HHS 405(d) HICP (Health Industry Cybersecurity Practices), explained

Section 405(d) of the Cybersecurity Act of 2015 (Public Law 114-113) directed HHS toward a coordinated, industry-partnered approach to healthcare cybersecurity rather than a standalone rule. HHS convened the 405(d) Task Group in 2017 under the Healthcare and Public Health (HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership — reporting on the Task Group describes roughly 200 participating information security officers, medical professionals, privacy experts and industry leaders working toward consensus guidance, a deliberately different model from a government-authored technical standard like NIST's SP 800-66 HIPAA Security Rule crosswalk.

HICP was first issued in 2018 and updated in a joint HHS/Healthcare and Public Health Sector Coordinating Council release on 17 April 2023. It isn't one document: the Main Document lays out the sector's top cybersecurity threats and ten recommended practices at a summary level; Technical Volume 1 scales those practices for small organizations; Technical Volume 2 scales them for medium and large organizations; and a Resources and Templates volume supplies a self-assessment tool and a mapping to the NIST Cybersecurity Framework. This guide's direct fetch of the HICP Main Document PDF returned a compressed binary stream that couldn't be machine-extracted for verbatim quotation — the practice list and threat descriptions below rest on consistent secondary reporting of the 2023 edition's content (Clearwater Security's published guide, the American Hospital Association's release notice, trade-press coverage), not a direct quotation of HHS's own PDF text.

Secondary coverage of the 2023 edition describes Practice #9 as substantially expanded with new sub-practices addressing connectivity risk in networked medical equipment, consistent with the edition's top-five-threats list naming "attacks against network-connected medical devices" directly alongside social engineering, ransomware, equipment/data loss and insider data loss. Treat the specific sub-practice text as a starting point to confirm against HHS's own published Technical Volumes rather than a verbatim rendering, given the PDF-extraction limitation noted above.

HICP itself creates no legal obligation. But Public Law 116-321, enacted 5 January 2021, added Section 13412 to the HITECH Act and requires HHS's Office for Civil Rights to consider whether a covered entity or business associate has had "recognized security practices" — a term the law defines to explicitly include approaches promulgated under Section 405(d) of the Cybersecurity Act of 2015 — "in place" for the preceding 12 months when deciding HIPAA civil penalties, audit scope, and the terms of a resolution agreement. OCR has been explicit in its own public statements that this is not a "safe harbor" and grants no immunity; industry commentary more accurately describes it as a mitigating factor an organization has to "adequately demonstrate," not a liability shield. For a device manufacturer, this is the mechanism that turns a hospital customer's "are you HICP-aligned?" question from a courtesy into something with real downstream HIPAA-enforcement consequences for that customer.

HHS published Healthcare and Public Health Sector-specific Cybersecurity Performance Goals (CPGs) on 24 January 2024 — ten "essential" and ten "enhanced" voluntary goals, covering areas like multifactor authentication, basic encryption, email security, incident planning that explicitly folds in networked medical devices, network segmentation and configuration management. Secondary reporting describes the CPGs as built in part on HICP's own practices, the NIST Cybersecurity Framework and the "chassis" of CISA's cross-sector Cybersecurity Performance Goals (see our CISA CPGs guide for that baseline). HHS has stated it would consider proposing the CPGs' incorporation into future enforceable requirements, which would move at least part of this currently-voluntary stack toward a binding one — a device maker treating HICP as a one-time checklist risks missing that direction of travel.

HICP is sector-wide guidance for healthcare delivery organizations first, not a device manufacturer submission requirement — it sits next to, not instead of, FDA's own device-specific obligations. A manufacturer selling network-connected medical devices in the US typically needs FDA premarket cybersecurity evidence (Section 524B's SBOM and vulnerability-monitoring plan) and an active FDA postmarket remediation process, while also expecting hospital customers to ask device-security questions framed around HICP Practice #9 and the HPH CPGs during procurement. None of these formally cross-reference each other, so the same underlying engineering evidence — asset inventory, SBOM, vulnerability-handling process — has to answer all three audiences rather than being built three separate times; see also AAMI SW96 for the risk-management-file layer underneath all of them.