🏥NIS2 for Health — deadlines, obligations, fines

A documented framework, all-hazards approach, covering risk policies, system security, incident handling, business continuity (with documented RTO/RPO for ICU, operating theatres, ER, pharmacy, laboratories), cryptography, MFA, training, access control and human resources security. NIS2 Art. 21(2) imposes the ten minimum measures (a-j), aligned with ISO/IEC 27001 and ISO/IEC 27002 [C3]. For hospitals, the ENISA Technical Implementation Guidance v1.0 (2025) remains the technical reference — not Reg. 2024/2690, which legally targets DNS, cloud, MSP and data-centre providers and not hospitals [C17]. The management body of the entity (board of directors, governing board, executive committee) approves and oversees implementation under NIS2 Art. 20, with personal accountability [C14].

For a hospital under NIS2 where a cyber incident also touches patient data, the same event triggers two parallel reporting flows. NIS2 Art. 23 to CSIRT/DNSC: early warning within 24 hours of awareness, incident notification within 72 hours, final report within one month [C4]. GDPR Art. 33 to ANSPDCP (the Romanian Data Protection Authority): notification of the personal-data breach within 72 hours of awareness, where there is a risk to the rights and freedoms of natural persons [C8]. The two 72-hour clocks run independently — the start point may differ (awareness of a "significant incident" vs. awareness of a "personal data breach"). In practice, the CISO and DPO share a single runbook feeding both the DNSC and ANSPDCP filings simultaneously, with no duplicated work and no delay to either.

Health data is a special category of personal data — GDPR Art. 9(1) prohibits processing, subject to the exceptions in Art. 9(2): explicit consent, medical care / diagnosis, substantial public interest in public health, scientific research, etc. [C7]. Implementation required by NIS2 Art. 21(2)(h) (cryptography) plus GDPR Art. 32 (technical and organisational measures) includes encryption in transit (TLS 1.3) and at rest for HIS/EHR/PACS/LIS, segregation of clinical and administrative networks, persistent audit logging, minimum retention for identifiable data, and pseudonymisation/anonymisation for research. The agreement with the HIS vendor or cloud provider becomes a DPA plus security-clause contract — not just an IT service agreement.

For a hospital, business continuity means ICU patients are not left without monitoring, operating theatres can intervene 24/7, and the pharmacy can dispense medication. NIS2 Art. 21(2)(c) imposes business continuity and crisis management as minimum measures [C3]. In practice: working offline plans (paper forms, manual laboratory routing, clinical decisions without the HIS), annual exercises with tabletops and simulations, immutable offline backups (rotated and restore-tested), multi-site redundancy for imaging and laboratories. The BackMyData / Hipocrate lesson (February 2024) is that hospitals with recent functioning backups resumed operations rapidly; those that had not tested their backups spent days or weeks in manual mode [C18].

Hospitals do not just buy IT: they buy CT and MRI scanners, ICU monitors, infusion pumps, connected defibrillators, PACS systems, laboratory systems (LIS) — all with firmware, software and connectivity. NIS2 Art. 21(2)(d) requires supply-chain security [C3]. MDR (Reg. 2017/745) imposes essential cybersecurity requirements on manufacturers of devices with software, including risk management and security-by-design (Annex I, sections 14.2(d) and 17.2) [C9]; IVDR (Reg. 2017/746) extends these to in-vitro diagnostic devices from 26 May 2022 [C10]. Concretely: contract clauses with each manufacturer (patching SLA, SBOM, vulnerability disclosure), a technical inventory of devices with IP / firmware, network segregation for classes of non-patchable devices, and behavioural monitoring for anomalies. The Düsseldorf lesson (2020): a backdoor on Citrix CVE-2019-19781 sat for ~9 months on the network and ultimately contributed to the death of a patient transferred to another hospital.

Type: BackMyData ransomware (Phobos family); vector RDP / access via a third-party ICT supplier

Impact: 26 spitale afectate (printre care Spitalul de Pediatrie Pitesti, primul care a raportat pe 10 februarie 2024); criptare date HIS; cerere de rascumparare 3,5 BTC (~157.000 EUR / ~180.000 USD la momentul atacului — februarie 2024). Majoritatea spitalelor afectate aveau backup-uri recente, restaurare relativ rapida. Incidentul a fost invocat in nota de fundamentare a OUG 155/2024 ca justificare directa a transpunerii NIS2 in Romania.

Lesson: Compromise of a single software vendor (RSC) propagated the incident to 26 public hospitals. NIS2 Art. 21(2)(d) and OUG 155/2024 require continuous contractual assessment and monitoring of critical ICT providers in healthcare; network segregation plus tested offline backups saved most of the units.

