HHS could mandate hospital cybersecurity on its own; paying for it needed Congress

The week

For years, hospital cybersecurity in the United States ran largely on good intentions. Hospitals had to protect patient information under HIPAA, the federal health privacy law, but there was no specific, enforceable checklist of security practices that every hospital had to follow. Meanwhile ransomware, criminal software that locks up an organization’s computer systems until a ransom is paid, was shutting down hospital systems around the country.

On December 6, 2023, the Department of Health and Human Services (HHS) signaled that this was going to change. It released a concept paper setting out its cybersecurity strategy for the healthcare sector. A concept paper is not a regulation. It creates no legal obligations. It is a government agency thinking out loud, in public, about what it intends to do, which makes it valuable to anyone who wants to see what is coming.

HHS wrote it in its capacity as the Sector Risk Management Agency for the healthcare and public health sector, a role assigned under the Homeland Security Act and a 2013 presidential policy directive. That role carried coordination duties and very little regulatory power of its own. The power sat elsewhere in the department: with the Office for Civil Rights (OCR), which enforces HIPAA, and with CMS, which sets the rules hospitals must meet to be paid by Medicare and Medicaid.

The paper opened with the department’s own numbers. Citing OCR data, it said large breaches reported to the agency rose 93 percent from 2018 to 2022, from 369 to 712, and that large breaches involving ransomware rose 278 percent over the same period. It described what those incidents did on the ground: multi-week outages, patients diverted to other facilities, cancelled appointments and delayed procedures.

The timing made the point vivid. Less than two weeks before the paper appeared, over the Thanksgiving holiday, a ransomware attack on Ardent Health Services had forced several of its hospitals in more than one state to divert ambulances while systems were restored.

The paper described four areas of action.

• A baseline. HHS would publish voluntary, healthcare-specific cybersecurity performance goals: a short, plain list of the security practices it expected organizations to have in place.
• Help to pay for it. It would provide resources and incentives to help organizations implement those goals. HHS said it would work with Congress to obtain new authority and funding, first to support hospital investment and, in the long term, to impose financial consequences on hospitals that did not adopt the practices.
• Accountability. It would strengthen accountability, including by proposing new enforceable cybersecurity standards through the Medicare and Medicaid programs and updating the HIPAA Security Rule, the part of the privacy law that sets out how electronic health information must be protected. OCR, it said, would begin that update in the spring of 2024. HHS would also ask Congress for higher civil money penalties for HIPAA violations and for resources to run proactive audits.
• Coordination. It would expand the department’s role as a coordinating point for sector cybersecurity through the Administration for Strategic Preparedness and Response (ASPR), the part of HHS that handles emergencies and disasters.

The paper did not come out of nowhere. It followed the 2023 National Cybersecurity Strategy, which had called for minimum cybersecurity requirements in critical sectors such as health care. The White House had, in effect, said that voluntary approaches were no longer enough for industries the country depends on, and HHS was now describing how it would apply that idea to hospitals.

The paper also listed what HHS had already done within its existing powers after an April 2023 analysis of hospital cyber resiliency carried out with industry. It had updated its voluntary guidance, the Health Industry Cybersecurity Practices published through its 405(d) program, and released free cybersecurity training aimed at small and medium-sized facilities. The FDA had issued premarket cybersecurity guidance for medical device makers. OCR had issued guidance on telehealth and the privacy and security of health information.

Those steps were the limit of what persuasion could do. The concept paper stated an aspiration to have all hospitals meeting the sector-specific goals “in the coming years,” and it was candid that voluntary goals and funding alone would not produce the change it wanted. Hence the third pillar, enforcement, which turned the document from guidance into a signal about future rules.

Hospital executives could read in it what they would be asked to do, how they might be required to do it, and whether anyone would help them pay.

Concept papers create no obligations, and many hospital executives read this one as a statement of intent, something to file and revisit later. It was more specific than that. It named a baseline of controls, named the regulatory levers that could make the baseline binding, and proposed incentives to help hospitals pay for it.

