thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISC2 · Governance, Risk & Privacy · Professional

ISC2 HCISPP exam guide

Exam HCISPP

HCISPP (HealthCare Information Security and Privacy Practitioner) validated healthcare security and privacy knowledge such as HIPAA, risk management and third-party risk. ISC2 has sunset the credential: it is no longer offered to new candidates and will be designated inactive on 1 December 2026, so this page is mainly for existing holders and people looking for a replacement path.

QuestionsSee official page
Time limitSee official page
Passing scoreSee official page
Exam feeSee official page
Valid forSee official page
DeliverySee official page

Format: No longer offered to new candidates. Fee note: ISC2 no longer lists an HCISPP exam price.

Who it's for

Current HCISPP holders deciding what to do after the sunset, and healthcare security or privacy staff looking for an alternative credential.

What the exam covers

Healthcare Industry—
Information Governance in Healthcare—
Information Technologies in Healthcare—
Regulatory and Standards Environment—
Privacy and Security in Healthcare—
Risk Management and Risk Assessment—
Third-Party Risk Management—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: Historically two years of paid work experience; the credential is now closed to new candidates.

Recommended: Not applicable for new candidates.

Keeping it active

None after sunset: the credential becomes inactive on 1 December 2026. It remains visible on holders' ISC2 records, and other ISC2 credentials are unaffected.

Skills & careers

Skills it validates

  • HIPAA and healthcare regulatory compliance
  • Healthcare information governance
  • Privacy and security controls for PHI
  • Healthcare risk assessment
  • Third-party and business associate risk management

Job roles

Healthcare Security AnalystHealthcare Privacy OfficerHIPAA Compliance ManagerHealth IT Risk AnalystClinical Systems Security Specialist

DoD 8140

Listed by ISC2 as approved under the former DoD 8570.01; no longer relevant once inactive. Open the DoD Workforce Navigator

Where it fits in your path

Take before

No prerequisite certification needed.

You are here

ISC2 HCISPP

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Holders: Before 1 December 2026, decide which active credential will replace HCISPP on your resume.
  2. For privacy-focused roles: Plan CIPP/US (covers HIPAA within U.S. privacy law) over 6-8 weeks.
  3. For security roles: Plan CISSP or CGRC, which carry DoD 8140 recognition.
  4. Update your resume and professional profiles to show HCISPP as a past credential after it goes inactive.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • There is no HCISPP exam to sit; do not buy third-party HCISPP prep material.
  • If you need a healthcare-specific credential, compare non-ISC2 options against job postings in your area.
  • CIPP/US is the closest widely recognised privacy credential for U.S. healthcare privacy work.
  • Keep listing HCISPP as an earned credential with dates; it remains part of your history even after it goes inactive.

Key terms for this exam

All 14 terms Study with thinQcards™

Frequently asked questions

Is HCISPP being retired?

Yes. ISC2 has sunset HCISPP and it will be designated inactive on 1 December 2026.

Can I still take the HCISPP exam?

No, it is no longer offered to new candidates.

What happens to my HCISPP?

It loses active status on 1 December 2026; your other ISC2 certifications are not affected.

What should I take instead?

CIPP/US for healthcare privacy, or CISSP/CGRC for security and compliance roles.

Do I still need to earn HCISPP CPEs?

Check your ISC2 account; after the inactive date there is nothing to maintain.

Official page: www.isc2.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.