Health-ISAC Hacking Healthcare 9-26-2025
This week, Health-ISAC®’s Hacking Healthcare® provides an update on the current state of CISA 2015 reauthorization. We take a look at where things currently stand regarding the various reauthorization approaches put forward by Congress, we break down the most likely path forward, we analyze the possibility of the law lapsing, and we finish with some considerations for Health-ISAC members.
As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)
PDF Version:
Text Version:
Welcome back to Hacking Healthcare®.
CISA 2015 Update
Despite widespread public and private interest in reauthorizing the U.S. Cybersecurity Information Sharing Act of 2015 (“CISA 2015”)[i], we are rapidly approaching September 30th, the date when the Act is set to expire barring congressional action to extend it. With time running short, let’s assess the options still being considered and breakdown how and why reauthorization is going down to the wire.
Health-ISAC Monthly Threat Brief
Before we dig into CISA 2015, we would like to remind everyone that the Health-ISAC’s Monthly Threat Briefing will be held next Tuesday and Wednesday. Come join your fellow Health-ISAC members as Health-ISAC staff and partner organizations provide an overview of the threat landscape. Presentations include an assessment of emerging malware, APT trends, legal and regulatory issues, physical security concerns, and more. We encourage all Health-ISAC members to take advantage of this service.
CISA 2015 Summary
A brief summary is in order for those not based in the U.S. or who are unclear on what CISA 2015 is and why it is so important.
Signed into law at the end of 2015, CISA 2015 provides guidelines and processes for cyber information sharing within and between the private and public sectors. In addition to defining terms and clarifying what could be shared, CISA 2015’s most important provisions are often considered to be the protections that shield entities from potential legal hazards like antitrust enforcement, Freedom of Information Act (“FOIA”) requests, regulatory enforcement actions, and others. Notably, despite sharing an acronym, CISA 2015 does not have any direct connection to the Cybersecurity and Infrastructure Security Agency (“CISA”).
Since being signed into law, CISA 2015 has enabled cyber information sharing and is widely regarded as a key piece of the cybersecurity ecosystem. However, CISA 2015 was considered to be far more contentious back in 2015 when it was being debated. In particular, privacy concerns around personally identifiable information (“PII”) led to a requirement for private entities to remove PII from cyber threat indicators and defensive measures before they are shared. This and other policy disagreements contributed to the inclusion of a “sunset” provision that would effectively phase out the law on September 30, 2025.
Where Are We Now?
The good news is that there does appear to be a critical mass of bipartisan congressional lawmakers and Trump administration officials, from Secretary Noem to National Cyber Director Cairncross, that support CISA 2015 reauthorization. The bad news is that there is no consensus over exactly what a reauthorization should look like and the path forward isn’t completely clear.
Substantively, there are multiple approaches being debated. The most widely desired approach would be a clean reauthorization of the law. This would be an extension of the effective end date without changing any of the actual language of the law. This approach is the simplest and seemingly avoids the potential for unintended consequences that could arise from revising the language, as well as the risk of opening up new issues related to privacy which had been settled in the 2015 Bill.
There are also some divisions about the length of time for which the law should be reauthorized. Another 10 years would offer stability and predictability, but a shorter extension could provide the time and incentive needed to evaluate and draft improvements informed by stakeholders.
Aside from a lack of consensus on the substantive approach, CISA 2015 reauthorization also needs to find a path through Congress. We will address a few of the prominent CISA 2015 reauthorization efforts in more detail in the Action & Analysis section below, but we are going to focus on the most likely reauthorization path in an attempt to keep things easy to follow.
Path Forward: Continuing Resolution & the National Defense Authorization Act
The current most likely path for a CISA 2015 reauthorization is not a simple standalone bill that is quickly passed by both chambers. Instead, the most likely path runs through a short term extension as part of a continuing resolution (“CR”) and then through the National Defense Authorization Act (“NDAA”).
For those who are unfamiliar, a CR is a “temporary spending [bill] that [allows] federal government operations to continue when final appropriations have not been approved by Congress and the President. Without final appropriations or a CR, there could be a lapse in funding that results in a government shutdown.”[ii] The NDAA is an annual end of year bill that provides appropriations for the Department of Defense (“DOD”). It is generally considered to be a “must pass” piece of legislation that lawmakers attempt to add otherwise unrelated policy matters.
Currently, without the passage of a CR, the government will shut down on October 1 (essentially coinciding with the end of CISA 2015). Both parties are currently debating what a CR should look like, with Republicans arguing for a short term continuation of current spending and Democrats holding out support for policy concessions.
So, what does this have to do with CISA 2015?
As it stands, the House of Representatives version of a CR[iii] includes an extension of CISA 2015 through the length of the CR (November 21). This would give lawmakers time to either pass a standalone bill reauthorization of CISA 2015 or to include it as part of the NDAA. Last week, the House of Representatives version of the CR was passed by their chamber, but failed to receive the necessary number of votes in the Senate to pass that chamber. While the CR can be brought back for another vote, it is not currently scheduled to do so before September 29th.
In the Action & Analysis section below we will dig into what might happen next.
Action & Analysis
**Included with Health-ISAC Membership**
[iv] https://www.congress.gov/bill/119th-congress/house-bill/5079
[v] https://www.congress.gov/bill/119th-congress/senate-bill/1337
- Related Resources & News
- The Video That Plays You: Fake MP4 File Carries Malicious Payload
- Man Against PowerPoint: How Cybersecurity Confused Discussion With Readiness
- AI Pentesting or AI-Powered AppSec?
- Beyond the Hype: What Mythos Actually Means for Security Teams
- Health-ISAC Hacking Healthcare 10-13-2026
- Health-ISAC Urges Validation of Restored Clinical Systems After June Cyber Exercise
- Threat groups ramp up social-engineering attacks against healthcare sector
- The New Dealbreaker in Medical Device Procurement? Cybersecurity
- 2026 Americas Hobby Exercise After Action Report
- Health-ISAC® Director of European Operations Elected European Council of ISACs Chair