Skip to main content
U.S. flag
An official website of the United States government

Health Industry Cybersecurity Practices

Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP 2023 Edition) outlines the top threats facing the HPH Sector. Developed with every stakeholder in mind, organizations from small to large can benefit from the resources and best practices provided in the main document and the additional two technical volumes. HICP aims to provide organizations with recommendations and best practices to prepare and fight against cybersecurity threats that can impact patient safety.

Do you want to start implementing HICP today in your organization? Begin your cyber resilience journey with our interactive “How-to” map and get started today!

Start your

journey here ==>

Have you heard about the top 5 threats facing the HPH sector?

Social Engineering

Social Engineering is an attempt to trick you into giving out personal information or infecting your device by clicking on a link to give hackers access to patient data. A common avenue for hackers is email phishing.

Real-World Scenario:
Your employees receive a fraudulent email from a cyber-attacker disguised as an IT support person from your patient billing company. The email instructs your employees to click on a link to change their billing software passwords. An employee who clicks the link is directed to a fake login page, which collects that employee's login credentials and transmits this information to the attackers. The attacker then uses the employee's login credentials to access your organization's financial and patient data.

Download the transcript to the video above

HICP's 10 Mitigating Practices

Email Protection Systems

The two most common phishing methods occur by email access: 1) Credential theft is where attackers leverage emails to conduct credential harvesting attacks on the organization. 2) Malware dropper attacks are used when attackers deliver malware through emails, which can compromise endpoints. An organization’s cybersecurity practices must address these two attack vectors. Because both attack types leverage email, email systems should be the focus for additional security controls.