Cybersecurity for hospitals and healthcare facilities
In a hospital, a cyber attack does not just stop the offices: it stops the emergency department, the laboratories, diagnostic imaging and the operating theatres. We help health authorities, private facilities, laboratories and the pharmaceutical industry comply with NIS2 and related rules, starting from what must keep working for patients.
When the system stops, it is back to paper
In May 2023 ransomware hit ASL 1 Abruzzo: for about two weeks services were reduced to emergencies, bookings were made on paper, and the criminal group then published hundreds of gigabytes of medical reports and patient records. In June 2024 the attack on Synnovis, the pathology laboratory serving several London hospitals, forced two large London hospitals to postpone, in less than four months, more than 10,000 outpatient appointments and more than 1,700 elective procedures.
The cases are different but the lesson is the same: in healthcare, cybersecurity means continuity of care, and health data remain exposed even after the systems are back up.
- Clinical systems: hospital information system, patient records, emergency department, laboratory, Electronic Health Record (FSE)
- Medical devices: monitors, infusion pumps, networked equipment, often running software that the manufacturer rarely updates
- Diagnostics: MRI, CT, ultrasound scanners and image archives (PACS)
- Building services: medical gases, operating theatre air conditioning, uninterruptible power supplies, building management
- Suppliers: manufacturers’ remote support, cloud services, outsourced laboratories and services
Who is affected
Healthcare is one of the sectors of high criticality under Legislative Decree 138/2024, which transposes NIS2. The size thresholds normally apply from medium-sized enterprises upwards; local health authorities are also included among the public administrations listed in the decree. Inclusion must still be checked case by case, also in the light of registration on the ACN platform.
Other rules add to NIS2: the resilience of critical entities (Legislative Decree 134/2024), the GDPR for health data, the AgID minimum ICT security measures (Circular no. 2/2017) for public administrations and, for medical devices, Regulation (EU) 2017/745.
- Healthcare providers: hospitals, health authorities, nursing homes, private facilities and laboratories
- EU reference laboratories
- Research and development of medicinal products and manufacture of basic pharmaceutical products and pharmaceutical preparations
- Medical device manufacturers: those considered critical during a public health emergency fall among the sectors of high criticality, the others among the other critical sectors (Annex II)
What we do
A hospital cannot shut down a ward to apply a patch. That is why we start from an analysis of clinical processes: which systems are needed to admit a patient, report on a test, administer a treatment, and what happens when they are not available.
For medical devices, Regulation (EU) 2017/745 requires the manufacturer to develop software in accordance with the state of the art, including information security, and to set out the minimum network and security requirements, including protection against unauthorised access. That information should be requested in the tender and used on the ward.
- NIS2 applicability check, registration, baseline measures and notifications
- Inventory of networked medical devices and segmentation of the clinical network
- Security requirements in tender specifications for equipment, clinical software and cloud services
- Procedures for working without the systems, with paper forms and recovery priorities for each ward
- Rules for remote support by suppliers and equipment manufacturers
- Protection of health data and data protection impact assessments (DPIA), including the Data Protection Officer (DPO) role
- ISO/IEC 27001 management systems, with the ISO 27799:2025 controls for healthcare
- War Room exercise on a realistic scenario: emergency department without its information system during a ransomware attack
One incident, several notifications
In healthcare almost every cyber incident involves health data, which the GDPR treats as special categories. That is why the incident management flow must bring together the CISO, the CSIRT contact person, the DPO and the medical directorate, which decides how to protect patients while the systems are down.
- NIS2 (CSIRT Italia): early warning within 24 hours, notification within 72 hours, final report within one month
- Critical entities (Legislative Decree 134/2024): if the incident significantly disrupts the essential service, notification to the sector authority and to the Single Point of Contact within 24 hours
- Italian Data Protection Authority (Garante): within 72 hours, if the personal data breach poses a risk to the data subjects
- Continuity of care: ambulance diversion, postponement of scheduled activities, communication to patients
How we work
The work is carried out by the 823 Consulting staff, coordinated by Giacomo Pesce, CISO at an NIS2 essential entity included in the National Cyber Security Perimeter (PSNC), DPO and ISO/IEC 27001 Lead Auditor. The work relies on Prometeo, the platform we use with clients to keep NIS2 measures, risks, suppliers and evidence together.
- Survey: facilities, wards, systems, devices, suppliers and NIS2 classification
- Impact analysis: what happens to patients if each system stops
- Plan: baseline measures, priorities for each ward, owners and deadlines
- Exercise: a scenario with the medical directorate, IT and the wards
- Review: after incidents, audits and changes of supplier
Sources
Legislative Decree 138/2024, Annexes I, II and III; Legislative Decree 134/2024; Regulation (EU) 2016/679, Articles 9 and 33; Regulation (EU) 2017/745, Annex I, sections 17.2 and 17.4, and MDCG 2019-16 guidance. Cases: Cybersecurity360 on the attack on ASL 1 Abruzzo (May 2023); NHS England on the attack on Synnovis (update of 26 September 2024). Other rules: AgID Circular no. 2/2017; ISO 27799:2025.
Before a ward stops
Tell us how your facility is organised and which systems you use. We will tell you which rules apply to you and where to start.