The European Commission has launched a comprehensive action plan aimed at enhancing the cybersecurity of hospitals and healthcare providers across the EU. Announced as part of President Ursula von der Leyen’s political guidelines, this initiative addresses the growing threat of cyberattacks on the healthcare sector, which has become increasingly vulnerable as digitalization reshapes the industry.
Digital innovations, such as electronic health records, telemedicine, and AI-driven diagnostics, have revolutionized healthcare services, offering significant benefits to patients. However, these advancements have also exposed the sector to new cyber risks. Cyberattacks have the potential to disrupt essential services, delay medical procedures, and create severe bottlenecks in emergency rooms—issues that could directly affect the health and safety of Europeans.
According to reports, 2023 saw 309 major cybersecurity incidents within the healthcare sector—more than any other critical infrastructure. In response, the Commission’s new action plan aims to bolster the sector’s defenses, focusing on improving threat detection, preparedness, and response capabilities to create a safer environment for both patients and healthcare professionals.
Key Measures of the Action Plan
The plan outlines four main priorities to address the cybersecurity challenges facing healthcare providers:
Enhanced Prevention: The action plan seeks to enhance the sector’s ability to prevent cyber incidents. This includes providing guidance on best practices for cybersecurity and offering financial assistance through “Cybersecurity Vouchers” for micro, small, and medium-sized healthcare providers. Additionally, the EU will develop specialized cybersecurity training resources for healthcare professionals.
Improved Detection and Threat Identification: The establishment of a Cybersecurity Support Centre by ENISA (the EU Agency for Cybersecurity) will provide hospitals and healthcare providers with tailored tools, services, and training. One of the centre’s key functions will be to offer an EU-wide early warning system to detect cyber threats in near-real time by 2026.
Effective Response to Cyberattacks: To minimize the impact of cyberattacks, the Commission proposes a rapid response service under the EU Cybersecurity Reserve. This service, part of the Cyber Solidarity Act, will facilitate immediate incident response by trusted private service providers. The plan also includes the creation of detailed response playbooks for healthcare organizations, as well as national cybersecurity exercises. Additionally, member states will be encouraged to report ransom payments to assist law enforcement investigations.
Deterrence of Cyber Threat Actors: The action plan aims to deter cybercriminals from targeting Europe’s healthcare systems. This will involve deploying the Cyber Diplomacy Toolbox, a coordinated EU diplomatic initiative designed to counter malicious cyber activities.
Public Consultation and Next Steps
The Commission’s action plan will be developed in close collaboration with healthcare providers, member states, and the broader cybersecurity community. To refine and enhance the plan’s effectiveness, the Commission will soon launch a public consultation, inviting feedback from citizens and stakeholders alike.
The plan will be rolled out in phases, with specific actions to be implemented progressively in 2025 and 2026. The outcomes of the public consultation will inform further recommendations, with a final set of proposals expected by the end of 2025.
Strengthening Europe’s Cybersecurity Framework
This action plan builds on the EU’s broader efforts to fortify cybersecurity across critical sectors. Under the NIS2 Directive, healthcare providers are classified as critical infrastructure, subject to enhanced cybersecurity requirements. In addition, the Cyber Resilience Act, effective from December 2024, mandates that products with digital components meet stringent cybersecurity standards. The Commission has also established a Cyber Emergency Mechanism to facilitate coordinated responses to cybersecurity incidents across the EU.
These initiatives aim to protect the EU’s digital infrastructure, ensuring that critical sectors, including healthcare, remain resilient in the face of growing cyber threats. The implementation of the European Health Data Space, which will empower citizens to control their health data, will depend on the success of these cybersecurity measures, making robust protection all the more vital.
With the launch of this action plan, the EU takes a significant step toward safeguarding the healthcare sector from the escalating risks of cyberattacks, securing both patient care and public trust in digital healthcare systems.
Related topics