Type: DoppelPaymer ransomware; exploit of Citrix CVE-2019-19781 (Shitrix), latent backdoor since December 2019

Impact: Spitalul a iesit din sistemul de urgenta; o pacienta de 78 ani a fost transferata la un spital la ~32 km distanta si a decedat in timpul transportului — primul caz public de deces direct asociat unui atac ransomware. Procurorii din Koln au deschis o ancheta pentru omor din culpa. Operatorii DoppelPaymer au furnizat ulterior cheia de decriptare cand au realizat ca au lovit un spital.

Lesson: Poor patch management (~9 months between the Citrix patch and exploitation) within a critical clinical perimeter contributed to the first death publicly linked to a ransomware attack. NIS2 Art. 21(2)(e) and MDR Annex I 17.2 require vulnerability handling and security-by-design for clinical devices and systems.

Type: Qilin ransomware (3 June 2024); encryption of the Synnovis network + data exfiltration

Impact: Servicii de patologie pentru NHS Londra blocate. La King's College + Guy's and St Thomas' — 1.134 operatii planificate si 2.194 programari ambulatorii anulate in primele 13 zile. Analize de sange in capitala operationale la ~10% din capacitate. Cerere de rascumparare 50 mil. USD, refuzata. Peste 900.000 pacienti cu date potential exfiltrate.

Lesson: A single compromised pathology provider paralysed two of London's largest NHS trusts. NIS2 Art. 21(2)(d) and the 2025 EU Action Plan on healthcare call for detailed maps of dependency on critical clinical providers (laboratories, imaging, pharmacy).

Type: BlackCat / ALPHV ransomware (detected 21 February 2024); entry presumed via Citrix without MFA

Impact: Cea mai mare bresa de date medicale din SUA. Intreruperi majore in procesarea retetelor, decontari medicale si plati pentru providers. UnitedHealth a furnizat peste 9 miliarde USD in finantare-puente catre furnizorii afectati. Impact financiar 2024 estimat la 1,90-2,05 USD/actiune. Date PHI/PII confirmate exfiltrate (22 screenshots publicate pe dark web). Call-center dedicat pentru 2 ani de credit monitoring gratuit clientilor afectati.

Lesson: ICT concentration risk in healthcare (one claims processor handling about a third of the US) propagated the incident to thousands of hospitals and pharmacies. NIS2 Art. 21(2)(d) and the 2025 EU Action Plan call for concentration testing on critical providers and continuity scenarios assuming a large provider goes down.

GDPR — Regulamentul (UE) 2016/679 · Directly applicable from 25 May 2018; ANSPDCP is the supervisory authority in Romania [C7][C8]

Health data is a special category — GDPR Art. 9(1) prohibits processing, subject to the exceptions in Art. 9(2) [C7]. Art. 33 requires notification of the breach to ANSPDCP within 72 hours [C8]. Key difference from NIS2: GDPR is triggered by a personal-data breach, NIS2 by a significant cyber incident — the two can coincide but do not have to. Sanctions are cumulative with those under NIS2.

MDR — Regulamentul (UE) 2017/745 · Directly applicable from 26 May 2021 [C9]

For any hospital operating medical devices with software (CT, MRI, pumps, ICU monitors, connected defibrillators), the manufacturer has essential cybersecurity obligations under MDR Annex I 14.2(d) and 17.2 [C9]. The hospital, as user, must keep an inventory of the device fleet, segregate networks and contractually require an SBOM and a patching policy. MDCG 2019-16 is the principal technical guidance.

IVDR — Regulamentul (UE) 2017/746 · Directly applicable from 26 May 2022 [C10]

Extends the MDR regime to in-vitro diagnostic devices (biochemistry, haematology, microbiology analysers, interpretation software). Software driving or influencing an IVD device falls under the same class as the device. For hospital and medical laboratories, IVDR and GDPR Art. 9 apply alongside NIS2 Art. 21(2)(d).

Cyber Resilience Act — Regulamentul (UE) 2024/2847 · In force since 10 December 2024; main obligations applicable from 11 December 2027, active-vulnerability reporting from 11 September 2026 [C11]

The CRA explicitly excludes medical devices covered by MDR/IVDR (Art. 2(2)(a)), because those remain under Annex I MDR/IVDR. It remains relevant, however, for generic IT products used in hospitals (non-MDR HIS systems, terminals, facility IoT, administrative software, card readers, access-control systems, connected cameras). The hospital becomes a demanding buyer: products with digital elements must carry CRA conformity before being placed on the EU market.

AI Act — Regulamentul (UE) 2024/1689 · In force since 1 August 2024; obligations for high-risk AI applicable in tranches 24-36 months later [C12]

For hospitals using clinical AI (radiology decision support, triage, mortality prediction, therapeutic decision support, AI-enabled IVDs), AI systems classified as high-risk under Annex III or through harmonisation with MDR carry additional obligations: risk management, quality data sets, transparency, human oversight, logs. The AI Act applies cumulatively with MDR and GDPR Art. 9 — in practice, AI-assisted clinical decision-making remains under the physician's and the institution's responsibility.