Those three elements had very different paths to reality. The first two were within HHS’s own power. The third depended on Congress. We take them in that order, because together they describe what was coming and who would pay: what the baseline would contain, which levers could make it mandatory, and how funding would, or would not, follow. First, though, what “controls” and “baselines” actually mean in a hospital.

Controls, baselines and the first-aid card

In cybersecurity, a control is any measure that reduces risk. Some are technical, such as software that blocks suspicious email. Some are procedural, such as a rule that a departing employee’s access is switched off on their last day. Some are about people, such as training staff to recognize a fake message. A baseline is simply an agreed minimum set of controls that every organization in a group is expected to have.

Large organizations often measure themselves against detailed frameworks, comprehensive catalogs that can run to hundreds of individual controls. These frameworks are thorough, but for a small hospital with a handful of IT staff they can feel like being handed an encyclopedia when what you need is a first-aid card.

That is where performance goals come in. They pick out a small number of practices that do the most to prevent the most common attacks, and they describe them in terms a board can understand. CISA, the federal Cybersecurity and Infrastructure Security Agency, had already published a set of cross-sector goals of this kind. HHS proposed to build healthcare-specific versions on top of them.

A baseline is a different regulatory idea from a risk analysis

The distinction matters because HIPAA was built the other way round. The Security Rule asks each covered entity and business associate to run its own risk analysis, weigh threats against its size and resources, and choose safeguards to match. Two organizations reading the same rule could reasonably reach different answers, provided each documented its reasoning.

A baseline reverses the burden. Certain controls are presumed necessary everywhere, and the risk analysis decides only what goes on top. That makes compliance easier to check and harder to argue around. It also has a cost. A floor can harden into a ceiling, with organizations doing the listed practices and little else, and a list written for today’s attacks can lag tomorrow’s.

HHS’s choice of short, high-impact goals was a bet that the floor was the bigger problem. OCR’s investigations had long found organizations that never completed an accurate risk analysis at all. For them, the flexibility of a risk-based rule had produced paperwork without protection.

Several of the practices on such lists deserve a quick explanation, because they come up again and again.

• Multi-factor authentication (MFA) means logging in with something you know, such as a password, plus something you have, such as a code on your phone. A stolen password alone is then not enough. A bank card works the same way: card plus PIN.
• Patching known exploited vulnerabilities means promptly installing the software fixes for security flaws that criminals are already known to be using.
• Separate privileged accounts means that the powerful administrator logins used to manage systems are kept apart from everyday accounts used for email and browsing, so a single stolen login does not hand over the keys to everything.
• Incident response planning means having a written, rehearsed plan for what to do when an attack happens, including who decides what, and how clinical care continues.

Two further practices on most lists are easy to underrate. Revoking access promptly covers contractors, students and volunteers as well as employees, and hospitals have many of each. Vendor requirements means writing security expectations into contracts with the companies that support clinical systems, many of which hold standing remote access to them.

The practice that is mostly clinical

Incident response planning looks like an IT item on the list, but most of its content belongs to clinical and operational leaders. When the electronic health record goes down for days, the questions are about care:

• how orders, results and medication administration are recorded on paper;
• who decides to divert ambulances, and how emergency medical services are told;
• how the laboratory and pharmacy keep working;
• how patients are identified when the registration system is gone.

Hospitals already had downtime procedures for planned maintenance, usually designed for a few hours. A ransomware outage can last weeks, and the procedures strain in ways a short outage never reveals. Paper forms run out, staff who have never charted on paper make errors, and the backlog of records to enter afterwards becomes its own project, with billing delayed until it is done.

A credible plan therefore names clinical owners as well as technical ones, and it is tested in exercises that include nursing, pharmacy, the emergency department and finance. The goal of an exercise is to find the step nobody owns. That is usually something mundane, such as who prints the current medication lists before access is lost, or who calls the neighboring hospital that will receive diverted patients.

