HHS could mandate hospital cybersecurity on its own; paying for it needed Congress

The week

On December 6, 2023, the Department of Health and Human Services released a concept paper setting out its cybersecurity strategy for the healthcare sector. It described four areas of action: publishing voluntary, healthcare-specific cybersecurity performance goals; providing resources and incentives to help organizations implement them, partly dependent on new authority and funding from Congress; strengthening accountability, including by proposing new enforceable cybersecurity standards through Medicare and Medicaid programs and updating the HIPAA Security Rule; and expanding the department’s role as a coordinating point for sector cybersecurity through the Administration for Strategic Preparedness and Response. The paper followed the 2023 National Cybersecurity Strategy, which had called for minimum cybersecurity requirements in critical sectors.

Concept papers create no obligations, and many hospital executives read this one as a statement of intent. It was more specific than that. It named a baseline of controls, named the regulatory levers that could make the baseline binding, and proposed incentives to help hospitals pay for it. Those three elements had very different paths to reality. The first two were within HHS’s own power. The third depended on Congress. We take them in that order, because together they describe what was coming and who would pay: what the baseline would contain, which levers could make it mandatory, and how funding would, or would not, follow.

What the baseline would contain

The paper promised voluntary, healthcare-specific cybersecurity performance goals, split into essential and enhanced tiers and building on CISA’s cross-sector goals. That lineage made the content predictable. The essential tier would emphasize a short list of practices associated with preventing or containing ransomware: multi-factor authentication, email security, timely patching of known exploited vulnerabilities, unique credentials and separate privileged accounts, revoking access for departing staff, basic training, incident response planning, and attention to vendor risk.

A short list was useful precisely because it was short. Many hospitals, especially small and rural ones, could not implement every control in a mature framework, and their boards had no simple way to ask whether the basics were in place. A health system could map itself against the likely essentials within weeks: for each practice, whether it was in place, where it was partial, the gap’s cost and its owner. That map would serve whatever form the requirements eventually took. It also gave hospitals evidence for a separate legal benefit. Since a 2021 amendment to the HITECH Act, HHS must consider recognized security practices in place for the prior 12 months when it sets HIPAA penalties, so documented adoption had value before anything became mandatory.

Which levers could make it mandatory

The paper named two routes, and neither needed new legislation. The first was the HIPAA Security Rule, which applies to covered entities and their business associates. It had been written to be flexible and technology-neutral, with many implementation specifications labeled addressable, which let organizations document why they had chosen an alternative. HHS said it would propose an update. A rewrite could turn named controls into explicit requirements for every covered entity and business associate, including small practices and vendors.

The second route was Medicare and Medicaid. HHS said it would propose cybersecurity requirements for hospitals through CMS, which most naturally means the conditions of participation that hospitals must meet to be paid. That lever reaches almost every hospital, is checked through surveys rather than complaint-driven investigations, and carries a consequence, loss of Medicare participation, far beyond a HIPAA penalty. It would place cybersecurity in the same compliance category as infection control and emergency preparedness, with survey readiness, documentation and plans of correction.

The two routes would differ in scope, timing and enforcement. A compliance officer could prepare for both at once by building the evidence each would demand: dated policies, configuration records showing controls in force, test results for backups and incident plans, and a named owner for each control. Counsel should track both, because comment periods are when a hospital can influence what is feasible.

How funding would follow

The paper acknowledged that many hospitals lacked the resources to meet even the essential goals. It proposed two incentive programs. One would provide upfront investment to help high-need hospitals, such as small and rural ones, implement the essential practices. The other would be a program to encourage all hospitals to adopt the enhanced practices, with financial consequences for those that did not. Both depended on new authority and appropriations from Congress.

That was the asymmetry at the center of the paper. Requirements could arrive through rulemaking on HHS’s timetable. Money could arrive only through legislation, on Congress’s. A hospital that planned on federal help arriving before obligations was making a bet the paper itself did not support.

The asymmetry fell hardest on the hospitals least able to absorb it. A large system can fund a security team from operating margin. A critical access hospital with a handful of IT staff and thin or negative margins cannot. A mandatory baseline without money would push it toward outsourcing, affiliation with a larger system, or a slower path to compliance negotiated with regulators. Boards of small hospitals needed to see that choice early.

The practical response ran in three steps. Fund the essential practices that are cheap relative to their effect first, such as multi-factor authentication for remote access and email, and patching known exploited vulnerabilities. Look for shared services, such as a regional security operations center run by a hospital association or a larger partner, to spread costs that a single critical access hospital cannot carry. And frame the budget request around the cost of extended downtime, which for most hospitals dwarfs the cost of the controls, so that cybersecurity competes with clinical investments on comparable terms.

With hindsight

HHS published its healthcare and public health cybersecurity performance goals in January 2024, with ten essential and ten enhanced goals that closely matched the practices above. The Change Healthcare attack in February 2024 intensified the debate. At the end of 2024, HHS proposed a substantial rewrite of the HIPAA Security Rule. It would remove the distinction between required and addressable specifications and mandate controls including multi-factor authentication, encryption, asset inventories and tested recovery, as a later article in this series discusses. Many hospital groups opposed it over cost, and as we write organizations should check its status with counsel. CMS had not proposed cybersecurity conditions of participation by the end of 2025. The asymmetry held: no dedicated incentive program of the kind the paper described was enacted. The Rural Health Transformation Program created in 2025 lists cybersecurity among permitted uses of state grants, but it is a broader program, administered by states and time-limited.