Healthcare Threat Intelligence Sharing: Turning Sector Reports into Hospital Action

Healthcare defenders have access to more shared threat information than many teams can process. Government advisories, sector reports, peer exchanges, vendor notices, indicators, and vulnerability alerts arrive every day.

The problem is rarely access alone. The problem is translation.

A hospital must decide whether the reporting applies to its environment, which services may be exposed, what evidence to collect, and what action is justified. A repeatable intelligence-sharing workflow turns external information into local decisions without flooding the SOC.

Treat sharing as a cycle

Intelligence sharing is not an inbox. It is a cycle:

1. Define what the hospital needs to know.
2. Collect from trusted sources.
3. Evaluate relevance and reliability.
4. Enrich with local context.
5. Act through detection, mitigation, or a decision.
6. Share useful findings back when permitted.
7. Review whether the action reduced risk.

HHS maintains HC3 resources to help health organizations maintain situational awareness of current threats and vulnerabilities (HHS HC3 products). CISA and HHS also provide healthcare-specific guidance and tools (CISA healthcare toolkit). These are starting points, not substitutes for local analysis.

Filter through intelligence requirements

Before subscribing to another feed, define the questions it should help answer.

Healthcare examples include:

• Which actors are targeting hospitals of our size or specialty?
• Which exploited vulnerabilities affect our clinical or business services?
• Are vendors with access to our environment under active targeting?
• Which techniques should our detection team prioritize this quarter?
• Are our brands, executives, or patient portals being impersonated?
• Which threats could interrupt care across multiple facilities?

Tag incoming reporting to one or more requirements. If a source never supports a decision, reduce its priority.

Score relevance before urgency

An urgent advisory may not be relevant. A quiet peer observation may be highly relevant.

Evaluate:

• Source reliability: Is the origin known, and does it have direct access to the information?
• Information credibility: Is the claim corroborated or technically supported?
• Local presence: Does the hospital use the affected product, service, domain, or access pattern?
• Exposure: Is the asset reachable in the way the threat requires?
• Clinical consequence: Could exploitation disrupt care, alter data, expose sensitive information, or affect safety?
• Time sensitivity: Is exploitation active, and does action have a narrow window?

Document confidence. “We do not know” is acceptable when followed by a collection plan.

Convert reports into tasks

Each relevant intelligence item should produce a clear next step. Possible actions include:

• Search endpoint, identity, network, and cloud telemetry
• Add or tune a detection
• Validate exposure and patch status
• Restrict a vendor connection
• Brief clinical engineering or application owners
• Preserve evidence
• Update an incident scenario
• Monitor for additional reporting

Assign an owner and a review time. Otherwise, the item becomes another unread artifact.

Share context, not just indicators

An IP address or file hash has a limited shelf life. When sharing is permitted, include context:

• Where the activity appeared
• What preceded and followed it
• Which technology or workflow was involved
• Whether the activity was blocked or successful
• How confident the assessment is
• What information has been removed to protect patients and the investigation

Never include protected health information or unnecessary identifying details. Use the Traffic Light Protocol and organizational handling rules to make distribution expectations clear.

Build a feedback path from operations

CTI improves when the SOC, incident responders, vulnerability teams, and clinical engineers report what happened after they acted.

Ask:

• Did the indicators match anything locally?
• Was the affected product actually present?
• Did the detection produce useful results?
• Was the recommended action safe for clinical operations?
• What additional information would have changed the decision?

This feedback helps analysts improve source selection and future assessments.

Use simple measures

Useful metrics include:

• Time from receipt to relevance decision
• Percentage of high-priority reports tied to an intelligence requirement
• Time from relevant report to completed local search
• Detections or mitigations created from shared intelligence
• Peer reports contributed with safe handling
• Decisions changed because of the intelligence

Avoid counting every indicator as equal value.

The goal is collective warning

Healthcare organizations face many of the same actors, products, suppliers, and fraud patterns. One hospital's observation can become another hospital's early warning.

Sharing succeeds when information is trusted, contextual, and connected to action. The strongest program is not the one that receives the most feeds. It is the one that can quickly explain what a shared report means here, what the hospital should do next, and what it can safely contribute back.