HHS 405(d) / HICP Healthcare Cybersecurity Assessment
Healthcare cybersecurity assessment with a care-focused improvement roadmap
Give hospital leadership and practice administrators a practical security baseline beyond a regulatory checklist. ICA's scoped HICP alignment review connects practice gaps with care-delivery needs and a prioritized improvement roadmap.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Set security priorities around care delivery
Your security investments need to reflect how care is delivered. A hospital CIO may need to explain competing priorities to leadership. A practice administrator may need a clearer baseline for decisions about access and staff responsibilities.
This assessment reviews alignment with Health Industry Cybersecurity Practices (HICP), associated with HHS 405(d). It supports decisions about where to focus improvement efforts. Care delivery and patient safety provide context for those decisions, alongside the organization's systems and available resources.
Choose the care settings and practices to review
HICP offers voluntary cybersecurity practices with guidance tailored to small organizations and to medium and large organizations. The assessment scope should match your care settings and organizational size.
Agreed coverage may consider email and endpoint protection, access management, data protection, asset and network management, vulnerability management, security operations and incident response, connected medical-device practices, and cybersecurity governance. Select relevant practice coverage during scoping rather than assume every area receives the same review depth.
Identify the clinical systems and supporting services within the boundary. Device-related coverage concerns practices and oversight; hands-on device testing requires a separate, safety-conscious scope.
Compare documented practices with operational evidence
The proposed review combines stakeholder interviews with relevant documents and evidence. IT and security owners explain current practices. Clinical and operational participants help clarify how security decisions affect access to systems and continuity of care.
Evidence may include asset inventories, access procedures, policy documents, existing vulnerability-management reports, and incident-response responsibilities. Review selected records against the agreed HICP practice coverage.
Document missing evidence and unresolved questions so readers can distinguish supported findings from areas needing further review. This approach does not assume privileged platform access or include vulnerability scanning, penetration testing, or workforce simulations.
Use three outputs to plan healthcare security improvements
The catalog's typical outputs connect practice alignment to leadership decisions. Their content and level of detail are agreed in the engagement scope.
Practice gap assessment. Records gaps against the selected healthcare cybersecurity practices. Use it to see where evidence supports alignment and where coverage or practice needs attention.
Healthcare-focused findings. Explain observations in the context of care settings and operational needs. Leadership can use them to discuss the significance of a gap with clinical and technology owners.
Prioritized roadmap. Sequences recommended improvements for planning. Use it to discuss dependencies and direct resources toward the practices that warrant attention first.
The roadmap recommends work; your organization decides how to fund, assign, and implement it.
Prepare the people and evidence that shape scope
Start with the decision the assessment needs to support. Define the care settings, organization size, systems, and HICP practice areas for review. Evidence depth and stakeholder participation also affect effort, cost, and timing.
Identify people who understand clinical workflows as well as technical safeguards. Gather existing inventories and policies, prior assessment findings, and records relevant to the selected practices.
Agree evidence access and appropriate handling arrangements before sharing sensitive material. Use limited or redacted records where suitable. Review activities should respect clinical schedules and avoid disruption to care.
Keep best-practice alignment separate from assurance
This is a scoped best-practice alignment assessment. It does not provide standalone HICP certification or guarantee compliance. HHS describes HICP as recommended practices to consider and tailor to an organization's risks.
A healthcare practice-gap review is not a substitute for a HIPAA security risk analysis. That analysis addresses risks to all electronic protected health information the organization creates, receives, maintains, or transmits. If that is your primary need, discuss the HIPAA Security Risk Assessment & Risk Management Plan as a separate offering.
Remediation execution and managed operations require separate agreement. Any active testing of clinical systems or connected devices needs explicit authorization and safety boundaries.
Healthcare cybersecurity assessment FAQs
Who is this assessment intended for?
Healthcare CIOs, CISOs, hospital leaders, and practice administrators who need a practical security baseline. It is particularly relevant when leadership wants to connect security priorities with care delivery rather than rely on a regulatory checklist alone.
Will the assessment cover every HICP practice?
Coverage is tailored. Agree the practice areas and review depth for your care settings, organization size, and systems. The scope should make exclusions clear so a review of selected practices is not mistaken for complete coverage across the organization.
What evidence supports the findings?
The proposed method uses interviews and relevant artifacts, including selected inventories, procedures, and operational records. Findings should identify their evidence basis and any gaps. Scanning or testing is a different activity and needs separate scope rather than being inferred from an evidence review.
What determines the cost and timing?
Care settings, organization size, system complexity, practice coverage, and evidence depth shape the engagement. Stakeholder availability and evidence access also matter. ICA needs to confirm scope and delivery resources before cost and timing can be established.
How does this differ from a HIPAA risk analysis?
This assessment focuses on alignment with healthcare cybersecurity practices and an improvement roadmap. A HIPAA security risk analysis evaluates risks to the organization's electronic protected health information. The two can inform related decisions, but this scoped HICP review does not replace that analysis.
Does the roadmap include implementing the recommendations?
The typical deliverables are a practice gap assessment, healthcare-focused findings, and a prioritized roadmap. They support planning rather than implement changes. Remediation, technical validation, or ongoing operational support would need a separate agreement with clearly defined responsibilities.
