Prove Your Cybersecurity Is Reasonable, Using a Framework Built by Healthcare, for Healthcare
If you lead security, compliance, or IT risk at a healthcare organization, you have probably heard of HICP. Few organizations have actually turned it into something they can point to. The Health Industry Cybersecurity Practices were developed under Section 405(d) of the Cybersecurity Act of 2015 by healthcare organizations, for healthcare organizations, first published in 2018 and sized explicitly to small, medium, and large healthcare entities. That sizing is the point generic frameworks miss: a ten-person physician practice and a thousand-bed health system don’t face the same expectations under HICP, but they do under most other frameworks.
The gap isn’t awareness, it’s evidence. HICP is one of only two frameworks the HITECH Act names by statute as a “recognized security practice,” alongside the NIST Cybersecurity Framework, which means OCR must consider it when weighing fines, audit length, and corrective remedies after a breach. In our experience, most organizations that could benefit from this have never assessed themselves against HICP formally enough to invoke it. The guidance sits in a PDF. Nobody owns turning it into a posture you can actually demonstrate.
A HICP 405(d) Assessment closes that gap: practices sized to your organization, measured formally enough to function as evidence, not just background reading.
Meditology runs the HICP 405(d) Assessment through the framework’s own structure and integrates it with our broader Security Risk Assessment (SRA) methodology for cross-framework correlation.
HICP is built around the Health Industry Cybersecurity Practices publication set, which sizes recommended practices to the organization: small, medium, and large healthcare entities. We scope the assessment to your size band so the practices we measure against are the ones HICP intends for an organization like yours, not a one-size-fits-all checklist.
The engagement moves through clear phases:
We confirm your HICP entity size (small, medium, or large), the in-scope environments, and the regulatory drivers behind the assessment, including HIPAA Security Rule obligations and any active or anticipated OCR interest.
We evaluate your environment against the HICP recommended practices for your size band, covering the threat categories HICP defines for the sector, such as email-based threats, ransomware, insider and accidental data loss, attacks against connected medical devices, and attacks against network-connected systems.
Using our SRA methodology, we map HICP findings to the other frameworks driving your audit calendar (HIPAA, NIST CSF 2.0, HITRUST, and others), so a single set of evidence informs multiple programs.
This is GRC operationalized: one assessment that closes the gap between policy and practice and feeds your wider governance program rather than sitting in a silo.
HICP often gets treated as background reading, a PDF to cite in a policy footnote, rather than a framework to formally assess against. We do the opposite: we measure your environment against the HICP practices for your specific size band and document the result so it functions as evidence, not a citation.
Because 405(d) shares control ground with HIPAA, NIST CSF 2.0, and HITRUST, the assessment feeds work you are already doing. For most organizations, that’s the difference between a fifth annual assessment and a shortcut through four others.
HICP (Health Industry Cybersecurity Practices) is a set of recommended practices developed under Section 405(d) of the Cybersecurity Act of 2015, first published in 2018. It was built by healthcare organizations, for healthcare organizations, to address the sector’s specific threat actors, attack vectors, and operational vulnerabilities.
HIPAA and HICP are distinct. HIPAA sets the regulatory requirement; HICP is a healthcare-native framework of recommended practices. A HICP assessment complements your HIPAA Security Rule program, and our SRA methodology correlates the two so a single evidence set informs both.
HICP is one of the practices explicitly named as a “recognized security practice” under the HITECH Act (42 U.S.C. § 17941, added by Public Law 116-321 in 2021), which requires OCR to consider recognized security practices when weighing fines, audit length, and corrective remedies. See our OCR Compliance and Investigation Support and Security Risk Assessment pages for related services.
Yes. HICP defines recommended practices for small, medium, and large healthcare entities. We scope the assessment to your size band.
Schedule a 30-minute conversation to scope a HICP assessment sized to your organization, and see how it counts toward your HIPAA, NIST, and HITRUST work at the same time.
