Permission to donate cybersecurity arrived without the money to run it

The week

On November 20, 2020, the HHS Office of Inspector General and the Centers for Medicare & Medicaid Services released companion final rules. They revised two of the most important legal guardrails in American health care. Among other things, they let hospitals help the small practices around them with cybersecurity.

The rules had been a long time coming. HHS proposed them in October 2019 as part of its Regulatory Sprint to Coordinated Care, an effort begun in 2018 to remove regulatory obstacles to coordinated, value-based care. Hospitals, physician groups, technology vendors and trade associations filed comments over the following months. The final versions arrived late in the administration’s term, with the pandemic still straining every part of the system they regulated.

Take a three-doctor family practice in a small town. It sends patients to the regional hospital for scans and surgery, its staff log in to the hospital’s systems to check results, and its office manager doubles as the person who “does the computers.” The hospital’s security team knows that practice is a soft spot. For years, federal law made it risky for the hospital to simply help.

The first of those laws is the federal Anti-Kickback Statute, which makes it a crime to offer anything of value to encourage referrals of patients covered by federal programs such as Medicare. Its “safe harbors” are carefully defined arrangements that are treated as acceptable. The second is the physician self-referral law, usually called the Stark law, which restricts doctors from referring Medicare patients to entities they have a financial relationship with, unless an “exception” applies. Together, the two laws explain why hospital lawyers grow nervous whenever someone proposes giving a referring physician something for free.

Much of the November package concerned value-based care, meaning payment arrangements that reward health outcomes rather than the volume of services. Tucked inside it was something new: protection for donations of cybersecurity technology and related services, for example from a hospital to physician practices that refer patients to it. Cybersecurity here means the tools and work that keep computer systems and data safe from intruders. Examples include software that spots malicious programs on a laptop, filters that catch fraudulent emails, and the people who watch for alerts.

The OIG rule alone added or changed safe harbors for value-based arrangements, patient engagement and support, CMS-sponsored payment models, local transportation, warranties and outcomes-based payments. CMS made parallel changes to the Stark regulations and clarified long-disputed terms such as commercial reasonableness and fair market value. Cybersecurity was a small part of a very large package.

The timing gave the cybersecurity provisions more weight than their length suggested. In late September 2020, a ransomware attack disrupted Universal Health Services, a large hospital operator, across many of its facilities. In October, the University of Vermont Health Network was hit and spent weeks restoring systems. On October 28, CISA, the FBI and HHS issued a joint advisory warning of an increased and imminent cybercrime threat to U.S. hospitals, naming Ryuk ransomware. The final rules landed three weeks later, in a sector already on alert.

The detail that mattered most was money. Hospitals had long been allowed to donate electronic health record systems, the digital charts doctors use, but recipients had to share in the cost. The new cybersecurity protections did not require the recipient to pay anything. There was a firm condition attached: donations could not be conditioned on referrals.

The text was deliberately broad. It defined cybersecurity as “the process of protecting information by preventing, detecting, and responding to cyberattacks,” and covered technology including hardware. The October 2019 proposal had left hardware out. The final rules let it in, provided it was necessary and used predominantly to implement, maintain or re-establish cybersecurity. The agencies described services such as training, cybersecurity-as-a-service, testing, business continuity and data recovery. Because only nonmonetary help qualified, cash, including money to pay a ransom, fell outside it.

Three conditions framed the protection, of which the referral bar was one. The arrangement had to be documented in writing, and a recipient could not demand a donation as a condition of doing business. Donors also could not shift the cost of what they gave away onto federal programs, for example by claiming it on Medicare cost reports.

The same package revised the older electronic health record donation rules. It removed their scheduled expiry at the end of 2021, allowed donations of replacement record systems and confirmed that security protecting a donated record system could be part of that donation. It kept the requirement that recipients pay at least 15 percent of the donor’s cost. Record systems still required the recipient to contribute, and standalone security did not.

The rules were published in the Federal Register in early December and took effect in January 2021. In one week, a legal obstacle that had blocked countless well-meant offers was removed. What the rules could not do was pay for the help, staff it, or keep it running.

