DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

HHS launches $50M security initiative to thwart hospital ransomware

Posted on May 20, 2024 by Dissent

Chad Van Alstin reports:

The U.S. Department of Health and Human Services (HHS) is launching a $50 million incentive program to encourage hospitals to improve their cybersecurity. Dubbed the Universal Patching and Remediation for Autonomous Defense—or UPGRADE—program, the initiative aims to speed up vulnerability detection and patch deployment through the creation of a platform that IT leaders can use to produce a “digital twin” of devices on the hospital network and run security tests.

UPGRADE is primarily aimed at stopping future ransomware incidents, given how vulnerable hospital networks are to those attacks.

Read more at HealthExec.

Related: ARPA-H announces program to enhance and automate cybersecurity for health care facilities :

Today, the Advanced Research Projects Agency for Health (ARPA-H) announced the launch of the Universal PatchinG and Remediation for Autonomous DEfense (UPGRADE) program, a cybersecurity effort that will invest more than $50 million to create tools for information technology (IT) teams to better defend the hospital environments they are tasked with securing.

Cyberattacks that hamper hospital operations can impact patient care while critical systems are down and can even lead to facility closure. A major hurdle in advancing cybersecurity tools in the health sector is the number and variety of internet-connected devices unique to each facility. While consumer products are patched regularly and rapidly, taking a critical piece of hospital infrastructure offline for updates can be very disruptive. Delayed development and deployment of software fixes can leave actively supported devices vulnerable for over a year and unsupported legacy devices vulnerable far longer.

“We continue to see how interconnected our nation’s health care ecosystem is and how critical it is for our patients and clinical operations to be protected from cyberattacks. Today’s launch is yet another example of HHS’ continued commitment to improving cyber resiliency across our health care system,” said HHS Deputy Secretary Andrea Palm. “ARPA-H’s UPGRADE will help build on HHS’ Healthcare Sector Cybersecurity Strategy to ensure that all hospital systems, large and small, are able to operate more securely and adapt to the evolving landscape.”

“It’s particularly challenging to model all the complexities of the software systems used in a given health care facility, and this limitation can leave hospitals and clinics uniquely open to ransomware attacks,” explained UPGRADE Program Manager Andrew Carney. “With UPGRADE, we want to reduce the effort it takes to secure hospital equipment and guarantee that devices are safe and functional so that health care providers can focus on patient care.”

Filling this gap in digital health security will take expertise from IT staff, medical device manufacturers and vendors, health care providers, human factors engineers, and cybersecurity experts to create a tailored and scalable software suite for hospital cyber-resilience. The UPGRADE platform will enable proactive evaluation of potential vulnerabilities by probing models of digital hospital environments for weaknesses in software. Once a threat is detected, a remediation (e.g., patch) can be automatically procured or developed, tested in the model environment, and deployed with minimum interruption to the devices in use in a hospital.

“Health isn’t just something that impacts an individual, and ARPA-H is investing in ways to build stronger, healthier, and more resilient health care systems that can sustain themselves between crises,” said ARPA-H Director Renee Wegrzyn, Ph.D. “UPGRADE will speed the time from detecting a device vulnerability to safe, automated patch deployment down to a matter of days, providing confidence to hospital staff and peace of mind to the people in their care.”

Addressing vulnerabilities in health care and data security is a challenge that ARPA-H is uniquely positioned to address. ARPA-H’s Digital Health Security Initiative, DIGIHEALS, launched last summer and is focused on securing individual applications and devices. The agency has also recently partnered with Defense Advanced Research Projects Agency for the Artificial Intelligence Cyber Challenge, or AIxCC, a prize competition to secure open-source software used in critical infrastructure. UPGRADE aims to secure whole systems and networks of medical devices to ensure solutions can be employed at scale.

Through a forthcoming solicitation, UPGRADE seeks performer teams to submit proposals on four technical areas: creating a vulnerability mitigation software platform, developing high-fidelity digital twins of hospital equipment, auto-detecting vulnerabilities, and auto-developing custom defenses.

Multiple awards under this solicitation are anticipated. To learn more about UPGRADE, including information about the draft solicitation, virtual Proposers’ Day registration, and how to state interest in forming an applicant team, visit the UPGRADE program page.

For more information on HHS’ Cybersecurity Performance Goals and HHS’ cybersecurity work, visit HHS Cybersecurity Gateway.

Related posts:

  • Lawmakers introduce bipartisan bill for ‘internet of things’ security standards
  • FDA outlines cybersecurity recommendations for medical device manufacturers
  • Protect Good Faith Security Research Globally in Proposed UN Cybercrime Treaty
  • HHS Cybersecurity Task Force Provides New Resources to Help Address Rising Threat of Cyberattacks in Health and Public Health Sector
Category: FederalHealth DataMalwareOf NoteU.S.

Post navigation

← Mosaic Mental Health notifies patients of breach
FTC Finalizes Order with Blackbaud Related to Allegations the Firm’s Security Failures Led to Data Breach →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud
  • Swiss Health Foundation Radix Hit by Cyberattack Affecting Federal Data
  • Russian hackers get 7 and 5 years in prison for large-scale cyber attacks with ransomware, over 60 million euros in bitcoins seized
  • Bolton Walk-In Clinic patient data leak locked down (finally!)
  • 50 Customers of French Bank Hit by Insider SIM Swap Scam
  • Ontario health agency atHome ordered to inform 200,000 patients of March data breach
  • Fact-Checking Claims By Cybernews: The 16 Billion Record Data Breach That Wasn’t
  • Horizon Healthcare RCM discloses ransomware attack in December
  • Disgruntled IT Worker Jailed for Cyber Attack, Huddersfield
  • Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • The Trump administration is building a national citizenship data system
  • Supreme Court Decision on Age Verification Tramples Free Speech and Undermines Privacy
  • New Jersey Issues Draft Privacy Regulations: The New
  • Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report
  • Germany Wants Apple, Google to Remove DeepSeek From Their App Stores
  • Supreme Court upholds Texas law requiring age verification on porn sites
  • Justices nix Medicaid ‘right’ to choose doctor, defunding Planned Parenthood in South Carolina

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.