U.S. HICP (Small Practice)

Why does it matter?

Technical Volume 1 opens by noting that smaller ambulatory practices are also targeted and can suffer greater proportional damage because they are less prepared to detect, respond and recover (Introduction). The guidance is not a control list that every organization must implement; the Main Document calls it recommended practices to consider as risk mitigation techniques, starting from a risk assessment. Its weight comes from the Cybersecurity Act of 2015, whose section 405(d) directed HHS and the sector to produce cost-effective voluntary guidelines, and Public Law 116-321 of January 5, 2021, which added section 13412 to the HITECH Act and names 405(d) approaches among the recognized security practices HHS must consider when setting HIPAA fines, audit length and settlement terms.

Key benefits include:

• Sized for a practice without IT staff

Technical Volume 1 assumes no dedicated IT or security personnel and devotes its first pages to managed IT services and vendor selection (Introduction), so the sub-practices are things a practice can ask a vendor to do.

• Threats mapped to practices

Each practice section ends with Key Mitigated Threats, tying the ten practices back to the five threats of the Main Document; the Threat-to-Practice Matrix on 405d.hhs.gov is offered as the start of a risk assessment.

• A HIPAA Security Rule credit

Under Public Law 116-321 (HITECH section 13412), twelve months of documented 405(d) practices may mitigate fines under section 1176 of the Social Security Act, end an audit early and mitigate remedies in a settlement.

• Free, government-published text

The Main Document, both Technical Volumes and the Resources and Templates volume are published by HHS at 405d.hhs.gov at no cost, with executive and quick-start cards for small organizations.

• Consistency across sizes

The same ten practices run through Technical Volume 2 for medium and large organizations, so a practice that grows, or a vendor serving several sizes, keeps one vocabulary.

How does it work?

The Main Document sets the frame. Under the Cybersecurity Act of 2015 it has three goals: cost-effectively reduce cybersecurity risks for the sector, support voluntary adoption, and keep the content actionable for stakeholders of every size (How to Use this Publication). It profiles the five threats and lists the ten Cybersecurity Practices: 1 Email Protection Systems, 2 Endpoint Protection Systems, 3 Access Management, 4 Data Protection and Loss Prevention, 5 Asset Management, 6 Network Management, 7 Vulnerability Management, 8 Security Operation Centers and Incident Response, 9 Network Connected Medical Devices and 10 Cybersecurity Oversight and Governance. A sizing table separates small, medium and large organizations by physicians (1 to 10, 11 to 50, over 50), providers, beds and funding.

Technical Volume 1 restates the ten practices for small organizations as 21 sub-practices (Table 2): 1.S.A Email System Configuration, 1.S.B Education, 1.S.C Phishing Simulations; 2.S.A Basic Endpoint Protection Controls; 3.S.A Basic Access Management; 4.S.A Policies, 4.S.B Procedures, 4.S.C Education; 5.S.A Inventory, 5.S.B Procurement, 5.S.C Decommissioning; 6.S.A Network Segmentation, 6.S.B Physical Security and Guest Access, 6.S.C Intrusion Prevention; 7.S.A Vulnerability Management; 8.S.A Incident Response, 8.S.B Information Sharing; 9.S.A Medical Device Security; and 10.S.A Policies, 10.S.B Cybersecurity Risk Assessment and Management, 10.S.C Security Awareness and Training, 10.S.D Cyber Insurance. Each practice chapter gives the sub-practice text, the roles involved and the Key Mitigated Threats.

Implementation follows the document's own order of work: an inventory of hardware, software and data (5.S.A), a risk assessment and management process (10.S.B), written policies (4.S.A, 10.S.A), basic endpoint and access controls (2.S.A, 3.S.A), email configuration and phishing education (1.S.A to 1.S.C), network segmentation and guest access rules (6.S.A, 6.S.B), vulnerability management (7.S.A), an incident response plan with a defined team and information sharing (8.S.A, 8.S.B; Table 7 lists the roles), medical device security (9.S.A) and cyber insurance (10.S.D). Where a managed service provider runs the IT, the practice remains a HIPAA covered entity and keeps responsibility for the practices (Introduction). Documentation of each practice over time is what Public Law 116-321 asks HHS to weigh.

