Introducing the Critical Infrastructure Sectors: Healthcare

Why healthcare is part of critical infrastructure

The healthcare sector is one of the fundamental pillars of a functioning state. From the public’s perspective it is one of the most sensitive sectors because its services affect every person without exception. Every citizen becomes a direct user of healthcare services at some point in their life, and the availability—or unavailability—of those services immediately affects their life circumstances.

Healthcare is not perceived only as a system of public services, but as an area whose stability causes a high degree of sensitivity and natural concern among the population. Any disruption of its operation is reflected directly at the level of individuals, families, and entire communities.

Its role is to ensure the provision of medical care, protection of public health, availability of medicines and medical devices, and the uninterrupted functioning of health services.

Disruption or failure of healthcare components can have a direct impact on the life and health of the population, the operation of public administration, state security, and economic stability. Experience from emergencies, pandemics, cyber incidents, or energy supply outages has also confirmed that healthcare is among the sectors highly dependent on other critical infrastructure sectors.

For these reasons, the Act on Critical Infrastructure classifies healthcare among the critical infrastructure sectors of the Slovak Republic.

Central state authority

The central state authority for the healthcare sector is the Ministry of Health of the Slovak Republic.

Within its remit the Ministry ensures the fulfillment of tasks under the Act on Critical Infrastructure, particularly:

·       identification of critical infrastructure entities in the healthcare sector,

·       risk assessment and evaluation in the sector,

·       coordination of measures to increase the sector’s resilience,

·       supervision of the fulfillment of obligations by critical infrastructure entities,

·       cooperation with other state authorities and security forces,

·       addressing continuity of provision of essential services.

An important part of the Ministry’s role is also coordinating the sector’s preparedness for crisis situations, extraordinary events, and hybrid threats.

Subsectors, entities and essential services of the healthcare sector

The Act does not define subsectors within the healthcare sector.

Entities include:

•  healthcare providers pursuant to § 4 of Act No. 578/2004 Coll. on healthcare providers, healthcare professionals, professional organizations in healthcare, and on amendments to certain acts.
• EU reference laboratories under Article 15 of Regulation (EU) 2022/2371 on serious cross-border threats to health,
• entities conducting research and development of medicines pursuant to § 2(7) of Act No. 362/2011 Coll. on medicines and medical devices,
• entities manufacturing medical devices considered critical in a public health emergency pursuant to Article 22 of Regulation (EU) 2022/123,
• entities holding authorisation for the distribution of medicines pursuant to §§ 17 and 18 of Act No. 362/2011 Coll.

Which essential services do critical entities in healthcare provide:

1.     healthcare services,

2.     analyses performed by an EU reference laboratory,

3.     research and development of medicines,

4.     manufacturing of medical devices regarded as critical in a public health emergency,

5.     distribution of medicines.

Essential services cover, in particular, the following areas:

·       provision of inpatient (hospital) healthcare,

·       provision of outpatient healthcare,

·       emergency medicine and emergency medical services,

·       protection of public health,

·       laboratory diagnostics,

·       ensuring the availability of medicines and medical devices,

·       operation of healthcare information systems,

·       processing and exchange of medical data,

·       supplying healthcare facilities with critical commodities.

Entities that may be designated as critical infrastructure under the Act include, in particular:

·       hospitals,

·       providers of emergency medical care,

·       operators of healthcare information systems,

·       organizations ensuring distribution of medicines,

·       public health entities,

·       laboratories important for public health protection,

·       other entities whose activities are essential for ensuring the sector’s essential services.

The decisive criterion is not the size of the organization but the importance of the service provided and the impact its disruption would have on the population or the functioning of the state.

Specifics of the healthcare sector

The healthcare sector is one of those with high demands for continuous operation, staff availability, data protection, and technological reliability.

Healthcare facilities are also strongly dependent on:

·       electricity supply,

·       information and communication technologies,

·       availability of medical supplies,

·       logistics and transport services,

·       functioning of supply chains,

·       cybersecurity,

·       staff stability.

A particular feature of the sector is that service outages immediately affect the health status of specific people. This is not an abstract systemic risk but situations that can touch any individual directly and immediately.

Risks to the healthcare sector

The main risks to the sector include, in particular:

·       cyberattacks on hospitals and information systems,

·       power outages,

·       unavailability of communication systems,

·       disruption of supply chains,

·       shortages of healthcare personnel,

·       pandemic situations,

·       logistical constraints,

·       physical incidents and security threats,

·       technological failures,

·       dependence on external suppliers.

An increasing risk is the interconnection of systems and the high dependence of healthcare facilities on digital technologies. A cyber incident today can cause limitations in the provision of healthcare that directly affect patients in real time.

Role of Critical Infrastructure Association of the Slovak Republic

The Critical Infrastructure Association of the Slovak Republic has long been active in supporting critical infrastructure entities, providing professional training, exchanging experience, and building the resilience of individual sectors.

To entities in the healthcare sector and organisations operating in their supply chains it provides mainly:

• expert consultations in the field of critical infrastructure,
• support in implementing legislative requirements,
• professional training and education,
• assistance in risk analysis and vulnerability identification,
• support in preparing security documentation,
• consultations on business continuity and crisis management,
• support in increasing cyber resilience,
• a platform for exchanging experiences between sectors,
• connection of experts from the public and private sectors.

The importance of healthcare as a critical infrastructure sector will continue to grow in the coming years. It is an area where decisions about health and often lives are made in real time, which places extraordinary demands on the preparedness, coordination, and resilience of all involved entities.

Organizations interested in professional cooperation, consultations, or education in the field of critical infrastructure may contact the Critical Infrastructure Association of the Slovak Republic via its communication channels.