What the baseline would contain

The paper promised voluntary, healthcare-specific cybersecurity performance goals, split into essential and enhanced tiers and building on CISA’s cross-sector goals. That lineage made the content predictable. Anyone who had read CISA’s goals could make a good guess at what HHS’s would say.

Why two tiers

The split between essential and enhanced goals was more than a ranking. It was a statement about who could reasonably be expected to do what. Essential practices are mostly configuration and discipline: settings in existing email and identity systems, a patching routine, an offboarding checklist, a written plan. A hospital with a small team can do most of them with tools it already licenses.

Enhanced practices are capabilities. A complete asset inventory, network segmentation that keeps an infected workstation away from infusion pumps, centralized log collection and someone to read the logs, regular testing: these need people, products and time. A large health system may already have most of them. A critical access hospital usually has few.

The paper’s funding design followed the same line. Upfront money would help high-need hospitals reach the essential tier. A separate incentive program would push all hospitals toward the enhanced tier, with financial consequences for those that did not get there. Reading the tiers and the money together showed what HHS expected of each kind of hospital.

The essential tier would emphasize a short list of practices associated with preventing or containing ransomware: multi-factor authentication, email security, timely patching of known exploited vulnerabilities, unique credentials and separate privileged accounts, revoking access for departing staff, basic training, incident response planning, and attention to vendor risk, the risk that comes from the many outside companies that connect to a hospital’s systems.

A short list was useful precisely because it was short. Many hospitals, especially small and rural ones, could not implement every control in a mature framework, and their boards had no simple way to ask whether the basics were in place. A list of a dozen or so practices changed that conversation. A board member does not need to understand the technology to ask, “Do we have multi-factor authentication on email and remote access, yes or no?”

A health system could map itself against the likely essentials within weeks. For each practice, the map records whether it was in place, where it was partial, the gap’s cost and its owner. That map would serve whatever form the requirements eventually took.

How the picture differs by type of provider

• Large systems and academic medical centers would find little new in the essentials. Their problem was consistency: a practice in place at the flagship hospital but not at a recently acquired one, or not on the clinics’ separate network.
• Community and critical access hospitals were the paper’s main concern. Their gaps were often in the essentials themselves, and their constraint was staff more than money.
• Ambulatory networks and physician groups are covered by HIPAA but not by hospital conditions of participation. For them, the goals mattered mainly through a possible HIPAA rewrite and through what hospital partners would start asking of them.
• Vendors and business associates, such as billing companies, clearinghouses and EHR hosting providers, appeared in the goals as the vendor risk that hospitals had to manage. Under HIPAA they also carried obligations of their own.

It also gave hospitals evidence for a separate legal benefit. Since a 2021 amendment to the HITECH Act, HHS must consider recognized security practices in place for the prior 12 months when it sets HIPAA penalties. If a hospital suffers a breach and HHS investigates, the hospital can point to a year of documented good practice, and HHS has to take it into account. So documented adoption had value before anything became mandatory, but only if the documentation existed and was dated.

The statute names what counts. Recognized security practices include the standards and best practices developed under the NIST Act, such as the NIST Cybersecurity Framework. They also include the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, the source of the Health Industry Cybersecurity Practices. Other programs developed under statutory authority can also qualify. A hospital that mapped itself to the HHS goals, which drew on the same sources, was building toward one of these.

The benefit has limits. It can reduce fines and shorten audits. It does not excuse a breach, it does not replace the risk analysis, and it depends on the hospital being able to show the practices were actually in place, with evidence beyond a written policy. Evidence that ages well is specific: dated configuration exports, ticket histories for offboarding, patch reports, training records with names and dates, and minutes of exercises.

