US healthcare organisations are told to adopt "recognised security practices", but few can show which practices they follow, at what depth for their size, and with what evidence covering the past twelve months. Health Industry Cybersecurity Practices (HICP) is the publication produced under Section 405(d) of the Cybersecurity Act of 2015, and since January 2021 the HITECH Act has named 405(d) approaches as one route to recognised security practices that HHS must consider when it sets HIPAA fines and audit outcomes. This guide walks through the 2023 edition practice by practice, shows how the small, medium and large tracks differ, and explains the evidence that makes HICP adoption count. It is for security leads, compliance officers and IT managers at providers, health plans and business associates. The wider regulatory landscape is in the Healthcare Cyber Regulation Map.
Key takeaways
- HICP is voluntary but rewarded. Public Law 116-321 requires HHS to consider whether an entity had recognised security practices in place for at least the previous 12 months when deciding fines, audit outcomes and remedies, and forbids penalising an entity for not adopting them.
- Five threats, ten practices. The 2023 edition addresses social engineering, ransomware, loss or theft of equipment or data, insider data loss and attacks on network connected medical devices, through ten unranked cybersecurity practices.
- Pick the right size track. Technical Volume 1 gives small organisations sub-practices marked S; Technical Volume 2 gives medium (M) and large (L) sub-practices, chosen by physicians, providers or beds.
- Identity carries much of the weight. Access Management grows from one basic sub-practice for small organisations to identity, provisioning, MFA, federation, authorisation, access governance and SSO for larger ones.
- The HPH CPGs are the short list. HHS's voluntary Cybersecurity Performance Goals (10 essential, 10 enhanced) link each goal back to HICP practices, which makes them a good starting order.
What it is and who it applies to
Section 405(d) of the Cybersecurity Act of 2015 led HHS to convene an industry and government task group in 2017, which produced HICP as voluntary, consensus-based, industry-led guidelines for the Healthcare and Public Health (HPH) sector. The current version is the 2023 edition. As of November 2026 the former 405d.hhs.gov addresses redirect to the HHS Cyber Gateway (hhscyber.hhs.gov), which hosts the HICP documents, the HPH Cybersecurity Performance Goals and supporting toolkits.
HICP applies to no one by force of law. Its weight comes from the HITECH Act amendment in Public Law 116-321, approved on 5 January 2021, which added a recognised security practices section (42 U.S.C. 17941). In summary, it provides that:
- Consideration: when deciding Security Rule fines, the length and extent of audits, and remedies in resolution agreements, HHS must consider whether a covered entity or business associate adequately demonstrated recognised security practices in place for at least the previous 12 months.
- Definition: recognised security practices include standards and guidelines developed under NIST's statute, approaches promulgated under Section 405(d), and other statutory cybersecurity programmes, as determined by the entity consistent with the Security Rule.
- Limits: HHS cannot increase fines or audit scope because an entity did not adopt them, there is no liability for electing not to, and Security Rule obligations are unchanged.
HICP is therefore one of two named routes (the other being the NIST family, including the Cybersecurity Framework). It does not replace HIPAA Security Rule compliance; see the HIPAA Security Rule Guide and, for the proposed changes, the HHS HIPAA Security Rule Update (2025 NPRM) Guide.
Choosing your size track
| Track | Indicative size (HICP Table 1) | Typical resources | Volume |
|---|---|---|---|
| Small | 1 to 10 physicians, 1 to 25 acute or post-acute providers, or 1 to 50 hospital beds | No dedicated IT staff or outsourced IT; limited security funding | Technical Volume 1 (S sub-practices) |
| Medium | 11 to 50 physicians, 26 to 500 providers, or 51 to 299 beds | Dedicated or co-managed IT; project-based funding | Technical Volume 2 (M sub-practices) |
| Large | Over 50 physicians, over 500 providers, or over 300 beds | CISO or dedicated security staff; dedicated budget | Technical Volume 2 (M plus L sub-practices) |
HICP lets organisations that span categories choose the best fit. Large organisations implement the medium sub-practices as well as the large ones. Small practices may also find the Cyber Security for Dental and GP Practices Guide useful.
