Cybersecurity should be embedded throughout healthcare procurement, from early planning to supplier oversight and eventual system retirement. New July 2026 guidance from the European Union Agency for Cybersecurity (ENISA) sets out a procurement approach for hospitals and healthcare providers that integrates security requirements across the full technology life cycle. The guidance covers medical devices, clinical information systems, cloud services, network equipment, remote care systems, infrastructure, managed services and AI-enabled products. It aligns procurement measures with frameworks including NIS2, the General Data Protection Regulation, medical device rules and the European Health Data Space Regulation.
Security Starts Before Suppliers Are Selected
Before a tender begins, healthcare organisations are advised to adopt a strategic approach to supply chain cybersecurity and maintain continuous awareness of technology infrastructure and service dependencies. Procurement planning should identify cybersecurity risks, consider how new acquisitions may change the organisation’s risk profile and account for interoperability with existing or legacy systems. Security, privacy and regulatory requirements should then be translated into clear procurement documentation. Adequate financial and human resources are also part of the wider strategy, alongside defined responsibilities and an up-to-date view of critical suppliers.
Tender specifications should define the security features expected from products and services. These may include encryption for data in transit and at rest, strong access controls, multifactor authentication, audit logging and secure default configurations. Requirements should also cover security updates across the expected product life cycle and arrangements for end-of-life support or replacement.
Must Read: Clinical Resilience Requires More Than Cybersecurity Tools
Supplier selection should test whether bidders meet the defined technical and regulatory requirements rather than treating cybersecurity as a separate consideration. Assessments should cover security practices, compliance with relevant standards and the supplier’s ability to manage vulnerabilities, patches and incidents. Equipment and software should be procured through authorised and trusted channels. Where feasible, proposals should be evaluated by a multidisciplinary group that includes IT, cybersecurity, clinical engineering and legal or regulatory expertise. Procurement decisions should also consider system resilience, supplier dependencies and the ability to avoid excessive supplier lock-in.
Contracts Extend Security Across the Product Life Cycle
Cybersecurity responsibilities continue after a supplier has been selected. Contracts should establish ongoing security obligations, including timely patching, vulnerability disclosure, incident notification and defined responsibilities for remediation. They should also address subcontracting, with security requirements passed through to approved subcontractors, and provide clear arrangements for data return or destruction when a contract ends. Suppliers should be required to follow secure software development practices so that systems, including machine-learning components, are designed and maintained with security by design.
Post-procurement management should verify that systems, products and services continue to meet agreed specifications while cybersecurity risks and regulatory obligations are actively managed. Supplier performance should be monitored, incidents and emerging threats tracked and corrective measures such as software updates or security configuration changes applied when needed. Secure decommissioning is also part of the procurement life cycle, particularly for systems and devices that may contain sensitive health or personal data. Inventories should remain accurate as technologies and AI functionality change.
The broader security measures include maintaining an up-to-date directory of critical suppliers, identifying and remediating known vulnerabilities and operating a robust patch management process. Healthcare organisations should also maintain secure network architecture, isolate critical systems where appropriate and support continuity through recovery, emergency response and crisis management procedures. Continuous logging and monitoring, protection of sensitive data, staff training and evaluation of security controls are included as cross-cutting measures.
AI and Supply Chains Add New Procurement Risks
AI introduces procurement risks even when a product is not explicitly marketed as AI-enabled. AI functionality may be embedded in a wider service, accessed through a third-party interface or used by suppliers and subcontractors for development, technical support, security testing, documentation or data analysis. Healthcare organisations are therefore advised to determine where AI is used across the supply chain and to continue this assessment after contract award as services or AI functionality change.
Where AI is involved, procurement documentation should require information on its purpose and scope, provider, deployment model, data-processing arrangements, categories of data processed, storage and retention, subprocessors, human oversight, logging and procedures for reporting material changes. Suppliers should also identify the processing purposes and legal basis if customer data may be used to develop, train or improve AI models. Sensitive health, personal, security or infrastructure information should not be submitted to external AI services or used for model development without explicit authorisation following appropriate legal, data protection, cybersecurity and clinical risk assessments. Contracts should address return and deletion of relevant data at termination.
These principles apply across diverse procurement settings. Hypothetical scenarios cover networked radiology equipment, cloud-based digital services and an off-the-shelf electronic health record system, linking general controls with planning, supplier selection and ongoing management. A structured checklist connects individual measures with procurement types and the threats they are intended to mitigate, with measures prioritised according to their relevance.
Healthcare procurement is treated as a continuous cybersecurity process rather than a one-off purchasing decision. Security requirements begin with risk assessment and tender design, continue through supplier evaluation and contractual controls and remain active during operation, incident management and decommissioning. The approach places particular emphasis on supply chain visibility, clear supplier responsibilities, vulnerability and patch management, secure handling of sensitive data and oversight of AI use. By linking these requirements to different procurement types and stages, the guidance provides hospitals and healthcare providers with a structured basis for integrating cybersecurity into purchasing and supplier management.
Source: ENISA
Image Credit: iStock
References:
European Union Agency for Cybersecurity (2026) Procurement guidelines for the cybersecurity of hospitals and healthcare providers. S.l.: ENISA.
