Cybersecurity for Healthcare Providers in India

A ransomware crew does not care that you are a hospital. If anything, they like it more. When a manufacturer goes down, its trucks stop. When a hospital goes down, patients on ventilators are at risk, surgeries get cancelled, and the pressure to pay lands on the CEO within hours. That is exactly why healthcare has become one of the most attacked sectors in India, and why the ransom demands keep going up.

We have sat in the war room the morning after. The clinical staff are running a paper triage, the radiology PACS is encrypted, and someone from IT is quietly asking whether the last good backup is three days or three weeks old. Nobody in that room is talking about DPDP consent notices. They are trying to keep the hospital running. The compliance conversation comes later, and it is always harsher than it needed to be.

Banks have been living under RBI cyber directions for a decade. They have SOCs, segmentation, and money for it. Most Indian hospitals do not. The board treats IT as a cost centre that keeps the HIS running, not as a control function. That gap is precisely what the attacker exploits.

Healthcare carries a specific kind of risk that makes it valuable and fragile at the same time:

Two years ago you could argue that health data protection in India was vague. That excuse is gone. Three things now govern how you handle patient data, and they interact.

The Digital Personal Data Protection Act 2023 (DPDP) is the law. Health data is personal data under it, and there is no separate lighter regime for hospitals. A few things every provider should internalise:

If you connect to the Ayushman Bharat Digital Mission (ABDM), you are also bound by its Health Data Management Policy and the technical requirements to become an HIP or HIU (Health Information Provider or User). ABDM expects encryption in transit and at rest, consent-artefact-based sharing through the Consent Manager, audit logging of every access, and empanelment through the ABDM sandbox before you go to production. The ABHA number is a health identifier tied to identity, so treating it casually is a fast route to trouble.

The CERT-In Directions of 28 April 2022 apply to you as much as to any other body corporate. The headline obligations that hospitals routinely miss:

Here is a composite from cases we have handled. A 350-bed multispecialty hospital. On a Friday around 9 pm, a billing operator opens an email claiming a rejected insurance claim needs re-verification, and enters credentials into a cloned portal. Nothing visible happens. Over the weekend the attacker moves laterally using those credentials, finds a domain admin account cached on an old workstation, and disables the backup agent.

Monday, 6 am. The HIS login fails. The PACS is encrypted. Screens across radiology, pharmacy, and the lab show a ransom note demanding payment in Bitcoin. The OPD queue is already building at the gate. By 8 am the hospital is on paper. Lab reports are handwritten, the pharmacy cannot see prescriptions, and two elective surgeries are postponed.

Now the compliance clock starts, and this is where unprepared hospitals bleed. CERT-In wants a report within 6 hours of noticing. DPDP requires breach notification to the Board. The team cannot even confirm whether patient data was copied out, because there was no data-loss monitoring and the logs rolled over after 30 days. The backup that IT was counting on was on a NAS that the attacker also encrypted, because it was reachable from the same network. Recovery from an offline copy takes 11 days. The regulator asks one uncomfortable question in writing: what reasonable security safeguards were in place before the incident. The honest answer is what determines the penalty.

None of the expensive part of this was the malware. It was the missing basics: no phishing-resistant login, a flat network, backups reachable from production, and logs too short to prove anything.

When we assess a hospital or a health-tech platform, the same five findings come up again and again. Fix these and you are ahead of most of the sector.

An MRI console talking to the same switch as the reception desktop is the single most common critical finding. Medical devices cannot be patched, so they must be isolated. You need VLAN segmentation with the clinical device network firewalled off, and no direct internet path from those devices.

Everyone has backups. Almost nobody tests restores. The attacker targets your backup infrastructure first. You need at least one immutable or offline copy that the production domain cannot reach, and a restore drill you have actually run against your HIS and PACS in the last quarter.

A single reception login used by six people, and a domain admin password taped under a keyboard, defeat every other control. Individual accounts, multi-factor authentication on anything internet-facing, and a break-glass process for admin access are non-negotiable.

When the incident hits, logs are the only thing standing between you and a total loss of forensic story. CERT-In mandates 180 days retained in India, with NTP synced to NIC or NPL. Most hospitals we see retain 15 to 30 days and have devices drifting minutes apart.

Teleradiology, lab integrations, TPAs, EMR clouds. Each one is a Data Processor under DPDP, and you owe a written contract that binds them to the same safeguards. Missing DPAs turn one vendor breach into your liability.

Boards always ask for the number. There is no single answer, because a 50-bed nursing home and a 500-bed chain are different animals. But here are honest, current ranges for the Indian market so you can budget realistically. These are indicative, not quotes.

Compare that to a single ransomware event. Between forced downtime, recovery labour, forensic and legal fees, possible ransom, patient churn, and a DPDP penalty that can reach Rs 250 crore, the incident dwarfs the prevention budget. We say this to every board: the cheapest security programme you will ever run is the one you build before the breach.

Do not try to boil the ocean. Sequence it so that the highest-impact, lowest-cost controls land first. A realistic 90-day arc for a mid-size provider looks like this.

If you do nothing else this quarter, work down this list in order. Every item here has stopped a real incident or saved a real audit.

The attacker who hits a hospital is betting on one thing: that keeping patients alive will always outrank keeping systems secure, so the basics never get done. That bet is usually right. Your job is to make it wrong, quietly, before Friday night, by getting segmentation, backups, identity, and logging in place while nobody is watching. The clinical mission and the security mission are the same mission. A hospital that cannot access its records cannot treat patients.

If you want a second set of eyes from people who have stood in that war room, our team at CyberSigma are senior CERT-In empanelled auditors and PCI QSAs who do this work hands-on for Indian hospitals and health-tech, from DPDP and ABDM readiness to VAPT and incident response. We are happy to walk your estate with you before an attacker does.