HHS 405(d) HICP: The Recognised Security Practices Explained

What HICP provides

Prioritised practices across common healthcare attack themes (email, ransomware readiness, identity, etc.) with volume-based sizing. Align practices to your asset and threat profile.

How programmes use it

• Gap heatmaps against current controls
• Board-friendly roadmaps
• Evidence links in GRC for each adopted practice

Relationship to HIPAA

Security Rule compliance remains mandatory for covered entities/BAs. HICP helps show industry-recognised approaches inside that risk-based framework.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is HICP mandatory?

It is voluntary guidance; HIPAA Security Rule obligations still apply.

Does adopting HICP stop OCR penalties?

It may support recognised-practices discussions where statutes allow consideration — not a free pass.

Where should evidence live?

In the same control library as HIPAA safeguards.

Related Resources

• HIPAA hub
• HITECH explained