iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Healthcare cybersecurity means protecting health information and the systems that support care and public health from unauthorized access, alteration, disruption, and loss. The priority is not just keeping data confidential: systems must also remain trustworthy and available when people need them. For organizations subject to HIPAA, the Security Rule requires appropriate administrative, physical, and technical safeguards for electronic protected health information (ePHI). HHS also publishes voluntary sector-specific goals to help healthcare and public health organizations prioritize security work.
What is healthcare and public health cybersecurity?
It is the set of safeguards and operating practices used to protect health information and the technology that stores, processes, or transmits it. In healthcare, an incident can expose ePHI, undermine the integrity of records, or make systems unavailable. Disruption can affect care delivery as well as privacy, which is why HHS Cyber Gateway frames the issue as “Cyber Safety is Patient Safety!”
Public health organizations also depend on reliable information systems and data. Their inclusion in HHS sector guidance does not by itself make every public health organization a HIPAA covered entity.
Recommended Free Tools
Who must follow the HIPAA Security Rule?
The HIPAA Security Rule applies to covered entities and business associates handling ePHI. It is in 45 CFR Part 160 and Subparts A and C of Part 164. The Rule requires appropriate safeguards in three areas:
#1 Best Overall
- Administrative safeguards: policies and management processes for protecting ePHI.
- Physical safeguards: protections for facilities and equipment that hold or access ePHI.
- Technical safeguards: protections used by information systems to control access to ePHI and help maintain its confidentiality, integrity, and availability.
Whether a particular organization has HIPAA duties depends on its role and the information it handles. HHS’s Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals are separate: they are voluntary prioritization guidance for organizations in the sector, not binding HIPAA requirements.
Why is cybersecurity an operational and patient-safety concern?
A cyber incident can affect more than data privacy. If systems used for care or public health operations are disrupted, staff may lose access to information or workflows they rely on. Security planning therefore needs to consider both the information at risk and the operational importance of the systems that handle it.
HHS’s Office for Civil Rights (OCR) reported, in the context of its HIPAA Security Rule proposal, that reports of large breaches increased 102 percent from 2018 through 2023, while the number of individuals affected increased 1,002 percent over the same period. OCR also reported that large breaches affected more than 167 million individuals in 2023, a record at the time of the agency’s report. These are HHS/OCR figures for the stated period, not a forecast of future incidents.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat cybersecurity steps should a healthcare organization take first?
OCR’s recommendations in its Comstar ransomware settlement announcement offer a practical starting checklist. They are recommendations described in enforcement material, not a complete substitute for assessing the organization’s obligations under the Security Rule.
- Map ePHI. Identify where ePHI is stored, how it enters and moves through systems, and where it leaves. Include relevant systems and workflows in the inventory.
- Analyze and manage risk. Make risk analysis and risk management part of routine business processes. Use the results to prioritize protections based on the information involved, system exposure, and operational criticality.
- Review system activity. Maintain audit controls and review activity so the organization can identify and investigate potentially inappropriate access or other security events.
- Authenticate users. Use authentication mechanisms to help ensure access is limited to authorized people. Consider coverage across the workforce and systems, along with compatibility with the organization’s identity environment.
- Encrypt ePHI when appropriate. Assess encryption for ePHI at rest and in transit in light of the systems and risks involved.
- Train staff for their roles. Provide regular training suited to what each role needs to do to protect information and respond to security concerns.
- Learn from incidents. Incorporate lessons from incidents into ongoing security management rather than treating response as a one-time task.
How can hospitals reduce ransomware risk and improve resilience?
There is no single product or control that prevents every ransomware incident. Use the checklist above as a connected program: understand the ePHI environment, manage risks, restrict access through authentication, monitor activity, and train staff. The organization should also plan how it will detect, respond to, and recover from incidents, then use what it learns to improve its safeguards.
Prioritization should reflect the consequences of losing access to a system, not only whether it contains ePHI. A system central to care or public health operations may warrant attention because of its operational criticality as well as its data. Avoid assuming that a control is effective simply because it has been purchased or installed; assess whether it covers the relevant people, systems, and workflows.
HHS’s voluntary sector goals can help organize this work: essential goals establish foundational practices, while enhanced goals encourage more advanced practices. An organization can use the distinction to identify foundational gaps first and then evaluate whether its risk and maturity call for enhanced practices.
Does HIPAA require encryption or multi-factor authentication?
OCR recommends encrypting ePHI when appropriate and using authentication mechanisms to limit access to authorized users. The sources cited here do not establish a universal requirement for a particular encryption implementation, multi-factor method, or physical security key. Organizations should assess safeguards in the context of their systems, risks, and applicable Security Rule duties; buying a security key alone does not satisfy those duties.
Best Value
What is the status of the proposed HIPAA Security Rule update?
HHS OCR issued a proposed Security Rule update on December 27, 2024. The cited proposal page describes proposed provisions, not proof that those provisions became final obligations. Check current HHS and Federal Register materials for the rule’s present status and any effective dates before relying on a proposed change as a legal requirement.
OCR’s audit program page says the agency selected 50 covered entities and business associates for 2024–2025 HIPAA audits focused on Security Rule provisions relevant to hacking and ransomware. That is a description of the selected audits, not a finding that every selected organization—or every organization in the sector—failed to comply.
What do recent HHS enforcement examples show?
OCR’s Change Healthcare incident FAQ, updated March 14, 2025, says the agency prioritized and opened investigations of Change Healthcare and UnitedHealth Group. The investigations focused on whether a PHI breach occurred and whether HIPAA requirements were met; that announcement should not be read as a final finding about compliance.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →In a separate announcement dated June 18, 2026, OCR described a settlement of a ransomware investigation involving an employer-sponsored health plan. OCR Director Paula M. Stannard said, “Effective cybersecurity starts with Security Rule compliance, ensuring that Security Rule provisions are implemented before a cyberattack occurs.” The settlement is a dated enforcement example, not evidence that all health plans share the same deficiencies.
How should an organization prioritize its next investment?
Start by identifying the organization’s regulatory scope, then assess risks and operational needs before selecting a control or service. A healthcare cybersecurity risk assessment, incident-response preparation, managed security services, or HIPAA risk-analysis education may be useful depending on the organization’s gaps. These are optional service categories, not HHS requirements; official HHS guidance and resources are also available without buying a commercial service.
Quick Recap
- Regulatory scope: determine whether the organization is a covered entity, business associate, or another type of public health organization, and which HIPAA duties apply.
- Risk and criticality: prioritize systems and workflows according to ePHI exposure and the consequences of disruption.
- Foundational maturity: use HHS’s voluntary essential goals to identify baseline practices, then assess whether enhanced goals are appropriate.
- Identity and access: evaluate the authentication methods in use, their coverage, and their fit with existing systems rather than assuming a particular device is required.
- Resilience: assess the organization’s ability to detect, respond, recover, and incorporate incident lessons. Set recovery expectations based on the organization’s actual needs and evidence.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
