Security and resilience in eHealth : security challenges and risks

Studies have shown that cyber security incidents in eHealth systems can have a great societal impact. In a recent ENISA study, twelve out of eighteen Member States (MS) that participated in the survey- consider healthcare as a critical sector, therefore they should take all appropriate measures to protect their ICT systems and assets. The scope and governance model of eHealth services may vary in the Member States (MS); it might be implemented as centralised or even decentralised and may be extended, offering cross-border services. Additionally, critical assets identification in the healthcare systems and infrastructures may be based on different criteria, such as business continuity, data security and integrity, services availability, eHealth security policy and legislation. Moreover usual practices, cyber security challenges, approaches to mitigate risks, and requirements for the eHealth infrastructures may converge, diverge or be inadequate. The aim of this study is to investigate the approaches and measures MS take to protect critical healthcare systems, having as a main goal improved healthcare and patient safety. In that respect this study analyses: the policy context in Europe and the legislation of the Member States ; the perception of the Member States on critical assets in eHealth infrastructures ; the most important security challenges ; the most common security requirements ; relevant good practices that have been deployed in the MS for eHealth security.