Description
Healthcare organizations classified as critical infrastructure under CIRCIA must prepare for compliance with final reporting rules expected by mid-2026. Once effective, covered healthcare entities must report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours.
Requirements
- Assess CIRCIA covered entity classification for healthcare
- Establish 72-hour cyber incident reporting procedures
- Implement 24-hour ransomware payment reporting process
- Integrate CIRCIA requirements with existing HIPAA incident reporting
- Train incident response team on CIRCIA healthcare requirements
Applicable To
HospitalsHealth SystemsHealthcare Technology ProvidersCritical Infrastructure Healthcare Organizations
Penalty Information
âš Civil enforcement by CISA, including administrative subpoenas for non-compliance.