Products · Healthcare IT
Alexus for Healthcare IT
Hospitals and providers are essential entities under NIS2, where downtime is a patient-safety event, not just an SLA breach. Alexus keeps a living record of every system, change and incident, so compliance is a by-product of running safe clinical IT.
The health sector is an essential entity under NIS2 Annex I. Providers must demonstrate risk-management measures and report significant incidents, all while protecting patient data under GDPR. Alexus treats the audit trail and GDPR right-to-erasure as one data lineage, not two checklists.
Overlaps with GDPR and national health-data rules.
NIS2 for Healthcare IT, in three questions
Yes — healthcare is a high-criticality sector under NIS2 Annex I.
Essential entity · NIS2 Annex I (Health)
Providers from medium size up are in scope — Essential if large, Important if medium — and patient data stays in scope for GDPR in parallel.
NIS2 generally applies from medium-sized up — broadly 50+ staff, or annual turnover / balance-sheet total over €10M. (Medium is under 250 staff and up to €50M turnover or €43M balance sheet; larger than that is a “large” entity.) Some entities are in scope regardless of size, and the exact rules are set by your country’s transposition.
Register with your national competent authority once the transposing law applies.
Put the ten cybersecurity risk-management measures in place — and be able to show them working.
Report significant incidents: a 24-hour early warning, a 72-hour notification, and a final report within a month.
Your management body approves and oversees the measures — and can be held personally liable.
Scope is ultimately set by your national transposition — use the self-checks above, or ask us to confirm against your estate.
What makes NIS2 hard in Healthcare IT
Legacy clinical estate
Decades-old clinical systems, medical devices and integrations rarely share a single source of truth, so 'what do we run, and is it controlled?' is hard to answer.
Uptime is patient safety
An outage in EHR, imaging or lab systems has clinical consequences. Incidents must be triaged, resolved and evidenced under pressure.
NIS2 and GDPR at once
NIS2 security evidence and GDPR data-protection duties pull on the same systems. Doing them separately wastes scarce IT capacity.
The evidence layer, tuned for Healthcare IT
Live inventory of clinical systems
A continuously reconciled map of services, devices and dependencies, the asset hygiene NIS2 Article 21 expects, kept current rather than annual.
Article 23 incident reporting
Significant-incident reports assembled from the operational graph (affected systems, data in scope, controls in place), ready for you to review and submit.
NIS2 + GDPR in one trail
Audit entries, embeddings and graph nodes share one lineage, so right-to-erasure is a data flow and NIS2 evidence is a query.
Management accountability
Quarterly evidence the board and CISO can show a regulator, Article 20 due diligence without the fire drill.