The European Union has a plan for dealing with increasing cyberattacks against hospitals in its member countries. It includes ramping up support, an early warning system and rapid-response teams to help hospitals fight cyberattacks from hacker groups, the European Commission — the EU’s executive arm — said Wednesday, POLITICO EU’s Sam Clark reports. Why it matters: National governments reported 309 significant cybersecurity incidents affecting the health care sector in 2023, more than in any other critical sector, the commission said. Ireland, France and Finland were among the countries that suffered devastating attacks on their hospitals and health care sectors since 2020. The U.S. has also struggled with health care cyberattacks. The HHS Office for Civil Rights says there was a 141 percent increase in large breaches reported to the agency between 2022 and 2023. An attack on Change Healthcare, a clearinghouse for medical payments, was the largest reported health care breach in U.S. history. “This is one of our sectors where we can see that [there are] massive cyber attacks, and we have to support [so] they are better prepared,” Henna Virkkunen, the commission's tech and security czar, who presented the plan, told Clark ahead of the launch. Inside the plan: The plan proposes setting up a European Cybersecurity Support Center for hospitals and the health care sector at the EU’s cybersecurity agency ENISA. That support center will provide tools and services, including an early warning system, testing and assessing hospitals’ cybersecurity standards, sharing information about vulnerabilities hackers are exploiting and guidance on responding to incidents. ENISA will get extra funding for this, an EU official granted anonymity to discuss details of the plan told reporters in Brussels. The exact funding has not yet been decided. The commission also plans to set up a rapid-response service for the health sector and to provide “cybersecurity vouchers,” which will allow EU countries to give cash to small hospitals and health care providers for cyber resilience. No specific amount has been set aside yet, the EU official said. According to the plan, EU governments should advise health care entities to notify authorities when they've paid or plan to pay ransom to resolve a ransomware attack. The commission also plans to make decryption tools, which allow organizations to get their data back without paying ransom, more readily available. What’s next: The commission will review the action plan, most of which is expected to go into effect later this year.
| 
