Health-ISAC Fall Americas Summit 2026

Attendees, exhibitors & solutions

Who this event is for

Industry trends

Key trends shaping this market and its wider industry.

Arrival airports

Choose from the following airports, with convenient access to the event and venue.

Hotel tiers

A range of accommodation options near the venue and across key areas.

Local transport

Get around the city with these convenient transport options.

Frequently asked

Glossary

1

Health-ISAC

A non-profit, member-driven organisation that shares cyber and physical threat intelligence among healthcare and public health organisations; it hosts the Fall Americas Summit in Tucson.

2

ISAC

Information Sharing and Analysis Center, an industry body that collects and distributes threat intelligence to its members; Health-ISAC is the healthcare-sector ISAC.

3

CISO

Chief Information Security Officer, the executive accountable for protecting an organisation's data and systems; a core attendee profile at the Fall Americas Summit.

4

TLP (Traffic Light Protocol)

A set of handling rules for sensitive information: TLP:RED is limited to the meeting room, TLP:AMBER to a defined community, TLP:GREEN to the wider sector, and TLP:CLEAR to the public. Summit working sessions frequently run under TLP:AMBER or TLP:RED, which means no posting of slides, screenshots or attendee details on social media.

5

IoMT (Internet of Medical Things)

The network of connected clinical devices such as infusion pumps, patient monitors, imaging systems and implantables. IoMT discovery, patching and segmentation are recurring agenda topics because these devices sit close to patient care and often run unpatched firmware.

6

HSCC (Healthcare Sector Coordinating Council)

A private-sector council that coordinates with US government partners on healthcare cybersecurity, medical device security and resilience guidance; its work products are a common reference point in summit discussions.

7

CIRCIA

The Cyber Incident Reporting for Critical Infrastructure Act, which requires covered critical-infrastructure entities, including much of healthcare, to report significant cyber incidents and ransom payments to CISA within set deadlines.

8

HHS 405(d)

The HHS program that produces the Health Industry Cybersecurity Practices (HICP) guidance, a baseline set of practices health systems use to structure security programs and benchmark their posture.

9

Medical device SBOM

A Software Bill of Materials for a medical device: the list of software components and dependencies inside it. Security teams use the SBOM to trace whether a newly disclosed library vulnerability affects pumps, scanners or monitoring equipment in their estate.

10

Clinical downtime procedures

The paper-based or offline workflows hospitals switch to when EHR, PACS or e-prescribing systems are unavailable. Summit peers compare how long their downtime drills last, which systems fail first and how they communicate with clinicians during a ransomware event.

11

Threat intelligence sharing

The controlled exchange of indicators, tactics and incident lessons between trusted parties. Health-ISAC members share anonymised observations; the summit is where those exchanges move from mailing lists into face-to-face working sessions.

12

Third-party clinical risk

Exposure created by vendors with access to patient data or clinical networks, such as revenue-cycle providers, imaging cloud services and device servicers. Summit sessions examine contract language, breach-notification paths and vendor attestations for these relationships.