Healthcare Board Cyber Briefing: Patient Safety Risk

In a hospital or care provider, a cyber attack is not only a data breach or an IT outage: it can delay blood results, cancel operations and push clinicians onto paper at the moment patients are most at risk. Boards that file cyber under information governance or IT miss the part they are most accountable for, which is safe care. This briefing gives healthcare boards, trustees and non-executive directors a patient safety framing for cyber risk: what to ask, what good looks like, where to invest first and how to measure it. It complements the general Board Cyber Risk Reporting Guide, which covers report structure and risk appetite, and does not repeat it.

Source note: this page summarises regulator, standards body and official sources listed at the end, as of November 2026. Confirm against the official text before relying on it.

The risk in one paragraph

Clinical care now depends on digital services the organisation does not fully control: pathology and imaging systems, electronic patient records, e-prescribing, medical devices and suppliers that process data on its behalf. When any of these is encrypted or switched off, the harm is measured in delayed diagnosis and treatment, not only in records exposed. In June 2024 a ransomware attack on Synnovis, a pathology provider serving NHS organisations mainly in south-east London, disrupted blood testing; NHS England reports delays to over 11,000 outpatient and elective procedure appointments, and full restoration of services took until December 2024. From late February 2024 the attack on Change Healthcare, which started with a remote access login that did not require multi-factor authentication, cut pharmacies, hospitals and practices off from claims and eligibility checks for weeks. The board question is therefore not "are we compliant?" but "how long can we keep patients safe when a critical system or supplier fails, and how do we know?".

Why this is a board-level issue now

Policy treats cyber as patient safety: the Department of Health and Social Care's cyber security strategy for health and adult social care to 2030 (published 22 March 2023) states that the cyber security of health and social care systems "underwrites patient safety", sets an aim for all health and social care organisations to be cyber resilient by 2030, and says leaders are responsible for the cyber risk held by their organisation.
Board actions are now written down: the UK Cyber Governance Code of Practice (8 April 2025) asks boards to gain assurance that a response and recovery plan exists, that it is exercised at least annually with internal and external stakeholders, and to require formal reporting at least quarterly against agreed tolerances. See the UK Cyber Governance Code of Practice Guide.
US sector goals set a baseline: HHS publishes voluntary Healthcare and Public Health Cybersecurity Performance Goals, ten essential goals including multifactor authentication, revoking credentials for departing workforce members (including contractors and volunteers), basic incident planning and vendor cybersecurity requirements, and ten enhanced goals. See the Healthcare Cyber Regulation Map for the regulatory picture, including HIPAA.
Suppliers are the weak point: both Synnovis and Change Healthcare were third parties to the providers whose patients were affected. Board oversight that stops at the organisation's own network misses the most likely cause of clinical disruption.
Devices are clinical equipment: the US FDA issued final guidance on cybersecurity in medical devices on 27 June 2025, including recommendations for "cyber devices" under section 524B of the Federal Food, Drug, and Cosmetic Act, and the FDA page lists a revised version dated 2 February 2026. Procurement and clinical engineering decisions now carry cyber obligations. See the Medical Device Security Guide.

Translating cyber risk into patient safety terms

Boards understand clinical risk. Express cyber scenarios in the same language, owned jointly by the chief information security officer (or equivalent) and the medical director or chief nurse.

Cyber scenario	Clinical consequence	Safety question for the board
Pathology or laboratory system unavailable	Delayed blood results, transfusion and cross-matching problems, postponed surgery	How many hours can we run urgent pathology manually, and with whom?
Electronic patient record or e-prescribing down	Medication errors, missing allergy and history information, slower handovers	Are downtime packs and read-only copies current and tested on every ward?
Imaging and reporting systems encrypted	Delayed diagnosis in stroke, trauma and cancer pathways	What is the diversion trigger and who decides?
Medical devices or their management servers compromised	Devices taken out of service, infusion and monitoring disruption	Do we know which devices are networked, and who can isolate them safely?
Critical supplier outage (claims, pharmacy, pathology, records hosting)	Care delayed across many providers at once	Which suppliers would stop clinical services, and have we exercised their failure?
Patient data stolen and published	Loss of trust, safeguarding risk for vulnerable patients, regulatory action	Can we notify and support affected patients quickly?

A practical step is to put the top cyber scenarios on the clinical risk register, not only the corporate risk register, with a named clinical owner, and to assess them with the same severity scale used for other patient safety risks.

Governance arrangements that put safety first

How cyber reaches the board decides whether patient safety is part of the conversation. A few structural choices make the difference.

Arrangement	Common default	Patient safety version
Committee route	Audit and risk committee only	Audit and risk for control assurance, plus the quality and safety committee for clinical impact, at least twice a year
Executive ownership	Chief information officer alone	Joint ownership by a clinical executive and the security lead, with a named board-level senior owner, as the Cyber Governance Code asks
Risk register	One generic "cyber attack" corporate risk	Specific scenarios (pathology loss, record system loss, supplier outage) scored on the clinical harm scale
Reporting frequency	Annual update or after an incident	Quarterly metrics against agreed tolerances, plus immediate escalation of material incidents
Exercising	IT technical recovery test	At least annual exercise involving clinicians, operations, communications and key suppliers, with lessons fed back
Board literacy	Ad hoc briefings	Scheduled training for directors, using the organisation's own scenarios

Two decisions should be made in advance rather than during an incident: who has authority to divert or cancel services because of a cyber incident, and what the board will be told, by whom, in the first hours. During an incident the Code expects directors to take responsibility for their individual regulatory obligations, such as reporting, and to support critical decisions and external communications. Pre-agreeing these roles avoids delay when systems, email and phones may be unavailable. The Board and Director Cyber Liability Guide covers director duties in more depth.

