Compliant with § 30 paragraph 2 no. 7 and § 38 paragraph 3 BSIG
Security Awareness Training for Healthcare
Cybersecurity training for hospitals, clinics, medical care centers, care facilities, pharma, and medtech — one annual core course plus three spotlights per year, with audit-ready documentation in line with NIS2 and Section 38 of the BSI Act.
OUR PROGRAM
Annual core course plus three spotlights.
Two learning formats, one consistently built security culture: a compact core course covering the four most important topics for all employees and new hires. Plus three spotlights per year on current threats, which in the quarters without the core course refresh and expand what has been learned.
Core course · annually · ~20 min
Mandatory for all employees and new hires.
SPOTLIGHTS · 3× YEARLY · 1–2 MIN
Refresher on current threats.
SPOTLIGHT 01
2 min.
Don't Pay the Price
Ransomware
How ransomware works and why healthcare is target No. 1. Spread through phishing, tampered downloads, and infected USB drives. Download safely from official sources. In an emergency: unplug the network cable, do not restart, call IT.
SPOTLIGHT 02
1.5 min.
Stay Safe Anywhere
Wi-Fi & Remote Work
Risks of public Wi-Fi networks — fake hotspots, data interception. Never enter patient data on public networks. VPN required for remote work. Maintain screen privacy on trains and in cafés. Secure your home router with a strong password.
SPOTLIGHT 03
1.5 min.
"Pocket Risks"
Mobile Security
Work apps on personal devices: keep them up to date, use a strong PIN. Risk of public charging (juice jacking). Report a lost device immediately — remote wipe is possible. Keep app permissions to a minimum. No photos of patient data.
SPOTLIGHT 04
2 min.
"Trust But Verify"
Social Engineering
Pretexting: fabricated scenarios to get information. Baiting: too-good-to-be-true offers, found USB sticks. Abuse of authority: “I’m from IT, I need your password.” Artificial urgency. Always verify through official channels.
SPOTLIGHT 05
1.5 min.
Beyond the Screen
Physical Security
Badge control: do not let strangers through security doors. Escort visitors without badges to reception. Avoid shoulder surfing — shield your PIN, turn the monitor away. Pick up printouts immediately. Always lock your workstation, even if only for a short time.
SPOTLIGHT 06
1.5 min.
"Keep It Current"
Software updates
Why updates are important: They close security gaps. Know the difference between real and fake update pop-ups. Don’t put off updates when IT asks you to install them. Only install from official sources. Report suspicious update requests.
WHO IS IT SUITABLE FOR
For every healthcare facility.
Our curriculum is tailored to healthcare facilities — not generic office environments. Examples and scenarios come from everyday clinical practice, not from finance departments.
Hospitals
Awareness training for nursing staff, medical staff, administration, and IT — compact modules that fit into shift work and everyday ward routines. NIS2 audit-ready documentation.
Medical care centers & practice networks
Standardized training across all locations — centralized reporting, a compact format with no shift downtime in practice. NIS2 audit-ready documentation.
Private clinics
Compact, practical curriculum — quick to implement, low administrative overhead, NIS2 audit-ready.
Pharma & MedTech
Awareness training for pharmaceutical and medtech workforces — with a focus on threats to IP protection, supply chains, and sensitive clinical study and patient data. NIS2-audit-ready evidence.
Care facilities
Adapted to high staff turnover and mobile work devices. Compact format with no downtime, NIS2-audit-ready proof.
Health Tech
Awareness training for Health Tech teams across Engineering, Customer Success, and Support. Phishing resilience, secure handling of customer data, and NIS2 audit-ready documentation.
OUR APPROACH
Training that employees actually do.
The biggest reason awareness programs fail isn’t bad content — it’s length. Mandatory 60-minute courses get clicked through, not learned from. Our approach flips that.
Microlearning instead of a mandatory lesson
Core course about 20 minutes, spotlights 1 to 2 minutes — deliberately kept short. Accessible at your desk, on the go, or during a break. Those who click learn — not those who survive.
Healthcare in Focus
Example scenarios include HIS logins, lab results, shift schedule emails, and privacy at reception. No generic office examples that nobody would recognize in everyday clinical work.
Measurable instead of just checked off
Participation rates, completion rates, maturity level by department. Presented in the report, ready for NIS2 audits. You can see where learning is happening — and where it isn’t yet.
These are the questions we regularly hear from managing directors, IT managers, and data protection officers in healthcare. Clarify additional questions directly in the free risk assessment.