Cybersecurity in Healthcare: Protecting Patient Data, Ensuring Continuity of Care and Strengthening the Resilience of the Health System

Authors:

Artem Honcharenko, PhD — President of the International Technology Transfer Association (ITTA), expert in digital transformation, artificial intelligence, technological innovation and international technology transfer, Head of the Veterans Institute “Architecture of Resilience” of KNUBA

Mykhailo Vasianovych, CEO of SmartGT, expert in digital transformation and AI, Senior Research Fellow at the National Institute for Regional Development, Director of the NGO “NAMIR Charitable Foundation”, coordinator of the VCU AI Incubator.

Andrii Stanko, PhD, Senior Lecturer at the Department of Computer-Integrated Technologies, Ternopil Ivan Puluj National Technical University. Lecturer at the Information Technology Centre of TNTU

The digitalisation of healthcare has changed the very nature of cyber risk. Electronic health records, laboratory information systems, telemedicine, digital prescriptions, medical devices, cloud services, insurance settlement systems and national registries offer significant benefits to patients, but at the same time make information infrastructure part of the process of delivering care. Cybersecurity in healthcare is therefore no longer just a matter of confidentiality. It is a matter of patient safety, continuity of treatment, the integrity of clinical decisions and the resilience of the public health system. The US Department of Health and Human Services states the principle directly: Cybersecurity is patient safety. [1]

The article on the PRAVO.UA portal, “Cybersecurity in Healthcare: How to Protect Patient Data in the Digital Age”, focuses on three basic properties of protected information — confidentiality, integrity and availability. A particular role is played by the human factor, access control, staff training and the legal regime governing medical information. For Ukraine, these points are borne out by the Law “On Personal Data Protection”, the legislation on information protection and cybersecurity, the rules of the Electronic Health System (eHealth, ESOZ) and the 2025 reform of the national cyber incident response system. [2]

Global experience shows that the most dangerous consequence of an attack on healthcare is often not the theft of a file as such, but the loss of the system’s ability to function. The WannaCry ransomware attack in May 2017 led to the cancellation of thousands of appointments in the National Health Service of the United Kingdom. The 2021 attack on the Health Service Executive of Ireland began with a phishing email and ended in a large-scale shutdown of systems.

The 2024 cyberattack on Change Healthcare disrupted prescription and payment flows across a significant part of the American healthcare system. The attack on the British laboratory provider Synnovis led to the delay of more than 11,000 outpatient appointments and elective procedures. [3]

The scale of a breach can also be systemic. Anthem reported almost 79 million people affected; SingHealth, Singapore’s public healthcare network, almost 1.5 million; the Australian health insurer Medibank about 9.7 million; and the US Department of Health and Human Services, as of July 2025, recorded about 192.7 million individuals whose information was affected by the Change Healthcare incident. [4]

The regulatory model is also changing. In the EU, the NIS2 Directive (the EU Directive on the security of network and information systems) moves cybersecurity from an “IT function” into the sphere of management accountability and requires risk management and multi-stage reporting of significant incidents. The EU General Data Protection Regulation (GDPR) separately governs personal data breaches; the regulation on the European Health Data Space (EHDS) adds a new layer of rules for electronic health data and electronic health record (EHR) systems. [5]

In the United Kingdom, the National Health Service (NHS) is moving to assessment through the Data Security and Protection Toolkit (DSPT), aligned with the Cyber Assessment Framework (CAF) of the UK National Cyber Security Centre (NCSC). [6]

The United States combines the mandatory rules of the Health Insurance Portability and Accountability Act (HIPAA) — the Security Rule and the Breach Notification Rule — with the voluntary Healthcare and Public Health Sector Cybersecurity Performance Goals (HPH CPGs). [7] Japan, Israel, Australia and Singapore demonstrate different but increasingly similar models: sector-specific rules, mandatory risk management, notification of government authorities, staff training and heightened accountability of senior management. [8]

The key conclusion for a healthcare facility: it is impossible to build sufficient cyber resilience with antivirus software, a security operations centre (SOC) or a privacy policy alone. Work is needed simultaneously in at least six areas: governance, identity and access management, segmentation and backup, protection of medical devices and suppliers, incident response / business continuity, and continuous training of staff.

For Ukraine this is especially important because of its dual context: large-scale digitalisation of healthcare services and the ongoing war. In April 2026, CERT-UA directly reported a cluster of cyber threats whose targets included hospitals. [9] Accordingly, the cyber resilience of a healthcare facility should be regarded as a component of clinical safety, civil resilience and national security.

