Cybersecurity in Digital Medicine in Viet Nam: Why It Is a Patient Safety Issue and What Healthcare Organizations Need to Prepare For
IMPLEMENTATION INSIGHTS
Cybersecurity in Digital Medicine in Viet Nam: Why It Is a Patient Safety Issue and What Healthcare Organizations Need to Prepare For
Last reviewed: 24 September 2026
When people hear the word cybersecurity in healthcare, the first concern is often patient data. Can somebody steal medical records? Could confidential information be exposed? How should a hospital protect its systems from unauthorized access? These are important questions, but they capture only part of the risk.
In an increasingly digital healthcare environment, a cyber incident can also prevent clinicians from accessing medical records, interrupt laboratory or imaging systems, disable communication and scheduling tools, interfere with connected medical devices, delay treatment or force a hospital to operate using unfamiliar manual processes. The issue is no longer only whether information remains confidential. It is also whether information remains accurate, available and usable when clinicians need it to care for patients. That is why cybersecurity in Digital Medicine should increasingly be understood as a patient-safety, clinical-continuity and healthcare-resilience issue, not simply as an information technology problem.
This distinction is particularly relevant in Viet Nam, where healthcare is becoming increasingly dependent on digital systems. As of this review, the Ministry of Health's electronic medical record portal lists 1,269 hospitals that have announced implementation of electronic medical records. The Ministry's 2026–2030 plan aims for electronic medical records without paper records to be implemented at 100 percent of healthcare facilities nationwide by 2030. As clinical information, workflows and connected technologies become increasingly digital, the consequences of system failure also become more clinically significant.
Cybersecurity in healthcare is about confidentiality, integrity and availability
Healthcare organizations have traditionally placed strong emphasis on confidentiality, and for good reason. Medical information can be deeply personal, and Viet Nam now has specific statutory protections for personal data, including health-related information. Cybersecurity, however, is also concerned with integrity and availability. Integrity means that clinicians can trust that information has not been altered, corrupted or substituted. Availability means that essential information and systems remain accessible when care depends on them.
Consider an electronic medical record that remains completely confidential but cannot be accessed for eight hours, a laboratory result that is available but has been maliciously or accidentally altered, or a connected patient monitor that is functioning but transmitting incorrect information. In each case, confidentiality may not be the primary clinical problem. The risk comes from disruption or loss of trust in information that clinicians use to make healthcare decisions. For Digital Medicine, cybersecurity therefore needs to protect not only data, but also the clinical functions that depend on those data.
Cyber incidents can affect patient care, not just computers
The relationship between cybersecurity and patient safety is no longer theoretical. A 2026 study published in the American Economic Journal: Economic Policy linked hospital ransomware incidents in the United States with Medicare claims data. During the initial week of an attack, hospital volume fell by approximately 17 to 24 percent. Among patients who were already admitted when the ransomware attack began, in-hospital mortality increased by 34 to 38 percent. These findings come from a particular healthcare system and population and should not be directly extrapolated to Viet Nam, but they provide important evidence that major cybersecurity disruptions can have measurable consequences beyond information technology.
Other research examining ransomware incidents affecting hospitals has documented substantial disruption to emergency care, clinical workflows and continuity of care. The practical lesson is important: a cyberattack does not need to manipulate a ventilator or another medical device directly to become a patient-safety problem. Preventing clinicians from accessing the right information at the right time may already be enough to affect care.
The attack surface of Digital Medicine is becoming larger
A modern healthcare organization rarely depends on one information system. It may use an electronic medical record, hospital information system, laboratory and radiology systems, picture archiving and communication systems, pharmacy software, patient portals, mobile applications, cloud platforms, remote patient monitoring, telemedicine, artificial intelligence applications and increasingly connected medical devices.
Many of these systems exchange information. Vendors may have remote access for maintenance. Data may move between local infrastructure and cloud services. Application programming interfaces may connect hospital systems with external platforms. Clinicians may access systems from laptops, mobile devices or outside the healthcare facility. Each connection can create clinical or operational value, but it can also create another dependency and another potential route for compromise or failure.
