ISC2 is retiring the HCISPP (HealthCare Information Security and Privacy Practitioner) credential, and its HCISPP page states that the certification will be designated inactive effective 1 December 2026. That leaves current holders, people part way through study and employers who list HCISPP in job specifications with decisions to make. This page is a retirement notice rather than an exam guide: it sets out what ISC2 has published, what is still unclear, and the realistic options for holders and hiring managers. It is written for healthcare security and privacy practitioners, their managers, and anyone who keeps a certification roadmap for a team. Facts were checked against ISC2's public pages in November 2026.
Key takeaways
- The date to plan around is 1 December 2026. ISC2's HCISPP page says the credential "will be designated inactive effective December 1, 2026" and points to a separate sunset notice for detail.
- Do not start a new HCISPP study plan now. With the credential going inactive, time is better spent on a certification that will still be maintained.
- Existing holders should confirm their own position with ISC2. Ask member support in writing how the inactive designation affects your record, annual maintenance fee, CPE cycle and use of the post-nominal, and keep the reply.
- The healthcare knowledge does not expire with the badge. The seven HCISPP domains map well onto broader ISC2 credentials, privacy credentials and HIPAA programme work you can evidence in other ways.
- Employers should update job specifications and supplier requirements. Replace "HCISPP required" with an outcome based requirement or a list of acceptable credentials.
What ISC2 has announced
ISC2's certification page for HCISPP carries the sunset statement in its body text and links to a dedicated notice at isc2.org/notice/HCISPP-Sunset for further information. The certification page and the "how to certify" page say the same thing: the credential will be sunset and designated inactive effective 1 December 2026. Neither page gives a separate last exam date, a figure for the number of holders, or holder specific instructions, so treat any date other than 1 December 2026 that you see elsewhere as unconfirmed until ISC2 states it.
| Item | What ISC2's public pages show (checked November 2026) |
|---|---|
| Status | To be sunset; designated inactive effective 1 December 2026 |
| Further detail | Linked sunset notice at isc2.org/notice/HCISPP-Sunset |
| Required work experience | 2 years |
| Exam outline | Dated September 2019 |
| Domains | Seven (listed below) |
| US DoD | Shown as approved under DoD 8570.1 |
| Last exam date, holder transition | Not stated on the certification pages; confirm with ISC2 |
One detail is worth noting for anyone reading search results: the HCISPP page's metadata description already says the credential "has been sunset", while the body text uses the future tense. The body text, with its specific date, is the statement to rely on.
What HCISPP covered
The seven domains are useful for two reasons after retirement: they tell a holder which skills to evidence in other ways, and they tell an employer which competencies the HCISPP line in a job description was really standing in for.
| HCISPP domain | Where the knowledge is now evidenced | Related NHI Mgmt Group guide |
|---|---|---|
| Healthcare Industry | Sector experience, role history | Healthcare Cyber Regulation Map |
| Information Governance in Healthcare | Governance and risk credentials, policy ownership | ISC2 CGRC Certification Guide |
| Information Technologies in Healthcare | Broad security credentials, clinical system projects | CISSP Certification Guide |
| Regulatory and Standards Environment | HIPAA programme work, privacy credentials | HIPAA Privacy Rule Guide |
| Privacy and Security in Healthcare | Privacy credentials, security operations experience | CIPP/E and CIPP/US Certification Guide |
| Risk Management and Risk Assessment | Risk credentials, completed risk analyses | HIPAA Security Risk Assessment Template |
| Third-Party Risk Management | Vendor and business associate oversight | HIPAA Business Associate Agreements Guide |
Options for current holders
- Get your position in writing: contact ISC2 member support and ask four questions: what "inactive" means for your record and verification, whether annual maintenance fees and CPEs are still due for HCISPP up to 1 December 2026, how you may describe the credential afterwards, and what happens to your digital badge. Save the answer with your CPE evidence.
