“Healthcare is a rapidly growing sector of our economy that employs more than 18 million workers, and is made up of both public and private sector organizations related to patient services, medical devices and manufacturers, and electronic health and medical records, that store considerable amounts of personal information, making them frequent targets of attacks,” Sen. Gary Peters (D-Mich.) said in his opening statement. Peters chairs the committee. “Cyberattacks on hospitals, and other healthcare providers, can cause serious disruptions to their operations, and prevent them from effectively providing critical, lifesaving care to their patients. Breaches can also lead to the exposure of sensitive personal and medical information of patients and health care personnel.”

A provision authored by Sen. Peters and Sen. Rob Portman (R-Ohio) to enhance the country’s ability to combat cybersecurity threats against critical infrastructure was recently signed into law as a part of the government funding legislation. The provision requires critical infrastructure owners and operators to report to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours if they are experiencing a substantial cyberattack and within 24 hours of making a ransomware payment.

“This law will help ensure that government is able to better track cybersecurity threats to our critical infrastructure, provide more transparency and situational awareness for our cybersecurity defenses, and enable CISA to warn potential victims of ongoing attacks, so they know if they could be a target next,” Peters said during the hearing.

Last week’s hearing also highlighted why rural healthcare providers are especially vulnerable to attacks. In her testimony, Kate Pierce of Fortified Health Security, mentioned budget constraints and lack of cybersecurity staffing as some challenges.

“Smaller facilities, from my experiences, most of them have no staff that are directly assigned to cyber or they have very limited staff in that area,” Pierce said.