Background and objectives of the consultation
A European action plan on the cybersecurity of hospitals and healthcare providers was set out in the Political Guidelines for the 2024–2029 European Commission, as one of the priority initiatives to be presented in the first 100 days of the new Commission mandate. The Action Plan was adopted as a Communication from the Commission on 15 January 2025, setting out actions for prevention, detection, response, recovery and deterrence against cybersecurity incidents in the healthcare sector.
Accordingly, a targeted consultation on the Action Plan was made available for responses from 7 April to 14 July 2025. It aimed at collecting the views of citizens, healthcare professionals, healthcare authorities, patients, compliance and data privacy professionals, cybersecurity professionals, organisations, and academia, among others. This consultation enabled respondents to provide insights both on general aspects of cybersecurity in the healthcare sector, and on specific elements of the Action Plan.
Next steps
The targeted consultation received 328 responses. This factual summary report includes the main quantitative results of the consultation. In addition, the Commission will assess the qualitative input received through open-text fields and documents added by respondents as attachments to their survey contributions. The Commission will consider the targeted consultation, as well as other consultations carried out in the context of the Action Plan, when formulating further recommendations in order to refine the Action Plan.
For more information, you can download the full report below and the anonymised survey results.
Disclaimer: the views presented in this factual summary report are not the views of the European Commission but of the stakeholders that participated in this targeted consultation.