People: from collaboration to talent development

Not everything can be outsourced, and without internal specialists, technologies will not deliver the expected effect. Since many hospitals face almost identical problems, it makes sense to share experience—when introducing technologies, in training, and in creating usable security documentation. A strong path is to develop your own people: move capable IT staff into security roles, invest in their education, and cover operations with juniors. A significant problem is obtaining a qualified cybersecurity manager in the state administration, and it also holds that many hospitals do not even come close to the recommended minimum of around 1% of IT employees out of the total headcount.

Money and systemic solutions

Without additional funding, the “cyber debt” will remain too large. The most effective route is centralization: unify technologies, share experts, carry out bulk license purchases, and provide methodological guidance to hospitals in user education. Ongoing, purposefully planned cybersecurity funding should be part of hospital budgets, not an ad hoc reaction to an incident.

Support programs help as well: state-provided training for state administration employees was a welcome step, although it was not sufficiently publicized. European calls focused on improving the management and level of cybersecurity are also positive, but not all hospitals were able to take advantage of them due to bureaucracy or capacity limits. However, if cybersecurity is not part of planning and education, an attack can paralyze the most important thing—the provision of healthcare itself.