Does NIS2 apply to hospitals and clinics?

It can. NIS2 covers medium and large healthcare providers, subject to national rules. Authorities can also name specific organisations.

Does NIS2 replace GDPR for patient data?

No. GDPR, the EU law on personal data, applies separately. Some safeguards, policies and access logs help with both laws. A single incident involving patient data may trigger reports under both NIS2 and GDPR. That applies where your organisation is covered by both and the incident meets each law’s reporting threshold.

How do you protect a medical device that cannot be updated?

By separating it from other systems and limiting who can reach it, then watching that access. We agree the measures with clinical staff and the supplier and record the risk that remains.

Does the Cyber Resilience Act apply to medical devices?

No. Medical devices and in vitro diagnostic medical devices covered by the MDR or IVDR are excluded from the CRA under Article 2(2)(a) and (b). The MDR and IVDR are the EU rules for these devices, and they keep their own cybersecurity requirements. The exclusion covers those devices only. Any other product or software you sell needs its own check.

What should a review of healthcare suppliers cover?

Suppliers that affect care, patient information, devices or recovery. Check their access, support arrangements, contracts and how you would replace them.

Healthcare

Healthcare cybersecurity and NIS2, centred on patient care

Protect patient information and the systems care depends on. We work with clinical and IT teams to assess risks, address NIS2 obligations where applicable and plan improvements around care delivery and medical-device constraints.

Plan your clinical security work Find your care setting

Healthcare organisations we work with

Relevant regulations and standards

Rules by type of healthcare organisation

Your type of care, size and country decide whether NIS2 applies. Privacy and medical-device rules apply separately.

Your organisation	Rules that usually apply	Where to start
Hospital or clinic	NIS2 can apply, depending on your size and national rules. GDPR covers the patient data you hold.	NIS2 Compliance
Laboratory or medical research organisation	NIS2 can apply to some, depending on activity, size and national rules.	A free call to check
Pharmaceutical company	NIS2 can apply, depending on what you make, your size and national rules.	NIS2 Compliance
Medical device maker	Medical and in vitro diagnostic devices covered by the MDR or IVDR, the EU device rules, are excluded from the Cyber Resilience Act. Your other products need their own check. NIS2 can apply, depending on size and national rules.	A free call to check
Supplier of clinical software or IT services	Healthcare customers under NIS2 must check the security of suppliers they depend on. Tenders may ask for ISO 27001 certification.	ISO 27001 Certification Consultancy

ISO 27001 can organise security work that counts towards both NIS2 and GDPR, but it replaces neither law.

Common challenges

Care depends on systems and people

A device cannot be updated
Its supplier and the people responsible for clinical use must agree other protections.
Many services share the same systems
Appointments, laboratory work and treatment can rely on the same systems and outside support.
Staff handle patient information
Teams need to know who may open patient records and when to ask for help.
Downtime needs clinical decisions
IT and care teams need agreed priorities and downtime procedures for working while systems are unavailable.

How we help

Security work agreed with clinical teams

Common questions

Free 30-minute call

Let’s protect the systems your care depends on

Tell us which clinical systems keep care running, and on a free 30-minute call we agree where security work should start.

Plan your clinical security work hello@guardera.tech