficult, today ill try to give a a tase not only of the important stories but also the day behind all them. I cant make sense to start with the anthem of breach back in 2015. This was really for many people, and ill ask for a show of hands, who here got one of those anthem notification letters . I did, too. This was about half of the u. S. Population more or less about a third or half, 140 million medical records breached. Will never know the exact number. But for many this was this was a massive wakeup call to the fact health data was highly centralized in many cases, highly vulnerable and highly valuable to certain parties as well. Unfortunately, this store did not end with the breach in 2015. The hits keep on coming. We just had a very recent breach, a lab core amc a breach with about 20 million medical records for patient data, individual data pieces that were identified and well see what the final numbers are. Back in 2016 we had a a major Ransomware Attack that reduced an entire Hospital System to pencil and paper. So imagine all the Electronic Health records, all the Electronic Systems that use and Health System, and now youre using pencil and paper. Pretty scary. This isnt just a couple of anecdotes either. If you look and really scale it out, a recent report back not too long ago showed 70 of Health Systems reported experiencing a major data breach and a third experienced one in the last year. If you think about this entire picture together, we are in a pretty terrifying state right now and its one where we are not always talking about what i can tell you elf systems are very aware of it all the time. So im not a big person on speculation, but also it makes sense to think proactively. Theres also the significant possibility raised recently in the bloomberg article of the ability of whether its state actors for individual or other types of criminals to engage in medical blackmail. Typically these types of incidents are highly behind the scenes. There are some great area reports this does happen but most of the time is not reported if it is the case. These are the anecdotes, but i dont want to focus about what could be. I want to show you the data for the rest of my presentation that shows you what were facing right now and what the trends are. I think for some of you in the audience you will know everything im talking about really clearly work for others i do want to contextualize why health data is so valuable. So by some report and i think these are exaggerated but they give you a sense of what these records can be worth come a single individual medical record can go for upwards of 1000 on the black market. These of been deflated as more medical records come on the black market. But theres a lot of value to thin and theres a lot of value to them for a lot of reasons. They can be used for insurance fraud, fraudulent claims. You can steal someones id and you could do it very comprehensive legal and you think that the information in a medical record. Its pretty much the entire history of someones past illnesses, their family members, their location, financial information. Its all in there. The only thing that has more information on individuals is probably like it comprehensive topsecret clearance document in the trinity. If you use open financial accounts because of the richness of the data so insurance or banking accounts, medical blackmail that could be criminal or statebased. You can also unfortunately people use for monday personal attacks or courtroom litigation in messy divorce cases. We seen it all. You can run fraudulent medicare, medicaid billing mills as well. A lot of im terrible terrible crimes that have impacts that can go on for years and years. Actually recently there was a cbs this Morning Report that featured some of the data im going to show today that showcased an individual who basically while he was in the service he had his medical identity stolen and he was resolving those challenges 15 years after and still suffers from challenges. A wonderful guy and hes been dealt quite a hard blow. What im going to show you next specific of the data we collect on a regular basis. Protenus is the worlds leading Health Care Complaint Analytics Platform focusing on detecting dangerous activities and health care, but im not here to talk about my company on that side. We have research that works with third parties to identify trends and Health Data Breaches and Health Cybersecurity in general. So one thing to start out is that since 2010, and i dont show all the way back, but since 2010 theres been a systematic increase in the number of data breaches that occur every single year, without fail. Without exception. We see this since weve been tracking the data specifically, weve seen every year and already we are projected to have another record year. This number that you see here is just a half year estimate from a recent analysis. If a work to continue, we will beat out 2018 a fortune. This is is the number of incidents. You want to look at the number of records breached. Were excluding the 2015 anthem creek where if you added that calling it would go up to about 170 million records that you or something in 2015. In 2016 we had a banner year with some big, big breaches, almost 30 million for 2017 some of us started to think that we were normalized. A bee does just a couple of big breaches and it will get better. That of course it tripled in 2018 and in 2019 that estimate you see up there of almost 32 million is just the half your estimate. That is not yet annualized to the full year. We are once again on track to break yet another record when it comes to the number of records breached. Importantly, you may want to know all this preaching is occurring. Of course hacking is a major concern. Its what people think about anything but these types of challenges. And that breaks down and i