Cybersecurity Performance Goals

Data theft and ransomware attacks targeting health care organizations have increased dramatically over the past several years, disrupting patient care, safety and privacy. Your organization can prepare for and manage such risks by viewing cybersecurity not as an IT issue but rather by making it part of your existing governance, risk management and business continuity framework.

The AHA has long been committed to helping hospitals and health systems defend against and deflect cyberattacks. That is why the AHA supports the voluntary Cybersecurity Performance Goals (CPGs) published by the Department of Health and Human Services (HHS) specifically for the Healthcare and Public Health (HPH) sector.

What are HPH Cybersecurity Performance Goals?

HHS created its Cybersecurity Performance Goals (CPG) to help health care organizations implement high-impact cybersecurity practices to better prepare for and mitigate cyberthreats.

Follow the practices to:

• Better protect your hospital or health system from cyberattacks.
• Improve response when events occur.
• Minimize residual risk.
• Mature and heighten your cybersecurity capabilities.
• Ultimately, protect patient health information and safety.

The CPGs are targeted at defending against the most common tactics used by cyber adversaries to attack health care and related third parties, such as exploitation of known technical vulnerabilities, phishing emails and stolen credentials. The AHA recommends that all components of the health care sector implement these practices including third-party technology providers and business associates.

Learn more about these cybersecurity practices on the HHS Cybersecurity Performance Goals webpage. Or print the Goals.

How Can AHA Help You Prepare?

While escalating cyberattacks underscore the critical need for your hospital or health system to defend against malicious actors, you cannot do it alone.

The AHA has worked closely with federal agencies, the hospital field and vendors to build trusted relationships and channels for the mutual exchange of cyberthreat information and resources and to assist in implementation of risk mitigation practices such as the HPH Cybersecurity Performance Goals.

As part of this work, the AHA established the AHA Preferred Cybersecurity Provider (APCP) program to support our members’ cybersecurity initiatives. Trust the vetted services of the highly reputable and accomplished cybersecurity providers listed below who have developed dedicated resources and offerings to help you meet the HPH Cybersecurity Performance Goals.