#CyberC4HE Coalition · third year of operation · update September 2026
Hospital cybersecurity is patient safety and continuity of care, not just a task for the IT department. The Coalition brings hospital directors, IT teams, public institutions and technology providers to one table — to turn obligations under NIS2 and the amended Polish National Cybersecurity System Act (KSC) into concrete, achievable actions.
How the Coalition was founded
The Coalition for Cybersecurity in Healthcare was inaugurated on 29 May 2024 in Warsaw, at the headquarters of the Supreme Medical Chamber. It was initiated by the Healthcare Poland Foundation and co-founded by the Central Research, Innovation and Education Centre of the Supreme Medical Chamber (NIL IN), the Polish Hospital Federation (PFSz) and the National Chamber of Care Homes (KIDO). Participants in the inauguration included Dr Artur Drobniak (President of the Warsaw Regional Medical Chamber, Director of COBIK NIL), Prof. Jarosław J. Fedorowski (President of PFSz), Roman Łożyński (Director of the Finance Ministry IT Centre) and Michał P. Dybowski (President of the Healthcare Poland Foundation).
The goals set at the founding remain valid: education of medical staff and management, cybersecurity standards for hospitals, audits, and extending the work to infrastructure and telemedicine security.
Media coverage from the founding period (in Polish)
What has been achieved
Figures from the Healthcare Poland Foundation press release of 8 July 2026.
- Inauguration of the Coalition in Warsaw.
- “NIS2 and cybersecurity in healthcare” trainings for directors, IT teams, lawyers and procurement staff — including Białystok (30 Sept) and Szczecin (16 Oct); later editions also in Łódź and Poznań.
- #CyberC4HE session with hospital directors at the 13th PFSz Congress in Warsaw — recommendation of two-factor authentication and hardware security keys; participants received 100 hardware keys.
- The Social Insurance Institution (ZUS) joined the Coalition.
- Report on open and secure hospital information systems (HIS) in the context of NIS2 and the EHDS, and a position paper to the Ministry of Health on reducing hospitals’ dependence on single software vendors (vendor lock-in).
- Cybersecurity strategy workshop at the Pomeranian Marshal’s Office — hospital directors and IT heads at one table with the e-Health Centre (CeZ); direction: a regional SOC and shared services model.
- Cybersecurity workshop for hospitals of the Podlaskie region at the psychiatric hospital in Choroszcz — NIS2/KSC compliance pathway, IT service models, secure connectivity, de minimis training.
- 8th Cybersecurity Forum (Palace of Culture and Science, Warsaw) — Piotr Welenc, Director of the HCPL Quality, Audit and Certification Department, speaks on ICT supply chain security at the invitation of the Deputy Prime Minister and Minister of Digital Affairs.
- Hospital & Healthcare Management and the PFSz Autumn Programme Conference — workshops, working groups and the 2026 edition report.
Legal status — 2026 update
| 3 April 2026 | The amendment to the Polish National Cybersecurity System Act transposing the NIS2 Directive entered into force. Healthcare providers are, depending on their size, essential or important entities; responsibility for meeting the obligations rests with the head of the entity. |
| by 3 October 2026 | Self-identification and application for entry in the register of essential and important entities (wykaz-ksc.gov.pl). |
| by 3 April 2027 | Implementation of the security management system, risk management and incident handling procedures. |
| from 3 April 2028 | Deadline for the first audit of essential entities; most administrative penalties may be imposed. |
The analysis and recommendations further down this page date from 2024–2025 and describe the situation before the amendment. Compliance is not the same as resilience — the Coalition works on both.
Regional perspective — Pomorskie Voivodeship
In 2026 the Coalition tested its recommendations at regional level. On 13 April 2026 the Department of Health of the Pomeranian Marshal’s Office held a hospital cybersecurity strategy workshop together with the Healthcare Poland Foundation, the Polish Hospital Federation and the e-Health Centre (CSIRT CeZ), with Ricoh as technology partner. The report prepared by the Foundation was revised after a consultation with the Office’s Department of Digitisation (9 June 2026) and its written comments, and the Office accepted version 2.2 on 9 July 2026 as the basis for passing it on to the region’s healthcare providers.
Sources: CSIRT CeZ (incidents, vulnerability monitoring); PTKOZ report, September 2025 (KSC awareness) — as cited in the workshop report.
