The House Committee on Energy and Commerce is seeking answers as to whether two key HHS cybersecurity officials faced retaliatory measures and whether those actions weakened the HHS' role in responding to cybersecurity incidents within the healthcare sector.
In a letter to Acting HHS Secretary Eric Hargan, Reps. Greg Walden, R-Ore., Frank Pallone Jr., D-N.J., and Diana DeGette, D-Colo., request details about the employment appointments and departures of former HHS Director of the Healthcare Cybersecurity Communications and Integration Center Margaret Amato and Deputy Chief Information Security Officer Leo Scanlon, both of whom left their posts Sept. 6.
On Sept. 6, Ms. Amato and Mr. Scanlon were notified they were being temporarily displaced within the agency — Ms. Amato was sanctioned to unclassified duties at a separate HHS building, while Mr. Scanlon was placed on telework status. According to memoranda from the HHS executive director of information security, the move was arranged so the agency had time to review allegations against the Office of Chief Information Officer, Office of Information Security.
However, after Ms. Amato and Mr. Scanlon met with bipartisan committee staff to discuss information contained in a protected disclosure at a hearing in late September, HHS shuffled Ms. Amato around two additional times, marking her fourth move in less than a month.
Ms. Amato and Mr. Scanlon allege they were targeted by HHS officials and private-sector companies worried the HCCIC would take away responsibilities from their businesses. They also claim that their removals from the agency hindered the HCCIC's ability to effectively proceed.
"Given how critical healthcare cybersecurity is to the nation and the apparently central role of the new HCCIC … these recent and abrupt changes raise a number of questions about HHS and its commitment to providing effective leadership to the sector," the letter reads. "It is, therefore, important to understand what led HHS to temporarily remove to key HHS cybersecurity officials from their positions, while possibly making structural changes to [HHS'] role, thus creating new uncertainty as to who is in charge."
The committee requests HHS brief its staff by Nov. 28 on the allegations relating to Ms. Amato and Mr. Scanlon, as well as the status of the HCCIC reorganization and its rationale for doing such.
Click here to view the full letter.