The 405(d) Health Industry Cybersecurity Practices (HICP) initiative is a federal public-private partnership led by the U.S. Department of Health & Human Services (HHS) to improve cybersecurity across the healthcare and public health sector.
Commonly referred to as “405(d),” “HHS 405(d),” or “HICP,” the program provides practical, implementation-focused cybersecurity guidance designed specifically for healthcare organizations.
As cybersecurity expectations from regulators, cyber insurers, governing boards, and business partners continue to increase, interest in 405(d) guidance and HICP best practices continues to grow.
The 405(d) Program was established under the Cybersecurity Act of 2015 to advance healthcare cybersecurity through practical, voluntary guidance developed collaboratively between government and industry.
Unlike broad cybersecurity frameworks that can be complex or resource-intensive, 405(d) focuses on:
The program’s primary publication is the Health Industry Cybersecurity Practices (HICP) guidance.
The Health Industry Cybersecurity Practices (HICP) guidance identifies the most significant cybersecurity threats facing healthcare organizations and provides ten prioritized cybersecurity practices with implementation guidance scaled for organizations of different sizes.
HICP helps healthcare organizations strengthen resilience against threats including:
Rather than serving as another regulatory framework, HICP provides practical recommendations that align with widely recognized cybersecurity frameworks such as the NIST Cybersecurity Framework while remaining healthcare-specific and implementation-focused.
Organizations searching for terms like “HICP framework,” “405(d) guidance,” or “healthcare cybersecurity best practices” are typically looking for practical, prioritized recommendations that can be implemented without overengineering their security programs.
Since the publication of HICP, HHS has introduced the Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs) to help organizations prioritize foundational cybersecurity improvements.
The HPH CPGs build upon and align with 405(d) guidance by identifying high-impact cybersecurity practices that organizations can implement to reduce cyber risk and improve operational resilience. Many healthcare organizations use HICP together with the HPH CPGs as complementary resources for strengthening cybersecurity programs.
Healthcare remains one of the most frequently targeted sectors for ransomware and other cyberattacks. At the same time, expectations from regulators, cyber insurers, governing boards, and business partners continue to increase.
Healthcare organizations face:
As a result, many organizations are turning to 405(d) and HICP guidance as a practical, federally developed starting point for strengthening cybersecurity programs.
Search interest in terms such as:
continues to grow as healthcare leaders seek trusted guidance.
No.
405(d) guidance is voluntary and is not a regulatory requirement or formal compliance mandate.
However, it is widely recognized as authoritative federal guidance for healthcare cybersecurity and is increasingly used to support:
While organizations are not required to implement 405(d), aligning with its recommendations can help demonstrate due diligence and adoption of recognized cybersecurity best practices.
The 405(d) Health Industry Cybersecurity Practices guidance is particularly valuable for:
Small and mid-sized healthcare organizations often find HICP especially valuable because it translates cybersecurity concepts into practical, achievable safeguards.
Healthcare organizations commonly implement 405(d) by:
Because HICP focuses on real-world healthcare threats, it bridges the gap between high-level cybersecurity frameworks and day-to-day operational execution.
The official 405(d) Program, Health Industry Cybersecurity Practices (HICP) guidance, and Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs) are published by the U.S. Department of Health & Human Services.
Organizations can access:
This page is provided for informational purposes and is not affiliated with or endorsed by the U.S. Department of Health & Human Services.
Understanding 405(d) guidance is only the first step. Successfully implementing HICP recommendations requires:
We help healthcare organizations operationalize 405(d), HICP, and related cybersecurity best practices in ways that strengthen resilience while supporting organizational objectives.
If your organization is evaluating 405(d) guidance or seeking to align with Health Industry Cybersecurity Practices, we can help you:
