HHS Releases Voluntary Cybersecurity Practices for the Healthcare Industry

The Department of Health and Human Services (HHS) announced today, January 2, 2019, in a Public Health Emergency Newsletter, the release of voluntary cybersecurity practices for the healthcare industry.

Cyber threats to healthcare entities put patient health, business continuity, and IT systems at risk. As provided by the Cybersecurity Act of 2015 (CSA), Section 405(d), HHS convened the CSA 405(d) Task Group to enhance cybersecurity and align industry approaches by developing a common set of voluntary, consensus-based, and industry-led guidelines, practices, methodologies, procedures, and processes that healthcare organizations can use to enhance cybersecurity.

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP) was developed to raise awareness, provide vetted cybersecurity practices and move organizations towards consistency in mitigating the most pertinent cybersecurity threats. The HICP provides guidance on cost-effective methods that a range of healthcare organizations can use to reduce cybersecurity risks.

Additional details are available here.