Support for your Cybersecurity Program

Data theft and ransomware attacks targeting health care organizations have increased dramatically over the past several years, disrupting patient care, safety and privacy. Your organization can prepare for and manage such risks by viewing cybersecurity not as an IT issue but rather by making it part of your existing governance, risk management and business continuity framework.

The AHA has long been committed to helping hospitals and health systems defend against and deflect cyberattacks. As the cybersecurity landscape continues to evolve, we are working closely with federal agencies, the hospital field and solution providers to build trusted relationships and channels for the exchange of cyberthreat information, as well as resources to support the implementation of risk mitigation practices.

HHS Cybersecurity Performance Goals

HHS created a set of voluntary Cybersecurity Performance Goals (CPG) in cooperation with the Healthcare and Public Health (HPH) sector to encourage the implementation of high-impact cybersecurity practices to help organizations better prepare for and mitigate cyber threats.

These practices are designed to:

• Better protect your hospital or health system from cyberattacks.
• Improve response when events occur.
• Minimize residual risk.
• Mature and heighten your cybersecurity capabilities.
• Ultimately, protect patient health information and safety.

The CPGs are designed to defend against the most common tactics used by cyber adversaries to attack health care and related third parties, such as exploitation of known technical vulnerabilities, phishing emails and stolen credentials. The AHA recommends that these CPGs be voluntarily implemented by all components of the health care sector, including third-party technology partners and business associates.

Learn more about the CPGs on the HHS Cybersecurity Performance Goals webpage. Or print the Goals.

How can AHA Help?

While escalating cyberattacks underscores the critical need for your hospital or health system to defend against malicious actors, you cannot do it alone.

That’s why the AHA is collaborating with multiple parties across the public and private sectors to support our members with cybersecurity risk mitigation.

As part of this work, the AHA established the AHA Preferred Cybersecurity Provider (APCP) program to help our members’ cybersecurity initiatives. These vetted, highly reputable and accomplished cybersecurity providers listed below have developed dedicated resources and special offerings to help you address your cybersecurity and risk mitigation challenges.