ProSec Global
Industries / In focus
  • Clinics & hospitals
  • Medical technology & dental
  • Pharmacies
  • Healthcare service providers

Healthcare & Medicine

In your organization, every security measure competes with the mandate to provide care – and care rightly wins. At the same time, the number of connected devices is rising, the skills shortage affects IT and care alike, and health data is among the most sensitive information an organization processes.

Patient care
Maintenance and change have to be subordinate to care operations.
Medical technology
Connected devices stay in use for ten years and longer.
Data protection
Security incidents can immediately also raise patient and data protection questions.
Resources
The skills shortage hits IT and patient care at the same time.
What we encounter in this environment
„
Patient care comes first. Always. That is why every change first has to prove that it does not impair operations. Security competes here with medical, staffing and organizational requirements that likewise tolerate no delay. That is why measures are not infrequently postponed although their relevance is undisputed.
How we see it

This is not negligence, but the right prioritization under conflicting requirements. What matters is therefore that security is not planned against care, but as part of its resilience.

Typical framework conditions

What makes this environment challenging.

Decisions in healthcare often touch several sensitive areas at once: ongoing care, regulated medical technology and the protection of health data. Every change therefore has to hold up medically, technically and in regulatory terms. We encounter three patterns in this environment again and again.

Recurring patterns from our practice
01

Care comes first

The mandate to provide care rightly stands above other considerations. Changes have to fit into it, not the other way round.

02

Operated, but not changeable

Connected medical technology is subject to manufacturer requirements that operators are not allowed to change on their own. It is nevertheless answered for in their own network.

03

Three sets of rules, one daily routine

Information security, medical device law and data protection are regulated separately. In everyday clinic and practice work they come together, and they do not always pull in the same direction.

Requirements that play a role
01NIS2
02B3S for hospitals
03MDR and IVDR
04IEC 62304
05IEC 81001-5-1
06GDPR
07ISO 27001
On an equal footing

Your contact for Healthcare & Medicine.

Talk to someone who knows your environment.

A confidential conversation at leadership level. We assess your situation and also tell you if another address would be the right one.