Product guide
Healthcare Market Index
The Healthcare list of the Market Index compares the DNS posture of US hospitals registered with the Centers for Medicare & Medicaid Services, grouped by who owns them and what kind of hospital they are.
The short answer
Use the Healthcare list to see how hospitals and health systems configure the DNS behind their public websites and email, graded with the Security Posture grade from nine of its cards: Email Security, DNS Security, TLS and Certificates, Website Application Security, Endpoint Security, IP and Asset Reputation, Human and Social Engineering Exposure, Trust Center and Privacy. Brand Protection, Attack Surface, Network Security, Vulnerability Management and Credential Exposure take far more requests or paid services, so they aren’t checked here, and the Security Posture page can grade more areas than the score stored here. Hospitals are a common phishing target, so email authentication (SPF, DKIM and DMARC) carries real weight in these scores.
Filter by ownership or hospital type to compare peers, such as critical access hospitals with each other, then open a hospital’s domain in Security Posture for remediation findings and Domain Visualizer for the records. The Security Posture grade uses different grouping and weights from Market Index.
What is in the list
The list holds the hospitals in the CMS Hospital General Information file: acute care hospitals, critical access hospitals, children’s hospitals, psychiatric hospitals, rural emergency hospitals, and the Veterans Health Administration and Department of Defense hospitals CMS lists. That comes to roughly 5,400 hospitals. A hospital that CMS lists twice at the same address, under an old and a new CMS Certification Number, appears once.
Each row shows the hospital’s name, its domain, its state, its ownership and hospital type, and its latest DNS score and grade. Hospitals that share a name, and there are many Memorial Hospitals, get their state (then their city) added.
Where the data comes from
Names, states, ownership and hospital type come from the Hospital General Information dataset that CMS publishes with Care Compare in its Provider Data Catalog. CMS refreshes it several times a year; the list was built from the 2026 release and is rebuilt when an administrator imports a newer release. Hospitals are identified by their CMS Certification Number (CCN).
The CMS file does not include websites, so each hospital’s domain is added by hand. Only hospitals with a known domain can be scored, which is why coverage grows over time rather than arriving all at once.
How often it is scored
Each organization on the list gets a fresh DNS score about once a month: the list is set to score every 30 days, and the work is spread across the month after the day’s S&P 500 scores, so a few organizations are re-checked every day rather than all of them at once.
A score counts only when every DNS lookup behind it was answered. The page shows each organization’s latest such score and its date, so an older score is labelled rather than hidden. For record-level investigation, open Domain Visualizer; for grades and remediation, use Security Posture. Check the Cached badge and timestamp: saved scans last 24 hours by default and are not necessarily fresh lookups. Query authoritative servers directly for immediate verification.
What the columns mean
Ownership is who runs the hospital, as CMS records it:
| Ownership | What it means |
|---|---|
| Voluntary non-profit (private, church or other) | Private non-profit hospitals, including those run by religious organizations. |
| Proprietary | For-profit hospitals, owned by a company or investors. |
| Government (local, state, federal, or hospital district or authority) | Hospitals owned by a city, county, state, federal agency or a hospital district. |
| Physician | Hospitals owned by the physicians who practice there. |
| Tribal | Hospitals run by tribal governments. |
| Veterans Health Administration, Department of Defense | Federal hospitals for veterans and military personnel. |
Hospital type is the kind of care the hospital provides: Acute Care Hospitals (general short-stay hospitals), Critical Access Hospitals (small rural hospitals with 25 or fewer inpatient beds), Childrens, Psychiatric, Rural Emergency Hospitals, and the acute care hospitals of the Veterans Administration and Department of Defense.
FAQ
Why does a hospital show no score?
Most often because its domain has not been added yet: the CMS file has no websites, so domains are filled in by hand. A hospital with a domain may also be waiting for its turn in the monthly scoring cycle.
Why is a health system’s domain shared by several hospitals?
Many hospitals in one health system use the system’s domain for their website and email. Each hospital is still listed on its own, with the same domain and the same score.
Is the score a rating of the hospital?
No. It measures how one domain’s DNS is configured. It says nothing about patient care, quality ratings or the hospital’s wider security program.