# Action Plan on the Cybersecurity of Hospitals and Healthcare Providers Canonical URL: https://digital-acquis.eu/initiative/action-plan-on-the-cybersecurity-of-hospitals-and-healthcare-providers Entry type: initiative Source edition current through: 17 July 2026 (2026-07-17). This is not a page modification date. Status: delivered. A delivered initiative is not necessarily legislation in force. Instrument: Communication Date as recorded: 15 Jan 2025 Date kind: date Status note: full date links only to published artifact types ## Summary Healthcare cybersecurity action is centred on a European Cybersecurity Support Centre, sector-specific guidance, maturity assessment and incident-response support. Planned measures include a rapid-response service in the EU Cybersecurity Reserve, a Health Cybersecurity Advisory Board, a network of health CISOs, cyber exercises and a ransomware recovery subscription service. The plan also covers cyber hygiene, threat intelligence, procurement guidance, training, regulatory mapping and international cooperation. ## Sources - [Official source]() ## Action items (33; complete published list) ### 1. Action item 170001 Ensure appropriate resources for the Cybersecurity Support Centre Work with the ECCC to launch pilot projects to develop best practices for cyber hygiene and security risk assessment, and to address the need for continuous cybersecurity monitoring, threat intelligence and incident response using state-of- the art cybersecurity solutions, for the development of the European Cybersecurity Support Centre’s service catalogue 2025 Provenance: source document doc-018, paragraph 1. Digital dimension: no. ### 2. Action item 170002 In consultation with the NIS Cooperation Group, EU-CyCLONe and ENISA, explore identifying health as a sector for which support can be given for coordinated preparedness testing under the Cyber Solidarity Act Q1 2025 Provenance: source document doc-018, paragraph 2. Digital dimension: no. ### 3. Action item 170003 Together with ENISA, ensure the EU Cybersecurity Reserve includes a Rapid Response Service specifically for the health sector Q4 2025 Provenance: source document doc-018, paragraph 3. Digital dimension: no. ### 4. Action item 170004 Supported by ENISA, set up a joint Health Cybersecurity Advisory Board Q1 2025 Provenance: source document doc-018, paragraph 4. Digital dimension: no. ### 5. Action item 170005 Launch a call for action for cybersecurity companies, foundations, educational institutions, and industry stakeholders to pledge actions to address the challenges in the health sector Q2 2025 Provenance: source document doc-018, paragraph 5. Digital dimension: no. ### 6. Action item 170006 Together with the High Representative, explore the use of Cyber Diplomacy Toolbox measures to prevent, discourage, deter and respond to malicious activities against health systems 2025 Provenance: source document doc-018, paragraph 6. Digital dimension: no. ### 7. Action item 170007 Advance international cooperation against ransomware actors, notably in the International Counter Ransomware Initiative, working together with the High Representative 2025-2026 Provenance: source document doc-018, paragraph 7. Digital dimension: no. ### 8. Action item 170008 Seek cooperation in the G7 Cybersecurity Working Group to strengthen the cybersecurity of the health sector 2025-2026 Provenance: source document doc-018, paragraph 8. Digital dimension: no. ### 9. Action item 170009 Launch comprehensive stakeholder consultations Q1 2025 Provenance: source document doc-018, paragraph 9. Digital dimension: no. ### 10. Action item 170010 Adopt recommendations to further refine the Action Plan Q4 2025 Provenance: source document doc-018, paragraph 10. Digital dimension: no. ### 11. Action item 170011 Begin work to establish a European Cybersecurity Support Centre for hospitals and healthcare providers Q2 2025 Provenance: source document doc-018, paragraph 11. Digital dimension: no. ### 12. Action item 170012 Develop a comprehensive service catalogue to be provided by the Cybersecurity Support Centre From Q4 2025 Provenance: source document doc-018, paragraph 12. Digital dimension: no. ### 13. Action item 170013 Issue guidance that highlights the most critical cybersecurity practices and aid healthcare providers in implementing them Q3 2025 Provenance: source document doc-018, paragraph 13. Digital dimension: no. ### 14. Action item 170014 In close collaboration with Commission and Member States, develop a regulatory mapping tool Q1 2025 Provenance: source document doc-018, paragraph 14. Digital dimension: no. ### 15. Action item 170015 Develop a framework for cybersecurity maturity assessments specific to healthcare