Suppose an 80-bed community hospital with four IT staff. Its chief financial officer builds a one-page table with the likely essential practices down the side and four columns: in place, partial, estimated cost to close, and owner. The table shows that multi-factor authentication is on remote access but not on email, that patching is done but not tracked against the list of known exploited vulnerabilities, and that nobody owns vendor access. Two of the three gaps are inexpensive. The table goes to the board, and for the first time the board can see its cybersecurity position on a single page.

The table also changes who is accountable. Before it, cybersecurity belonged to “IT.” After it, each gap has a named owner: human resources for offboarding, the supply chain office for vendor access, the chief nursing officer for how multi-factor authentication works on clinical workstations.

Which levers could make it mandatory

The paper named two routes, and neither needed new legislation. That is easy to miss: HHS did not need Congress to make the baseline binding, because it already had the tools.

The first route was the HIPAA Security Rule, which applies to covered entities, such as hospitals, health plans and most providers, and to their business associates, the vendors that handle health information on their behalf. The rule had been written to be flexible and technology-neutral, with many implementation specifications labeled “addressable,” which let organizations document why they had chosen an alternative. That flexibility was deliberate, but it also meant that two hospitals could take very different approaches and both claim compliance.

How a HIPAA rewrite would work

A Security Rule update follows the ordinary rulemaking path. OCR publishes a proposed rule, the public comments, OCR weighs the comments and publishes a final rule, which takes effect after a set period. HIPAA rules generally give regulated entities 180 days after a change takes effect to comply. That sounds like time. For a hospital renegotiating dozens of business associate agreements and deploying controls across every system that holds patient data, it is not much.

Enforcement would run through the channels OCR already used: complaints, breach reports and compliance reviews, ending in technical assistance, corrective action plans, settlements or civil money penalties. Under HITECH, state attorneys general can also bring HIPAA actions. A rewrite would not change who enforces. It would change how much room an organization had to argue that a missing control was a reasonable choice.

HHS said it would propose an update. A rewrite could turn named controls into explicit requirements for every covered entity and business associate, including small practices and vendors. Physician offices, billing companies and software providers would all have to meet the same requirements as hospitals.

That breadth is the HIPAA route’s strength and its weakness. It reaches the whole chain, including the vendors through which many attacks arrive. It also means a single set of requirements must fit a two-physician practice and a national health plan, which tends to produce either rules too heavy for the small or too loose for the large.

The second route was Medicare and Medicaid. HHS said it would propose cybersecurity requirements for hospitals through CMS, the Centers for Medicare & Medicaid Services, which most naturally means the conditions of participation that hospitals must meet to be paid. Conditions of participation are the rules a hospital must follow to bill Medicare and Medicaid, covering everything from patient rights to fire safety.

That lever is powerful for three reasons. It reaches almost every hospital. It is checked through surveys, regular inspections, rather than complaint-driven investigations that start only after something goes wrong. And it carries a consequence, loss of Medicare participation, far beyond a HIPAA penalty; for most hospitals, losing Medicare would be existential. It would place cybersecurity in the same compliance category as infection control and emergency preparedness, with survey readiness, documentation and plans of correction.

How a condition of participation would work

The hospital conditions of participation are federal regulations. Compliance is checked by state survey agencies working for CMS and by accrediting organizations, such as the Joint Commission, whose surveys CMS accepts in place of its own. A surveyor who finds a hospital out of compliance cites a deficiency. The hospital submits a plan of correction and is checked again. Serious findings can put a hospital on a termination track, although that remains a last resort and most deficiencies end with a corrected plan.

The nearest precedent is emergency preparedness. CMS added emergency preparedness requirements for hospitals and many other provider types in a 2016 rule, and they became a standard part of surveys: a risk-based plan, policies, communications, training and exercises. A cybersecurity condition would likely look similar, with surveyors asking for documents and evidence of testing rather than inspecting firewalls themselves.