What Cybersecurity in Healthcare Means and Why Its Risks Are Special

It is important to start not with technology but with the legal status of medical data: digital healthcare works with one of the most sensitive categories of information about a person, and cyber protection must therefore ensure the realisation of the patient’s right to confidentiality. [10]

In practical terms, cybersecurity in healthcare is a set of managerial, legal, organisational, technical, clinical and educational measures that ensure:

It is availability that distinguishes healthcare from many other sectors. In a bank, system unavailability means a delayed payment; in a hospital, it can mean being unable to quickly see test results, carry out a diagnostic examination, confirm a blood group, retrieve an allergy history or properly organise surgery. The experience of the National Health Service of the United Kingdom (NHS), the Health Service Executive of Ireland (HSE), the American company Change Healthcare (an operator that processes medical payments and insurance claims) and the British laboratory services provider Synnovis shows that cyberattacks can translate directly into operational disruption of care delivery. [11]

Medical data has a long life cycle. A bank card can be reissued, but genetic characteristics, medical history, a psychiatric diagnosis or the fact of a particular treatment cannot be “replaced”. That is why the European GDPR (the EU General Data Protection Regulation) classifies health data as a special category of personal data and establishes an enhanced legal regime for its processing. [12]

Healthcare has an exceptionally wide range of vulnerabilities. A typical hospital runs many different medical information systems at once: an electronic health record (EHR) and a hospital information system (HIS), a picture archiving and communication system (PACS), specialised systems that automate laboratory (LIS) and radiology (RIS) work, pharmacy systems, accounting, access control systems, email, a virtual private network (VPN), Wi-Fi, servers, cloud services, patient portals, hundreds or thousands of workstations, and network-connected medical devices. As a result, the compromise of a single weak component or contractor can open a path to more critical systems. This is why the US Department of Health and Human Services (HHS) includes in its Healthcare Cybersecurity Performance Goals separate requirements on multi-factor authentication, separation of privileged accounts, vulnerability management, and response to risks and incidents involving third parties. [13]

The supply chain is part of clinical risk. Change Healthcare and Synnovis showed that the compromise of a single service node can affect a large number of independent healthcare organisations. Change Healthcare supported critical transactional processes between insurers, pharmacies and healthcare providers, while Synnovis provided laboratory services for several NHS organisations. [14]

The human factor remains critical — phishing, passwords, employee errors and the need to develop a cyber culture. Practice confirms this.

Public health risk differs from the risk to an individual hospital. A cyberattack on vaccination registries, laboratory networks, epidemiological surveillance, infectious disease reporting systems or national exchange of medical data can degrade the quality of the data that the state uses to assess threats. It is precisely the link between electronic health data and potential health threats and future pandemics that is built directly into the logic of the European Health Data Space (EHDS). [17]

In Europe, the problem is systemic in nature. ENISA (the European Union Agency for Cybersecurity), analysing 215 publicly known incidents in the healthcare sector from January 2021 to March 2023, found that ransomware accounted for 54% of the cases examined; 53% of incidents affected healthcare providers, and 42% specifically hospitals. [18] In more recent ENISA material covering 2024, ransomware accounted for approximately 45% of health-related incidents, and data breaches for about 28%. [19]

ENISA data; the two largest categories are shown, so the values should not be interpreted as a complete, mutually exclusive breakdown of all types of incidents. [19]

The Ukrainian context. Official materials of the Electronic Health System (eHealth, ESOZ) describe the separation of personal and medical data, controlled authentication and authorisation, the use of a qualified electronic signature (QES) and two-factor authentication, access restrictions and a comprehensive information protection system. The National Health Service of Ukraine (NHSU) is the owner of the central eHealth database, and the State Enterprise “Electronic Health” is responsible for its administration. [20]

Following the 2025 changes, Ukrainian legislation additionally formalised the national cyber incident response system, the information-sharing system and the role of cyber defence of critical information infrastructure. [21] CERT-UA, operating under the State Service of Special Communications and Information Protection, receives incident reports, investigates them, assists with the remediation of consequences and coordinates the exchange of information on cyber threats. [9]

This means that, for Ukrainian healthcare, the model of “protecting the patient database” is no longer sufficient. It is necessary to protect simultaneously the data, the treatment process, fallback procedures and the facility’s ability to keep operating during an attack.

Major Healthcare Cyber Incidents: What Actually Happened and What They Taught Us

The most valuable material for building cyber resilience is not a list of “frightening breaches” but an analysis of precisely which protective barriers failed and what happened to clinical processes after the compromise.

Summary timeline

Anthem showed the price of lost confidentiality. The HHS OCR called the incident the largest data breach to date and in 2018 reached a $16 million settlement with Anthem, adding an extensive corrective action plan. [22] This is an important precedent: the regulator assesses not only the fact of the breach, but also whether risk analysis, access management and security controls were adequate.

