Cybersecurity of hospitals and healthcare providers

Digitalisation has revolutionised healthcare, improving patient services through innovations such as electronic health records, telemedicine, and AI-driven diagnostics. However, cyberattacks can have severe consequences, including delays in medical procedures, gridlocks in emergency rooms, and disruptions to vital services.

The healthcare sector is one of the most targeted by cyberattacks, with an increasing number of incidents in recent years — more than in any other critical sector in the EU.

It is based on 4 priorities:

• Enhanced prevention. The plan helps to build the healthcare sector's capacities to prevent cybersecurity incidents through enhanced preparedness measures such as guidance on implementing critical cybersecurity practices. Secondly, the Member States may also introduce cybersecurity vouchers to provide financial assistance to micro, small, and medium-sized hospitals and healthcare providers. Finally, EU will also develop cybersecurity learning resources for healthcare professionals.
• Better detection and identification of threats. The cybersecurity support centre for hospitals and healthcare providers will develop an EU-wide early warning service, delivering near-real-time alerts on potential cyber threats, by 2026.
• Response to cyberattacks to minimise impact. The plan proposes a rapid response service for the health sector under the EU cybersecurity reserve. Established in the Cyber Solidarity Act, the reserve provides incident response services from trusted private service providers. As part of the plan, national cybersecurity exercises can take place along with the development of playbooks to guide healthcare organisations to respond to specific cybersecurity threats, including ransomware. Member States are encouraged to request reporting of ransom payments from entities, to be able to provide them the support they need and allow follow-up by law enforcement authorities.
• Deterrence: protecting European healthcare systems by deterring cyber threat actors from attacking them. This includes the use of the cyber diplomacy toolbox, a joint EU diplomatic response to malicious cyber activities.