Cyber Security and Patient Safety in the NHS

The Cyber Security and Business Resilience Policy Centre (CSBR) recently brought together experts and stakeholders for a virtual policy discussion exploring an increasingly important question for the NHS: how should cyber security be understood and managed as a patient safety issue?

The discussion, led by James Morris, CEO of CSBR, alongside Dr Saif F Abed, Founding Partner and Director of Cybersecurity Advisory Services at The AbedGraham Group, built on the findings of CSBR’s earlier executive roundtable and examined the practical and policy challenges facing an increasingly digital NHS.

Throughout the event, one message emerged particularly strongly: cyber security can no longer be treated solely as a technical or back-office IT concern. As the NHS becomes increasingly reliant on digital systems, cloud infrastructure, AI and proposals such as the Single Patient Record, cyber resilience is becoming inseparable from clinical governance, continuity of care and patient safety.

Cyber security as a patient safety issue

Opening the discussion, James outlined several strategic priorities emerging from CSBR’s work in this area. These included measuring cyber-related harm and disruption alongside other clinical risks, improving system-wide resilience, strengthening assurance and accountability, and taking an ecosystem-wide approach that recognises the NHS’s dependence on suppliers, managed service providers and other third parties.

The discussion also highlighted the uneven levels of cyber maturity across the health and care system. Smaller trusts, primary care and social care can have very different levels of capability and preparedness, while disruption to digital systems can directly affect services such as diagnostics, pathology and emergency care.

James outlined a series of potential policy directions, including establishing cyber security more clearly as a patient safety duty, strengthening central assurance, conducting regular cyber simulation exercises, connecting clinical safety and cyber resilience through standards such as DCB0129, embedding resilience into the development of the Single Patient Record and strengthening accountability at board and senior leadership level.

Closing the gap between digital maturity and risk maturity

Dr Saif Abed developed this argument further, warning of a gap between the pace of digital transformation and the maturity of the systems used to manage the accompanying risks.

As the NHS adopts more electronic health records, AI-enabled technologies and interconnected digital workflows, he argued that investment in risk management, clinical safety and cyber security needs to develop at the same pace.

Particular attention was given to the NHS supply chain. The discussion considered the responsibilities of technology vendors and other suppliers, the enforcement of existing clinical safety and cyber security requirements, and the growing dependencies created as healthcare becomes more digitally interconnected.

Crucially, cyber incidents were discussed not simply in terms of unavailable computers or lost data, but in terms of their potential consequences for healthcare delivery. Disruption can result in diverted ambulances, cancelled operations and delays to time-sensitive treatment, illustrating why the impact of cyber incidents needs to be considered through a clinical as well as technical lens.

Regulation, standards and accountability

The fireside discussion between James and Dr Abed explored how this shift could work in practice.

One area considered was whether existing frameworks could be better connected rather than continually creating new requirements. Dr Abed highlighted the potential for clinical safety standards such as DCB0129 and DCB0160 to work more closely alongside cyber security frameworks, helping make cyber risk an explicit part of clinical safety throughout the lifecycle of digital technology.

The discussion also explored how regulation could account for the diversity of the NHS ecosystem. A small social care provider cannot necessarily be treated in exactly the same way as a major teaching hospital, highlighting the importance of proportionate requirements alongside education, support and meaningful enforcement.

Leadership was another recurring theme. Participants considered how responsibility for cyber resilience needs to extend beyond IT and security teams and become embedded within senior leadership, procurement and organisational governance.

The Single Patient Record and AI

The proposed Single Patient Record provided an important example of the balance between digital opportunity and cyber risk.

The discussion recognised the potential clinical and productivity benefits of improved access to patient information, while also considering the concentration

of risk created by greater dependence on interconnected national infrastructure. Dr Abed argued that security and resilience therefore need to be considered from the beginning of such programmes rather than added later.

AI prompted a similarly balanced discussion. Dr Abed described himself as a strong believer in AI’s potential to improve workflows, clinical outcomes and quality of care, while raising concerns about governance, regulatory clarity and the pace at which AI capabilities are entering healthcare environments.

The wider discussion therefore returned repeatedly to the same principle: digital innovation and cyber resilience should develop together.

Moving from discussion to action

Contributions from attendees reinforced the need to translate these principles into practical policy.

Participants raised concerns about vulnerabilities within the wider supply chain and the need to establish a clearer baseline of cyber maturity. The discussion included examples of fundamental security weaknesses such as accounts without multi-factor authentication and inadequately protected assets, with contributors arguing that cyber resilience needs greater prominence within board-level decision-making.

The conversation also moved towards what should happen next. One contribution emphasised the importance of developing clear policy asks that could be taken forward through Parliament, committees and ministerial engagement. This included finding better ways of measuring cyber-related patient harm — moving beyond simply recording the number of attacks towards understanding what those incidents actually mean for patients and continuity of care.

That distinction is important. Measuring whether an organisation has experienced a cyber incident tells only part of the story. Understanding whether that incident delayed treatment, disrupted diagnostics, diverted emergency services or otherwise affected patient outcomes provides a much clearer picture of cyber risk in a healthcare setting.

What comes next?

The discussion demonstrated that cyber security, patient safety and digital transformation cannot be considered in isolation.

The NHS will continue to digitise. AI, interconnected records, cloud infrastructure and digital services all offer significant opportunities to improve healthcare. The challenge is ensuring that the resilience, governance and accountability surrounding those technologies develop alongside them.

The policy conversation must therefore increasingly focus not simply on whether NHS organisations are technically compliant, but whether healthcare services are secure, resilient and recoverable when disruption occurs.

For CSBR, the event builds on the work of the earlier executive roundtable and provides a foundation for developing more detailed policy proposals around cyber-related patient harm, clinical safety standards, regulatory enforcement, leadership accountability and resilience across the NHS and its wider supply chain.

Most importantly, the discussion reinforced a simple principle at the heart of this work:

Cyber security in healthcare is about protecting systems, but ultimately it is about protecting patients.