WannaCry showed the price of technical debt. According to the findings of the UK National Audit Office, the affected organisations were using Windows systems without installed updates, or systems for which support had been discontinued; basic measures such as applying updates and managing firewalls could have prevented a significant share of the infections. At the same time, the official authorities did not establish any theft of patient data — the clinical risk arose primarily from the unavailability of systems. [23]

SingHealth showed the danger of late escalation. Initial access was probably gained as early as August 2017 through phishing. The attacker then spent months moving across the network, compromising endpoints, servers and administrator accounts. IT staff noticed anomalies as early as June 2018, but senior management and the Cyber Security Agency of Singapore (CSA) were informed much later. [29] The Committee directly linked the problem to insufficient cybersecurity awareness, a lack of training and resources, and weak escalation. [30]

The HSE showed how long the post-incident period can be. The phishing email was received in March 2021, and the ransomware was activated in May. Years after the attack, the HSE continued monitoring and notifying individuals whose documents had been unlawfully copied. [31] Incident response in healthcare does not end at the moment when “the servers are working again”: digital forensic examination, determination of the scale of the data breach, notification of patients, legal proceedings, monitoring, lessons-learned analysis and the rebuilding of controls all continue afterwards.

Medibank showed the risks of the supply chain and of credential protection. The Australian regulator’s materials describe the compromise of credentials associated with an IT contractor’s employee and security alerts that were not properly handled. The Office of the Australian Information Commissioner (OAIC) asserts that Medibank did not take sufficient steps to protect the sensitive data of 9.7 million people; the case was referred to the Federal Court of Australia. [32]

Change Healthcare is perhaps the clearest lesson on multi-factor authentication. In the testimony of the Chief Executive Officer of UnitedHealth Group before the US Senate Committee on Finance, it was stated that the attackers used compromised credentials to log in to a Citrix portal that had no multi-factor authentication; after gaining entry, they moved across the network, exfiltrated data and, nine days later, deployed ransomware. [33] Recovery required replacing thousands of laptops, changing credentials, and rebuilding the data centre network and key services. [34] By 26 April 2024, UnitedHealth Group reported more than $6.5 billion in accelerated payments and interest-free assistance to healthcare providers to support their liquidity. [35]

Synnovis showed the systemic risk of outsourcing. The victim was not an individual hospital but a laboratory services provider. The consequence was a collapse of laboratory capacity at once in several organisations of the National Health Service of the United Kingdom and more than 11 thousand postponed appointments and procedures. [36] This is an argument for ensuring that a hospital’s business continuity plan covers not only its own data centre but also the failure of a critical external supplier.

These cases reveal a fundamental pattern: a catastrophic outcome is rarely explained by a single “brilliant hacking technique”. Most often it is a chain of ordinary weaknesses: phishing → compromise of credentials → absence of multi-factor authentication → excessive privileges → insufficient segmentation → late escalation → a backup that was never tested → no plan for delivering care while information systems are unavailable.

How Healthcare Cybersecurity Is Organised in Different Jurisdictions

For additional comparison, besides the EU, the United Kingdom, the USA, Japan and Israel, Australia and Singapore have been selected. Australia is of interest for its combination of a general privacy law (the Privacy Act), mandatory data breach notification and a critical infrastructure protection regime; Singapore for its high level of digitalisation, centralised cyber policy and very concrete financial support for cybersecurity in healthcare.

European Union. Several levels of regulation operate here simultaneously. The GDPR protects personal data and recognises health data as a special category; the articles on security of processing and breach notification form the privacy-protection layer of cybersecurity. In the event of a personal data breach, the controller, as a rule, notifies the supervisory authority within 72 hours if the breach may create a risk to the rights and freedoms of individuals; in the case of a high risk, an obligation to notify the data subjects themselves may also arise.

NIS2 covers the healthcare sector as a sector of high criticality and requires cybersecurity risk-management measures. For significant incidents, a multi-stage model is provided: an early warning within 24 hours, an incident notification within 72 hours and a final report, as a rule, no later than one month afterwards. For essential entities, the directive requires that the maximum administrative fines in national law be at least €10 million or 2% of worldwide annual turnover. NIS2 is applied through the national laws of the Member States, so the competent authorities and procedural details differ. [38]

Regulation 2025/327 on the European Health Data Space (EHDS) creates yet another layer: rules on citizens’ access to electronic health data, cross-border use through the MyHealth@EU platform, secondary use through health data access bodies, and requirements for electronic health record (EHR) systems. The regulation was adopted in 2025 and is being introduced gradually, so in 2026 it is more accurate to see it as a transformational framework that is being rolled out, not as a system that has been completed at a stroke. [39]

The EU has also adopted a separate Action Plan on the cybersecurity of hospitals and healthcare providers. The European Commission envisages a dedicated support centre, early-warning mechanisms, training and the possibility of providing cyber vouchers to smaller healthcare providers. In July 2026, ENISA announced a three-year agreement with the Commission on a contribution of €6 million to support the implementation of this strand of work. [40] The broader Cyber Solidarity Act, which entered into force in 2025, creates the European Cybersecurity Alert System and an EU Cybersecurity Reserve for responding to major incidents. [41]

United Kingdom. In the healthcare sector in England, the competent authority under the Network and Information Systems Regulations 2018 (NIS Regulations) is the Department of Health and Social Care (DHSC); the official sector guidance sets out duties concerning security, incident reporting and enforcement, with possible fines of up to £17 million. [42] In parallel, the UK GDPR (the British version of the General Data Protection Regulation) requires the Information Commissioner’s Office (ICO) to be notified of reportable data breaches, as a rule within 72 hours, and, in the case of a high risk, requires the affected individuals to be informed without undue delay. [43]

The evolution of corporate governance in the NHS is particularly important. In its 2026 guidance, NHS England states that organisations directly providing healthcare must be assessed under the Data Security and Protection Toolkit (DSPT), aligned with the NCSC Cyber Assessment Framework (CAF). Oversight by the board and senior management must cover cyber risk management, protection against attacks and data breaches, threat detection, minimisation of impact, and the proper use and sharing of data. [6] This shifts cybersecurity from the “responsibility of the IT manager” to board-level accountability.