Q3 2025 Provenance: source document doc-018, paragraph 15. Digital dimension: no. ### 16. Action item 170016 Carry out an annual Health Cyber Maturity Assessment 2025-2026 Provenance: source document doc-018, paragraph 16. Digital dimension: no. ### 17. Action item 170017 Collaborate with Member States and regional programme authorities to create Cybersecurity Voucher model programmes 2025-2026 Provenance: source document doc-018, paragraph 17. Digital dimension: no. ### 18. Action item 170018 Develop new procurement guidelines for cybersecurity of hospitals and healthcare providers Q3 2025 Provenance: source document doc-018, paragraph 18. Digital dimension: no. ### 19. Action item 170019 Create a European Health CISOs Network Q1 2026 Provenance: source document doc-018, paragraph 19. Digital dimension: no. ### 20. Action item 170020 Design and promote training modules and courses for healthcare professionals Q1 2026 Provenance: source document doc-018, paragraph 20. Digital dimension: no. ### 21. Action item 170021 Build up a European KEV catalogue for medical devices, electronic health record systems and providers of ICT equipment and software in health Q4 2025 Provenance: source document doc-018, paragraph 21. Digital dimension: no. ### 22. Action item 170022 Introduce an EU-wide early warning subscription service for the health sector As of 2026 Provenance: source document doc-018, paragraph 22. Digital dimension: no. ### 23. Action item 170023 Support the European Health ISAC with tools and information exchange 2025-2026 Provenance: source document doc-018, paragraph 23. Digital dimension: no. ### 24. Action item 170024 Together with the Commission, ensure the EU Cybersecurity Reserve includes a Rapid Response Service specifically for the health sector Q4 2025 Provenance: source document doc-018, paragraph 24. Digital dimension: no. ### 25. Action item 170025 In collaboration with the CSIRTs Network, develop cyber incident response playbooks tailored for healthcare Q3 2025 Provenance: source document doc-018, paragraph 25. Digital dimension: no. ### 26. Action item 170026 Facilitate a large roll out of national cybersecurity exercises to test the playbooks and strengthen incident response protocols As of Q4 2025 Provenance: source document doc-018, paragraph 26. Digital dimension: no. ### 27. Action item 170027 Provide a ransomware recovery subscription service As of 2026 Provenance: source document doc-018, paragraph 27. Digital dimension: no. ### 28. Action item 170028 Together with Europol, identify the most common ransomware strains targeting healthcare organisations and expand the repository of decryption tools through the No More Ransom project. Q4 2025 Provenance: source document doc-018, paragraph 28. Digital dimension: no. ### 29. Action item 170029 Together with Europol, develop accessible guidance to help healthcare providers avoid paying ransoms Q3 2025 Provenance: source document doc-018, paragraph 29. Digital dimension: no. ### 30. Action item 170030 Assist Member States in developing national action 2025 plans Provenance: source document doc-018, paragraph 30. Digital dimension: no. ### 31. Action item 170031 Coordinate efforts to ensure that resources and strategies of individual Member States complement each other 2025-2026 Provenance: source document doc-018, paragraph 31. Digital dimension: no. ### 32. Action item 170032 In consultation with the Commission, regularly provide updates of the work of the Cybersecurity Support Centre to relevant networks of Member States 2025-2026 Provenance: source document doc-018, paragraph 32. Digital dimension: no. ### 33. Action item 170033 Continually exchange with the Health Cybersecurity Advisory Board 2025-2026 Provenance: source document doc-018, paragraph 33. Digital dimension: no. ## Citing documents - [Political Guidelines 2024-29]() — status: not recorded. The Political Guidelines link European competitiveness with industrial renewal, digital innovation and simpler rules for businesses. They propose support for AI, data sharing, biotechnology and strategic investment, alongside cleaner energy, circular production and changes to public procurement. A Union of Skills would connect education, training and recognition of qualifications across borders. The programme also covers hospital cybersecurity, protection against online manipulation and harmful platform design, and measures to improve working conditions. International partnerships and economic security form part of this agenda, while institutional reforms and stronger cooperation on lawmaking are intended to support its implementation. Source document doc-002, action item 30015: > We must also do more to protect the security of