At a glance
What this entry covers
Health Industry Cybersecurity Practices (HICP) is a voluntary publication from the HHS 405(d) program, created under Section 405(d) of the Cybersecurity Act of 2015 with industry partners, describing top threats to health care organizations and practices to address them. HHS now publishes HICP and the voluntary Healthcare and Public Health (HPH) Cybersecurity Performance Goals on the HHS Cyber Gateway; the former 405d.hhs.gov address redirects there.
MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid; it is not legal advice and is not a substitute for the official text.
Official documentation
- Primary official source: https://hhscyber.hhs.gov/
- HICP 2023 Edition main document (PDF): https://hhscyber.hhs.gov/Documents/HICP/HICP-Main-508.pdf
- HPH Cybersecurity Performance Goals: https://hhscyber.hhs.gov/cybersecurity-performance-goals.html
How to use this index entry
- Open the official link above (or the agency home if the deep link drifts).
- Confirm edition / revision date against your program scope.
- Map applicability by sector and jurisdiction listed in the metadata.
- Follow related frameworks only after checking their own official sources.
Disclaimers
- MyRHC does not host proprietary standards text (ISO, some industry bodies).
- Where standards are paywalled, we link to the publisher’s catalog page.
- Always verify current requirements with counsel and the issuing authority.
Index only — not legal advice.
MyRHC does not certify compliance. Confirm current requirements with the issuing authority and qualified counsel. Proprietary standards text remains with its publisher.