USA. The HIPAA Security Rule (HIPAA being the American law on the protection of health information) requires organisations covered by HIPAA, and their business associates, to protect electronic protected health information (ePHI) by means of administrative, physical and technical safeguards and to ensure its confidentiality, integrity and availability. [44]

The HIPAA Breach Notification Rule uses a different timing model from the GDPR. A breach affecting 500 or more individuals must be reported to the Secretary of Health and Human Services without unreasonable delay and no later than 60 calendar days after its discovery; for smaller breaches, an annual consolidated notification within the prescribed deadline is permitted. Individual notifications must likewise be sent without unreasonable delay and no later than 60 days. [45]

In parallel, HHS developed the Healthcare and Public Health Sector Cybersecurity Performance Goals — a voluntary sector baseline built on the practices of HICP (Health Industry Cybersecurity Practices), NIST (the US National Institute of Standards and Technology) and CISA (the US Cybersecurity and Infrastructure Security Agency). Priorities include: system vulnerabilities, email security, multi-factor authentication (MFA), encryption, unique credentials, separation of privileged accounts, network segmentation, incident response plans and third-party risks. [13]

After the Change Healthcare incident, the federal debate intensified considerably, but it is important not to confuse rules in force with reform proposals. For example, in its current materials on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), CISA stated that the obligations of the organisations to which it will apply will take effect only after the final rule enters into force; accordingly, the deadlines proposed under CIRCIA should not automatically be treated as an already binding universal obligation for every hospital. [46]

Japan. The principal regulator in the field of privacy protection is the Personal Information Protection Commission (PPC), and the basic law is the Act on the Protection of Personal Information (APPI). [47] The Ministry of Health, Labour and Welfare (MHLW) has its own well-developed system of cybersecurity guidelines for healthcare. In 2026, the MHLW continued to publish security alerts, checklists, guidelines for medical information systems and training programmes, and to maintain a channel for reporting cyber incidents. The Ministry expressly asks healthcare institutions to promptly notify it of cyberattacks or suspected attacks. [48]

Where a breach or a likely breach of personal data occurs, including health data, an obligation to report to the PPC also arises. The PPC requires prompt preliminary notification; where malicious activity is suspected, a final report must be submitted within 60 days of discovery. Among the examples of reportable events expressly given by the PPC are unauthorised access and ransomware. [49]

The Japanese model is also interesting for its funding: the MHLW has separate programmes for security assessment of healthcare organisations, training and consultancy, and, through government support mechanisms for small and medium-sized businesses and for IT, it can subsidise the adoption of specified cybersecurity services. [50]

Israel. Here, the protection of health data rests on the Privacy Protection Law and the Privacy Protection Regulations (Data Security) of 2017. The Regulations differentiate requirements according to the security level of the database and cover security policy, asset inventory, risk assessment, physical protection, access control, authentication, logging, incident documentation, outsourcing, backups and audits. In the event of a serious security incident, the relevant databases are subject to a requirement to notify the Registrar of Databases without delay. [51]

Amendment 13 to the Privacy Protection Law entered into force on 14 August 2025 and substantially expanded enforcement powers, financial sanctions and the obligation to appoint a data protection officer (DPO) for specified categories of organisations; official Israeli guidance expressly names hospitals and health funds among such entities. [52]

At the cybersecurity level, state cyber policy is coordinated by the Israel National Cyber Directorate (INCD); in 2025 an updated National Cybersecurity Strategy was published with a three-year implementation horizon. [53] In March 2026, the Ministry of Health additionally required healthcare organisations to raise their cyber alert level, review externally accessible services, and strengthen monitoring and risk management. [54]

Australia. The Privacy Act and the Notifiable Data Breaches (NDB) scheme cover, among others, private healthcare providers. Where a breach is likely to result in serious harm, the organisation must notify the OAIC and the affected individuals; the assessment of a suspected breach should be carried out within 30 days. [55]

For critical hospitals, the Security of Critical Infrastructure Act (SOCI) additionally applies: a critical cyber incident with a significant impact on availability must be reported to the Australian Signals Directorate / Australian Cyber Security Centre (ASD/ACSC) within 12 hours, and any other cyber incident with a relevant impact within 72 hours. [56]

