Newberry hospital picked for free federal cybersecurity pilot program

NEWBERRY — A group of private cybersecurity companies will offer their services, free of charge, to a Newberry hospital as part of a federal pilot project aimed at better protecting rural healthcare from virtual attacks.

White House National Cyber Director Sean Cairncross and U.S. Department of Health and Human Services Chief Counselor Chris Klomp were on hand Monday at Newberry Health, located 40 miles northwest of downtown Columbia, for the launch of Project Lifeline 250.

SUBSCRIBE: GET THE MORNING HEADLINES DELIVERED TO YOUR INBOX.

“Thanks to the commitment of the world-leading American industry here today, we’re deploying the greatest American tools and capabilities to defend hospital networks, deploy physical backup devices after an initial incident to ensure an impacted hospital can still provide critical care and identify high-risk devices and replace them,” Cairncross said. “We’ll find what works and we’ll scale it. America’s rural communities and hospitals, they rely on it, and we’ll get it done.”

“We have an opportunity to build a model that every rural hospital across the entire country can rely upon,” Cairncross added.

The announcement was light on details. Officials did not say when the six-month pilot period would start, how it would be maintained and expanded after the pilot period or how that expansion might be paid for. Nor did they say why they selected South Carolina for this initial trial.

The Office of the National Cyber Director and the South Carolina State Law Enforcement Division’s cybersecurity arm will oversee the program.

Technology companies including Cisco, Cyera, Microsoft, Trellix, Zscaler, Rilian, Dispel, Abnormal AI and Becton, Dickinson and Company, Palo Alto Networks, ServiceNow, Infoblox Security Solutions and Forescout Technologies will provide their services.

The average hospital has more than 26,000 internet-connected devices, all of which could be subject to a cyber attack, Klomp said. And his agency tracked more than 2,200 health-related cyber incidents just last year.

And unlike larger hospital systems, rural providers don’t have the same financial resources to shore up its technological defenses.

“When a family walks through the doors of a hospital, they’re counting on a nurse, they’re counting on a doctor, someone to be there and to help them,” Klomp said. “Those professionals are depending on systems to share the medical records, the labs, the radiology communications, and others to give them the information to coordinate care appropriately. When those systems fail, the consequences can reach the bedside. They impact real lives. They impact the patient, impact their family.”

Klomp told the story of St. Margaret’s Health, a Catholic hospital system in Illinois, which closed in 2023. In their filings to the state, hospital officials cited a cyberattack as one of the reasons behind their closure.

“They couldn’t generate revenue and they couldn’t keep their doors open,” Klomp said.

Closer to home, AnMed in the Upstate saw its operations interrupted for months by a cybersecurity attack in which CEO William Kinley said cybercriminals accessed patients’ health information.

AnMed, with its 461-bed hospital in Anderson and more than 60 physician practices across South Carolina and Georgia, kept its urgent care and emergency services locations open following the July 26 attack. But doctors and patients had limited access to medical records.

It wasn’t until mid-September that the hospital system returned to normal operations.

“Cybersecurity is no longer just an IT issue,” SC Law Enforcement Division Chief Mark Keel said. “It is a public safety issue. It’s an economic issue. And in a healthcare environment, it can be the difference between life and death.”

“South Carolina is not waiting for a next cyber incident to happen,” Keel added. “We are identifying risks, bringing partners together, and putting practical solutions in place to better protect the citizens of our state.”

SC rural hospitals, doctors’ offices receive share of $200M in federal funding amid Medicaid cuts

One of the technologies the Newberry hospital will test out is called Project Code Cart, Cairncross said.

Researchers at the University of California San Diego developed Code Cart, which Cairncross described as an IT system in a box, using a U.S. Department of Health and Human Services grant.

“It’s designed, in the event of a full shutdown of systems in a hospital for a ransomware attack, to completely restore essential functionality within two hours, so that all operations can be maintained,” Cairncross said. “Think essential communications. Think radiology labs, access to critical electronic health records.”

Project Lifeline follows a similar White House-led cyber effort: Project Watershed 250, a pilot project to protect water infrastructure from a cyber attack in Texas. The Office of the National Cyber Director announced that pilot in August.

SUPPORT: YOU MAKE OUR WORK POSSIBLE

Courtesy of South Carolina Daily Gazette