our health systems, which are increasingly the target of cyber and ransomware attacks. To improve threat detection, preparedness and crisis response, I will propose a European action plan on the cybersecurity of hospitals and healthcare providers in the first 100 days of the mandate. - [Commission work programme 2025 + Annex]() — status: not recorded. The 2025 work programme brings together planned legislation and policy strategies covering competitiveness, the Single Market and industrial transition. Its programme includes measures on affordable energy, startups and scaleups, savings and investment, and business simplification. Digital priorities span AI, quantum technology, electronic communications, business wallets and the space sector. The programme also identifies work on defence, preparedness, internal security and hospital cybersecurity. Skills, quality jobs, consumer protection and democratic resilience sit alongside these economic and technological measures. Each listed initiative carries an indicative timetable, and the programme distinguishes legislative proposals from non-legislative plans. Source document doc-005, action item 60019: > Action plan on the cybersecurity of hospitals and healthcare providers (non-legislative, Q1 2025) ## Current developments Latest updates from Digital Policy Alert and Global Trade Alert. No reviewed developments available; this does not establish that no developments exist. ## Associated policy priorities - [External Strategy, Security & Democratic Resilience]() ## Broader policy context (shared priority; not a direct citation) - [Action Plan on Drone and Counter Drone Security]() — status: delivered. Action Plan on Drone and Counter-Drone Security prioritises a Drone Security Package, coordinated risk assessment and industrial coordination to address drone threats. Proposed actions include registration and direct remote identification for drones above 100g, D-TECT Forum launch in Q2 2026, a Drone Security Toolbox and an EU Trusted Drone Label. The plan also covers resilience testing for critical infrastructure, training, cellular detection, voluntary deployment and procurement, annual exercises, a centre of excellence and cooperation with Ukraine. - [Digitalisation of Return Case Management]() — status: forthcoming. The Commission will table a dedicated initiative to digitalise Member States’ return case management, as part of a new common approach on returns. COM(2025) 101 sets a common return system and, in Art. 42(1)(d), makes national digital systems for return/readmission/reintegration a core component; a separate act will specify interoperability, once-only data flows and statistics. The Commission’s Political Guidelines commit to digitalising case management; von der Leyen’s 17 March letter signalled presentation by end-2025. A 2026 consultation under the Work Programme will prepare governance and implementation, aligning with SIS/Eurodac and digital-by-default delivery while ensuring uniform practice across the Union. - [DigitalJustice@2030]() — status: delivered. The Commission's justice digitalisation programme will expand shared tools, data availability and cross-border digital cooperation. It plans a repository of digital justice tools, an IT toolbox, exchanges among Member States and guidance on high-risk AI. Other actions cover legal and judicial-data reuse, common videoconferencing requirements, remote participation in criminal hearings, support for national digitalisation and further development of the European Electronic Access Point. - [EU Action Plan on Cable Security]() — status: delivered. EU Action Plan on Cable Security aims to prevent, detect and respond to risks affecting submarine cables. By Q4 2025, the Commission, Member States and ENISA are to complete cable mapping, a coordinated risk assessment, a Cable Security Toolbox and a priority list of Cable Projects of European Interest. Further measures address investment, integrated surveillance, regional hubs, sensors, surveillance drones, incident reporting, repair vessels and spare parts, alongside crisis response, NATO cooperation, diplomacy, sanctions and attribution. - [European Centre for Democratic Resilience]() — status: not recorded. The Centre will be the operational backbone of the European Democracy Shield, uniting national capabilities to detect, analyse and attribute foreign information manipulation and interference (FIMI). It will pool open-source intelligence, media forensics and platform signals, provide rapid alerts and incident-response templates, and coordinate joint attribution with partners. The Centre will convene Member States and neighbouring countries, standardise methodologies, and channel support to independent