Singapore. The Personal Data Protection Act (PDPA) requires the Personal Data Protection Commission (PDPC) to be notified of a notifiable data breach no later than three calendar days after it is established that the breach is notifiable; individuals are notified if the breach is likely to cause them significant harm. A breach is considered to be of significant scale where, among other things, it involves 500 or more individuals. [58]

The Cybersecurity Act covers critical information infrastructure (CII), including the healthcare sector. [59] In 2026, the Cyber Security Agency of Singapore (CSA) continued to strengthen the Code of Practice for CII — with a greater emphasis on board-level oversight, the cyber resilience framework, testing and threat hunting. [60]

The Ministry of Health of Singapore (MOH) has also updated the Cybersecurity and Data Security Baseline Requirements for healthcare institutions and has organised training and support aimed, among others, at small clinics. [61] Importantly, the support also has a financial dimension: in 2026, the MOH announced the NEHR Connect grant of up to $45 million over four years; for small and medium-sized businesses, co-funding is also provided for cybersecurity consultancy from CSA-certified providers, together with separate programmes for firewalls and anti-malware tools. [62]

Financial liability under the PDPA is also substantial: for organisations with an annual turnover in Singapore of more than $10 million, the maximum financial penalty may reach 10% of the relevant turnover; for smaller organisations, an alternative statutory cap applies. [63]

Comparative table

Part 1. Authorities, legal framework and notification deadlines

Part 2. Sanctions, strategy, funding and training

The comparison shows an important trend: modern regimes no longer regard cybersecurity as a purely technical problem. In all the developed models, four common elements emerge: management accountability, mandatory risk management, prompt notification of the state, and verifiable recovery readiness. [71]

A Practical Cyber Resilience Model for a Healthcare Facility

A good cybersecurity programme should begin not with the purchase of a product but with an answer to the question: which clinical processes cannot be allowed to stop, and which digital assets do they depend on?

A typical governance model might look like this:

The key principle: the chief information security officer (CISO) cannot be solely responsible for a risk that could stop an operating theatre, a laboratory or an emergency department. The owner of such a risk must be the organisation’s leadership, and clinical leadership must take part in testing business continuity and disaster recovery plans. That is why in 2026 the NHS emphasises oversight by the board and senior management of cyber risk and recovery. [6]

The technical minimum. The first priority must be account security: multi-factor authentication (MFA) for remote access, administrators, cloud services and the electronic health record; separate privileged accounts; least-privilege access rights; prompt deactivation of the accounts of departed employees; and avoidance of shared accounts wherever clinically possible. The Change Healthcare incident is practically a textbook confirmation of the risk posed by a remote access portal without MFA. [33] HHS includes MFA, unique credentials and the separation of privileged accounts in the Healthcare and Public Health Sector Cybersecurity Performance Goals. [13]

The second level is asset inventory and vulnerability management. A healthcare facility must know not merely the number of computers but the owner of each critical asset, its operating system, firmware, software version, internet exposure, vendor support status, clinical criticality, backup method and tolerable downtime. The lesson of WannaCry is precisely that unsupported, unpatched systems turned a known technological weakness into a systemic healthcare problem. [23]

The third is network segmentation. Clinical systems, administrative IT infrastructure, the medical Internet of Things and operational technology, the guest Wi-Fi network, backup infrastructure and the privileged access management environment must not form one flat network. This does not guarantee protection against intrusion, but it makes lateral movement across the network — a stage that was important in both SingHealth and Change Healthcare — considerably harder. [72]

The fourth is backup as a real capability, not a formal checkbox. At a minimum, logically isolated or immutable copies of critical data, access control for backup systems and regular restoration testing are required. For an electronic health record, one should test not only the restoration of a file but also the scenario: “Can we restore the clinical system within the agreed recovery time objective (RTO) and recovery point objective (RPO) and verify the integrity of the records?”

The fifth is endpoint detection and response (EDR) tools, a security information and event management (SIEM) system, logging and threat detection tuning. Logs of remote access, account management systems, the electronic health record, Active Directory, the firewall, VPN, cloud services and privileged user actions must be correlated. SingHealth demonstrates that individual technical specialists may see anomalies, but without correlation and a proper escalation model the organisation does not assemble them into a single picture of the attack. [73]

The sixth is the security of medical devices. For every network-connected device, it is necessary to know the vendor, the support period and end of life, available updates, network dependencies, the authentication method, the remote support mechanism and the clinical consequences of its unavailability. If a device cannot be updated because of certification or vendor restrictions, the risk is compensated for by segmentation, application allow-listing, network monitoring, restricted remote access and a replacement plan.

