Chair Rodgers Opening Statement on Health Care Cybersecurity

opening statement thank you everyone for being here today to discuss cyber security and healthc care and the recent change healthc care Cyber attack while I'm disappointed that United Health Group chose not to make anyone available to testify today so that the committee and the American people could hear directly from them about how the specific Cyber attack occurred I will note United Health briefed ENC members recently on the matter and have committed to testifying at a future hearing Health Care cyber security was already a concern before change the change attack and I look forward to today's discussion about what the federal government Doctors Hospitals and others have done right and where there is opportunity to improve the resiliency of the healthc Care sector the change healthc care cyber attacked is not just the most recent case of ransomware targeting our Healthcare System and due to change's integration with so many of our healthcare providers and payers it is still impacting providers and Healthcare organizations across the country I have heard concerns from providers rural hospitals and many others all worried about what this Cyber attack means for them and just this morning the change tack the change held hackers were posting stolen data from the ransomware attack there are still many unanswered questions and lessons to be learned from this attack how did this attack gain entry to the change system how can hospitals doctors and others best protect themselves what other third parties do our nation's healthc care providers rely upon if taken offline could have a similar negative impact on the US Health Care System healthc care infrastructure is crucial for patients receiving the care they need and sadly this will likely not be the last breach or ransomware attack that will happen patient data is valuable and it is housed online that is why we must continue to examine Healthcare cyber security and make sure that patient data remains protected HHS has overall responsibility for ensuring cyber security within healthc care across the United States federal government and the administration for strategic preparedness and response or asper has been designated the One-Stop shop responsible for leading and coordinating the cyber security efforts both within HHS and external partners however there seems to be multiple offices and agencies that have some role in cyber response the office of civil rights the HHS Chief Information officer the office of national coordinator and then in the most recent response CMS all played a role as our health care System becomes more Consolidated the impacts of cyber attacks if successful may be more widespread pulling in even more agencies and offices within HHS this committee has led at examining cyber security across all SE sectors in 2019 Congress made explicit that part of the responsibilities of asper is preparedness and response to cyber attacks in 2020 a bill led by Dr Burgess which passed through this committee encouraged Healthcare organizations to adopt strong cyber security best practices last Congress this committee worked to give FDA more authority over cyber security medical devices and more recently in the reauthorization of the pandemic and all hazards preparedness act reported by this committee we made it explicit that cyber security should be considered and prioritized as a part of asper National Health security strategy and the Energy and Commerce Committee will continue leading the way and examining this issue I hope we can use this hearing today to learn more about the change healthc care Cyber attack and the response resp is it a unique situation what do providers and patients need to know and look out for I don't want this committee to be back here in five or 10 years after more patients healthc care is disrupted by known criminal actors finding vulnerabilities and cyber security of our health care System to prevent that I look forward to hearing from our Witnesses about what can healthc care learn from other sectors are there more Federal authorities HHS needs what is the best balance to get better adoption of existing cyber security practices and I look forward to the discussion and yield back thank you Mr chairman