Protecting One of the Nation's Critical Infrastructures: Healthcare

Michael B. Harrington, Carol S. Miller, and Ming-Pin Wang

hat is present in nearly every U.S. community, responds to every disaster, and functions every hour of the day, every day of the year? The nation’s $1.5 trillion healthcare and public health sector. Protection of this vast infrastructure against cyber, physical, and other threats has assumed increasing urgency since September 11, 2001.

MITRE has been helping the Department of Health and Human Services (HHS) Office of Public Health Emergency Preparedness to strengthen the security of the U.S. healthcare and public health infrastructure and ensure rapid response to incidents threatening public health. We created a framework of all the major entities contained in this sector and developed a plan to protect it. We are helping bring together elements of the sector in partnerships, which will share information, concerns, and plans. To accomplish this, we are leveraging the expertise of our colleagues who support the Department of Homeland Security on a wide range of critical infrastructure protection topics.

To understand the scale of the assignment, it is necessary to look at the wide variety of elements within the healthcare and public health sector. It consists of an array of decentralized, loosely coupled organizations, most of which are small compared to those found in such sectors as energy, telecommunications, and financial services. The health sector is a mixture of private and public organizations, but the majority are privately owned and operated.The private healthcare sector includes:

• More than 6,600 hospitals
• More than 492,000 ambulatory healthcare facilities
• Nearly 70,000 nursing and residential care facilities
• Nearly 175,000 individual or group medical practices
• Nearly 100 health insurance companies
• More than 40,000 pharmacies
• Approximately 2,500 pharmaceutical manufacturers
• A medical devices and supplies industry
• More than 500 blood and organ bank establishments

Though not nearly as large, the public healthcare sector includes:

• Elements of three federal cabinet-level departments (i.e., Health and Human Services, Veterans Affairs, and Defense)
• 57 state and territorial health departments
• 36 local and regional tribal health boards
• More than 3,000 local health departments and 2,000 public health laboratories

Altogether, there are approximately 4,300,000 professionals with health-related emergency responsibilities at work across the sector.

In December 2003, Homeland Security Presidential Directive (HSPD) 7 designated the HHS as the Sector Specific Agency responsible for critical infrastructure protection in the healthcare and public health sector. Under HSPD-7, HHS is responsible for:

• Collaborating with federal departments and agencies, state and local governments, and the private sector in identifying critical infrastructures and key resources
• Identifying and assessing the vulnerabilities of these infrastructures and resources
• Prioritizing these infrastructures and resources from an infrastructure protection viewpoint
• Developing strategic programs that will prevent and/or mitigate the effects of attacks against the sector's infrastructures and resources
• Developing and applying metrics
• Documenting the results in a Sector Specific Plan (SSP) that is updated annually

HHS considers health infrastructure protection as going beyond the delivery of patient care and safeguarding the public health. It includes building up an emergency-ready health infrastructure to respond to bioterrorism or other public health emergencies (from diseases to tsunamis). The HHS Sector Specific Plan is being combined with companion efforts in other sectors to produce a National Infrastructure Protection Plan (NIPP). This Plan will be updated annually.

MITRE's Role

Developing the Sector Specific Plan involved two main tasks for our team. The first was to engage sector leaders on topics of shared concern. This was crucial since most of this huge sector lies outside federal authority. With MITRE's technical and program assistance, HHS has forged productive partnerships with federal agencies that have health-related responsibilities, state and local public health organizations, relevant professional associations, and major private sector groups. An example of these partnerships are the new healthcare Information Sharing and Analysis Centers, one for private and one for public healthcare, being created in support of critical infrastructure protection (CIP).

These partnerships are designed to provide forums for industry leaders and government officials to discuss issues of common concern including, but not limited to, critical information protection. They are also the cornerstone of information-sharing networks and Websites that will link key professional organizations representing the 4.3 million healthcare professionals in this country. We're assisting in the creation of Websites devoted to CIP topics and suggesting linkages to foster wider communication among interested parties. We will continue to encourage these partnerships and are now working on a strategic plan and process for better integrating all parts of the sector from an information sharing perspective.

The second task was to develop the most complete picture possible of the major entities in the healthcare and public health sector that should be protected from attacks. While a great deal of information was available on this enormous sector, it was scattered widely. We gathered and organized the information in a way that would reflect the needs of the government to protect the sector. This framework was built into the first draft of the Sector Specific Plan, which MITRE completed for DHS comment in June 2004. The plan encompassed such topics as:

• Protection of fixed public and private healthcare facilities
• Emergency capabilities shared by the entire sector
• The growing role of information technology in the sector, including strengths and vulnerabilities
• The threat against fixed facilities posed by conventional explosives (e.g., truck bombs)
• Vulnerabilities of the sector that result from its dependence on other sectors (e.g., power, water, ground transportation)
• A preliminary assessment of the sector's critical information protection requirements
• Recent initiatives to strengthen CIP within the sector (e.g., creation of Coordination Groups and Information Sharing and Analysis Centers)
• Initial plans for prioritizing critical infrastructures and key resources and for developing protective strategies and plans
• Preliminary metrics for the measurement and communication of results

After comment by interested federal, state, local, and private sector parties, the updated Sector Specific Plan was incorporated into the NIPP for White House review. We are assisting the HHS to assess vulnerabilities and prioritize assets in the healthcare and public health sector, as called for by the NIPP.

MITRE continues to work with this sector to strengthen the infrastructure against terrorist attacks and other major threats. We are working with other sectors as well, helping to carry out the objectives of Homeland Security Presidential Directive 7. Our federally funded research and development centers (FFRDCs) are designed for just these kinds of projects—demanding broad expertise, domain knowledge, and continuity of experience and institutional memory. Also, our nonprofit FFRDC status allows us to deal with sensitive work that requires access to government-related information, critical infrastructure data, and sensitive and proprietary industry information.

For more information, please contact Michael B. Harrington, Carol S. Miller, or Ming-Pin Wang using the employee directory.

Solutions That Make a Difference.®
Copyright © 1997-2013, The MITRE Corporation. All rights reserved.
MITRE is a registered trademark of The MITRE Corporation.
Material on this site may be copied and distributed with permission only.

Privacy Policy | Contact Us