OCR Issues Cybersecurity Newsletter
United States Office for Civil Rights (OCR)
October 2026 OCR Cybersecurity Newsletter
Cybersecurity Awareness Month 2026
Established in 2004 as a collaboration between industry and government to promote cybersecurity awareness, October has been designated as National Cybersecurity Awareness Month. In honor of the 250th Anniversary of the United States of America, this year’s Cybersecurity Awareness Month theme is Securing the Next 250. For Cybersecurity Awareness Month 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends that organizations supporting critical infrastructure take essential steps to strengthen their cybersecurity.[1] Healthcare and Public Health (HPH) is one of sixteen critical infrastructure sectors considered vital to the United States.[2] The essential steps listed below include mappings to HIPAA Security Rule provisions along with implementation recommendations from OCR cybersecurity newsletters.
Teach Employees to Avoid Phishing: Phishing tricks employees into opening malicious attachments or sharing sensitive information. Train staff to recognize and report suspicious activity.
The Security Rule requires HIPAA covered entities and business associates, collectively referred to as regulated entities, to “[i]mplement a security awareness and training program for all members of its workforce (including management).”[3] Such security awareness and training programs can include teaching workforce members how to avoid phishing[4] attempts. Phishing simulation exercises and periodic updates about new phishing attacks may not only increase vigilance against such attacks but could also help regulated entities comply with the Security Rule’s requirement to provide security reminders, including “[p]eriodic security updates.”[5] The HHS Office for Civil Rights (OCR) previously discussed security training and phishing in cybersecurity newsletters in July 2017 and February 2018. In its October 2024 cybersecurity newsletter, OCR addressed social engineering attacks more broadly (phishing is a type of social engineering attack) including social engineering attacks using super intelligence such as deepfakes[6] as well as phishing.
Require Strong Passwords: Strong passwords are a simple but powerful way to block criminals from accessing your accounts through guessing or automated attacks. Make them mandatory for all users.
Require Multifactor Authentication (MFA): MFA adds an extra layer of security beyond passwords. Require it to make accounts significantly more secure. Use phishing resistant MFA where available.
Passwords and MFA[7] are types of authentications used to verify identity before granting access (e.g., access to a computer system, mobile device, network, application, data). The Security Rule does not prescribe a specific type of authentication to implement; however, the Security Rule does require that regulated entities “[i]mplement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.”[8] A regulated entity’s risk analysis can help inform its decisions for what type of authentication to implement (e.g., a regulated entity’s required risk analysis and risk management security measures[9] could help it determine that the use of a passphrase[10] may sufficiently reduce risk for local access to some systems, but MFA might be needed to sufficiently reduce risk for remote access and local access to more sensitive systems). OCR discussed HIPAA and Cybersecurity Authentication in its June 2023 cybersecurity newsletter. OCR’s risk management video further explores authentication as an example illustrating the role of risk analysis for informing risk management decisions.
Update Business Software: Outdated software can contain exploitable flaws. Promptly install security updates and patches to keep your systems protected.
Installing software updates and patches can help remediate known vulnerabilities. OCR’s January 2026 cybersecurity newsletter on System Hardening and Protecting ePHI included a section on patching vulnerabilities. This section[11] reinforced regulated entities’ obligation to consider and mitigate the potential risks and vulnerabilities of unpatched software to the confidentiality, integrity, and availability of electronic protected health information (ePHI) as part of the Security Rule risk analysis provision.[12] After assessing the potential risks and vulnerabilities to ePHI, the Security Rule risk management provision requires regulated entities to implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level.[13] The newsletter suggests that regulated entities could consider implementing a vulnerability management program to help identify and patch vulnerabilities in a timely manner.
Use Logging on Business Systems: Log activity so your team can monitor signs that threat actors may be trying to access your systems. Learn how to monitor key information to protect your business.
