MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesHICP

    Health Industry Cybersecurity Practices

    Voluntary HHS healthcare cybersecurity practices that can support recognized-security-practices evidence in HIPAA enforcement.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

    Definition

    Health Industry Cybersecurity Practices (HICP) is a publication series produced by the HHS 405(d) Task Group, a public-private collaboration of the Department of Health and Human Services and more than 200 healthcare and cybersecurity organizations. HICP defines voluntary, consensus-based cybersecurity practices scoped to small, medium, and large healthcare organizations. The 2023 edition (HICP 2023) updated the original 10 practice areas and aligned them to the NIST Cybersecurity Framework.
    What the regulation says
    HICP is voluntary HHS guidance. Under 42 USC 17941, OCR must consider adequately demonstrated recognized security practices in place for at least the prior 12 months in specified enforcement and audit decisions. This does not guarantee penalty reduction or establish HIPAA compliance. HPH CPGs are published by HHS with CISA collaboration.

    What this means in practice

    HICP can support healthcare cybersecurity planning and recognized-security-practices evidence. Buyers may request alignment and device-security documentation, but HICP does not create a general manufacturer procurement or MDS2 mandate.

    Examples

    • Illustrative: A small rural clinic, after a ransomware incident, used HICP's guidance on incident response and data backup to improve its cybersecurity posture and prepare for potential future threats.
    • Illustrative: A large academic medical center referenced HICP when updating its vendor risk management program, specifically requesting medical device manufacturers to demonstrate how their products align with HICP's cybersecurity principles.
    • Illustrative: During a HIPAA audit, a regional hospital demonstrated that its implementation of HICP's recognized security practices for vulnerability management and access control helped mitigate potential penalties after a data breach.
    Common pitfalls
    • •Confusing HICP with the HIPAA Security Rule, HIPAA sets requirements, HICP describes how to meet them.
    • •Manufacturers ignoring HICP because it's hospital-facing, your products must enable hospital HICP conformance, particularly around asset management, identity, and vulnerability management.
    • •Citing HICP 2018, the current edition is HICP 2023, with updated technical volumes and a separate Cybersecurity Framework Implementation Guide.

    Frequently asked questions

    No, Health Industry Cybersecurity Practices (HICP) is a voluntary, consensus-based set of practices published by the HHS 405(d) Task Group, not a binding regulation, but it carries legal weight because Public Law 116-321 requires HHS Office for Civil Rights to consider whether an organization has adopted 'recognized security practices' like HICP for at least the prior 12 months when calculating HIPAA penalties or determining audit scope.

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Latest in MedTech

    Sources

    6 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Official-source claim check:

    HICP is voluntary HHS sector practice guidance; recognized practices can mitigate enforcement outcomes, not confer immunity.

    Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

    Remaining verification limits
    • Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
    Tier 2Regulator guidance and consensus· 5Tier 4Trade press and expert commentary· 1
    Link health: 3 verified 3 unchecked· last checked 2026-06-20
    HHS·4HSCC·1uscode.house.gov·1
    1. 1
      405(d) Program, HICP 2023
      Tier 2 Verified
      HHS405d.hhs.gov
    2. 2
      HHS 405(d) Program
      Tier 2 Verified
      HHS405d.hhs.gov
    3. 3
      HSCC - Health Sector Coordinating Council
      Tier 4 Verified
      HSCChealthsectorcouncil.org
    4. 4
      HHS recognized security practices guidance
      Tier 2 Unchecked
      HHShhs.gov
    5. 5
      US Code 42 USC 17941
      Tier 2 Unchecked
      uscode.house.govuscode.house.gov
    6. 6
      HHS HPH CPGs
      Tier 2 Unchecked
      HHShhscyber.hhs.gov

    Inline markers like [1] jump to the matching reference above.