US HHS to Invest $50 Mn to Defend Hospitals From Cyber Attacks

The research division of the U.S. Department of Health and Human Services (HHS) is planning to allocate over US$50 million towards the development of cutting-edge cybersecurity solutions for healthcare.

The Advanced Research Projects Agency for Health (ARPA-H) within HHS said the initiation of the "Universal PatchinG and Remediation for Autonomous DEfense" (UPGRADE) program. The program aims to create tools that enable hospitals and healthcare systems to efficiently identify and address cyber vulnerabilities within their infrastructure.

“We continue to see how interconnected our nation’s healthcare ecosystem is and how critical it is for our patients and clinical operations to be protected from cyberattacks. Today’s launch is yet another example of HHS’ continued commitment to improving cyber resiliency across our health care system," said HHS Deputy Secretary Andrea Palm.

"ARPA-H’s UPGRADE will help build on HHS' Healthcare Sector Cybersecurity Strategy to ensure that all hospital systems, large and small, can operate more securely and adapt to the evolving landscape,” Palm added.

In a statement, HHS stated that one of the primary challenges hindering the progress of cybersecurity tools within the healthcare sector is the abundance and diversity of internet-connected devices found in each facility. 

Unlike consumer products that receive frequent and prompt patches, updating essential hospital infrastructure can lead to significant disruptions. 

Consequently, the delayed development and implementation of software fixes may leave actively supported devices vulnerable for extended periods, with unsupported legacy devices at risk for even longer durations.

The UPGRADE platform will facilitate the proactive assessment of potential vulnerabilities by examining digital models of hospital environments to identify software weaknesses. 

Upon detecting a threat, a remediation such as a patch can be automatically acquired or created, tested within the model environment, and implemented with minimal disruption to the devices operational within a hospital.