Simplify compliance management for your CMS SSPP

• CMS SSPP stands for Centers for Medicare & Medicaid Services (CMS) System Security and Privacy Plan (SSPP). This document outlines how an organization secures its systems and data in relation to CMS programs. The main goal is to ensure the confidentiality, integrity, and availability (CIA) of the systems and data managed by the organization, following federal guidelines and compliance requirements like FISMA (Federal Information Security Management Act).

• Any entity that is responsible for safeguarding CMS-related information (healthcare providers, managed care organizations, insurance companies, third-party vendors that interact with CMS systems or manage patient data) need to develop and implement an SSPP to comply with CMS security requirements.

CMS SSPP is a detailed plan used by organizations to secure systems and data specific to CMS programs, such as Medicare and Medicaid, that outlines how security controls are implemented to protect healthcare-related information. In contrast, NIST SP 800-53 is a broader framework that provides general security and privacy controls for federal information systems across various industries. While NIST SP 800-53 serves as a guideline, CMS SSPP is a mandatory, tailored application of those controls specifically for CMS compliance, ensuring the confidentiality, integrity, and availability of healthcare data.

In early 2024, the name was updated from System Security Plan (SSP) to the System Security and Privacy Plan (SSPP) to reflect that it now includes all of the requirements for the privacy baseline controls outlined in NIST SP 800-53, making SSPP more cohesive.