Do you provide cybersecurity for hospitals and clinics in Kerala?
Key takeaways
- An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
- CERT-In requires 180-day log retention and reporting of listed incidents within six hours of noticing them, which applies to hospitals.
- Segmentation is the single control that limits a healthcare blast radius, by isolating clinical and administrative devices from the database server.
- Backups must be offline and tested, because ransomware exfiltrates as well as encrypts, and a synced backup is already compromised.
- The Health Ministry's 2018 guidance on patient data, the IT Act, 2000 and the DPDP Act 2023 all apply to a Kerala clinic holding patient records.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why are Kerala hospitals and clinics being targeted?
Three reasons, and the first two are structural. Hospitals hold unusually dense personal data, because a single patient record carries identity, diagnosis, medication, family details and often financial information, which makes it worth far more to an attacker than a list of names and passwords. And healthcare networks are built for availability rather than security, because a hospital cannot refuse a patient, so legacy clinical devices, imaging systems and vendor-maintained equipment often run with old software, default credentials and no segmentation, and that is a soft target by design. The third reason is that Kerala's healthcare sector has now been hit at scale, with an Ernakulam hospital losing over 800GB of patient data in March 2026 and a Kochi hospital listed by the same ransomware group in the same month.
What are the three controls that matter most?
Three, in this order. First, segmentation: clinical, administrative, guest and biomedical devices sit in separate network zones, so a compromised workstation on a ward floor cannot reach the database server or the imaging archive, and the report server cannot reach the internet. Second, tested offline backups: a backup that is encrypted, air-gapped, and restored at least quarterly, because ransomware that reaches the server also reaches a backup that is online and writable. Third, log retention and clock synchronisation, since CERT-In requires 180 days of logs and a defensible detection timestamp, and a hospital that cannot prove when it detected a breach cannot prove that it reported within six hours. These three controls, done properly, contain most of the realistic loss.
What does a compliance posture look like for a Kerala clinic?
Four frameworks apply and they overlap, so a single evidence set can serve all of them. The Health Ministry's 2018 guidance on patient data, which sets expectations for electronic patient records and health information security. The Information Technology Act, 2000, whose sections 43 and 66 govern unauthorised access to hospital systems and whose 2000-era re-read alongside the CERT-In directions defines your reporting duties. The Digital Personal Data Protection Act 2023, which applies to health data as sensitive personal data and whose Rule 7 notification obligations commence from May 2027. And the CERT-In directions themselves, with six-hour reporting and 180-day logs. For a mid-size clinic, a 90-day plan covering segmentation, backups, logging and an incident runbook closes most of the gap.
How should a clinic respond when it suspects a breach?
Run the same sequence as any Indian organisation, and the medical context does not change the legal clock. Isolate the affected systems, and do not power them off, since volatile evidence is lost on shutdown. Preserve logs and images, and note the exact time of detection. Secure the accounts, forcing resets and revoking sessions. Then report to CERT-In within six hours of noticing or being brought to notice, at incident@cert-in.org.in or 1800-11-4949, identifying the affected system, the closest Annexure I category and the occurrence and detection timestamps. Where patient data is involved, the DPDP Rules add notification duties to affected individuals and the Data Protection Board from May 2027, and clinical operations must continue on paper or in a segregated downgraded mode while containment proceeds.
| Control | Why it matters | Effort | Primary standard |
|---|---|---|---|
| Network segmentation of clinical systems | Limits the blast radius of a ward device compromise | Medium | CERT-In directions, DPDP Act |
| Offline, tested backups | Ransomware exfiltrates as well as encrypts | Low | CERT-In directions |
| 180-day log retention with NTP sync | Proves the detection timestamp for the 6-hour rule | Low | CERT-In directions |
| MFA on clinical and admin systems | Blocks credential reuse from a patient record leak | Medium | Health Ministry 2018 guidance |
| Endpoint hardening on legacy devices | Old imaging and clinical systems are the soft target | Medium | Health Ministry 2018 guidance |
| Staff awareness for reception and nursing | Phishing and calls target reception and billing staff | Low | DPDP Act reasonable safeguards |
| Incident runbook with six-hour clock | Makes the CERT-In deadline survivable under pressure | Low | CERT-In directions, DPDP Rule 7 |
What are the frequently asked questions?
Get a straight answer on this
Call +91 98473 40580 and ask for a hospital security scoping visit in Kochi, and we will return a 90-day control plan with a fixed price.
Send us the details See pricing