Transforming healthcare cybersecurity with the NIS2 Directive
The healthcare sector has emerged as one of the main targets for cybercriminals, primarily due to the high value of health data in illicit buying and selling activities. This situation is exacerbated by the increasing use of new technologies and the lack of robust procedures and awareness among healthcare professionals of the critical importance of their operations. As a result, health data, which is particularly protected under Article 9.1 of the General Data Protection Regulation (GDPR), is exposed to significant risks during processing.
The evolving nature of cyber threats has made it necessary to update cybersecurity regulations. In response, the European Union has adopted the NIS2 Directive, a legal framework designed to ensure a high common level of cybersecurity across the Union. This directive, which replaces the previous NIS Directive of 2016, is expected to be transposed into Spanish law during 2024.
Application of the NIS2 Directive in the healthcare sector
The NIS2 Directive applies to both public and private entities in the healthcare sector, as categorised in Annexes I and II. Large companies with more than 250 employees and an annual turnover exceeding €50 million are considered essential entities. Meanwhile, medium-sized companies with more than 50 employees and an annual turnover exceeding €10 million, as well as certain medium-sized and large companies listed in Annex II of the Directive, are classified as important entities.
In addition, each EU Member State has the authority to classify service providers as essential or important entities if their failure could have a significant impact on public safety and health, even if they do not meet the general size criteria.
Although the formal transposition of the NIS2 Directive into Spanish legislation is still pending, entities that will be subject to these regulations can begin implementing security risk management measures. These measures include information system security policies, business continuity, assessment of security measures, incident management, human resources security, risk analysis and multi-factor authentication solutions, among others.
The directive establishes that essential and important entities must report any significant incident to their designated CSIRT (Computer Security Incident Response Team) or the competent authority. These notifications must be made in three stages: an initial notification within 24 hours of detecting the incident, an intermediate update after 72 hours, and a final report within one month containing full details of the incident.
Member States may also implement supervisory measures and penalties to ensure compliance with the directive. Supervisory measures may include security audits, security assessments and tests to verify the implementation of security policies.
Failure to comply with the NIS2 Directive may result in significant penalties. For important entities, fines may reach €7 million or 1.4% of annual turnover, whichever is higher. For essential entities, penalties may be even more severe, with fines of up to €10 million or 2% of annual turnover. In serious cases, a temporary ban on holding management positions may also be imposed on directors responsible for the affected entity.
European Health Data Space (EHDS)
In addition to the NIS2 Directive, the European Health Data Space (EHDS) Regulation, recently approved by the European Parliament and awaiting publication, also plays a crucial role in protecting health data. This regulation aims to place citizens at the centre of their healthcare by giving them full control over their data. It also facilitates the use of this data for research and public health purposes under strict conditions.
The EHDS covers manufacturers and suppliers of Electronic Health Record (EHR) systems, as well as controllers and processors of electronic health data relating to EU citizens and legally resident third-country nationals in Member States.
Compliance with the NIS2 Directive and the EHDS is crucial for any healthcare organisation seeking to protect health data. At Baker Tilly, our team of specialists in Digital Law and data protection is available to provide guidance. We help your company align with current regulations and strengthen its defences against cyber threats.
Contact us to ensure that your company's and your clients' information is protected effectively and securely.
Related content
