Health data security and privacy guide

Health data security is the set of controls that keeps patient information confidential, accurate and available when care depends on it. Privacy is the set of rules that decides who may see that information and for what purpose. In a hospital information system the two meet in a small number of controls: role based access, two factor authentication, audited break glass access for emergencies, encryption, recorded patient consent for sharing, and a complete audit log, supported by governance that prepares the organisation for ransomware.

Security used to be discussed as a technical matter for the IT department. The evidence of the past decade has moved it to the agenda of hospital boards and ministries, because attacks on health systems now cancel appointments, divert ambulances and close diagnostic services. A system that clinicians and patients trust must be open enough for care to proceed without delay, and closed enough that no one sees what they should not.

Why hospitals are a target

Hospitals hold sensitive data, run around the clock and cannot easily tolerate downtime. That combination makes them attractive to criminals who extort payment.

The European Union Agency for Cybersecurity (ENISA) analysed 215 publicly reported incidents in the health sector across the EU and neighbouring countries over two years. Ransomware accounted for 54 per cent of incidents, healthcare providers were the target in 53 per cent, and hospitals alone in 42 per cent [2]. Patient data was the most targeted asset, and nearly half of incidents (46 per cent) aimed to steal or leak data [2]. Only 27 per cent of surveyed health organisations had a dedicated ransomware defence programme [2]. The European Commission counted more than 300 cybersecurity incidents in the health sector in 2023, more than in any other critical sector in the EU [14].

In the United States, researchers identified 374 ransomware attacks on hospitals, clinics and other care delivery organisations between 2016 and 2021, exposing the personal health information of nearly 42 million people [3]. Annual attacks more than doubled over the period, from 43 to 91, and 44 per cent of attacks disrupted the delivery of care [3].

The Director General of WHO told the UN Security Council in November 2024 that ransomware attacks on hospitals are not only matters of security and confidentiality: "they can be issues of life and death" [5]. He cited a 2021 global survey in which more than a third of respondents reported at least one ransomware attack in the preceding year [5].

What an attack does to patient care

Two public inquiries illustrate how quickly a cyber incident becomes a clinical one.

WannaCry and the NHS, 2017. The UK National Audit Office found that at least 81 of 236 trusts in England were affected, together with 603 primary care and other NHS organisations, including 595 general practices [1]. NHS England estimated that more than 19,000 appointments were cancelled, and five emergency departments diverted patients [1]. The infected organisations were running unpatched or unsupported Windows operating systems; trusts had been told in 2014 to plan their migration away from Windows XP, and critical alerts had been issued in March and April 2017 [1].

The Irish Health Service Executive, 2021. The attackers were active in the network for about eight weeks before the ransomware was released on 14 May 2021 [6]. Antivirus software flagged attack tools on six servers a week earlier, but the alerts were not acted on [6]. Around 80 per cent of the IT environment was encrypted, 700 GB of data was taken, staff reverted to pen and paper, and recovery took about four months [6]. The post incident review found no single senior owner for cybersecurity, no documented incident response plan, and high risk gaps in 25 of 28 controls most effective against human operated ransomware [6].

The effect also reaches hospitals that are not attacked. A study in JAMA Network Open examined two emergency departments in San Diego next to a health system hit by a month long ransomware attack in 2021. Compared with the four weeks before, ambulance arrivals rose 35.2 per cent, median waiting room times rose from 21 to 31 minutes, patients leaving without being seen rose 127.8 per cent, and stroke code activations rose from 59 to 103 [4]. The authors concluded that such attacks should be considered a regional disaster [4].

The reference frameworks

Ministries do not need to invent a security framework. Several are widely used and complement each other.

Framework	Publisher	What it gives a health organisation
ISO 27799:2016	ISO	Guidance for applying the ISO/IEC 27002 controls in health, aimed at preserving the confidentiality, integrity and availability of personal health information [9]
NIST SP 800 66 Revision 2	US National Institute of Standards and Technology, 2024	Practical guidance on administrative, physical and technical safeguards, built on risk assessment and risk management [8]
Health Industry Cybersecurity Practices (HICP) 2023	US Department of Health and Human Services and the Healthcare and Public Health Sector Coordinating Council	Five priority threats and ten cybersecurity practices [7] [15]
OECD Recommendation on Health Data Governance	OECD Council, December 2016	Twelve elements of a national framework, including consent, training, audit and safeguards [13]
Cybersecurity and privacy maturity assessment for digital health information systems	WHO Regional Office for Europe, 2025	A maturity assessment method organised around availability, privacy and governance [14]

HICP names five threats: ransomware, phishing, loss or theft of equipment or data, insider threats, and attacks against connected medical devices [7]. Its ten practices cover email protection, endpoint protection, access management, data protection and loss prevention, asset management, network management, vulnerability management, security operations and incident response, network connected medical devices, and cybersecurity oversight and governance [15]. ISO 27799 is technology neutral: it defines what must be achieved, not which product achieves it [9].