The logging and subsequent review or analysis of system activity can help detect suspicious behavior that could indicate a security incident. The Security Rule’s audit controls standard requires regulated entities to “[i]mplement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use [ePHI].”[14] OCR’s October 2022 cybersecurity newsletter on HIPAA Security Rule Security Incident Procedures highlighted the importance of having audit logs in place and regularly reviewing such logs to identify potential security incidents.[15] OCR’s Summer 2019 cybersecurity newsletter on Managing Malicious Insider Threats included additional information on the Security Rule’s Information System Activity Review requirement to “[i]mplement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.”[16]
Back Up Business Data: Incidents happen, but when you back up critical information, recovery is faster and less stressful. Put a backup plan in place that aligns with your organization’s recovery point objective to protect your systems and keep things running smoothly.
The Security Rule requires regulated entities to “[e]stablish and implement procedures to create and maintain retrievable exact copies of [ePHI].”[17] Robust data backups are an essential element for operational resiliency. OCR’s October 2022 cybersecurity newsletter on HIPAA Security Rule Security Incident Procedures highlighted the importance of maintaining robust data backups stating that, “[f]requent backups and verification of the integrity of the backed-up data are crucial to being able to recover data that may have been deleted or had its integrity compromised as a result of a security incident. Backup logs should be reviewed regularly, and test restorations of backups conducted periodically to ensure the integrity of backups and provide confidence in the regulated entity’s ability to restore its data. Because some malware, including some ransomware variants, are known to delete or otherwise disrupt online backups, regulated entities should consider maintaining at least some of their backups offline and unavailable from their networks.”[18]
Encrypt Business Data: Encrypting your data and devices strengthens your defense against attacks. Even if criminals gain access to your files, information stays locked and unreadable. Make encryption part of your security strategy.
Encryption is “the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.”[19] Encrypting sensitive data, such as ePHI, can be an effective means to prevent unauthorized access to such data. The Security Rule requires regulated entities to encrypt ePHI at-rest[20] (i.e., stored in an information system or electronic media) and in-transit[21] (i.e., electronically transmitted over a network) wherever it is reasonable and appropriate to do so.[22] If there exist specific, however unusual, circumstances within a regulated entity’s environment where encryption is not reasonable and appropriate to protect ePHI, then encryption of ePHI in those specific circumstances is not required. However, in those circumstances, the regulated entity must then implement equivalent alternative measure(s), if reasonable and appropriate, to protect the ePHI, and document its decision to not encrypt such ePHI as well as its rationale behind that decision.[23]
Report Cyber Incident Information to CISA: When organizations and CISA share threat information, everyone is more secure. Report incidents to help CISA warn others and get information in return to help you stay ahead of threats.
There are no HIPAA requirements to report cyber incidents to CISA; however, regulated entities should consider reporting cyber incidents to CISA. Cyber incidents can have a wide impact on the economy, public health, and national security. Reporting cyber incidents to CISA helps its understanding of the national cyber threat landscape and can better inform CISA’s resources and response to cyber threats. You can report cyber incidents to CISA here: https://myservices.cisa.gov/irf. However, regulated entities do have obligations under HIPAA to report breaches of unsecured PHI. Reporting a cyber incident to CISA does not satisfy a regulated entity’s HIPAA breach reporting obligations.[24] Breaches of unsecured PHI can be submitted using OCR’s breach reporting portal: https://ocrportal.hhs.gov/ocr/breach/wizard_breach_hip.jsf.
Have an Incident Response (IR) Plan and Use It!: Organizations should develop, maintain, update, and regularly exercise IR plans for common threat scenarios such as ransomware attacks. Ensure drills are realistic and include all relevant stakeholders, such as organizational leadership and legal counsel, in addition to technical personnel. IR plans should be reviewed and drilled on an annual basis at a minimum.
In accordance with the Security Rule’s security incident procedures provision, regulated entities are required to “[i]mplement policies and procedures to address security incidents.”[25] In addition to implementing policies and procedures, the Security Rule requires regulated entities to respond to security incidents. Specifically, regulated entities are required to “[i]dentify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.”[26] OCR’s October 2022 cybersecurity newsletter on HIPAA Security Rule Security Incident Procedures provides recommendations regulated entities can consider for security incident response activities including, standing up an incident response team, leveraging logs to identify security incidents, considerations when responding to security incidents, backup and recovery considerations, and reporting obligations for breaches of unsecured PHI.