Before these rules, a hospital that wanted to help an affiliated physician practice secure its systems faced a legal question first. Could giving something of value to a referral source be treated as an inducement for referrals? The answer often ended the conversation. Compliance officers, quite reasonably, did not want to explain to federal investigators why the hospital had handed free services to the very doctors who sent it patients.

The November 2020 rules opened a clear path. How far donors traveled down it depended on economics more than law: on what the rules unlocked, on the donor’s economics, and on the recipient’s.

The sections below begin with the exposure itself and the tools that address it. They then take those three factors in turn, and close with the program design that follows from them and the questions a leader should be able to answer.

Why a hospital worries about the doctor’s office down the road

Modern health care is wired together. A health system is no longer one building with its own computers. It is at the center of a web of affiliated practices, labs, imaging centers and clinics that exchange information all day.

Affiliated practices often connect to the system’s electronic health record, the shared digital chart that holds diagnoses, medications, test results and notes. They exchange referrals and results electronically and share patients. A physician’s front-desk staff may log in to the hospital’s system many times a day. The hospital can have excellent locks on its own doors, but a practice with weak defenses is a side entrance into the same systems.

That is the core of the hospital’s concern. A compromised practice account can become a route into shared systems, or a source of fraudulent messages that look trustworthy because they come from a known partner. If an attacker takes over the email account of a nurse at a trusted practice and sends the hospital’s billing office a request to change bank details, that message arrives wearing a familiar face. Security professionals call the total set of entry points an organization exposes its attack surface. The practice is part of the system’s attack surface whether or not the system owns it.

How a compromise travels

The routes are mundane. A front-desk worker at a practice reuses one password for personal email and the hospital’s physician portal. A phishing email harvests it. If the portal accepts a password alone, the attacker now reads patient records under a legitimate name. If the practice connects through a remote-access gateway or a shared virtual desktop, the attacker may land inside the hospital’s network rather than at its edge.

Other paths run through the plumbing. Many systems extend their own record system to independent practices as a hosted service, so the practice’s users are, technically, users of the hospital’s record. Interfaces pass orders, results and referrals between systems automatically. Shared mailboxes, electronic fax and file transfer links carry documents both ways. Each is a trust relationship, and an attacker who controls one end inherits that trust.

Business email compromise is the least technical route and often the most expensive. An attacker who controls a practice’s mailbox can reply inside existing threads with the hospital’s supply chain or billing teams. The messages carry real history and real names. Filters built to stop strangers do little against a known correspondent whose account has been taken over.

Who counts as connected

Practices near a hospital do not all pose the same risk. Practices the system employs or owns are usually already on its network and inside its security program. Independent practices on the system’s hosted record are the classic donation candidates: legally separate, technically entangled. Referring practices that only exchange documents present less direct access risk, though their mailboxes still matter. Labs, imaging centers, ambulatory surgery centers, skilled nursing facilities and home health agencies form further rings, each with its own connections.

Legal status matters as much as the technical link. An independent practice is its own HIPAA covered entity, responsible for its own risk analysis and safeguards. Donating tools to it does not, by itself, move those duties to the donor, and counsel should confirm how a given program’s terms affect that line. The hospital is exposed to the practice’s risk without controlling it, which is the problem the rules tried to ease.

Small practices are, through no fault of their own, harder to defend. They rarely have dedicated IT staff. Their budgets go first to clinicians and rent. Their technology is often a patchwork of devices bought at different times. Attackers know this, which is why criminals so often target the smaller members of a network to reach the larger ones.

What a hospital might actually donate

The rules covered cybersecurity technology and related services. The most common pieces are these.

Endpoint protection and detection

An endpoint is any device a person uses to reach the network: a desktop at the front desk, a laptop a physician takes home, a tablet in an exam room. Endpoint protection is software on those devices that blocks known malicious programs. Its more capable cousin, endpoint detection and response, watches for suspicious behavior, such as a program suddenly encrypting hundreds of files, and can isolate the device before the damage spreads. The difference is roughly that between a lock on the door and a guard who notices when someone is behaving oddly in the hallway.

Email filtering

Most attacks still begin with an email. Phishing is the practice of sending messages that trick a recipient into clicking a harmful link, opening a poisoned attachment or handing over a password. Email filtering services screen incoming mail and quarantine the obvious fakes before they reach a person’s inbox. They catch a great deal, but never everything.

