Cyber security for private healthcare
Test results, diagnoses and treatments are the data most valuable to blackmailers. For outpatient clinics, laboratories, care homes and private hospitals, information security is also continuity of care.
Cyber security in healthcare: data that cannot be changed
A stolen credit card can be blocked in five minutes. A diagnosis, a psychiatric record or the result of a genetic test stays true forever. That is why cyber security in healthcare starts from a simple fact: whoever steals health data can blackmail twice, first the organisation and then the individual patients.
Private healthcare providers often have an unfavourable combination: many users with different access (contract doctors, technicians, administrative staff, shift workers), management software from different suppliers, diagnostic equipment connected to the network and IT entrusted to an external consultant who comes in once a week. In a care home (in Italy, an RSA, a residential healthcare facility) or a private hospital, moreover, activity does not stop at night or on public holidays.
The typical episodes recur: the email pretending to come from the booking system supplier, the password for the test results portal reused elsewhere, the image archive server reachable from the internet for the convenience of the radiologist who reported from home.
Health data security: what the GDPR and NIS2 require
The GDPR applies to every provider, even a practice with two consulting rooms. NIS2 depends on size.
GDPR: special categories of data
Data concerning health falls under the "special categories" of Article 9: processing it requires security measures appropriate to the risk (Article 32), accurate records of processing and, for large-scale processing such as a hospital's, a data protection officer.
Data breaches
A data breach must be notified to the Garante (the Italian Data Protection Authority) within 72 hours of becoming aware of it; when health data is exposed, the risk to patients is often high enough that they must be told too. Our guide to data breaches in 72 hours explains the steps.
NIS2: the health sector
Legislative Decree 138/2024, the Italian law transposing NIS2, places health among the sectors of high criticality. It covers healthcare providers, public or private, that are at least medium-sized: medium-sized ones are important entities, large ones essential entities. Local health authorities are included as public administrations.
Health dossier, health record and access
The Garante's rules on the health dossier and those on the Italian Electronic Health Record (Fascicolo sanitario elettronico) require tracking of who consults patient data. On top of this comes the order on system administrators.
Medical devices. Regulation (EU) 2017/745 imposes cyber security requirements on manufacturers of devices with software. The organisation using them, however, remains responsible for the network it connects them to: an ultrasound scanner with an operating system that is no longer updated is a computer like any other, just harder to fix.
The priorities for outpatient clinics, laboratories, care homes and private hospitals
Four steps, each linked to a Dottor Box service. You can enable just one and add the others later.
Know where the health data is
The records of processing follow Article 30 of the GDPR field by field. If you use Google Drive, the platform reads only its metadata and flags, among the retention cases to check, health documents that have ended up in the wrong places.
List what is connected to the network
Asset Management and the network map also show devices without an agent: diagnostic equipment, label printers, switchboards, cameras. Scans are non-invasive, and you can exclude the most sensitive medical devices by IP address, port or MAC address.
Close the most used entry points
Scans of the external network and of the test results portal with the web application check, staff credentials searched for in data breaches by Dark Web Monitoring, simulated phishing run by Dottor Marc with Cyber Awareness.
Prepare to handle a breach
With Incident Response and the data breach register the response team has roles already assigned and every event follows the phases, from detection to lessons learned. The authorisation letters for doctors, nurses and other staff come out of GDPR forms.
An organisation that can answer the Garante and its patients
Tracked access
The access log register, with alerts on repeated failed attempts and, if you use Microsoft 365, on sign-ins from countries never seen before. Any account block happens only when a person confirms it.
GDPR documents in line with your staff
Appointments, instructions and privacy notices generated from the personnel records, to be regenerated when a new doctor joins.
A record of the before
Dated scans and archived reports show which measures were already in place on the day of the breach.
Cover at night too
For those who care for residents and patients 24 hours a day, the MDR + SOC 24/7 level adds a dedicated number for emergencies.
Questions about cyber security in healthcare
Does a private outpatient clinic fall under NIS2?
It does if it is a healthcare provider and exceeds the small enterprise thresholds, that is, it has at least 50 employees or an annual turnover or balance sheet total of at least €10 million. Below those thresholds it is, as a rule, not subject to NIS2, unless specifically designated by the authority. GDPR obligations on health data apply in any case, regardless of size.
Why does health data need more protection than other data?
The GDPR places it among the special categories of data in Article 9, because its disclosure can cause discrimination or damage to the reputation or employment of the person concerned. The Article 32 security measures must therefore be calibrated to a higher risk. In the event of a breach it is more likely that the patients involved must also be informed.
Does a care home have to appoint a DPO?
The GDPR makes it mandatory when the core activity consists of large-scale processing of health data. A hospital or a large residential facility usually falls into this case; an individual doctor or a small practice generally does not. The assessment must be made and documented case by case, and the Garante has published specific guidance for healthcare.
Can networks with medical devices be scanned?
Yes, with some precautions. Dottor Box scans are non-invasive and are scheduled on the days and at the times you choose. Diagnostic equipment that the manufacturer asks not to be probed is excluded by address, port or MAC address, and still remains visible in the inventory as a device present on the network.
How quickly must a data breach involving health data be notified?
To the Garante within 72 hours of the organisation becoming aware of it, unless a risk to people is unlikely. If the risk is high, the people concerned must also be informed, without undue delay. If the organisation is also a NIS2 entity, the significant incident follows in parallel the deadlines towards CSIRT Italia, the national incident response team: early warning within 24 hours and notification within 72.
The modules healthcare providers use most
Records of processing
The GDPR Article 30 register, with processing activities suggested by an analysis of your Drive.
Learn more GovernGDPR forms
Appointments, privacy notices and authorisation letters for all your staff, generated in one step.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more SeeCyber Awareness
Simulated phishing campaigns prepared and run by Dottor Marc, with the results in the platform.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.