September 8, 2026
TOKYO – The Health, Labor and Welfare Ministry is set to strengthen cybersecurity measures at hospitals to counter a surging number of cyberattacks on medical institutions.
The ministry has included ¥13.7 billion in its budget request for fiscal 2027 to implement the measures for protecting networks and deploying cybersecurity specialists. The request will be included in the government’s newly established investment framework for making Japan “stronger and more prosperous,” championed by Prime Minister Sanae Takaichi’s Cabinet.
Medical institutions have faced challenges when implementing effective cybersecurity measures as there are multiple IT vendors for different medical devices. This means that facilities have to maintain numerous network connections linking their systems to the outside world.
To address this, the ministry will provide subsidies to hospitals that consolidate their external connection points, simplifying monitoring and allowing for systems to be isolated faster in the event of an attack. Hospitals will outsource the work to private contractors, but the ministry will implement limits on subsidy amounts based on the number of beds they have available.
In recent years, medical institutions have frequently been targeted by cyberattacks involving ransomware. An attack on Osaka General Medical Center in 2022 caused an electronic record system to malfunction, forcing the facility to restrict surgeries and outpatient care. In February, the personal information of about 130,000 patients was leaked following a cyberattack on Nippon Medical School Musashikosugi Hospital in Kawasaki.
The ministry will also provide support for dispatching cybersecurity experts in the event of a cyberattack. It is usually difficult for medical institutions to secure such specialists on their own, so the ministry will encourage the use of a list of professionals registered with the Innovation Platform Agency, Japan (IPA) and match them with individual hospitals. The ministry will subsidize the costs for training hospital staff.
Under the amended law on the national security promotion through economic measures, which was enacted during the recent special Diet session, health care was added to the list of critical infrastructure, such as electricity and gas, for which the government takes the lead in cybersecurity.
Hospitals covered by the law are expected to be chosen from among 88 so-called advanced treatment hospitals which have 400 or more beds. The ministry will have specialists inspect cybersecurity at these hospitals, and about 20 hospitals are expected to undergo such inspection under the fiscal 2027 budget.