can go into more detail but thats a mix of what weve seen from a phishing perspective, certain that some hour, submits links miscellaneous threats and about go into all the deep details but we provide a breakdown of this in the barometer which you can download and subscribed and is totally free, just google protenus. A huge proportion between 2540 of breaches are due to insiders. That is individuals with some legitimate level of access to the Electronic Health record and have used that access. So i for instance, when i was the lowest of the low medical student with my dorky little white coat, i can access any medical record of any individual who ever passed through the walls of my institution. That was not because my institution was unique in this respect. That is true of basically every Single Health system in the world. And the reason is because for emergency access you need to be able to get access to the er quickly. You also have extremely complex environments where proactively using control as im sure some of you may be thinking about is a failed paradigm. Its simply too complex to tackle with that type of threat. And so this Insider Threat surface, one we often underappreciated the one that leads to huge proportion of the breaches we saw all the time. As far as whose most vulnerable, this may come as no surprise, but obviously lions share is hospitals themselves. I want to know, this is not because hospitals are lazy or do not care about this problem. Quite the contrary. They care and extort him out but keep in mind hospitals are often running on razor thin margins, their Technology Investment in this space is not always what they want it to be and they have to take care of patients. When you look at their list of priorities theres a lot going on they have to be thought of and, of course, they are on the front lines so the most people have access to this. A large Health System and have 30,000 employees. How do you make sure all of those individuals are not committing privacy violations . A major, major challenge him. If you 99. 9 rate of preventing phishing attacks at your institution and you would 100,000 employees, you will still have a lot of breaches, and thats a big problem. Question . [inaudible] its hard for me to comment as a member, as im in the of the private sector on a lot of the statebased activity that occurs in these spaces. Im not really the person to necessary talk about specifics just because that information is not readily available to me. What we see is the lions share here is people who are not some sort of Foreign Espionage type of situation, its just the hospitals own employees that might be using it for criminal gain, for abusing their axis media attack a a colleague, to look up the pip. Ive even seen people look up local sports stars fantasy football edge. So it happens, yeah. It is some pretty scary situations out there. So im going to tell you a nice story as well. This is like the one good piece of data you will see here, and what this is it is the average time for an individual Health System to report a breach to health and Human Services which they are required to do within 60 days. They are really good about this. Hospitals are extremely responsible and thoughtful about once they know about something they do reported. We have seen a bit of a trend outwards lately on reporting but most of the time everyone is falling inside these lines, which is good. However, the time to detect a breach is not so good. So oftentimes malicious actors will be inside Health Systems for weeks, for months, for years. We have seen ten year plus bad actors occur inside Health Systems and they just keep on going. The problem is not in the reporting rapidly but it is in the detecting rapidly. Heres a number you will not necessarily see a lot, but its a really important one. Weve done some analysis at protenus to understand how many privacy violations typically occur in a given month based on the size of an institution. What weve seen is that for every 300 individuals you can expect about one privacy violation to a patients data per month. That means if you have 30,000 employees at a Health System you are talking about 100 privacy violations a month, and 1200 per year. If you think about what is being reported, you can really only get this once you get comprehensive analysis of the system and understand how many violations are happening but it gives you a sense of the size and scope of these threats whizzing across the whole spectrum. In addition, theres a great opportunity to focus on education and remediation. Another thing we see is the majority of events that we are detecting i repeat offenses, which means someone has already violated patient privacy in some way and we havent caught them and educate them so theyll do it again and again and again. We see this pattern over and over again. It means we can reduce by half the number of violations that occur if were proactively detecting these threats and ensuring that individual is educator or appropriate sanction for that activity. To meet this looks bad but it is the hopeful stat because it means we can predict and prevent these threats through really thoughtful workforce management. So i want to be brief in this next session and just note very briefly my work at new america is focusing on a white paper which will be released next month that addresses three core areas of challenge in this space, and i will be thoughtful of the time because im running over but the aries are essentially culture, workforce, and technology. When we look at culture its all about how to recreate accountability from the board level on down . How do we appropriately fund hospitals so they can make sure theyre getting the job done . How do we work with existing regulatory structures to be more effective and more forward thinking . Our workforce is how do we build