In a digital era marked by increasingly interconnected information systems, healthcare has become one of the most exposed components of national critical infrastructure. Cyber attacks on medical information systems can delay or block treatment, compromise sensitive personal data and, in the worst cases, put patient lives at risk. Hospitals, laboratories, emergency units and the platforms managing electronic health records are frequent targets, particularly given the global rise in ransomware and phishing.
Directive (EU) 2022/2555 (NIS 2) lists healthcare in Annex I, among the sectors of high criticality, and imposes clear obligations on risk assessment, technical and organisational measures, incident reporting and continuity of care. In a sector where systems cannot simply be switched off while a problem is fixed, the ability to keep working safely without them is part of the requirement.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Health sector
Essential entities:
Healthcare providers, EU reference laboratories, entities carrying out research and development of medicinal products, entities manufacturing basic pharmaceutical products and preparations, and entities manufacturing medical devices considered critical during a public health emergency.
- Hospitals and other healthcare providers
- Medical analysis and reference laboratories
- Emergency and ambulance services
- Operators of electronic health record platforms
- Manufacturers of critical medicinal products and medical devices
Sector-specific cyber threats
- Ransomware that blocks access to patient records and imaging systems
- Unauthorised access to electronic health records and sensitive personal data
- Attacks on connected medical devices and monitoring equipment
- Disruption of laboratory information and result reporting systems
- Phishing targeting clinical and administrative staff
- Compromise of suppliers of medical software and equipment
NIS 2 requirements for the health sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Total dependency on electricity and communications for clinical systems
- Links with emergency services and with public health reporting
- Effects on patient safety when systems become unavailable
- Overlap with data protection obligations for health data
Protecting healthcare information systems means protecting patient safety, sensitive data and the continuity of care. Complying with NIS 2 is not only a legal obligation but a strategic investment in the resilience of the institution.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.