The Health Industry Cybersecurity Practices (HICP) 2023 edition, from the HHS 405(d) program, names five top threats to healthcare: social engineering, ransomware, loss or theft of equipment or data, insider data loss, and attacks on network-connected medical devices. It pairs them with ten mitigating practices, in separate volumes for small and for medium and large organizations.
The five threats
- Social engineering (this edition's name for what the 2019 edition called email phishing, and it now includes things like smishing, whaling and business email compromise)
- Ransomware
- Loss or theft of equipment or data
- Insider accidental or malicious data loss
- Attacks against network connected medical devices
The ten practices
- Email protection systems
- Endpoint protection systems
- Access management
- Data protection and loss prevention
- Asset management
- Network management
- Vulnerability management
- Incident response
- Network connected medical device security
- Cybersecurity oversight and governance
The 405(d) highlight sheet says practice 9 was fully updated, and that practice 10 was renamed from cybersecurity policies to oversight and governance. New content includes attack simulations, cybersecurity insurance and risk assessment guidance, plus the strategies of zero trust and defense in depth.
How the publication is organized
There is a main document that overviews the threats and explains how to use the publication. Technical Volume 1 gives the ten practices and sub-practices for small entities. Technical Volume 2 does the same for medium and large entities.
Where a small clinic could start
This is our suggestion, not text from HHS:
- Email and training first. Social engineering leads the list, so combine filtering with short, regular staff practice.
- Know your assets. You cannot protect devices you cannot list, including connected medical equipment.
- Control access. Use unique accounts and multifactor authentication on systems with patient data.
- Back up and rehearse. Ransomware is second on the list, so test restoring.
- Write down who to call when something goes wrong.
For an example of what ransomware does to care delivery, see our analysis of the Change Healthcare incident.
Limits
HICP is voluntary guidance. It is not a regulation and meeting it does not by itself show compliance with HIPAA. Use it to organize work, and check legal requirements separately.
Using the list in a risk conversation
The threats and practices make a simple map. Draw a grid with the five threats down the side and the ten practices across the top, then mark which practices you have in place. Gaps become visible fast, and so does overlap. Email protection and access management, for example, both help against social engineering.
Take the grid to your leadership as a one page view. It is easier to fund a gap when it is tied to a named threat.
Quick check
Is HICP mandatory?
It is practice guidance from HHS 405(d). Check HIPAA and other laws separately for legal duties.
Which volume should a ten person clinic read?
Technical Volume 1, which covers the practices for small entities.
Safeguard's asset discovery, dependency scanning and compliance evidence automation can help healthcare software teams with practices 5 and 7 on the software they build. It does not manage clinical devices.
Sources
Last reviewed: 19 October 2026.