- Check how the mark rules apply: ISC2's membership policies say use of a certification mark "must be discontinued immediately if the individual does not maintain their certification". Ask ISC2 how that applies once the credential itself is inactive before you change your CV, email signature or LinkedIn profile.
- Keep your other ISC2 credentials current: if HCISPP sits alongside another ISC2 certification, make sure CPE records are allocated to the credential that continues. The Certification Renewal and CPE Requirements Guide covers how CPE cycles work across bodies.
- Choose a successor credential by role: use the decision table below. A healthcare security lead with five years of experience usually looks at CISSP; a privacy lead looks at a privacy credential; a cloud focused engineer looks at CCSP.
- Record the history honestly: list HCISPP with its dates of holding, for example "HCISPP (ISC2), held 2021 to 2026, credential retired by ISC2". Hiring panels understand retirements; an unexplained gap or a lapsed mark presented as current is the problem.
- Evidence the domain knowledge directly: HIPAA risk analyses you led, business associate reviews, incident handling and audit results are stronger proof of healthcare competence than any single credential.
Choosing a successor credential
There is no like for like replacement named on ISC2's HCISPP page, which lists CC, CISSP and SSCP only as general suggested links. Pick on the role you hold or want.
| Your situation | Credential to consider | Why |
|---|---|---|
| Five or more years in security, aiming at lead or manager roles | CISSP | ISC2 lists 5 years of required work experience; broad management scope that covers most HCISPP domains |
| Early career or moving into security from clinical IT | ISC2 CC, then a practitioner credential | ISC2 states no work experience is required for CC |
| Privacy, records or compliance office | CIPP/US or CDPSE | Privacy law and privacy engineering focus, close to the HCISPP privacy domains |
| Risk and governance roles | CGRC or CRISC | Risk assessment and control governance |
| Cloud hosted EHR and health data platforms | CCSP | Cloud security architecture and operations |
For a wider view of where these sit, see the Cybersecurity Certifications Guide.
What employers and procurement teams should change
- Job specifications: replace "HCISPP required" with the competencies behind it (HIPAA Security Rule risk analysis, business associate oversight, healthcare incident response) and an "or equivalent" list of credentials.
- Existing staff: do not penalise holders for a retirement they did not choose. Recognise HCISPP as evidence of past training and agree a successor credential in development plans.
- Contracts and tenders: search supplier questionnaires and framework agreements for HCISPP as a mandatory qualification and amend them before renewal.
- Workforce frameworks: if HCISPP was used to meet a US DoD workforce requirement, check the current qualification lists with the programme owner rather than assuming the old 8570.1 approval carries forward.
- Training budgets: stop funding new HCISPP vouchers and redirect the budget to the successor credentials above.
Common failure patterns
- Booking or continuing HCISPP study without checking the inactive date.
- Assuming a date or holder rule seen on a training provider's site is ISC2 policy.
- Letting CPEs or fees lapse on another ISC2 credential while the HCISPP question is being sorted out.
- Leaving HCISPP as a hard requirement in job adverts and tenders after it can no longer be earned.
- Presenting a retired credential as current on professional profiles.
Practitioner checklist
- Diary 1 December 2026 and review the ISC2 sunset notice for any update.
- Email ISC2 member support with the four holder questions and keep the reply.
- Reconcile CPE records across all ISC2 credentials you hold.
- Pick a successor credential by role and set a target exam window.
- Update CV and profiles to show HCISPP with dates once ISC2 confirms the wording.
- Collect evidence of healthcare security work: risk analyses, BAA reviews, audits.
- Employers: amend job specifications, supplier requirements and training budgets.
Standards and references
- ISC2: HCISPP Certification
- ISC2: HCISPP How to Certify
- ISC2: Membership Policies and Procedures
- ISC2: CISSP Certification
- ISC2: Certified in Cybersecurity (CC)
Related NHI Mgmt Group resources: CISSP Certification Guide · Certification Renewal and CPE Requirements Guide · Cybersecurity Certifications Guide · Healthcare Cyber Regulation Map