CMS was already touching security at the edges. Its Medicare Promoting Interoperability program required eligible hospitals to attest that they had conducted a security risk analysis and completed self-assessments using ONC’s SAFER Guides, which cover the safe use of electronic health records. Those were attestations, not inspections. A condition of participation would replace a checkbox with a surveyor.

Reach is the other difference. Conditions of participation cover hospitals, and critical access hospitals have their own parallel conditions. Physician practices are outside them, and ambulatory surgical centers have separate conditions for coverage. A cybersecurity condition for hospitals would leave much of outpatient care to HIPAA alone.

The two routes would differ in scope, timing and enforcement. A compliance officer could prepare for both at once by building the evidence each would demand:

• dated policies, showing what the hospital requires and since when;
• configuration records showing controls actually in force;
• test results for backups and incident plans, showing they work;
• a named owner for each control.

Counsel should track both, because comment periods, the window when the public can respond to a proposed rule, are when a hospital can influence what is feasible. A rule written without hearing from small hospitals is more likely to assume resources they do not have.

Which lever bites whom

• A hospital or health system would face both levers, with different evidence demands: a surveyor’s checklist under Medicare, and OCR’s investigation file under HIPAA.
• A critical access hospital would face both too, but with the least capacity to prepare and the most to lose from a deficiency citation.
• A physician group or ambulatory network would feel mainly the HIPAA route, plus contract terms passed down from hospital partners.
• A business associate would feel the HIPAA route directly and, indirectly, every hospital customer’s new vendor questionnaire.
• A health plan would feel the HIPAA route but not the hospital conditions, although plans that own providers would see both.

How funding would follow

The paper acknowledged that many hospitals lacked the resources to meet even the essential goals. It proposed two incentive programs. One would provide upfront investment to help high-need hospitals, such as small and rural ones, implement the essential practices. The other would be a program to encourage all hospitals to adopt the enhanced practices, with financial consequences for those that did not. Both depended on new authority and appropriations from Congress.

Why the money needed Congress

Medicare payment rates are set by statute and by rules that implement it. HHS cannot simply decide to pay hospitals more for buying security tools, or to cut payments to those that do not, without authority from Congress. Requirements are different. CMS already had broad authority to set health and safety conditions for hospitals, and OCR already had authority to set HIPAA security standards. Obligations could be imposed under existing law; money could not be spent without new law.

There was a template for what HHS was asking. The HITECH Act of 2009 created Medicare and Medicaid incentive payments for hospitals and clinicians that adopted certified electronic health records, followed later by Medicare payment reductions for those that did not. The concept paper’s design, support first and financial consequences later, followed the same pattern. HITECH, however, arrived as part of a large economic stimulus law. A comparable program for cybersecurity would need its own vehicle, and none was in sight in December 2023.

That was the asymmetry at the center of the paper. Requirements could arrive through rulemaking on HHS’s timetable. Money could arrive only through legislation, on Congress’s. A hospital that planned on federal help arriving before obligations was making a bet the paper itself did not support.

The asymmetry fell hardest on the hospitals least able to absorb it. A large system can fund a security team from operating margin. A critical access hospital, a small, usually rural hospital with a special Medicare designation, with a handful of IT staff and thin or negative margins cannot. A mandatory baseline without money would push it toward outsourcing, affiliation with a larger system, or a slower path to compliance negotiated with regulators. Boards of small hospitals needed to see that choice early, while they still had time to choose rather than have the choice made for them.

What the costs actually are

The costs fall into four groups, and they behave differently. Licenses for multi-factor authentication, email filtering and endpoint detection are recurring and predictable. Labor to configure, patch and review is the hardest to find in rural markets. Round-the-clock monitoring is the largest single step up, because it requires either a staffed team or a contract. Testing, from restore tests to penetration tests, is periodic but easy to defer, which is why it so often is.

Some of the spending was already being forced by another party. Cyber insurers had for several years been asking applicants about multi-factor authentication, backups and endpoint detection, and pricing or declining cover accordingly. For many hospitals, the essential goals described controls their insurer was already requiring. The baseline gave those controls a regulatory reason as well as a commercial one.

