HHS Releases Health-Care Cybersecurity Guide

On March 8, the Department of Health and Human Services (HHS) released a cybersecurity implementation guide to assist public and private health-care sectors prevent cybersecurity incidents. “Cyber incidents pose risks to patient data, intellectual property, scientific or laboratory research, medical manufacturing, and ultimately the ability of health-care organizations to safely serve their patients,” said HHS Deputy Secretary Andrea Palm. “The release of this guide will help health-care organizations become better equipped to assess and improve their cybersecurity.”

The Cybersecurity Framework Implementation Guide is the result of a collaboration between HHS and the private sector. This guide:

1. Outlines risk management principles and best practices,
2. Provides common language for addressing and managing cyber risk,
3. Lays out a structure for applying cyber risk management, and
4. Identifies “effective standards, guidelines, and practices to manage cybersecurity risk cost-effectively based on business needs.