Health Information Sharing and Analysis Center

Health Information Sharing and Analysis Center
Name	Health Information Sharing and Analysis Center
Abbrev	HISAC
Formation	2009
Type	Nonprofit
Headquarters	Washington, D.C.
Region served	United States

Health Information Sharing and Analysis Center

The Health Information Sharing and Analysis Center is an industry-led entity focused on cyber and physical threat intelligence for the healthcare and public health sectors. It functions as an information exchange among major stakeholders including Department of Homeland Security, Federal Bureau of Investigation, National Institutes of Health, Centers for Disease Control and Prevention, and private healthcare organizations such as Mayo Clinic, Kaiser Permanente, Johns Hopkins Hospital, HCA Healthcare, and Trinity Health. Its activities intersect with regulatory frameworks exemplified by Health Insurance Portability and Accountability Act of 1996, Cybersecurity Information Sharing Act of 2015, and standards from National Institute of Standards and Technology and International Organization for Standardization.

Overview

The organization operates as a sector-specific Information Sharing and Analysis Center analogous to counterparts like Financial Services Information Sharing and Analysis Center, Retail Cyber Intelligence Sharing Center, and Energy Information Sharing and Analysis Center, providing situational awareness, incident reporting, and mitigation guidance for participants including American Medical Association, American Hospital Association, Association of American Medical Colleges, and corporate partners such as Microsoft, Cisco Systems, Amazon Web Services, Google Cloud, and IBM. It leverages threat frameworks developed by groups such as MITRE ATT&CK and collaborates with standards bodies like Health Level Seven International and Trusted CI to disseminate advisories to clinical networks, academic medical centers like Cleveland Clinic and Massachusetts General Hospital, and health insurers such as UnitedHealth Group and Anthem Inc..

History and Development

Origins trace to post-2000s initiatives linking cyber policy actors including Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, and federal response agencies like United States Secret Service and Cybersecurity and Infrastructure Security Agency following prominent incidents affecting providers such as Anthem data breach and WannaCry ransomware attack. Early development featured engagements with think tanks such as RAND Corporation, Brookings Institution, and Center for Strategic and International Studies, and legal analysis referencing cases and statutes including Gramm-Leach-Bliley Act and rulings from the United States Court of Appeals for the Ninth Circuit. The organization matured alongside initiatives like National Cybersecurity Center of Excellence and sector risk assessments produced by The White House and National Infrastructure Advisory Council.

Mission and Activities

Its stated mission aligns with sector resilience objectives endorsed by National Health Security Strategy and programs such as Public Health Emergency Preparedness. Core activities comprise real-time indicator sharing, vulnerability notification, coordinated incident response exercises with partners such as Federal Emergency Management Agency, Red Cross, and United States Department of Defense medical commands, and publication of advisories like those modeled after US-CERT bulletins. Services offered to members include threat intelligence feeds interoperable with platforms like Splunk, AlienVault, and FireEye, tabletop exercises with law firms such as Covington & Burling and DLA Piper, and guidance on compliance with frameworks from Payment Card Industry Security Standards Council when applicable to payment systems in healthcare settings.

Organizational Structure and Membership

The governance model resembles other ISACs, with a board including representatives from major hospital systems such as Mount Sinai Health System and academic institutions like Stanford Health Care and University of California, San Francisco Medical Center, and advisory input from federal partners like Office of the Director of National Intelligence. Membership tiers incorporate private-sector vendors, health information exchanges such as eHealth Exchange, regional health collaboratives, and nonprofit organizations like United Way affiliates involved in community health. Technical working groups engage experts from SANS Institute, Electronic Frontier Foundation, and academic research centers such as Johns Hopkins Bloomberg School of Public Health.

Partnerships and Collaboration

Formal partnerships exist with international and domestic bodies including World Health Organization regional offices, European Union Agency for Cybersecurity, Interpol, and national CERTs such as CERT-EU and US-CERT. Collaborative initiatives include joint exercises with Operation Warp Speed stakeholders, interoperability projects with DirectTrust, and advisory roles in standards development with Institute of Electrical and Electronics Engineers. The organization also exchanges intelligence with private-sector Information Sharing and Analysis Organizations like ISAC Council members and works alongside cybersecurity vendors including Palo Alto Networks, CrowdStrike, and Tenable.

Criticism and Privacy Concerns

Critics cite privacy advocates such as Electronic Privacy Information Center and civil liberties organizations including American Civil Liberties Union over potential data sharing that implicates protections under Health Insurance Portability and Accountability Act of 1996 and debates involving Fourth Amendment to the United States Constitution jurisprudence. Concerns raised by policymakers from committees such as the United States Senate Committee on Homeland Security and Governmental Affairs and United States House Committee on Energy and Commerce focus on data minimization, liability protections aligned with Cybersecurity Information Sharing Act of 2015, and transparency in partnerships with technology firms like Palantir Technologies. Academic critiques from institutions including Harvard T.H. Chan School of Public Health and Yale Law School emphasize oversight, auditability, and the risk of mission creep into areas governed by Food and Drug Administration regulation and clinical ethics boards.

Category:Information sharing and analysis centers