The seventh is third-party security. A contract with a laboratory, a cloud provider, a supplier of a hospital or medical information system, a telemedicine service or an external security operations centre (SOC) must contain not an abstract “ensures information security” but concrete requirements: multi-factor authentication; encryption; logging; incident notification; cooperation during forensic investigation; vulnerability remediation; control of subcontractors; backup; RTO/RPO; preservation of evidence; the right to audit; secure deletion of data; and an exit plan. The consequences of the incidents at Change Healthcare and Synnovis demonstrate that operational dependency must be treated as cyber dependency. [74]

The organisational minimum. Every critical clinical service must have a written plan for operating during system downtime. Not “IT will restore the system”, but specifically: how we register a new patient without the hospital information system; how we check medication history; how we order laboratory tests; how we receive results; how we document the administration of medicines; what happens to medical images; how, after recovery, we transfer paper records back into the electronic health record; and how we prevent duplication and data transfer errors.

The legal minimum. A healthcare facility must have a data register and a legal map: which categories of data are processed, who is the data owner, controller or the relevant entity under national law, which third parties have access, on what legal basis, where and in which jurisdiction the data are physically stored, what the retention periods are, what the breach notification requirements are, and who has the authority to decide on notifying the regulator and patients.

For Ukraine, it is important to link this with the eHealth (ESOZ) regime, the Law “On Personal Data Protection”, the rules of medical confidentiality, the legislation on information and communication systems and the new cyber incident response system. [75]

The training minimum. An annual cyber awareness course on its own is not enough. It is recommended to divide training by role:

Such a role-based approach is consistent with the directions developed by HHS, the NHS and the MHLW. [76]

Action Plan After a Cyber Incident

The first hours after an attack are the moment when a wrong decision can increase both clinical and legal harm. A healthcare facility’s incident response plan must be approved in advance, tested and aligned with the business continuity plan.

The EU experience under NIS2 shows particularly well why one cannot wait for a “complete forensic picture” before starting to report: the system provides for an early warning within 24 hours, then a notification within 72 hours, and only later a final report. [77] A similar logic exists in Australia for critical infrastructure: 12 hours for the most serious incidents affecting availability. [56]

For Ukraine, interaction with CERT-UA should be built into the plan in advance. The team officially receives reports, conducts investigations and provides assistance in remediating the consequences. [9]

What not to do during a ransomware attack: shut down all equipment chaotically and without coordination; delete logs; contact the attackers on one’s own from personal accounts; publicly name the cause or the scale before they are confirmed by forensic examination; restore systems in a compromised network; connect backups to an environment where the attacker’s foothold has not yet been eliminated; regard payment of a ransom as a substitute for recovery.

The cases of the HSE and Change Healthcare show two different decisions on ransom: the HSE did not pay a ransom, while the Chief Executive Officer of UnitedHealth Group confirmed that he personally took the decision to pay at Change Healthcare. [78] No universal rule of “never” or “always” paying follows from this. The decision depends on the position of law enforcement authorities, the sanctions regime, clinical consequences, the possibility of recovery, insurance and legal assessment. But receiving a ransom demand should not be the first moment at which leadership discusses this policy.

Short Templates of Policies and Procedures

Access management policy template

Purpose: to ensure access to medical information strictly in accordance with job and clinical authority.

Rule: all users have personal accounts. Multi-factor authentication (MFA) is mandatory for remote access, privileged accounts and other designated critical systems. Rights are granted on the principles of least privilege and role-based access.

Review: rights are reviewed after a change of position and periodically; after the termination of an employment or contractual relationship, access is revoked immediately.

Emergency access: access that bypasses the usual rules (“break glass”) is permitted only in the case of clinical necessity, is logged automatically and is subject to subsequent review.

The approach is consistent with the HHS Cybersecurity Performance Goals (CPGs) and with the principles of controlled access applied in eHealth (ESOZ). [79]

Template of a procedure for reporting a suspicious incident

Any employee who notices an unusual system login, phishing, a ransomware message, unauthorised access, a lost device or anomalous behaviour of a clinical system does not conduct an investigation on their own but immediately reports to the support service or the security operations centre (SOC) through the designated channel.

The report must include: the time, the system/device, a brief description, a screenshot (if possible), and the user’s actions before the event.

The incident response team determines the severity level, the impact on clinical processes and the need for escalation to management, the data protection officer, lawyers, CERT or the regulator.

The problem of late escalation is one of the central lessons of SingHealth. [73]

Template of a contractual clause on third-party security

The supplier applies multi-factor authentication for remote and privileged access, keeps logs of security events, maintains a vulnerability management process, encrypts sensitive data in transit and at rest, maintains a tested backup and recovery capability, and notifies the customer of a confirmed or reasonably suspected security incident no later than X hours after its detection.

The supplier preserves digital evidence, assists in the investigation of the incident, reports the subcontractors involved, and does not change the place or jurisdiction of processing of health data without a procedure provided for in the contract.

It is advisable to set the period in the contract shorter than the external regulatory deadline; otherwise the healthcare facility may physically be unable to meet its own notification obligation in time.

Template of a backup and recovery policy

For each critical clinical system, a recovery time objective (RTO) and a recovery point objective (RPO) are established.

At least one backup copy must be protected against modification or deletion using working credentials.

A recovery test is carried out according to an approved schedule.

