Could cyber protection become mandatory in the care sector?

We live in an increasingly digital world, and in the care sector, it’s no different. Care organisations handle lots of sensitive information daily, so you need to have the right protection in place.

In 2023, the UK government introduced plans for all health and social care organisations to achieve strengthened cyber resilience by 2030.

At Everywhen, we know the importance of having the right protection. In this article, we look at cyber protection and what it could mean for your organisation if it does become a requirement for care organisations.

As we mentioned above, care organisations handle lots of valuable, sensitive data every day, including financial, medical, and personally identifiable information (PII). This makes them an attractive target for criminals. Phishing emails, stolen passwords and unsecure systems can all lead to hackers gaining access to your organisation’s data, and it can be difficult and costly to fix the damage they cause.

Artificial intelligence (AI) is bigger than ever before and is now widely used by the care sector to handle and process data. However, cyber criminals are beginning to use AI to their advantage too, by creating deepfake videos or voice notes to trick people in revealing their passwords.

The Cyber Security and Resilience Bill, introduced to Parliament in November 2025, will increase the UK defences against cyberattacks to public services, including healthcare.

Under the new bill:

Companies providing IT support to private and public sector organisations like the NHS will be regulated for the first time, meaning that they will need to meet certain security requirements

There will be tougher turnover-based penalties for serious breaches

Regulators will be given new powers to designate critical suppliers to the UK’s essential services such as those providing healthcare diagnostics to the NHS

Cyber insurance isn’t currently a legal requirement, but it can give you vital support if your care organisation faces a cybersecurity breach. If a breach happens and your organisation doesn’t have the right safeguards in place, you could face regulatory investigations, fines, legal action and reputational damage. Cyber insurance can’t replace compliance, but it can give you vital support when an incident occurs, helping you respond quickly and limit disruption.

Consider speaking to your insurance broker about cyber protection. They can help you explore available options to see what’s best suited to your care organisation. In the meantime, it’s best to make sure that your team is cyber-savvy. You could invest in extra training for your people so they know what red flags to look out for, as well as being aware of the possible consequences of a hacking incident.

If cyber protection does become mandatory, the market may become crowded with many options that aren’t fit for purpose. It’s important to work with a broker you trust to get the right policy for your business. At Everywhen, we can help you find the best solutions, with cover tailored especially for your organisation.

This information contained in this article is for general information purposes only. It does not constitute legal or other professional advice and cannot be relied upon as such. Should you have any queries, we recommend that you consult the appropriate professional adviser. The links provided in this document are for reference only. Please note that we are not responsible for the content of any linked site.