The HHS cybersecurity performance goals for accounts and logins

HHS’s Healthcare and Public Health Sector Cybersecurity Performance Goals (HPH CPGs) are a voluntary list of practices for health care organizations. Four of the ten essential goals concern accounts and logins. They are multi-factor authentication (MFA), revoking credentials for departing workforce, unique credentials, and separate user and privileged accounts. An enhanced goal, centralized log collection, covers the logs where those sign-ins are recorded. For each one, you can check your practice against a staff list and a list of systems.

What the goals are

HHS publishes the CPGs to help health care organizations, and especially those that deliver care, put high-impact security practices first. They grew out of CISA’s cross-sector performance goals, released in March 2023, which HHS adapted with CISA and industry. HHS says they also draw on HICP (Healthcare Industry Cybersecurity Practices, guidance HHS publishes with industry through its 405(d) program), the NIST Cybersecurity Framework and other sources.

The goals come in two tiers. The ten essential goals set “a floor of safeguards.” HHS presents them as minimum foundational practices. The ten enhanced goals help organizations go further. Each goal links to HICP practices, NIST controls and the matching CISA goal.

HHS calls the goals voluntary, and they are not HIPAA. The HIPAA Security Rule, 45 CFR Part 164, Subpart C, is the regulation that applies to practices that handle electronic patient data (What is the HIPAA Security Rule?). Several goals line up with Security Rule provisions; the last column of the table gives the closest one. Following the goals is your choice; the Security Rule applies either way. Other account questions for practices are collected in Healthcare account access.

The goals that concern logins

Checking each goal at your practice

Revoke credentials for departing workforce

Compare the user list in each system with your current staff list. Include contractors and volunteers, since the goal names them. Any account for someone who has left is a gap. Cloud systems need a separate look, because each has its own user list. HICP’s volume for small practices says to end access immediately and to update shared or generic accounts too. What to close and how fast is in Which accounts to close when someone leaves a medical practice, and how fast.

Unique credentials

HHS frames this goal around spotting unusual activity and stopping attackers from moving from system to system. Under HIPAA, unique user identification (Required) gives each user a unique name or number, so check that each person signs in with their own login. List every login that more than one person uses, and why. HICP’s small-practice volume says to give each user a separate account and avoid shared or generic ones. If a shared account is required, it says to remind users to sign out whenever they step away. Where a shared login has to stay, write down why, and keep a separate record of who used it.

Separate user and privileged accounts

A privileged account can change settings, add users or install software. Check who holds admin rights in the EHR, email, the network and staff computers. HICP’s small-practice volume says a person with admin duties should have two accounts: one for admin work and one for everyday tasks such as email. It also says to turn on MFA for every admin account.

Multifactor authentication

List the systems people reach over the internet: email, remote access, the EHR’s web sign-in, payer portals and telehealth. Note which ones have MFA on. HICP’s small-practice volume recommends MFA for email, remote access and VPN connections. MFA on a shared login brings its own problems, covered in Two-factor authentication at a medical practice, and what happens on shared logins.

Centralized log collection

This enhanced goal goes beyond the floor. A first step is knowing where each system’s logs live, who reviews them, and how long they’re kept. How long to keep them is in How long to keep audit logs under HIPAA.

Where shared logins fall short

A login several staff share is hard to square with two of these goals. You can’t revoke it when one person leaves, because the others still use it. Instead, you change the password and tell everyone who stays. And the system can’t tell which person used it, so unusual activity can’t be traced to anyone. Spotting that kind of activity is what HHS wants unique credentials for. MFA on a shared login also sends the code to one phone, or to every phone set up for it.

HICP’s small-practice volume warns that updating the password for many users on a shared account is complex, which can leave a compromised password active for a long time. So write down every shared login: who knows the password, when it last changed, and who used it on which day. That list is the starting point for replacing it, or for running it more safely while it stays. Why shared logins persist is covered in Can staff share an EHR login?