Health groups press cyber funding after Commerce clears Mythos, Fable
Hospitals are treating frontier AI as a funding problem because resilience mandates do not patch rural budgets or clinical downtime.
TL;DR
Health care advocates told Inside Health Policy they want federal cybersecurity funding and guidance after Commerce lifted controls on Anthropic’s Mythos and Fable models. The push targets hospitals, HIPAA covered entities and especially rural providers with scarce resources. Sen. Bill Cassidy’s Health Care Cybersecurity and Resiliency Act is moving as a fiscal 2027 NDAA amendment, while HHS lists HIPAA Security Rule final action for July 2027.
The health care sector’s argument is straightforward: if frontier AI models accelerate attacks, hospitals need money and usable guidance, not only more liability exposure after an incident. Inside Health Policy reports that the Healthcare Leadership Council is pressing for federal funding as AI-powered attacks increase the speed and scale of incidents, particularly for patients in hospitals. The College of Healthcare Information Management Executives is also urging regulators to reconsider how Health Insurance Portability and Accountability Act obligations land on providers, insurers and other covered entities when vulnerabilities sit outside their control.
There is a timing problem inside that plea. Sen. Bill Cassidy’s Health Care Cybersecurity and Resiliency Act advanced from the Senate Health, Education, Labor and Pensions Committee on Feb. 26 and he is trying to attach it to the fiscal 2027 National Defense Authorization Act. HHS, meanwhile, has put final action on its HIPAA Security Rule cybersecurity proposal in the long-term bucket, with July 2027 as the anticipated date. For hospital CISOs, that means the policy machinery is moving, but not at the speed of ransomware, medical device disruption or clinical continuity planning.
The operational message is less exotic than the AI framing. Hospitals and health systems still have to treat cyber risk as enterprise risk, use AI defensively where it helps, and build resiliency and extended clinical continuity plans for mission-critical and life-critical services. Frontier models may change attacker speed. They do not change the old health care problem: the providers most exposed to downtime are often the least able to buy their way out of it.
Published ·Deep Fathom