Subscribe
In an increasingly digital world, cybersecurity is a key priority, especially for the healthcare sector, where cyber threats can have direct consequences on people’s lives.
The European Commission has launched an action plan to strengthen the cybersecurity of hospitals and healthcare providers. Announced as a priority within the first 100 days of President Ursula von der Leyen’s new mandate, the initiative marks a major step forward in creating a safe and resilient digital environment.
Digitalisation has transformed the healthcare sector, improving patient services thanks to innovations such as electronic health records, telemedicine and artificial intelligence. However, these advances have also exposed the sector to growing cyber threats. In 2023, Member States reported 309 significant cybersecurity incidents affecting hospitals and healthcare providers, more than any other critical sector. Cyberattacks can jeopardise the continuity of medical services, delay life-saving procedures and disrupt vital public health operations.
The European Commission’s action plan is structured around four key priorities:
-
Strengthened prevention
To prevent cyberattacks, the plan aims to improve the health sector’s ability to prepare and protect itself. The measures proposed include:
Specific guidance on adopting critical cybersecurity practices. Cybersecurity vouchers, aimed at providing financial support to small and medium-sized hospitals and healthcare providers.
Training programmes to raise awareness among healthcare workers about cyber risks and how to mitigate them.
-
Improving threat identification
A central element of the plan is the creation of a Cybersecurity Support Centre for the Health Sector, managed by ENISA, the EU agency for cybersecurity. This centre will develop a pan-European rapid alert service, capable of providing real-time warnings on potential threats, which will be operational by 2026.
-
Rapid response to cyber attacks
To limit the damage of cyber-attacks, the plan proposes the creation of an EU cybersecurity reserve, which will include rapid response services provided by trusted private partners. In addition, national cybersecurity exercises will be organised and operational manuals will be developed to help healthcare organisations respond to specific threats, such as ransomware. Member States will be encouraged to report ransom payments, thus facilitating support and intervention by law enforcement authorities.
-
Deterrence of attacks
To deter cyber threat actors, the plan envisages the use of joint cyber diplomacy tools, a coordinated EU response to counter malicious activities in cyberspace.
The plan will be implemented in close cooperation with Member States, healthcare providers and the cybersecurity community. The Commission will soon launch a public consultation to gather input and further refine the proposed measures. The first actions will be progressively implemented by 2025 and 2026. The Action Plan builds on an existing legislative framework to strengthen cybersecurity in the EU, including the NIS2 Directive and the Cyber Resilience Act. These laws introduce stringent obligations for healthcare organisations, ensuring they take adequate measures to protect their systems. In addition, the Cyber Solidarity Act, which entered into force in December 2024, established an emergency mechanism to improve cooperation between Member States and strengthen the EU’s response capabilities to cyber threats. The ultimate goal of the Plan is to ensure that digital healthcare is safe, resilient and trustworthy. Creating a secure digital infrastructure is essential for the full implementation of the European Health Data Space, which aims to put citizens at the centre of their healthcare by giving them full control over their data. At a time when cybersecurity is a global challenge, the European Commission’s initiative marks a significant step forward in protecting one of the most critical sectors for the well-being of European citizens. Through prevention, threat identification, rapid response and deterrence, the action plan aims to safeguard not only digital infrastructures, but also citizens’ trust in modern and innovative healthcare.
Alessandro Fiorentino