Conclusions from the regional perspective
- The compliance clock is running at regional level, not only in each hospital. Self-identification by 3 October 2026, management systems by 3 April 2027 and the first audits from 3 April 2028 fall on all providers reporting to the regional government at the same time. A regional coordination team (Department of Health, Department of Digitisation, CSIRT CeZ, experts) lets them go through the process together rather than one by one.
- Scale is a condition of entry. A single provincial or county hospital cannot maintain its own professional Security Operations Centre, internal auditors and full toolset. A shared, managed SOC delivered as a service was judged by the Department of Digitisation to be attractive and realistic.
- Start with what can be delivered before 2028. The consultation showed that a full shared regional data centre is hard to achieve by April 2028 and must account for migration costs. The near-term priority is therefore simpler measures with immediate effect: a shared backup cloud under the 3-2-1 rule, tested recovery, and joint licence purchasing.
- Three kinds of gaps, three kinds of response. Organisational gaps (policies, risk analysis, roles), service gaps (monitoring and response) and classic hardware and software gaps (missing firewalls, end-of-life equipment) need different tools — the report version 2.2 adds a separate section on the organisational layer of security.
- People before technology. Most incidents start with a person — a click, a private mailbox, a weak password. Multi-factor authentication, regular cyber hygiene training and a reporting culture without blame (Just Culture) are the cheapest and most effective controls.
- Cybersecurity is an operating cost, not a one-off project. The region supports including a cybersecurity component in the pricing of health services. Psychiatric hospitals and emergency medical service stations were left out of earlier cybersecurity grants and need targeted support.
- Innovation through sandboxes, not ad hoc pilots. New AI, MedTech and cyber solutions should be tested in controlled environments — including the Black Box testing laboratory of the Healthcare Poland Foundation and the Polish Air Force Academy – Dęblin (LAW).
- Decisions stay with the providers and the regional government. The report sets a direction; whether and how to implement each recommendation is decided by independent healthcare providers and the Pomorskie regional government. The Foundation acts as an expert partner.
Next steps in the region: a second, needs-focused survey of units by the Department of Digitisation; a live presentation of the Foundation’s free compliance and governance platform (NIS2/KSC); a regional maturity benchmark based on the ENISA self-assessment.
What the Pomorskie work shows for other regions: the KSC obligations are individual, but the capacity to meet them can be built jointly. Regional governments acting as founding bodies are the natural level for shared services, joint procurement and a single dialogue with CSIRT CeZ.
Join the Coalition
Healthcare providers and institutions — beneficiaries
Who: hospitals, care homes and long-term care facilities, primary and outpatient care providers, emergency medical services, founding bodies and regional governments.
What you gain:
- Round Table meetings and regional workshops for directors and IT heads,
- Coalition materials, checklists and reports, and access to working groups,
- a NIS2/KSC readiness assessment pathway with the HCPL Quality, Audit and Certification Centre,
- training for medical staff and management,
- participation in developing the regional SOC and shared services model,
- a voice in position papers to the Ministry of Health and the Ministry of Digital Affairs.
How to join:
- Email application: organisation name, region, contact person on the management and IT side.
- Introductory call (approx. 20 minutes) — needs and status under the KSC Act.
- Declaration of accession to the Coalition.
- Inclusion in a working group and the regional events calendar.
Market suppliers — technology and service partners
Who: providers of SOC/SIEM, EDR, backup and recovery, connectivity, HIS and cloud services, audit and advisory firms, law firms.
2026 partnership package:
- use-case presentations at Coalition events,
- exhibition presence and visibility in event materials,
- networking sessions with hospital management,
- participation in working groups and co-authoring expert papers,
- event summary reports.
Rules of participation:
- verification of competence and references by the HCPL Quality, Audit and Certification Centre,
- neutrality — the Coalition does not endorse any single supplier; purchasing decisions are made by healthcare providers under their own procedures,
- substantive case studies rather than sales pitches,
- disclosure of conflicts of interest.
Package terms are available on request. Technology partners taking part in 2026 events included Ricoh and Comstellation.
