Acknowledgements

Health Care and Public Health Sector Cybersecurity Framework Implementation Guide

In 2015, the National Institute of Standards and Technology (NIST) released the Framework for Improving Critical Infrastructure Cybersecurity (“Cybersecurity Framework") in response to a requirement of Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity. EO 13636 also called on Sector Specific Agencies (SSAs) like the U.S. Department of Health and Human Services (HHS) to “coordinate with the Sector Coordinating Councils (SCCs) to review the Cybersecurity Framework and, if necessary, develop implementation guidance or supplemental materials to address sector-specific risks and operating environments."

The Risk Management (RM) Sub-Working Group (SG) was formally chartered under CIPAC under the Joint HPH Cybersecurity Working Group (WG) in late 2015 to produce the Health Care Sector Cybersecurity Framework Implementation Guide (Sector Guide) to help Health Care and Public Health (HPH) Sector organizations implement the NIST Cybersecurity Framework in accordance with EO 13636.

Initially released in February 2016 as Version (Ver.) 1, a 508-compliant version, Ver. 1.1 with additional minor updates and corrections was published in May 2016. The Joint HPH Cybersecurity WG was later re-chartered under CIPAC as the HPH Sector Coordinating Council (HSCC) Joint Cyber WG (JCWG) and the original RM SG was renamed as Task Group 1A (TG-1A) under the JCWG in 2018.

TG-1A members who assisted with the development and internal review of this major new release, Ver 2.0, of the Sector Guide include:

Government Coordinating Council (GCC) organizations that conducted formal reviews of this document include the U.S. Food and Drug Administration (FDA), the Office for Civil Rights (OCR), the HHS Administration for Strategic Preparedness and Response (ASPR), the HHS Office of the Chief Information Officer (CIO), the Centers for Medicare & Medicaid Services, the Office of the National Coordinator​ for Health Information Technology (ONC), the National Institute of Standards and Technology (NIST), and the HHS Office for Civil Rights (OCR).