The practical response ran in three steps.

1. Fund the cheap, high-impact practices first. Some essential practices are cheap relative to their effect, such as multi-factor authentication for remote access and email, and patching known exploited vulnerabilities. They should come first.
2. Share what one hospital cannot carry. Look for shared services, such as a regional security operations center (a team that monitors systems around the clock for signs of attack) run by a hospital association or a larger partner, to spread costs that a single critical access hospital cannot carry.
3. Frame the budget around downtime. Frame the budget request around the cost of extended downtime, which for most hospitals dwarfs the cost of the controls, so that cybersecurity competes with clinical investments on comparable terms.

The third step matters most. Cybersecurity budgets often lose to new equipment or clinical staff because the benefit is invisible: nothing happens. Framing the request around what a week without the electronic health record would cost in diverted patients, cancelled procedures and delayed billing turns an abstract risk into a figure the finance committee recognizes.

The case for waiting, and why it was weaker than it looked

A finance committee in December 2023 had a respectable argument for patience. The rules were not written. Federal money might come, and spending now could forfeit it. Controls chosen today might not match the final requirements, and scarce staff might be better spent on clinical systems.

The argument works for some investments and not others. The essential practices were the same across every source a hospital might be measured against: CISA’s goals, HHS’s own 405(d) guidance, insurer questionnaires and every major framework. Money spent on them was low-regret whatever the final rule said. The argument for waiting was stronger for large, enhanced-tier projects, such as a full network segmentation program, where design choices might reasonably follow the final requirements.

Funding was the weakest reason to wait. Even if Congress acted, an incentive program would take years to design and pay out, and nothing in the paper suggested that money would reward controls a hospital adopted before it existed. Waiting for funding meant carrying the risk in the meantime, uninsured by any program.

Patients, money and the boardroom

The baseline was never only a matter for the compliance officer and the IT department. The stakes reach much further.

• Patients. The essential practices exist because they prevent or contain the attacks that take hospitals offline. When systems go down, care slows, ambulances may be diverted and procedures are postponed.
• Money. A mandatory baseline brings costs, and the paper made clear that federal help was uncertain. At the same time, extended downtime is far more expensive than most controls.
• Regulators. If the Medicare route were used, cybersecurity would join the list of things surveyors inspect, with the same consequences as any other condition of participation. A HIPAA rewrite would bring explicit requirements for vendors too.
• Strategy. For small hospitals, a mandate without money could shape decisions about outsourcing, partnerships and affiliation. Those are board-level choices.
• Staff. Several essential practices, such as training and multi-factor authentication, change how every employee works each day. Rolling them out well takes clinical leadership as well as IT.

Second-order effects

The obvious responses to a baseline create problems of their own. Multi-factor authentication on shared clinical workstations can slow nurses down if it means a phone prompt for every login, which is why many hospitals pair it with badge-tap or proximity sign-on. Shared security services move risk as well as cost: a regional monitoring center serving many small hospitals becomes a concentration point, and its own security and contracts need scrutiny.

Requirements without funding also feed consolidation. A small independent hospital that cannot meet a mandated baseline alone has a new reason to join a larger system. Whether that is good for patients depends on the market, but it is a strategic consequence that a cybersecurity rule rarely announces. Boards of independent hospitals should see it coming.

Finally, a baseline changes the conversation with vendors. Once hospitals must show that vendor access is controlled, every supplier with a remote connection faces questions about how it authenticates, what it logs and how fast it reports incidents. Smaller vendors may struggle, and some hospitals will find that a critical clinical system depends on a supplier that cannot answer.

Winning the capital round

Return to the 80-bed hospital. Its one-page map shows three gaps: no multi-factor authentication on email, patching not tracked against known exploited vulnerabilities, and no owner for vendor access. Its four IT staff also cannot watch systems overnight or at weekends.

