Healthcare cybersecurity
What NIS2 requires from hospitals and health-tech suppliers, how ISO 27001 and ISO 27799 fit in, and the identity and access controls behind secure health apps.
Health is a sector of high criticality under the EU NIS2 Directive (Directive (EU) 2022/2555). Hospitals and other healthcare providers above the size threshold must take risk-management measures, report significant incidents in stages (an early warning within 24 hours, a notification within 72 hours, a final report within one month) and manage the security of their suppliers. The technical work underneath is largely the same everywhere: identity and access control, multi-factor authentication, encryption, logging, backups and supplier assurance.
| Main EU law | NIS2, Directive (EU) 2022/2555, applied through national laws |
|---|---|
| Who is in scope | Healthcare providers, EU reference laboratories, some pharmaceutical and medical device manufacturers, and the cloud and managed service providers they rely on |
| Incident reporting | 24 hours, 72 hours, one month after a significant incident |
| Management standards | ISO/IEC 27001, with ISO 27799 as health-specific guidance |
| App-level controls | OAuth 2.0, OpenID Connect, SMART on FHIR, audit logs |
What does NIS2 require in healthcare?
Which security standards apply to health data?
How do health apps handle identity and access?
- Security and identity in health apps: the mapHow a health app proves who the user is, what it may access and what it did: OAuth 2.0 and 2.1 with PKCE, OpenID Connect, SMART on FHIR scopes, patient consent as the source of authorisation, break-the-glass, access logs the patient can read, AuditEvent, identity assurance, encryption, and the baseline regulators expect.
- SMART App Launch explained: scopes, launch, PKCESMART App Launch is the HL7 specification that lets an app run against any FHIR server with the user's authorisation: discovery, EHR and standalone launch, the authorisation code flow with PKCE, the scope syntax, launch context, refresh tokens, backend services, and what changed in SMART v2, with real requests.
For developers
Build on interoperable health data
Anpheros Platform is a FHIR R4 API for medical records, with patient consent, a free sandbox and SDKs for Dart, Flutter and TypeScript.