media and media-literacy initiatives. By closing gaps between monitoring, policy action and sanctions, it will strengthen deterrence, help protect elections and debate, and build a European capacity against hybrid threats. - [European Democracy Shield]() — status: delivered. It will harden democratic resilience by combining early detection of foreign information manipulation, coordinated analysis and rapid response across the Union. A new European Centre for Democratic Resilience will pool national expertise and capacities as the hub for monitoring, attribution and joint action with partners. The Shield will leverage the EU’s FIMI toolbox and the Digital Services Act, expand media- and digital-literacy efforts, and strengthen crisis communication to counter disinformation systematically. It complements a forthcoming Media Resilience Programme supporting independent journalism, and is anchored in upgrades to EU internal-security governance. Work will also address harmful social-media design and youth well-being through expert advice on safeguards and enforcement. - [European Preparedness Union Strategy]() — status: delivered. The Preparedness Union Strategy would improve EU anticipation, coordination and response across crises through an EU risk and threat assessment, crisis dashboard and an upgraded Emergency Response Coordination Centre. It also proposes stockpiling, minimum preparedness requirements, revised civil-protection arrangements, early-warning guidance and preparedness training. The strategy includes measures for public-private continuity planning, population self-sufficiency during extreme disruptions, EU-wide exercises, civil-military coordination and cooperation with partner countries. - [European Space Shield]() — status: forthcoming. The European Space Shield is a proposed flagship within the Readiness Roadmap for defence readiness. It would establish and protect a European system of space capabilities for defence purposes, building on EU space systems and national capacities. The roadmap envisages endorsement of the shield as a priority flagship, coordinated prioritisation through space and defence programmes, coordination with Member States' procurement plans, and the shield's launch. - [Europol & Eurojust Revision]() — status: in progress. Europol & Eurojust Revision seeks to modernise Eurojust's legal framework and strengthen cross-border criminal-justice cooperation. The proposal addresses structural and operational constraints identified by the 2025 evaluation, improving governance and operational performance, cooperation with EU partners and third countries, and analytical and proactive capacity. It would expand Eurojust's mandate to cybercrime, gender-based violence and violations of EU restrictive measures, while reinforcing coordination with Europol and supporting work on serious and organised cross-border crime. - [Frontex Revision & EU Visa Support Office]() — status: forthcoming. Frontex is slated for a stronger mandate and reinforced standing corps, allowing the European Border and Coast Guard Agency to expand its presence and operational support. The Commission also assigns Frontex a stronger role in supporting Member States with returns and places a visa strategy among measures aimed at attracting international talent and reducing administrative barriers. - [Harmonised EU Framework for Data Retention]() — status: forthcoming. The Commission is preparing an impact assessment on data retention by service providers for criminal proceedings. The work responds to divergent national rules and the absence of an EU-wide framework, which authorities identify as an obstacle to investigations and cross-border cooperation. Consultations will examine the obstacles, possible non-regulatory and regulatory responses, and impacts on citizens' security, electronic-communications services and the protection of fundamental rights. - [International Digital Strategy]() — status: delivered. International Digital Strategy would extend EU digital cooperation through partnerships, dialogues, trade agreements and infrastructure with trusted partners. The programme covers secure connectivity, Digital Public Infrastructure, AI, software, submarine cables, satellite connectivity, quantum research, semiconductors, high-performance computing, cybersecurity and digital identity. Measures include the Digital Partnership Network, additional bilateral and regional partnerships, EU Tech Business Offer, support for Arctic, MEDUSA and Blue-Raman cables, and integration work on the EU Digital Identity Wallet with Ukraine, Moldova and the Western Balkans. - [New Strategic EU-India Agenda]() — status: delivered. Europe have tabled a Strategic EU–India Agenda