CYBER RISK MANAGEMENT IN THE BUSINESS STRATEGIES OF HEALTHCARE INSTITUTIONS AND COMPLIANCE WITH DIGITAL PATIENTS' RIGHTS: EU EXPERIENCE AND PROPOSALS FOR UKRAINE IN WARTIME

Abstract

The article examines the issues of cyber risk management in the business strategies of healthcare institutions operating in the European Union, in order to ensure the digital protection of patients and reduce potential negative economic losses. The relevance of the study stems from the rapid development of digital technologies in the healthcare sector and the increasing incidence of cyber threats that compromise the confidentiality of patient data, disrupt the operations of healthcare institutions and pose significant economic risks. The purpose of the article is to study the existing approaches to cyber risk management in the business strategies of healthcare institutions in order to reduce economic losses and ensure compliance with patients' digital rights, and on this basis to formulate proposals for improving the legislation of Ukraine and medical practice, taking into account the challenges of war. The research methods employed encompass the dialectical method, analysis and synthesis techniques to examine the interrelationships between cyber threats and patients' digital rights, statistical analysis to evaluate the prevalence of cyber threats within the European Union, modelling to formulate recommendations, and a comparative legal approach to identify common and distinct approaches in the European Union and Ukrainian legislation concerning the regulation of cyber security in healthcare facilities. The study's primary findings indicate that the most prevalent cyber threats within the digital healthcare sector encompass phishing attacks, malware, disruptions to artificial intelligence algorithms, and insider threats. The European Union has adopted contemporary methodologies in the realm of cyber security, underpinned by the principles of secure design of information systems and data protection in accordance with the rule of secure processing. At the same time, as proved in the article, it is necessary to improve the legislation of Ukraine, in particular by introducing provisions on the processing of medical data in accordance with the principles of the GDPR, strengthening the influence of international ISO standards on the business strategies of healthcare institutions for managing cyber risks and overcoming the consequences of their manifestation. A number of recommendations for Ukraine are proposed, namely ensuring cyber hygiene of medical personnel, integrating data encryption and cyber incident response plans, using artificial intelligence technologies to monitor risks, and adapting European experience to Ukrainian realities. The conclusions emphasise the necessity of implementing the most effective European practices in the realm of cyber risk management within the business strategy of medical institutions in Ukraine. This approach is expected to enhance the level of cyber security, mitigate the risks of violating patients' digital rights, and ensure the economic sustainability of healthcare facilities in the context of the ongoing war against Ukraine.