NIS2 for Healthcare

Scope clarity: who is essential, who is important

Annex I of NIS2 covers the health sector under a single heading, but the practical scope is broader than just hospitals. The directive reaches across the care continuum, including manufacturers upstream of clinical delivery.

• Healthcare providers, as defined in Directive 2011/24/EU. This primarily means hospitals and clinics providing cross-border or nationally significant care.
• EU reference laboratories designated by the European Commission.
• Entities carrying out research and development activities on medicinal products.
• Entities manufacturing basic pharmaceutical products and pharmaceutical preparations.
• Entities manufacturing medical devices considered critical during a public health emergency, as referred to in the public health emergency critical devices list.

General practitioners, small clinics, and allied health providers are usually out of direct scope unless the member state specifically designates them. The line moves when a provider is deemed critical at national level, for example because it is the sole provider of a specialist service. Always confirm scope against the national transposition law, not only the directive text.

Top cyber risks for healthcare

Ransomware on hospitals

Hospitals are among the most frequently attacked ransomware targets in Europe. Downtime of the electronic patient record, radiology systems, or clinical messaging directly affects patient safety. Several high-profile incidents have forced ambulance diversions, cancelled surgeries, and extended outages lasting weeks. Article 21 treats continuity as a mandatory control area for exactly this reason.

Medical device security

Infusion pumps, imaging systems, patient monitors, and laboratory analyzers are network-connected and often run outdated operating systems. They cannot usually be patched on enterprise schedules. NIS2 does not ask the hospital to rebuild them, but it does require a documented approach: inventory, segmentation, monitoring, and compensating controls.

Patient data at rest and in motion

Electronic patient records, research data, and genomic information are high-value targets. Encryption, access control, and audit logging are foundational. NIS2 reinforces these expectations through Article 21 and aligns with GDPR on data security, although the two regimes have different triggers and recipients for reporting.

Third parties and clinical supply chain

Hospitals rely on EHR vendors, imaging PACS providers, medical device makers, cleaning and catering services, and a long tail of research collaborators. Each of these introduces potential access. Article 21 supply chain security duties apply to the full set.

NIS2 and GDPR: one incident, two regimes

Ransomware affecting patient records is the textbook case. Under NIS2 Article 23, the hospital must submit an early warning to the CSIRT or competent authority within 24 hours, a formal notification within 72 hours, and a final report within one month. Under GDPR Article 33, the hospital must notify the data protection authority within 72 hours. Affected patients may also need to be informed under GDPR Article 34.

The content of these reports differs. NIS2 emphasises service disruption, cross-border impact, and technical root cause. GDPR emphasises the categories and volume of personal data, affected individuals, and mitigation. A shared incident playbook that produces both streams of reporting from the same factual baseline is the pragmatic answer, and one of the deliverables Burak typically produces during an engagement.

Board liability in healthcare

Hospital boards have historically focused on patient safety, quality, and financial sustainability. Cybersecurity now sits on the same risk register with the same expectation of board engagement. Article 20 requires the management body to approve cybersecurity risk measures, to oversee their implementation, and to complete cybersecurity training. Members can be held personally accountable when serious breaches are linked to oversight failures.

In practice this means quarterly board-level reporting on cybersecurity risk, a documented training program for directors, and a clear decision trail when the board signs off on the information security policy. The same applies to university medical center supervisory boards and to the boards of group structures operating multiple hospitals.

A 30-day, 90-day, and 12-month roadmap for hospitals

First 30 days: clarity

• Confirm scope per legal entity and register with the national competent authority.
• Form a joint NIS2 and GDPR steering group with CISO, DPO, legal, clinical leadership, and a board sponsor.
• Inventory high-criticality clinical systems, including EHR, radiology, lab, pharmacy, and key medical devices.
• Review the existing incident response plan against Article 23 timelines and identify decision gaps.

Days 30 to 90: stabilise

• Publish a management body-approved information security policy.
• Deliver mandatory cybersecurity training to the management body.
• Run a tabletop exercise simulating ransomware on the EHR, exercising both NIS2 and GDPR reporting.
• Close top quick wins: MFA for clinical applications where feasible, offline EHR downtime procedures, and segmentation of known-vulnerable medical devices.

Months 4 to 12: sustain

• Mature the medical device security program with inventory, risk rating, and vendor engagement on patching and monitoring.
• Roll out supply chain security duties to vendor management, including contract clauses for EHR, PACS, and device makers.
• Integrate NIS2 and GDPR reporting into a single incident management tool, with clear routing to CSIRT and DPA.
• Run an internal audit against Article 21 and close findings before the first external supervisory review.

Frequently asked questions