By Walter Pryce
Opinion. This column analyzes a commentary published by the Brookings Institution, a Washington think tank. The arguments and figures attributed to Brookings and its author are theirs; the conclusions about Buffalo and Western New York are the author’s.
Most hospital administrators in Western New York don’t need a think tank to tell them what a cyberattack costs. They can ask the people on Grider Street.
In April 2017, ransomware shut down more than 6,000 computers at Erie County Medical Center and forced staff back to paper charts. The attackers demanded 24 bitcoin, about $30,000 at the time. ECMC refused to pay, and the hospital later estimated the recovery cost at nearly $10 million, roughly half for new hardware, software and outside help and half for overtime and lost revenue, according to figures reported by The Buffalo News. Chief executive Thomas Quatroche Jr. explained the decision plainly to WBFO: the hospital had backups, paying would make it a target, and “We didn’t want to pay criminals.”
Nearly a decade later, Congress is debating how much of that burden should fall on hospitals, and how much help they should get. A new Brookings commentary makes the most useful contribution to that debate I have read this year.
Brookings’ argument
In “Mandates, money, and the end of voluntary hospital cybersecurity,” published Oct. 26, Brookings fellow Niam Yaraghi looks at three bills now before Congress. Two were the subject of a Sept. 15 hearing of the House Energy and Commerce health subcommittee: the Rural Hospital Cybersecurity Enhancement Act, which would have the Department of Health and Human Services write a rural workforce strategy and publish free training materials, and the Health Care Cybersecurity and Resiliency Act, which would tighten coordination between HHS and the Cybersecurity and Infrastructure Security Agency, authorize grants and require multifactor authentication and encryption. The third, reintroduced by Sens. Mark Warner and Ron Wyden, would set mandatory standards, audit compliance, lift the caps on HIPAA fines and pay $1.3 billion through Medicare, $800 million of it for rural and safety-net hospitals.
The debate is usually framed as mandates versus money. Yaraghi says that framing is wrong. In his telling, federal policy since 2015 has been to “advise, publish, and wait,” while large health data breaches reported to HHS rose from 270 in 2015 to 804 in 2025. He cites research finding that ransomware attacks raise in-hospital death rates among patients already admitted by 34% to 38%.
His evidence for what works comes from his own research on a 2013 HIPAA rule that extended liability to the claims processors and software vendors that handle patient data. Once enforcement began, he writes, breaches among those firms fell while breaches at providers kept rising. “The rule worked because it changed liability, not because it offered training,” he writes.
But he is just as blunt about the other side of the ledger. Citing Chartis, he notes that 41.2% of the rural hospitals it analyzed operate at a loss and that critical access hospitals hold a median of 98 days of cash. “Accountability without money is a closure policy for hospitals with 98 days of cash,” he writes. His prescription: one bill with standards written and updated by HHS, executive sign-off and audits, mandatory funding that arrives before the deadlines, shared regional defenses for small rural hospitals, and a public breach portal that shows what was fixed after each incident.
New York already tried the combination
What makes this argument worth reading in Buffalo is that New York has, in effect, already run the experiment Brookings recommends.
In November 2023, Gov. Kathy Hochul proposed statewide cybersecurity rules for hospitals and paired them with $500 million in her FY2024 budget that health care facilities could apply for to upgrade their technology, including cybersecurity tools. She called the rules “a nation-leading blueprint.” The state Health Department adopted the regulation, 10 NYCRR 405.46, effective Oct. 2, 2024. Hospitals had to start reporting serious cyber incidents to the state within 72 hours right away, and by Oct. 2, 2025 they had to have a risk-based security program, a chief information security officer, annual risk assessments and testing, multifactor or risk-based authentication, staff training and a tested incident response plan.
That is close to the “mandates plus money” design Yaraghi favors, and the state did it before Washington. His essay even points to a different New York rule, the state’s financial services cybersecurity regulation with its signed annual compliance certification, as the one policy in a study of four interventions that was followed by a measurable drop in breaches.
That does not mean the federal debate is irrelevant here. Federal rules cover the vendors, clearinghouses and billing firms that New York’s hospital rule does not directly reach, and the 2024 Change Healthcare attack, which Brookings says exposed 192.7 million records, showed how one vendor’s failure can ripple through hospitals nationwide. And the Warner-Wyden approach would pay hospitals through Medicare, a recurring source of revenue for smaller hospitals across rural Western New York, rather than through one-time capital grants.
What Congress should take from it
There is room here for agreement across party lines. The House subcommittee, under Republican leadership, held a serious hearing on the issue. The American Hospital Association’s objection, as Brookings summarizes it, that hospitals should not face mandates “as if they were at fault” for crimes committed against them, is fair, and HHS itself estimated its proposed update to the HIPAA Security Rule would cost regulated entities about $9 billion in the first year. Brookings reports that rule has now been pushed to July 2027, which gives Congress time to get the design right rather than simply pile on costs.
Getting it right means taking both halves of Yaraghi’s argument seriously. Rules without money squeeze the smallest hospitals. Money without rules buys training binders. New York’s approach, a clear standard backed by state funding, is a reasonable template, and Western New York’s House members should say so as the subcommittee considers a markup.
ECMC paid nearly $10 million to recover from an attack whose ransom demand was about $30,000. The cheapest version of hospital cybersecurity is the one that is in place before the next ransom note appears.
Walter Pryce writes opinion for The Buffalo Chronicle. Read the Brookings Institution’s original commentary by Niam Yaraghi here.
Photo: Erie County Medical Center in Buffalo, April 2020. Andre Carrotflower / Wikimedia Commons, CC BY-SA 4.0.
Leave a Reply