Cyber Security Responsibilities for Healthcare Managers: A Practical Guide

As a healthcare manager, your cyber security responsibilities are mostly about people and process, not technology. Your IT team runs the systems, but you decide who on your team can use them, whether staff are trained, whether problems get reported quickly, and how patient care carries on when the computers go down. This guide sets out what that looks like for ward, practice, care-home and department managers in Ireland and the UK.

Why managers own the human side of cyber risk

Most healthcare breaches are not exotic hacks. Verizon's analysis of healthcare cases found that the human element, such as a mistake, a misused login or someone tricked by a scam, was involved in 54% of breaches, and internal actors were behind 19% (Verizon Data Breach Investigations Report, Healthcare Snapshot, 2026).

Those are everyday behaviours, shaped by the person who runs the rota, signs off access and sets the tone on the floor. That is you. Board-level oversight is a separate job, covered in our guide to board cyber governance and audit committee oversight. Your part is operational.

Make sure your team completes awareness training

Training is usually assigned centrally, but completion happens at team level. In practice, your job is to:

• Check completion reports regularly and follow up gently with anyone overdue.
• Give protected time for training, not a module squeezed in at the end of a night shift.
• Build it into induction so new starters, bank staff and returners complete it early.
• Mention real examples at huddles, such as a suspicious email someone spotted that week.

For what good content covers, see our guide to cyber security awareness training for healthcare staff.

Joiners, movers and leavers: getting access right

Access control starts with a manager's request. The principle is least privilege: each person gets the access their role needs, and nothing more.

Watch out for shared logins. A generic account on the nurses' station PC, or staying logged in for a busy colleague, feels efficient. But nobody can then tell who viewed or changed a record, which weakens the audit trail that protects your staff if a complaint arises. If people share logins because signing in is too slow, raise that with IT as a workflow problem rather than tolerating the workaround.

Approving and reviewing access to patient systems

If you approve access to patient record systems, treat each approval as a small governance decision: does this person need this level of access for their actual duties? Review your team's access from time to time and remove anyone who has left or changed role. Remind staff that looking up records out of curiosity, whether a neighbour, a relative or a well-known patient, is a data protection breach even if nothing is shared.

Set a no-blame reporting culture

Once something goes wrong, speed matters most. A clicked link reported in five minutes is minor; the same click hidden for a week can become serious. Staff hide mistakes when they expect blame.

• Thank people who report, even when it turns out to be nothing.
• Make sure everyone knows exactly how to report, including out of hours.
• Treat honest mistakes differently from deliberate misuse, and say so openly.
• Share lessons learned without naming individuals.

Plan for downtime before you need it

When systems go down, the question is whether your team can keep caring for patients safely. After the 2021 ransomware attack on the Health Service Executive (HSE), the independent post-incident review found that services relying on paper records were best placed to keep delivering clinical care (PwC independent post-incident review for the HSE, 2021). Our piece on lessons from the HSE cyber attack goes into more detail.

A practical downtime plan for your area covers:

• Paper forms for admissions, observations, prescribing and referrals, kept where everyone can find them.
• A regularly printed list of current patients or residents, medicines and key contacts.
• Who decides to switch to downtime mode, and how records are back-entered afterwards.
• A short drill, even once a year, so new staff have seen the procedure.

Supplier and third-party access

Third parties were involved in 32% of healthcare breaches in Verizon's latest analysis (Verizon Data Breach Investigations Report, Healthcare Snapshot, 2026). Managers meet this risk directly, from an engineer plugging in a laptop to a vendor asking for remote access. You do not need to assess the supplier yourself, but you should know who is accessing your systems and why, route requests through IT and procurement, supervise on-site access, and tell IT when a contract ends.

What NIS2 means for management in health organisations

The EU's NIS2 Directive (Directive (EU) 2022/2555) lists healthcare providers among its "sectors of high criticality" and generally applies to organisations of medium size and above, so many small practices and care homes may fall outside it. Article 20 requires the management bodies of organisations in scope to approve the cyber security risk-management measures and oversee their implementation, and provides that they can be held liable for infringements. Members of management bodies must follow training, and organisations are encouraged to offer similar training to employees regularly. Article 21 lists the expected measures, including business continuity, supply chain security, basic cyber hygiene and training, and access control.

"Management body" generally means senior leadership rather than ward or practice managers. But the evidence those leaders rely on, from training records to access reviews and downtime drills, is produced by you.

Ireland: NIS2 is not yet in force in Irish law. The General Scheme of the National Cyber Security Bill was published on 30 August 2024, but the Bill had not been introduced to the Oireachtas as of October 2026, and the European Commission referred Ireland to the Court of Justice of the EU over the delay on 8 July 2026 (Law Society Gazette, 2026).

UK: NIS2 does not apply. The Cyber Security and Resilience (Network and Information Systems) Bill, introduced on 12 November 2025 (GOV.UK, 2025), had passed the House of Commons and was in its final House of Lords stages at the end of October 2026 (UK Parliament, 2026). It is not yet law.

This section is general information, not legal advice; check with your governance or legal team how the rules apply to you.

Frequently asked questions

Am I personally liable for a cyber incident in my team?

NIS2 liability is aimed at management bodies, usually senior leadership. As a line manager, you are more likely to be held to your organisation's own policies and data protection duties. Following those policies, and recording what you did, is your best protection.

What should I do on a locum's last day?

Check their account is set to end or ask IT to close it, collect any smartcard or device, and make sure no patient information has been saved outside approved systems.

How often should I review who has access?

Follow your organisation's policy if it sets a frequency. If not, a review whenever staff move or leave, plus a periodic check of your whole team list, catches most problems.

None of this needs a technical background, just clear processes, follow-through and a team that feels safe speaking up. To build that confidence, Learnsignal's healthcare compliance CPD courses offer practical, flexible learning for busy managers.