The World Health Organization Regional Office for Europe's 2025 cybersecurity and privacy maturity guidance reflects this broader digital-health environment. Its scope includes healthcare-provider information systems, cloud computing, mobile and web applications, connected medical devices, digital therapeutics, application programming interface services and artificial intelligence or machine-learning applications. The document is tailored to the WHO European Region rather than specifically to Viet Nam, but its risk-based approach provides a useful international reference for healthcare organizations.
Cybersecurity governance therefore cannot stop at the hospital's internal network. Healthcare organizations need to understand the wider digital ecosystem on which their care depends.
Viet Nam's cybersecurity legal framework changed substantially in 2026
Viet Nam's cybersecurity legal environment changed significantly in 2026. The Law on Cybersecurity No. 116/2025/QH15 took effect on 1 July 2026. From that date, the previous Law on Network Information Security No. 86/2015/QH13 and Law on Cybersecurity No. 24/2018/QH14 ceased to have effect, bringing areas that had previously been governed through separate legislation into a new consolidated statutory framework.
Implementation was further developed on 19 August 2026, when the Government issued a series of cybersecurity decrees. Particularly relevant to healthcare organizations are Decree No. 331/2026/NĐ-CP on cybersecurity protection for information systems, Decree No. 333/2026/NĐ-CP detailing provisions and measures for implementation of the Law on Cybersecurity, and Decree No. 330/2026/NĐ-CP on administrative sanctions in cybersecurity and personal-data protection. All three took effect on 19 August 2026.
The important message for healthcare leaders is not that every hospital or every digital system now has identical cybersecurity obligations. Applicable requirements depend on the organization, the information system, its function and classification, the information being processed, the services being provided and other relevant circumstances. Compliance therefore needs to begin with an understanding of the organization's actual systems, data flows and responsibilities, rather than with a generic cybersecurity checklist.
Information systems are classified across five cybersecurity levels
Decree No. 331/2026/NĐ-CP establishes criteria for information systems across five cybersecurity levels, together with requirements and responsibilities corresponding to those levels. The framework is risk based, with stronger protection requirements applying as the potential consequences associated with a system increase.
Classification considers characteristics such as the type of information processed, services provided, system function, organizational or geographic scope, the number and type of data subjects involved and the potential consequences of disruption. For certain online services, personal-data volumes form part of the criteria. An online service processing information relating to fewer than 100,000 data subjects for basic personal data or fewer than 10,000 data subjects for sensitive personal data is included among the Level 2 criteria. Reaching or exceeding 100,000 data subjects for basic personal data or 10,000 for sensitive personal data is included among the Level 3 criteria. Level 3 also covers certain other systems specified by the Decree.
These numbers need to be interpreted carefully. They do not mean that every hospital with records for more than 10,000 patients automatically has a Level 3 information system. The classification applies to the particular information system, and the relevant criteria need to be considered together. Where a system meets criteria corresponding to more than one level, the highest applicable level must be used. The framework also prohibits artificially dividing a system simply to obtain a lower cybersecurity level.
Existing and developing systems also need attention during the transition
The transition to the new framework is relevant to healthcare organizations that already operate classified information systems or have systems under development.
Under Article 45 of Law No. 116/2025/QH15, information systems that had already been assigned a level under the previous Law on Network Information Security continue to retain that level. Within 12 months from 1 July 2026, however, they must satisfy the cybersecurity conditions, standards and protective measures corresponding to that level under the new Law.
Decree No. 331/2026/NĐ-CP contains a separate transitional rule for information systems that were already in the process of investment or construction before 1 July 2026. Relevant parties must complete appraisal and approval of the system level under the previous Decree No. 85/2016/NĐ-CP within six months from the effective date of the new Law, while the system must satisfy the cybersecurity conditions, standards and protective measures corresponding to its level under the new Decree within 12 months.
