EC Unveiled Plan to Protect the Health Sector from Cyberattacks

The European Commission presented an EU action plan to bolster the cybersecurity of hospitals and healthcare providers. This Action Plan was announced in President von der Leyen's political guidelines as a key priority within the first 100 days of the new mandate.

The initiative is an important step in shielding the healthcare sector from cyber threats. Enhancing threat detection, preparedness, and response capabilities of hospitals and health providers, will create a safer and more secure environment for patients and health professionals. Cyberattacks can delay medical procedures, create gridlocks in emergency rooms, and disrupt vital services which, in severe cases, could have a direct impact on the lives of Europeans. Member States reported 309 significant cybersecurity incidents affecting the healthcare sector in 2023, more than in any other critical sector.

The action plan proposes, among others, for ENISA, the EU agency for cybersecurity, to establish a pan-European Cybersecurity Support Centre for hospitals and healthcare providers, providing them with tailored guidance, tools, services, and training. The initiative builds on the broader EU framework to strengthen cybersecurity across critical infrastructure and marks the first sector-specific initiative to deploy the full range of EU cybersecurity measures.

The action plan focuses on four priorities: enhanced prevention, better detection, and identification of threats, response to minimize impacts, and attack deterrence. The EC believes the plan helps build the healthcare sector's capacities to prevent cybersecurity incidents through enhanced preparedness measures such as guidance on implementing critical cybersecurity practices. The Member States may also introduce Cybersecurity Vouchers to provide financial assistance to micro, small, and medium-sized hospitals and healthcare providers. Finally, the EU will also develop cybersecurity learning resources for healthcare professionals.

The Cybersecurity Support Centre for hospitals and healthcare providers will develop an EU-wide early warning service, delivering near-real-time alerts on potential cyber threats, by 2026. The plan proposes a rapid response service for the health sector under the EU Cybersecurity Reserve. Established in the Cyber Solidarity Act, the Reserve provides incident response services from trusted private service providers. As part of the plan, national cybersecurity exercises can take place along with the development of playbooks to guide healthcare organizations to respond to specific cybersecurity threats, including ransomware.

The Action Plan will be implemented hand in hand with healthcare providers, Member States, and the cybersecurity community. To further refine the most impactful actions so that patients and healthcare providers can benefit from them, the EC announced it would soon launch a public consultation on this plan, open to all citizens and stakeholders.