HHS released voluntary Healthcare and Public Health cybersecurity performance goals in early 2024: ten essential goals as a baseline and ten enhanced goals for maturing programs. They are voluntary, but HHS's earlier concept paper said it intended to implement enforceable standards informed by them.
The essential ten
According to a Jones Day summary, the essential goals are:
- Fix known vulnerabilities
- Email protections against spoofing and phishing
- Multifactor authentication
- Basic cybersecurity training
- Strong encryption for data in transit
- Revoke credentials for departing workers
- Incident planning and preparedness
- Unique network credentials
- Separate everyday and privileged accounts
- Identify and mitigate risks from outside vendors
The enhanced ten
- Asset inventories
- Third-party vulnerability discovery and response
- Third-party incident and breach reporting
- Cybersecurity testing
- Fix vulnerabilities found through testing
- Detect and respond to relevant threats
- Network segmentation to limit lateral movement
- Centralized log collection
- Centralized incident planning and preparedness
- Consistent baseline configuration management
What voluntary means
The summary states compliance is currently voluntary. It also notes HHS's 2023 concept paper intended enforceable standards informed by the goals, so entities may expect firmer enforcement later. We did not fetch HHS's own page, so confirm details there. The summary gives the date as February 2024 without a day.
Where to start if you have little time
Most small clinics and hospitals cannot do all twenty. A workable order is: multifactor authentication, then vulnerability fixing, then credential removal for departing staff, then incident planning. Each is concrete and measurable. After that, asset inventory from the enhanced list helps with almost every other item, because you cannot patch or segment what you cannot see.
Write the status of each goal in a simple sheet with three columns: done, in progress, not started. Revisit it quarterly. The sheet is also the first thing a regulator or insurer would ask for.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a framework is broken into items you can mark done, partly done or open. The goals above work well as a checklist in the same way.
How to use the lists
- Score the essential ten first, honestly, with evidence.
- Pick the enhanced items that match your biggest gap. Asset inventory is often the quickest win because the later items depend on it.
- Put vendor items in contracts, not only in policy.
Safeguard supports several of these items on the software side: dependency and SBOM scanning for vulnerability fixing, asset discovery for inventory, and compliance evidence automation for proof.
Quick check
Are the goals a law?
No, they are voluntary per the summary.
Which tier includes asset inventories?
The enhanced tier.
Sources
Last reviewed: 19 October 2026.