Healthcare organizations should therefore not treat 2026 simply as another year of routine information-security maintenance. Existing classifications, protection plans, technical controls and documentation should be reviewed against the new framework, with the precise transitional route determined from the status of each system.
Cybersecurity needs governance throughout the information-system lifecycle
Decree No. 331 does not treat cybersecurity as something that should be added only after an information system has been developed. The framework addresses cybersecurity across the lifecycle of information systems, including their design, construction, management, operation, use, upgrade and decommissioning, together with requirements relating to documentation, storage, backup and assessment.
For Digital Medicine projects, the practical implication is clear. A hospital should not purchase a cloud platform, artificial intelligence system, connected device or remote-monitoring solution and then ask the cybersecurity team to “secure it” shortly before launch. Security requirements should be considered when the clinical use case is defined, the architecture is designed, vendors are evaluated and contracts are negotiated. Designing security into a system from the beginning is usually more reliable and less disruptive than trying to redesign the architecture after clinical workflows and data integrations are already dependent on it.
Privacy and cybersecurity overlap, but they are not the same thing
Cybersecurity and personal-data protection are closely related but legally and operationally distinct. The Law on Personal Data Protection No. 91/2025/QH15 has been effective since 1 January 2026, with Decree No. 356/2025/NĐ-CP providing further implementation requirements. The framework includes specific protections relevant to health information and the processing of personal data in health-related applications.
Personal-data protection asks questions such as whether information is being collected and used lawfully, whether the purpose of processing is appropriate, which parties are involved, how long data are retained and whether the rights of data subjects are respected. Cybersecurity asks related but different questions: Can somebody gain unauthorized access? Can information be altered? Can a service be disrupted? Can malware spread? Can the organization detect and contain an attack? Can essential clinical functions continue while systems are unavailable?
A hospital can have technically sophisticated security controls while processing patient information in ways that do not comply with personal-data requirements. Conversely, an organization can have well-designed privacy notices and consent processes while operating systems with inadequate cybersecurity. Both areas need to be governed together without assuming that compliance with one automatically establishes compliance with the other.
A personal-data incident may create a 72-hour notification obligation
Cybersecurity incident response should include legal and privacy assessment, not only technical containment. Under Article 23 of the Law on Personal Data Protection, a personal-data controller, controller-processor or third party that discovers a violation capable of causing specified forms of harm, including harm to the life, health, honor, dignity or property of a data subject, must notify the specialized personal-data protection authority no later than 72 hours after detecting the violation. A processor that identifies a violation must promptly notify the relevant controller or controller-processor.
For a healthcare organization, the first hours following a serious incident may therefore involve several activities in parallel: containing the attack, protecting patients, maintaining essential clinical operations, preserving evidence, identifying affected data, assessing notification obligations and deciding how affected individuals or other stakeholders should be informed.
These responsibilities need to be planned in advance. A hospital should not have to determine for the first time during a ransomware incident who has authority to make legal, clinical, technical and communication decisions.
Cybersecurity incidents may create separate reporting obligations
Personal-data notification is not the only reporting issue that may arise. Where Decree No. 331/2026/NĐ-CP applies, the owner of an information system also has cybersecurity incident-reporting responsibilities. The Decree requires reporting on the cause, scope of impact and remediation measures within 72 hours from detection of an incident. For a serious cybersecurity incident, an initial notification is required within 24 hours, and incidents showing signs of affecting national security, public order or safety, or seriously disrupting the information system, are subject to more immediate reporting requirements.
These are distinct legal pathways with different triggers and purposes. A single ransomware or other cyber incident could potentially require technical incident response, cybersecurity reporting and personal-data assessment at the same time. Healthcare incident-response procedures should therefore make clear who is responsible for determining which obligations have been triggered, to whom reports must be made and within what timeframe.