Coalition Coordinator: Michał P. Dybowski, President of the Management Board, Healthcare Poland Foundation · centrum@healthcarepoland.pl · tel. +48 787 000 827
Expanded narrative of the CyberC4HE Coalition’s activities with reference to national laws and European regulations
✓ Establishment of the Cyber4HE Coalition
✓ NIS2 Directive
✓ Act on the National Cybersecurity System (KSC)
✓ RODO and eIDAS regulations
✓ Conclusions from the analysis of 140 hospitals in 2024
✓ Identification of good practices
✓ Recommendations for 2025
✓ Timeline for implementation of recommendations
✓ Forms of support offered by CyberC4HE
Establishment of the CyberC4HE Coalition
The CyberC4HE Coalition was formed in response to the rapidly growing cyber threats in the healthcare sector, which stem from the increasing dependence of medical systems on digital technologies and the outdated IT infrastructure of many facilities. The coalition acts as a platform for cooperation between the public and private sectors, state institutions, NGOs and experts.
Since its inception, the Coalition has brought together leading organizations such as the Center for e-Health (CeZ), the sector CSIRT, the Healthcare Poland Foundation, the Polish Federation of Hospitals (PFSz), regional Chambers of Physicians, and key experts in cyber security, risk management and digital transformation.
The goal of the Coalition is to gather information on the state of preparedness of healthcare entities and to develop an optimal process for implementing an integrated critical infrastructure protection system in accordance with the requirements of the NIS2 Directive, EU ENISA standards and national regulations, such as the National Cyber Security System Act (Journal of Laws 2018, item 1560, as amended) and RODO regulations (Regulation 2016/679 of the European Parliament and of the EU Council).
NIS2 Directive
The NIS2 Directive, adopted in December 2022, is a key piece of critical infrastructure protection legislation in the European Union, extending responsibilities to the healthcare sector. Key provisions include:
Risk management obligation
Every regulated organization must implement a cyber risk management system.
Incident reporting
Medical facilities are required to report major cyber incidents within 24 hours to the sector CSIRT (in Poland: the team at the e-Health Center).
Audit obligation
Organizations must regularly conduct audits to assess IT infrastructure compliance with security requirements.
NCS / KSC
Act on the National Cybersecurity System
(NCS / KSC)
In Poland, the regulations of the NIS2 Directive are being implemented through amendments to the KSC Act, which will come into force on January 1, 2025. The most important provisions of the law:
- Granting hospitals of particular importance to health protection the status of key service operators.
- Introduction of the obligation to create risk management plans and incident response procedures.
- The obligation to ensure compliance with the safety requirements specified in Article 8 of the Act.
- The requirement to conduct reporting in accordance with ESG (Environmental, Social, Governance), which is a new element related to the financing of technological solutions.
Analysis
Conclusions from the analysis of 140 hospitals in 2024
Conclusions from the analysis of 210 hospitals in 2025
1
Deficiencies in IT infrastructure
62% of hospitals use IT systems that are more than five years old, which prevents them from being updated in accordance with security requirements.
48% of facilities have not implemented real-time threat monitoring systems.
2
Lack of integrated risk management procedures
Most hospitals do not have incident response plans or defined reporting procedures.
3
Insufficient funding
Only 30% of hospitals allocate more than 5% of their IT budget to cybersecurity, which is well below ENISA’s recommendation.
Identification of good practices
Provincial SOC (Security Operations Center)
Provincial Security Operations Centres have been established in 3 provinces to provide monitoring and technical support for healthcare facilities.
Pilot programmes
Hospitals participating in CeZ programmes, such as EZLA (electronic medical records), demonstrated greater resilience to incidents.
Recommendations for 2025/2026
1
Construction of distributed SOCs
Establishment of Provincial and Local Government SOCs integrated with CeZ and sectoral CSIRTs.
Financing the construction of SOCs from EU funds (Horizon Europe, Digital Europe) and the ESG component under the KPO (National Recovery Plan).
2
Simplified audit and certification model
Simplified audit: Dedicated to medium-sized hospitals, allowing for assessment of compliance with the NIS2 Directive and the KSC Act.
ESG certification: Facilities that meet IT security requirements will be able to obtain certificates confirming ESG compliance, which opens up access to additional funds.
3
Isolated infrastructure and physical security measures
Air-gapped networks: For critical IT systems, such as patient data management systems.
USB port blocking: Mandatory on all medical and administrative devices, except for authorised hardware keys.
4
Digitisation and elimination of paper-based procedures
Digital documentation: Implementation of digital signatures in accordance with eIDAS, enabling a complete transition to electronic patient consent forms and medical documentation.
