Andhra Pradesh’s rapid shift toward digital healthcare has created a cybersecurity challenge that can no longer be treated simply as an IT problem. A World Bank assessment, conducted with technical support from Imperial College London’s Institute of Global Health Innovation, finds that while the state has established relatively strong cybersecurity institutions, its public health sector remains at a “formative” stage of cyber maturity. With around 46 million Ayushman Bharat Health Accounts and more than 20 health applications supporting an increasingly connected healthcare system, cybersecurity weaknesses could affect patient data, hospital operations, public finances and trust in digital health.
Strong State Defences, but a Weak Link Inside Healthcare
Andhra Pradesh already has important foundations, including its Cyber Security Policy, Andhra Pradesh Cyber Security Framework (APCSF), Andhra Pradesh Technology Services (APTS) and the Andhra Pradesh Cyber Security Operations Centre (APCSOC). The problem is that these state-level capabilities have not been fully integrated into everyday healthcare operations.
The assessment identifies nine major weaknesses. No health authority formally oversees cybersecurity across the sector; responsibilities remain unclear; public facilities lack specialist personnel and financial resources, and the Department of Health and Family Welfare (DoHFW) does not have a formal cybersecurity risk-management strategy.
Compliance with existing standards is also incomplete. The APCSF contains 90 baseline cybersecurity controls and 94 advanced controls, but several remain only partially implemented or absent in healthcare. Existing protections include password requirements, unique user accounts, role-based access, encryption and network monitoring. However, weaknesses remain around device management, cyber hygiene, software security and employee behaviour.
For policymakers, the message is clear: establishing a state cybersecurity framework is not enough unless departments have the people, budgets and accountability required to implement it.
Why 11,980 Health Facilities Turn Cybersecurity Into a Development Issue
The risks become more significant because Andhra Pradesh has approximately 11,980 public health facilities at primary and secondary levels. Yet frontline workers currently lack a direct mechanism for reporting suspected cybersecurity incidents to APCSOC.
The assessment found problems including outdated computers, broken equipment, personal mobile phones being used for data collection, insecure communication platforms and inconsistent security practices. Some frontline workers also had limited understanding of password sharing, personal-device risks and how cyberattacks could disrupt healthcare.
A successful attack can therefore become a healthcare crisis rather than simply a data breach. The report points to Indian healthcare cyber incidents costing as much as ₹200 crore and notes that the attack on AIIMS Delhi disrupted registration, appointments, admissions, billing and discharge functions for roughly two weeks.
This creates a strong economic argument for preventive investment. Governments need to compare the cost of cybersecurity staff, secure equipment, backups and training against potentially much larger losses from interrupted healthcare, recovery expenditure and declining public confidence.
A Five-Year Cybersecurity Roadmap Starts With Just Two Specialists
The report recommends a five-year reform programme built around four action paths. Its priority is to strengthen institutional capacity within the DoHFW by recruiting two dedicated full-time professionals—one cybersecurity engineer and one cybersecurity analyst.
Their initial tasks would include mapping critical digital assets, identifying vulnerabilities, conducting compliance assessments and establishing a clearer picture of cyber risks throughout the health system.
The next priority is people. Training should extend beyond IT departments to senior officials and frontline healthcare workers. The proposed model is deliberately practical: frontline staff could receive an initial cybersecurity course of up to two hours, followed by one-hour annual refresher training.
The DoHFW should also establish a health-sector Information Security Policy, Cyber Risk Management Strategy and formal Incident Response Plan covering business continuity and disaster recovery. Cybersecurity indicators should become part of organisational performance monitoring so progress can be measured rather than assumed.
New Opportunities for Development Partners and Technology Companies
For international development partners, the findings suggest that cybersecurity should be built into digital-health programmes from the beginning rather than financed after systems have already been deployed. Support could cover cybersecurity assessments, workforce development, institutional capacity, secure infrastructure, simulation exercises and technical assistance for risk and incident management.
Private-sector opportunities are also significant. Cybersecurity companies, software developers, cloud providers, training organisations and health-tech firms could see growing demand for vulnerability assessments, threat detection, secure software development, encryption, identity management, backups and incident-response services.
But outsourcing also creates risks. Technology vendors handling health information or operating critical applications become part of the healthcare security chain. Government procurement therefore needs to assess cybersecurity alongside price and functionality, establish clear responsibility for protecting data and require vendors to report vulnerabilities and incidents.
The broader lesson is that Andhra Pradesh does not need to build its cybersecurity system from scratch. It already has policies, institutions and monitoring capabilities. The priority is connecting those strengths with thousands of healthcare facilities.
For policymakers, development partners and businesses, the sequence matters: recruit specialists, map digital assets, assess risks, close gaps in the 90 baseline controls, train workers, formalise incident response and strengthen information sharing. Done alongside continued digital-health investment, these measures could protect patient data and service continuity while strengthening confidence in digital healthcare. Without them, the expansion of digital health could increase cyber exposure almost as quickly as it improves healthcare delivery.
