Senate bill eyes minimum cybersecurity standards for health care industry

A major February ransomware attack against Change Healthcare (part of UnitedHealth) exploited a server lacking multi-factor authentication, resulting in stolen credentials, a $22M ransom payment to the ALPHV group, widespread disruptions to healthcare claims and payments, and exposure of a substantial portion of Americans' health data. Senators Wyden and Warner proposed the Health Infrastructure Security and Accountability Act to require minimum cybersecurity standards, proactive HHS audits, increased penalties, funding for hospitals to meet standards, and annual executive certifications to improve resiliency across the health care sector.