a workforce in the future that is effective and retain the valuable workforce we have and how to prevent Workforce Burnout through making sure were not having people to continuous or repetitive low value task and it their focusing on what is strategically important. Finally from a Technology Perspective its about getting a lot of luck as he jumped the system. We know theres a lot of legacy technology. It needs to be remediated. Theres areas we can clarify when it comes to guidance. And then finally its about baking and with its devices or Software Security Development Lifecycle it comes to creating the Software Devices that again are ultimately trading and serving patients. At the end of the its all about Patient Safety. We do all these things at the end of protecting patient to defend them from these threats and to making sure we keeping them safe. Thats what the hippocratic oath is all about and in a way thats what weve got to do hear from a cybersecurity and privacy perspective. And so i will now wrap things up. Hopefully you can take a look at this in september and now there will be a much more interesting speaker talking to you. Thanks so much, everyone. [applause] well, its too. I think the last time is in rome this crowded its been a while. Good afternoon guys. My name is jen bordenick. Robert just that of the really Nice Supreme Court for us. Kind of give you basic over ovw terms of what the date is on breaches and where were going. Im going to spend a few minutes talking a little bit about some of the misperceptions around hipaa policy and cyber policy and talk about current policies and practices how we are evolving into what could be a National Security threat around cybersecurity and health. Cybersecurity has nothing to do with elections, just with health care. Ehealth initiatives has been around about 19 years, and where a group of influential executives from across the spectrum of health care. We bring together leaders from all different groups, payers, providers, vendors, pharmacy, et cetera to work on really tough issues. Our belief is you cant just talk to hospitals about health care. You cant just talk to providers and clinicians. Health care is a continuum so we need to join with pharmacies, nations, consumers, vendors. Its an interconnected problem. Its a network problem. We need to offset that together they get how how to solve it. Weve done a lot of research, education policy workprint cybersecurity. We passed out your today we have a new white paper out on risky business. We have some fact sheets on myths surrounding hipaa which are available in many more on her website. We really need to stop looking at cyber and privacy policy, and stop thinking about Health Care Data in terms of what building it belongs into, or what office should it be in. Health care data doesnt stop at the door. Your Hospital Data shouldnt only be within hospital. You should be able to access it from home, from your phone. Its all over the place. In terms of thinking about rules around cybersecurity and Health Care Data, it doesnt make sense to think about it with an institution always. You need to think about in terms of the greater spectrum. Now, i just want to be frank with you here. We have done a horrendous job in health care and technology talking about federal aviation administration, diversey policy talking about the mac, privacy policy. They think the elections and fixing whatever life story on the news is right now. They are not thinking about their Health Care Data. Part of the issue is have made it so technical and confusing and with so these acronyms out at you from some people just dont understand it. It sounds really overwhelming and ill be honest with you a start in health care two decades ago, i i felt silly asking questions about hipaa. I felt i had to be a lawyer legal analyst to ask questions because it was so collocated and technical at that point. How many of your event and the doctors office, filling out a form and you said like i need to do this again . They said to you, because of the hipaa, right . Hipaa is the big bad wolf of health care, okay . Whenever you can you cant getg done a lot of times the excuse is because of hipaa. Your doctor cant talk to your loved one about your condition because of hipaa. Thats a myth. Your doctor needs a written authorization or they cant share your Health Information thats another myth doctors are not allowed to email patients. Thats another myth. Hipaa protects all of your Health Care Data. Another myth. Im going to go into these last two because these are really, drive me nuts. If an organization is hipaa certified its okay to share information with them. There is no such thing as a hipaa Certified Organization. Ill say that again. There is no such thing as a hipaa Certified Organization. It just does not go rent and Certified Organization and say hhs does not go around and Certified Organizations. So what often happens, an organization will say they are hipaa certified but that basically means they are complying with hipaa the way they interpret it. Another myth out there, if a consumer upload to the medical records into a health apco that information is a been protected by hipaa. Wrong. Theres no such thing as a Health Certified or hipaa certified health. Its not out there. If a Company Offers a direct to consumer outcome so you could download an app directly from an organization and its its not provide a bit of a covered entity, its not subject to hipaa. I just threw in a word that might confuse you, covered entity. This is where we get confusing and people start to come their eyes glaze over and they get a little bit, start to fall asleep a little. Lets talk about what that means. Theres a couple of key questions around apps and whether or not they fall underneath hipaa. It all depends how an app is branded. It depends how the