Health data have an additional governance layer
Cybersecurity in healthcare also sits within Viet Nam's wider health-data framework. The Law on Data No. 60/2024/QH15 and Decree No. 102/2025/NĐ-CP on management of health data have been effective since 1 July 2025. Decree No. 102 establishes a framework for managing, developing, protecting, governing, processing and using health data, including the development and operation of the National Health Database.
Electronic medical records add another layer. Circular No. 13/2025/TT-BYT, effective from 21 July 2025, requires implementation of electronic medical records to comply with the applicable laws concerning data, electronic transactions, cybersecurity, access to information, personal-data protection and data retention.
This overlap is not merely administrative complexity. A modern electronic medical record is simultaneously a clinical record, a collection of personal information, a health-data resource and an information system on which clinical care may depend. Its governance therefore cannot belong exclusively to the information technology department or exclusively to the medical-records function.
Cloud computing is not inherently unsafe, but the architecture needs to be understood
Cloud services can provide strong security, redundancy, scalability and disaster-recovery capabilities, sometimes beyond what an individual healthcare organization can build on its own. Cloud use should therefore not automatically be treated as less secure than local infrastructure.
The problem arises when an organization does not understand the architecture on which its service depends. Before contracting with a cloud provider, healthcare organizations should know where production data are hosted, where backups and disaster-recovery copies are maintained, which subcontractors are involved, how privileged access is controlled, how encryption is managed, how incidents are communicated and what happens to the organization's data when the contract ends.
Viet Nam's personal-data framework contains specific requirements relevant to cloud services. Decree No. 356/2025/NĐ-CP requires parties to clarify data-processing flows, roles and responsibilities in cloud arrangements and contains technical and contractual requirements. It also requires personal data on cloud services to be encrypted at rest and in transit, with appropriate access controls. In addition, the Decree treats several scenarios as cross-border personal-data transfers, including the transfer of personal data collected or stored in Viet Nam to overseas servers or to the cloud services of a foreign provider. Applicable impact-assessment requirements and exemptions therefore need to be determined from the actual architecture and data flows.
Separately, Article 19 of Decree No. 333/2026/NĐ-CP identifies categories of data that must be stored in Viet Nam, including personal information of users of services in Viet Nam and specified user-generated data. Domestic enterprises are required to store the data described in that provision in Viet Nam. For specified foreign enterprises, the obligation to store data in Viet Nam and establish a branch or representative office arises only under the circumstances, conditions and procedures set out in the Decree.
These frameworks should therefore be considered together rather than reduced to either “all cloud data must remain in Viet Nam” or “foreign cloud processing is generally unrestricted.” Healthcare organizations need to understand what data are being processed, who the relevant entities are, where production data and backups are located, whether cross-border processing occurs, whether local-storage obligations apply and which cybersecurity and personal-data requirements attach to the particular architecture.
Connected medical devices belong in the cybersecurity inventory
Cybersecurity governance also needs to extend beyond conventional information systems. Modern medical devices may contain software, connect to hospital networks, exchange information with other systems or receive updates remotely. A cybersecurity vulnerability can therefore become a medical-device safety issue when it affects the availability, integrity or intended performance of the device.
The United States Food and Drug Administration's February 2026 guidance addresses cybersecurity in medical devices as part of product design, quality management and risk management, with an emphasis on building resilience to cybersecurity threats into devices that present cybersecurity risk. These are United States regulatory expectations, not Vietnamese law, but they illustrate how medical-device cybersecurity is increasingly treated internationally as a lifecycle safety issue rather than simply an information technology issue.
For healthcare organizations in Viet Nam, the practical lesson is that a cybersecurity inventory should not stop at servers, laptops and desktop computers. It should also consider network-connected patient monitors, imaging equipment, laboratory systems, infusion technologies, remote-monitoring devices and other clinical equipment containing software or communicating digitally. Biomedical engineering, clinical engineering or medical-equipment teams therefore need to participate alongside information technology and cybersecurity teams.
