On June 10, 2024, the White House issued a fact sheet detailing a federal push to strengthen healthcare cybersecurity — released in the shadow of attacks that had paralyzed parts of the U.S. health system. For any contractor that handles health data or sells into the health sector, the direction of travel matters. (This summarizes a policy statement from the prior administration; treat the specific initiatives as historical context and confirm current program status.)
Why the Urgency
The numbers told the story. The fact sheet noted that cyberattacks against the U.S. healthcare system rose 128% from 2022 to 2023. Then, in February–March 2024, a major attack on a key payment system disrupted claims processing so severely that, by providers' accounts, roughly one in three U.S. health care claims were affected — choking payments to providers and, in some cases, forcing hospitals to redirect care. Health-sector cyber stopped being abstract.
What the Government Did
The effort emphasized public-private partnership, since much of the health system is privately owned. Key threads included:
- An HHS healthcare cybersecurity gateway (launched January 2024) to centralize sector-specific cyber resources.
- Voluntary Healthcare and Public Health Cybersecurity Performance Goals (CPGs) to help institutions prioritize high-impact practices.
- Executive engagement — the White House convened CISOs and senior leaders from across care delivery, medical technology, and industry associations to improve threat-intelligence sharing and push secure-by-design adoption.
The throughline: start with voluntary performance goals and partnership, while signaling that mandatory requirements could follow for parts of the sector.
What This Means for Contractors
- Health data raises the stakes. If you hold electronic protected health information (ePHI) under a federal contract, you likely sit at the intersection of HIPAA's Security Rule and federal frameworks like FISMA / NIST. See the Healthcare industry page.
- "Voluntary" goals become benchmarks. CPGs have a way of hardening into expectations — in contract terms, in customer due diligence, and eventually in rules. Adopting them early is cheaper than retrofitting.
- Sector momentum is bipartisan and durable. Related legislative efforts — like the Healthcare Cybersecurity Act — point the same way.
What to Do Now
- Confirm your ePHI footprint and map HIPAA Security Rule duties against any federal-contract cyber requirements.
- Benchmark against the HCP Cybersecurity Performance Goals, even where they are voluntary.
- Prioritize resilience basics: offline backups, tested recovery, network segmentation, and an incident-response plan — the controls that blunt the attacks that hurt this sector most.
Key Takeaways
- A 128% surge in healthcare attacks and the 2024 payment-system disruption drove a major federal cyber push.
- The strategy mixed voluntary performance goals and partnership with the prospect of future requirements.
- Health-sector contractors should align with HIPAA + federal frameworks and treat the CPGs as benchmarks now.
Dive into sector specifics on the Healthcare industry page, or confirm your obligations with Find My Requirements.