Build a healthcare security roadmap your teams can use
Discuss a scoped HICP alignment assessment that reflects your care environment. Establish the practice coverage and evidence needed to give leadership a clearer basis for prioritizing healthcare security improvements.
Set security priorities around care delivery
Your security investments need to reflect how care is delivered. A hospital CIO may need to explain competing priorities to leadership. A practice administrator may need a clearer baseline for decisions about access and staff responsibilities.
This assessment reviews alignment with Health Industry Cybersecurity Practices (HICP), associated with HHS 405(d). It supports decisions about where to focus improvement efforts. Care delivery and patient safety provide context for those decisions, alongside the organization's systems and available resources.
Choose the care settings and practices to review
HICP offers voluntary cybersecurity practices with guidance tailored to small organizations and to medium and large organizations. The assessment scope should match your care settings and organizational size.
Agreed coverage may consider email and endpoint protection, access management, data protection, asset and network management, vulnerability management, security operations and incident response, connected medical-device practices, and cybersecurity governance. Select relevant practice coverage during scoping rather than assume every area receives the same review depth.
Identify the clinical systems and supporting services within the boundary. Device-related coverage concerns practices and oversight; hands-on device testing requires a separate, safety-conscious scope.
Compare documented practices with operational evidence
The proposed review combines stakeholder interviews with relevant documents and evidence. IT and security owners explain current practices. Clinical and operational participants help clarify how security decisions affect access to systems and continuity of care.
Evidence may include asset inventories, access procedures, policy documents, existing vulnerability-management reports, and incident-response responsibilities. Review selected records against the agreed HICP practice coverage.
Document missing evidence and unresolved questions so readers can distinguish supported findings from areas needing further review. This approach does not assume privileged platform access or include vulnerability scanning, penetration testing, or workforce simulations.
Use three outputs to plan healthcare security improvements
The catalog's typical outputs connect practice alignment to leadership decisions. Their content and level of detail are agreed in the engagement scope.
Practice gap assessment. Records gaps against the selected healthcare cybersecurity practices. Use it to see where evidence supports alignment and where coverage or practice needs attention.
Healthcare-focused findings. Explain observations in the context of care settings and operational needs. Leadership can use them to discuss the significance of a gap with clinical and technology owners.
Prioritized roadmap. Sequences recommended improvements for planning. Use it to discuss dependencies and direct resources toward the practices that warrant attention first.
The roadmap recommends work; your organization decides how to fund, assign, and implement it.
Prepare the people and evidence that shape scope
Start with the decision the assessment needs to support. Define the care settings, organization size, systems, and HICP practice areas for review. Evidence depth and stakeholder participation also affect effort, cost, and timing.
Identify people who understand clinical workflows as well as technical safeguards. Gather existing inventories and policies, prior assessment findings, and records relevant to the selected practices.
Agree evidence access and appropriate handling arrangements before sharing sensitive material. Use limited or redacted records where suitable. Review activities should respect clinical schedules and avoid disruption to care.
Keep best-practice alignment separate from assurance
This is a scoped best-practice alignment assessment. It does not provide standalone HICP certification or guarantee compliance. HHS describes HICP as recommended practices to consider and tailor to an organization's risks.
A healthcare practice-gap review is not a substitute for a HIPAA security risk analysis. That analysis addresses risks to all electronic protected health information the organization creates, receives, maintains, or transmits. If that is your primary need, discuss the HIPAA Security Risk Assessment & Risk Management Plan as a separate offering.
Remediation execution and managed operations require separate agreement. Any active testing of clinical systems or connected devices needs explicit authorization and safety boundaries.
Healthcare cybersecurity assessment FAQs
Who is this assessment intended for?
Healthcare CIOs, CISOs, hospital leaders, and practice administrators who need a practical security baseline. It is particularly relevant when leadership wants to connect security priorities with care delivery rather than rely on a regulatory checklist alone.
Will the assessment cover every HICP practice?
Coverage is tailored. Agree the practice areas and review depth for your care settings, organization size, and systems. The scope should make exclusions clear so a review of selected practices is not mistaken for complete coverage across the organization.
What evidence supports the findings?
The proposed method uses interviews and relevant artifacts, including selected inventories, procedures, and operational records. Findings should identify their evidence basis and any gaps. Scanning or testing is a different activity and needs separate scope rather than being inferred from an evidence review.
What determines the cost and timing?
Care settings, organization size, system complexity, practice coverage, and evidence depth shape the engagement. Stakeholder availability and evidence access also matter. ICA needs to confirm scope and delivery resources before cost and timing can be established.
How does this differ from a HIPAA risk analysis?
This assessment focuses on alignment with healthcare cybersecurity practices and an improvement roadmap. A HIPAA security risk analysis evaluates risks to the organization's electronic protected health information. The two can inform related decisions, but this scoped HICP review does not replace that analysis.
Does the roadmap include implementing the recommendations?
The typical deliverables are a practice gap assessment, healthcare-focused findings, and a prioritized roadmap. They support planning rather than implement changes. Remediation, technical validation, or ongoing operational support would need a separate agreement with clearly defined responsibilities.
Build a healthcare security roadmap your teams can use
Discuss a scoped HICP alignment assessment that reflects your care environment. Establish the practice coverage and evidence needed to give leadership a clearer basis for prioritizing healthcare security improvements.