Last updated
Digitalisation has changed how medical information is stored and handled — and, above all, made care simpler to obtain: a declaration with a doctor filed online, an e-prescription, prices compared, an electronic sick note, a birth record that feeds straight into the state’s “eMaliatko” service. Electronic records, laboratory results, images and treatment data have long been part of how any modern clinic works.
But concentrating that much sensitive information in single databases has turned healthcare into one of the most attractive and most vulnerable targets for cybercriminals and for state espionage. Medical data is exceptionally valuable on shadow markets because, unlike compromised financial information — which can be neutralised by blocking an account — a medical history, genetic information and biometric indicators stay with a person for life, which opens wide scope for blackmail, stigmatisation and social engineering.
For Ukraine the question has become unusually sharp. On one side the country is at war, with cyberspace recognised as a theatre of it, and medical infrastructure treated by the enemy as a critical target whose disruption would paralyse the saving of lives and cause public panic. On the other, Ukraine is integrating fast into the European digital and legal space, which calls for a thorough revision of outdated national data-protection law to bring it into line with the GDPR, the NIS2 Directive and the emerging European Health Data Space.
The legal frame today is spread across several acts. The Law on personal data protection places health data in the category subject to special requirements, allowing processing for healthcare, diagnosis, treatment and the provision of medical services provided the statutory safeguards are observed. In parallel, the Fundamentals of Healthcare Legislation guarantee the patient’s right to confidentiality about their health, the fact of seeking care and the diagnosis (Article 39-1), and oblige medical staff and others not to disclose medical secrets (Article 40). In a digital environment, then, medical confidentiality is no longer only a question of how a doctor behaves: it depends directly on how secure the systems holding the data are. The Law on the protection of information in information and communication systems and the Law on the fundamental principles of cybersecurity set the wider framework; the central system in Ukrainian medicine is the electronic health system, governed by Cabinet Resolution No. 411 of 2018, with CERT-UA coordinating the protection of state registers and the sector’s critical infrastructure. During 2026 the Ministry of Health and CERT-UA reported a rise in attacks on local authorities and municipal healthcare institutions, aimed not only at stealing information but at blocking access to electronic records and disrupting the running of medical infrastructure.
Much of the article deals with what this means inside a clinic. The Ministry of Health has built a knowledge base on information protection and work with personal data, which defines cybersecurity as the state of protection of data in electronic form against unauthorised use or criminal interference, together with the measures taken to achieve it — confidentiality, integrity and availability of digital assets. Healthcare institutions are answerable under the law for the security of patient data, and so for keeping patients’ trust.
The human factor matters most of all. A technically secure system can still be compromised through a phishing email, a shared password, an unprotected device or access granted by mistake, which is why the Ministry stresses building a security culture among staff, with training for everyone at least once a year. The basic rules of cyber hygiene it sets out are a clear desk and screen; proper handling of passwords, including not reusing strong work passwords on social networks; safe use of email, from not using work addresses for private correspondence to checking attachments before opening them; two-factor authentication; safe browsing, careful checking of links and caution with browser add-ons; and rules for flash drives and other removable media. Knowing which scenarios exist makes a person markedly harder to manipulate, and the article commends the “30-second rule”: if an email feels wrong, give yourself half a minute to look at it before reacting or clicking anything.
Awareness is only half of it; the main task is building an effective system of protection, which calls for real expertise and is best done against an accepted standard such as the NIST Cybersecurity Framework. The technical components range from antivirus software, access management, encryption and vulnerability scanners to monitoring and event logs, network segmentation, intrusion detection, sandboxes, audit tools, firewalls, deep packet inspection, data-loss prevention, integrity checking, behavioural analysis and patch and change management. For ordinary users of a clinic’s workstations the role is narrower: understand the basics well enough to report a problem promptly and correctly to whoever supports the institution’s IT.
Responsibility for cybersecurity and information security in a healthcare institution normally rests with its head, together with a designated information security officer, who oversees the development, implementation and maintenance of the institution’s security policy. That officer is usually a different person from the one responsible for IT, whose task is to keep IT services running at the agreed level. One officer alone cannot secure an institution: at a minimum there should be an incident response group — assembled from existing staff in a small institution, and as a dedicated team of specialists in a large one with developed IT infrastructure.
The article closes with what a breach can cost an individual member of staff. Disciplinary liability under Articles 147–152 of the Labour Code, up to dismissal. Civil liability under Articles 1166, 1167 and 1172 of the Civil Code: the person whose rights were infringed may claim pecuniary and non-pecuniary damages, which are paid by the institution, with a right of recourse against the employee. Administrative liability under Article 188-39 of the Code of Administrative Offences, with fines from UAH 1,700 to 8,500, and from UAH 17,000 to 34,000 for a repeat offence. And criminal liability under Articles 145 and 182 of the Criminal Code, which arises only for intentional unlawful acts — with confidential information, or with information constituting medical secrecy where grave consequences follow.
A proper analysis of cybersecurity in medicine therefore has to take in not only technical regulations and cryptographic standards but the fundamental right to privacy, the concept of medical secrecy, the integration of civil data with military registers, and the state’s institutional capacity to make leaks punishable. In digital medicine a leak of medical data is not simply an IT incident: it is a potential violation of the patient’s right to privacy and to confidentiality of medical information. Cybersecurity has to be treated as an inseparable part of the quality and safety of medical care.