Multifactor authentication

Multifactor authentication means that logging in requires something beyond a password, such as a code from a phone app or a physical key. If a password is stolen, the attacker still cannot get in without the second factor. Phishing-resistant versions go a step further by making it very difficult for a fake website to capture and replay the login. For a practice whose staff log in to hospital systems all day, this is one of the most valuable single protections available.

Backups

Ransomware is malicious software that scrambles an organization’s files and demands payment for the key to unscramble them. The best defense against being forced to pay is a recent copy of the data that the attacker cannot reach, usually called an offline backup. The word that matters is “tested.” A backup that has never been restored is a hope rather than a plan.

Monitoring services

All of these tools generate alerts. Someone has to read them, decide which matter and act, including at two in the morning on a holiday weekend. Organizations that cannot staff this themselves buy it as a managed or monitored service. This is the part of cybersecurity that is easiest to underestimate, and it turns out to be the heart of the economic question.

Training, testing and recovery help

The coverage of services reached past running software. Security awareness training for practice staff, simulated phishing, vulnerability scans, penetration tests and help writing an incident response plan could all be donated if they served cybersecurity predominantly. So could incident response itself: a retained team that arrives when a practice is hit, contains the damage and helps restore systems. For a practice with no relationship with any responder, a donor’s retainer may be the most valuable item on the list.

Hardware, within limits

Because the final rules covered hardware, a donor could supply devices whose main job is security, such as a managed firewall or physical security keys for multifactor sign-in. The predominant-use test still applied. A general-purpose laptop that happens to run security software is hard to fit within it, and counsel would expect a clear security rationale for any device donated. Hardware also brings lifecycle obligations: firmware updates, replacement and eventual retrieval.

What stayed outside

Some things the rules never reached. Cash was excluded because only nonmonetary help qualified. General IT support, such as fixing a printer or upgrading a scheduling system, does not become cybersecurity because it touches a computer. And nothing in the rules changed who is responsible when a recipient is breached. Programs that blur these edges invite the legal questions the rules were meant to settle.

What the rules unlocked

The new Anti-Kickback Statute safe harbor and the parallel Stark exception covered cybersecurity technology and related services that are necessary and used predominantly to implement, maintain or re-establish cybersecurity. The definition was broad on purpose. Commenters had argued that attackers do not distinguish between software, services and the people who run them, and the agencies largely agreed. A donor was therefore not limited to handing over a software license. Services, the human work of running and watching the tools, were in scope.

The absence of a cost-sharing requirement mattered most. Electronic health record donations required recipients to pay a share. Small practices, the organizations least able to contribute, would have been the ones priced out. Removing the contribution removed that barrier. Suppose a four-physician practice already has its annual technology budget stretched by its record system and phone lines. A requirement to fund a share of a security program might have been enough for its partners to decline. Without it, the conversation could at least begin.

Conditions remained, and any board or general counsel needs to understand them:

• Donors could not take the volume or value of referrals into account when choosing recipients or sizing donations. A hospital cannot offer better protection to the practices that send it the most patients.
• Recipients could not demand a donation as a condition of doing business. A practice cannot say, in effect, “protect us for free or we will refer elsewhere.”
• The arrangement had to be documented.

Organizations should check with counsel before structuring a program, because the two regimes differ in detail. The Anti-Kickback Statute and the Stark law were written for different purposes and have different mechanics, so an arrangement that fits one cleanly still needs to be tested against the other.

What the written agreement covers

The rules required documentation without prescribing a form. A sound agreement names the parties, describes each item and service donated, states the donor’s cost where it can be determined, and records how recipients were chosen. It sets the term, the recipient’s obligations and the exit terms. Counsel will also want a separate record showing that selection criteria were applied consistently to every connected practice.

How the two regimes differ

The differences have practical consequences. The Anti-Kickback Statute is a criminal law that turns on intent, and it applies to anyone who offers or receives remuneration tied to federal health program business. Its safe harbors are voluntary. An arrangement outside a safe harbor is not automatically illegal; it is judged on its facts, which leaves uncertainty that compliance officers dislike.

