HHS 405(d) HICP Explained: Recognized Security Practices

What Is the HHS 405(d) HICP and Why Was It Created?

The HHS 405(d) Program originated from Section 405(d) of the Cybersecurity Information Sharing Act (CISA) of 2015, which tasked HHS with establishing a public-private task force to improve cybersecurity in the healthcare industry. The result was the Health Industry Cybersecurity Practices (HICP), first published in 2018 and updated periodically, most notably in 2022.

The HICP addresses a critical gap: while the HIPAA Security Rule mandates that covered entities and business associates implement safeguards for ePHI and conduct a security risk analysis (45 CFR § 164.308(a)(1)(ii)(A)), it does not specify exactly which technical controls or operational processes to deploy. The HICP fills that gap by providing specific, prioritized cybersecurity practices derived from real-world breach data and input from the sector.

The HICP is not a regulation itself, but it is officially recognized by HHS as a set of “recognized security practices” under the HITECH Act. This designation is critical: if an organization experiences a HIPAA breach and can demonstrate that it was following the HICP’s practices, OCR must consider that as a mitigating factor during the penalty determination process (42 U.S.C. § 17934).

Who Should Follow the HHS 405(d) HICP?

The HICP is designed for the entire healthcare ecosystem. While the primary audience includes covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates, the practices are also highly relevant for medical device manufacturers, health information exchanges (HIEs), and any subcontractor handling ePHI.

For US-based organizations, the HICP is especially important because it directly supports compliance with the HIPAA Security Rule’s implementation specifications. For Canadian organizations handling ePHI of US patients (for example, a Canadian hospital treating US medical tourists or a Canadian software provider serving US healthcare clients), the HICP offers a practical bridge between the HIPAA Security Rule and the organization’s domestic privacy obligations under PIPEDA or Ontario’s PHIPA.

How Is the HICP Structured? (HICP 2022 Main Practices)

The HICP is organized into two core volumes plus supporting materials. The primary volume is “Main Practices – Cybersecurity Practices for the Healthcare Industry,” which groups actions into five threat-based areas. Each practice area includes a set of specific, measurable implementation steps.

Threat 1: Email Phishing Attacks

Phishing remains the top vector for healthcare breaches. The HICP recommends specific technical controls and training programs designed to reduce the risk of credential compromise and unauthorized ePHI access.

Threat 2: Ransomware Attacks

Ransomware is the most financially devastating threat for healthcare organizations. The HICP provides detailed guidance on maintaining offline backups, implementing network segmentation, and deploying security monitoring to detect ransomware early. These practices directly support the HIPAA Security Rule’s requirement for data backup and disaster recovery at 45 CFR § 164.308(a)(7).

Threat 3: Data Breaches and Unauthorized Access

This section addresses insider threats, misconfigured systems, and external intrusions that lead to unauthorized ePHI disclosure. The HICP recommends implementing a robust incident response plan, access controls, and continuous monitoring to meet HIPAA’s information access management requirements (45 CFR § 164.312(a)).

Threat 4: Medical Device Security

Connected medical devices—from infusion pumps to imaging systems—represent a growing attack surface. The HICP provides guidance aligned with the FDA’s 524B provisions under the Federal Food, Drug, and Cosmetic Act, which requires device manufacturers to demonstrate they have a coordinated vulnerability disclosure (CVD) program and appropriate security controls. For US-based hospitals and health systems, this section is critical for ensuring that both legacy and new devices are properly inventoried and secured.

Threat 5: Network Protection

This section covers perimeter and internal network security, including firewall management, vulnerability scanning, and security log monitoring. It aligns closely with the administrative safeguards of the HIPAA Security Rule (45 CFR § 164.308(a)(1)) and the physical safeguards (45 CFR § 164.310). The HICP recommends a layered approach to network defense, including using a SIEM tool for centralized log management and threat detection—a capability directly supported by ThreatHawk SIEM.

HICP and the HIPAA Security Rule: Mapping the Controls

The HICP is explicitly designed to map to the HIPAA Security Rule’s administrative, physical, and technical safeguards. The table below illustrates how specific HICP practices correspond to required HIPAA implementation specifications.

How Does the HICP Relate to Other Frameworks?

For organizations managing multiple compliance obligations, the HICP integrates well with other major frameworks. The table below highlights key comparisons between the HICP and the NIST Cybersecurity Framework (CSF) 2.0, NIST SP 800-53, and HITRUST CSF.

While the HICP is healthcare-focused, it is effectively a subset of the NIST CSF 2.0 tailored for healthcare. For organizations pursuing comprehensive compliance, the HICP provides a strong sector-specific starting point, while broader frameworks like NIST CSF or HITRUST offer more granularity and maturity models.

