Cyber Security in Hospitals: Legal Responsibilities

The increased use of interconnected technologies in healthcare - EHR systems, Internet of Medical Things (IoMT) devices, telehealth platforms and cloud-based systems - has transformed how hospitals operate while increasing their exposure to cyber threats such as ransomware, phishing, insider threats and the exploitation of medical devices. This article reviews the current state of cybersecurity in healthcare organizations with an emphasis on the legal obligations created by major regulatory frameworks, including HIPAA, HITECH, the GDPR, the NIS2 Directive and cybersecurity guidance for medical devices. It examines the intersection of data protection law, critical infrastructure regulation, tort liability and corporate governance; evaluates civil liability and penalty exposure, breach notification duties and third-party liability for cloud and vendor environments; and discusses ethical issues around confidentiality and professional duties. The findings show that hospital cybersecurity has evolved from a technical IT function into a comprehensive legal and governance responsibility requiring board-level oversight, structured risk management, continuous compliance documentation and workforce training.