The Stark law works the other way. It is a civil, strict-liability statute that applies when a physician refers Medicare patients for certain “designated health services” to an entity with which the physician has a financial relationship. Intent does not matter. If a financial relationship exists and no exception fits, the referrals are prohibited and the resulting claims can be denied or recouped. A free security service creates a financial relationship, so a hospital donating to referring physicians needs the exception to fit exactly.

Other rules surround the two federal ones. Many states have their own anti-kickback and self-referral laws, some reaching commercially insured patients. Nonprofit hospitals also weigh tax-exemption rules on private benefit when they give things of value to private practices. A program that clears federal fraud and abuse review still needs those checks.

Why the standalone path mattered

Before November 2020, the closest route was the record-system donation rule. It was built for record systems, carried the 15 percent contribution and left doubt about how far security help could go. The 2020 package clarified that security protecting a donated record could fall under that rule. The new standalone protection went further, covering security for the whole practice, from email to backups, with no contribution. For a donor, the choice of route also shapes the paperwork: which rule the written agreement cites, what it describes and how recipients are chosen.

The donor’s economics

For a health system, the case for donating is self-interest. The affiliated practice is part of the attack surface, and strengthening it protects the hospital’s own systems, patients and reputation. That self-interest is healthy; it is the reason the rule could work at all.

Against that sit costs that never appear on a license quote. Each practice needs onboarding: someone has to visit or call, take an inventory of devices, install software and explain what will change. Tools must be supported in environments the donor does not control, on hardware it did not buy. One practice runs aging desktops, another uses personal laptops, a third has an outside vendor who resists interference. Help desk calls rise.

And the donor becomes the visible provider of security when an incident happens anyway, which carries reputational and possibly contractual exposure. Some donors worried that a donation would be read as accepting responsibility for the practice’s security. If a donated tool misses an attack, does the practice’s lawyer call the hospital? Clear written terms manage that concern, but drafting them slows decisions.

A donation program is also a recurring commitment. Security tools and services renew annually. A program launched on one year of capital, or a grant, can end abruptly and leave practices dependent on protection that disappears. Withdrawing a monitored service from a practice that has come to rely on it is arguably worse than never offering it, because the practice may have stopped doing things it once did for itself.

A credible program sets a funding horizon of several years, names who in the donor manages the relationships, and agrees in writing what happens if a practice leaves the network or the program ends. To a chief financial officer it should look less like a one-time gift than an operating line that belongs in the multi-year budget alongside other shared infrastructure.

Pricing the program honestly

A realistic budget has more lines than a license quote. Per-device fees for endpoint detection and email filtering are the visible part. Behind them come the monitoring service, onboarding labor, extra help desk capacity, hardware keys, legal review and a program manager. Renewals rise when vendors reprice. Practices add staff and devices, and the per-device count grows with them.

The donor’s scale is the main economic argument for donation. A large system negotiates enterprise prices that a four-physician practice could never get alone. The catch is contractual. Many enterprise licenses limit use to the licensee and its affiliates, and an independent practice is not an affiliate. Donors usually need to renegotiate for third-party use or buy a separate multi-tenant service. Discovering this after the board has approved the program costs months.

Architecture choices carry costs too. Running recipients inside the donor’s own security console is cheap, but it mixes the donor’s data with the practice’s and widens what the donor sees. A separate tenant per practice, or a provider that runs its own multi-tenant platform, keeps the boundary clean at a higher price. Insurers on both sides may have views. The donor’s cyber policy may treat the program as a new exposure, and the practice’s policy may set its own control requirements.

Different donors, different math

An academic medical center with a large security team can absorb a program inside its own operations center. A regional system of modest size may need to buy the monitoring from a provider. A rural or critical access hospital, often struggling to fund its own defenses, is rarely in a position to donate at all. The hospitals best able to give are therefore not always the ones whose surrounding practices most need help.

Market position changes the referral question. A dominant system in a small market may receive most of a region’s referrals regardless, so selecting recipients by connection rather than referrals is easy to document. A system competing hard for referrals faces more scrutiny of any gift to independent physicians, and its counsel will want especially clean selection criteria.

