Healthcare

Compliance requirements for the healthcare sector.

---

Sector Profile

Attribute	Value
AI Act impact	CRITICAL (High-Risk)
NIS2 category	Essential (Annex I — Health)
GDPR impact	CRITICAL (Special category data)
Other regulations	Health Services Act, MDR

---

AI Act for Healthcare

High-Risk AI Systems (Annex III)

System	Classification	Obligations
Diagnostic AI	HIGH-RISK	Full obligations, CE marking
AI for patient triage	HIGH-RISK	DPIA, human oversight
Predictive analytics (prognosis)	HIGH-RISK	Testing, documentation
AI assistant for physicians	MEDIUM	Transparency
Administrative AI	LOW	Minimal

High-Risk AI in Healthcare — Requirements

High-Risk AI in healthcare — requirements

BEFORE DEPLOYMENT (Pre-deployment)

• CE marking (Medical Device Regulation)
• Clinical validation study
• DPIA + AI Impact Assessment
• Technical documentation
• Human oversight design

AFTER DEPLOYMENT (Post-deployment)

• Continuous monitoring
• Adverse event reporting
• Performance tracking
• Bias monitoring (demographic groups)
• Regular re-validation

TRANSPARENCY

• Patient must be informed about AI use
• Physician has the right to review AI recommendations
• Decision documentation

---

NIS2 for Healthcare

Scope

• Essential entity (Annex I, sector 5 — Health)
• Hospitals, laboratories, health insurers
• Medical device manufacturers (if >250 employees)

Specific Requirements

Area	Requirement	Priority
System availability	RTO <4h for critical systems	Critical
Patient data protection	Encryption + access control	Critical
Network segmentation	Medical devices isolated	Critical
Incident response	24h notification to national CSIRT	Critical
Supply chain	Audit medical device vendors	High
Business continuity	Paper backup procedures	High

Medical Device Cybersecurity

Network-connected medical devices

• Inventory of all connected devices
• Network segmentation (VLAN for medical)
• Patch management (coordination with vendor)
• Anomaly monitoring
• Incident response for device compromise

---

GDPR for Healthcare

Special Category Data (Art. 9)

Health data = special category — stricter rules apply

Legal basis	When to use
Explicit consent	Research, secondary use
Necessary for healthcare	Primary care, diagnostics
Public interest in health	Epidemiology, public health
Legal obligation	Reporting of infectious diseases

Specific GDPR Requirements

Area	Requirement	Status
Retention	Medical records min. 10 years	Legal obligation
Access control	Role-based, need-to-know	Required
Audit trail	Who accessed a patient record	Required
Patient portal	DSAR self-service recommended	Recommended
Cross-border	SCCs for transfer outside EU	If applicable

DSAR in Healthcare

DSAR in healthcare — patient rights

Patient has the right to:

• Copy of medical records (30 days)
• Information about who accessed the data
• Correction of inaccurate data
• Restriction of processing (not always possible)
• Portability (export in a standard format)

Exceptions:

• Protection of third-party rights
• Public health
• Research purposes (with limitations)

---

Checklist for Healthcare

Immediate (Weeks 1-2)

• Inventory of AI systems in clinical use
• Audit of connected medical devices
• GDPR data mapping for patient data

Short-term (Months 1-3)

• High-risk AI classification
• NIS2 scope confirmation
• Incident response plan for health data breach

Medium-term (Months 3-6)

• DPIA for diagnostic AI
• Medical device network segmentation
• Staff training (GDPR + AI)

Long-term (Months 6-12)

• ISO 27001 certification
• AI Act full compliance
• NIS2 full implementation

---

Typical Costs

Item	Estimate
ISMS + ISO 27001	EUR 50-80k
Medical device security audit	EUR 20-40k
AI compliance (per system)	EUR 15-30k
GDPR health data audit	EUR 15-25k
Staff training	EUR 10-20k
Total Y1	EUR 110-195k

---

Resources

• MDR (Medical Device Regulation)
• ENISA Healthcare Cybersecurity
• WHO AI Ethics Guidelines