INCIBE advances ES-ISAC Salud and new EU lines

Cybersecurity is back on the healthcare sector’s agenda following several public and sectoral developments that affect the day-to-day management of private clinics: on one hand, the Ministry of Health has published information on the pattern of attacks recorded in the sector in 2024 according to INCIBE (Spain’s National Cybersecurity Institute); on the other, the creation of ES-ISAC Salud has been announced as a public–private initiative with participation from INCIBE and healthcare associations; and, in parallel, the European Commission is still developing an action plan specifically for hospitals and healthcare providers that foresees a stakeholder consultation, still in a definition phase, according to the Commission itself. In Spain, moreover, the SNS Cybersecurity Strategy published on sanidad.gob.es sets out lines for coordination and information sharing with INCIBE, with indirect implications for providers and operators in the healthcare ecosystem.

What has been announced and why it matters to a private clinic

The Ministry of Health, in a note from its Press Office, has linked the sector’s increased exposure to the “necessary interconnection between health services” and indicated that, according to data from INCIBE (Spain’s National Cybersecurity Institute), the most frequent attacks against the healthcare sector in 2024 have been malware, intrusions, data theft and ransomware, affecting primary care centres and hospitals, according to the Ministry quoting INCIBE. Although the reference focuses on the public and hospital environment, the operational message for a private clinic is straightforward: the vectors and incident types described by INCIBE (malware, intrusion, data exfiltration and encryption) align with the usual risks to the clinical record, appointment scheduling, billing, payment gateways and documentation systems.

Separately, sector media have reported the creation of ES-ISAC Salud as a centre aimed at strengthening the sector’s cybersecurity and cyber‑resilience, an initiative announced with participation from INCIBE and organisations from the private industrial and care sectors, according to iSanidad. The practical value for a clinic, should this materialise in sectoral information flows and alerts, would be having indicators and warnings more finely tuned to the healthcare environment—especially relevant when the clinic relies on multiple technology providers (clinical software, laboratory, radiology, signature gateways, hosting or backup).

Finally, the European Commission has published information about its European action plan on cybersecurity for hospitals and healthcare providers, stating that its design will be carried out in collaboration with healthcare providers, Member States and the cybersecurity community, and that “a consultation will be launched soon” with stakeholders to shape higher-impact actions, according to the Commission. For private clinics, this signals potential lines of work and future requirements, but the European Commission frames it as a process still to be defined.

Most-cited incidents in 2024: INCIBE and the Ministry’s focus

The Ministry of Health has listed, citing INCIBE, four categories of frequent incidents in the sector in 2024: malware, intrusions, data theft and ransomware, according to the Ministry’s Press Office note. The management implication for a private clinic is to review whether its procedures and contracts cover that “quadrant” of incidents: detection and containment of malware, access control to prevent intrusions, prevention of exfiltration (including unauthorised access to clinical and administrative information) and the capacity to recover from encryption.

The same Ministry communication points to service interconnection as a contextual factor. In a clinic, that interconnection usually takes the form of integrations with third parties (laboratories, private prescription platforms where applicable, video consultation tools, signature or storage providers). From an internal governance perspective, this requires inventorying dependencies and knowing which provider is involved in each data flow, especially when health data are involved.

ES-ISAC Salud: what it is and what to expect in the short term

The formation of ES-ISAC Salud has been presented as a sectoral public–private initiative announced with the participation of INCIBE and organisations from the industrial and private care sectors, according to iSanidad. An ISAC (information sharing and analysis centre) typically focuses on sharing alerts, indicators and good practices among members. Given the announcement-level information, what matters for a private clinic is to monitor how it develops: what membership channels will be available, what type of information will be shared and whether participation will be direct or via associations—details not specified in iSanidad’s coverage.

While those points are clarified, an immediate internal implication is to prepare the clinic to receive and act on external alerts. That includes assigning a person responsible for receiving alerts (management, head of systems or the IT provider), defining an escalation circuit (what to do if an alert affects a critical provider) and keeping the list of connected systems and services up to date.

SNS Cybersecurity Strategy: coordination and sharing

The SNS Cybersecurity Strategy available on sanidad.gob.es includes, among its lines, “analysing alternatives with INCIBE for information sharing” by IT providers for the Public Health Services and “establishing the coordination functions to be assumed by the Ministry of Health”, according to the Strategy document. Although the primary scope is the SNS, a private clinic is affected by knock-on effects when it works with providers that also serve public environments or when it integrates services that are standardised across the healthcare ecosystem.

In practice, this can translate into stricter contractual requirements from providers and greater formalisation of security evidence (policies, incident logs, notifications, response commitments). The Strategy, as published, sets a direction for coordination, but its concrete impact on obligations for third parties will depend on how it is implemented, according to the document itself when describing functions and alternatives.

European action plan: consultation pending and possible effects

The European Commission has indicated that the European action plan on cybersecurity for hospitals and healthcare providers will be designed with the participation of Member States and the sector, and that a consultation of stakeholders will be activated, according to the Commission. For a Spanish private clinic, the key point is that this work is still in the design phase: it is advisable to follow the consultation and the documents that are published in order to anticipate changes in cybersecurity requirements, particularly regarding service continuity, incident response and relationships with providers.

Until it is finalised, the compliance-focused operational recommendation is to monitor developments and prepare: identify which processes are most critical (schedule, clinical record, payments, communications with patients) and which external dependencies could become single points of failure, without yet assuming new obligations that have not been published.

AI and incident response: announced coordination

The IA360 Plan published by La Moncloa mentions “response to incidents arising from the behaviour of advanced models or agents, in coordination with INCIBE and the Centro Criptológico Nacional”, as well as international cooperation, according to the document itself. For private clinics, this is relevant insofar as AI‑based systems are adopted for administrative or support tasks (for example, email classification or document automation), because it introduces a public coordination framework for incidents linked to these systems if they come to affect essential services or sensitive data.

The document does not set out specific obligations for clinics, but it does establish an institutional line of coordination with INCIBE that may influence guidance, action frameworks or future requirements for providers, according to the IA360 Plan.

What management should review without waiting for new developments

From what the Ministry, the European Commission and the strategic documents have published, clinic leadership can draw three immediate control tasks: (1) an inventory of providers and connected systems, because interconnection increases exposure, according to the Ministry of Health; (2) an internal incident management procedure that covers the four incident types most cited by INCIBE for 2024 (malware, intrusions, data theft, ransomware), according to the Ministry citing INCIBE; and (3) monitoring sector initiatives such as ES-ISAC Salud and the European consultation, because they may become relevant information channels and future compliance references, according to iSanidad and the European Commission.

Any contractual or documentary adaptation (for example, with IT providers or cloud services) should be reviewed with the appropriate adviser, since the cited sources describe lines of action and announcements but do not replace the legal or fiscal interpretation applicable to each clinic.

References and links

• Nota del Ministerio de Sanidad sobre incidentes y datos de INCIBE: Ministerio de Sanidad
• Documento de Estrategia de Ciberseguridad del SNS (sanidad.gob.es): Estrategia de Ciberseguridad
• Anuncio de ES-ISAC Salud con participación de INCIBE (cobertura sectorial): ES-ISAC Salud
• Información de la Comisión Europea sobre el plan de acción y la consulta: Plan de acción europeo
• Plan IA360 (La Moncloa) y coordinación con INCIBE y CCN: Plan IA360

This article summarises public sector information. It is not legal or fiscal advice.