The recipient’s economics

For a small practice, a donated tool is valuable only if someone operates it. Endpoint protection, email filtering and multifactor authentication all need configuration, monitoring and responses to alerts. Many practices have no IT staff and rely on a local managed service provider, or on an office manager who handles technology part-time.

Services are therefore worth more than software. A monitored service, with someone accountable for watching alerts and responding at night, changes a practice’s risk more than licenses it cannot run. Say a small practice receives an excellent detection tool, and at 11 p.m. on a Friday it flags suspicious activity on the billing computer. If nobody is watching, the alert sits unread until Monday, by which time the damage is done. The same tool paired with a monitoring service means someone isolates that computer within minutes.

The rules allowed services, but services cost the donor more and are harder to scale. That pushes donors toward a narrower offer than the rules permit, and much of the real story lies in the gap between what is legally possible and what is economically practical.

Underneath any donation sits a daily operating discipline that no donor can supply: patching, access reviews when staff leave, backups that are tested, and staff who recognize suspicious requests. Patching means installing the fixes that software makers release when they discover weaknesses; delaying them leaves known doors unlocked. Access reviews mean checking who still has logins, so the receptionist who left in the spring cannot still sign in by autumn. A donation can provide tools and some expertise. It cannot provide attention on the days nobody is looking, and programs that ignore this deliver tools that decay.

A donor can narrow the gap with simple supports: a shared patch calendar, a quarterly access review template, a named contact for suspicious messages, and an annual restore test the donor witnesses. Each is cheap, and together they turn good intentions into routine.

Independence matters to recipients as well. Many practices value their separation from large systems. Some are wary of arrangements that give a hospital visibility into their operations, even when the stated purpose is security. Monitoring tools, by their nature, see a great deal. Clear limits on what the donor can see and use help adoption.

The practice’s side of the bargain

A donation usually comes with obligations, and a practice should read them as carefully as the donor’s lawyers wrote them. Typical terms include allowing software on every device, enrolling all staff in multifactor sign-in, reporting incidents within a set time and cooperating with the monitoring provider. Each is reasonable. Each also takes time from a small staff, and the agreement should say who does the work.

Existing vendors complicate things. Many practices already pay a local managed service provider, which may resist a second party installing tools. Two security agents on one laptop can conflict. The cleaner arrangements bring the practice’s provider into planning, define who answers which alert and avoid paying twice for overlapping tools.

The donation does not discharge the practice’s own duties. A practice that is a HIPAA covered entity still needs its own security risk analysis and its own policies. Donated tools can make that analysis easier and its findings better, but the obligation stays with the practice. Owners who assume the hospital now handles security have misunderstood the gift.

What a practice should settle before signing

A practice weighing an offer can protect itself with a few written terms. It should know exactly which tools will be installed, who will monitor them and how alerts reach the practice. It should know what data leaves its environment, where it is stored and who at the donor can see it. It should see the program’s funding horizon and the notice it will get before any change. And it should have in writing that the offer does not depend on how many patients it refers, a term the donor’s counsel should welcome.

Recipients differ too

A small primary care practice and a large specialty group have different needs and different bargaining positions. A federally qualified health center may have its own IT staff and compliance program. A behavioral health practice may hold substance use disorder records protected by the separate federal confidentiality rule at 42 CFR Part 2, which makes it rightly cautious about any outside party with broad visibility. A dental or physical therapy practice may connect to the hospital only for referrals. A one-size donation fits none of them well, which argues for a common baseline delivered in a few standard packages.

Narrow and deep beats wide and thin

The design that fits these constraints is narrow and deep. Pick a short list of controls with the largest effect, such as phishing-resistant authentication, managed endpoint detection and tested offline backups. Deliver them as a service with named responsibilities. Verify them periodically. Apply the same baseline to every connected practice through third-party risk management, the discipline of assessing and managing the risks that come from suppliers and partners, whether or not the practice accepts a donation. The donation then becomes a way to meet the standard rather than a gift with no expectation attached.

Consider a regional health system connected to forty independent practices. It sets one baseline for all of them: multifactor authentication on every account that touches its systems, monitored endpoint detection on every device, and a tested offline backup. Any practice that already meets the baseline through its own vendor simply shows evidence once a year. Any practice that does not can accept the system’s donated service, delivered by a single provider under a multi-year contract. Recipients are selected by connection to the system, not by referral volume, and counsel signs off on the documentation. A one-page agreement states what the system’s monitoring can see, what happens if a practice leaves, and how much notice the system will give if the program changes.

