Healthcare cybersecurity: NIS2, GDPR and the EHDS explained for European providers
Healthcare cybersecurity is now a legal duty under NIS2 and GDPR, with the European Health Data Space next. See who is in scope, which clocks run after an incident, and what recent European cases teach.
A hospital cannot pause surgery because its patient record system is down. That is why information security in healthcare, and healthcare cybersecurity in particular, carries higher stakes than in most other sectors. When data is encrypted or leaked, the damage lands on treatment plans, medication and patients who rely on the records being accurate and available.
The rulebook has tightened as well. NIS2 puts healthcare among the sectors of high criticality, and most Member States now apply it through national law. GDPR still governs every piece of health data, national confidentiality rules sit on top, and the European Health Data Space (EHDS) regulation has fixed dates that procurement teams need to plan for.
This guide is written for compliance leads, data protection officers, CISOs and IT managers in hospitals, clinic groups, laboratories and life science companies across Europe. It explains which rules apply to whom, which clocks start running after an incident, and what recent European cases say about where things usually go wrong. Every article number and figure has been checked against EUR-Lex and the relevant agencies as of September 2026.
The short answer: what does healthcare cybersecurity require in the EU?
If you are a healthcare provider, an EU reference laboratory, a pharmaceutical company or a medical device manufacturer with at least 50 staff, or more than EUR 10 million in both turnover and balance sheet, you are in scope of the NIS2 Directive (EU) 2022/2555 as transposed in your Member State. Your management body must approve and oversee the risk management measures in Article 21, you must register with the national authority, and significant incidents must be reported within 24 hours, 72 hours and one month. GDPR applies alongside, and the usual legal basis for health data in care is Article 9(2)(h), not consent. Personal data breaches go to the data protection authority within 72 hours. The practical answer is to run one risk assessment and one incident process that satisfy both regimes at once.
Five rulebooks that often get mixed up
Articles on healthcare cybersecurity compliance tend to list NIS2, GDPR, ISO 27001 and national health law in one breath, as if they were interchangeable. They protect different things, answer to different regulators and trigger different deadlines. Sorting them into the right boxes is the most useful first step.
| Rulebook | What it protects | Who supervises | What an incident triggers |
|---|---|---|---|
| NIS2 (Directive (EU) 2022/2555 and national law) | Network and information systems, and so the continuity of the service | The national competent authority for health, often a health ministry agency | Early warning in 24 hours, notification in 72 hours, final report after one month |
| GDPR (Regulation (EU) 2016/679) | Personal data, including health and genetic data | The national data protection authority | Notification within 72 hours, communication to patients where risk is high |
| National health and confidentiality law | Professional secrecy and the content of the medical record | Health regulators and professional bodies | Disciplinary or criminal cases for unauthorised access |
| CER Directive (EU) 2022/2557 | Physical and organisational resilience of designated critical entities | The sector authority named in national law | Notification of incidents that significantly disrupt the essential service |
| ISO 27001 and ISO 27799 | Nothing on their own. They are voluntary standards for managing security | No regulator. ISO 27001 is certified by accredited bodies | Only what your own procedures say |
Standards are tools, not obligations. ISO/IEC 27001 provides the management system, and ISO 27799:2025 translates the ISO/IEC 27002 controls into clinical situations such as emergency access to records and sharing between care teams. You cannot certify against ISO 27799. If you need external proof of your ISMS, ISO 27001 is the route, and our guide to ISO 27001 certification covers the process.
A note for UK readers: NIS2 does not apply in the United Kingdom, which still runs the NIS Regulations 2018 and is legislating separately. UK providers serving EU patients or with EU establishments should read on.
Is your organisation in scope of NIS2?
NIS2 applies to public and private entities of the types listed in Annex I and Annex II that meet the size thresholds (Article 2). Health is point 5 of Annex I, the sectors of high criticality. Manufacture of medical devices and in vitro diagnostic devices sits in Annex II, point 5(a), among the other critical sectors.
Which healthcare entities are covered
| Entity type | Annex | Typical examples |
|---|---|---|
| Healthcare providers as defined in Article 3(g) of Directive 2011/24/EU | Annex I, point 5 | Public and private hospitals, clinic groups, larger dental and diagnostic chains |
| EU reference laboratories under Article 15 of Regulation (EU) 2022/2371 | Annex I, point 5 | Laboratories designated by the Commission |
| Research and development of medicinal products | Annex I, point 5 | Pharmaceutical and biotech companies |
| Manufacture of basic pharmaceutical products and preparations (NACE C21) | Annex I, point 5 | Medicine manufacturers |
| Manufacture of medical devices considered critical during a public health emergency | Annex I, point 5 | Manufacturers on the list under Article 22 of Regulation (EU) 2022/123 |
| Manufacture of medical devices and in vitro diagnostic medical devices | Annex II, point 5(a) | MedTech companies under the MDR and IVDR |
The definition of healthcare provider is broad. Directive 2011/24/EU covers anyone legally providing healthcare, and healthcare includes prescribing and dispensing medicinal products. Pharmacy chains and private rehabilitation centres can therefore be in scope if they meet the size test. A single GP practice with ten staff usually is not.
