HCISPP

ISC2 states on its certification page that the credential will be sunset and will be designated inactive effective December 1, 2026, and points readers to a dedicated sunset notice. Treat the credential as active until that date but plan around it. Check ISC2's own notice for scheduling, exam appointment and membership details before you register.

ISC2 lists two years of required work experience alongside the HCISPP exam outline. The public page does not spell out which roles or substitutions count toward that requirement, and it does not state whether an associate pathway exists. Confirm the exact endorsement and experience rules with ISC2 directly rather than assuming.

Seven domains: Healthcare Industry; Information Governance in Healthcare; Information Technologies in Healthcare; Regulatory and Standards Environment; Privacy and Security in Healthcare; Risk Management and Risk Assessment; and Third-Party Risk Management. The mix is deliberately cross-functional - you are tested on privacy obligations and vendor oversight as much as on technical security controls, so do not study it as a pure security exam.

ISC2 lists compliance officers, information security managers, privacy officers, compliance auditors, risk analysts, medical records supervisors, IT managers, privacy and security consultants, health information managers and practice managers - professionals charged with guarding protected health information. If your work touches PHI governance, vendor contracts or regulatory obligations, the domain list maps closely to your daily tasks.

Start with the healthcare industry and information governance domains, because they supply the vocabulary and organizational context the later domains assume. Then take regulatory and standards, privacy and security, and risk management together, since those three overlap heavily. Finish with third-party risk management, which draws on all of the preceding material.

Two recurring traps. First, treating the exam as general security knowledge and skipping the regulatory and governance domains, which carry real weight. Second, answering from instinct about vendor oversight instead of from a documented, risk-based process. Questions about third parties usually reward the answer that establishes accountability and evidence, not the one that adds a control.

The public ISC2 pages reviewed here do not state the HCISPP exam fee, the number of items, or the appointment length. Those details sit in the exam outline and registration pages. Because the credential has an announced sunset date, confirm fee, format and scheduling windows with ISC2 before paying for training or booking a seat.

ISC2 states the HCISPP is approved under U.S. Department of Defense Directive 8570.1, which matters for roles subject to DoD workforce requirements. That approval is stated on the certification page without a separate expiration date, so verify current status if you are relying on it for a specific position or contract requirement.

It should shape your decision. If you need the credential for a current role or contract before December 1, 2026, the timeline may still work. If you are investing for a long-term credential to display for years, weigh that against the announced inactive date and ask ISC2 what happens to existing holders after it takes effect.