Permission to donate cybersecurity arrived without the money to run it
New fraud-and-abuse protections let hospitals give cybersecurity to physician practices without cost sharing. The rule removed a legal obstacle; whether anything changed depended on donor economics, recipient capacity and who would operate the tools year after year.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On November 20, 2020, the HHS Office of Inspector General and the Centers for Medicare & Medicaid Services released companion final rules. They revised the federal Anti-Kickback Statute safe harbors and the physician self-referral (Stark) law exceptions. Much of the package concerned value-based care arrangements. It also created new protection for donations of cybersecurity technology and related services, for example from a hospital to physician practices that refer patients to it. Unlike the long-standing protections for electronic health record donations, the cybersecurity protections did not require the recipient to share in the cost. Donations could not be conditioned on referrals. The rules were published in early December and took effect in January 2021.
Before these rules, a hospital that wanted to help an affiliated physician practice secure its systems faced a legal question first. Could giving something of value to a referral source be treated as an inducement for referrals? The answer often ended the conversation. The November 2020 rules opened a clear path. How far donors traveled down it depended on economics more than law. We look at three parts: what the rules unlocked, the donor’s economics, and the recipient’s economics.
What the rules unlocked
The new Anti-Kickback Statute safe harbor and the parallel Stark exception covered cybersecurity technology and related services that are necessary and used predominantly to implement, maintain or re-establish cybersecurity. The definition was broad on purpose. Commenters had argued that attackers do not distinguish between software, services and the people who run them, and the agencies largely agreed.
The absence of a cost-sharing requirement mattered most. Electronic health record donations required recipients to pay a share. Small practices, the organizations least able to contribute, would have been the ones priced out. Removing the contribution removed that barrier.
Conditions remained. Donors could not take the volume or value of referrals into account when choosing recipients or sizing donations. Recipients could not demand a donation as a condition of doing business. The arrangement had to be documented. Organizations should check with counsel before structuring a program, because the two regimes differ in detail.
The donor’s economics
For a health system, the case for donating is self-interest. Affiliated practices often connect to the system’s electronic record, exchange referrals and results electronically and share patients. A compromised practice account can become a route into shared systems, or a source of fraudulent messages that look trustworthy because they come from a known partner. The practice is part of the system’s attack surface whether or not the system owns it.
Against that sit costs that never appear on a license quote. Each practice needs onboarding. Tools must be supported in environments the donor does not control, on hardware it did not buy. Help desk calls rise. And the donor becomes the visible provider of security when an incident happens anyway, which carries reputational and possibly contractual exposure. Some donors worried that a donation would be read as accepting responsibility for the practice’s security. Clear written terms manage that concern, but drafting them slows decisions.
A donation program is also a recurring commitment. Security tools and services renew annually. A program launched on one year of capital, or a grant, can end abruptly and leave practices dependent on protection that disappears. Withdrawing a monitored service from a practice that has come to rely on it is arguably worse than never offering it. A credible program sets a funding horizon of several years, names who in the donor manages the relationships, and agrees in writing what happens if a practice leaves the network or the program ends.
The recipient’s economics
For a small practice, a donated tool is valuable only if someone operates it. Endpoint protection, email filtering and multifactor authentication all need configuration, monitoring and responses to alerts. Many practices have no IT staff and rely on a local managed service provider, or on an office manager who handles technology part-time.
That makes services worth more than software. A monitored service, with someone accountable for watching alerts and responding at night, changes a practice’s risk more than licenses it cannot run. The rules allowed services, but services cost the donor more and are harder to scale. That pushes donors toward a narrower offer than the rules permit.
Underneath any donation sits a daily operating discipline that no donor can supply: patching, access reviews when staff leave, backups that are tested, and staff who recognize suspicious requests. A donation can provide tools and some expertise. It cannot provide attention on the days nobody is looking. Programs that ignore this deliver tools that decay. A donor can narrow the gap with simple supports: a shared patch calendar, a quarterly access review template, a named contact for suspicious messages, and an annual restore test the donor witnesses.
Independence matters to recipients as well. Many practices value their separation from large systems. Some are wary of arrangements that give a hospital visibility into their operations, even when the stated purpose is security. Clear limits on what the donor can see and use help adoption.
The design that fits these constraints is narrow and deep. Pick a short list of controls with the largest effect, such as phishing-resistant authentication, managed endpoint detection and tested offline backups. Deliver them as a service with named responsibilities. Verify them periodically. Apply the same baseline to every connected practice through third-party risk management, whether or not it accepts a donation. The donation then becomes a way to meet the standard, not a gift with no expectation attached.
With hindsight
The case for supporting the smaller parts of health care grew stronger after 2020. The February 2024 attack on Change Healthcare, a major claims and payment clearinghouse, disrupted cash flow for practices nationwide and showed how much small providers depend on infrastructure they do not control. In January 2024 HHS published voluntary cybersecurity performance goals for the health sector. At the end of 2024 it proposed substantial updates to the HIPAA Security Rule, which by 2026 had not been finalized.
The donation protections remained available throughout. They did not, by themselves, solve the resource problem at small practices, because a legal permission creates neither budget nor staff. The 2020 rules were necessary and modest. They cleared the path for health systems willing to treat affiliated practices as part of their own security perimeter, and left the economics to them.