Structure and key requirements
The Main Document addresses executives and general staff, describes the five threats and, in 2023, adds zero trust, defence in depth and a section on workforce training. The technical volumes hold the sub-practices, named by practice number, size letter and sequence letter (for example 7.M.A). A Resources and Templates volume supplies supporting material, and a threat-to-practice matrix maps the five threats to the ten practices.
| # | Practice | Small (Vol 1) | Medium and large (Vol 2) highlights |
|---|---|---|---|
| 1 | Email Protection Systems | 1.S.A configuration, 1.S.B education, 1.S.C phishing simulations | Further M and L sub-practices in Volume 2 |
| 2 | Endpoint Protection Systems | 2.S.A basic endpoint controls | 2.M.B mobile device management; 2.L.C endpoint detection and response; 2.L.D application allowlisting; 2.L.E micro-segmentation |
| 3 | Access Management (Identity and Access Management in Vol 2) | 3.S.A basic access management | 3.M.A identity; 3.M.B provisioning, transfers and deprovisioning; 3.M.C authentication; 3.M.D MFA; 3.L.A federation; 3.L.B authorisation; 3.L.C access governance; 3.L.D SSO |
| 4 | Data Protection and Loss Prevention | 4.S.A policies, 4.S.B procedures, 4.S.C education | Further M and L sub-practices in Volume 2 |
| 5 | Asset Management | 5.S.A inventory, 5.S.B procurement, 5.S.C decommissioning | Further M and L sub-practices in Volume 2 |
| 6 | Network Management | 6.S.A segmentation, 6.S.B physical security and guest access, 6.S.C intrusion prevention | Further M and L sub-practices in Volume 2 |
| 7 | Vulnerability Management | 7.S.A vulnerability management | 7.M.A host scanning; 7.M.B web application scanning; 7.M.D patch and configuration management; 7.M.E change management; 7.L.A penetration testing; 7.L.B remediation planning; 7.L.C attack simulation |
| 8 | Incident Response (Security Operation Centers and Incident Response) | 8.S.A incident response, 8.S.B information sharing | Further M and L sub-practices in Volume 2 |
| 9 | Network Connected Medical Devices | 9.S.A medical device security | Fully rewritten for 2023 |
| 10 | Cybersecurity Oversight and Governance | 10.S.A policies, 10.S.B risk assessment and management, 10.S.C awareness and training, 10.S.D cyber insurance | Further M and L sub-practices in Volume 2 |
The 2023 changes worth knowing: "Email Phishing" became "Social Engineering" to cover smishing, whaling and business email compromise; Practice 10 changed from Cybersecurity Policies to Cybersecurity Oversight and Governance; and new sub-practices cover attack simulation (Practice 7), cyber insurance and risk assessment using free federal tools (Practice 10).
Identity and NHI requirements
Practice 3 is where HICP is most specific about identity, and it scales sharply with size.
- One person, one identity (3.M.A): identities come from systems of record such as HR or ERP, each person has a unique identifier that is never reused and is not a Social Security number, and every non-employee account (contractor, volunteer, student) has an accountable employed sponsor.
- Birthright and minimum necessary (3.M.B): define the least access each role needs, document it as birthright entitlements, provision through consistent workflows, and only then automate. HICP's warning is not to automate bad or unknown workflows.
- MFA (3.M.D): multifactor authentication, with remote access the priority. The Change Healthcare breach 2024 began with a stolen credential on a remote access portal without MFA, which is exactly the control this sub-practice and the CPG MFA goal target.
- Separate privileged accounts (2.M.A): limit local administrator rights and give users who need them a separate privileged account; a general user account should never run with administrative privileges.
- Federation, authorisation, governance and SSO (3.L.A to 3.L.D): large organisations add federated identity, formal authorisation models, access reviews and single sign-on.
HICP's identity text is written around people. Apply the same principles to non-human identities: give each interface engine, integration and service account a named owner (the "sponsor" principle), record it in a system of record, scope it to minimum necessary access, and include it in access reviews under 3.L.C. Clinical integration accounts and API credentials are a common gap; see the Healthcare Identity Security Guide and the Service Account Security Guide.
Implementation steps
- Choose the size track and record why. Use Table 1 and document the choice; auditors will look for it.
- Start with the HPH CPGs. The ten essential goals (mitigate known vulnerabilities, email security, MFA, basic training, strong encryption, revoke credentials for departing workforce members, basic incident planning, unique credentials, separate user and privileged accounts, vendor cybersecurity requirements) each link to HICP sub-practices. Close these first.
- Run a gap assessment per sub-practice. Rate each applicable sub-practice as implemented, partial or not started, with an owner and target date. Use the threat-to-practice matrix to weight the five threats against your own risk analysis.
- Sequence the work. Typical order: Practice 3 (MFA, privileged account separation, deprovisioning), Practice 7 (scanning and patching), Practice 1 (email), Practice 8 (incident response), then the rest. Medical device security (Practice 9) runs in parallel with clinical engineering.
- Start the 12-month clock. The statute looks back over at least the previous 12 months, so date-stamp when each practice went live and keep evidence continuously, not just before an audit.
- Review annually. Fold HICP status into your HIPAA risk analysis and governance reporting under Practice 10, and update when HHS revises HICP.
