In brief
Healthcare is one of the sectors of high criticality under NIS2. Hospitals, health authorities, private facilities and laboratories that exceed the size thresholds must adopt security measures, notify incidents to CSIRT Italia and answer to management bodies that are personally accountable. On top of this come the resilience of critical entities, the GDPR for health data and, for medical devices, the manufacturers’ obligations that the hospital must know how to ask for.
Who falls under NIS2
Legislative Decree 138/2024 places the following in the health sector, among the sectors of high criticality (Annex I):
- healthcare providers, meaning anyone who legally provides healthcare: hospitals, health authorities, nursing homes, private facilities and laboratories;
- EU reference laboratories;
- those carrying out research and development activities on medicinal products;
- those manufacturing basic pharmaceutical products and pharmaceutical preparations;
- those manufacturing medical devices considered critical during a public health emergency.
Other manufacturers of medical devices and in vitro diagnostic medical devices fall among the other critical sectors (Annex II). The size thresholds normally apply from medium-sized enterprises upwards; local health authorities also appear in the decree’s list of public administrations.
For those entering the NIS list in 2026, the timetable is the one set by ACN: CSIRT contact person by 31 December, incident notification from 1 January 2027, baseline measures by 31 July 2027. We described it in the article on the entities added in 2026.
Critical entities
Legislative Decree 134/2024, which transposes the CER Directive on the resilience of critical entities, also covers healthcare. Those identified as critical entities must assess risks, including non-cyber risks such as natural events, failures and sabotage, adopt resilience measures and notify within 24 hours incidents that significantly disrupt the essential service.
Medical devices: what to ask the manufacturer
Regulation (EU) 2017/745 requires manufacturers to develop device software in accordance with the state of the art, including information security, and to set out the minimum requirements for hardware, networks and IT security, including protection against unauthorised access (Annex I, sections 17.2 and 17.4). The MDCG 2019-16 guidance explains how.
For the hospital this means two things. In the tender, it can ask for that information and for the update plan covering the whole life of the device. On the ward, the information must be used: an inventory of connected devices, separate networks, and access by the manufacturer’s technicians only when needed and logged.
Health data
Health data are special categories of personal data (Article 9 GDPR). A breach must be notified to the Italian Data Protection Authority (Garante) within 72 hours if it poses a risk to individuals, and communicated to the data subjects if the risk is high. After a ransomware attack the decisive question is almost always the same: were the data only encrypted, or were they also taken?
Regulation (EU) 2025/327, published in the Official Journal of the European Union in March 2025, establishes the European Health Data Space and will, in the coming years, also bring requirements for electronic medical record systems.
The framework in one table
| Rule | Who it applies to | What it requires |
|---|---|---|
| NIS2 (Legislative Decree 138/2024) | Healthcare providers, laboratories, pharmaceutical sector, medical device manufacturers, at least medium-sized enterprises; local health authorities | Security measures, incident notification to CSIRT Italia, accountability of management bodies |
| Critical entities (Legislative Decree 134/2024) | Facilities identified by the sector authority | Risk assessment, resilience measures, notification within 24 hours |
| GDPR | Anyone processing health data | Appropriate measures, data protection impact assessments (DPIA), breach notification within 72 hours |
| Regulation (EU) 2017/745 | Medical device manufacturers | Software in accordance with the state of the art and minimum IT security requirements for use |
Not just theory: four cases, two of them Italian
- May 2021, Irish health service (HSE). The Conti ransomware forced the information systems to be shut down: radiology, laboratories and radiotherapy slowed down or stopped, appointments cancelled, staff working on paper. Ireland’s Comptroller and Auditor General counted about €51 million in costs incurred by the HSE in 2021 alone.
- August 2021, Lazio Region. A ransomware attack on the regional data centre made the Covid-19 vaccine booking portal unreachable; bookings were suspended and vaccinations continued with manual procedures.
- May 2023, ASL 1 Abruzzo. The Monti group encrypted the systems: for about two weeks, emergencies only and bookings on paper. It then published hundreds of gigabytes of medical reports and patient records.
- June 2024, Synnovis. The attack on the pathology laboratory serving several London hospitals forced two large London hospitals to postpone, in less than four months, more than 10,000 outpatient appointments and more than 1,700 elective procedures.
The common thread: in healthcare the impact is measured on patients, and recovery times are long even for large, well-structured organisations.
Where to start
- Check whether the facility falls under NIS2, with which classification, and whether it has been identified as a critical entity.
- List the essential clinical processes and the systems they depend on: admissions, emergency department, laboratory, diagnostics, treatments.
- Prepare and test procedures for working without the systems: paper forms, recovery priorities, ambulance diversion.
- Make an inventory of networked medical devices and separate them from the rest of the network.
- Include security requirements in the tender specifications for equipment, clinical software and cloud services.
- Train the medical directorate and the executive management with an exercise on a realistic incident.
How we can help
We support hospitals, healthcare facilities and the pharmaceutical industry with NIS2 compliance, medical device security and ward continuity, taking on the Data Protection Officer (DPO) role when needed.
Our healthcare service →Sources
Legislative Decree 138/2024, Annexes I, II and III; ACN Determinations no. 127434 and no. 127437 of 13 April 2026; Legislative Decree 134/2024; Regulation (EU) 2016/679, Articles 9, 33 and 34; Regulation (EU) 2017/745, Annex I, sections 17.2 and 17.4; MDCG 2019-16; Regulation (EU) 2025/327. Cases: AGI on the attack on the Lazio Region (August 2021); Irish Comptroller and Auditor General, 2022 report on the attack on the HSE; Cybersecurity360 on the attack on ASL 1 Abruzzo (May 2023); NHS England on the attack on Synnovis (update of 26 September 2024).