Essential or important entity
Size decides the category. An Annex I entity is essential if it exceeds the ceilings for medium-sized enterprises, which means 250 staff or more, or annual turnover above EUR 50 million and a balance sheet above EUR 43 million (Article 3(1)(a)). It is important if it is at least medium-sized but not essential (Article 3(2)). Entities identified as critical under the CER Directive are essential regardless of size (Article 3(1)(f)). Essential entities face proactive supervision under Article 32, whilst important entities are supervised after the fact under Article 33. The security obligations themselves are identical.
National transposition matters
NIS2 is a directive, so the obligations bite through national law. The transposition deadline was 17 October 2024. By July 2026 most Member States had legislated, and the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition. Registration routes, competent authorities and fine levels differ from country to country.
Denmark shows what a finished transposition looks like. The Danish NIS2 Act (Act no. 434 of 6 May 2025) has applied since 1 July 2025, lists health in its Annex 1, repealed the earlier health-specific NIS law from 2018, and names the Danish Health Data Authority (Sundhedsdatastyrelsen) as competent authority for the health sector and for the regions. Existing entities had to register by 1 October 2025. For the wider picture across sectors, see our introduction to NIS2.
What NIS2 requires from a hospital, clinic or MedTech company
Article 21(1) requires appropriate and proportionate technical, operational and organisational measures. Article 21(2) lists ten areas that must be covered as a minimum. The table shows what they typically mean in healthcare.
| Art. 21(2) | Requirement | What it looks like in healthcare |
|---|---|---|
| (a) | Risk analysis and information system security policies | Risk assessment of the EHR, laboratory systems, imaging and the network that hosts medical devices |
| (b) | Incident handling | One process that meets both NIS2 and GDPR deadlines, with out-of-hours cover |
| (c) | Business continuity, backup and crisis management | Paper-based downtime procedures, offline backups of clinical data and drills with clinical departments |
| (d) | Supply chain security | Security requirements for and oversight of EHR, hosting and medical device suppliers |
| (e) | Security in acquisition, development and maintenance | Security clauses in tenders and a plan for devices that cannot be patched |
| (f) | Assessing the effectiveness of measures | Internal audit, restore tests and follow-up on access log reviews |
| (g) | Cyber hygiene and training | Awareness for clinical staff who share workstations and work in shifts |
| (h) | Cryptography and encryption | Encryption of laptops, links to primary care and secure email |
| (i) | HR security, access control and asset management | Role-based access, fast revocation for leavers and a complete asset register |
| (j) | Multi-factor authentication and secured communications | MFA on remote access and admin accounts, and secured emergency communication systems |
Under Article 20, the management body must approve these measures, oversee their implementation and can be held liable for infringements. Its members must follow training. In a public hospital trust, who counts as the management body is a governance question worth answering in writing. Our article on NIS2 training requirements explains what the training should cover.
Suppliers are not directly bound by your obligations. They are pulled in through Article 21(2)(d), because you must set requirements and follow up. In hospitals that is often where the real exposure sits, since a handful of large vendors run the EHR, the infrastructure and the devices. Our guide to vendor audits shows how to structure that oversight.
Article 34 sets the maximum administrative fines: at least up to EUR 10 million or 2 % of worldwide annual turnover for essential entities, and at least up to EUR 7 million or 1.4 % for important entities, whichever is higher. National law decides how fines are imposed. In Denmark, for example, the courts set them.
Healthcare cybersecurity threats: what the European data shows
ENISA's first threat landscape for the health sector, published on 5 July 2023, analysed 215 publicly reported incidents between January 2021 and March 2023. Ransomware accounted for 54 % of threats, hospitals for 42 % of incidents, and patient data was the most frequent target at 30 %. Nearly half of incidents (46 %) aimed to steal or leak data, and ENISA estimated the median cost at EUR 300,000. The Commission's action plan later noted that 309 incidents affecting the health sector were reported in 2023, more than in any other critical sector.
