HCISPP
HealthCare Information Security and Privacy Practitioner
ISC2 certification for healthcare security and privacy. Will be retired in December 2026. Focus on data protection, compliance, and risk management in healthcare. Relevant in the US (HIPAA), less so in Europe.
› Quality score
Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.
› Market signals
public, citable inputs to the recognition score› Built for these roles
› Exam format
No longer offered (last exam Dec 2023)
30/60/90 day waits for retakes 1/2/3 in a rolling 12-month window.
› Recertification
60 CPEs per 3-year cycle until Dec 2026
› 3-year cost of ownership
Excludes study materials, training, retake risk, and lost-wage opportunity. Use as a floor estimate.
› NICE Framework work roles
The NIST NICE work-role IDs this cert maps to. NICCS lookup.
› Core domains covered
The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.
Data classification, encryption-at-rest/in-transit, DLP, tokenization, privacy-by-design, plus the regulatory stack (GDPR, CCPA, HIPAA) that sets the bar.
Risk frameworks (NIST RMF, ISO 31000, FAIR), policy development, audit, regulatory compliance, third-party risk.
› Prerequisites
2 years healthcare security/privacy experience
› Progression
requiredrecommendedWhere this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.
No vendor-gated prereqs.
No certs require this one.
No follow-on certs reference this one yet.
› Study materials
Curated starting points. Not exhaustive — vet each against your learning style and the current exam version.
- Official (ISC)² HCISPP CBK Reference, 3rd Ed. — Wiley/ISC2
- Boson ExSim-Max for HCISPP
› Version & lifecycle
› Salary signal
Healthcare security/privacy practitioner, US, 3-5 years.
Robert Half Salary Guide + Glassdoor 'Healthcare Security Analyst' aggregations · 2024 · US base only · p25–p75 range
› How it compares
HCISPP is healthcare-specific (HIPAA + HITECH); CIPP/US is broader US privacy.
↔ Compare side-by-side› Careers that commonly pursue this cert
Build privacy into systems by design. Navigate GDPR, CCPA, and emerging AI privacy regulations.
See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.