Sequencing the rollout

Order matters because early wins pay for later work. Multifactor sign-in on every account that touches the hospital’s systems comes first. The hospital often controls those accounts or the portal, so it can enforce the change at its own end, and it closes the most common route in. Email filtering follows, because it needs little on-site work and blocks many attacks before anyone clicks.

Monitored endpoint detection takes longer. Each device needs an agent, each agent needs tuning, and the practice needs to know who will call when a device is isolated. Pilot with a handful of practices of different sizes, fix the onboarding checklist, then roll out in waves. Backups come last in sequence but not in importance. A practice on the hospital’s hosted record may have its clinical data protected by the hospital, yet hold no tested copy of the billing files, spreadsheets and scanned documents kept locally.

Each wave should end with evidence, not a completion email. Screenshots of sign-in policies, agent coverage reports and a witnessed restore are cheap to collect at the time and expensive to reconstruct when an auditor asks a year later.

Measuring whether the program works

A program should report outcomes, not activity. Useful measures include the share of connected accounts using multifactor sign-in, the share of practice devices reporting to the detection service, and the time from a high-severity alert to isolation of the device. Restore tests passed in the past year, and the number of practices still below the baseline, round out the set. Each figure can be produced from the tools themselves.

The evidence matters beyond the board. An auditor reviewing the hospital’s third-party risk program, or an insurer renewing its cyber policy, will ask how connected practices are assessed. A program that tracks coverage per practice answers with data. One that tracks licenses issued answers a different question.

The baseline itself needs an owner and a review date. Threats shift, and so do the controls insurers and regulators expect. A baseline set once and never revisited drifts out of date within a few years. An annual review, with changes announced well before they take effect, lets practices plan and budget instead of reacting.

Planning the exit on day one

Every program needs an off-ramp. A practice may be acquired by a competitor, change its record system or decline to renew. The agreement should set a notice period, a schedule for removing agents and licenses, and what happens to logs and alerts held by the donor. Without that, a departing practice can be left with half-removed software and no coverage at all.

The case against donating

The strongest objection is concentration. Put forty practices on one monitoring provider and one remote management tool, and a compromise of that provider reaches all forty at once. The July 2021 attack through Kaseya’s VSA software, which spread ransomware via managed service providers to their customers, showed that this risk is real. A donor that consolidates recipients needs to vet the provider’s own security as hard as its own.

A second objection holds that the hospital should defend its own boundary and leave practices alone. Strict conditional access, narrow portal permissions, phishing-resistant sign-in for outside users and close monitoring of partner connections all reduce what a compromised practice can reach. Those controls are worth doing in any case. They do not protect the patients whose records the practice itself holds, or stop fraudulent payment requests sent from a hijacked practice mailbox. Boundary controls and donations work best together.

A third objection concerns dependence. Some argue that donations entrench large systems and erode physicians’ independence. The concern deserves weight, which is why clear exit terms and limits on visibility matter. A program designed so a practice can leave without losing its protection answers most of it.

The programs that disappoint tend to do the opposite. Offering a long menu of licenses to every practice, with no one to run them, produces impressive numbers in a board report and very little change in actual risk. A program built on one-time money can leave practices worse off when it ends. Choosing recipients informally, or letting anyone hint that referrals matter, puts the whole program at legal risk. Monitoring that feels like surveillance will be resisted, switched off or never installed. And a hospital that cares only about the practices that accept a gift leaves the others as unexamined side entrances into the same systems.

Money, staff and an accountable owner

Whether you lead a health system, sit on a hospital board, or run a practice that might receive a donation, a few questions cut to what matters:

1. Which outside practices and partners can log in to our systems today, and what minimum security standard do we expect from every one of them, whether or not we help pay for it?
2. If we donate, are we donating tools, or are we donating someone to watch and respond to them?
3. How many years is the program funded for, and what happens to recipients if the money stops?
4. Has counsel confirmed that recipient selection and donation size are independent of referrals, under both the Anti-Kickback Statute and the Stark law?
5. What exactly can our monitoring see inside a recipient’s environment, and have we written that down for them?

