Cybersecurity for nursing teams protects the availability, integrity, and confidentiality of the information and technology used in care. An incident can affect patient records, communication, connected equipment, or access to essential systems. Nursing involvement is therefore part of operational safety as well as information protection.
HHS's Health Industry Cybersecurity Practices describes threats including social engineering, ransomware, lost equipment, insider data loss, and attacks against connected medical devices. Nurses do not need to become security investigators to help recognize and report problems.
Make secure work practical
Use the organization's approved accounts, devices, and communication tools. Keep individual access credentials private and use required authentication. Lock or sign out of workstations according to policy when leaving them unattended.
The SAFER system-management guide recommends technical and physical controls that restrict access to patient information and system settings. It also addresses software currency and protection of devices. Those controls require organizational support; a nurse cannot repair an unsafe configuration simply by being more careful.
When a security measure obstructs a necessary care task, report the problem and request an approved solution. Shared passwords, unauthorized apps, or unofficial copies of patient information can create additional risks while hiding the original workflow issue.
Recognize the event and protect care
Examples of concerns include an unexpected request for credentials, a device that behaves unusually, missing equipment containing work information, or a system that becomes unavailable. Follow the local incident-reporting process promptly. State what happened and what information or care function may be affected.
Do not independently investigate by opening suspicious files, connecting unknown storage devices, or changing clinical equipment settings. Security and clinical engineering teams need to guide technical containment in coordination with clinical leadership.
Illustrative interruption
During an illustrative shift, several workstations display an unexpected message and the EHR becomes inaccessible. The charge nurse uses the established downtime communication and care procedures while the technical team investigates. Staff preserve essential patient information using approved methods and receive clear instructions about when routine electronic work can resume.
The example does not assume that every outage is a cyberattack. It shows why the response must support patient care while the cause is being established.
Prepare together
Nursing orientation should identify how to report a suspected incident, where downtime instructions are stored, and whom to contact outside routine hours. The SAFER contingency guide recommends communications independent of the EHR infrastructure and staff training in downtime and recovery.
Practice scenarios that connect security events to actual nursing tasks, such as receiving a result or administering a scheduled medication during downtime. Review what information staff need without exposing real patient data in training.
Reporting a concern early gives the organization a chance to limit its effects; waiting for certainty can leave both information and care processes exposed.
If a system becomes unavailable, follow the organization’s response plan and downtime procedures.
Related
Phishing in Healthcare Workplaces
EHR Downtime Planning for Nurses
Sources
-
HHS: Health Industry Cybersecurity Practices (accessed 2026-09-17).
-
SAFER: System Management (accessed 2026-09-17).
-
SAFER: Contingency Planning (accessed 2026-09-17).