The Cyber Incident Reporting for Critical Infrastructure Act of 2022, signed into law on March 15, 2022. It requires covered entities in critical infrastructure sectors to report cyber incidents and ransomware payments to CISA.

Is CIRCIA part of HIPAA?

No. CIRCIA is a separate federal law administered by CISA. HIPAA's own requirements, including breach notification, still apply to dental practices.

What are CIRCIA's reporting deadlines?

Covered entities must report covered cyber incidents to CISA within 72 hours and ransomware payments within 24 hours, and must preserve related data.

When do CIRCIA's reporting requirements take effect?

Only after CISA's final rule takes effect. CISA targeted finalizing the rule in fall 2026; check CISA's CIRCIA page for the current status and which organizations are covered.

URGENT HIPAA UPDATE: WILL CHANGE HOW ALL DENTISTS PRACTICE!

CorrectionUpdated October 2026. CIRCIA is a separate federal law, not a change to HIPAA. It was signed on March 15, 2022, but its reporting requirements apply only once CISA’s final rule takes effect, and that rule will define which organizations count as covered entities. CISA targeted finalizing the rule in fall 2026. See CISA’s CIRCIA page for the current status.

01The Cyber Incident Reporting for Critical Infrastructure Act

Without specialized support for IT, cybersecurity, and HIPAA compliance, you put your practice, employees, patients, and career at risk. Under-protected practices are experiencing compromised data, lost revenue, and damaged reputations. IT, cybersecurity, and HIPAA compliance are glaring weaknesses in the dental industry, and as of 2022, cyber criminals had made dental practices, and the healthcare sector as a whole, the number one target for ransomware and other cyberattacks. The time to put a comprehensive plan in place is now.

On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law. That means specialized support for IT, cybersecurity, and HIPAA compliance isn’t just a nice addition; it could save your practice.

02What does it do?

Direct answerCIRCIA requires covered entities to report cyber incidents to CISA, with escalation to the Department of Justice for non-compliance.

The law requires covered entities to report cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security. CIRCIA creates a partnership between CISA and other federal agencies including Health and Human Services, defines reporting requirements, and establishes escalation to the Department of Justice for non-compliance.

03Who is accountable?

72 hours

To report a covered cyber incident to CISA

24 hours

To report a ransomware payment to CISA

CIRCIA was signed amid a ramped-up focus on cybersecurity and growing concern about retaliatory attacks on the US after Russia’s invasion of Ukraine. It establishes reporting requirements of 72 hours for covered cyber incidents and 24 hours for ransomware payments to CISA by a “covered entity.” Healthcare is one of the sixteen critical infrastructure sectors, and CISA’s final rule will define which healthcare organizations are covered. Covered entities will also be required to preserve data related to an incident. Too many substandard IT practitioners have wiped and reloaded systems without a proper investigation.

04Am I safe?

Many dental practices don’t have the basic but critical infrastructure in place (actively managed firewalls, security software, backups, dental-specific IT, cybersecurity experts, or comprehensive HIPAA compliance management) to prevent, mitigate, or recover from a cyberattack, let alone handle new reporting requirements. Under CIRCIA, covered entities that fail to report can face a subpoena from CISA, and failure to comply may be referred to the Department of Justice. Can you prove that you’re covered?

05But I already have IT

Practices without an adequate plan may already be compromised. With ePHI vulnerable in both server and cloud-based environments, anything less than dental-specific IT leaves you exposed to vulnerabilities, financial loss, downtime, and regulatory consequences. Managed service providers are named in the law. If you don’t have one, you need one.

06What do I do now?

Step one is putting the right prevention measures in place. Professionals with dental industry knowledge can assess your current vulnerabilities, offer solutions to safeguard your practice, and, in the event of an attack, help you meet reporting requirements and recover as efficiently as possible. To learn more about how Darkhorse Tech covers cybersecurity and HIPAA compliance, reach out for a complimentary IT audit.

About Darkhorse Tech

Whether you’re just starting out or a well-established organization, Darkhorse Tech has the experience and technology to help get you moving, cut costs, and streamline your operations with unlimited IT support. We help you do what you do best: provide top-notch care and service for patients, not deal with IT problems, time spent on hold with technical support, or complicated technical mishaps. Our additional security services include:

Unlimited remote and/or on-site IT support of all your hardware and software
Improved network performance and security
HIPAA-compliant off-site and local backup service (Darkhorse Secure Backup)
Managed antivirus, anti-malware, and anti-ransomware (Darkhorse Security Products)
Compliance and security law standards
Microsoft security patch management
Vendor management: we will be on the phone, not your employees
Secure, remote access to your office
Firewall management
Network management
Long-term planning and budgeting

Contact us anytime to learn more about our dental-specific solutions and unlimited support packages. Read our reviews or call us today at 800.868.4504.

Let’s get started

Book a complimentary consultation with Darkhorse Tech.

Complimentary Consultation