Support for Your Cybersecurity Program

The AHA has long been committed to helping hospitals and health systems defend against and deflect cyberattacks, physical vulnerabilities and intrusions. As the cyber and physical security landscape continues to evolve, we are working closely with federal agencies, the hospital field and solution providers to build trusted relationships and channels for the exchange of cyber and physical threat information, as well as resources to support the implementation of risk mitigation practices.

HHS Cybersecurity Performance Goals

HHS created a set of voluntary Cybersecurity Performance Goals (CPG) in cooperation with the Healthcare and Public Health (HPH) sector to encourage the implementation of high-impact cybersecurity practices to help organizations better prepare for and mitigate cyber threats.

These practices are designed to:

• Better protect your hospital or health system from cyberattacks.
• Improve response when events occur.
• Minimize residual risk.
• Mature and heighten your cybersecurity capabilities.
• Ultimately, protect patient health information and safety.

The CPGs are designed to defend against the most common tactics used by cyber adversaries to attack health care and related third parties, such as exploitation of known technical vulnerabilities, phishing emails and stolen credentials. The AHA recommends that these CPGs be voluntarily implemented by all components of the health care sector, including third-party technology partners and business associates.

Learn more about the CPGs on the HHS Cybersecurity Performance Goals webpage.

How can AHA Help?

The nation’s hospitals and health systems are facing many challenges in their efforts to provide quality patient care and maintain business operations. Cyberattacks and physical threats are two of these critical challenges that are at the forefront for health care leaders.

Your organization can better prepare for and manage these challenges by making cybersecurity and physical security part of your existing governance, risk management and business continuity framework.

To help its members address these rising threats, the AHA has established a Preferred Cybersecurity & Risk Provider Program. The goal: to identify trusted providers with vetted services that can help hospitals and health systems protect their patients and operations from cyberattacks and physical threats.