Bolstering the cybersecurity of the healthcare sector

The Commission has presented an EU Action Plan to strengthen the cybersecurity of hospitals and healthcare providers. This initiative is a key priority within the first 100 days of the new mandate, aiming to create a safer and more secure environment for patients. 

In 2023 alone, EU countries reported 309 significant cybersecurity incidents targeting the healthcare sector – more than any other critical sector. As healthcare providers increasingly use digital health records, the risk of data-related threats continues to rise. Many systems can be affected, including electronic health records, hospital workflow systems, and medical devices. Such threats can compromise patient care and even put lives at risk.  

To address these challenges, the EU is working to strengthen the healthcare sector and make it more resilient against cyber threats. The new Action Plan builds on existing legislation, such as the EU-wide legislation on cybersecurity, and extends its scope to include general practices. It focuses on prevention, detection, impact mitigation and deterrence of cyber threats. The Plan also aims to establish a pan-European Cybersecurity Support Centre to provide more tailored guidance to hospitals and healthcare providers. By the end of the year, it will be further refined through a collaborative approach and will be rolled out progressively over the next 2 years. 

Digitalisation of the healthcare sector enables better services to patients through innovations, along with many other benefits. The EU remains committed to fostering a healthcare environment where technology empowers patients, enhances care, and supports healthcare professionals. 

For more information 

Cybersecurity of hospitals and healthcare providers 

A new plan for Europe's sustainable prosperity and competitiveness  

Cybersecurity  

Press Release: Commission unveils action plan to protect the health sector from cyberattacks 

European action plan on the cybersecurity of hospitals and healthcare providers 

European Union Agency for Cybersecurity (ENISA)