Foreword by Sen. Mark Warner

The WannaCry ransomware attacks in 2017 demonstrated that cyber-attack targets have moved from being concentrated on finance and government entities, to other industries like health care, telecommunications, and logistics, with the attack surface growing to include vulnerabilities in hardware as well as software. The rapid adoption of technology in health care has the potential to improve the quality of patient care, expand access to care, and reduce wasteful spending. However, such technology also has the power to put patients at risk as it facilitates the proliferation of valuable personal health care data. To support the benefits of health care technology, we must also effectively protect patient information and the essential operations of our health care entities. Furthermore, escalating cyber-attacks against health care entities are not just data or device security issues— they are a patient safety concern.

Recognizing that cybersecurity is an increasingly complex issue that impacts the health, economic prosperity, national security, and democratic institutions of the country, I helped establish the Senate Cybersecurity Caucus in June of 2016. The bipartisan Caucus serves an educational resource to help the Senate more effectively engage on cybersecurity policy issues, and to highlight the most pressing information security challenges facing the United States. With the ongoing rise in ransomware and other cyber-attacks, my colleagues and I have noticed that the health care industry is increasingly targeted. It is more important than ever to better understand how cybersecurity and health care interact.

Robert Lord and Dillon Roseen’s report, “Do No Harm 2.0,” is a valuable effort to bring awareness to the issue of cybersecurity and health care. It underscores the fact that information security is not just an IT issue, but also a patient safety issue. It describes the state of the threat, the importance of the problem, and provides a number of potential policy remedies for Congress to consider. As a longtime advocate for the importance of addressing cybersecurity vulnerabilities in health care systems and organizations, I thank the authors for bringing much-needed attention and thoughtfulness to the issue, and hope that it will receive the consideration it deserves.

U.S. Senator Mark R. Warner (VA)
Co-Chair Senate Cybersecurity Caucus