SEC Cybersecurity Rule Increases Costs, Risks for Health Care

The Securities and Exchange Commission’s rule requiring publicly traded companies to quickly disclose cybersecurity breaches will pose unique risks for the health-care sector, data privacy and cybersecurity attorneys say.

“The health-care industry is going to be held to a higher standard,” said Bess Hinson, a privacy and cybersecurity attorney for Holland & Knight in Atlanta. “Given the nature of the data that they hold about patients—how sensitive it is and also the fact that the disruption to their business or operations—is literally life-threatening.”

The SEC’s requirement to report breaches within four business days means higher costs for health-care companies for ...