EU Commission Introduces New Cybersecurity Action Plan for Healthcare Sector
To safeguard hospitals and healthcare organizations against rising cyber threats, the European Commission has proposed a plan to create a cybersecurity center and provide customized support.
The European Commission has launched an ambitious initiative to enhance cybersecurity in the healthcare sector, addressing the increasing number of cyberattacks on hospitals and health organizations across Europe.
With half of European hospitals targeted by cyberattacks, Health Commissioner Oliver Varhelyi and Commission President Ursula von der Leyen have prioritized cybersecurity for their second term, aiming for a 100-day deadline to address the issue.
The plan, announced on Wednesday, suggests the establishment of a dedicated Cybersecurity Support Centre within the European Union Agency for Cybersecurity (ENISA).
This center will offer customized cybersecurity assistance to healthcare organizations, seeking to reduce the effects of increasingly advanced attacks.
A primary concern is the growing occurrence of ransomware, responsible for over 50% of cyberattacks on healthcare from 2021 to 2023.
These attacks often force healthcare institutions to pay ransoms to regain access to critical systems, jeopardizing patient care and safety.
Besides the support center, the plan proposes creating cybersecurity educational resources for healthcare professionals and launching a warning service by 2026 to alert the sector to emerging threats. It also underscores the significance of a unified European response to large-scale cyber incidents via the Cyber Solidarity Act's EU Cybersecurity Reserve, which would offer technical assistance, coordination, and financial resources to EU member states.
The Commission is urging EU countries to provide financial backing for the initiative, suggesting the development of 'Cybersecurity Vouchers' to help smaller healthcare organizations enhance their cyber defenses.
These vouchers would resemble 'innovation vouchers' previously used to support SMEs.
Additionally, the Commission is encouraging countries to mandate that healthcare entities report ransom payments, a controversial issue due to many institutions' reluctance to disclose such payments, potentially compromising investigations.
Although healthcare institutions are already subject to EU cyber regulations, like the NIS2 Directive, which outlines cybersecurity and reporting standards for critical sectors, the Commission noted that many member states have been slow to implement these regulations into national law.
The healthcare sector is also affected by the Cyber Resilience Act (CRA), which establishes standards for the cybersecurity of products, including software used in medical devices.
The Commission's new action plan seeks to provide a comprehensive framework for detecting, responding to, and recovering from cyber threats in the healthcare sector, while promoting greater collaboration and resource-sharing across the EU. A public consultation on the plan is anticipated, with a non-binding recommendation expected by the end of 2025.
Healthcare is a prime target for cybercriminals, drawn to the high-risk nature of the sector, where successful attacks can have life-or-death implications.
However, many healthcare institutions face challenges with cybersecurity due to limited resources and a lack of specialized staff, resulting in vulnerabilities that cybercriminals can exploit.
As the Commission endeavors to enhance cybersecurity protections for this critical sector, the plan aims to create a safer environment for patients and healthcare providers alike.
With half of European hospitals targeted by cyberattacks, Health Commissioner Oliver Varhelyi and Commission President Ursula von der Leyen have prioritized cybersecurity for their second term, aiming for a 100-day deadline to address the issue.
The plan, announced on Wednesday, suggests the establishment of a dedicated Cybersecurity Support Centre within the European Union Agency for Cybersecurity (ENISA).
This center will offer customized cybersecurity assistance to healthcare organizations, seeking to reduce the effects of increasingly advanced attacks.
A primary concern is the growing occurrence of ransomware, responsible for over 50% of cyberattacks on healthcare from 2021 to 2023.
These attacks often force healthcare institutions to pay ransoms to regain access to critical systems, jeopardizing patient care and safety.
Besides the support center, the plan proposes creating cybersecurity educational resources for healthcare professionals and launching a warning service by 2026 to alert the sector to emerging threats. It also underscores the significance of a unified European response to large-scale cyber incidents via the Cyber Solidarity Act's EU Cybersecurity Reserve, which would offer technical assistance, coordination, and financial resources to EU member states.
The Commission is urging EU countries to provide financial backing for the initiative, suggesting the development of 'Cybersecurity Vouchers' to help smaller healthcare organizations enhance their cyber defenses.
These vouchers would resemble 'innovation vouchers' previously used to support SMEs.
Additionally, the Commission is encouraging countries to mandate that healthcare entities report ransom payments, a controversial issue due to many institutions' reluctance to disclose such payments, potentially compromising investigations.
Although healthcare institutions are already subject to EU cyber regulations, like the NIS2 Directive, which outlines cybersecurity and reporting standards for critical sectors, the Commission noted that many member states have been slow to implement these regulations into national law.
The healthcare sector is also affected by the Cyber Resilience Act (CRA), which establishes standards for the cybersecurity of products, including software used in medical devices.
The Commission's new action plan seeks to provide a comprehensive framework for detecting, responding to, and recovering from cyber threats in the healthcare sector, while promoting greater collaboration and resource-sharing across the EU. A public consultation on the plan is anticipated, with a non-binding recommendation expected by the end of 2025.
Healthcare is a prime target for cybercriminals, drawn to the high-risk nature of the sector, where successful attacks can have life-or-death implications.
However, many healthcare institutions face challenges with cybersecurity due to limited resources and a lack of specialized staff, resulting in vulnerabilities that cybercriminals can exploit.
As the Commission endeavors to enhance cybersecurity protections for this critical sector, the plan aims to create a safer environment for patients and healthcare providers alike.
Translation:
Translated by AI
AI Disclaimer: An advanced artificial intelligence (AI) system generated the content of this page on its own. This innovative technology conducts extensive research from a variety of reliable sources, performs rigorous fact-checking and verification, cleans up and balances biased or manipulated content, and presents a minimal factual summary that is just enough yet essential for you to function as an informed and educated citizen. Please keep in mind, however, that this system is an evolving technology, and as a result, the article may contain accidental inaccuracies or errors. We urge you to help us improve our site by reporting any inaccuracies you find using the "Contact Us" link at the bottom of this page. Your helpful feedback helps us improve our system and deliver more precise content. When you find an article of interest here, please look for the full and extensive coverage of this topic in traditional news sources, as they are written by professional journalists that we try to support, not replace. We appreciate your understanding and assistance.
