EU action plan on the cybersecurity of hospitals (2025)

Summary

The action plan responds to the rise in cyberattacks, especially ransomware, against hospitals and healthcare providers, the most attacked sector in the EU in recent years. At its core is a European Cybersecurity Support Centre for hospitals and healthcare providers within ENISA, offering guidance, tools, services and training. The actions cover prevention (maturity assessments, vouchers for smaller providers, procurement guidelines, training), threat detection (a European catalogue of known exploited vulnerabilities for medical devices and electronic health record systems, an early warning service), response and recovery (a health rapid response service in the EU Cybersecurity Reserve, playbooks and exercises) and deterrence. It calls on Member States to designate national support centres and adopt national action plans on health sector cybersecurity.

Information

Jurisdiction

European Union

Issuing body

European Commission

Type

Action / implementation plan

Available languages

English, Italian (official translation), French (official translation), Spanish (official translation), German (official translation)

Topics

• Health
• Critical infrastructure
• Incident management / CSIRT
• Skills and training
• Supply chain

Strategic objectives

• Protect critical information infrastructure
• Establish incident response capability
• Organise cyber security exercises
• Strengthen training and education
• Strengthen supply chain security

Notes

Commission communication, not binding. The annex sets indicative deadlines in 2025 and 2026, for example the European network of health sector chief information security officers and training modules in the first quarter of 2026. The Commission announced recommendations to refine the plan in the fourth quarter of 2025: whether they have been adopted is to be verified.

European Commission. (2025). European action plan on the cybersecurity of hospitals and healthcare providers (COM(2025) 10 final). https://digital-strategy.ec.europa.eu/en/library/european-action-plan-cybersecurity-hospitals-and-healthcare-providers

European Commission. "European action plan on the cybersecurity of hospitals and healthcare providers." 15 January 2025. https://digital-strategy.ec.europa.eu/en/library/european-action-plan-cybersecurity-hospitals-and-healthcare-providers.

@misc{eu_action_plan_cybersecurity_hospitals_2025,
  author       = {{European Commission}},
  title        = {{European action plan on the cybersecurity of hospitals and healthcare providers}},
  year         = {2025},
  note         = {COM(2025) 10 final},
  url          = {https://digital-strategy.ec.europa.eu/en/library/european-action-plan-cybersecurity-hospitals-and-healthcare-providers},
  urldate      = {2026-10-29}
}