Beyond Compliance: Why ARC-AMPE Is the New Standard for Trust in Healthcare IT

March 31, 2025

The protection of health information is a national priority. As healthcare delivery systems modernize and cybersecurity threats become more sophisticated, the safeguarding of sensitive data—including Personally Identifiable Information (PII) and Protected Health Information (PHI)—is essential to upholding public trust and ensuring operational integrity. In response to these growing demands, the Centers for Medicare & Medicaid Services (CMS) has introduced Acceptable Risk Controls for ACA, Medicaid, and Provider Entities (ARC AMPE). This new framework replaces the outdated MARS-E standard and aligns healthcare risk and compliance operations with NIST SP 800-53 Rev. 5.