Controls inside the clinical system

Most of the frameworks above apply to the whole organisation. A subset must be built into the electronic health record itself, because only the application knows who the user is, which patient they are looking at and why.

Role based access

Each user receives the access their role requires and no more. A pharmacist sees prescriptions and dispensing; a laboratory scientist sees orders and results; a ward clerk sees registration and bed information. Access management is one of the ten HICP practices [15]. In practice, role based access also has to reflect assignment: a doctor normally works with the patients under their care at their facility, not every patient in the hospital.

Two factor authentication

A password alone is the weakest point of most systems, and phishing is one of the five HICP threats [7]. CISA, the US cybersecurity agency, states that using multifactor authentication makes an account 99 per cent less likely to be hacked [12]. Two factor sign in should be standard for clinical users and mandatory for administrators.

Break glass access

Strict access rules can block care in an emergency, when a clinician needs a record outside their usual assignment. Break glass access resolves the conflict: the user may override the restriction, but must confirm the reason, and the access is recorded for review.

Evidence shows that the design of the prompt matters. A hospital study of restricted genetic reports found that before break glass controls were introduced, all 842 unauthorised attempts to open those reports succeeded. After introduction, of 5,608 attempts, 45 per cent were abandoned at the warning [10]. The same study found justifications left empty and a few users accounting for many overrides, and recommended mandatory reasons and ongoing log review rather than review only after a breach [10].

Audit and follow up

An audit log is only useful if someone reads it. A controlled trial at a large academic medical centre in the United States, published in JAMA Network Open in 2022, followed 444 staff flagged for unauthorised record access. Among those who received an email warning, 4 of 219 repeated the behaviour; among those who did not, 90 of 225 did [11]. The lesson is direct: logging deters when it is visibly acted on.

Encryption

Data should be encrypted in transit between devices and servers and at rest in databases, backups and portable devices. Loss or theft of equipment is one of the five HICP threats [7]; encryption turns a lost laptop from a reportable breach into a replaceable device.

Consent for sharing

The OECD Recommendation asks countries to clarify when consent is required, how it is given and withdrawn, and how individuals can express preferences where consent is not the legal basis [13]. The system must record that consent in a form that controls what is actually shared, rather than storing it as a scanned form.

A checklist for hospital and ministry leaders

Area	Question to ask	Evidence to request
Governance	Is one senior person accountable for cybersecurity?	Named owner, board reporting, risk register
Access	Does each role see only what it needs?	Role matrix and a demonstration by role
Sign in	Is two factor authentication available and enforced for administrators?	Configuration and policy
Emergency access	Is break glass access justified, logged and reviewed?	Sample review report
Audit	Can the data owner see every access and change?	Audit log search by patient and by user
Encryption	Is data encrypted in transit and at rest, including backups?	Architecture description
Consent	Does recorded consent control sharing?	Demonstration of a sharing decision
Patching	Are supported operating systems and timely updates in place?	Asset and patch reports
Response	Is there a tested incident response and downtime plan?	Plan and the date of the last exercise

The final two rows are the lessons of WannaCry and the Irish attack respectively [1] [6]. WHO's recommendations to the Security Council point the same way: include basic cybersecurity controls in digital health budgets, avoid unsupported software, invest in early detection, and train staff and rehearse response plans [5].

Privacy depends on identity and ownership

Two foundations sit beneath every control above. The first is reliable patient identity: access rules and audit trails mean little if one patient has three records, or two patients share one. This is covered in master patient index and unique health identifiers. The second is clear ownership: the organisation that collects the data decides who may use it, and the supplier processes it only on that organisation's instructions. The legal and contractual side is set out in health data sovereignty.

Continuity planning belongs here too. A system that saves work on the device and synchronises when the connection returns, as described in designing health systems for unreliable connectivity, keeps clinicians working through a network outage. It does not replace a tested downtime and recovery plan.