The results of the recovery test are documented and reported to the system owner.

A backup is considered fit for purpose only after a confirmed restoration and an integrity check.

Template of a downtime procedure in the event of a ransomware attack

In the event of loss of access to the electronic health record, the responsible clinical lead declares a switch to downtime operating mode.

Pre-prepared paper/local forms are used for patient identification, medication administration, laboratory orders, medical images and clinical records.

After recovery, data are transferred to the electronic health record under a double-check procedure to minimise duplication and transfer errors.

The restoration of IT systems and the restoration of clinical processes are separate workstreams, synchronised by the incident response lead.

Healthcare Facility Readiness Checklist and Strategic Conclusions

Below is a practical self-assessment tool. A “no” answer does not automatically mean a critical failure, but a cluster of “no” answers in one category points to a systemic risk.

In practice, the result can be assessed as follows: 90–100% “Yes” — a mature programme that nevertheless requires constant testing; 70–89% — an acceptable baseline with specific gaps; 50–69% — a substantial operational vulnerability; less than 50% — the priority should be not the acquisition of a new technology platform but the establishment of basic governance and recovery capability. This is not a regulatory scale but a management tool for internal gap analysis.

For a Ukrainian facility, it is advisable to allocate the first investments in the following order: account security and MFA → asset inventory → backup and recovery → patch and vulnerability management → network segmentation → logging and threat detection → incident response → clinical downtime procedures → supplier security → advanced security operations centre (SOC) capabilities. This order corresponds to the nature of the weaknesses that actually manifested themselves in WannaCry, SingHealth, the HSE, Medibank and Change Healthcare. [80]

For a small hospital, this does not mean a need to build a large in-house SOC. Some functions can be purchased as a managed service, but risk and accountability cannot be outsourced. Management must still know which data and systems are critical, who can cut off the attacker’s access, who will restore the electronic health record, how long this will take, and how physicians will work until recovery.

For the public healthcare system, one more level is needed: sector threat intelligence, uniform baseline protection measures, certified and vetted providers, centralised reporting, funding of cyber protection for small hospitals, joint exercises between facilities, fallback mechanisms for laboratories and for the electronic health system, and national coordination of incident response. This is precisely the direction in which the EU, the NHS, Japan and Singapore are moving. [81]

For Ukraine, a particularly promising model would be one in which a minimum baseline level of cybersecurity for healthcare facilities is linked not only to the protection of personal data but also to the ability to provide care in the event of a failure of digital systems. In practice, this means bringing together three traditionally separate disciplines:

cybersecurity + patient safety + business continuity = healthcare cyber resilience.

This is the main lesson of the last decade. The most mature systems no longer ask: “Will our hospital be attacked?” They plan how to prevent the attack from spreading, how to keep treating patients during an incident, and how to recover without losing trust and the integrity of medical data.

For Ukraine, this approach is further reinforced by the risk of war. In 2026, CERT-UA already recorded campaigns whose targets included hospitals, while digital healthcare increasingly relies on eHealth (ESOZ) and interconnected information systems. [82] Accordingly, the cyber resilience of the healthcare system should be considered on a par with energy, communications and other critical resilience.

Our Projects

Veterans’ Projects

• veterano.info — an information project for veterans and their families from the Veterans Cluster of Ukraine and the Veterans Institute.
• veterano.media — the media outlet of the Veterans Cluster of Ukraine: news, stories and practical navigation for veterans and families.
• veterano.army — a recruitment agency for business: we select able-bodied veterans to meet business needs — production, warehousing, logistics, office work.
• veterano.bio — digital confirmation of veteran status and document translation: a secure profile, a multilingual certificate.
• veterano.digital — the “Single Window”, a digital reception desk for veterans in education: enquiries by any convenient method, a personal educational pathway.

Partner Projects of the Ecosystem

• Ukraine Recovery Agency — an association that brings together the efforts of the state, business and communities around the post-war recovery and development of Ukraine.
• National Institute for Regional Development — brings together science, education, business and the state to accelerate the development of regions.
• Research Institute and Analytical Centre “Innovations, Investments, Intelligence” — a scientific research information and analytical centre, Kyiv.
• Charitable Foundation “Reconstruction and Development of Ukraine” — mobile hospitals for the Armed Forces of Ukraine.
• AGGR World / ITTA — news on the economy, defence, business and society.

Ready-made SmartGT Solutions

• Smart CMS — a free and secure CMS with built-in AI for content, plugins tailored to your tasks and a convenient block editor.
• Smart LMS — turnkey learning platforms: courses, tests, assignments, certificates and sales of access; each school with its own domain and brand, all from a single panel.
• BOT-panel — management of Telegram bots with AI in a single panel: mailings, contacts, time tracking, document approval, assessment of communication quality.
• Smart Audit — a free website check in 3 minutes: security, search visibility, speed, AI-agent readiness; no registration.
• Smart 360 — ERP and CRM for business: customers and deals in a pipeline, product catalogue and price lists, warehouse, documents and contracts in one system.
• Smart Window — the manager’s single window: how the dashboard is organised and what can be seen in it.

