HCISPP case studies
HCISPP · Put your knowledge to work in context.
The HCISPP (HealthCare Information Security and Privacy Practitioner) is an ISC2 credential built around a single premise: protecting patient health information requires cybersecurity skill and privacy practice in the same person. ISC2 describes it as the only certification that combines cybersecurity skills with privacy best practices and techniques, and positions it as evidence that a holder can implement, manage and assess security and privacy controls in a healthcare organization using policies and procedures established by ISC2's cybersecurity experts. The HCISPP case studies are 5 cases and about 2,466 words.
1EHR Availability Risk at a 25-Bed Critical Access Hospital
Riverside Critical Access Hospital is a 25-bed facility with 14,000 active patients, three IT staff, and a 2019 on-premises EHR. Eleven days ago a failed RAID controller took the EHR offline for six hours; clinicians used paper order sets, and two medication orders were transcribed late.
478 words, about 2 min2AI Scribe Vendor Uses an Undisclosed Offshore Subcontractor
North Valley Medical Group employs 180 providers across six clinics and contracts with an AI scribe vendor that records visits and generates draft notes. The business associate agreement prohibits subcontractors without written approval and requires PHI to be stored and processed in the United States.
526 words, about 3 min3Nurse Snooping and the Four-Factor Breach Test
Lakeshore Regional Hospital has 300 beds and a mature EHR. A patient complaint prompts an audit: a night-shift nurse accessed 14 patients' records over two months.
487 words, about 2 min442 CFR Part 2 Data in a Regional Health Information Exchange
Riverbend Behavioral Health is a 12-clinician clinic with 800 active patients, including 260 receiving substance use disorder treatment. The clinic joins a regional HIE to improve care coordination.
494 words, about 2 min5Legacy Infusion Pumps and Network Segmentation
Summit Medical Center is a 400-bed hospital with 1,800 networked infusion pumps. A security scan finds 120 pumps running Windows 7 with unpatched vulnerabilities; the manufacturer will not release a patch and plans replacement in 2027.
481 words, about 2 min