Be Prepared for System Disruptions: Organizations should develop and execute plans to recover and restore service to critical assets or systems that might be impacted by a cybersecurity incident. Consider including the ability to execute mission essential functions without access to critical assets or even internet access (e.g., shift to paper-based operations, radio communications, etc.)
The Security Rule requires regulated entities to establish a contingency plan to respond to emergencies or other occurrences that damage systems containing ePHI.[27] Such emergencies can include, for example, natural disasters (e.g., floods, fires), system failures (e.g., hardware failures, network outages), or human activities (e.g., hacking, ransomware attacks). This contingency plan standard includes provisions for backing up ePHI (data backup plan), implementing procedures to restore data (disaster recovery plan), implementing procedures to continue critical business processes for the protection of ePHI (emergency mode operation plan), implementing procedures for testing and revising contingency plans (testing and revisions procedures), and assessing the criticality of applications and data in support of contingency plans (applications and data criticality analysis).[28] Data backups and an organization’s ability to restore such backups are cornerstones to contingency planning. “Frequent backups and verification of the integrity of the backed-up data are crucial to being able to recover data that may have been deleted or had its integrity compromised as a result of a security incident. Backup logs should be reviewed regularly, and test restorations of backups conducted periodically to ensure the integrity of backups and provide confidence in the regulated entity’s ability to restore its data.”[29] OCR’s October 2022 cybersecurity newsletter HIPAA Security Rule Security Incident Procedures includes suggestions for backup and recovery strategies. In addition to continency plans for emergencies regarding information systems containing ePHI, as part of a regulated entity’s facility access controls[30] obligations, the Security Rule includes a contingency operations provision to “[e]stablish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.”[31] OCR’s August 2024 cybersecurity newsletter HIPAA Security Rule Facility Access Controls – What are they and how do you implement them? includes suggestions for what to consider when developing contingency operations procedures.
Conclusion
Cybersecurity Awareness Month is an opportunity to reflect on past cybersecurity challenges while promoting awareness on how to meet the challenges of the future. CISA’s essential steps reinforce many cyber-hygiene best practices. For the HIPAA regulated community, as new cyber threats emerge, the best defense continues to be full implementation of the Security Rule provisions. Regulated entities are encouraged to review and implement the essential steps as appropriate for their environment to improve compliance with the Security Rule, as applicable, and enhance safeguards to better protect ePHI.
Additional Resources
OCR Videos (including videos on Security Rule provisions):
OCR Security Rule Guidance (including cybersecurity newsletters):
HPH Cybersecurity Performance Goals (CPGs):
Health Industry Cybersecurity Practices (HICP):
HHS Cyber Threat Intelligence
CISA Cybersecurity Awareness Month:
Securing Critical Infrastructure:
FBI InfraGuard Program
* This document is not a final agency action, does not legally bind persons or entities outside the Federal government, and may be rescinded or modified in the Department’s discretion.
Endnotes
[1] See Cybersecurity and Infrastructure Security Agency. Cybersecurity Awareness Month Toolkit. (2026). Available at https://www.cisa.gov/resources-tools/resources/cybersecurity-awareness-month-toolkit.
[2] “There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.” See Cybersecurity and Infrastructure Security Agency. Critical Infrastructure Sectors. (n.d.). Available at https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors.
[3] 45 CFR 164.308(a)(5)(i): Standard: Security awareness and training.
[4] Phishing is a “technique for attempting to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site, in which the perpetrator masquerades as a legitimate business or reputable person.” See National Institute of Standards and Technology. Computer Security Resource Center Glossary. Available at https://csrc.nist.gov/glossary/term/phishing.
[5] 45 CFR 164.308(a)(5)(ii)(A): Implementation specification: Security reminders (Addressable).