consumer gets the app. It depends how the data flows between the app and maybe the hospital or the doctors office. It depends whether or not it is coming from there. These are all a lot of those things that can really determine whether or not a health app is covered underneath hipaa and has to follow hipaa regulation. Generally, hipaa covers data in health plans with Health Care Providers that are contacting claims transactions, building, living houses, and business associates. Another term thats probably a little bit confusing which we will talk about. So who counts as as a business associate . Im not going to make you read this. Im going to tell you. Lets give you guys an example. Say we have sally, okay . Sally goes to her doctor. Her doctor says you know what . You have diabetes. I got this really great at that point help you manage your condition and you get some counseling along with it. I heard about it from this great app company, so her physician gives her the app. She goes so and she uses the app. That is covered by hipaa because it came from the provider. The provider recommended it. The providers may might be on it, so it is in the coming directly from the provider. Saw that app is now supposed to comply with hipaa, which means it should protect all of your Health Care Data. Now this is what it gets a little tricky. Say weve got sally, same sally. Sally picks up the newspaper or picks up her phone and reads about this really new cool health app that apple has. She downloads the same exact app directly, puts the same kind of data in it. That app is not covered by hipaa because it was direct to the consumer. So you see, you could have the same app with information in it that is supposed to comply with hipaa, and then you can have one thats not even though its the same information from the same company. This is what makes hipaa a little bit tricky to figure out. It doesnt quite make sense, and thats just one of the reasons we have to really think about where this is all going. Theres also kind of this healthyish type data, i like to call it, thats not covered under hipaa. Things like you join a Disease Network to talk about your cancer care, or a Counseling Network online. You purchased pregnancy test did you purchase information about a sexually transmitted disease. You join in hiv group. Gps data that shows that you go to your psychiatrist every thursday. Gps data that shows you were in a rehab center for six months. All of that information is healthyish kind of data. It says a lot about your current condition and could reveal a lot about you. Thats not covered as well. A lot of people would be a lot more concerned about all the items they purchase of walgreens or cvs or on amazon going public then they might about the medical record. Everybody is using these thirdparty apps, even cms. I went online last night, has a list of thirdparty apps to use. If you go to the site you can see all of the different organizations that cms is sharing your information with. You can link to them. In some cases you can opt out. But this isnt just happening in the private sector. This is happening in the government as well. Its important to know that when youre thinking about hipaa. So we spend all this time and effort worried about our Health Care Data and taking sure is protected underneath hipaa are learning its not protected underneath hipaa. We dont want to reveal it, but whats so amazing to me is that so much of this data that were trying to protect, so carefully, with actually giving it away. So you ask how are we giving this data away . Has anybody read the fine print . I mean, i just pulled this down from it own personal health plan and some of the doctors offices that i go to. This is my personal information he. But if you actually read that, and i encourage all of you to actually read the fine print, you will see in many cases the policy says that they dont have to agree to do what it says they are going to do. In many cases it says that they will share this information with contractors and authorized partners, but they dont tell you those people are. It says they will use for normal routine Health Care Operations that are not sure what a normal routine Health Care Operation is. Does that mean the Web Developer happens to be in the office that they gets to look at my medical record . Matey. Or the guy whos working on the xerox machine . I dont know. But its important to understand what it is you are signing away. And then a lot of these will say we can change the rights, you know, we reserve the right to change the terms of this policy at any time we want. And if you want to learn about that, you can come pick up a a copy of the changes. So a lot of the fine print, we are really just getting a lot of this information away. So weve heard a lot about Health Care Data and how valuable it is. I think everyone in this room can probably attest to the fact that we need this data to find cures for cancer, to discover new drugs, to save lives. If valuable data but were finding bad actors want this date as well. So guess who else wants your data. I was pretty naive when i started in cybersecurity. I thought reason everybody wanted this date was because they wanted to break into medical records and find that about Britney Spears or salena or somebody in rehab or what was the medical condition . With someone pregnant . All the celebrity things you hear about. Or that they wanted to bribe people. Dont fool yourself. Its naive to think this is just about bribery or understanding celebrities, or someone even trying to steal your credit card. This is happening right now. There is a new space race, and its around Health Care Data. This is the Fastest Growing business globally. Chinese investors right now are pouring, in the first nine months of 2018, 23 43 of all the investments went into biotech. In 2018. Companies