How Moana approaches security and privacy

Moana is built on the principle that the organisation that collects the data owns it, and on the controls this guide describes, applied inside the clinical record rather than added around it.

Role based workspaces. MOANA Desktop gives doctors, nurses, pharmacy, laboratory, radiology and administration their own workspaces, each limited to the functions and data that role requires. Doctors see the patients assigned to them at their facility. Sensitive programme data is restricted by role.
Two factor authentication. Sign in can require a second factor, protecting accounts against stolen or guessed passwords.
Audited break glass access. When a doctor opens a patient assigned to another doctor, Moana shows a break glass prompt before the record opens. If the doctor proceeds, the access is logged so that it can be reviewed later.
A full audit log. Every access and change is written to the audit log. Administrators can review that activity, which supports the kind of follow up the evidence shows changes behaviour [11].
Encryption. Patient data is encrypted.
Consent for sharing. Patient consent is recorded, so that sharing follows the patient's permission and national policy. The same principle governs research access through MOANA Clinical Research, where feasibility counts suppress small numbers and every query is audited.
Ownership and export. The data belongs to the organisation that collects it, and it remains retrievable in standard formats through FHIR R4, so control does not depend on the supplier.

The same controls apply across clinics and hospitals, from a single practice to a regional referral hospital, and they are described in more detail on the trust and security page and the hospitals page. Moana walks each organisation through access roles, break glass review and audit reporting as part of implementation, so that the policies the hospital adopts are the policies the system enforces.

Key questions for procurement

What is break glass access in an electronic health record?

It is a controlled override that lets a clinician open a record outside their normal access, typically in an emergency. The user confirms the reason, and the access is logged for review. Research recommends requiring a reason and reviewing the logs routinely [10].

Is role based access enough to protect patient privacy?

No. Role based access limits what each role can see, but staff with legitimate roles can still look at records without a care reason. An audit log, regular review and visible follow up are needed alongside it [11].

Which security standard should a ministry reference in a tender?

ISO 27799 is the health specific companion to ISO/IEC 27002 and is technology neutral [9]. NIST SP 800 66 and HICP provide practical safeguards and practices [8] [15]. A tender can reference ISO 27799 for the organisation and then state application controls such as those in the checklist above.

How does two factor authentication help against ransomware?

Many attacks begin with stolen credentials or phishing [7]. A second factor makes a stolen password insufficient on its own. CISA states that multifactor authentication makes an account 99 per cent less likely to be hacked [12].

What should a hospital do before an attack happens?

Name an accountable owner, keep software supported and patched, monitor and act on alerts, and write and rehearse an incident response and downtime plan. These are the gaps the WannaCry and Irish reviews identified [1] [6].

Sources

Investigation: WannaCry cyber attack and the NHS, National Audit Office, 2017
Ransomware accounts for 54% of cybersecurity threats in the health sector, European Union Agency for Cybersecurity (ENISA), 2023
Trends in ransomware attacks on US hospitals, clinics and other health care delivery organisations, 2016 to 2021, JAMA Health Forum, summarised by ASPR TRACIE, US Department of Health and Human Services, 2022
Ransomware attack associated with disruptions at adjacent emergency departments in the US, JAMA Network Open, 2023
WHO Director General's remarks at the UN Security Council on threats posed by ransomware attacks, World Health Organization, 2024
Lessons learned from the HSE cyber attack, US Department of Health and Human Services, 2022
Joint release of Health Industry Cybersecurity Practices 2023 and supplements, Health Sector Coordinating Council and US Department of Health and Human Services, 2023
NIST SP 800 66 Revision 2: Implementing the HIPAA Security Rule, a cybersecurity resource guide, National Institute of Standards and Technology, 2024
ISO 27799:2016 Health informatics: information security management in health using ISO/IEC 27002, International Organization for Standardization, 2016
Log analysis of human computer interactions regarding break the glass accesses to genetic reports, ICEIS 2013, SCITEPRESS, 2013
On the spot email interventions reduce repeat medical record snooping incidents by 95%, HIPAA Journal, reporting a JAMA Network Open study, 2022
Multifactor authentication, Cybersecurity and Infrastructure Security Agency, 2024
Recommendation of the Council on Health Data Governance, OECD, 2016
WHO Europe launches guide to strengthen cybersecurity in digital health, World Health Organization Regional Office for Europe, 2025
Exploring the Health Industry Cybersecurity Practices publication and how to use it, TechTarget HealthTech Security, 2023

Health data security and privacy: a guide for hospitals and ministries