Healthcare cybersecurity protects electronic protected health information (ePHI) and helps keep care and public health operations running when systems are attacked or disrupted. For organizations subject to HIPAA, the Security Rule requires appropriate administrative, physical, and technical safeguards; HHS also offers voluntary sector goals to help organizations prioritize improvements.
What is healthcare and public health cybersecurity?
It is the work of protecting health information and the systems and workflows that depend on it. A compromised system can put ePHI’s confidentiality, integrity, or availability at risk, and disruption can affect care delivery or public health operations. HHS Cyber Gateway captures this connection in its message, “Cyber Safety is Patient Safety!”
As an Amazon Associate I earn from qualifying purchases.
The legal and operational scopes are not identical. The HIPAA Security Rule applies to covered entities and business associates that handle ePHI. A public health organization is not automatically a HIPAA covered entity merely because it works in public health; it must determine which HIPAA duties apply to its role and information. HHS’s Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals are separate, voluntary prioritization guidance for organizations in the sector.
Recommended Free Tools
What does the HIPAA Security Rule require?
HHS’s Office for Civil Rights (OCR) describes the Security Rule as requiring appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of ePHI. The Rule is in 45 CFR Part 160 and Subparts A and C of Part 164, according to HHS OCR’s “The Security Rule” page.
That requirement is a safeguard obligation, not a claim that one security product or checklist automatically makes an organization compliant. The safeguards need to address the organization’s ePHI, systems, risks, and operations. OCR’s enforcement materials offer practical recommendations, but those recommendations are not a replacement for reading the Security Rule and applying it to the organization’s circumstances.
Encryption and multi-factor authentication
OCR recommends encrypting ePHI when appropriate and using mechanisms to authenticate users. The cited guidance does not establish that every organization must use a particular hardware key, nor does it endorse a specific authentication device. A FIDO2 security key may be one possible authentication aid, but compatibility and coverage depend on the organization’s identity systems; buying a key alone does not satisfy the Security Rule.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
What should a healthcare organization do first?
OCR’s ransomware settlement materials describe a practical set of security-management steps. Treat these as implementation priorities to evaluate against your environment, not as a complete substitute for the Rule.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Map ePHI. Identify where ePHI is stored and how it enters, moves through, and leaves systems. Include the workflows and systems that handle it.
- Analyze and manage risk. Make risk analysis and risk management part of routine business processes, rather than one-off exercises detached from operational decisions.
- Review system activity. Maintain audit controls and review system activity so the organization can evaluate what is happening in its environment.
- Authenticate users. Use authentication mechanisms to limit access to authorized people. Assess how broadly the chosen mechanisms cover workforce members and systems, and whether they fit the organization’s identity environment.
- Protect ePHI with encryption when appropriate. Assess ePHI in transit and at rest, and determine where encryption is appropriate to the organization’s risks and systems.
- Train staff for their roles. Provide regular training suited to what different staff members do, rather than relying only on generic awareness material.
- Learn from incidents. Incorporate incident lessons into security management so identified weaknesses inform future decisions and practices.
How can hospitals prevent ransomware attacks?
No single control can guarantee that a hospital will avoid ransomware. The OCR recommendations above address core prevention and security-management work: understand where ePHI is, manage risks, review activity, authenticate users, apply encryption where appropriate, train staff, and use incident experience to improve safeguards.
Ransomware planning also needs an operational-resilience view. Assess how important each affected system or workflow is to care, and whether the organization can detect, respond to, and recover from incidents. The HHS materials summarized here do not establish a universal recovery-time target or promise a particular outcome; organizations should set and evaluate resilience expectations against their own operational needs.
How can HHS’s voluntary cybersecurity goals help?
HHS’s Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals distinguish essential foundational actions from enhanced practices. Organizations can use the essential goals to prioritize foundational work and then assess enhanced practices in light of risk, criticality, and capacity. The goals are voluntary guidance, not binding HIPAA requirements.
Rank #4
A useful prioritization sequence is to determine regulatory scope, identify ePHI and critical workflows, assess risks and existing safeguards, and then use the goals to organize improvement work. For identity and access, consider authentication coverage and compatibility with existing systems rather than selecting a device by default. For resilience, assess the organization’s ability to detect, respond, recover, and incorporate lessons from incidents.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat do recent breach and enforcement figures show?
On its HIPAA Security Rule proposed-rule page, HHS OCR reported that reports of large breaches rose 102 percent from 2018 through 2023, while the number of individuals affected rose 1,002 percent over the same period. OCR also reported that large breaches affected more than 167 million individuals in 2023, a record at the time of the agency’s report. These are HHS-reported figures for the stated period, not forecasts of future breach activity.
OCR said it selected 50 covered entities and business associates for its 2024–2025 HIPAA audits, focusing on Security Rule provisions relevant to hacking and ransomware. The count and focus describe that audit program, not the likelihood that any particular organization will be audited.
The Change Healthcare incident illustrates the breadth of a major sector incident and the distinction between an investigation and a final finding. In its FAQ updated March 14, 2025, OCR said it had prioritized and opened investigations of Change Healthcare and UnitedHealth Group, focusing on whether a PHI breach occurred and whether HIPAA requirements were met. That statement describes the investigation’s scope; it is not a final determination of noncompliance.
What changed with the proposed HIPAA Security Rule update?
HHS issued a proposed update to the HIPAA Security Rule on December 27, 2024, according to OCR’s proposed-rule page. Proposed provisions should not be described as final obligations solely because they appeared in that proposal. Before relying on proposed text for a compliance decision, confirm the current rule, regulatory status, and effective dates in official HHS and Federal Register materials.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOCR Director Paula M. Stannard said in a June 18, 2026 health plan settlement announcement: “Effective cybersecurity starts with Security Rule compliance, ensuring that Security Rule provisions are implemented before a cyberattack occurs.” The settlement is a dated enforcement example involving an employer-sponsored health plan, not a finding that all health plans share the same deficiencies.
When can outside support help?
Organizations that need help with the work may consider healthcare cybersecurity risk assessment, incident-response preparation, managed security services, or HIPAA risk-analysis education and advisory support. These are service categories, not a requirement to hire a provider. Evaluate any outside support against the organization’s regulatory scope, risks, systems, and operational needs. HHS and OCR materials are official resources for understanding the Rule and sector guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