globally are involved in economic espionage, and companies that handle patient data are really particularly at a greater risk. They are taking this data. This is really a space race. Whoever has the most data wins. Think about it. Think about the amount of profit that can be made by the next influenza vaccine, the next ebola vaccine. And about the potential bioterrorism that could take place, if you discover a certain population was susceptible to a certain charm or drug. Im really grateful to supervisory special agent at the fbi. I dont know if anybody heard him talk before. Hes from weapons of mass distraction directorate here, and thats all he does is study these Different Countries that are basically not just hacking our information, but taking our information when we give it to them. And thats whats generally happening. The data they are taking can be used to exploit us. They can discriminate against certain groups. They can create bio weapons. They can target as. But most important they can get economic advantage. Look in the news. All of these companies are working with chinese companies, in this case. Its not just china but i but t many examples are from china, where u. S. Corporations are sharing their data with chinese own organizations. So basically our information is in many cases being given to the chinese. There is a clear certified allows you to work with organizations outside of the u. S. And share data with them. So imagine you are a health plan here in the u. S. And you direct all your labs, all your dna testing, whatever it might be, to be handled by a Chinese Company. That doesnt have our best interests at heart. If you look in the news, sometimes you hear about the chinese hacking data, but more often than not we are actually giving them the data. There was a report released this year, february 2019 by oig here and the fbi and identify National Security risks related to sharing genomic data. This happening right now. That identify china as a primary source of those risks. There are concerns right now because nih has given access to forprofit companies in china. And these companies have ties to the chinese government. Now, this does not reciprocal. But in health care would like to think anybody sharing data for the greater good. Thats how i always believed that things were but thats not the case. In fact, in china they have a law. Their data doesnt go outside of their bounty. Villager any of their data. They get our data if you dont share any data. In fact, theres a new law there you can even use the biometry sometime unless theres a chinese collaborative or an organization involved. So its really important to understand what the National Security risks are for sharing health data with china and other countries. Its important to understand what regulations we have in place for sharing rus genomic data. Its important for us to understand what payments we are making through cms, what payments our federal government and the cms is making to other countries to hold and handle our data. And its really important for cms and for private companies to consider what other National Security risks that we need to think about before we do business with these companies. These are things we havent really worried about before, right . I mean, weve been worrying about people hacking in to take celebrities information blackmail an individual person, but thats not whats happening. We are actually at a different point right now. Senators grassley and rubio actually drafted a letter just a couple months ago is you and anyone hear offices . Around asking her cms to put a plan together and asking to kind of understand better nih and how theyre showing that, and to be clear about what payments are going there and what the rules are going to be. Thats just the beginning expiration around that this is something i think is really important for people to keep asking about. Because this is going to sneak up on us very quickly. Once that date is gone, its not coming back. You cant get it back. So in summary, you know, this Health Care Data is valuable. It saves lives and who really want to emphasize that. It is important to share this data, be identified so we can do the research we need to do to find cures and better treatment treatments, find appropriate treatment for alzheimers or als. We need vast amounts of data to do that so we dont want to siphon that. But we need to make some that. We need to make tough decisions what data want to share and what form, who we want to share with. Antedate have seen a lot of discussion about that. But the time to have that discussion is now before its too late. So thats it. I want to thank you for listening and im happy to take any questions. [applause] thank you again to jennifer and robert for those presentations. They were able to cover what i would consider an enormous amount of information and condense it into those slides that im sure theres tons of questions and want to drill down a bit deeper on certain subjects. I think we definitely got a good understanding of risk of our data being out there and how it can be shared and have dont know what is being shared. I guess one question i i would like to start with is, is there or is is the concern or should there be greater concern that beyond the inherent risk and the jeopardy of Patient Safety with the data being shared, is right direct threat to Patient Safety, other avenues we might want to be worried about . To talk about that a bit as wel well. Anyway, you guys can probably hear me. We certainly see this all the time this one . Okay. Does that work . So one of the things that are mentioned was the potential Ransomware Attack. This is when essentially you have a form of malware that encrypts all of the data in the Health System and makes it inaccessible to anyone using the systems, effectively shutting