EZLA system: Expansion to all hospitals, elimination of risks associated with prescription machines.
5
Medical and administrative staff training and support
Nationwide training programme on cyber hygiene and incident management for medical and administrative staff.
Workshops for management on integrating cybersecurity with ESG management.
Schedule for implementing the recommendations
Short-term
(2025)
➜ Pilot project involving simplified audits in 10 hospitals
➜ Construction of 5 Provincial SOCs
➜ Training 20,000 healthcare workers in cybersecurity
Mid-term
(2026–2027)
➜ Certification of 80 hospitals in accordance with ESG
➜ Full implementation of isolated networks in key units
Long-term
(2028+)
➜ The development of the national cybersecurity system in healthcare as a model for other sectors
Closing 2025 — review of the short-term goals
The 2024 schedule set three goals for 2025. Below is how they were met and what follows from them for the coming years.
| Training 20,000 healthcare workers partly achieved | 3,500+ participants in educational activities by the end of 2025 (on-site and online), including the “NIS2 and cybersecurity in healthcare” trainings for directors, IT teams, lawyers and procurement staff in Białystok, Szczecin, Łódź and Poznań. Conclusion: reaching 20,000 people needs stable funding — which is why from 2026 trainings are available under de minimis aid and within PFSz membership (see below). |
| Building 5 regional SOCs carried forward | In 2025 the Coalition did not build SOCs on its own. The goal moved to work with regional governments: in 2026 a shared SOC delivered as a service was developed with the Pomorskie region, and a workshop for hospitals of the Podlaskie region took place in Choroszcz (19 June 2026). |
| Pilot of simplified audits in 10 hospitals reshaped | In 2025 the diagnosis covered an analysis of 210 hospitals. From 2026 hospitals have a NIS2/KSC readiness assessment pathway at the HCPL Quality, Audit and Certification Centre and a NIS2/ENISA diagnostic questionnaire covering 130 risk areas. |
Number of participants — Healthcare Poland Foundation press release of 8 July 2026.
Informing PFSz hospitals about the trainings
In October 2026 information on de minimis-funded trainings reached around 900 representatives of management and staff of hospitals affiliated with and cooperating with the Polish Hospital Federation.
Trainings available now under de minimis aid
A hospital operating as a commercial company can train its staff without burdening its budget — in operators’ programmes up to 100%. The de minimis ceiling is EUR 300,000 per undertaking over three years (Commission Regulation (EU) 2023/2831); we check the hospital’s remaining limit in the SUDOP register based on its tax number. Public healthcare units (SPZOZ) entered in the National Court Register are assessed individually.
- Cybersecurity and NIS2 — 23 hours of training combined with individual advisory, for management, IT and information security (operator programme, de minimis aid).
- NIS2 for hospitals — 16 hours of online training and 15 hours of advisory: gap analysis, risk workshop, remediation plan, pre-audit consultations (HCPL Academy; de minimis, National Training Fund or the Development Services Database).
- CyberC4HE Essentials (20 h) and tabletop exercises for hospital management (8 h) — for PFSz member hospitals within the membership fee.
- Other de minimis programmes for hospital staff: accessibility in healthcare (free, up to 32 h), accessibility for business by PARP (free, 24 h + 15 h advisory), circular economy and ESG specialists (free, 26 h).
The application is non-binding and takes about 5 minutes. Training programme operator: IZOB Employers’ Association — phone: +48 602 657 062. Funding information is indicative; final terms are set by the agreement with the operator or the labour office.
CyberC4HE
Summary
Based on national and EU regulations, the CyberC4HE coalition has developed a comprehensive plan for cybersecurity transformation in the Polish healthcare sector. Implementation of the recommendations will ensure compliance with the NIS2 directive, protect patient data, and increase the effectiveness of financing, including in preparation for ESG reporting.
Models of support offered by CyberC4HE
Find out what forms of support the CyberC4HE Coalition offers its members.
Comprehensive cybersecurity transformation plan
The plan includes the implementation of risk management systems, IT infrastructure protection and compliance with the NIS2 directive, supporting hospitals in improving their financing and preparing for ESG reporting.
CyberBook
A handbook of good practices and standards for cybersecurity that supports the implementation of obligations under EU regulations (NIS2, GDPR, eIDAS).
Construction of distributed SOCs
Local security centres in EU regions monitoring threats, co-funded by Horizon Europe and Digital Europe funds.