A vendor's security certificate is useful, but it is not enough
Healthcare organizations increasingly depend on technology vendors, cloud providers, medical-device manufacturers and software companies. This creates an important governance risk: an organization can have strong internal controls but still be exposed through a supplier.
Vendor due diligence should therefore go further than asking whether the company holds an information-security certificate. The healthcare organization should understand which systems and data the vendor can access, whether privileged remote access remains continuously available, how accounts are authenticated, how quickly known vulnerabilities are addressed, how software updates are tested, whether subcontractors can access patient information, where backups are maintained and how a cybersecurity incident affecting the vendor will be communicated.
Contractual arrangements matter because technical expectations that are not reflected in enforceable responsibilities may become difficult to manage during a serious incident. Contracts should address security obligations, incident notification, vulnerability management, access to data, service continuity, subcontractors and support throughout the product lifecycle. Exit planning matters as well. If a vendor fails, experiences a prolonged outage or ends a service, the healthcare organization needs to know whether it can retrieve its information and maintain essential clinical operations.
Backups matter only if clinical services can actually recover
Many organizations correctly recognize that they need backups. Fewer routinely test whether those backups can restore the systems required for patient care within an acceptable time. A backup that exists but cannot be accessed during ransomware provides limited protection. Restoring a database may also be insufficient if authentication services, network infrastructure, medical interfaces or dependent applications remain unavailable.
Healthcare organizations should therefore think in terms of recovery of clinical capability, not simply recovery of files or databases. The recovery plan should establish which services must return first, how long critical departments can function without each system and which dependencies must be restored in sequence. How will laboratory results be communicated while interfaces are unavailable? How will medications be prescribed and administered? How will patients be identified? How will clinicians obtain allergy or previous treatment information? How will information generated during downtime be reconciled once digital systems return?
These are clinical questions as much as technical questions, which is why recovery planning needs input from the people who actually deliver care.
Downtime procedures need to reflect real clinical work
A technically sound incident-response plan may explain how to isolate infected servers, block network traffic and restore infrastructure, but it may say little about how a nurse verifies medication administration during downtime, how clinicians access allergy information, how laboratory staff communicate a critical result or how new patients are registered safely.
Healthcare organizations therefore need clinical downtime procedures alongside technical cybersecurity response plans. These procedures should be simple enough to use under pressure and should reflect actual workflows in emergency departments, inpatient units, operating rooms, laboratories, pharmacies, diagnostic departments and other relevant services.
Essential paper forms, contact lists and escalation pathways should remain accessible even when digital infrastructure is unavailable. Responsibilities for clinical decisions during downtime should be clear, and departments should understand which information needs to be reconstructed or reconciled after systems recover. Most importantly, downtime procedures need to be tested. A contingency plan that has never been exercised remains an assumption about how the organization will behave under pressure.
Cyber exercises should include clinicians, not only technical teams
Traditional cybersecurity exercises often focus on technical teams responding to simulated malware or data breaches. Healthcare organizations need a broader model. A realistic exercise might begin with the electronic medical record becoming unavailable during a busy morning. Shortly afterward, laboratory interfaces stop functioning, some workstations display ransomware messages and the organization learns that an external technology vendor may also have been affected.
The exercise should test more than whether the technical team can identify the malware. Can the emergency department continue working safely? Can medications still be administered? How are critical results communicated? Who decides whether elective procedures continue? Does senior management know when crisis governance should be activated? How are patients and staff informed? How is care delivered during the outage documented and later reconciled?
The objective is not to make clinicians cybersecurity specialists. It is to ensure that the organization can continue providing safe care when digital systems fail.
Cybersecurity should be risk based, not equally strict everywhere
Not every digital system creates the same clinical risk. A public education website is different from an electronic medication-administration system. An appointment-scheduling application is different from a connected device supporting a critically ill patient. A brief outage in one system may be inconvenient, while the same outage in another may immediately affect patient care.
Cybersecurity investment should therefore be proportionate not only to data volume or financial value but also to clinical consequence. For each important system, healthcare organizations can ask a simple question:
If this system becomes unavailable, inaccurate or compromised, what could happen to a patient?