Decision guidance: small organisations relying on an outsourced IT provider should write the S sub-practices into the provider contract with reporting, so evidence arrives without extra effort. Large systems should plan the L sub-practices as a multi-year programme with board reporting, and prioritise identity governance where clinical turnover and contractor volumes are high.
Evidence and assessment
There is no HICP certification. What matters is being able to demonstrate adoption to HHS's Office for Civil Rights if an investigation or audit occurs.
| Evidence | Example | Supports |
|---|---|---|
| Adoption decision | Board or executive minute adopting HICP 2023 and the size track | Practice 10; shows a deliberate choice |
| Sub-practice register | Status, owner, go-live date for each applicable sub-practice | 12-month look-back |
| Technical records | MFA enrolment reports, privileged account lists, scan and patch reports, phishing simulation results | Practices 1, 2, 3, 7 |
| Process records | Joiner, mover and leaver tickets, access review sign-offs, incident exercises | Practices 3 and 8 |
| Risk analysis | HIPAA risk analysis referencing HICP controls | Security Rule and Practice 10 |
Metrics that show the practices work: MFA coverage of remote access and email (target 100%), leaver accounts disabled within 24 hours, critical vulnerabilities remediated within your policy window, phishing simulation report rate, and share of medical devices inventoried with an owner.
Mapping to other frameworks
| HICP practice | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | HPH CPG (essential) |
|---|---|---|---|
| 3 Access Management | PR.AA-01, PR.AA-03, PR.AA-05 | AC-2, IA-2, AC-6 | MFA; unique credentials; separate user and privileged accounts; revoke credentials |
| 7 Vulnerability Management | ID.RA-01 | RA-5, SI-2 | Mitigate known vulnerabilities |
| 8 Incident Response | RS.MA-01 | IR-4, IR-8 | Basic incident planning and preparedness |
| 10 Oversight and Governance | GV.OC-01, GV.RM-01 | PM-9, RA-3 | Vendor cybersecurity requirements |
The 2023 technical volumes cite NIST CSF version 1.1 subcategories beside each sub-practice; the CSF 2.0 identifiers above are NHI Mgmt Group's mapping for current use.
HICP or the NIST route?
Both count as recognised security practices under the statute, and they are not exclusive. HICP suits organisations that want prescriptive, healthcare-specific sub-practices sized to their resources; the NIST Cybersecurity Framework suits organisations that already report against it across several sectors, such as integrated systems with insurance or research arms. A common pattern is to govern with CSF 2.0 outcomes and implement with HICP sub-practices, keeping one register that shows both. Whichever you choose, name it in your policies so the 12-month evidence trail points to a specific framework and edition.
Common pitfalls
- Claiming HICP without dates: the statute's test is at least 12 months in place. Without go-live dates and continuous records, adoption is hard to demonstrate.
- Picking the small track to save effort: a 300-bed hospital on Volume 1 will struggle to show recognised practices appropriate to its size.
- Treating HICP as HIPAA compliance: it is a set of practices that can mitigate penalties; the Security Rule requirements still apply in full.
- Stopping at people: service accounts, integration credentials and vendor remote access fall outside the user-focused text unless you bring them in deliberately.
- Ignoring medical devices: Practice 9 was rewritten in 2023 and needs clinical engineering involvement, not just IT.
- Working from old links: 405d.hhs.gov now redirects to the HHS Cyber Gateway; check you hold the 2023 edition documents.
Practitioner checklist
- Record the HICP 2023 adoption decision and size track at executive level.
- Close the ten HPH CPG essential goals first, starting with MFA on remote access and email.
- Build a sub-practice register with owners, status and go-live dates.
- Separate privileged accounts from daily accounts and remove standing local administrator rights.
- Apply the sponsor and minimum necessary principles to service accounts and integration credentials.
- Run authenticated vulnerability scans and track remediation against policy windows.
- Exercise the incident response plan at least annually and keep the record.
- Reference HICP in the annual HIPAA risk analysis and keep 12 months of evidence on hand.
Standards and references
- HHS: Health Industry Cybersecurity Practices (HICP) 2023 Edition, Main Document
- HHS: HICP Technical Volume 1 (Small Organizations)
- HHS: HICP Technical Volume 2 (Medium and Large Organizations)
- HHS: What's New in HICP 2023
- US Government Publishing Office: Public Law 116-321
- HHS Cyber Gateway: HPH Cybersecurity Performance Goals
- HHS Cyber Gateway
Related NHI Mgmt Group resources: Healthcare Cyber Regulation Map · HIPAA Security Rule Guide · Healthcare Identity Security Guide · NHS Data Security and Protection Toolkit. This guide summarises HHS 405(d) HICP and Public Law 116-321 and is not legal advice.