The MDU in action

Ransomware attacks on healthcare organisations are where an individual or gang ‘locks’ files on a computer or network and demands payment in return for access. They’re a growing global threat and hugely disruptive. 

In fact, 2024 was one of the worst years on record. 

In June, Russian criminals caused the postponement of more than 10,000 outpatient appointments and 1,693 elective procedures after successfully targeting Synnovis, which provides pathology services to the NHS. Stolen patient data was also published on the dark web. 

In February, an attack on the US medical invoicing company Change Healthcare led to severe cashflow problems for practices and delays, although the company paid a ransom of $22 million. 

And half the population of France are estimated to have been affected by January attacks on two French healthcare payment providers (Viamedis and Almerys) in the country’s largest ever cybersecurity breach.

Alongside the immediate disruption and distress for patients, organisations that fall prey to cyberattacks have to deal with the fallout. Even if they don’t pay a ransom, getting back to normal service can be expensive and there can be lasting reputational damage. 

In addition, the Information Commissioners Office (ICO) has the authority to impose fines of up to £17.5 million or 4% of annual worldwide turnover of the organisation (whichever is higher) for serious breaches of data protection principles.    

In a briefing to the UN in November 2024, the head of the World Health Organization, Tedros Adhanom Ghebreyesus, called for international cooperation to address the growing crisis of ransomware and other cyberattacks on health services. 

Meanwhile, the UK government is introducing a Cyber Security and Resilience Bill to Parliament in 2025. It says the bill will include measures to expand the remit and powers of regulators and mandate better incident reporting. 

Although this isn’t yet law, your organisation must still “ensure that you have appropriate security measures in place to protect the personal data you hold,” in line with the General Data Protection Regulations (GDPR) security principle. 

In addition, all organisations with access to NHS patient data and systems must use the Data Security and Protection Toolkit to assess their performance against data security standards set by the National Data Guardian for Health and Social Care.

You can also find guidance from:

• National Cyber Security Centre (NCSC)
• NHS Digital website includes resources on cyber and data security for NHS organisations.
• NHS England has also produced this guidance for GPs. Digital Health & Care Scotland promotes cyber security in Scotland.
• ICO website has detailed guidance on security measures.
• The GMC’s confidentiality guidance includes a section on ‘Managing and protecting personal information’ while the GDC’s ‘Standards for the dental team’ requires dental professionals to “keep patients’ information secure at all times” (para 4.5). 

Cyberattacks on healthcare are a global concern but every organisation has a part to play in combatting it. You wouldn’t leave your practice without switching on the alarm, but neglecting IT security is effectively leaving the door open for criminals. 

Here are the top things you can do to improve your practice’s IT security and resilience.

Review IT and data policies and procedures
Your practice should already have an information security policy and a designated person to ensure personal data is protected from unauthorised or unlawful processing, accidental loss, destruction or damage.

However, this document shouldn’t be left to gather dust. Revisit the policy at regular intervals to take account of new regulations and guidance or when there has been an IT security incident/near miss. Ask yourself if the policy needs updating to reflect the ways your practice currently processes data (migration to cloud data storage, for example).

Policies should include:

• the use and review of security software (including updates and data backup)
• procedures for safe handling of patient information, including the use of encryption
• the need for signed written contracts with all third-party suppliers, including IT contractors, setting out your confidentiality requirements
• rules on the use of home computers or mobile devices
• access controls and audits of electronic systems
• strong passwords and individual login profiles that should be changed regularly
• staff data protection training 
• social media use and patient confidentiality
• secure disposal of practice computers. 

Check how you measure up
If you’re not already required to meet the NHS data security standards, assess your practice’s cybersecurity controls against good practice standards. 

The government-backed Cyber Essentials programme includes a ‘readiness toolkit’ that provides a personalised list of actions to improve cybersecurity. You’re awarded a certificate to show you’ve met the necessary standard. 

Seek expert advice
Seek professional advice from a reputable specialist about IT security measures such as firewalls, virus protection and encryption. They should also be able to advise on penetration testing to see how your systems would withstand a cyberattack.

Train staff 
Human error is a common factor in many cyberbreaches, such as clicking on a link or sharing passwords, so ensure staff inductions cover IT security policies and procedures and provide refresher training if required. Some organisations also use mock phishing emails to test how their staff respond to cyber threats.

Report data breaches
If the worst happens, you must report data breaches that are likely to result in a "risk to the rights and freedoms of individuals" within 72 hours of becoming aware of the breach using the ICO’s breach reporting service. 

The ICO also says you must notify individuals concerned without delay if there’s a ‘high risk’ to their rights and freedoms. This sets a higher threshold for notifying individuals of the data breach, but this obligation might well be engaged in the case of health data. This can be a difficult area, so contact the MDU for advice if you are unsure.

The ICO defines a personal data breach as “a security incident that has affected the confidentiality, integrity or availability of personal data.” It may also belong to one or more of these categories. For example, an unauthorised or accidental disclosure of or access to personal data, an accidental or loss of access to or destruction of personal data or unauthorised or accidental alteration of personal data.

When you notify a breach, you’ll be required to provide information, including:

• the categories and approximate number of individuals concerned
• categories and approximate number of personal data records concerned
• name and contact details of the data protection officer or other contact point
• description of likely consequences of a personal data breach
• description of measures taken or proposed to be taken to deal with a personal data breach, including measures to mitigate possible adverse effects.

The ICO advises organisations to report major cyber incidents to the NCSC and incidents that could heighten fraud risk for individuals to Action Fraud or Police Scotland. 

As an MDU Connect policy holder, you and your team have access to expert medico-legal and dento-legal guidance and support. 
We encourage you to address issues early to pre-empt problems, so contact us for specific advice or explore our resources. 

This page was correct at publication on 12th March 2025. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.