CIRCIA for Healthcare: Reporting Rules and Preparation

CIRCIA establishes a framework for covered critical infrastructure entities to report covered cyber incidents and ransom payments to CISA. Healthcare teams should prepare their response workflows now, while distinguishing proposed implementation details from reporting obligations that have taken effect.

Understand the proposed reporting clocks

CIRCIA provides for reporting covered cyber incidents within 72 hours after a covered entity reasonably believes one has occurred, and ransom payments within 24 hours after a payment. Coverage, definitions, reporting content, exceptions and implementation timing must be checked against the final rule. Do not assume that every healthcare organization or every security alert falls within the reporting requirement.

Prepare a reporting decision process

Assign responsibility for identifying an incident, deciding which reporting duties may apply, approving a report and retaining records. Include security, legal, privacy, clinical operations and communications teams. Document the facts supporting the assessment and track when the organization learns them. Reassess as the investigation develops.

Keep CIRCIA and HIPAA workflows distinct

CIRCIA and HIPAA address different reporting and notification questions. A healthcare incident may raise obligations under more than one framework, with different scope, recipients and timing. Avoid treating HIPAA’s outer notification limits as a general waiting period or assuming one submission satisfies another obligation. Maintain a reporting matrix that the responsible teams can update as rules change.

Improve asset and communication context

During an incident, responders need to understand the affected devices, workloads, owners and business functions. Correlating identity and asset context with observed communication can support investigation and containment decisions. Preserve the relevant logs and investigation records alongside policy records; a segmentation tool is not a complete forensic or reporting system.

Contain access while continuing the reporting assessment

Reviewed segmentation policies can restrict unnecessary communication and help limit lateral movement. Containment does not automatically remove a reporting obligation or prove that an incident is below a legal threshold. Continue assessing the incident’s facts, impact and applicable rules even when a policy blocks an attempted connection.

Where Elisity fits

Elisity IdentityGraph combines network observations with identity, endpoint, CMDB, IoT and cloud context. Teams use that context to review access policy, simulate changes against observed traffic and enforce approved restrictions through supported infrastructure. The Elisity Assistant helps authorized users investigate devices, traffic and policy in Cloud Control Center. These capabilities support visibility and policy review; they do not guarantee incident-reporting compliance, complete forensic evidence or a particular containment time.

Practice before the rule takes effect

Run a tabletop exercise that includes clinical-system disruption, a compromised third-party connection and a potential ransom payment. Check who can gather the required facts, who approves decisions and how records are retained. Update the playbook against the published final rule before relying on its definitions, exceptions or effective date.

Frequently asked questions

Are CIRCIA reports required from healthcare organizations today?

CIRCIA reporting is not required until the final rule’s effective date. As of October 11, 2026, the final rule is pending OIRA review. Other federal, state, contractual or sector-specific reporting requirements may already apply.

Which healthcare organizations will be covered?

Coverage depends on the final rule’s covered-entity criteria and applicable exceptions. Healthcare-sector membership alone should not be presented as a complete determination. Review the final text against the organization’s size, activities and other relevant criteria.

What are the 72-hour and 24-hour reporting periods?

CIRCIA provides for covered cyber incident reporting within 72 hours after a covered entity reasonably believes a covered incident has occurred, and ransom-payment reporting within 24 hours after payment. Check the final rule for implementation details and its effective date.

Does containment eliminate the need to report?

Not necessarily. Whether an incident is reportable depends on the applicable rule and the facts. A blocked connection or limited spread alone does not establish that no report is required. Continue the reporting assessment with the responsible legal and incident-response teams.

Does a CIRCIA report replace HIPAA notification?

Do not assume that it does. The frameworks address different obligations, recipients and timing. Determine each applicable duty and whether a specific, effective reporting exception or agreement applies.

How can Elisity support incident readiness?

Elisity can provide asset and identity context and help teams review and enforce network-access policy. Use this alongside incident-response tools, investigation records and organizational processes. It is not a guarantee of compliance or a substitute for a reporting decision.

Primary sources

• CISA CIRCIA fact sheet
• OIRA pending review, RIN 1670-AA04
• CIRCIA proposed-rule overview

Explore healthcare microsegmentation