down anything that runs on any form of data. Thats everything. Well, there are still some things that hospitals probably should but they dont. So that means the Patient Safety effect can be huge because suddenly youve lost access to critical system. Another day concern that is been proven time and time again at these from a Theoretical Research and we dont know if it is happen in a while yet is potential device would hacking. You can imagine an insulin pump or an implanted defibrillator could readily be compromised and then could be used easily given the function of those devices to kill a patient or seriously injure them. Those are just two two really f examples but they are very serious, very possible and they are either actually out there or a been proven to be completely plausible and deployable. Right now there is malicious where thats attacking microsoft and other widely used software. A lot of the medical devices sit on top of that software. It could be then that messerli attacking the medical device itself but the software is connected to and thats happening right now. A lot of people dont recognize when their machine or the device or hospitals that no other device is connected to something thats been attacked maliciously. It is happening right now, just that in what you think about it. I think everybody saw the homeland episode with a pacemaker getting attacked him and when it seemed that so much right now. But definitely we are seeing a lot of attacks on General Software that is connected to those things, and we dont have a good way right now to notify people and reach out. If you think about medical devices, once they are out there, we would need to know exactly where the manufacturer sold then, what providers by then, which patients they were given two. Think about the chain of events in terms of where medical devices go. Its a pretty long chain. So in terms of the notification there are specific guidelines of how that notification is to take place but its a real concern. The more that this happens i think the more dangerous it is going to get. [inaudible] about like where the source of a coming from whether hacking or insiders. Was that based on instances or the proportion of number of patients attacked . Does that make sense . That is based on incident numbers. Those percentages, yes, the number of incidents. Obviously you have different view towards hacking when you look at it from percentage of records compromised. Because those looking to be the biggest types of breach events that being said, what sometimes can be the most damaging to help systems are sometimes the one of types of attacks because they can be very public. They might be for personal and they might be one and one types of vendettas or legal action. When you look at the total risk to the system, you could make an argument it could be either way but to you point its a very good one. If you look at total number of records compromised you would probably get more hacks. Sometimes it is an insider type of air that leads to that. Good question. We are going to go enough blue tie back there. [inaudible] appreciate your comments and just want to echo what you said earlier. We see impact of Patient Safety care delivering, Ransomware Attack specifically because the net effect, surge is canceled. The ambulance is possible the verdict, and we seen that from our members, and we sang the adventures go after smaller hospitals most recently, and increasing the ransom attacks. And using an attack those going into the backups first, critical backups, which is very troubling because thats the normal defense against ransomware so very concerned about that and appreciate your comments there. Again come under data point, i think the majority of records as you say that a compromise of external hackers, would you agree with that . I think from a number of records but i think sometimes we need to be thoughtful about incidents versus records as our measure of risk. Sometimes those incidents in the think some of the greatest vulnerabilities which may or may not be exploited in these large dark web sales, things that might have less of an actual impact on the institution or patience. It really does depend but its a good point and i would applaud also aag for a lot of great work theyve been doing in the space. Specifically i know some of the work youve been doing, john. We have launched an initiative to our members become aware of the strategic threat posed by nationstates targeting medical research and innovation. So thanks or bringing that up. Can adjust piggyback as well . I think hes phishing attacks are the most common. That is external but it can be, you can address that with training. A lot of companies have trained their employs and phishing attacks. They will send it in email and the people that click it have to go to training. We can speedy you can address that but that is the number one way people get in. We show that break and enter data if you want to look at the actual report. We confirmed over the phishing is by far the largest portion of the hacking section of that event. Right there in the back. If you dont mind, this gentleman will find you with the mic what kind of policy has been recommended or should be recommended to address this issue are . Which part . Minute hospitals leaking or insiders in hospital leaking information to protect against companies are outsourcing the data to foreign nations . We general havent seen that. What we sang in terms of hospitals is of these phishing scams. Its really a training, education. Large corporations are launching largescale efforts to train their employees do not click on things. Because thats the number one way that people get into your organization. Is that how some folks externally and from other nations get in . Yes, but it is all around for the most part, they get in from an inside