Key Elements

• Five threats (Main Document)

Social engineering; ransomware attacks; loss or theft of equipment or data; insider, accidental or malicious data loss; attacks against network connected medical devices that may affect patient safety.

• Ten Cybersecurity Practices

Email protection, endpoint protection, access management, data protection and loss prevention, asset management, network management, vulnerability management, incident response, network connected medical devices, and cybersecurity oversight and governance.

• 21 small-organization sub-practices (Technical Volume 1, Table 2)

Numbered 1.S.A to 10.S.D; the small-organization set is the lightest of the three sizes, with single basic sub-practices for endpoint protection, access management and vulnerability management.

• Size definition (Main Document sizing table)

Small: 1 to 10 physicians, 1 to 25 acute or post-acute providers, 1 to 50 hospital beds, a single practice or care site, non-existent or limited cybersecurity funding.

• Governance and risk assessment (Practice 10)

Policies, a cybersecurity risk assessment and management process, security awareness and training, and cyber insurance; the document recommends starting any adoption with the risk assessment.

• Recognized security practices (Public Law 116-321)

HITECH section 13412: HHS must consider whether a covered entity or business associate had 405(d) practices in place for the previous twelve months when deciding fines, audit length and remedies; no penalty for not adopting them.

What does it cover?

Technical Volume 1 is written for small healthcare organizations: ambulatory practices, clinics and providers that the Main Document's sizing table places at 1 to 10 physicians, 1 to 25 acute or post-acute providers or hospitals with 1 to 50 beds, typically one site without dedicated IT or security staff. The volume's Introduction describes their functions (clinical care including e-prescribing, telehealth and networked diagnostic equipment, practice management, business operations) and notes that they remain HIPAA covered entities when a managed service provider runs their systems. Adoption is voluntary; the guidance does not replace the HIPAA Security Rule risk analysis; medium and large organizations use Technical Volume 2.

What are its objectives?

The Main Document states the publication's three goals under the Cybersecurity Act of 2015 (How to Use this Publication) and the Task Group's three-step approach (Appendix B).

Cost-effectively reduce cybersecurity risks for the health and public health sector.

Support the voluntary adoption and implementation of its recommendations.

Ensure that content is actionable, practical and relevant to healthcare stakeholders of every size and resource level on an ongoing basis.

Examine current threats, identify the weaknesses that make organizations vulnerable, and provide the practices experts rank as most effective against them.

Give small organizations a starting point, a risk assessment and 21 sub-practices, rather than a mandatory control list.

Framework in Context

HICP sits beside the HIPAA Security Rule rather than inside it: HHS's Office for Civil Rights enforces the rule, and Public Law 116-321 made 405(d) practices one of the recognized security practices, alongside NIST-developed frameworks and other regulatory programs, that OCR must consider in enforcement. The 405(d) Program runs under the Administration for Strategic Preparedness and Response with the Health Sector Coordinating Council, whose Joint Cybersecurity Working Group hosts the 405(d) Task Group (Main Document, Appendix B). The Main Document records input from CMS, FDA, OCR, ONC, DHS and NIST; Technical Volume 2 carries the same ten practices for medium and large organizations, and the Resources and Templates volume supplies the Cybersecurity Practices Assessment Toolkit.

Common Framework Mappings

Organizations map the HICP practices to the frameworks below because the ten practices restate controls those frameworks already define and Public Law 116-321 treats both 405(d) practices and NIST frameworks as recognized security practices.

Mapped frameworks include:

CIS Controls v8.1

HIPAA (NIST SP 800-66 Rev. 2)

HITRUST CSF v11.5

ISO 27001:2022

NIST CSF 2.0

NIST 800-171 Rev. 3

NIST 800-53 Rev.5

PCI DSS 4.0.1