Why hospitals could prepare for CIRCIA before CISA wrote its rule

The week

Some laws arrive with a bang. This one arrived tucked inside a spending bill. On March 15, 2022, President Biden signed the Consolidated Appropriations Act, 2022, the omnibus legislation that funded the federal government for the rest of the fiscal year. Division Y of that law was the Cyber Incident Reporting for Critical Infrastructure Act of 2022, known as CIRCIA.

The route to that signature was short but not smooth. A House version of mandatory incident reporting had been attached to the annual defense authorization bill in 2021 and was dropped from the final text in December. In February 2022, Senators Gary Peters and Rob Portman introduced the Strengthening American Cybersecurity Act. It bundled incident reporting with reform of federal agency security law and a statutory footing for FedRAMP, the federal cloud authorization program.

The Senate passed that package by unanimous consent on March 1. The House did not take it up as a standalone bill. Instead, a hybrid of House and Senate reporting language was placed in the omnibus, which the House passed on March 9 and the Senate passed days later. The agency security and cloud provisions were left out. Only incident reporting made it through.

The timing owed a great deal to events. Russia had invaded Ukraine on February 24, and CISA, the federal Cybersecurity and Infrastructure Security Agency, was running its “Shields Up” campaign urging organizations to harden systems and report anything unusual. The Colonial Pipeline ransomware attack of May 2021 and the SolarWinds compromise disclosed in December 2020 had already shown how little the government learned about major intrusions unless the victim chose to tell it. On March 21, the following Monday, the White House warned that evolving intelligence suggested Russia was exploring options for cyberattacks against the United States.

“Critical infrastructure” is the government’s term for the sectors the country cannot do without: energy, water, transportation, financial services, communications and others. Healthcare and Public Health is one of the sixteen designated sectors. The idea behind CIRCIA was to give the federal government fast visibility of serious cyberattacks on these sectors by requiring organizations to tell CISA quickly.

The law set two clocks. Covered entities must report covered cyber incidents to CISA within 72 hours after they reasonably believe one has occurred. The trigger is reasonable belief, not the end of an investigation. They must also report ransom payments made in response to ransomware attacks within 24 hours of payment. Ransomware is malicious software that locks up an organization’s systems or data, usually by encrypting it, with criminals demanding payment to unlock it.

The statute went further than the two clocks. It required supplemental reports when substantial new or different information came to light. It required covered entities to preserve data relevant to an incident or payment. It allowed a third party, such as an incident response firm, an insurer or a law firm, to submit a report on an entity’s behalf. An entity that suffered a covered incident and also paid a ransom could file a single joint report.

What the law did not do was settle the details. Key definitions, including which entities are covered and what counts as a covered incident, were left to a CISA rulemaking, the formal process by which an agency writes binding regulations, consults the public and then finalizes them. The law required a proposed rule within 24 months of enactment and a final rule within 18 months after that. Until the final rule took effect, nobody had to report.

The law also limited how reported information could be used. With narrow exceptions, reports could not be used to regulate the reporting entity or as the basis of an enforcement action against it. Submitting a report would not waive legal privilege, reports were shielded from public records requests, and no lawsuit could be based solely on having filed one. CIRCIA created no fines for late reports. If an entity failed to report, CISA could request information and then issue a subpoena, which the Justice Department could enforce in court.

CISA was made the hub, with a duty to share reports with other federal agencies, and a new Cyber Incident Reporting Council was set up to coordinate the federal government’s many separate reporting requirements. For a hospital chief executive reading the news that week, the message was mixed. A federal reporting duty was clearly coming. Whether it would apply to their hospital, and exactly what would trigger it, would not be known for years. Waiting looked like the obvious response. The smarter one, as it turned out, was to notice which parts were already fixed.

Most laws take effect on a date. CIRCIA would take effect only when CISA finished a rule, and the statute gave the agency more than three years to do so. Hospitals and health systems knew in March 2022 that a federal reporting duty was coming and roughly what it would require. They did not know whether it would cover them or exactly what would count.

Waiting for the final rule was a defensible choice. It was also a missed opportunity, because the statute had already fixed the parts that would be hardest to build. A 72-hour clock would run from reasonable belief, and a 24-hour clock would run from payment. Each clock forces a decision inside incident command, and neither decision depended on how CISA would eventually word its definitions. A third task, reconciling the new duty with the many reporting duties a hospital already owed, was also independent of the details.

