Deloitte: Cybersecurity in healthcare to grow from reactive to proactive measures

The healthcare industry is expected to step up spending on cybersecurity, with hospitals currently allocating 8–10% of their IT budgets for hiring experts and deploying tools to prevent cyberattacks. According to a Deloitte India analysis, this will increase to 12–15% in the next two years– from a reactive to a proactive cybersecurity readiness.

Unlike the financial services sector, healthcare has been slower in adopting digital technologies. However, recent data breaches and rising cyber threats have prompted large hospital chains and their board members to prioritise patient data protection highlighted the ‘Cyber Resilience in Hospitals’ report by Deloitte and the Data Security Council of India (DSCI). While the Indian healthcare system is valued at $66 billion and projected to surpass $100 billion by 2027 cyber readiness and digital infrastructure needs to be developed.

Nearly 60% of healthcare organisations globally suffered a cyberattack in 2023, according to a study by Sophos, earlier reported by ET. This includes India’s top institutions such as the All India Institute of Medical Sciences (AIIMS) and the Indian Council of Medical Research (ICMR) wherein the personal data of over 81.5 million Indians was compromised and found for sale on the dark web.

“The executive management in corporate hospitals is increasingly coming from industries with higher cyber maturity, driving a shift in focus toward robust cybersecurity measures. We’re moving from reactive monitoring to offensive cybersecurity,” Vikram Venkateswaran, Partner, at Deloitte India told ET. He added that over the next decade there will be a growing trend of tech-savvy doctors leading the charge in cybersecurity awareness. He also said that while the preventive measures will improve, the number of acts will only grow due to the widening digital footprint.

The report noted that 89% of hospitals have adopted Third-Party Risk Management (TPRM) systems which are crucial in detecting and addressing cybersecurity threats within the vendor network, protecting sensitive patient data and strengthening vendor relationships. Despite this progress, only 10 percent of hospitals have fully implemented comprehensive data privacy programmes. Venkateswaran believes this will drastically change with implementation of Digital Personal Data Protection Act (DPDPA).

Rise of Telemedicine & cyber insurance

In the next two years, remote consultations will double from the current 7-10% to 17-20% the survey revealed despite the drop post pandemic. Clarifying on this trend Venkateswaran said, “The next phase of telemedicine growth won’t come from replacement but from new inquiries—primarily from people in remote areas seeking initial consultations before travelling to urban centres for treatment,” adding that the shift highlights telemedicine’s role in expanding access to healthcare especially in rural areas. Around 50% of hospitals have taken cyber insurance policies to protect against financial risks from data breaches and ransomware attacks. “One area that needs improvement is integrating cybersecurity into medical training where technology discussions are limited to handling X-rays and MRIs. Today, with robots performing surgeries, the landscape has changed, and so has the need for awareness and training,” the Deloitte partner said.

The firm recommends that medical, nursing, and pharmacy colleges must take cybersecurity more seriously, ensuring graduates are equipped to handle tech-driven challenges from the initial stage.