Healthcare and Public Health Cybersecurity Performance Goals
HHS's sector-specific list of essential and enhanced cybersecurity goals for healthcare, derived from HICP and the NIST CSF.
Definition
HHS published voluntary HPH Cybersecurity Performance Goals in January 2024 in collaboration with CISA and industry. They adapt CISA cross-sector CPGs and draw on HICP, NIST CSF and the HPH sector implementation guide. Essential goals establish foundational priorities; Enhanced goals support more advanced practices. This is not a formal linear hierarchy from CSF through HICP.What this means in practice
HPH-CPGs are quickly becoming the primary measuring stick for healthcare cybersecurity maturity. HHS has signaled that future rulemaking under the HIPAA Security Rule and conditions of participation for Medicare may incorporate CPG-style requirements. Medical device manufacturers should expect hospital RFPs and procurement reviews to ask explicitly which CPGs your product helps the hospital achieve, particularly around asset inventory, vulnerability management, MFA, and incident response.Examples
- Illustrative: A hospital IT team reviews the HPH-CPG Essential Goals to ensure their baseline security practices, such as implementing multi-factor authentication for remote access, meet current industry expectations.
- Illustrative: A manufacturer maps device inventory and vulnerability-management capabilities to the corresponding voluntary HPH goals.
- Illustrative: During an annual security audit, a public health agency assesses its incident response plan against the HPH-CPG Enhanced Goals, aiming to improve its capabilities for rapid detection and containment of sophisticated threats.
- •Treating Essential CPGs as the ceiling, they are the floor. Enhanced Goals reflect what mature health systems are already doing.
- •Mapping device features to CPGs in marketing without evidence, hospitals will ask for technical artifacts (MDS2, SBOM, configuration guides) tied to specific CPGs.
- •Assess supplier requirements in actual contracts and applicable business associate agreements. HPH CPGs do not automatically flow down as legal requirements, and not every device supplier is a business associate.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsVoluntary HHS healthcare cybersecurity practices that can support recognized-security-practices evidence in HIPAA enforcement.
Member-driven nonprofit that operates the trusted sharing community for cyber and physical threat intelligence across the healthcare sector.
U.S. federal law governing the privacy and security of protected health information.
An industry-developed reference framework from the Healthcare Sector Coordinating Council for end-to-end MedTech cybersecurity.
More in Cybersecurity
· Same categoryA risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs.
AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Where this term appears across MedTech Terms.
Sources
6 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
Official-source claim check:
HHS voluntary goals adapt CISA cross-sector CPGs using several healthcare frameworks.
Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.
Remaining verification limits
- Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
- 1Cross-Sector Cybersecurity Performance GoalsTier 2 VerifiedCISAcisa.gov
- 2MDCG Cybersecurity GuidanceTier 2 VerifiedMDCGhealth.ec.europa.eu
- 3HSCC - Health Sector Coordinating CouncilTier 4 VerifiedHSCChealthsectorcouncil.org
- 4HHS HPH CPGsTier 2 UncheckedHHShhscyber.hhs.gov
- 5HHS CPG documentTier 2 UncheckedHHShhscyber.hhs.gov
- 6HHS current Security RuleTier 2 UncheckedHHShhs.gov
Inline markers like [1] jump to the matching reference above.