U.S. HICP 2023 Edition — Medium and Large Organizations

Why does it matter?

Cybersecurity incidents affect patient care and can threaten patient safety, which is why the Main Document frames cyber safety as patient safety. HICP gives medium and large organizations practices written by practitioners and tied to named threats, and HIPAA enforcement recognizes the 405(d) approach.

Key benefits include:

• Practices tied to named threats

Each practice ends with Key Mitigated Threats and Suggested Metrics, and the Threat-to-Practice Matrix on 405d.hhs.gov relates the five threats to the ten practices.

• Sized to the organization

Technical Volume 2 splits every practice into sub-practices for medium-sized organizations and for large organizations, for example 3.M.A Identity and 3.L.A Federated Identity Management.

• Recognized security practices under HITECH

HITECH section 13412 requires HHS to consider whether recognized security practices were in place for at least 12 months when it decides fines, audit length and remedies (Public Law 116-321).

• A starting point, not a mandate

HHS states that the publication is a series of recommended practices to consider as risk mitigation techniques and advises beginning with a risk assessment.

• Medical devices covered

Practice 9 is dedicated to network-connected medical devices, from asset management and endpoint protections to procurement and security evaluations and contacting the FDA.

How does it work?

Start from the five threats in the Main Document and size your organization with Table 1. A medium-sized hospital has 51 to 299 beds and a medical group has 11 to 50 physicians. A large hospital has over 300 beds and a large group over 50 physicians. Medium-sized organizations begin with the medium sub-practices and large organizations consider both sets.

Each practice lists sub-practices coded by practice number, size and letter, such as 1.M.A Basic Email Protection Controls or 8.L.A Advanced Security Operations Center. Technical Volume 2 describes itself as an index of existing industry practices with guidance on how to start, written for the technical practitioner.

The Main Document recommends starting with a risk assessment and tailoring the mitigations. It also discusses Zero Trust and Defense-in-Depth as strategy approaches, and offers executive cards that explain the importance of cybersecurity to leaders in small and in medium and large organizations.

Key Elements

• Email, endpoint and access (practices 1 to 3)

Email Protection Systems, Endpoint Protection Systems and Identity and Access Management cover email controls, multi-factor authentication, mobile device management, provisioning and deprovisioning, and authentication.

• Data and assets (practices 4 and 5)

Data Protection and Loss Prevention covers classification, backup strategies and data loss prevention. IT Asset Management covers inventory, procurement, secure storage and decommissioning.

• Network and vulnerabilities (practices 6 and 7)

Network Management covers firewalls, segmentation, intrusion prevention and web proxy protection, and Vulnerability Management covers host and web application scanning, patch and configuration management, and for large organizations penetration testing and attack simulation.

• Security operations (practice 8)

The Security Operations Center and Incident Response practice covers the SOC, incident response and information sharing through ISACs and ISAOs. Large organizations add advanced SOC capability and user behavior analytics.

• Medical devices (practice 9)

Medium sub-practices run from asset management to vulnerability management and contacting the FDA. Large sub-practices add security operations and procurement and security evaluations.

• Oversight and governance (practice 10)

Medium sub-practices cover policies, cybersecurity risk assessment and management, and security awareness and training. Large organizations add cyber insurance.

What does it cover?

Technical Volume 2 is for medium-sized and large healthcare organizations that generally have dedicated IT departments and likely have cybersecurity staff. Medium-sized examples include community hospitals, critical access hospitals with more than 50 beds and larger medical groups. Large examples include health systems with multiple hospitals and integrated delivery networks. HICP is voluntary and applies to organizations in the healthcare and public health sector, not to a defined set of regulated entities.

What are its objectives?

The Main Document sets three core goals for the publication.

Cost-effectively reduce cybersecurity risks for the healthcare and public health sector.

Support the voluntary adoption and implementation of its recommendations.

Keep content actionable, practical and relevant to organizations of every size and resource level.

Foster awareness and move the sector toward consistency in mitigating the most impactful threats.

Give executives awareness material and technical staff implementation detail in separate documents.

Framework in Context

HICP is not a regulation, but HITECH section 13412, added by Public Law 116-321, makes recognized security practices relevant to HIPAA enforcement. Recognized security practices include approaches promulgated under Section 405(d), and HHS may not raise fines or expand audits because an organization lacked them. HHS developed HICP with the HPH Sector Coordinating Council, the Department of Homeland Security and NIST.

Common Framework Mappings

HICP 2023 Edition is often mapped to other widely adopted cybersecurity and privacy frameworks to simplify compliance, strengthen risk management, and facilitate regulatory crosswalks within healthcare organizations.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

HITRUST CSF v11.5

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2