Skip to content

NIS2 for medical practices in Belgium

DeepIT, based in Brussels, helps medical practices, dental practices and community health centres find out whether NIS2 applies to them, then put in place the security measures they are asked for: by the law, by a partner hospital or by an insurer. We work with the framework published by the Centre for Cybersecurity Belgium (CCB).

To be clear: we are not a certification body and we do not award any label. We prepare your practice; when an official assessment is required, it is carried out by an accredited body.

Illustration: NIS2 for medical practices

Is my practice covered by NIS2?

The Belgian NIS2 law (law of 26 April 2024, in force since 18 October 2024) covers healthcare, but only above a certain size: at least 50 full-time employees, or an annual turnover and a balance sheet total that both exceed 10 million euros. Most practices are below that. They can still be affected in three ways:

  • your practice belongs to a group that exceeds these thresholds: the group's figures are added up;
  • the CCB designates you, whatever your size, for example if an outage at your practice would affect public health;
  • a client or partner subject to NIS2, such as a hospital, imposes measures on you through a contract.

Even outside the scope

A practice that is not covered by the law is well advised to apply the same basic measures: they protect patient records, and they are what hospitals, laboratories and insurers increasingly ask for.

What NIS2 requires in practice

Whether the law covers you or a partner asks for it, the substance is the same: know what you protect, close the most common ways in, be able to recover after an incident, and report it.

Illustration: responding to and reporting an incident

Know what you have

A list of the practice's computers, accounts and software, and who has access to what, in particular to patient records.

Protect access

One account per person, a confirmation code on the phone on top of the password, and access closed on the day someone leaves the practice.

Protect computers

Protection on every computer, monitored, with updates tracked machine by machine, including the reception PC.

Respond and report

An organisation covered by NIS2 must report a significant incident to the CCB: an early warning within 24 hours, a notification within 72 hours and a final report no later than one month after. We help you recognise an incident, deal with it and prepare that report (official CCB page).

Note that this is a second channel: a leak of patient data must also be reported to the Data Protection Authority within 72 hours (GDPR, article 33). One report does not replace the other.

Train the team

The fake email remains the main way in. A few simple rules for reception and clinicians are worth more than one more piece of software. The law also requires management to be trained.

The Belgian framework: CyberFundamentals

The CCB publishes a reference framework, CyberFundamentals, with three levels: Basic, Important and Essential. For an organisation covered by NIS2 it is a recognised way to show compliance. For a small practice it is above all a clear list of what to do, in order.

Verification or certification of a level is carried out by an accredited body, not by us. How it works: CyberFundamentals: how can your SME prove it complies with NIS2?

How we work with you

  • Scope: we take the CCB test with you, using the figures of your practice or group.
  • Review: your computers, accounts, network and backups, compared with the expected measures.
  • A written plan: what is missing, urgent items first, who does what.
  • Putting the measures in place, without stopping consultations.
  • Follow-up: the measures stay in place over time, and you can answer a hospital, an insurer or the CCB.

Who is responsible?

The law places responsibility on management: management approves the measures. We do the technical work and give you what you need to follow up and decide. If we already look after your practice, these measures are part of our cybersecurity service.

What we do not do

We do not certify, we do not award any label and we do not replace legal advice: the decision to register with the CCB or not remains yours, with your adviser if needed. We do not promise that no incident will ever happen: we reduce the risk and prepare the response. And we do not touch the medical software: we work with its vendor.

A real case (anonymised): what NIS2 aims to prevent

In a healthcare practice we look after, it all started with a fake invoice received by email. A few weeks later came an attempted fraud. Analysing the machines, we found spyware on a server: it was removed, every machine was checked and monitoring was stepped up at our other clients. That is exactly what NIS2 measures aim to prevent: an ordinary way in, spotted because someone was reading the traces. The case is told on our cybersecurity page.

Frequently asked questions

How do I bring a medical practice in Belgium into line with NIS2?

In four steps: check whether the practice is covered (the CCB's free test), review its security, fix the weak points in the order that matters, then keep the measures in place over time and be able to show it. The basic measures are the same whether the law covers you or a partner asks for them.

Who can help me in Brussels?

DeepIT, in Brussels, supports medical and dental practices from the initial review to ongoing follow-up, using the references published by the CCB. An official CyberFundamentals assessment also requires an accredited body, which we are not.

Does a small practice have to register with the CCB?

Only if it is covered by the law, through its size, its group or a designation by the CCB. The CCB's free test tells you. A practice outside the scope does not have to register, but it may have to meet measures required by its partners.

A hospital asks us to prove our security. What should we do?

Ask in writing for the expected level and the evidence they accept, then review your security before you answer. What it means to be the supplier or partner of an organisation subject to NIS2: our article.

Does NIS2 replace the GDPR?

No. The GDPR protects personal data, including health data; NIS2 is about the security of systems and continuity of service. They add up, and many measures serve both.

How we start

  • A free audit of your computers, network, backups and security
  • The NIS2 scope test, done together
  • A written plan, then implementation and day-to-day follow-up
Book your free audit→Contact us→

The practice's IT, beyond NIS2

Medical software, imaging, phones, reception computers: see medical IT, dental practices and community health centres. Official sources: Centre for Cybersecurity Belgium and Safeonweb@Work.

Read also