What is NIS2 and which companies does it affect?

NIS2 is the EU cybersecurity directive for entities in essential or important sectors. Applicability depends on sector, size and the exceptions in the directive and national transposition; legal scope should be confirmed before defining the technical plan.

What should I do if my company is hit by ransomware?

Isolate affected systems without destroying evidence, activate the response plan and contact specialists. If a personal-data breach is likely to risk people’s rights and freedoms, the controller must notify the authority without undue delay and, where feasible, within 72 hours of becoming aware. Response, recovery and reporting depend on the accepted scope.

How many backups does my company need? (the 3-2-1 rule)

The 3-2-1 rule proposes three copies, two media types and one off-site copy; immutability and restore testing can strengthen it. Architecture, frequency, retention, RPO and RTO must be agreed and validated for each system.

What is reviewed before scoping an IT project for healthcare and clinics?

We review HIS, RIS-PACS, laboratory, clinical endpoints, identity and connected medical devices, as well as locations, owners, dependencies, access and windows. Scope is confirmed from that evidence and the agreed priorities.

IT for healthcare in Spain and Portugal

For healthcare and clinics, legal review starts from clinical continuity, health-data protection and care-system integration. Legal or data-protection teams validate the basis, duties and deadlines for that context against official sources; technical work documents controls and evidence without replacing their interpretation.

How to prepare an IT decision for healthcare and clinics

Scope before catalogue

Inventory and dependencies before scope is defined.

A useful healthcare and clinics assessment starts with the process that must be protected, not a product list. The initial map links HIS, RIS-PACS, laboratory, clinical endpoints, identity and connected medical devices to owners, locations, dependencies and work windows, separating a real requirement from a technology preference that has not yet been validated.

The priority is to understand clinical continuity, health-data protection and care-system integration. Each assumption retains a source, date and owner; missing information is recorded as unknown instead of being turned into a promise about availability, recovery or compliance.

Scope distinguishes included work, third-party dependencies and decisions owned by the client. It also identifies access, approvals, building conditions and operational constraints before dates, price or service objectives are proposed.

Representative testing and controlled change

Validation with acceptance criteria and rollback.

Validation follows a real journey: clinical access, study exchange, restoration, contingency and permission revocation. Prerequisites, expected result, evidence, acceptance criteria and rollback are recorded so the test can be repeated without placing operations at unnecessary risk.

Where several sites or systems are involved, work begins with a representative sample. The next wave proceeds only after incidents, exceptions and capacity have been reviewed, avoiding replication of a design that works in one environment but fails in another.

Changes are coordinated with operations, security, quality and affected vendors. An approved window is not enough: prior state, decision owner, communications, post-change testing and a recovery path are all needed when the result is not accepted.

Evidence that supports operations

Evidence handed over to the accountable team.

Handover preserves processing inventory, owners, test results and continuity exceptions. Each item identifies version, period and owner so an audit, a later incident or a new vendor can reconstruct what was decided and what remains open.

Metrics are agreed around the objective: inventory coverage, measured availability, recurring incidents, backup success, observed timings or acceptance by location. An average must not hide a critical exception or missing data.

The operating model names who requests, approves, performs, validates and receives each task. Vendors, carriers and external applications are linked to an owner and escalation path without presenting their availability as an in-house capability.

Service hours, priorities, response objectives and escalation are agreed for each engagement after criticality and dependencies are reviewed; permanent availability is not assumed.

Typical challenges in healthcare

NIS2 applicability and duties are checked against current official rules based on activity, size, country and supply-chain role; legal or compliance owns the legal determination.
HIS, RIS-PACS, lab without integration: clinical history in one system, lab in another, billing in a third. Manual re-entry = errors.
Multi-site without central management: clinic networks with 5, 10, 30 centers where each runs IT differently. Impossible to audit.
Targeted ransomware: attackers know healthcare pays fast because lives are at stake. Healthcare tops ransomware victim rankings in Europe.

How we tackle it at Impulso

Healthcare cybersecurity with Sophos + Fortinet: endpoint protection on every PC and connected medical device, network segmentation between admin and clinical data, mandatory MFA, patch management in windows that don't interfere with operations.
On-site coverage is confirmed case by case: our own team is based in Madrid and, elsewhere in Spain and Portugal, a suitable local resource or nearest available partner is assigned after location, timing, scope and access are validated.
Operationalized GDPR + LOPDGDD: processing register per treatment type, clauses for external processors (lab, transcription), documented subject-rights procedures, impact assessments where applicable.
HIS-RIS-PACS-lab integration: HL7/FHIR middleware so systems talk without manual re-entry.

Iberian healthcare regulatory framework

ENS category, measures and certification needs are checked against the current framework and each procurement requirement. Technical assessment supplies evidence without replacing accountable-body judgement.
HL7 / FHIR: healthcare interoperability standard.
ISO 27001 + ISO 27799: healthcare-specific standards. Competitive differentiator with insurers and clinical trials.

Why Impulso for Iberian healthcare

Real healthcare experience: active clients in dentistry (12-clinic network), ophthalmology, podiatry, physiotherapy.
Vendors, licences, integrations and capabilities are validated during design; any certification or contractual requirement is confirmed before it enters a proposal.

Healthcare & Clinics