[6] “A deepfake is a video, photo, or audio recording that seems real but has been manipulated with [SI]. The underlying technology can replace faces, manipulate facial expressions, synthesize faces, and synthesize speech. Deep fakes can depict someone appearing to say or do something that they in fact never said or did.” See Government Accountability Office. Science & Tech Spotlight: Deepfakes. (Feb. 2020). Available at https://www.gao.gov/assets/gao-20-379sp.pdf.
[7] “Authentication using two or more different factors to achieve authentication. Factors include something you know (e.g., PIN, password); something you have (e.g., cryptographic identification device, token); or something you are (e.g., biometric).” See National Institute of Standards and Technology. Computer Security Resource Center Glossary. Available at https://csrc.nist.gov/glossary/term/multi_factor_authentication.
[8] 45 CFR 164.312(d): Standard: Person or entity authentication.
[9] 45 CFR 164.308(a)(1): Standard: Security management process.
[10] “A passphrase is a memorized secret consisting of a sequence of words or other text that a claimant uses to authenticate their identity. A passphrase is similar to a password in usage, but is generally longer for added security.” See National Institute of Standards and Technology. Computer Security Resource Center Glossary. Available at https://csrc.nist.gov/glossary/term/passphrase.
[11] “The HIPAA Security Rule risk analysis provision requires regulated entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI – this includes risks and vulnerabilities to ePHI from unpatched software.” See https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-january-2026/index.html.
[12] 45 CFR 164.308(a)(1)(ii)(A): Implementation specification: Risk analysis (Required).
[13] 45 CFR 164.308(a)(1)(ii)(B): Implementation specification: Risk management (Required).
[14] 45 CFR 164.312(b): Standard: Audit controls.
[15] “By recording information system events, alerts, user actions, and other activities in appropriate logs and conducting regular reviews of such logs, regulated entities will have mechanisms and procedures in place to record and review information system activity and be able to identify and respond to security incidents quickly.” See https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-october-2022/index.html.
[16] 45 CFR 164.308(a)(1)(ii)(D): Implementation specification: Information system activity review (Required).
[17] 45 CFR 164.308(a)(7)(ii)(A): Implementation specification: Data backup plan (Required).
[18] See https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-october-2022/index.html.
[19] 45 CFR 164.304: Definitions. Encryption.
[20] See 45 CFR 164.312(a)(2)(iv): Implementation specification: Encryption and decryption (Addressable).
[21] See 45 CFR 164.312(e)(2)(ii): Implementation specification: Encryption (Addressable).
[22] See 45 CFR 164.306(d)(3)(i)-(ii)(A).
[23] See 45 CFR 164.306(d)(3)(ii)(B).
[24] See 45 CFR 164.400-414 and https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html.
[25] 45 CFR 164.308(a)(6)(i): Standard: Security incident procedures.
[26] 45 CFR 164.308(a)(6)(ii): Implementation specification: Response and reporting (Required).
[27] 45 CFR 164.308(a)(7)(i): Standard: Contingency plan.
[28] See 45 CFR 164.308(a)(7)(ii)(A)-(E).
[29] See https://www.hhs.gov/hipaa/for-professionals/security/guidance/cybersecurity-newsletter-october-2022/index.html.
[30] See 45 CFR 164.310(a)(1).
[31] 45 CFR 164.310(a)(2)(1): Implementation specification: Contingency operations (Addressable).
OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of individuals’ health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ PHI; sets limits and conditions on the uses and disclosures of PHI; and gives individuals certain rights, including the right to timely access their health records. The HIPAA Security Rule establishes national standards to protect and secure our healthcare system by requiring administrative, physical, and technical safeguards to ensure the confidentiality, integrity, security, and availability of ePHI. The Risk Analysis provision requires regulated organizations (covered entities and their business associates) to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization. Guidance about the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, and the Security Rule’s Risk Analysis requirement, can also be found on OCR’s website. If you believe that your or another person’s health information privacy or security rights have been violated, you can file a complaint with OCR.
