HHS Releases Cybersecurity Guide

The US Department of Health and Human Services recently updated its guide to help the private and public healthcare sectors develop cybersecurity protocols that address NIST's Framework for Improving Critical Infrastructure Cybersecurity. The guide is a toolkit, with information and resources intended to help companies implement cybersecurity programs in the health care space. While the aim of this guidance is to help companies implement NIST's protocols for protecting US critical infrastructure, the recommendations contained in the guide mirror other agencies' security recommendations (for example those we have written about from the Department of Labor and the FDA).

Included in the guide are recommendations on implementing NIST's seven-step cybersecurity framework (prioritize – orient – create a current profile – risk assessment – target profile – gap identification – action plan). Within the guide are items specific to health care providers, including conduct an