door. The only thing i would add is, i think you bring up a pretty broad set of challenges that our faith, even if you look at any one discrete piece, the challenges are across many different dimensions and thats a lot of what were working on a new america in particular which is to understand how do we change the culture of these organizations, to your point about education. How do we look at the technology. Technology. Are we using the most modern technology, artificial intelligence, using everything we can and workforce. At the end of the day its human beings that are both defending the systems as well as serving as the role of the lease and the training and pipeline we create their have a strong, diverse and welltrained workforce in the future is just incredibly important and theres a lot of specific policy recommendations in this paper that will be released soon that and hoping can help empower to make some are concrete recommendations. Its important organizations like aha and other associations and societies really get out there and do what aha is doing, is educate people. People dont even know this is a problem or that its happening. The more that you can talk about it in your offices or with your constituents, its really important, bring up reallife examples with them. Ive been seeing a lot in the academic literature and real push to the idea of the internet of things because it will save us from kind of human air when were talking about niv transfusion pump. I kind of always did have this fear in the back of my mind, these things are packable but most of the literature icing lately dealing with security focus on the passive data collection. Do you think that theres not really as much direct risk their oars at something that could be forthcoming as kind of more of these devices become mainstream . A lot of the systems are very smart, and there is always human error. With finding that medical records are in many cases more secure than they were when they were paper records, in many cases. But everything is going to be hackable eventually. There will always be a way in. Theres no 100 guarantee that something can be safe. If anyone is looking for that, they will not find it. I mean, for me and just from my perspective, when i was a medical researcher in school, i focused almost entirely on Patient Safety as the top of that i worked on. I can tell you, absolutely there is a really Important Role of the internet of things in improving Patient Safety. One thing that gets lost in cyberspace and privacy is you cant just walk everything that an sick theres no systems and lets all go back to using the scalpel at the pencil. Not going to work. We have real gains we can make a leveraging data and modern technology and leveraging conceptual frameworks like the internet of things. But it think sometimes we frame as an either or and is not an either or. We both need to use these advanced technologies to our patients and we need to deploy advanced technologies to protect these data and systems. Until we start thinking about it as an and instead of or, we are not going to fundamentally shift this curve but its absolutely possible think and we see top Health Systems doing it all the time. Jennifer, i just had a question. Im not sure how familiar you are with mit has been a big center for medical innovation for what one thing that was left out of this conversation, robert refill was talking about it and when you talk to his research but universities are a giant hole for a lot of this hacking, but also particularly from foreign influences especially because most universities, when you want a part of with other universities, especially in china, i mean, youre right. We should be encouraging that. We should want collaboration because thats the nature of academia particularly in the sciences, but i would argue especially some of the research thats come out of mit and how we know that at least two actively monitor leaders him a special with the genome stuff you were talking about earlier, they were tracking peoples dna evidencebased on ethnic heritage. I feel like to an extent it brings up the question of, should we just banned Chinese Investment and investors from the u. S. Tech industry . Its an extreme option but is it really ridiculous considering we all have American Science being at least somewhat culpable in whats really going on at the moment . Its a really good question. I dont think there is an easy answer to it. Because of course that. First of all, i mean, there were those two meck county site is likely were just indicted for doing exactly that, what youre talking about. Its going happen again. But you know what . We need to share this data openly. We need more data or we are not going to find these cures, were not going to discover the diseases we need. Its a real complex question. So it could be a matter of how we show share the data come int format. It could it needs to be reciprocal. The other issue is one of money. Chinese investors are putting a lot of money into biotech in this country. So theres a financial question as well as an ethical one. I think its a conversation that has to be had. One of the things i dont think weve asked at all of the general public and we dont know about consumers is, what do consumers think . How open to people think their data should be . Are the people in this room will need to share the data, but only the identified . I dont think we have a really good since of which way the general public is going as well, and its hard to make policy without even knowing that. So theres no easy answers, but they are all questions which need to be discussed and we need to find out what the Public Perception is as well. Sorry i didnt answer your question. [inaudible] i guess the frustration a lot of us in the National Security community especially comes to china have come is that