Two cases show the healthcare cybersecurity risk in practice:
- Ireland's Health Service Executive (2021). The independent post-incident review found that a phishing email opened on 18 March 2021 led to Conti ransomware detonating on 14 May 2021, encrypting around 80 % of the HSE's IT environment. Several alerts in the days before went unactioned, and the HSE had roughly 15 full-time cybersecurity staff.
- Vastaamo, Finland (2018 to 2020). A psychotherapy provider's patient database was breached, and more than 33,000 patients later received extortion messages. On 26 February 2026 the Helsinki Court of Appeal increased the attacker's sentence to six years and eleven months.
The EU's response is the European action plan on the cybersecurity of hospitals and healthcare providers, presented on 15 January 2025 around four pillars: prevention, detection, response and deterrence. In July 2026 ENISA signed a EUR 6 million agreement to run a European Cybersecurity Support Centre for the sector and published procurement guidelines for hospitals and healthcare providers. Those guidelines are a useful checklist when you write security requirements into your next tender.
GDPR and health data: Article 9, not consent
Health data is a special category under Article 9 of GDPR. Processing is prohibited unless an exception in Article 9(2) applies. A common misconception is that a hospital needs patient consent. It usually does not.
Processing for preventive medicine, diagnosis, care and treatment is typically based on Article 9(2)(h), read with Article 9(3), which requires that the data is processed by or under the responsibility of a professional bound by secrecy. National health law supplies that secrecy duty. Consent under Article 9(2)(a) is one of several bases and is mainly used for research or processing beyond what the law provides for. See our article on the legal basis for sensitive personal data.
Three other GDPR provisions weigh heavily on healthcare:
- Article 32 requires appropriate technical and organisational measures. Encryption and pseudonymisation are examples in the text, not absolute requirements. The level must match the risk, and for health data the risk is high.
- Article 35(3)(b) requires a data protection impact assessment for large-scale processing of special categories. A new EHR or patient app almost always needs a DPIA.
- Article 37(1) requires a DPO for public authorities (point a) and where core activities involve large-scale processing of special categories (point c). Public hospitals and large private groups need one.
Breaching Article 32 carries fines of up to EUR 10 million or 2 % of turnover (Article 83(4)). Breaching Article 9 falls under the higher tier of EUR 20 million or 4 % (Article 83(5)).
One incident, two clocks
A ransomware attack on a hospital is usually both a significant incident under NIS2 and a personal data breach under GDPR. Two sets of deadlines run in parallel, and they go to two different authorities.
| When | What | To whom | Legal basis |
|---|---|---|---|
| Within 24 hours of becoming aware | Early warning of a significant incident | CSIRT or competent authority | NIS2 Art. 23(4)(a) |
| Within 72 hours of becoming aware | Incident notification with initial assessment | CSIRT or competent authority | NIS2 Art. 23(4)(b) |
| Without undue delay and where feasible within 72 hours | Personal data breach notification | Data protection authority | GDPR Art. 33 |
| Without undue delay, where risk is high | Communication to affected patients | Data subjects | GDPR Art. 34 |
| Without undue delay | Notice to recipients of your services where delivery is likely to be affected | For example referring GPs, municipalities and partner hospitals | NIS2 Art. 23(1) |
| No later than one month after the incident notification | Final report | CSIRT or competent authority | NIS2 Art. 23(4)(d) |
Two details are frequently misstated. The GDPR 72 hours apply to the notification to the supervisory authority. Patients must be told without undue delay when the breach is likely to result in a high risk to them, and Article 34 sets no fixed number of hours. The NIS2 notification also does not replace the GDPR one. You need both, although Article 35 of NIS2 requires the competent authority to inform the data protection authority when an infringement may involve a personal data breach. Our article on handling a security breach walks through documenting the assessment.
The European Health Data Space: the next layer, already dated
Regulation (EU) 2025/327 on the European Health Data Space was published on 5 March 2025 and entered into force on 26 March 2025. It gives patients new rights over their electronic health data and sets requirements for the EHR systems you buy. It applies directly, but in stages.
| Date | What happens |
|---|---|
| 26 March 2025 | Entry into force |
| 26 March 2027 | General date of application (Article 105). Key implementing acts due from the Commission |
| 26 March 2029 | Patient summaries and ePrescriptions exchanged across the EU. EHR systems processing those data must comply. Most secondary use rules (Chapter IV) apply |
| 26 March 2031 | Medical images, lab results and discharge reports added. Requirements extend to EHR systems already in service |
| 26 March 2035 | Third countries and international organisations may apply to join HealthData@EU |
Two parts of the EHDS matter directly for security. Article 9 gives patients the right to information, including automatic notifications, on any access to their data through health professional access services. EHR systems must include a European logging component that meets the security and logging requirements in Annex II, section 3. What is good practice today becomes a product requirement. Write it into your tenders now.