Two smaller checks round out the picture: when someone from the donor last watched a recipient restore its data from backup, and who, by name, owns the relationship with each recipient practice. Vague answers to either suggest a program that exists mostly on paper.

Ownership inside the donor is often the weakest link. The security team runs the tools, compliance owns the legal structure, physician relations owns the practices and finance owns the budget. A program with four partial owners has none. One executive should be accountable, with a small committee from those functions meeting on a set schedule and reporting to the board at least once a year.

The November 2020 rules made it lawful for hospitals to help the smaller players around them. They left it to leaders to decide whether that help would be real, durable and run by someone accountable, which comes down to money, staffing and partnership, where senior executives have the most influence.

With hindsight

The case for supporting the smaller parts of health care grew stronger after 2020. The February 2024 attack on Change Healthcare, a major claims and payment clearinghouse, disrupted cash flow for practices nationwide and showed how much small providers depend on infrastructure they do not control. A clearinghouse is the behind-the-scenes intermediary that passes insurance claims and payments between providers and payers. When it went down, the money that keeps small practices open stopped flowing, and many discovered how exposed they were to someone else’s security failure.

The scale of that incident kept growing as the facts came in. Change Healthcare eventually told HHS that the breach affected about 192.7 million people, the largest health data breach reported to the department. In March 2024, CMS opened accelerated and advance payments to help affected providers survive while claims were stuck. That spring, small practices needed cash flow, and no security donation could have supplied it. The episode showed how unevenly the sector’s risk was spread.

Policy moved too, though slowly. In January 2024 HHS published voluntary cybersecurity performance goals for the health sector, a menu of recommended practices rather than binding requirements. At the end of 2024 it proposed substantial updates to the HIPAA Security Rule, the federal regulation that sets security expectations for protecting patients’ electronic health information. The proposal was published in January 2025. As of mid-2026 those updates had not been finalized, and HHS’s regulatory agenda had moved the target date to 2027.

Among other things, the proposal would have required multifactor authentication, encryption, a technology asset inventory and network map, and the ability to restore certain systems within 72 hours. Those are exactly the controls small practices struggle to fund and staff. Had it been finalized as proposed, a hospital’s donation would have looked less like a courtesy and more like compliance help.

Two other developments mattered to anyone running a donation program. In January 2021, weeks after the rules took effect, Congress amended the HITECH Act. HHS must now consider whether a covered entity or business associate had “recognized security practices” in place for the prior 12 months when it sets HIPAA penalties and audit outcomes. Recognized practices include the NIST Cybersecurity Framework and the Health Industry Cybersecurity Practices published under the HHS 405(d) program. A donor that built its baseline on those frameworks gave recipients something they could later point to.

The January 2024 performance goals split into “essential” and “enhanced” practices. The essential list read much like a donation menu: email security, multifactor authentication, basic training, strong encryption, mitigation of known vulnerabilities and basic incident planning. In June 2024, the White House announced that Microsoft and Google would offer free or discounted security help to rural hospitals. That help came from vendors rather than from hospitals to practices, yet it rested on the same diagnosis. The smallest providers lacked money and people more than permission.

The donation protections remained available throughout. They did not, by themselves, solve the resource problem at small practices, because a legal permission creates neither budget nor staff. Removing a legal barrier leaves the problem behind it in place. Somebody still has to pay, somebody still has to operate the tools, and somebody still has to keep doing it after the launch announcement fades.

Public evidence on how widely the safe harbor was used remained thin. Donors had no duty to report donations publicly, and no federal dataset tracks them. A policy tool whose use nobody measures is hard to defend in a budget debate, and harder still to improve.

The 2020 rules were necessary and modest. They cleared the path for health systems willing to treat affiliated practices as part of their own security perimeter, and left the economics to them. A board should ask less whether the rule worked in the abstract than whether its own organization used the path the rule opened. The test is whether it brought enough money and people to make that count.

Outside health care the pattern is familiar. Banks rely on small vendors, agencies rely on local contractors, and every one of them is part of someone’s attack surface. Permission to help them is rarely the binding constraint. Sustained funding and someone accountable usually are.