Those three tasks form the core of what follows: judging the moment of reasonable belief, reporting a payment within a day, and mapping one incident onto many reports. They are preceded by the setting in which all three would be exercised, a hospital’s incident command during a ransomware attack. They are followed by the case for waiting and its cost, the question of who owns each duty, one hypothetical bad night, the stakes, and the preparation that never depended on the rule.

Incident command meets ransomware

Hospitals are used to emergencies. Most run on a structure called incident command, a standard way of organizing people during a crisis, borrowed from emergency services. When a mass-casualty event or a power failure strikes, a designated incident commander takes charge, roles are assigned, and decisions are logged. The same structure is increasingly used for cyberattacks.

How a hospital organizes a crisis

The version most US hospitals use is the Hospital Incident Command System, an adaptation of the incident command model used by fire services. It gives the incident commander a small command staff, typically a public information officer, a safety officer and a liaison officer. Beneath that sit section chiefs for operations, planning, logistics, and finance and administration. Each role has a job action sheet, a one-page card describing what the person in that role does first.

Accreditation standards and Medicare’s emergency preparedness requirements push hospitals to plan for all hazards and to exercise those plans. Many hospitals now list a cyberattack among their hazards. Fewer have rewritten the job action sheets to say who handles regulatory reporting during one. That gap matters, because the reporting decision does not fit neatly into any of the classic sections.

The first 72 hours of a ransomware attack

A serious cyber incident at a hospital usually unfolds in a recognizable way. Something odd is noticed: systems slow down, files will not open, a ransom note appears on screens. The IT and security teams investigate. If the problem is serious, incident command opens. Clinical leaders decide whether to switch to downtime procedures, the paper-based or manual processes hospitals use when computer systems are unavailable, and whether to divert ambulances to other hospitals. Executives call the cyber insurer, outside lawyers and, often, a specialist incident response firm that helps investigate and recover.

The first day is about containment. Teams isolate network segments, cut external connections and decide which systems can safely stay up. The second and third days are about scoping and stabilization: which systems are affected, whether backups are intact, whether patient data was taken, and whether the attackers are still inside. Communications with the attackers, if any, usually begin in this window too.

In those early hours, almost nothing is certain. Nobody knows how the attackers got in, how far they spread or whether patient data was taken. Investigators, often called forensic teams because they gather evidence, may take weeks to reach firm conclusions. A 72-hour reporting clock therefore runs almost exactly in parallel with containment, when the people who know the most are also the busiest.

Differences by type of hospital

A large academic medical center usually has its own security operations team, in-house counsel and a retained incident response firm. Its challenge is coordination across many people. A rural critical access hospital may have an IT staff of a handful, a hosted electronic health record run by its vendor and a managed service provider watching its network. Its challenge is that the facts needed for a reporting decision may be held by outside companies.

A multi-state system adds another layer. Its incidents may start in one region, affect shared services such as a central data center or revenue cycle platform, and touch facilities that answer to different state health departments. For each of these organizations, the question of who makes the reporting call has a different answer, and none of those answers depends on CISA’s eventual definitions.

Judging the moment of reasonable belief

The 72-hour clock starts when an entity reasonably believes a covered incident has occurred. That is earlier than certainty, and much earlier than the end of a forensic investigation. Someone has to judge, in the first day or two of an incident, whether it meets a threshold the rule would define. That judgment and its timing must be recorded, because the clock runs from it.

Hospitals already make comparable calls under pressure. They decide when to open incident command, when to divert ambulances, when to move to downtime procedures and when to notify their cyber insurer. What CIRCIA added was a documented determination against a federal definition on a short deadline. The work that did not depend on the rule was to name who makes that determination, with a deputy, and what facts they need. The record should show when the belief formed and on what evidence.

What reasonable belief means, and what it does not

Health care compliance teams already knew a similar idea from HIPAA. Under the breach notification rule, a breach counts as discovered on the first day it is known, or would have been known with reasonable diligence. Regulators judge that date with hindsight, by asking what the organization knew and when. A reasonable-belief trigger works the same way. Delaying the formal decision does not delay the clock if the facts already supported it.

