Healthcare is the highest-impact sector for cyber attacks in the UK. The 2017 WannaCry incident cost the NHS roughly £92m and disrupted care across 80 trusts. The 2024 attack on Synnovis, the pathology services provider for King’s College Hospital and Guy’s & St Thomas’, postponed thousands of operations and remains the most disruptive ransomware event in NHS history. Recent ransomware events at care home groups, dental chains and private hospitals have confirmed that the threat extends well beyond the NHS itself.
This guide explains the cyber security obligations and practical controls UK healthcare providers must implement in 2026 — whether you’re a primary care GP practice, a private clinic, an NHS-contracted service, a care home group, or a digital health SaaS vendor selling into the NHS.
What UK healthcare regulators expect in 2026
NHS Data Security and Protection Toolkit (DSPT)
Mandatory annual self-assessment for all organisations that have access to NHS patient data — including GP practices, dentists, pharmacies, optometrists, NHS-contracted private providers, and any digital health vendor accessing NHS data. The 2024–25 DSPT aligns with the National Data Guardian’s 10 standards and the Cyber Assessment Framework (CAF) for NHS organisations.
DSPT submission deadline: 30 June each year. Failure to submit on time can affect NHS contract status. Most UK healthcare providers underestimate the work involved — budget 4–8 weeks of effort the first time, 1–2 weeks for renewals.
Network and Information Systems Regulations 2018 (NIS)
Operators of Essential Services in healthcare (specifically: NHS Trusts, primary care providers commissioned by ICBs above certain thresholds, certain critical NHS suppliers) fall under NIS 2018. NIS requires appropriate technical and organisational measures, incident reporting to NHS England’s designated Competent Authority within strict deadlines, and cooperation with the National Cyber Security Centre.
The UK is in the process of implementing NIS-equivalent reforms. Mid-sized private healthcare providers should treat NIS-like expectations as the floor, not the ceiling.
UK GDPR — medical data is special-category
All medical data falls under UK GDPR Article 9 (special-category data), requiring an explicit legal basis under both Article 6 and Article 9. Breaches involving medical data almost always require ICO notification within 72 hours and frequently require notification to data subjects. ICO fines for healthcare breaches have ranged from £15,000 to £1.275m, with no cap in principle.
CQC fundamental standards
The Care Quality Commission’s fundamental standards under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 implicitly require providers to maintain confidentiality and handle records appropriately. Cyber failures that expose patient records can lead to CQC enforcement action including warning notices, conditions on registration, or in extreme cases, deregistration.
NHS England Digital Technology Assessment Criteria (DTAC)
If you’re a digital health vendor selling SaaS or apps into the NHS, DTAC compliance is now expected. DTAC covers clinical safety, data protection, technical assurance, interoperability and usability. The cyber security section requires evidence of secure development practices, vulnerability management and pen testing.
The cyber threats UK healthcare providers face
1. Ransomware on clinical systems
The Synnovis attack and earlier incidents at Advanced (NHS 111 supplier, 2022) and University Hospital of Southampton have confirmed: attackers prioritise clinical systems precisely because they cannot be brought down without affecting patient care. Defence requires immutable backups of clinical systems, segmented networks separating clinical from administrative IT, and 24/7 detection.
2. Phishing of clinical staff
Clinical staff are statistically more susceptible to phishing than office staff — partly because they work under time pressure, partly because much of the phishing arrives during clinical workflows (DocuSign requests, IT password expiry notifications etc.). Awareness training tailored to clinical workflows is materially more effective than generic phishing training.
3. Patient-data theft for fraud
UK NHS records sell on dark-web markets at significantly higher prices than financial records, because they enable downstream identity fraud, prescription fraud and medical-impersonation insurance fraud. Healthcare providers are targeted both for direct extortion and for data exfiltration ahead of resale.
4. Connected medical device compromise
Imaging systems, pumps, monitoring devices and lab analysers increasingly run on networked Windows or Linux systems. Many have legacy operating systems that cannot be patched. Network segmentation, dedicated VLANs and continuous monitoring are required — treating medical devices like normal IT endpoints fails because they can’t be patched on normal cycles.
5. Third-party / supply-chain compromise
Synnovis was a supplier-route compromise; several earlier NHS incidents originated in a third-party SaaS or managed-service provider. More on supply-chain attacks here. Healthcare procurement processes must include cyber due diligence on suppliers (DSPT submission, ISO 27001, Cyber Essentials Plus).
The cyber controls UK healthcare providers should have in 2026
Identity, access and segmentation
- MFA on every clinical-system login, every email account, every remote-access route. NHS Smartcards count where applicable.
- Role-based access control aligned to clinical roles (clinician, admin, finance, pharmacy etc.).
- Network segmentation separating clinical, medical-device, administrative, guest Wi-Fi networks.
- Zero-trust principles for any cross-network access.
Endpoint and medical device protection
- EDR on every administrative endpoint (laptops, desktops, servers). EDR comparison.
- For medical devices: continuous network monitoring (Claroty, Medigate, Cynerio), explicit vendor patch tracking, segmentation by device class.
- BitLocker / FileVault encryption on every device storing patient data.
Email and communications
- Microsoft Defender for Office 365 P1 or P2 with anti-phishing, anti-impersonation rules.
- NHS-mail interop (where applicable) plus encrypted external-correspondence channels.
- SPF, DKIM, DMARC at p=reject.
Backup, recovery and clinical continuity
- 3-2-1-1 backups including clinical systems, EPRs, imaging archives.
- Immutable backup storage to defeat ransomware encryption of backups.
- Documented Recovery Time Objective (RTO) for each clinical system, with clinical-team-validated business continuity plans for paper-based fallback.
