CMS Policies and Guidance

As CMS works to improve healthcare for millions of Americans, information security and privacy policies ensure that sensitive data is protected. CMS Policies and Guidance are how CMS implements federal requirements from higher-level authorities such as HHS, FISMA, and NIST.

The policy and guidance pages found on this site are approved by the CMS Chief Information Security Officer (CISO), and are regularly reviewed to ensure accuracy. Updates or changes are posted to the blog. If you have a question about security policy at CMS, contact the ISPG Policy team.