Reasonable belief is also not certainty. An organization does not need to know who the attacker is, how they got in or whether data left the network. It needs enough evidence that a reasonable person would conclude a qualifying incident had happened. Ransom notes on screens and an inaccessible scheduling system will usually clear that bar within hours. A single suspicious login probably will not.

An impact-based severity scale

A hospital with a defined severity scale could later map the final definition onto it. A severity scale is a simple ranking, say from one to four, that the security team uses to classify incidents so that everyone knows how seriously to treat them. The statute’s minimum description of a covered incident already turned on substantial loss of confidentiality, integrity or availability, serious impact on the safety of operational systems, or disruption of operations.

Those three terms are worth translating. Confidentiality means information is seen only by people who should see it; a data theft breaks it. Integrity means information is accurate and has not been tampered with; an attacker altering records breaks it. Availability means systems and data are there when needed; ransomware that locks the scheduling system breaks it. A scale that already records those effects for each incident makes the mapping mechanical. A scale that records only technical severity, such as how many servers were affected, makes it a fresh judgment every time.

The clinical side of the hospital supplies some of the clearest evidence. A decision to divert ambulances, cancel elective surgery or move a unit to paper is an operational disruption by any definition. A severity scale that treats those clinical decisions as automatic inputs to the reporting determination saves the decision-maker from having to rediscover them.

Building the determination record

A useful determination record is short. It captures the time of the first anomaly, the time incident command opened, the facts available, which criteria appear to be met, the decision, who made it and why. While the picture is unclear, the decision-maker should revisit it at fixed intervals, every twelve hours for instance, and record each “not yet” as carefully as the eventual “yes.”

That record does several jobs at once. It shows CISA, if asked, when the clock started. It shows HHS, a state regulator or a plaintiff’s lawyer that the organization acted on evidence rather than convenience. It also gives the after-action review something concrete to examine, so the next determination is faster.

Privilege and the provisional report

The determination is at odds with the instinct to wait for facts. Legal teams often prefer to say nothing until an investigation concludes, partly to avoid stating something that later proves wrong. They also commonly retain the forensic firm through outside counsel, hoping to protect its work as privileged. Courts have not always agreed. In 2020, a federal court in the Capital One data breach litigation ordered the company to produce its forensic firm’s report.

CIRCIA tried to ease that tension by providing that a report would not waive privilege. Even so, the safest pattern keeps reports factual: what happened, what was affected, what is being done. Legal analysis stays out. A reasonable-belief trigger does not allow silence until the investigation ends. Incident commanders and counsel needed to agree in advance that an early, provisional report, supplemented later, is the expected pattern.

A report due a day after paying

The ransom payment clock is shorter and simpler. It starts when payment is made. For a health system, the decision to pay is already among the gravest it can face. It weighs patient safety, sanctions exposure, insurance terms, law enforcement advice and reputation, and it is usually taken at the top of the organization with outside counsel and incident response firms involved.

Why the payment decision is already crowded

Sanctions exposure arises because paying a criminal group linked to a sanctioned person or country can itself be unlawful, regardless of the reason for paying. The Treasury Department’s Office of Foreign Assets Control updated its advisory on ransomware payments in September 2021. It discouraged payments, reminded organizations that sanctions liability does not depend on knowing who the recipient is, and said that prompt reporting to authorities and cooperation would weigh in an organization’s favor.

The payment itself usually moves through specialists. A negotiator communicates with the attackers, a firm converts money into cryptocurrency, and an insurer may reimburse some or all of the cost under the policy. Each party keeps its own records. The hospital, which owns the reporting duty, may hold the least detail of anyone.

A county-owned or other public hospital may face one more constraint. Some states began restricting ransom payments by state agencies and local governments in the years after CIRCIA passed. Whether such a law reaches a particular public hospital, and in what form, is a question for counsel. It does mean the payment decision tree can differ sharply between a public hospital and a private nonprofit across the street.

Building the report into the decision

CIRCIA added one more step: a report within a day of payment. The preparation was to make the report part of the payment decision itself. That means a named owner for the report, and a checklist capturing what the report would likely need as the decision is made: the amount, the currency and method, the instructions received, the intermediaries used and the circumstances. Ransoms are commonly demanded in cryptocurrency, digital money transferred over the internet without a bank in the middle, so the method and the trail of the payment matter.

