The Advanced Research Projects Agency for Health (ARPA-H) is launching an initiative to create information technology tools to help hospitals with cybersecurity.

ARPA-H announces program to enhance and automate cybersecurity for health care facilities

The program seeks to protect operations and ensure the continuity of patient care

Safeguarding protected health information is a top priority for the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR).  OCR is sharing the following announcement of Advanced Research Projects Agency for Health (ARPA-H) on the launch of Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE) program, a cybersecurity effort that will invest more than $50 million to create tools for information technology (IT) teams to better defend the hospital environments they are tasked with securing.  Cyberattacks that hamper hospital operations can impact patient care while critical systems are down and can even lead to facility closure.  A major hurdle in advancing cybersecurity tools in the health sector is the number and variety of internet-connected devices unique to each facility.  While consumer products are patched regularly and rapidly, taking a critical piece of hospital infrastructure offline for updates can be very disruptive.  Delayed development and deployment of software fixes can leave actively supported devices vulnerable for over a year and unsupported legacy devices vulnerable far longer.  

“We continue to see how interconnected our nation’s health care ecosystem is and how critical it is for our patients and clinical operations to be protected from cyberattacks.  Today’s launch is yet another example of HHS’ continued commitment to improving cyber resiliency across our health care system," said HHS Deputy Secretary Andrea Palm.  "ARPA-H’s UPGRADE will help build on HHS' Healthcare Sector Cybersecurity Strategy to ensure that all hospital systems, large and small, are able to operate more securely and adapt to the evolving landscape."

“It’s particularly challenging to model all the complexities of the software systems used in a given health care facility, and this limitation can leave hospitals and clinics uniquely open to ransomware attacks,” explained UPGRADE Program Manager Andrew Carney.  “With UPGRADE, we want to reduce the effort it takes to secure hospital equipment and guarantee that devices are safe and functional so that health care providers can focus on patient care.”

Filling this gap in digital health security will take expertise from IT staff, medical device manufacturers and vendors, health care providers, human factors engineers, and cybersecurity experts to create a tailored and scalable software suite for hospital cyber-resilience.  The UPGRADE platform will enable proactive evaluation of potential vulnerabilities by probing models of digital hospital environments for weaknesses in software.  Once a threat is detected, a remediation (e.g., patch) can be automatically procured or developed, tested in the model environment, and deployed with minimum interruption to the devices in use in a hospital.

“Health isn’t just something that impacts an individual, and ARPA-H is investing in ways to build stronger, healthier, and more resilient health care systems that can sustain themselves between crises,” said ARPA-H Director Renee Wegrzyn, Ph.D.  “UPGRADE will speed the time from detecting a device vulnerability to safe, automated patch deployment down to a matter of days, providing confidence to hospital staff and peace of mind to the people in their care.”

Addressing vulnerabilities in health care and data security is a challenge that ARPA-H is uniquely positioned to address.  ARPA-H's Digital Health Security Initiative, DIGIHEALS, launched last summer and is focused on securing individual applications and devices.  The agency has also recently partnered with Defense Advanced Research Projects Agency for the Artificial Intelligence Cyber Challenge, or AIxCC, a prize competition to secure open-source software used in critical infrastructure.  UPGRADE aims to secure whole systems and networks of medical devices to ensure solutions can be employed at scale.  Through a forthcoming solicitation, UPGRADE seeks performer teams to submit proposals on four technical areas: creating a vulnerability mitigation software platform, developing high-fidelity digital twins of hospital equipment, auto-detecting vulnerabilities, and auto-developing custom defenses.  Multiple awards under this solicitation are anticipated.  To learn more about UPGRADE, including information about the draft solicitation, virtual Proposers’ Day registration, and how to state interest in forming an applicant team, visit the UPGRADE program page.  For more information on HHS’ Cybersecurity Performance Goals and HHS’ cybersecurity work, visit HHS Cybersecurity Gateway.

Additionally, OCR has provided additional resources to help entities protect their record systems and patients from cyberattacks, including:

• OCR HIPAA Security Rule Guidance Material – This webpage provides educational materials to learn more about the HIPAA Security Rule and other sources of standards for safeguarding electronic protected health information.  Materials include a Recognized Security Practices Video, Security Rule Education Paper Series, HIPAA Security Rule Guidance, OCR Cybersecurity Newsletters, and more.
• OCR Video on How the HIPAA Security Rule Protects Against Cyber-Attacks  – This video educates the health care industry on real world cyber-attack trends from OCR breach reports and investigations and explores how implementation of HIPAA Security Rule safeguards can help detect and mitigate common cyber-attacks.  Topics include OCR breach and investigation trend analysis, common attack vectors, OCR investigations of weaknesses that led to or contributed to breaches, and how Security Rule compliance can help regulated entities defend against cyber-attacks.
• OCR HIPAA Risk Analysis Webinar – This webinar discusses the HIPAA Security Rule Risk Analysis discusses the HIPAA Security Rule requirements for conducting an accurate and thorough assessment of potential risks and vulnerabilities to electronic protect health information and reviews common risk analysis deficiencies OCR has identified in its investigations.
• HHS Security Risk Assessment Tool – This tool is designed to assist small- to medium-sized entities in conducting an internal security risk assessment to aid in meeting the security risk analysis requirements of the HIPAA Security Rule.
• Factsheet: Ransomware and HIPAA – This resource provides information on what is ransomware, what covered entities and business associates should do if their information systems are infected, and HIPAA breach reporting requirements.
• Healthcare and Public Health (HPH) Cybersecurity Performance Goals – These voluntary, health care specific cybersecurity performance goals can help health care organizations strengthen cyber preparedness, improve cyber resiliency, and protect patient health information and safety.
• Ransomware Guidance – OCR’s ransomware guidance provides specific information on the steps covered entities and business associates should take to determine if a ransomware incident is a HIPAA breach.  A breach, under the HIPAA Rules, is defined as, “…the acquisition, access, use, or disclosure of [PHI] in a manner not permitted under the [HIPAA Privacy Rule] which compromises the security or privacy of the PHI.”  See 45 CFR 164.402.  Whether the presence of ransomware would be a breach under the HIPAA Rules is a fact-specific determination.