Sources

Ukraine

1. Olha Danchenko. “Cybersecurity in Healthcare: How to Protect Patient Data in the Digital Age”, PRAVO.UA, 16 September 2026. [15]
2. Verkhovna Rada of Ukraine. Law of Ukraine “On Personal Data Protection”, current version. [83]
3. Verkhovna Rada of Ukraine. Law No. 4336-IX of 27 March 2025 on the protection of information and the cyber defence of state information resources and critical information infrastructure. [21]
4. eHealth (ESOZ) / State Enterprise “Electronic Health”. Official materials on the protection of personal and medical data in the central eHealth database. [20]
5. CERT-UA [9]

European Union

1. European Union. Directive 2022/2555 — NIS2 Directive. [77]
2. European Union. Regulation 2016/679 — General Data Protection Regulation. [12]
3. European Union. Regulation 2025/327 — European Health Data Space. [39]
4. ENISA. Checking-up on Health: Ransomware Accounts for 54% of Cybersecurity Threats, 2023. [18]
5. ENISA. [19]
6. European Commission. Cybersecurity in healthcare, 2026. [84]
7. ENISA, 2026. [85]
8. European Commission / EU. Cyber Solidarity Act and the European Cybersecurity Reserve. [41]

United Kingdom

1. National Audit Office. Investigation: WannaCry cyber attack and the NHS, 2017. [23]
2. NHS England. Board and executive assurance: cyber security risk, 2026. [6]
3. UK Department of Health and Social Care. The Network and Information Systems Regulations 2018: guide for the health sector in England. [42]
4. Information Commissioner’s Office. Guidance on personal data breach reporting under UK GDPR. [43]
5. NHS England. Synnovis cyber incident. [28]
6. ICO. Statement concerning the Synnovis cyber attack. [86]

USA

1. U.S. HHS Office for Civil Rights. HIPAA Security Rule materials. [44]
2. U.S. HHS. HIPAA Breach Notification Rule, 2026 reporting instructions. [45]
3. HHS Cyber Gateway. Healthcare and Public Health Cybersecurity Performance Goals. [87]
4. HHS OCR. Anthem pays OCR $16 Million in record HIPAA settlement following largest health data breach in history, 2018. [22]
5. HHS OCR. Change Healthcare Cybersecurity Incident Frequently Asked Questions. [88]
6. Andrew Witty / UnitedHealth Group. Testimony before the U.S. Senate Finance Committee: Change Healthcare cyberattack. [89]
7. UnitedHealth Group. Updates restoration Change Healthcare. [90]
8. U.S. Department of Justice. ALPHV/BlackCat ransomware operations. [91]

Ireland

1. Health Service Executive. Conti cyber attack on the HSE — Independent Post Incident Review. [92]
2. HSE. [31]

Japan

1. Personal Information Protection Commission of Japan. APPI — laws and policies. [47]
2. PPC Japan. Reporting personal-data leaks, unauthorized access ransomware. [49]
3. Ministry of Health, Labour and Welfare. Portal cybersecurity measures for medical institutions, guidance, checklists, training, reporting, procedures. [48]
4. MHLW. Cybersecurity support and assessment programme for medical institutions. [93]

Israel

1. Israel Privacy Protection Authority. Guidance on Privacy Protection Regulations (Data Security) 2017. [51]
2. Israel Privacy Protection Authority. Amendment 13 to the Privacy Protection Law, effective from August 2025, updated guidance, 2026. [52]
3. Israel National Cyber Directorate. National Cybersecurity Strategy 2025. [53]
4. Israel Ministry of Health. Cybersecurity directions to health organisations, 2026. [54]

Australia

1. Office of the Australian Information Commissioner. Notifiable Data Breaches scheme guidance. [55]
2. OAIC. OAIC takes civil penalty action against Medibank, 2024. [94]
3. OAIC. Regulatory guidance on current maximum Privacy Act civil penalties. [57]
4. Australian Cyber Security Centre / cyber.gov.au. Mandatory reporting under the Security of Critical Infrastructure Act, including critical hospital assets. [56]
5. Australian Federal Police. Official investigation materials concerning the Medibank attack. [95]

Singapore

1. Personal Data Protection Commission. Data breach notification requirements. [58]
2. PDPC. Updated PDPA enforcement regime and financial penalty limits. [63]
3. Cyber Security Agency of Singapore. Cybersecurity Act and Critical Information Infrastructure requirements. [96]
4. Singapore Ministry of Health. Healthcare Cyber Security and Data Security Essentials, training and support measures, 2026. [61]
5. Singapore Ministry of Health. Funding measures including NEHR Connect Grant and cybersecurity support for providers, 2026. [62]
6. Committee of Inquiry into the Cyber Attack on Singapore Health Services Patient Database. Official public report, 10 January 2019. [97]