The ransom report duty did not depend on the attack being a covered incident. A ransomware attack too small to meet the incident threshold could still produce a payment report. Hospitals that tied payment reporting to their incident severity scale risked missing that distinction.

Contracts with negotiators and insurers

Payments are often made through a negotiator or incident response firm, specialists who communicate with the attackers and handle the transaction. The statute allowed such a firm to file on the hospital’s behalf, and required a third party that knowingly paid for a covered entity to advise it of its reporting duty. Responsibility still stayed with the hospital.

The engagement letter, the contract that hires the firm, should therefore require it to supply the transaction details within hours. Otherwise the hospital may find, on the day the report is due, that the information it needs is held by a third party busy on someone else’s crisis. Cyber insurance policies often steer the choice of firm through an approved panel. Reviewing those panel firms’ standard terms at renewal, rather than during an incident, is the moment to add the clause. The wider legal questions around payment go well beyond reporting and belong with the hospital’s lawyers.

One incident, many reports

A health system hit by a serious incident may owe several reports at once. HIPAA, the federal law that protects patients’ health information, requires notice of breaches of unsecured protected health information to individuals and to the Department of Health and Human Services, and in larger cases to the media. Notice is due without unreasonable delay and no later than 60 days after discovery. State breach laws add their own triggers and timelines, and some states require notice to the attorney general. Payer contracts, research sponsors, accreditors and cyber insurance policies set further duties, some measured in hours. CIRCIA would add a federal report on a 72-hour clock.

Same incident, different questions

These duties differ in trigger, recipient, deadline and content. A HIPAA breach concerns protected health information. A CIRCIA incident turns on effects on systems and operations. A ransomware attack that halts scheduling without touching patient records could trigger CIRCIA and not HIPAA. A silent data theft might trigger HIPAA long before anyone saw an operational effect.

Insurance notice clauses ask yet another question. Most policies require notice of a claim or a potential claim as soon as practicable, and some require use of the insurer’s chosen vendors to keep coverage. Payer and clearinghouse contracts often ask whether the hospital’s systems can still exchange claims safely. Research sponsors ask whether trial data or blinding was affected. Each question needs a different fact from the forensic team, on a different day.

Why one report would not satisfy everyone

The statute allowed an exception where an entity reports substantially similar information to another federal agency under an agreement with CISA, but whether such agreements would exist was unknown. Hospitals therefore could not assume that one report would satisfy everyone. The same was true of the new Cyber Incident Reporting Council, whose job was to harmonize federal requirements. Its work would take years, and it had no power to rewrite private contracts or state laws.

What banks were building at the same moment

Financial services offers a useful contrast. In November 2021, the federal banking agencies finalized a rule requiring banks to notify their primary federal regulator within 36 hours of determining that a “notification incident” had occurred. Compliance began on May 1, 2022, six weeks after CIRCIA was signed. Banks spent that spring building exactly the determination process this article describes, with a named decision-maker and a recorded time of determination.

Hospitals have no prudential regulator that plays that role. Their nearest equivalents, HHS for HIPAA and state health departments for licensure, ask different questions on longer clocks. A bank chief information security officer in 2022 could look at CIRCIA and see a second version of a duty already being built. A hospital counterpart was looking at something new.

Building and keeping the map

The preparation that made sense in 2022 was a single map of every reporting obligation the organization faced, with its trigger, recipient, deadline, required content and owner. Kept current, and walked through in tabletop exercises, structured rehearsals in which leaders talk through a simulated attack hour by hour, it reduces the risk of missing a deadline during the confusion of an attack.

The map is only as good as the contract inventory behind it. Notice clauses tend to live in payer agreements, research contracts and vendor terms negotiated by different departments. Tagging those clauses in the contract management system when each agreement is signed is the cheapest way to keep the map current. Rebuilding it from scratch once a year, from documents scattered across shared drives, is the most expensive way.

Why waiting is tempting, and what it costs

The hospitals that chose to wait had their reasons. Compliance teams in health care are stretched. They already manage HIPAA, state privacy laws, billing rules, accreditation standards and a steady stream of new federal requirements. Building processes for a rule that might not apply, with definitions that might change, can look like a poor use of scarce time. Some leaders also worried that preparing early would mean rebuilding later once the final text arrived.