The chief information officer’s first budget request, framed as “cybersecurity tools and services,” loses to a new imaging machine in the capital round. The board is not careless. It simply sees a visible clinical need competing with an invisible risk.

The following year the request is rebuilt in three parts, following the three steps above. First, the inexpensive fixes: extend multi-factor authentication to email, start tracking patching against the known exploited list, and name an owner for vendor access. These are funded from the operating budget within weeks. Second, overnight monitoring: rather than hire staff it cannot afford, the hospital joins a shared security operations center offered through its state hospital association, splitting the cost with other small hospitals. Third, the framing: the finance team estimates what a week without the electronic health record would cost in diverted patients, rescheduled procedures, overtime and delayed billing, and sets that figure beside the cost of closing the gaps.

The figure is an estimate, and the board knows it. But it changes the conversation from “Should we spend money on IT?” to “Is this a reasonable premium against a known exposure?” The request is approved. Just as important, the hospital has begun building the dated evidence of recognized security practices that would count if HHS ever investigated a breach, and that any future survey or HIPAA audit would ask to see.

What the board watches afterwards

Approval is the start of the work. The hospital’s board asks for a short quarterly report with a handful of measures it can follow without technical knowledge:

• the share of accounts, including remote and email access, protected by multi-factor authentication;
• the time taken to patch vulnerabilities on CISA’s known exploited list;
• the number of privileged accounts, and whether it is going down;
• the date of the last successful restore test for the electronic health record and its backups;
• the number of vendors with remote access, and how many have been reviewed.

Each measure maps to one of the essential practices, and each produces dated evidence as a by-product. The report doubles as the record a regulator would ask for.

The measures also expose drift. A multi-factor authentication figure that slips from one quarter to the next usually means new systems or new staff groups were added without it, often through an acquisition or a new clinic. Catching that early is far cheaper than finding it during an investigation.

Nothing in this example depended on the final shape of the rules or on federal incentives. A hospital that does the inexpensive essentials, shares what it cannot carry and makes the cost of downtime visible is prepared for whichever lever HHS pulls, whenever it pulls it.

Reading the paper as a preview

The hospitals best placed were those that treated the concept paper as a preview and acted on it: a one-page map against the essentials, dated evidence building up month by month, a compliance officer tracking both regulatory routes, a board that had seen the gaps and their costs, and a funding plan that did not depend on Washington.

The sequence mattered as much as the content. In the first ninety days, a hospital could finish the map, fix the cheapest gaps and start dating its evidence. Within a year, it could settle its approach to round-the-clock monitoring, run a full restore test and an incident exercise with clinical leaders, and rewrite vendor contracts as they came up for renewal. Larger enhanced-tier projects could follow as budgets and the eventual rules allowed.

The ways to get it wrong were just as recognizable:

• Waiting for the final rule. By the time a rule is final, the 12 months of documented practice that could reduce a penalty will either exist or not.
• Counting on federal money. The paper itself made incentives conditional on Congress.
• Treating “addressable” as “optional.” Even under the existing rule, choosing an alternative requires documenting why.
• Buying tools before basics. Expensive products do little if email lacks multi-factor authentication or departing staff keep their access.
• Keeping cybersecurity off the board agenda. A short list of practices exists precisely so boards can ask about them.

Where a board can test its hospital’s readiness

• Against the essential cybersecurity practices, where are we fully in place, partial or missing, what would each gap cost to close, and who owns it?
• Can we show 12 months of dated evidence that our security practices were in place, if HHS ever asked?
• If CMS made cybersecurity a condition of participation tomorrow, what would a surveyor ask to see, and could we produce it?
• Are any of our plans assuming federal funding that has not been enacted?
• What would a week without our electronic health record cost us, and how does that compare with the cost of closing our gaps?

With hindsight

HHS published its healthcare and public health cybersecurity performance goals in January 2024, with ten essential and ten enhanced goals that closely matched the practices above. The baseline arrived quickly, and on HHS’s own timetable, just as the paper suggested it could.

