Clinic cybersecurity: protecting patient data without blocking care

A clinic protects itself through four priorities, in this order: being able to restart after an attack, closing access, securing endpoints and staff, and making sure patients can always reach reception. Everything else, including compliance with Morocco’s Law 09-08, follows from these four workstreams. A clinic cannot stop, and that is exactly why attackers target it: when the electronic patient record and imaging are encrypted, the pressure to pay is maximal. This guide is for facility directors, doctors running a practice and IT managers in healthcare, in Morocco and elsewhere.

What is at stake in a healthcare facility

A clinic’s IT does not look like an office’s. It brings together very different systems, all with a direct impact on patient care:

• The electronic patient record: history, reports, prescriptions. This is health data, among the most sensitive under Law 09-08.
• Imaging: the modalities (X-ray, ultrasound, CT) and the PACS that stores and distributes images.
• The laboratory and its analysers, often linked to the patient record.
• Billing, insurance agreements and scheduling for consultations and operating theatres.
• The phone system for reception and emergencies.
• Connected biomedical equipment, often old and shipped with a system that cannot be updated.

An outage on any of these does not mean an administrative delay but patients waiting, examinations postponed and clinical teams going back to paper. That is why we treat every healthcare facility as a critical site, as explained on our healthcare and clinics page.

Priority 1: being able to restart

The first question is not “how do we prevent the attack?” but “how do we restart if it succeeds?”. No protection is foolproof; a well-built backup is the only real insurance.

• Immutable off-site backups of the patient record, imaging and servers: a copy that neither ransomware nor a stolen admin account can delete or encrypt. The 3-2-1 rule remains the reference, detailed in 3-2-1 immutable backup.
• A timed quarterly restore test: you actually restore a server and a sample of records, and note how long it takes. A backup that has never been tested is only an assumption.
• A written recovery plan with the restart order: identity and directory, network and firewall, patient record, imaging, then billing. The plan also sets how clinical staff work in degraded mode during recovery. Our method is described in disaster recovery plan.

Imaging deserves special attention: volumes are large, and restoring a whole PACS takes time. Recent studies, restored first, should be distinguished from the archive, which can follow.

Priority 2: closing the doors

Most intrusions come through a poorly protected remote access or a flat network where everything talks to everything.

• MFA for every remote access: doctors checking records from home, software vendors doing maintenance, management on the road. A password alone is no longer enough. See our MFA rollout guide.
• Controlled vendor access: one named account per engineer, opened on request and closed after the intervention, rather than a permanent access left open “for maintenance”.
• Network segmentation: administrative, medical, imaging, biomedical equipment, telephony and patient WiFi are separated. If a reception PC is compromised, the attack does not reach the PACS.
• A next-generation firewall with filtering, intrusion prevention and retained logs. We deploy Fortinet appliances in particular, sized on real throughput with inspection enabled.

Network zone	Contents	Access rule
Administrative	Reception, billing, management	Filtered internet, limited access to patient record
Medical	Consultation PCs, patient record	No access to biomedical devices except required flows
Imaging	Modalities, PACS, consoles	Flows limited to the PACS and reading stations
Biomedical	Legacy devices, analysers	Isolated, no internet, controlled maintenance
Telephony	IP handsets, phone system	QoS priority, isolated from workstations
Patient WiFi	Guest access	Internet only, no internal access

Priority 3: endpoints and people

A reception PC shared by several people and left open all day in a public area is an ideal target.

• EDR on every workstation and server: it detects suspicious behaviour, not just known viruses, and can isolate a machine remotely. The difference is explained in EDR vs antivirus.
• Removal of admin rights on user workstations.
• Automatic session locking in shared areas, and screens angled so they cannot be read from the waiting room.
• Short, regular awareness for reception and admin staff, the first phishing target: fake invoices, fake suppliers, fake messages from a software vendor.
• Managed updates: systems, browsers and business software, with a defined window so consultations are not disrupted.

Priority 4: telephony

The phone system is part of continuity. An IP phone system with 4G backup, or hosted off-site, ensures patients can reach the clinic even if the local network is down, and that reception and emergency call queues keep working. We deploy 3CX and Yeastar depending on the facility’s size and needs.

Compliance as a result, not a goal

Health data is sensitive data under Law 09-08. Declaring processing to the CNDP or obtaining its authorisation, binding the vendors and providers who access it by contract, setting retention periods, tracing access to patient records: these obligations are largely covered by the measures above, provided they are documented. For details, see Morocco’s data protection law 09-08.

The most common mistakes

1. Backup to a disk permanently attached to the server: ransomware encrypts it along with everything else.
2. Permanent remote access left to a vendor, with a shared password never changed.
3. A flat network: workstations, imaging, biomedical devices and patient WiFi on the same network.
4. A generic reception account used by the whole team: no way to know who opened which record.
5. No restore test: on the day of the incident you discover the imaging backup has been failing for months.
6. Telephony depending on a single link: one internet outage and reception becomes unreachable.
7. No paper procedure to keep receiving patients during an outage.

Clinic checklist

• Immutable off-site backups of the patient record, imaging and servers.
• Last restore test dated, with the time measured.
• Written recovery plan, with restart order and degraded mode.
• MFA enabled for all remote access, vendors included.
• Segmented network, biomedical devices isolated.
• EDR on all workstations and servers, admin rights removed.
• Named accounts, sessions locked automatically.
• Telephony with a tested backup path.
• Processing register and provider contracts up to date.

How we do it

We start with an audit: inventory of systems, flows between them, remote access and the real state of backups. We then prioritise actions by their impact on continuity of care, scheduling changes outside consultation hours. Once the facility is secured, our team provides 24/7 monitoring, handles critical incidents in under 15 minutes and runs regular restore tests, as part of our cybersecurity service. Backups rely on proven solutions such as Veeam. Our work in the sector is presented, without client names, in our case studies, and anti-ransomware measures in ransomware: 7 measures for SMBs.

Is your clinic or practice ready to restart after an attack? The initial audit is free: contact us, we reply within 24 business hours.