Health · NIS2

Healthcare & NIS2: the obligations of an essential sector

The healthcare sector is designated as essential under the NIS2 directive. Healthcare institutions and providers bear the strictest cybersecurity obligations, in a context of high exposure to ransomware, where an incident can paralyse care delivery. This guide details the classification as an essential entity, the measures to be deployed, the notification regime, and management liability.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: NIS2.
  • Hospitals, clinics, laboratories and critical healthcare providers above the thresholds are essential entities.
  • Managing risks (Article 21).
  • Securing the supply chain.
  • Notify incidents.
  • For essential entities, fines can reach €10 M or 2% of global turnover, with enhanced supervision (inspections, audits) and potential personal liability for executives.

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force (EU directive)

In force

October 2024

Transposition deadline (EU)

In force

2026

French transposition (Resilience Act)

In force

What does NIS2 cover?

NIS2 distinguishes between essential and important entities. Healthcare is among the highly critical sectors (Annex I): establishments and providers concerned are, above the applicable thresholds, classified as essential entities, subject to more stringent supervision than important entities.

The measures under Article 21 cover a comprehensive baseline: security policy, incident management, business continuity, supply chain, encryption, access control and multi-factor authentication.

Is the 'Healthcare' sector affected?

Hospitals, clinics, laboratories and critical healthcare providers above the thresholds are essential entities. Certain entities deemed critical may qualify as such regardless of their size.

Publishers and the service providers serving them are indirectly affected, through the supply chain security requirements imposed on their clients.

Detailed obligations

Manage risks (Article 21)

Deploy technical and organisational measures: security policy, incident management, encryption, access control, multi-factor authentication, among others.

Secure the supply chain.

Assess and govern the security of software vendors and service providers, which are frequent attack entry points.

Notify incidents

Submit an early warning after becoming aware of a significant incident, followed by intermediate and final reports within the required timeframes.

Ensure continuity

Have a continuity and recovery plan, tested backups, and a crisis management organisation in place — essential defences against ransomware.

Involve management

Have the scheme approved and monitored by the governing body, which is now accountable and must receive training.

Sanctions & risks

For essential entities, fines can reach €10 M or 2% of global turnover, with enhanced supervision (inspections, audits) and potential personal liability for executives.

The primary risk remains operational and human: a successful attack can interrupt patient care.

Application timeline

  • 1Directive. Adopted end of 2022.
  • 2France. Transposition currently being finalised; anticipate measures now given the current threat level.

Common mistakes in the sector

  • 1Underestimating the threat. Overlooking the sector's exposure to ransomware.
  • 2Unsecured supply chain. Allowing unevaluated publishers or service providers to access systems.
  • 3Untested continuity. Having a theoretical recovery plan that has never been tested.
  • 4Absent leadership. Confining cybersecurity to technical teams without management involvement.

Practical case

A healthcare facility is hit by ransomware introduced through an uncontrolled maintenance provider. Due to the lack of a tested business continuity plan, operations are disrupted for several days. The NIS2 remediation consists of controlling provider access, rolling out multi-factor authentication across the board, regularly testing the recovery plan, and formalising incident notification.

Compliance roadmap

  1. 1

    Qualify. Confirm the status of essential entity.

  2. 2

    Analyse risks. Carry out a risk analysis and gap assessment with regard to Article 21.

  3. 3

    Deploying measures. Implement missing measures, a business continuity plan, and an incident response plan.

  4. 4

    Secure suppliers. Governing publishers and critical service providers.

  5. 5

    Equip the notification process. Implement the alert and reporting process.

Frequently asked questions

Essential, which entails the strictest NIS2 regime and enhanced supervisory authority oversight.

Back to the Health guideHealth & GDPR Health & AI Act

Take action on NIS2

Free assessment or a chat with an expert dedicated to health.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the health sector secured their compliance with DCO.

See testimonials