The essential goals covered mitigating known vulnerabilities, email security, multi-factor authentication, basic training, strong encryption, revoking credentials for departing workforce members, basic incident planning, unique credentials, separate user and privileged accounts, and vendor cybersecurity requirements. The enhanced goals added asset inventory, third-party vulnerability disclosure and incident reporting, testing and mitigation, threat detection, network segmentation, centralized logging, centralized incident planning and configuration management. HHS described them as voluntary and built them on CISA’s cross-sector goals and its own 405(d) practices.

The Change Healthcare attack in February 2024 intensified the debate, showing how far a single incident could reach across the health system. An affiliate of the ALPHV ransomware group broke into Change Healthcare, a UnitedHealth Group subsidiary that processes a large share of the country’s insurance claims. Pharmacies, physician practices and hospitals lost the ability to submit claims or check coverage for weeks, and CMS offered accelerated and advance payments to help providers with cash flow. UnitedHealth later put the number of people whose data was involved at roughly 190 million.

The attack also exposed a gap the concept paper had not addressed. The hospital-centered levers, conditions of participation and hospital incentives, did nothing about a clearinghouse whose failure stopped payments to providers of every kind. Only the HIPAA route reached business associates of that sort.

At the end of 2024, HHS proposed a substantial rewrite of the HIPAA Security Rule. It would remove the distinction between required and addressable specifications and mandate controls including multi-factor authentication, encryption, asset inventories (complete lists of an organization’s systems and devices) and tested recovery.

The proposal was published in the Federal Register on January 6, 2025, with comments due by March 7, 2025. It would require a written technology asset inventory and network map, reviewed at least every 12 months, and written procedures to restore critical systems and data within 72 hours. It would also require vulnerability scanning at least every six months, penetration testing at least once a year and an annual compliance audit. Business associates would have to give written verification that they had deployed the required safeguards. HHS estimated first-year costs of about $9 billion and about $6 billion a year in years two through five.

Many hospital groups opposed it over cost. As we write it has not been finalized. An earlier regulatory agenda had targeted May 2026; that date passed, and OCR’s agenda now points to July 2027; organizations should check its status with counsel. We are not aware of CMS having proposed cybersecurity conditions of participation for hospitals. So of the two regulatory levers, one has moved slowly and the other, as far as we can find, not at all.

OCR has not waited for the rewrite to act. It has continued to enforce the existing Security Rule, and its settlements in 2024 and 2025 repeatedly turned on the most basic requirement, an accurate and thorough risk analysis. For a hospital, that meant the old rule kept producing consequences while the new one stalled.

The asymmetry held: we know of no dedicated hospital cybersecurity incentive program of the kind the paper described being enacted. Bills to tie federal health payments or grants to minimum cybersecurity standards were introduced in the Senate after the Change Healthcare attack, but as far as we can find none became law. The Rural Health Transformation Program created by the 2025 budget law lists cybersecurity capability among permitted uses of its funds, but it is a broader program, administered by states and limited to fiscal years 2026 through 2030. It provides $50 billion, $10 billion a year, with half split equally among approved states and half allocated by CMS using factors such as rural population and the circumstances of rural facilities. A small hospital may find money there, but it is not the dedicated support the paper envisaged, and it competes with many other rural health priorities.

The hospitals that mapped themselves against the essentials and started documenting practice in late 2023 lost nothing by acting early; they have years of evidence and fewer gaps. When the HHS goals appeared in January 2024, they could check their maps against the published list. When the HIPAA proposal arrived, its most basic demands, such as multi-factor authentication and encryption, were already familiar ground. The ones that waited for rules or money are still waiting for some of both. Requirements can still arrive on a regulator’s schedule, and funding still depends on others. Planning for that gap, by doing the cheap, high-impact work first and sharing costs where possible, remains the sound course.