How to Implement the HHS 405(d) HICP: A Practical Guide

Adopting the HICP does not require a complete overhaul of your existing security program. The practices are designed to be implemented incrementally, starting with the highest-impact threats. The most common approach for HIPAA compliance is to use the HICP as a “control library” to populate your security risk analysis and remediation plan.

HICP and OCR Investigations: How “Recognized Security Practices” Help

One of the most powerful reasons to adopt the HICP is the potential for penalty mitigation. Under the HITECH Act, as amended by 42 U.S.C. § 17934, OCR is required to consider whether an organization had implemented “recognized security practices” (including the HICP) when determining the penalty amount for a violation. This means that if you can demonstrate your organization was following the HICP at the time of a breach, OCR must weigh that as a mitigating factor during the penalty calculation.

For example, if a phishing incident bypasses your MFA controls but you can show that you had implemented DMARC, conducted quarterly phishing simulations, and had a documented incident response plan consistent with HICP Threat 1 and Threat 3, OCR would be obligated to reduce the penalty accordingly. Not all organizations will need an external assessment for this; many can self-attest if they have robust documentation. However, working with an experienced compliance partner like CyberSilo can help you build defensible documentation faster.

HICP and Canadian Healthcare Organizations

For Canadian healthcare organizations that handle US patient ePHI—whether as a covered entity (e.g., a Canadian hospital providing services to US patients) or as a business associate (e.g., a Canadian software provider hosting US health data)—the HICP applies just as much as it does to a US-based provider. The HIPAA Security Rule and HITECH Act have extraterritorial reach, meaning any organization creating, receiving, maintaining, or transmitting ePHI is subject to HIPAA enforcement if that data belongs to a US citizen.

For Canadian organizations that do not handle US ePHI but want to adopt a robust, sector-specific cybersecurity framework, the HICP can also serve as an excellent supplement to domestic compliance. It maps well to PIPEDA’s 10 fair information principles, particularly Principle 7 (Safeguards), and aligns with many of the technical security measures recommended by the Canadian Centre for Cyber Security (CCCS) under its ITSG-33 guidelines. However, for Canadian organizations, the primary compliance driver remains PIPEDA (and provincial laws like Ontario’s PHIPA or Quebec’s Law 25), so the HICP should be treated as an overlay rather than a replacement for domestic obligations.

Common Misconceptions About HHS 405(d) HICP

“The HICP Is Mandatory.”

False. The HICP is voluntary. However, adopting it can significantly reduce your risk profile and provide penalty mitigation under the HITECH Act. Many privacy officers also find it practically mandatory because OCR has signaled that it expects organizations to follow these recognized practices during audits.

“I Already Have the HIPAA Security Rule; I Don’t Need the HICP.”

Inaccurate. The HIPAA Security Rule tells you what to do; the HICP tells you how to do it. The Security Rule requires that you “protect against reasonably anticipated threats” (45 CFR § 164.306(a)(2)). The HICP provides the current standard of care for that anticipation. Without the HICP, your risk analysis may be missing the specific threats that are plaguing the industry today.

“The HICP Only Applies to Large Hospitals.”

Incorrect. The HICP includes separate guidance for small/medium-sized healthcare organizations (those with fewer than 15 employees). It provides a tiered approach that allows organizations to start with the highest-priority, lowest-cost controls and scale up as resources allow.

“Once I Implement the HICP, I’m Done.”

Inaccurate. Like all cybersecurity frameworks, the HICP requires continuous improvement. The threat landscape changes, and HHS expects organizations to update their practices as the HICP itself is periodically revised. Annual reviews and ongoing monitoring—including SIEM-based threat detection—are essential.

How CyberSilo Supports HHS 405(d) HICP Adoption

CyberSilo’s Compliance Standards Automation solution is purpose-built to help regulated organizations—especially those in healthcare—map their security controls to multiple frameworks simultaneously. For a client adopting the HICP, the automation platform can:

• Map your existing controls to each of the 15 HICP practices and the corresponding HIPAA Security Rule implementation specifications.
• Identify control gaps by comparing your current state against the HICP’s technical, physical, and administrative requirements.
• Generate evidence artifacts for OCR investigations, including control maturity scores, risk findings, and remediation timelines.
• Integrate with ThreatHawk SIEM to continuously monitor for threats—including phishing, ransomware, and network intrusions—as part of a unified compliance and security operations platform.

For organizations requiring real-time monitoring of their healthcare IT and medical device environments, ThreatHawk SIEM provides the centralized log management and threat detection that supports HICP Threat 5 (Network Protection) and the HIPAA requirement for information system activity review.