In healthcare, cybersecurity is patient safety

Abdulrahman Al Nazari · Director of Cybersecurity & Information Protection · November 2026

When people think about hospital safety, they picture sterile theatres, correct dosages and trained clinicians. Increasingly, they should also picture an unpatched server, a phished password or a ransomware note on a nurse's screen.

Healthcare is one of the most targeted sectors in the world for a simple reason: its data is valuable and its operations cannot stop. A bank can pause transactions for an hour. An emergency department cannot pause patients.

After nearly three decades in Dubai's government and healthcare technology, I have learned that the most important shift is in language. When we describe cyber risk only in technical terms, it stays in the IT department. When we describe it as patient safety, it reaches the boardroom, the medical director and the ward.

Three principles guide how I approach this:

1. Resilience before perfection. No organisation can prevent every attack. What matters is how quickly clinical services continue safely when something goes wrong: tested backups, downtime procedures that clinicians actually rehearse, and clear decision rights during an incident.
2. The ecosystem is the perimeter. Hospitals, clinics, laboratories, pharmacies and technology suppliers are connected. The weakest link anywhere becomes everyone's problem, so sector-wide standards and shared threat intelligence matter as much as any single organisation's controls.
3. People are the strongest control, when we invest in them. Awareness that is practical, short and relevant to clinical work changes behaviour far more than annual slide decks.

Cybersecurity in healthcare is not a technology project. It is part of the promise every health system makes to its patients: we will keep you safe.