+420 266 104 111 (8:00-16:30, Mo-Fr)
Order

How to address cybersecurity in healthcare?

18. 7. 2025

Cybersecurity in healthcare must be approached comprehensively—at the organizational/hospital level (IT systems, processes, staff) and at the level of technologies and medical devices that handle patient data or communicate with other systems.

It is essential to distinguish between management systems (e.g., ISO/IEC 27001, ISO 13485, or the new Cybersecurity Act based on NIS2), which apply solely to the organization, its processes, and quality management.
These systems do not demonstrate or prove the cybersecurity of specific products or medical devices—this must be addressed separately through technical standards and specialized assessments.

Ensuring the security of medical devices and information systems requires:

  • Secure development and system management (e.g., according to IEC 81001-5-1 or IEC 62443-4-1)

  • Vulnerability testing and penetration testing (e.g., according to IEC 62443-4-2)

  • Implementation of an Information Security Management System (ISMS according to ISO/IEC 27001)

  • Assessment of compliance with NIS2, the Cybersecurity Act (ZoKB), GDPR, and MDR (Medical Device Regulation)

  • Preparation of technical documentation and compliance for notification or CE marking

EZÚ offers both organizational and product-related services, supporting hospitals, public institutions, and healthcare technology providers in managing the full process of cybersecurity—from GAP analysis and tailored training to pre-assessments, audits, and certification based on relevant standards and regulations.