Cyber Security Guidance Material

In this section, you will find educational materials specifically designed to give HIPAA covered entities and business associates insight into how to respond to a cyber-related security incidents.

How the HIPAA Security Rule Can Help Defend Against Cyber-Attacks

The HHS Office for Civil Rights (OCR) has produced a pre-recorded video presentation for HIPAA covered entities and business associates (regulated entities) on how the HIPAA Security Rule can help regulated entities defend against cyber-attacks. The video is available in English and Spanish.

The presentation is intended to educate the health care industry on real world cyber-attack trends from OCR breach reports and investigations and explore how implementation of appropriate HIPAA Security Rule safeguards can help detect and mitigate common cyber-attacks. Topics include:

  • OCR breach and investigation trend analysis
  • Common attack vectors
  • OCR investigations of weaknesses that led to or contributed to breaches
  • How Security Rule compliance can help regulated entities defend against cyber-attacks

The video presentation may be found on HHS’s YouTube channel at:
https://www.youtube.com/watch?v=VnbBxxyZLc8, links to an external website, opens in a new tab (Oct. 23, 2023)

The video presentation in Spanish may be found on HHS’s YouTube channel at:
https://www.youtube.com/watch?v=3oVarCxLcB8, links to an external website, opens in a new tab (Oct. 23, 2023)

Cyber Security Checklist and Infographic

This guide and graphic explains, in brief, the steps for a HIPAA covered entity or its business associate to take in response to a cyber-related security incident.

Cyber Security Checklist, opens in a new tab

Cyber Security Infographic, opens in a new tab [GIF 802 KB]

Ransomware Guidance

HHS has developed guidance to help covered entities and business associates better understand and respond to the threat of ransomware.

Ransomware, opens in a new tab

National Institute of Standards and Technology (NIST) Cybersecurity Framework

This crosswalk document identifies “mappings” between NIST’s Framework for Improving Critical Infrastructure Cybersecurity and the HIPAA Security Rule.

NIST Cyber Security Framework to HIPAA Security Rule Crosswalk, links to an external website, opens in a new tab

OCR Cyber Awareness Newsletters

In 2019, OCR moved to quarterly cybersecurity newsletters. The purpose of the newsletters remains unchanged: to help HIPAA covered entities and business associates remain in compliance with the HIPAA Security Rule by identifying emerging or prevalent issues, and highlighting best practices to safeguard PHI. Visit our Cybersecurity Newsletter Archive page to view previous newsletters from 2016.

Sign up for the OCR Security Listserv to receive the OCR Cyber Awareness Newsletters in your email inbox.

Frequently Asked Questions for Professionals - Please see the HIPAA FAQs for additional guidance on health information privacy topics.

Content created by Office for Civil Rights (OCR)
Content last reviewed