The answer can help determine which systems deserve the strongest controls, the shortest recovery times and the most rigorous testing.
Identity and access management deserve particular attention
Many cybersecurity incidents begin with compromised credentials rather than highly sophisticated attacks against infrastructure. Healthcare environments also make access management unusually challenging because staff work shifts, rotate between departments, change roles and sometimes require rapid access in emergencies. Visiting clinicians, outsourced personnel and vendors may need temporary access, while shared workstations remain common in many clinical settings.
These realities make strong identity governance more important, not less. Healthcare organizations should know who can access which systems, why that access is necessary and when it should end. Privileged administrative accounts deserve stronger controls than ordinary user accounts. Multi-factor authentication, separation of administrative privileges where appropriate, timely removal of access when staff leave or change roles and monitoring of unusual login behavior can materially reduce risk.
The objective should not be security that obstructs care. It should be access that is as straightforward as reasonably possible for authorized users and difficult for everyone else.
Patch management in healthcare requires clinical judgment
“Patch everything immediately” sounds sensible but can be difficult in healthcare environments. A software update may affect a laboratory analyzer, imaging platform, medical device or interface whose failure could itself create patient risk. Some legacy technologies depend on operating systems that are difficult to update, while manufacturers may require testing before changes are installed.
This does not justify leaving known vulnerabilities unmanaged. It means healthcare organizations need a risk-based vulnerability-management process that considers both cybersecurity risk and the potential clinical consequences of the remediation itself. Where a patch cannot immediately be installed, compensating measures may be necessary, such as network segmentation, access restrictions, enhanced monitoring or isolation of vulnerable equipment. The decision should be documented, assigned an owner and reviewed periodically rather than allowing unsupported technology to remain indefinitely because “it still works.”
Cybersecurity needs to be part of procurement before contracts are signed
Digital Medicine procurement increasingly determines a healthcare organization's future cybersecurity posture. Once a hospital has purchased a system, transferred patient information and integrated the platform into clinical workflows, replacement can become difficult and expensive.
Cybersecurity questions therefore need to be asked before the procurement decision. Does the vendor follow secure software-development practices? How are vulnerabilities disclosed and corrected? How long will the product receive security updates? Will the healthcare organization be informed of significant changes? Can relevant security logs be accessed? Can data be exported? Can the vendor connect remotely to production systems? What happens when the product reaches the end of support?
For connected medical devices, healthcare organizations should also understand whether security updates can be delivered safely throughout the expected life of the equipment. Cybersecurity should therefore be treated as part of the total lifecycle cost and risk of a Digital Medicine product, not as an additional expense discovered after purchase.
Governance must reach the leadership level
Cybersecurity cannot be delegated entirely to the head of information technology. Senior leadership determines investment priorities, staffing, risk tolerance, vendor selection, business continuity and the speed at which vulnerable legacy systems are replaced. Clinical leaders understand which systems are critical to patient care. Quality and patient-safety teams understand how system failure may create harm. Personal-data protection teams understand privacy obligations. Biomedical engineers understand connected medical equipment. Legal and procurement teams influence contracts and vendor accountability.
These perspectives need to come together. A mature healthcare organization should consider cybersecurity within the same governance environment in which it considers other significant clinical and organizational risks. Leadership should understand which digital systems are critical to care, where important dependencies exist, whether recovery arrangements have been tested and whether significant risks are being corrected.
The board or senior management does not need to understand the technical detail of every vulnerability. It does need to understand whether the organization can continue caring for patients safely if its most important digital systems fail.
International frameworks can help organize the work
Vietnamese law determines an organization's legal obligations, while international frameworks can provide useful structures for building a mature cybersecurity program.
The National Institute of Standards and Technology Cybersecurity Framework 2.0 organizes cybersecurity around six concurrent functions: Govern, Identify, Protect, Detect, Respond and Recover. The addition and central placement of Govern is particularly relevant to healthcare because it emphasizes that cybersecurity risk management is an organizational responsibility rather than simply a collection of technical controls.
