Japan's Health, Labor and Welfare Ministry is planning to significantly strengthen cybersecurity at hospitals, responding to a growing wave of cyberattacks targeting medical institutions. The ministry has included ¥13.7 billion (roughly ₹826 crore) in its fiscal 2027 budget request specifically to improve network security and deploy cybersecurity specialists across the country's healthcare system.
Why Hospital Cybersecurity Has Been a Struggle
Medical institutions have historically found it genuinely difficult to implement effective cybersecurity, largely because different medical devices often run on multiple IT vendors simultaneously. This can leave hospitals with a sprawling number of external network connections linking their internal systems to the outside world, connections that are hard to monitor consistently and even harder to isolate quickly if something goes wrong.
The ministry's plan aims to help hospitals consolidate these scattered external connection points, making networks considerably easier to monitor as a whole, and allowing systems to be isolated much faster if an attack actually occurs.
How the ₹826 Crore Will Be Spent
The proposed funding will support both hospital network protection measures and the deployment of dedicated cybersecurity specialists. This request forms part of the government's newly established investment framework aimed at making Japan "stronger and more prosperous," an initiative championed by Prime Minister Sanae Takaichi's Cabinet.
Hospitals will be encouraged to consolidate their external network connections, and they'll be able to outsource this work to private contractors, though subsidy limits will vary based on factors including how many beds a given hospital has.
The Attacks That Prompted This Response
Japanese medical institutions have repeatedly been targeted by ransomware attacks in recent years. In 2022, an attack on Osaka General Medical Center caused its electronic record system to malfunction, forcing the facility to restrict both surgeries and outpatient care, a stark illustration of how a cyberattack on hospital infrastructure can translate directly into disrupted patient care.
More recently, in February, the personal information of around 130,000 patients was leaked following a cyberattack on Nippon Medical School Musashikosugi Hospital in Kawasaki, underscoring that these risks extend well beyond operational disruption into serious patient privacy breaches too.
Bringing in Specialists When It Matters Most
The ministry plans to support the dispatch of cybersecurity experts to hospitals specifically when an attack actually occurs. Since most medical institutions genuinely struggle to employ this kind of specialist permanently, the ministry intends to encourage the use of professionals registered with the Information-technology Promotion Agency, Japan (IPA), matching them with individual hospitals whenever their specific expertise is needed rather than requiring every hospital to maintain that capability in-house.
Training for Hospital Staff Too
Beyond bringing in outside specialists, the ministry will also subsidise the cost of training hospital staff directly as part of these broader cybersecurity measures. The overall approach is designed to strengthen hospitals' own ability to respond to cyber incidents on the ground, while still ensuring access to specialist expertise whenever an attack genuinely exceeds what internal staff can handle alone.
Why Healthcare Is Now Treated as Critical Infrastructure
Japan's amended law on promoting economic security measures has formally added healthcare to the country's list of critical infrastructure sectors. This reclassification has raised the stakes for protecting medical institutions and their systems, and reflects the government's broader push to strengthen cybersecurity across the healthcare sector as a whole, rather than treating hospital security as a purely individual-institution responsibility.
Which Hospitals Will Get This Support
Hospitals covered under the law are expected to be selected from among 88 advanced treatment hospitals with 400 or more beds. The ministry plans to assign specialist cybersecurity personnel to these facilities, with around 20 hospitals expected to undergo inspections under the fiscal 2027 budget as the programme's initial rollout.
FAQs
Q1. How much is Japan allocating for hospital cybersecurity in fiscal 2027?
¥13.7 billion, roughly ₹826 crore, aimed at improving network security and deploying cybersecurity specialists.
Q2. What cyberattacks have prompted this response?
A 2022 ransomware attack on Osaka General Medical Center that disrupted surgeries and outpatient care, and a February attack on Nippon Medical School Musashikosugi Hospital that leaked personal data of around 130,000 patients.
Q3. Which hospitals will receive this new support?
Hospitals will be selected from among 88 advanced treatment facilities with 400 or more beds, with around 20 expected to undergo inspections under the fiscal 2027 budget.
Q4. Why has healthcare been reclassified as critical infrastructure in Japan?
Under Japan's amended law on promoting economic security measures, healthcare was formally added to the list of critical infrastructure sectors, reflecting the growing importance of protecting medical systems from cyberattacks.