When a Cyber Audit Comes Back Clean: What a Small Hospital Got Right

The HHS Office of Inspector General (OIG) recently published an audit that stands out for what it did not contain. In OAS-25-18-033 (issued June 12, 2026), OIG examined whether a small hospital in the southeastern United States had cybersecurity controls in place to prevent, detect, and respond to cyberattacks. The OIG concluded the small hospital had sufficient cybersecurity controls in place and OIG made no recommendations.

What makes this really stand out is that this audit is the third in a series that included two larger hospitals. The OIG told both of the larger facilities (A-18-22-08019 and A-18-22-08021) they had room to improve. When it comes to cybersecurity, vigilance matters more than size.

What OIG Examined
OIG's objective was straightforward: determine whether the hospital could prevent, detect, and respond to a cyberattack. Rather than reviewing policies on paper alone, OIG contracted with a cybersecurity firm to run external penetration testing, web application testing, and vulnerability scanning against four of the hospital's public-facing websites. OIG also reviewed the hospital's incident response and contingency planning policies and interviewed its officials. The penetration testing took place in June 2025, with broader audit work running from January 2025 through April 2026.

What OIG Found
OIG found that the hospital's controls held. The hospital had adopted the NIST Cybersecurity Framework (CSF) 2.0 as its primary framework, and OIG evaluated its controls against the HIPAA Security Rule. Specifically, OIG observed:

• A defense-in-depth architecture layering multiple safeguards, including a custom system built to block unusual or suspicious activity. The hospital detected OIG's penetration testing and flagged it as suspicious in real time.
  
  
• Mature incident response practices aligned with NIST SP 800-53, including annual cybersecurity training, routine vulnerability scanning, continuous monitoring, regular tabletop exercises, and annual third-party penetration testing.
  
  
• Disciplined contingency planning with a plan tested twice a year and updated annually based on risk assessments, role-based contingency training, nightly backups replicated to an off-site location and tested at least monthly, quarterly disaster recovery exercises, backup workstations to keep clinical data accessible during outages, and data encrypted at rest and in transit.
  
  
• Engaged leadership that met regularly to focus on emerging threats and ongoing improvements to the security program.
  

The testing identified only one low-risk issue: certain systems did not enforce a secure transport setting. Tellingly, the hospital had already identified that issue itself, formally documented its acceptance of the associated risk, and was working with a vendor on a long-term fix. Even the single weakness OIG found was already under active management.