The Commission has presented an EU action plan aimed at strengthening the cybersecurity of hospitals and healthcare providers.
The initiative is an essential step in shielding the healthcare sector from cyber threats.
Digitalization is revolutionizing healthcare, enabling better patient services through innovations such as electronic health records, telemedicine, and AI-driven diagnostics. However, cyberattacks can delay medical procedures, create gridlock in emergency rooms, and disrupt vital services, which, in severe cases, could directly impact the lives of Europeans.
Member States reported 309 significant cybersecurity incidents affecting the healthcare sector in 2023 – more than in any other critical sector.
The action plan proposes, among others, for ENISA, the EU agency for cybersecurity, to establish a pan-European Cybersecurity Support Centre for hospitals and healthcare providers, providing them with tailored guidance, tools, services, and training. The initiative builds on the broader EU framework to strengthen cybersecurity across critical infrastructure and marks the first sector-specific initiative to deploy the full range of EU cybersecurity measures.
EU action plan centers on four critical priorities
Enhanced prevention. The plan helps to build the healthcare sector’s capacity to prevent cybersecurity incidents through enhanced preparedness measures such as guidance on implementing critical cybersecurity practices. Secondly, the Member States may introduce Cybersecurity Vouchers to provide financial assistance to micro, small, and medium-sized hospitals and healthcare providers. Finally, EU will also develop cybersecurity learning resources for healthcare professionals.
Better detection and identification of threats. The Cybersecurity Support Centre for hospitals and healthcare providers will develop an EU-wide early warning service, delivering near-real-time alerts on potential cyber threats, by 2026.
Response to cyberattacks to minimise impact. The plan proposes a rapid response service for the health sector under the EU Cybersecurity Reserve. Established in the Cyber Solidarity Act, the Reserve provides incident response services from trusted private service providers. As part of the plan, national cybersecurity exercises can take place along with the development of playbooks to guide healthcare organisations to respond to specific cybersecurity threats, including ransomware. Member States are encouraged to request reporting of ransom payments from entities, to be able to provide them the support they need and allow follow-up by law enforcement authorities.
Deterrence: Protecting European healthcare systems by deterring cyber threat actors from attacking them. This includes the use of the Cyber Diplomacy Toolbox, a joint EU diplomatic response to malicious cyber activities.
The Action Plan will be implemented hand in hand with healthcare providers, Member States, and the cybersecurity community. To further refine the most impactful actions so that patients and healthcare providers can benefit from them, the Commission will soon launch a public consultation on this plan, open to all citizens and stakeholders.
First step toward stronger healthcare cybersecurity
The action plan is the start of a process to improve cybersecurity in the healthcare sector. Specific actions will be rolled out progressively in 2025 and 2026. The results of the consultation will feed into further recommendations by the end of the year.
The EU works on various fronts to promote cyber resilience and protect its citizens and businesses from cyber threats. This action plan responds to the urgency of the situation and the unique threats facing the sector. It builds on the existing legislative framework in the field of cybersecurity.
Hospitals and other healthcare providers are established as a sector of high criticality under the NIS2 Directive. The NIS2 cybersecurity framework works hand in hand with the Cyber Resilience Act, the first-ever EU legislation placing mandatory cybersecurity requirements for products that include digital elements, which entered into force on 10 December 2024.
The Commission has also put in place a Cyber Emergency Mechanism under the Cyber Solidarity Act which reinforces the EU’s solidarity and coordinated actions to detect, prepare and effectively respond to growing cybersecurity threats and incidents.
Ensuring a resilient and secure digital infrastructure is essential for the full deployment of the European Health Data Space which will place citizens at the centre of their healthcare, granting them full control over their data.
“Modern healthcare has made incredible advances through digital transformation, which has meant citizens have benefited from better healthcare. Unfortunately, health systems are also subject to cybersecurity incidents and threats. That is why we are launching an Action Plan to ensure that healthcare systems, institutions and connected medical devices are resilient. Prevention is better than cure, so we need to prevent cyber-attacks from happening. But if they happen, we need to have everything in place to detect them and to quickly respond and recover,” said Henna Virkkunen, EVP for Tech Sovereignty, Security and Democracy.