The strongest case for waiting

The case for waiting deserves a fair hearing. Coverage thresholds might exclude smaller hospitals entirely, leaving their preparation wasted. CISA might reach agreements with HHS so that one report served both agencies, making a separate CIRCIA process unnecessary. The report form might ask for information so different from what a hospital expected that a pre-built template would need rewriting. And compliance hours spent on CIRCIA were hours not spent on rules with fixed dates, such as the federal information blocking requirements then phasing in.

Each of those points was reasonable. Each argued against building detailed artifacts, such as a CIRCIA-specific report template or a data preservation procedure keyed to rule text that did not yet exist. None of them argued against the decision rights, the determination record, the payment checklist or the reporting map. Those served HIPAA, state laws, insurers and contracts whether or not CIRCIA ever applied.

Separating the fixed from the uncertain

The answer lies in separating what was uncertain from what was not. Coverage was uncertain. The exact definition of a covered incident was uncertain. The content of the report form was uncertain. But the shape of the obligation was fixed in law: a short clock that starts on reasonable belief, a shorter clock that starts on payment, and a new duty that would join many existing ones. Preparing for that shape required no guesswork about the details.

The cost of starting late

The cost of waiting, by contrast, would show up at the worst possible time. A rule that arrives with a modest implementation period leaves little room to design a decision process, renegotiate contracts with incident response firms and rehearse with clinical and legal leaders. Organizations that start then will be building their process under deadline pressure, and possibly in the middle of an incident. That is precisely when shortcuts get taken and deadlines get missed.

There is also an effort curve to consider. Decision rights and a determination record take a few meetings to agree. Contract clauses take a renewal cycle, often a year or more, to work through every relevant agreement. Rehearsal takes at least one tabletop exercise to expose the gaps and another to show they were closed. Starting in 2022 spread that work across ordinary budget cycles. Starting after a final rule compresses it into months.

Duties that fall between chairs

Reporting duties tend to fall between chairs. Security teams see them as legal matters. Legal teams see them as something that follows the technical investigation. Compliance teams may own HIPAA but not insurance or payer contracts. Clinical leaders, whose decisions about diversion and downtime are some of the clearest evidence of operational disruption, are often not in the room when reporting is discussed.

A workable division of labor

A workable arrangement gives each part a clear role. The security leader, or whoever is named in the plan, makes and records the determination. The general counsel’s office owns the decision to file and the wording of reports, with an agreed expectation that early reports are provisional. Compliance owns the reporting map and keeps it current as contracts and laws change. Finance and the executive team own the payment decision and, with it, the payment report. Clinical operations feeds the incident log with the facts about disruption to care.

The board, or its relevant committee, should see the map and the results of exercises at least once a year, so that it knows the organization could meet its obligations on a bad day. Directors do not need the detail. They need assurance that names are attached to each duty and that the names have rehearsed.

How the roles differ by organization

In an academic medical center, the general counsel may be part of a university legal office with its own priorities and hours. Agreeing in advance who from that office joins incident command, and how fast, matters more than in a stand-alone hospital. In a critical access hospital, the chief executive, chief financial officer and a single IT manager may cover every role between them. There, the priority is to write down which outside companies hold the facts and how to reach them at night.

In a multi-state system, the determination is best made centrally, because a covered entity under CIRCIA was expected to be the organization, not each facility. State notices and payer notices, by contrast, often run through regional compliance teams that know local rules. The map should show both levels and the handoff between them.

Placing reporting inside incident command

The simplest structural fix is to add reporting to the incident command chart. Some hospitals assign it to the liaison officer, who already handles outside agencies. Others place it in the planning section, which tracks the situation and documents decisions. Either works if the job action sheet says so explicitly and names the deputy.

Tuesday, 4 a.m.

Suppose staff at a three-hospital system find, at 4 a.m. on a Tuesday, that they cannot open the scheduling and lab systems. Ransom notes appear on several screens. By 6 a.m., incident command is open, the emergency department is on downtime procedures and two hospitals are diverting some ambulances.

