For years, the HHS Cybersecurity Performance Goals (CPGs) sat in the "best practice" category — sensible guidance that hospitals could adopt at their own pace. That changed in 2026. Healthcare cyber security compliance is now directly tied to Medicare reimbursement, which means a facility ignoring these goals isn't just risking a breach — it's risking its revenue.

The Essential Goals are the floor, not a target to work toward eventually: mitigating known vulnerabilities, enforcing multi-factor authentication across every system, securing email against phishing, and revoking access the moment an employee or contractor leaves. If a facility can't demonstrate these four are in place, everything else is secondary.

Mature organizations are expected to go further — the Enhanced Goals call for a strict, current asset inventory (every device on the network, not just the ones IT remembers), third-party vulnerability disclosure processes, centralized log collection, and proof that vendors meet a baseline security posture before they're onboarded.

The practical problem for most hospital networks is scale. A mid-size hospital might have hundreds of connected devices — infusion pumps, monitors, imaging systems — many running operating systems too old to accept modern patches. Meeting an "asset inventory" requirement isn't a one-time spreadsheet; it's an ongoing discipline, and manual tracking breaks down fast once Medicare reimbursement is on the line.

For compliance and IT leadership auditing where they stand against HHS CPGs, the honest first step is separating the four Essential Goals — which need to be provably in place today — from the Enhanced Goals, which need a roadmap and, increasingly, automated tracking to sustain.

A full breakdown of both HHS and CERT-In requirements, including the specific incident-reporting and log-retention timelines healthcare organizations now face, is covered here: [read the full 2026 healthcare cyber security regulatory breakdown].