Action Plan on the Cybersecurity of Hospitals and Healthcare Providers
On this page
Summary
Healthcare cybersecurity action is centred on a European Cybersecurity Support Centre, sector-specific guidance, maturity assessment and incident-response support. Planned measures include a rapid-response service in the EU Cybersecurity Reserve, a Health Cybersecurity Advisory Board, a network of health CISOs, cyber exercises and a ransomware recovery subscription service. The plan also covers cyber hygiene, threat intelligence, procurement guidance, training, regulatory mapping and international cooperation.
Action items
Ensure appropriate resources for the Cybersecurity Support Centre Work with the ECCC to launch pilot projects to develop best practices for cyber hygiene and security risk assessment, and to address the need for continuous cybersecurity monitoring, threat intelligence and incident response using state-of- the art cybersecurity solutions, for the development of the European Cybersecurity Support Centre’s service catalogue 2025
In consultation with the NIS Cooperation Group, EU-CyCLONe and ENISA, explore identifying health as a sector for which support can be given for coordinated preparedness testing under the Cyber Solidarity Act Q1 2025
Together with ENISA, ensure the EU Cybersecurity Reserve includes a Rapid Response Service specifically for the health sector Q4 2025
Supported by ENISA, set up a joint Health Cybersecurity Advisory Board Q1 2025
Launch a call for action for cybersecurity companies, foundations, educational institutions, and industry stakeholders to pledge actions to address the challenges in the health sector Q2 2025
Together with the High Representative, explore the use of Cyber Diplomacy Toolbox measures to prevent, discourage, deter and respond to malicious activities against health systems 2025
Advance international cooperation against ransomware actors, notably in the International Counter Ransomware Initiative, working together with the High Representative 2025-2026
Seek cooperation in the G7 Cybersecurity Working Group to strengthen the cybersecurity of the health sector 2025-2026
Launch comprehensive stakeholder consultations Q1 2025
Adopt recommendations to further refine the Action Plan Q4 2025
Begin work to establish a European Cybersecurity Support Centre for hospitals and healthcare providers Q2 2025
Develop a comprehensive service catalogue to be provided by the Cybersecurity Support Centre From Q4 2025
Issue guidance that highlights the most critical cybersecurity practices and aid healthcare providers in implementing them Q3 2025
In close collaboration with Commission and Member States, develop a regulatory mapping tool Q1 2025
Develop a framework for cybersecurity maturity assessments specific to healthcare Q3 2025
Carry out an annual Health Cyber Maturity Assessment 2025-2026
Collaborate with Member States and regional programme authorities to create Cybersecurity Voucher model programmes 2025-2026
Develop new procurement guidelines for cybersecurity of hospitals and healthcare providers Q3 2025
Create a European Health CISOs Network Q1 2026
Design and promote training modules and courses for healthcare professionals Q1 2026
Build up a European KEV catalogue for medical devices, electronic health record systems and providers of ICT equipment and software in health Q4 2025
Introduce an EU-wide early warning subscription service for the health sector As of 2026
Support the European Health ISAC with tools and information exchange 2025-2026
Together with the Commission, ensure the EU Cybersecurity Reserve includes a Rapid Response Service specifically for the health sector Q4 2025
In collaboration with the CSIRTs Network, develop cyber incident response playbooks tailored for healthcare Q3 2025
Facilitate a large roll out of national cybersecurity exercises to test the playbooks and strengthen incident response protocols As of Q4 2025
Provide a ransomware recovery subscription service As of 2026
Together with Europol, identify the most common ransomware strains targeting healthcare organisations and expand the repository of decryption tools through the No More Ransom project. Q4 2025
Together with Europol, develop accessible guidance to help healthcare providers avoid paying ransoms Q3 2025
Assist Member States in developing national action 2025 plans
Coordinate efforts to ensure that resources and strategies of individual Member States complement each other 2025-2026
In consultation with the Commission, regularly provide updates of the work of the Cybersecurity Support Centre to relevant networks of Member States 2025-2026
Continually exchange with the Health Cybersecurity Advisory Board 2025-2026