Suppose, too, that the system prepared in 2022. Its incident response plan names the chief information security officer as the person who makes the reporting determination, with the deputy general counsel as backup. At 9 a.m. she records her judgment: core operations are disrupted, which fits the severity level the hospital has already mapped to the federal definition. The time and the evidence go into the incident log. The clock, if CIRCIA applies, has started, and the team knows it.

Meanwhile, the compliance lead opens the reporting map. It shows the insurer must be notified within hours under the policy, two major payers within a day under their contracts, and the state health department under its rules. HIPAA notification will depend on whether patient data was taken, which the forensic team cannot yet say; the map notes the 60-day outer limit and the owner. Nobody is hunting through contracts at 10 a.m. trying to remember what they promised.

By the evening of day two, the deputy general counsel has approved a short factual report for filing within the 72-hour window. It describes the affected systems, the operational effects, the containment steps and the fact that the investigation is continuing. It contains no conclusions about how the attackers got in, because nobody knows yet.

On day three, after long discussion with counsel, law enforcement and the insurer, the board decides not to pay. Had it decided otherwise, the checklist for the 24-hour payment report was ready, and the negotiation firm’s contract already required it to hand over transaction details promptly.

On day nine, the forensic firm finds evidence that files from a shared drive holding patient records were copied out before the encryption began. Two things happen. The compliance lead starts the HIPAA analysis, with the discovery date recorded. The security lead prepares a supplemental report, because the new information is substantial and different from the first. Both actions are on the map, with owners.

The preparation cost a few meetings in 2022. Its value is that, on the worst week of the year, leaders spent their time on patients and recovery rather than on paperwork.

Diverted ambulances and missed deadlines

A cyber incident at a hospital can delay care, divert ambulances, disrupt billing for weeks and erode the trust of patients and staff. Reporting duties are layered on top of all that. Missing one can bring regulatory consequences, contract disputes or insurance complications at exactly the moment the organization can least afford them.

What a missed deadline costs

The consequences differ by duty. A late HIPAA notice can draw an Office for Civil Rights investigation, and timeliness of notice is among the issues that office has examined in its enforcement work. A missed insurer notice can give the carrier grounds to contest coverage, at the moment the hospital most needs reimbursement for recovery costs. A missed payer notice can sour a relationship the hospital depends on for cash flow. CIRCIA itself carried no fines, but a subpoena from CISA, and the referral options that follow one, is not a position any hospital wants to explain to its board.

There are softer costs too. Regulators and partners form views about an organization from how it behaves in a crisis. A hospital that reports promptly, accurately and with updates builds credit it can draw on later. One that reports late, or contradicts itself, spends that credit when it can least afford to.

Reporting as a contribution to the sector

There is also a wider purpose. Fast reporting helps the government and the sector see patterns, warn others and respond when an attack spreads. Ransomware groups often hit several hospitals with the same tools and techniques in a short period. A report filed on day two can help CISA and its partners warn the next hospital before its own 4 a.m. call. A hospital that reports well contributes to the safety of others, and benefits when others do the same.

The trade-off in candor

Early reporting has a cost. Provisional reports will sometimes be wrong, and correcting them takes time and care. Some counsel worry that any written account, however factual, may surface in litigation. The statute’s protections reduced that risk without removing it. The trade-off still favors early, factual reporting, because the alternative is a determination record that shows a hospital knew enough and chose to wait. The work of preparing is modest compared with the cost of improvising.

Preparation that never depended on the rule

• A named decision-maker. One person, with a deputy, owns the judgment that an incident is reportable, and records when and why. The role appears on the incident command chart and on a job action sheet.
• An impact-based severity scale. Incidents are graded by their effects on data, safety and operations, as well as by technical measures. Clinical decisions such as diversion feed the scale automatically.
• A determination record. The log captures the first anomaly, the facts known, each “not yet” and the eventual decision, with times and names.
• Payment reporting built in. Any decision to pay includes a report owner, a checklist and contractual duties on negotiators, reviewed at each insurance renewal.
• One reporting map. Every duty, from HIPAA to payer contracts, is listed with trigger, recipient, deadline, content and owner, and fed by tagged clauses in the contract system.
• Rehearsal. The map and the determination process are used in tabletop exercises rather than filed away.

