Cybersecurity Coalition Demands Overhaul to Shield Healthcare from Rising Threats

At a glance

• Healthcare under attack: Rising attacks on hospitals and health systems have prompted calls for new security policy.
• HSCC-CWG’s position: The Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group (HSCC-CWG) wants government and industry to write healthcare security policy together.
• Halt the NPRM: The group asked the government to suspend the Notice of Proposed Rulemaking (NPRM) on the HIPAA Security Rule and reassess it.
• Working together: The group proposes a consultation process between industry and policymakers instead.

Industry pushes back on the HIPAA proposal

Attacks on healthcare are becoming more frequent and more sophisticated. In March 2025 the Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group (HSCC-CWG) asked the government to rethink its approach to healthcare cybersecurity policy.

A frequent target

Healthcare is heavily connected and holds sensitive patient data, which makes it a top target for criminals. Attacks can interrupt patient care and expose records. The financial and reputational costs are high, and recent incidents have pushed security experts to call for quick action.

Who the HSCC-CWG is

The HSCC-CWG is a coalition of healthcare and cybersecurity professionals. It wants a joint policy that fits current threats. Its members argue that rules written together with the sector will protect hospitals better than rules imposed on it.

What the group is asking for

The group’s statement asked federal officials to work with healthcare organizations on a structured consultation lasting about a year, instead of finalizing the current proposal.

The NPRM in question

A key part of the proposal is suspending the Notice of Proposed Rulemaking (NPRM) on updates to the HIPAA Security Rule. The group said the rule as written was not practical, citing the cost and complexity of compliance. It argued that policies should be reviewed so they don’t weaken the sector’s defenses by accident.

Working together

The HSCC-CWG wants industry and policymakers to work together. Each side brings expertise the other lacks. The aim is a strategy that combines technology and policy.

What happens next

Attacks on healthcare are rising. The HSCC-CWG argues that pausing the NPRM and starting a joint process would lead to a more secure health system. The decision now rests with federal regulators, and hospitals are waiting to see which rules they will have to follow.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.