that elevates the partnership across five pillars: prosperity, technology, security, connectivity and enablers. It prioritises concluding an FTA and an Investment Protection Agreement, alongside Global Gateway investments and supply-chain de-risking via the EU–India TTC (chips, solar, APIs). It deepens digital cooperation (e.g. trusted data flows, secure 5G/6G and interoperable digital public infrastructures) and expands joint R&I in AI, HPC/quantum and space. A Security and Defence Partnership with a Security of Information Agreement will underpin maritime, cyber and hybrid resilience. Delivery will be steered by an annual summit, upgraded TTC, and an EU–India Business Forum. - [ProtectEU: A European Internal Security Strategy]() — status: delivered. ProtectEU sets out EU internal-security action based on regular threat assessments and stronger operational capacity. It covers terrorism, organised crime, cyber-related and hybrid threats, with proposed changes involving Europol, Eurojust and Frontex. The strategy also calls for a European Critical Communication System, better protection of critical infrastructure and transport hubs, stronger cybersecurity, updated organised-crime and firearms rules, and closer operational cooperation with partner regions. - [Roadmap on Lawful and Effective Access to Data]() — status: delivered. The Roadmap for lawful and effective access to data for law enforcement sets out the conditions that should govern access to digital evidence. It says access must be necessary, proportionate, founded on clear, precise and accessible legal rules, subject to independent oversight and accompanied by effective remedies. The roadmap identifies deleted data, jurisdictional conflicts, difficult device forensics, encryption and limited analytical capacity as obstacles to obtaining criminal evidence. - [Strengthening EU Economy Security]() — status: delivered. Strengthening EU Economy Security centres on faster risk assessment, shared intelligence and action to reduce dependencies in critical supply chains, technologies and infrastructure. The Commission proposes an Economic Security Information Hub, stronger coordination with Member States, an adviser group involving businesses, trade-resilience information and an expanded Observatory on Critical Technologies. It will also consider funding safeguards, foreign-investment screening guidance, dual-use export-control evaluation, trade-defence tools, customs measures, procurement preferences and restrictions on high-risk suppliers. - [Team Europe]() — status: delivered. Aligns the EU, Member States, the EIB/EBRD, agencies and the private sector to act as one, pooling finance, expertise and diplomacy for maximum impact. Born during COVID-19, it is now the default delivery model for international partnerships and Global Gateway. It coordinates over 160 Team Europe Initiatives and mobilised €179 billion in 2021–2023, underpinned by instruments such as the €40 billion EFSD+ guarantee and regular Global Gateway business fora, with governance via a Board, Business Advisory Group, and a Civil Society & Local Authorities platform. By joining up investments, reforms and standards, Team Europe scales high-standard projects worldwide and strengthens EU strategic influence. - [The Pact for the Mediterranean]() — status: delivered. The EU will forge a new pact with Southern Neighbourhood partners, building on the 2021 Agenda, with a strong digital pillar to deepen political engagement and cooperation. Priorities include secure connectivity under Global Gateway (most visibly the MEDUSA submarine cable linking the northern and southern shores and boosting regional capacity) alongside resilient cable and satellite links. Cooperation will use Trade & Technology-style dialogues, Cyber Dialogues, and association to Horizon Europe and Digital Europe, embedded in tailor-made Comprehensive and Strategic Partnerships (e.g. Tunisia, Egypt, Jordan). Work will advance trusted 5G/cable security, skills and innovation, and gradual policy harmonisation supporting integration with EU digital rules where relevant. - [White Paper for European Defence]() — status: delivered. The White Paper invites Member States to increase collaborative defence procurement and proposes fast consideration of SAFE and the European Defence Industry Programme. It calls for military support to Ukraine and greater integration of Ukraine's defence industry, mobility corridors and access to EU space-based governmental services. Further measures include a defence-industry dialogue, a Defence Omnibus Simplification proposal, an armament technology roadmap and military-mobility action. --- [Reading guide and interpretation notes]() · [Methodology]()