The health ministry plans a sharp expansion of cybersecurity support for medical institutions in fiscal 2027, requesting ¥13.7 billion for the work against ¥100 million in the initial fiscal 2026 budget.
Ransomware attacks have hit hospitals as well as private companies such as GMO Internet Group, and the ministry judged that stronger defenses are essential to keeping medical care running. When a hospital is hit, electronic medical records can become unusable and treatment can be affected for a long period.
Weak points at the network edge
Surveys by the ministry and others found that many hospitals have numerous connection points to outside networks — maintenance VPN devices — that are hard to manage and monitor. The surveys also found that hospitals often have no cybersecurity specialists on staff.
At Nippon Medical School Musashi Kosugi Hospital in Kawasaki, Kanagawa Prefecture, a leak of personal information on about 130,000 patients and staff was confirmed in February. The ransomware attack on the hospital came in through a connection point where a vulnerability had been left unaddressed, the ministry said.
What the money would pay for
The fiscal 2027 program would support hospitals on staffing, organization and systems. It covers consolidating outside connection points to make them easier to manage and monitor, and using a list compiled by the Information-technology Promotion Agency (IPA) to bring in specialist staff.
The ministry also plans to help hospitals with their initial response when a cybersecurity incident occurs.