Measures worth tracking

A few simple measures tell leaders whether the preparation is real. In each exercise, how long it takes from the first simulated anomaly to a recorded determination. How many active contracts have their notice clauses captured in the map. Whether every incident response and negotiation firm on the insurer’s panel has agreed to the transaction-detail clause. Whether the named decision-maker and deputy have both taken part in an exercise within the past year.

The failures are predictable: waiting for a final rule before doing anything, assuming legal will “handle reporting” after the investigation, keeping obligations scattered across contracts nobody can find in a crisis, and leaving payment details entirely in the hands of an outside firm.

Before the next 4 a.m. call

• Who decides that a cyber incident is reportable, and who stands in if that person is unavailable?
• Does our incident log record when we first believed something serious had happened, and on what evidence?
• If we ever paid a ransom, who would file the report within 24 hours, and what information would they need?
• Do we have one list of every reporting duty we owe, including payers, insurers, research sponsors and state authorities?
• What is the current status of CISA’s CIRCIA rule, and has counsel confirmed whether and when it applies to us?

Each of those questions should have an answer with a name and a date attached. If the answers took more than a morning to assemble, the gap is in preparation, and it is the same gap whatever the final rule eventually says.

With hindsight

CISA published its proposed rule on April 4, 2024, close to the statutory deadline. Comments closed in early July 2024. The proposal defined covered entities broadly. An entity in a critical infrastructure sector would be covered if it exceeded the Small Business Administration’s size standard for its industry, or if it met a sector-specific criterion.

For health care, those criteria would reach owners and operators of hospitals with 100 or more beds, critical access hospitals, manufacturers of certain essential drugs and manufacturers of higher-risk medical devices. Critical access hospitals are small, usually rural hospitals with a special federal designation; including them signaled that size alone would not keep a hospital out of scope. CISA estimated that about 316,000 entities across all sectors would be covered, and it proposed detailed report content and data preservation duties.

The proposal drew heavy comment on burden and on overlap with other federal reporting regimes. Hospital groups argued for wider exemptions for smaller facilities and for reports to HHS to count toward CIRCIA. The Cyber Incident Reporting Council had already documented the overlap in a September 2023 report to Congress. It counted 45 separate federal cyber incident reporting requirements administered by 22 agencies, and it recommended model definitions, timelines and triggers.

The final rule missed the statute’s October 2025 deadline. CISA moved its target to May 2026 and later to September 2026. A lapse in DHS funding in early 2026 forced the agency to postpone town hall meetings on the rule, and it said the lapse would likely delay the final rule further. The town halls were held instead in June 2026. On October 1, 2026, CISA sent the final rule to the White House Office of Management and Budget for review. As of this writing, the text was not public and reporting was not yet required. Health systems should confirm its scope and effective dates with counsel when it is published.

The wider reporting picture moved faster than CIRCIA did. The SEC began requiring public companies, including investor-owned hospital operators, to disclose material cybersecurity incidents within four business days of a materiality determination from December 2023. New York adopted hospital cybersecurity regulations in October 2024 that included a 72-hour reporting duty to the state health department. HHS proposed a major overhaul of the HIPAA Security Rule in January 2025. That proposal was still not final in October 2026, with its target pushed to 2027.

Meanwhile, the February 2024 attack on Change Healthcare showed how one incident at a single intermediary could disrupt claims and pharmacy services across the country. An intermediary in this sense is a company that connects providers, insurers and pharmacies, passing claims and payments along. When it went down, the effects reached organizations that had never been attacked themselves. UnitedHealth Group’s chief executive told Congress that the company had paid a ransom of $22 million, and the company later estimated that about 190 million people were affected. That episode strengthened the case for fast federal visibility of major incidents, and it showed how many reports a single event can generate across hundreds of organizations.

What held up from 2022 is the shape of the obligation. The 72-hour and 24-hour clocks are in the statute and survived every stage of the rulemaking. What did not hold up was any assumption that the rule would be in force by 2025, or that coverage of smaller hospitals would be settled early.

The health systems best placed for CIRCIA are those that built a documented determination process, a payment reporting step and a single reporting map while the rule was still being written. The delay has wasted none of that work. The same disciplines help with HIPAA, state laws, the SEC, insurers and contracts today. The hard parts of a new obligation are often visible long before the rule is final, and preparing for them is simply good incident management.