Understand what the Cyber Security and Resilience Bill is, how it will impact healthcare services and, most importantly, how healthcare practices can get ahead. This guide is intended to inform healthcare practice, clinic and organisation owners of the UK government’s new approach to national cyber security.
What is the Cyber Security and Resilience Bill?
In 2018, the Government introduced a vital new regulation called the Network and Information (NIS) Regulations 2018 (1) to improve cyber security for essential services such as healthcare. Whilst the regulations made an impact, the Government are frequently revisiting the regulations as criminals and hackers become more efficient.
A recent policy paper has stated that the NIS does not sufficiently manage risks across digital services and supply chains that healthcare services have become increasingly reliant on (2). The policy paper also references the June 2024 cyber-attack on Synnovis, a third-party provider for the NHS, that caused financial losses of £32.7 million and a disruption of over 11,000 appointments, which shows the devastating impact incidents can cause.
The Cyber Security and Resilience Bill will roll out across 2026/7 to build upon the current framework of the Network and Information Regulations from 2018.
Key changes
Not only will the bill tighten the regulations from NIS, but it will also expand on who NIS applies to. The bill is not expected to receive a Royal Ascent to come into place until late 2026, however, the proposed changes organisations can expect are:
- 24-hour early reporting for incidents followed by a 72-hour full report to the National Cyber Security Centre (NCSC).
- Mandatory notification to those involved in a breach in select circumstances.
- Penalty changes depending on seriousness of the breach. Penalties could reach up to 4% of global turnover for serious breaches, and £100,000 per day if the incident is ongoing.
- Additional sectors operating for essential services will now fall in the scope of the Bill such as relevant digital service providers, critical suppliers and data centres (3).
How does it affect healthcare and dental practices?
The Bill will focus heavily on essential services, having an impact on both private and NHS healthcare services. This could include services and organisations such as:
- General practices
- Dental practices
- NHS Hospital Trusts
- Pharmaceutical companies
- Optometrists
Although healthcare organisations may feel slight relief that their third-party providers will be held to the same standards as themselves, healthcare organisations may still feel the effects of being quick to report incidents, increased penalties and notification costs.
How healthcare organisations can get ahead
Since the bill has not received Royal Ascent at time of publishing, healthcare organisations have a good opportunity to tighten their security and put appropriate measures in place to lessen their risk of a breach or financial loss.
Tips for putting appropriate cyber security measures in place:
- Refer to the Information Commissioner’s Office and NCSC checklists
- Audit your third parties and supply chain
- Implement 2-factor authentication
- Build an incident response kit
- Explore Cyber Insurance options
- Create an ongoing employee cyber training programme
By taking appropriate protection and incident response measures, your organisation can better defend itself against cybercrime.
Lloyd & Whyte’s Cyber Liability Insurance
Being specialists in providing healthcare organisations with insurance, Lloyd & Whyte has developed Cyber Liability Insurance for the unique requirements of healthcare organisations. It is essential for these organisations to have a stand-alone cyber insurance policy for many reasons, especially with the new regulations coming into place imposing greater penalties in the event of an incident.
Patient data: is considered high-risk by the ICO as hackers could access patient addresses, medical history and contact details. This could lead to emotional and financial damages for the affected victim which the organisation would need to take accountability for.
Third-party suppliers: will mostly likely have their own cyber security defences in place, however, if an incident happens to them which affects your own organisation, as data handlers, you could still be deemed responsible by any patients it has affected.
Network failure and system downtime: are not covered in standard practice insurance policies. Financial loss as a direct result of a cyber-attack or hacking is not able to be claimed without a specialist Cyber Liability policy covering network failure and system downtime.
Regulatory and legal costs: since government enforced penalties are mirrored to the organisation’s turnover, they can become costly very quickly in the event of a claim. If you do not have a policy in place, organisations should prepare to budget for these costs, however, having a Cyber Liability policy is one of the easiest an organisation can prepare for regulatory fines.
Notification costs: organisations are expected to pay for these additional costs in the event of an incident to ensure that any persons whose data is breached as a result of a cyber-attack is notified in good time.
Employee breaches: accidents happen and a breach may not always be from a criminal but a simple employee mistake.
Lloyd & Whyte has partnered with a panel of leading cyber insurers to include risk management services in your Cyber Liability policy. They can run back-ground honey-pot testing and incident response testing so you can focus on your day-to-day activities.
Many practice, clinic and healthcare organisation owners simply do not have the time to monitor everything so let us look after your Cyber risks.
Receive your specialist healthcare Cyber Liability Insurance policy today:
Get a personalised quote
References
- https://www.gov.uk/government/collections/nis-directive-and-nis-regulations-2018
- https://www.gov.uk/government/collections/cyber-security-and-resilience-bill
- https://www.digitalxraid.com/blog/cyber-security-and-resilience-bill-guide/
Related pages
