This week, Health-ISAC®‘s Hacking Healthcare® examines an upcoming Federal Communications Commission (FCC) Notice of Proposed Rulemaking (NPRM) related to their Rural Health Care (RHC) program. Join us as we briefly summarize what the program is, what the NPRM seeks to change related to cybersecurity, and how Health-ISAC members can engage with it to improve cybersecurity outcomes.
As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)
PDF Version:
Text Version:
Welcome back to Hacking Healthcare® !
FCC Rural Health Care Program Revisions
On August 7, the FCC published a press release outlining their intention to streamline and improve the RHC program.[i] The press release promised to “improve the efficiency and effectiveness” of the RHC by “cut[ting] red tape, reduc[ing] administrative burdens on program participants, and ensur[ing] that limited program funding reaches the rural hospitals and clinics that need it most.”[ii] The 32-page NPRM that was released alongside the press release contains several cybersecurity related provisions that are worth assessing.[iii]
What is the RHC Program?
As the FCC describes it, the RHC program “provides universal service financial support to help rural health care providers obtain telecommunications and broadband services at discount rates.”[iv] The program provides support through two initiatives, the Telecommunications Program and the Healthcare Connect Fund. The Telecommunications Program subsidizes the difference between rates for health care providers in rural areas in comparison to urban areas, while the Healthcare Connect Fund provides a discount on a range of eligible advanced telecommunications and information services.[v]
What is in the NPRM?
As stated above, the NPRM covers a range of issues with the broad intent of improving efficiency and reducing administrative burdens in three general areas: 1) Improving Support Calculations in the Telecom Program; 2) Making Effective Use of RHC Program Supported Services; and 3) Evaluating and Improving Program Processes. The cybersecurity related elements are primarily within the two subsections of 2) Making Effective Use of RHC Program Supported Services. Two of the most prominent cybersecurity related provisions are Promoting Lower-Cost Secondary Services and Establishing an RHC Program Eligible Services List.
Cybersecurity: Secondary Services
This section outlines the FCC’s desire to seek comments on measures to “promote health care providers’ use of lower-cost options” for what are essentially backup services, which the FCC views as a potential “essential component of a health care provider’s risk management plan by providing continuity of patient care in the event of a communications system failure or cyber threat.”[vi]
This portion of the NPRM seeks to identify possible options to lower program costs through modifications to its rules and requirements. This includes potentially distinguishing primary services from secondary services and limiting the types of technologies available through the program. However, the FCC is cognizant that there may be good reasons beyond cost-effectiveness for entities to choose the backup services they do, such as safety and resiliency, and they are interested in hearing more detailed responses from stakeholders to help inform future program changes.
Cybersecurity: Eligible Services List
This section proposes the adoption of an eligible services list for the RHC program’s Healthcare Connect Fund. The Healthcare Connect Fund provides discounts on a range of eligible advanced telecommunications and information services, but it has never provided an explicit list of the products and services it covers. To date, the Healthcare Connect Fund provides general guidance through an example document that outlines the common types of products that are generally approved, but even this guidance cautions that “Inclusion on this list does not guarantee funding” and that “products and services not listed below may be eligible for support.”[vii]
According to the NPRM, the FCC believes that instituting an eligible services list, similar to what already exists for their E-Rate program, could make the “RHC Program rules more transparent, easier to administer, and more comprehensible, particularly for new entrants to the program.”[viii] While much of this section is dedicated to asking questions related to if an eligible services list would be a good idea and how it should work in practice, it also asks questions related to what should be included.
Action & Analysis
**Included with Health-ISAC Membership**
[i] https://docs.fcc.gov/public/attachments/DOC-424077A1.pdf
[ii] https://docs.fcc.gov/public/attachments/DOC-424077A1.pdf
[iii] https://docs.fcc.gov/public/attachments/FCC-26-54A1.pdf
[iv] Qualifying entities must meet the requirements of being one of (1) post-secondary educational institutions offering health care instruction, teaching hospitals, and medical schools; (2) community health centers or health centers providing health care to migrants; (3) local health departments or agencies; (4) community mental health centers; (5) not-for-profit hospitals; (6) rural health clinics; (7) skilled nursing facilities (as defined in section 395i–3(a) of title 42 and (8) consortium of health care providers consisting of one or more entities falling into the first seven categories). A qualifying entity must also be non-profit or public.
[v] Per the FCC’s NPRM: “Under the broadband-based HCF Program, eligible advanced telecommunications and information services are those that enable ‘health care providers to post their own data, interact with stored data, generate new data, or communicate, by providing connectivity over private dedicated networks or the public internet for the provision of health information technology.’”
[vi] https://docs.fcc.gov/public/attachments/FCC-26-54A1.pdf
[vii]https://www.usac.org/wp-content/uploads/rural-health-care/documents/handouts/HCF-Program-Examples-of-Common-Products-and-Services.pdf
[viii] https://docs.fcc.gov/public/attachments/FCC-26-54A1.pdf
[ix]https://www.nbcnews.com/tech/security/cyberattacks-us-hospitals-mean-higher-mortality-rates-study-finds-rcna46697
[x] https://www.federalregister.gov/
Click Here For The Original Source.