frankly, when it comes to trade come when it comes to science, when it comes to stuff like the south china sea, it seems like china gets the benefit of operating within the International System but not the responsibility for the burden of having to follow any rules. Even if we do set up like all right, fine can you can access to american updated but you can only do a through cms. Cms has to be monitoring it. The reality is many of these investors dont have a choice as to whether not want to do that because many of the companies are also on by the chinese government. In most companies, i believe a member of the Chinese Communist party has to sit on the board of that company. We have seen this with apple, with several other companies. I guess the question is, because its true, we should be having a conversation about, as a general public and asking with the general public thinks about issues like this. But my issue i have, the same issue a lot of people have winded with china is how to do with an actor that isnt going to do with you on even terms . Should we try to make them hurt a little bit and make them understand that while relationship is one of symbiosis, we rely on them for trade and investment and other things. At what point do we have to just stand up and say no, not today . We are starting to do that. The administration put a halt to the 23 and investment that was going to take place here from the Chinese Company most recently. This is already happening. Their money is already here in many places so its a real, yes, im not sure what putting a stop to it would mean right now, what that would look like. Maybe that is a decision that paulson et cetera figure that out, what that looks like. But at the same time in ages gone a lot of important data from other nations. So we really have to balance whats important. Right here. Good afternoon. Im from senator manchins office i want to take the time to thank you all for taking the time to come to capital speak to us on this issue. I come from west virginia, and while our state has Incredible Community Health Networks such as in huntington, morgantown, charleston, so much of her work is done at the local level in very small rural clinics. The amount of information they are able to retain on patients is incredible. Obviously, as we talked about earlier, resources are scarce, especially money, whenever margins are so small within health care, but particularly in rural appalachian west virginia, the resources are even more scarce. As with the advancements in things such as telemedicine, what advice or recommendations could you offer to make sure that even though the resources are scarce, that we are still utilizing technology at the local level and still have the best protections in place . I can speak briefly to that. We have a recommendation in the space that specifically relates to rural settings. As you may know, some of the barriers to protect and gives the settlers are often led to the existing antikickback and star clause associate with Larger Organization providing proactive funding to these small affiliate clinics that represent major weak links. For instance, you could put them under the security umbrella of a larger hospital and that larger hospital may want to does a protective but they are not about to because of current legislation and current regulation. Thoughtful reforms to that would be an easy move. I think also in the longer term since, its how do we thoughtfully skill using technology, the types of automation and the types of insight and the types of proactive detection of threads that can reach up into all these communities, can reach out through networks of different providers and not necessarily have an individual human at every one of the sites watching it, but overall technologically enabled oversight of these organizations that are connected back to central ups. This is all very possible and if think theres some relatively low hanging fruit we could modify to transform the landscape and approve the care that we are delivering to our patients in rural clinics and the security of their data. Its reflective of the inequity we have right now between smaller, rural, maybe less resources and these larger Corporate Companies that have all the resource they need to do the tech lg updates and have the full breadth of security. Its going to be really hard for some of the smaller places to be completely secure. And its not going to be equitable. I think thats a real problem and we are seeing that across the country. Its a lot tougher. I do think aha and other organizations are doing a really good job and the real Hospital Association is doing a great job with trying to share some of the resources they have, but its tough. We have come up on the end of our time here, so looks like perfect timing, number questions remaining. I want you think you both again. Youve been very generous with your time, i think everyone that came out today. I would like to say as you can probably tell from the context of a conversation that there is a lot of work to be done in this area, a lot we need to focus on the fort and export to a great extent. This is something that the Senate Cybersecurity caucus will be committed to exploring in the future. We deftly invite all of your bosses to join the caucus, and we thank you once again on behalf of senator warner for coming today. [applause] if anyone would like to reach me directly, its robert at protenus. Com. I get the benefit of having just a single name. Cspan has live coverage of the 2020 president ial candidates at the iowa state fair. Today we live at 10 a. M. Eastern with former hud secretary julian castro. Watch anytime online at cspan. Org or listen live from wherever you are on the go using the free cspan radio app. We take you live now next u. S. Senate, in for a short pro forma session. They wont