The DOI matches its Crossref record.
SoK: Cybersecurity Regulations, Standards and Guidelines for the Healthcare Sector *
Open accessAbstract
The growing adoption of IT solutions in the healthcare sector is accompanied by a steady increase in cybersecurity incidents. In response to this phenomenon regulations, standards, and best practices have been introduced to address cybersecurity and data protection issues in this sector. However, applying this large corpus of documents poses several operational hurdles, while operators continue to lag behind the growing number of cyber attacks. This paper contributes a Systematization of Knowledge (SoK) of the main cybersecurity documents relevant to the healthcare sector. We collected and analyzed 49 relevant documents and used the NIST Cybersecurity Framework as a taxonomical instrument to categorize key information extracted through a three-step analysis. We provide and quantify seven findings emerging from this analysis and propose a way to exploit the extracted measures to support cybersecurity assessments.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Emerging technologies offer cybersecurity posture enhancement opportunities including Artificial Intelligence and Machine Learning for threat detection automation, Quantum Computing era preparation, Blockchain for critical infrastructure security, and Cloud Computing with security provisions (Carello et al., 2023).”
From Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia (2025) · cites this paper as Carello et al., 2023
Experimental — accuracy not yet measuredThe source backs part of the claim, not all of it — or backs it for a different population, condition or comparison.
In the citing paper
“Systematization of cybersecurity regulations demonstrates that comprehensive frameworks must address multiple dimensions: asset identification, threat assessment, vulnerability analysis, and risk calculation using Likelihood × Impact matrices (Carello et al., 2023).”
From Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia (2025) · cites this paper as Carello et al., 2023
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Security audits often focus on compliance checklists rather than operational effectiveness (Carello et al., 2023).”
From Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia (2025) · cites this paper as Carello et al., 2023
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“Geopolitical motivation drives APT activities with strategic intelligence gathering objectives (Carello et al., 2023).”
From Comprehensive Cybersecurity Framework for Digital Governance: Threat Assessment, Risk Mitigation, and Regulatory Compliance in Indonesia (2025) · cites this paper as Carello et al., 2023
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
No references could be resolved yet.
Research works printed but not linked: 34
- health, 2022, Fascicolo sanitario elettronico - linee guida
- 10.1016/j.sintl.2021.100117 · DOI · Paper page
- 10.1016/j.hlpt.2021.100549 · DOI
- 2021, IEC 80001–1 2021 application of risk management for it-networks incorporating medical devices
- 2013, HHS Administrative simplification
- 2016, European Parliament General Data Protection Regulation
- 2018, NIST Cybersecurity Framework v1
- 2023, ENISA Boost your cyber vitals - healthcare campaign
- 10.1093/eurpub/ckz165 · DOI
- 2021, ENISA Psirt expertise and capabilities development - health and energy
- 2017, Parliament E Regolamento (ue) 2017–745 sui dispositivi medici - mdr
- 10.1007/978-3-030-55196-4_8 · DOI
- akinsanya, 2019, Current cybersecurity maturity models: How effective in healthcare cloud?, CERC, 211
- 2016, ISO 27799 health informatics-information security management in health using iso/iec, 27002
- 2015, ISO 17522health informatics - provisions for health applications on mobile/smart devices
- 2017, ISO 18638 2017 - health informatics - guidance on health information privacy education in healthcare organizations
- 2017, ISO 17090 2017 health informatics - public key infrastructure
- lewallen, 2021, Emerging technologies and problem definition uncertainty The case of cybersecurity
- lechner, 0, An overview of cybersecurity regulations and standards for medical device software, Central European Conference on Information and Intelligent Systems, 237
- 2022, Guidance on Cybersecurity for Medical Devices
- 10.1136/bmj.j3179 · DOI
- 2019, ISO 14971 medical devices (md) application of risk management to md
- 10.2196/12644 · DOI
- 2021, ISO 21332 - health informatics - cloud computing considerations for the security and privacy of health information systems
- nai-fovino, 2019, A proposal for a european cybersecurity taxonomy, Publications Office of the European Union
- mohammed, 2017, Us healthcare industry: Cybersecurity regulatory and compliance issues, Journal of Research in Business Economics and Management, 9, 1771
- 2008, NIST Nist security rule (sp 800–66 rev 1)-an introductory resource guide for implementing the hipaa security rule
- 10.1016/j.maturitas.2018.04.008 · DOI
- 10.1145/3290688.3290721 · DOI
- 2019, ENISA Procurement Guidelines for Cybersecurity in Hospitals
- 10.1186/s12911-018-0724-5 · DOI
- 10.1109/VIZSEC.2017.8062194 · DOI
- 10.1365/s43439-022-00054-x · DOI
- 10.1097/CCM.0000000000002994 · DOI · Paper page
Cited by
Sorted by citations
Mualim, W. M. A., Marta, F. Y. D., & Meiyenti, I. (2025) · Jurnal Teknik Informatika dan Teknologi Informasi · doi:10.55606/jutiti.v5i3.6379
Metadata
- Authors
- Carello, M. P., Marchetti-Spaccamela, A., Querzoni, L., & Angelini, M.
- Affiliations
- Sapienza University of Rome (IT)
- Venue
- 2023 IEEE International Conference on Intelligence and Security Informatics (ISI)
- Publisher
- IEEE
- Published
- 2023-10-02
- Pages
- 1-6
- OpenAlex
- W4388115871
- Cited by
- 25
- References
- 0
- Citations by year
- 2026: 9 · 2025: 10 · 2024: 6
- FWCI
- 4.81
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE International Conference on Intelligence and Security Informatics (ISI) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- IRIS Research product catalog (Sapienza University of Rome) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Health Sciences › Health Professions › Health Information Management › Thoreau and American Literature
- Health Sciences › Medicine › Public Health, Environmental and Occupational Health › Healthcare Regulation
- Keywords
- healthcare cybersecurity, cybersecurity regulation, cybersecurity standards, NIST Cybersecurity Framework, data protection, cybersecurity assessment, knowledge systematization, health information technology adoption, cyberattacks
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