A worked example: the clinic hit by ransomware on a Friday
Harbourside Clinic and Anna Berg are fictional. We invented them for this article, and they are neither customers nor a case study.
Harbourside Clinic is a private hospital established in one EU Member State, with 180 staff, turnover of EUR 28 million and a balance sheet of EUR 20 million. As a healthcare provider it falls under Annex I. With fewer than 250 staff and turnover below EUR 50 million it does not exceed the medium-sized ceilings, so it is not essential. With more than 50 staff it is an important entity under Article 3(2). Anna Berg is head of IT and security.
At 14:00 on a Friday the hosting provider calls. The server holding bookings and clinical notes is encrypted, and there are signs that data has been copied out. Anna's plan looks like this:
| Time | Action | Basis |
|---|---|---|
| Friday 14:00 | Awareness. Management and DPO informed, continuity plan activated, Monday's operating list reviewed | Art. 21(2)(b) and (c) |
| Saturday 14:00 | Latest point for the early warning to the national CSIRT, flagging suspected malicious action | NIS2 Art. 23(4)(a) |
| Saturday | Assessment of whether the breach is high risk for patients. The answer is yes, because clinical notes may have leaked | GDPR Art. 34 |
| Monday 14:00 | Latest point for the NIS2 incident notification and the GDPR notification to the data protection authority | Art. 23(4)(b) and GDPR Art. 33 |
| Monday and Tuesday | Patients informed. Referring GPs told that follow-up appointments will be delayed | GDPR Art. 34 and NIS2 Art. 23(1) |
| Within one month of Monday's notification | Final report on root cause, mitigation and cross-border impact | Art. 23(4)(d) |
The number that matters is 24 hours. It expires on a Saturday. Without an on-call rota and a pre-filled template, the clinic misses the first deadline before anyone has read the law. So Anna's most important preparation is about roles rather than technology: who may submit the report, who assesses the risk to patients, and who can reach the supplier's contact at the weekend.
With 260 staff the clinic would have been essential. The incident duties are the same, but it would face proactive supervision and a higher fine ceiling.
Healthcare cybersecurity best practices: seven steps to get started
Most healthcare organisations already have parts of the work in place. What is usually missing is the connection between them. Seven steps pull it together:
- Confirm your status. Are you in scope of NIS2, essential or important, designated under CER, and who is your competent authority in each country where you operate?
- Register. If you have not registered with the national authority, do it now.
- Map systems and data. Keep one asset register for systems and medical devices and one record of processing activities for health data.
- Run one risk assessment. Use the same method for NIS2 Article 21, GDPR Article 32 and DPIAs under Article 35. Our guide to information security risk management shows how.
- Prioritise the ten measures. Start with MFA, offline backups, segmentation of medical device networks and systematic access log review.
- Build one incident process with three clocks. Templates for the CSIRT, the data protection authority and patients, an on-call rota and an annual exercise.
- Anchor it with management. The board approves the measures, completes training, and supplier oversight goes into a fixed annual cycle.
What regulation will not do for you
Compliance is not the same as security. You can have an approved policy and a perfect registration and still be hit because a supplier account without MFA was left open. The HSE review makes that point better than any regulation.
This article also has limits. It does not cover manufacturers' cybersecurity duties under the MDR and IVDR, the Cyber Resilience Act (Regulation (EU) 2024/2847) or the AI Act's requirements for high-risk diagnostic AI. National rules on medical records and confidentiality differ, so check your own Member State. And whilst ISO 27001 and ISO 27799 give a solid framework, neither makes you NIS2 or GDPR compliant on its own. Regulators assess whether your measures fit your risk, not whether you hold a certificate.
How .legal supports healthcare cybersecurity
The hard part in healthcare is rarely understanding the rules. It is keeping the evidence for several regimes current across departments and suppliers. In the .legal information security module you register assets, assess risks and link controls to them. With Frameworks, the same control, such as your backup restore test, can be mapped to NIS2 Article 21 and ISO 27001 so you document it once.
Supplier oversight can be run in Vendor Management, and recurring tasks such as board approval, log reviews and incident exercises fit into compliance task management. The platform does not file incident reports for you and does not replace your technical security. It gives you an overview and an audit trail you can show a regulator. Book a demo to see how it works for a healthcare organisation.
.legal compliance platform
Secure Healthcare Data with .legal
-
Document healthcare security policies
-
Track GDPR compliance for health data
-
Manage access control documentation
-
Monitor security measures in real time
-
Generate audit-ready compliance reports
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
