What is HHS 405(d)?

HHS 405(d) refers to Section 405(d) of the Cybersecurity Act of 2015, which mandated the Department of Health and Human Services (HHS) to lead a public-private effort to align healthcare cybersecurity approaches across the industry.

Out of this came the 405(d) Task Group, a coalition of over 150 cybersecurity professionals, clinicians, and public health experts from both the public and private sectors. Their charge? Translate broad cybersecurity principles into practical, threat-based guidance tailored for healthcare organizations.

The crown jewel of this initiative is the Health Industry Cybersecurity Practices (HICP) framework, an evolving suite of resources designed to help healthcare leaders defend against the top cyber threats while ensuring patient safety.

Why It Matters to Cyber Executives

For CISOs, CIOs, and risk leaders, 405(d) provides clear, sector-specific guidance that balances regulatory expectations with operational realities.

Unlike generic frameworks, HHS 405(d):
- Recommends size-appropriate controls for small, medium, and large healthcare entities
- Bridges the gap between technical operations and board-level oversight
- Aligns with HIPAA, NIST CSF, and cyber insurance requirements

In a time where healthcare remains the #1 targeted critical infrastructure sector, 405(d) becomes a strategic weapon for cyber resilience.

Who Owns It?

The initiative is led by HHS’s Administration for Strategic Preparedness and Response (ASPR), with close collaboration from DHS, NIST, the Health Sector Coordinating Council (HSCC), and private-sector cybersecurity experts.

This isn’t vendor-created theory, it’s community-driven and federally backed.

Key 405(d) Resources and Their Executive Value

1. HICP Main Document

Why it matters: Summarizes the top 5 threat areas and 10 best practices every healthcare leader should understand. Great for executive education and high-level strategy alignment.

2. Technical Volume 1 (Small Organizations)

Why it matters: Essential for health systems overseeing affiliate clinics, rural care sites, or business units without mature IT resources.

3. Technical Volume 2 (Medium and Large Organizations)

Why it matters: Designed for hospitals and health systems with complex IT environments, this volume offers technical guidance to combat ransomware, data loss, and medical device threats. It outlines ten core practices to protect ePHI and maintain operational resilience

4. Hospital Cyber Resiliency Landscape Analysis

Why it matters: Provides sector-wide benchmarks where CISOs can assess systemic gaps and coordinate planning across regional or multi-entity systems.

5. Operational Continuity-Cyber Incident (OCCI) Checklist

Why it matters: A practical, role-based guide to help healthcare organizations navigate the first 12 hours of a major cyber incident. It outlines clear actions for leadership and operational teams to protect patient safety, sustain critical operations, and manage response and recovery during prolonged outages.

6. 405(d) Post XXIII: Health Industry Cybersecurity Strategic Plan (2024–2029)

Why it matters: A unified strategy to strengthen cybersecurity in healthcare. It promotes user-focused security, shared responsibility, and resilience to help all organizations protect patients, safeguard data, and ensure continuity in a digital age.

7. 405(d) Post: Volume XXV

Why it matters: With AI, cloud, and telehealth on the rise, this volume calls for strong protocols, staff training, and governance to protect patient safety, data, and operations from evolving cyber threats.

How 405(d) Helps Cyber Leaders Build Resilient Programs

Here’s how healthcare cybersecurity executives can leverage HHS 405(d) today:

Board-Level Engagement:

Use HICP and threat summaries to educate executives and align with patient safety outcomes.

Control Prioritization:

Tailor security roadmaps based on your org size and top 5 threat vectors.

Vendor Risk Management:

Embed 405(d) expectations into RFPs, contracts, and third-party reviews.

Cyber Program Maturity:

Benchmark internal capabilities using HICP as a maturity model reference.

Audit & Assurance Readiness:

Demonstrate “recognized security practices” for HIPAA Safe Harbor protections and cyber insurance underwriting.

Workforce Culture:

Use the Check Your Cyber Pulse toolkit to drive continuous awareness and engagement.

How Onyxia Can Help

At Onyxia, we specialize in transforming cybersecurity programs from reactive to preemptive, and our custom framework feature can integrate HHS 405(d) guidance.

Our platform unifies over 50 cybersecurity tools and provides real-time KPI tracking, board-ready reporting, and customized compliance alignment all in one place. HHS 405(d) is about readiness. Onyxia helps you own it.