Procurement Guidelines for Cybersecurity in Hospitals: New Online tool for a Customised Experience!

The new tool helps healthcare organisations identify best practices in order to meet cybersecurity needs when procuring products or services.

To facilitate the use of the Procurement Guidelines for Cybersecurity in Hospitals published in 2020, ENISA releases an online tool today to support the healthcare sector in identifying procurement good practices to meet cybersecurity objectives when procuring products or services.

In addition, the Agency also publishes a concise version of the procurement guidelines dedicated to the sector in each of the 24 EU official languages.

Cybersecurity in Healthcare: why does it matter?

The COVID-19 pandemic demonstrated the value of eHealth services such as telemedicine and remote patient care.

Since it has become increasingly digital and interconnected, the healthcare sector needs to consider cybersecurity as an enabler and as a key factor for ensuring the resilience and availability of key healthcare services.

Cybersecurity needs to be envisaged throughout the procurement lifecycle. IT departments should be involved in procurement activities as the cybersecurity implications in the procurement of any product or service should be well understood and consistently addressed by healthcare organisations.

EU Agency for Cybersecurity Executive Director, Juhan Lepassaar, declared: “Securing eHealth today means ensuring the resilience of the EU’s life support system, the healthcare sector. ENISA is committed to shape the ICT environment needed to prevent cybersecurity incidents and attacks on our healthcare sector.”

Procurement Guidelines and online tool: What for?

The online tool was developed as a complement to the procurement guidelines for cybersecurity in hospitals. Its purpose is:

• To help healthcare organisations to quickly identify the guidelines that are most relevant to their procurement context such as assets procured or related threats;
• To promote the importance of a good procurement process to ensure appropriate security measures.

To facilitate the dissemination of good practices across all healthcare organisations across the EU, a concise version of the procurement guidelines is now made available in the 22 official EU languages and the full version is available in english and spanish languages.

The report on procurement guidelines has already generated a significant interest in the healthcare cybersecurity community.

Stakeholders in the sector, including members of the eHealth Security Experts Group suggested the idea of an interactive format of the guidelines making it possible to customise searches and help decision making through informed procurement.

The guidelines were translated in order to allow health organisations across Member States to directly access the content in their own language.

Who is it meant for?

• Procurement officers of healthcare organisations;
• Healthcare professionals with technical positions or in charge of IT systems and equipment;
• Chief level executives such as CIO, CISO, CTO;
• The EU citizens involved in or seeking to develop knowledge and awareness on such processes.

Background

The European Union Agency for Cybersecurity has been supporting the healthcare sector in raising cybersecurity capacity and awareness since 2015.

The activities in the areas include the publication of good practice guides, the organisation of dedicated cybersecurity conferences and supporting policy implementation such as the provisions of the NIS Directive or the Medical Device Regulations.

ENISA published a report on Cloud Security for Healthcare Service in January 2021. This report provides cybersecurity guidelines for healthcare organisations to help further digitalise with the support of cloud services. The report builds on ENISA’s procurement guidelines for cybersecurity in hospitals.

Further Information

ENISA – Procurement Guidelines for Cybersecurity in Hospitals

Guidance on Cybersecurity for medical devices – MDCG 2019-16

More information about our activities in healthcare on ENISA’s dedicated page Critical information infrastructures and services – HEALTH