Some U.S. hospitals are falling short in protecting themselves from cyberattacks, with 29 percent of facilities recently surveyed lacking a documented governance, risk, and compliance (GRC) system, a new report from the Department of Health and Human Services (HHS) found.

The report, released Monday, is a forerunner to the creation of new policy requirement practices at hospitals, with guidelines aimed at the protection of patient data. The frequency and complexity of cyberattacks on hospitals is increasing and includes attacks that have resulted in weekslong shutdowns of imaging and laboratory equipment, the HHS said.

Because of the drastic impact such shutdowns can have on patients, especially critically ill people, the Federal Bureau of Investigation now considers attacks on hospital systems “threat-to-life” crimes, the report said.