Detailed description of project  

HEALTH-ER directly addresses the objectives of the DIGITAL-ECCC-2025-DEPLOY-CYBER-08 call, introducing a paradigm shift in healthcare cybersecurity, which is moving beyond traditional, IT-centric security models that are insufficient for the clinical environment. The project will deliver an innovative cybersecurity framework leveraging AI-based tools and services to protect EU hospitals and healthcare providers and provide enhanced preparedness and cyber resilience as well as increased training and awareness. The framework will include an AI-driven Security Operations Centre-as-a-Service (SOCaaS) orchestrating multiple AIbased components and connected with a large set of preparedness and assessment services. The framework is meticulously designed to elevate resilience across the full spectrum of European hospitals and healthcare providers and will transform reactive cybersecurity into a proactive, intelligent, and context-sensitive resilience strategy. The HEALTH-ER consortium consists of thirteen (13) organizations, from seven (7) Member States and will be coordinated by OSI, a partner with significant expertise in cybersecurity  

Type and scope of work provided  

HEALTH-ER delivers an innovative cybersecurity framework designed to transform EU healthcare from reactive IT security to proactive, AI-driven resilience. The scope spans the entire cybersecurity lifecycle—Prevent, Detect, Respond, and Recover—tailored specifically for the clinical environment.  

Core Activities:  

• Assessment & Planning: Establishing a digital maturity baseline across EU hospitals to map common needs and design technical implementation roadmaps aligned with the NIS2 Directive and EU AI Act.  

• AI-Driven Orchestration: Developing an AI-based Security Operations Centre-as-a-Service (SOCaaS) to orchestrate multiple security components, making elite-level protection accessible to both large hospitals and small clinics.  

• Validation & Resilience: Executing pilot implementations, penetration testing, and business continuity drills to ensure uninterrupted healthcare services during cyber incidents.  

• Data & Ethical Governance: Implementing privacy-by-design and decentralized AI training to protect sensitive data, while ensuring human oversight and accountability.  

• Capacity Building: Providing specialized training and awareness workshops to improve “cyber hygiene” and prepare the healthcare workforce for evolving threats.