”Cybersecurity Is Patient Safety”

Could you briefly outline what you plan to cover at the MVA conference in Copenhagen? Please, give us a teaser!

– My presentation will focus on the evolving cyber threat landscape facing healthcare organizations and the practical steps required to build resilience. I will discuss lessons learned from managing cybersecurity at a national healthcare level, the growing challenge posed by sophisticated threat actors, and how healthcare providers can balance innovation, digital transformation, and patient care while maintaining strong cybersecurity. I will also touch on the opportunities and risks introduced by artificial intelligence in healthcare security.

I understand that Israel has faced a sharp rise in cyber threats, especially since the outbreak of war three years ago. Did you manage to stop them?

– The volume and sophistication of cyberattacks have increased significantly during periods of geopolitical tension. While it is unrealistic to claim that cyberattacks can be completely stopped, our objective is to prevent disruptions to patient care, protect sensitive medical information, and ensure rapid detection and response.

– Through stronger governance, enhanced monitoring capabilities, and continuous preparedness activities, we have successfully prevented many attacks from causing damage. Cybersecurity is not a destination but an ongoing effort that requires constant adaptation.

You’ve mentioned that the ransomware attack which crippled Hillel Yaffe Medical Center marked a turning point, leading the Israeli Ministry of Health to tighten cybersecurity regulations. Have these stricter rules prevented attacks, or are further measures needed?

– The Hillel Yaffe incident was indeed a key moment. It demonstrated that cyberattacks on healthcare institutions are not theoretical risks but real threats with direct implications for patient care and operational continuity.

– The regulatory changes that followed significantly improved cybersecurity maturity across the healthcare sector. They strengthened governance, risk management, incident response readiness, and security controls. However, regulations alone are not enough. Threat actors continue to evolve, and defensive measures must evolve as well. Continuous investment, technological innovation, workforce development, and executive engagement remain essential.

In that case, what should be done to enhance security against cyberattacks on the healthcare sector – and how urgent is the need for action?

– The need for action is immediate. Healthcare organizations are among the most attractive targets for cybercriminals because they manage critical services and highly sensitive data.

Key priorities should include:

• Strengthening cyber resilience rather than focusing solely on prevention.
• Expanding continuous monitoring and threat intelligence capabilities.
• Implementing advanced detection and response technologies.
• Ensuring comprehensive supply chain and third-party risk management.
• Increasing cybersecurity awareness among employees and leadership.
• Regularly testing incident response and business continuity plans.
• Leveraging automation and AI to improve detection and response times.

– The question is no longer whether healthcare organizations will face cyberattacks, but how prepared they will be when those attacks occur.

I’ve read a lot about the risks associated with AI; since you use this technology, are there any specific risks you could mention?

– AI presents tremendous opportunities for healthcare and cybersecurity, but it also introduces new risks.

– Attackers can use AI to automate reconnaissance, generate highly convincing phishing campaigns, develop more evasive malware, and create sophisticated social engineering attacks. At the same time, AI systems themselves can be vulnerable to manipulation, data poisoning, inaccurate outputs, or unintended disclosure of sensitive information.

– For these reasons, AI governance, security controls, transparency, and ongoing risk assessments must become integral parts of every organization's cybersecurity strategy. Responsible AI is not only about innovation; it is also about trust and security.

Is there anything else you’d like to bring up that I haven’t asked about?

– One important point is that cybersecurity in healthcare is fundamentally about patient safety. When a hospital's systems are disrupted, the impact extends far beyond technology. It can affect clinical operations, medical decision-making, and ultimately patient outcomes.