- Annual full-restoration drills.
Detection, response and reporting
- 24/7 MDR with NHS-aware analyst playbooks — incidents in healthcare have shorter dwell-time tolerance than other sectors.
- Incident response plan documenting NHS Digital DSP Toolkit incident-reporting workflows, ICO notification procedures, and CQC notification thresholds.
- Pre-arranged DFIR firm via incident-response retainer.
- Annual tabletop exercise involving clinical and IT leadership together.
Compliance & governance
- NHS DSPT submitted annually by 30 June; achieve “Standards Met” baseline.
- Cyber Essentials annually as a minimum; Cyber Essentials Plus for NHS-contracted providers and DTAC-relevant suppliers.
- UK GDPR Article 30 records of processing for special-category data.
- DPIA for new clinical SaaS or AI tools.
- Documented Caldicott Guardian function with executive-level support.
Realistic cyber security budget for UK healthcare
Single-site GP practice (8–15 staff)
- NHS-mail + clinical system already provided centrally; local IT spend covers infrastructure beyond that.
- M365 Business Premium for non-clinical workloads: £2,200/year
- Cyber Essentials annual + DSPT submission support: £2,500/year
- Awareness training including clinical-context phishing modules: £400/year
- Local backup beyond clinical-system supplier: £600/year
- Pen test (every 2 years): £1,750/year amortised
- Total: ~£7,500/year
Private clinic / care home group (40–80 staff, multiple sites)
- M365 Business Premium: £18.10 × 60 × 12 = £13,000/year
- 24/7 MDR: £13,000/year
- Cyber Essentials Plus + DSPT: £5,500/year
- Awareness training: £1,800/year
- Clinical-system backup add-on (immutable): £3,500/year
- Annual external pen test + DTAC review: £7,500/year
- Cyber insurance: £6,000/year
- IR retainer: £6,000/year
- Total: ~£56,000/year
Mid-sized digital health vendor (50–100 staff, NHS-contracting)
- M365 mix: £25,000/year
- Premium tier MDR + SIEM: £30,000/year
- ISO 27001 + Cyber Essentials Plus + DSPT + DTAC: £18,000/year
- Awareness + secure-dev training: £3,000/year
- Pen testing programme: £25,000/year
- Cyber insurance: £15,000/year
- IR retainer: £10,000/year
- Total: ~£126,000/year
Frequently Asked Questions
Mandatory for any organisation that has access to NHS patient data — which includes most NHS-contracted private providers, GP practices, dentists, pharmacies, optometrists, and digital health suppliers using NHS data. Private clinics that don’t access NHS data may not need DSPT, but their clients (insurers, NHS partners) often require DSPT-equivalent assurance. Practical answer: if you’re selling into the NHS or accepting NHS-funded patients, plan for annual DSPT submission. The work is significant the first year (4–8 weeks) and lighter on renewals.
DTAC (Digital Technology Assessment Criteria) is NHS England’s assessment framework for digital health products. If you’re a SaaS vendor or app developer selling clinical or patient-facing digital tools into the NHS, expect DTAC compliance to be required by the procuring NHS organisation. DTAC covers clinical safety (DCB0129), data protection, technical assurance, interoperability and usability. The cyber security section explicitly requires evidence of secure development, vulnerability management and pen testing — effectively expecting Cyber Essentials Plus or ISO 27001 as a baseline.
Treat medical devices as a separate trust zone from corporate IT. Three core controls: (1) network segmentation putting medical devices on dedicated VLANs with controlled gateways to corporate IT, (2) continuous network monitoring using a clinical/IoT-aware platform like Claroty or Medigate to detect anomalous traffic, (3) explicit vendor-managed patching cycles — many medical devices run unpatched legacy operating systems and the vendor controls when patches can be applied. Don’t put EDR on medical devices unless the manufacturer explicitly supports it — you can void clinical-safety assurance.
Medical data is UK GDPR Article 9 special-category data, so almost any breach involving patient records meets the 72-hour ICO notification threshold. The ICO expects a documented incident-response procedure, prompt notification, evidence of containment activities, and a cogent root-cause analysis. ICO healthcare enforcement has focused on lack of MFA, unencrypted devices, inadequate access controls and missing audit logging. Recent ICO healthcare fines have ranged from £15,000 to £1.275m. The penalty calculation is heavily influenced by the cyber controls in place at the time of breach.
Realistic 2026 budgets: single-site clinic (8–15 staff) ~£7,000–£10,000/year; mid-sized clinic or care home group (40–80 staff) ~£45,000–£65,000/year; multi-site healthcare provider (200+ staff) ~£150,000–£300,000/year; digital health SaaS vendor (50+ staff) ~£100,000–£180,000/year given DTAC and ISO 27001 expectations. As a benchmark, healthcare cyber spend should be 8–14% of total IT spend — significantly higher than the all-sectors average because of the data sensitivity and the regulatory exposure.
For some NHS contracts, Cyber Essentials basic is sufficient as the technical-controls baseline; for others, Cyber Essentials Plus is required, especially where the supplier handles patient data or connects to NHS systems. NHS England’s commercial framework increasingly requires Plus rather than basic. For digital health suppliers, ISO 27001 is becoming the de facto floor, sometimes alongside DTAC and DSPT. Practical answer: aim for CE Plus + DSPT submission as the credible minimum for any NHS-contracted UK healthcare supplier in 2026.
Need a healthcare-aware cyber review of your practice or business? Request a free DSPT & cyber gap analysis — we cover the controls NHS England, the ICO, the CQC and your NHS-contracting partners actually expect, with explicit recommendations for clinical-system protection. See also our best UK cyber security companies guide.
Related Reading
More from the Connection Technologies blog.