Healthcare providers, medical device manufacturers, and health IT vendors serving the U.S. Department of War are facing a new cybersecurity mandate: CMMC Level 2 compliance. Unlike other defense industries, healthcare contractors must navigate an additional layer of complexity: the intersection of Controlled Unclassified Information (CUI) requirements under CMMC and Protected Health Information (PHI) obligations under HIPAA.
Healthcare contractors often rely on outdated systems, some running unsupported operating systems or proprietary medical software that are difficult to secure, patch, or monitor. Many also struggle with sprawling networks that blend clinical, administrative, and research environments, making CMMC boundary definition and CUI scoping particularly challenging. Systems that were never designed with defense contract requirements in mind must now demonstrate compliance with NIST SP 800-171 controls.
HIPAA focuses on protected health information (PHI), which may also be classified as CUI in federal defense contracts. Healthcare contractors often assume existing HIPAA policies are sufficient, only to discover that CMMC requires more granular access control, audit logging, encryption standards, and incident response planning, all mapped specifically to NIST SP 800-171. In addition, CMMC requires a formal System Security Plan (SSP) and documented Plans of Action and Milestones (POA&Ms) that HIPAA does not mandate.
From cloud EHR platforms to telehealth services, healthcare is a deeply outsourced ecosystem. Under CMMC, prime contractors are responsible for how their vendors handle CUI, and that responsibility flows down the supply chain. If subcontractors are not compliant or if contracts do not include the right DFARS flow-down clauses, your entire compliance posture could be at risk during a C3PAO assessment.
Many healthcare contractors are already stretched thin meeting HIPAA, PCI DSS, and other regulatory demands. Adding CMMC compliance presents new challenges for already taxed IT and security teams, requiring dedicated planning, cross-functional coordination, and executive sponsorship to meet DoW certification timelines.
A CMMC gap analysis is the essential first step toward Level 2 certification, providing a structured review of your current cybersecurity posture against all 110 NIST SP 800-171 requirements. The analysis will help you identify technical, policy, and documentation gaps that will require additional investments beyond those made to ensure HIPAA compliance. For healthcare, this step is critical in understanding how CUI flows through clinical, research, and administrative environments.
Identify where CUI is stored, processed, or transmitted within your organization, and define your CMMC assessment boundary accordingly. Healthcare contractors often find CUI in contract documentation, research data, and administrative systems that sit alongside or within PHI-handling infrastructure. In complex healthcare settings, it may be necessary to segment research systems from clinical systems, isolate vendor-managed platforms, or restructure network architecture to reduce CMMC scope.
CMMC Level 2 requires formal, repeatable, and enforced security policies. Many healthcare contractors find they need to develop entirely new procedures for access control, audit logging, system monitoring, and risk assessment that go beyond HIPAA or Joint Commission standards. These policies, reviewed by your C3PAO, must be mapped directly to NIST SP 800-171 practice domains and maintained with supporting evidence.
CMMC certification is not a one-time checkbox. It reflects ongoing operational maturity and requires your organization to establish governance structures, assign compliance ownership, and run internal audits to validate that controls are implemented and maintained. For healthcare contractors achieving and maintaining CMMC compliance, lifecycle continuity provides a structured timeline, helping surface gaps that appear across the three year assessment cycle.
“Working with Coalfire Federal for our CMMC Level 2 assessment was a thorough and professional experience from start to finish. Their assessment team demonstrated deep expertise in both the technical requirements and the practical implementation of CMMC controls."
Please note that this FAQ is a summary and should be used in conjunction with the official CMMC documentation for precise guidance and compliance instructions.
CMMC 2.0 is the Department of War's cybersecurity certification framework, designed to protect Controlled Unclassified Information (CUI) across the defense industrial base. For healthcare contractors, Level 2 is the most relevant tier. It requires meeting all 110 security practices in NIST SP 800-171 and, for most organizations, undergoing a third-party assessment conducted by an authorized C3PAO before contract award.
CMMC Level 2 is required for any contractor or subcontractor that handles CUI in support of the DoD. That includes:
Many of these organizations already operate under HIPAA. But HIPAA compliance is not enough. CMMC introduces additional requirements around technical controls, documentation, and maturity that go well beyond privacy rules and breach notification.
Healthcare is one of the most targeted sectors for cyberattacks—and one of the most heavily regulated. DoD healthcare contractors face pressure not only from CMMC requirements, but also from heightened expectations around patient privacy, data integrity, and national security.
Organizations that delay CMMC preparation risk losing federal contracts or facing remediation timelines that disrupt operations. Those who move now can build trust with contracting officers, improve their overall cyber posture, and maintain their eligibility as the DoD tightens enforcement.
Any organization handling CUI for DoD contracts—such as healthcare providers, medical device manufacturers, and health IT vendors—must achieve CMMC Level 2 to remain eligible for defense work.
HIPAA addresses the privacy and security of protected health information (PHI), while CMMC focuses on the protection of Controlled Unclassified Information (CUI) in the context of defense contracts.
The two frameworks share some overlap, particularly around access controls and audit logging, but CMMC introduces requirements that HIPAA does not address, including formal System Security Plans (SSPs), configuration management documentation, media protection controls, and third-party assessment by an authorized C3PAO. Healthcare contractors cannot rely on HIPAA compliance to satisfy CMMC.
Healthcare contractors should begin by conducting a CUI boundary analysis to identify where CUI exists in their environment and establish the scope of their CMMC assessment. A formal gap analysis against NIST SP 800-171 follows, documenting deficiencies in a POA&M and prioritizing remediation.
Organizations should then develop CMMC-specific policies, assign compliance roles, and implement missing technical controls before scheduling a C3PAO assessment. A mock assessment is strongly recommended for organizations approaching their first official evaluation.
Healthcare contractors supporting the DoW or VA that handle CUI cannot rely on HIPAA compliance alone. Coalfire Federal is an authorized C3PAO with nearly 20 years of federal cybersecurity experience, and we work directly with healthcare contractors to close CMMC gaps, define CUI boundaries, and complete official Level 2 assessments. Talk to an expert to understand where your organization stands.
