National Infrastructure Protection Plan

Overview of the National Infrastructure Protection Plan

In 2003, the Federal Government established the Healthcare and Public Health (HPH) Sector as a critical infrastructure sector in the United States, recognizing that the healthcare sector’s security and resilience are essential to national security, the economy, and public health and safety.

In 2013 “Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Protection and Resilience”  was issued as a means for the United States to strengthen and secure the country’s critical infrastructure. The Directive seeks to reduce vulnerabilities, identify and disrupt threats, minimize consequences and hasten response and recovery efforts related to critical infrastructure by fostering greater integration and cooperation among public and private organizations.

A Sector-Specific Plan (SSP), updated in 2016, included a set of goals and objectives and an increased emphasis on priorities such as information sharing and emergency response. The plan represented a continued collaborative effort among the private sector; Federal, State, local, tribal, and territorial governments; and non-governmental organizations to develop specific membership actions over the coming years required to reduce critical infrastructure risk and enhance Sector resilience.

Sector Partnership Vision
The Healthcare SSP promotes a vision of a public-private partnership supporting the needs of the Healthcare Sector’s critical infrastructure and Federal, State, local, tribal, and territorial (FSLTT) government partners to enhance the resilience of the Sector to all hazards.

Sector Partnership Mission
The SSP envisioned partnership’s mission would be to sustain the essential functions of the Nation’s healthcare and public health delivery system and to support effective emergency preparedness and response to nationally significant hazards. Public and private sector partners will evaluate risks; coordinate plans and policy; and provide guidance to prevent, protect, mitigate, respond to, and recover from all hazards that pose a threat to the Sector’s critical infrastructure.

Sector Partnership Goals

• Risk Assessment: Leverage relationships and resources to assess and analyze threats to,
  vulnerabilities of, and consequences of disruption to HPH Sector critical infrastructure to inform
  risk management activities. Ensure that approaches consider the physical, cyber, and human
  elements of critical infrastructure security and resilience, supply chain issues, and
  interdependencies with other sectors.
• Risk Management: Enhance the resilience of the HPH Sector by translating risk analyses into
  actionable recommendations for State and local public health departments, individual private
  sector facilities, and health systems at large. Integrate such risk analyses into the mitigation,
  response, and recovery efforts of the Federal Government. Execute risk mitigation activities in a
  prioritized manner with clear plans and metrics for success.
• Information Sharing: Enhance existing and develop new mechanisms to ensure bidirectional
  sharing of information. Promote sharing of risk information, threats, best practices, and lessons
  learned between government and private sector partners.
• Partnership Development and Coordination: Develop and implement a “Partnership
  Engagement Strategy” to include outreach efforts to both government and private sector
  entities with a focus on developing relationships with owners and operators of critical
  infrastructure. Encourage the development of regional; State, local, tribal, and territorial (SLTT);
  cross-sector; and intra-HPH Sector partnerships to enhance sector resilience, facilitate
  information sharing, and respond to disasters.
• Response and Recovery: Engage in response and recovery efforts across FSLTT government
  agencies, health care coalitions, and the private sector during and after disasters, including
  cybersecurity incidents. Exercise the ability of the Sector to respond to natural or manmade
  disasters and incorporate lessons learned into future exercises and corrective actions.