Private hospitals warn some ICUs could close due to cybersecurity costs
“In those smaller locations, you’ll make decisions around closing ICUs and they may be a small number of beds but the impact on that local community is quite significant,” he said.
The proposed Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 will give the government new powers to impose cybersecurity obligations on a range of industries, including “critical hospitals” – defined in the legislation as those that have intensive care units. Under the law, the Home Affairs minister will be able to direct hospitals and other entities to develop a “risk management program” to detect and mitigate against all hazards, including foreign interference threats through supply chains, and malicious cyberattacks. It will also require entities to identify high-risk employees who could engage in corporate espionage and sabotage.
The bill is the second tranche of critical infrastructure reforms after the Parliament last year passed a related bill that handed the government powers to intervene in the security responses of companies and institutions across 11 sectors, including heath care, finance, universities, and food and groceries in the event of major cybersecurity attack.
The Department of Home Affairs, which has estimated it will cost hospitals $5.8 million per year to maintain the program, said in its submission to the inquiry that the regulatory burden was “minimal when compared to the damage to the economy if businesses underinvest in security and allow breaches to occur.”
Home Affairs official Hamish Hansford told the inquiry it had been consulting with the private health care sector on the proposed measures since August 2020.
Ramsay Health Care is pushing for private hospitals to be excluded from the scope of the bill, with chief information security officer Christopher Neal telling the inquiry it financially disadvantaged some private providers and not others.
“In terms of competitors that run no hospitals with ICUs or run predominantly day surgeries or those sort of facilities...they would be able to operate at a lower cost base than we would have to,” Mr Neal said.
Gloss