Five questions for the board to ask

Which systems and suppliers, if lost, would stop or endanger clinical care, and for how long can we cope without each? Expect a ranked list with tested manual workaround times, agreed with clinical leaders, not an IT asset list.
When did we last run a clinical downtime exercise, and what went wrong? Expect a dated exercise involving clinicians, operations and key suppliers, with actions tracked to closure. See the Clinical Downtime and EHR Downtime Procedures Guide.
Is every remote access route, administrator account and supplier connection protected by multi-factor authentication? Expect coverage figures with named exceptions, each with an owner and an end date. The Change Healthcare attack began with a single remote access login without MFA.
Can we restore the systems clinicians need most, from backups attackers cannot reach, within our clinical tolerance? Expect tested restore times for the electronic patient record, pathology and imaging, measured in a real test.
Who decides to divert, cancel or switch to paper, and how will we communicate with patients, staff and regulators if email and phones are down? Expect named decision makers, out-of-band communications and pre-approved patient messages.

Red flags in management answers

Risk described only in compliance terms (toolkit status, audit findings) with no link to clinical services.
Downtime procedures that exist on paper but have not been used by clinicians in the last year.
"MFA is enabled" without coverage figures for remote access, suppliers and administrator accounts.
Recovery times taken from supplier contracts rather than from tests.
No clinical representative in cyber exercises, or no cyber representative in major incident planning.

What good looks like

Shared ownership: cyber scenarios are owned jointly by a clinical executive and the security lead, and appear on the clinical risk register.
Clinical tolerances: each critical service has an agreed maximum tolerable outage, set by clinicians, that drives recovery and backup investment.
Tested downtime: wards and departments rehearse paper-based working and manual pathology and pharmacy processes at least annually, alongside the organisation's major incident plan.
Identity basics done: MFA on all remote access and administration, unique credentials, separate privileged accounts and prompt removal of access for leavers, contractors and volunteers, in line with the HHS essential goals. See the Healthcare Identity Security Guide.
Supplier assurance by clinical impact: suppliers ranked by the clinical services they support, with security requirements, incident notification terms and exercised failure scenarios for the top tier.
Integrated response: cyber incident response is part of emergency preparedness, with clinical safety decisions built into the playbook. See the Healthcare Incident Response Guide.

Where to invest first

Priority	Investment	Patient safety rationale
1	MFA on remote access, email, administrator and supplier accounts	Removes the most common route into clinical systems
2	Immutable or offline backups of the electronic patient record, pathology and imaging, with tested restores	Shortens the period of unsafe paper-based care
3	Clinical downtime procedures and exercises	Keeps care safe while systems are down, whatever the cause
4	Network segmentation for medical devices and clinical systems	Limits spread from office IT to clinical equipment
5	Supplier security requirements and incident terms for clinical-critical suppliers	Addresses the route seen in the largest recent disruptions
6	Detection and centralised logging, with 24 hour response cover	Earlier containment means fewer services lost

Small providers such as GP and dental practices should focus on the first three and rely on their suppliers for much of the rest. See the Cyber Security for Dental and GP Practices Guide.

Metrics to track

Metric	What it tells the board
Critical clinical services with a tested manual workaround, and the date of the last test	Whether care can continue safely during an outage
Tested restore time against clinical tolerance for the electronic patient record, pathology and imaging	Whether recovery investment is sufficient
MFA coverage on remote access, supplier and administrator accounts, with exception count	Exposure to the most common initial access route
Clinical-critical suppliers with security requirements and an exercised failure scenario	Third-party exposure
Networked medical devices inventoried and segmented	Device risk and isolation readiness
Leaver, contractor and volunteer accounts disabled within the agreed time	Basic access hygiene in a large, mobile workforce

A 90-day plan

Days 1 to 30: agree joint clinical and security ownership; list the systems and suppliers whose loss would stop clinical care; obtain MFA coverage figures and restore test dates for each.
Days 31 to 60: clinicians set maximum tolerable outages for the top services; add cyber scenarios to the clinical risk register; close the highest-risk MFA gaps on remote access and supplier accounts.
Days 61 to 90: run a board-level exercise based on the loss of a critical supplier (for example pathology), including the diversion and communications decisions; agree the quarterly metrics above and the investment priorities for the next year.

Common failure patterns

Cyber reported to the audit committee only: the quality and safety committee never sees it, so clinical consequences are not discussed.
Remote access without MFA: the Change Healthcare breach began with one remote access login without MFA and disrupted pharmacy and claims processing nationwide for weeks.
Supplier treated as someone else's problem: contracts lack incident notification and recovery terms, and nobody has exercised the supplier's failure.
Downtime packs out of date: paper forms and contact lists that do not match current wards, systems or staff.
Recovery measured in IT terms: "systems restored" declared while clinical backlogs, re-testing and re-booking continue for months, as NHS England described after Synnovis.

Standards and references

How NHI Mgmt Group can help

We provide independent identity and non-human identity risk assessments and board briefings for healthcare organisations, with a focus on the remote access, supplier, privileged and machine accounts that attackers use to reach clinical systems. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.

Healthcare Board Cyber Briefing: Treating Cyber Risk as a Patient Safety Risk