ISO 27799:2025 provides health-specific information-security controls based on ISO/IEC 27002:2022. Its scope includes electronic health-record systems, medical devices incorporating health software and other technologies used in healthcare environments. The World Health Organization Regional Office for Europe's 2025 cybersecurity and privacy maturity framework provides another healthcare-focused approach for assessing cybersecurity and privacy maturity in digital health information systems. The United States Department of Health and Human Services also publishes voluntary healthcare-specific Cybersecurity Performance Goals designed to help healthcare organizations prioritize high-impact cybersecurity practices.
These frameworks are not substitutes for Vietnamese law and should not be presented as mandatory in Viet Nam unless a particular regulation, contract or organizational policy makes them applicable. Their value is in helping organizations translate broad governance responsibilities into systematic operational practices.
What healthcare organizations in Viet Nam should prepare for now
For many healthcare organizations, the immediate priority should not be purchasing another cybersecurity product. It should be developing a clear picture of what already exists. The organization should know which digital systems are operating, which are essential to clinical care, what information they process, how they are connected, who owns them, which third parties can access them and what would happen if each system became unavailable or unreliable.
From there, the applicable cybersecurity classification and legal requirements can be assessed, together with personal-data, health-data, cloud and medical-device implications where relevant. Controls can then be prioritized according to actual risk. Identity and access management, vulnerability and patch management, backup and recovery, monitoring, network segmentation, endpoint protection, vendor access, incident response and workforce awareness all matter, but the appropriate sequence will differ between organizations.
The more important organizational shift is to connect cybersecurity with patient safety, business continuity and clinical governance, rather than allowing it to remain an isolated technical program.
Cyber resilience matters as much as cyber defense
No healthcare organization can guarantee that it will never experience a cybersecurity incident. For this reason, mature cybersecurity practice emphasizes resilience as well as prevention. The objective is not only to stop attacks but also to detect them quickly, contain their effects, maintain essential operations and recover safely.
For healthcare, resilience has a particularly practical meaning. Patients continue to arrive when servers are unavailable. Emergency surgery cannot always wait for a database to be restored. Medications still need to be administered, laboratory results communicated and clinical decisions documented.
A resilient hospital is therefore not one that assumes its digital systems will never fail. It is one that knows how to continue caring for patients safely when they do.
What good cybersecurity governance in Digital Medicine should look like
The strongest cybersecurity program is unlikely to be the one with the largest number of security products or the most complicated dashboard. It is the one in which the organization understands its critical systems, knows which risks matter most, protects information appropriately, detects unusual activity, responds coherently and can restore safe clinical operations when something goes wrong.
Cybersecurity should also evolve with the organization's digital environment. A hospital that introduces remote patient monitoring, artificial intelligence, digital therapeutics, new cloud infrastructure or additional connected medical devices changes its risk profile. Its cybersecurity assessment should change with it.
As Digital Medicine develops in Viet Nam, cybersecurity will increasingly become part of the infrastructure on which safe innovation depends. Strong cybersecurity should not be seen as something that slows digital transformation. Digital transformation becomes fragile when cybersecurity, continuity and clinical resilience are not designed into it.
The central question is therefore not simply “Is our information secure?” It is “If our digital systems are compromised or unavailable, can we still protect our patients, maintain essential care and recover safely?”
That is the point at which cybersecurity becomes part of patient safety.
References and further reading
National Assembly of Viet Nam. Law on Cybersecurity No. 116/2025/QH15. Effective 1 July 2026.
Government of Viet Nam. Decree No. 331/2026/NĐ-CP on Cybersecurity Protection for Information Systems. Effective 19 August 2026.
Government of Viet Nam. Decree No. 333/2026/NĐ-CP detailing provisions and measures for implementation of the Law on Cybersecurity. Effective 19 August 2026.
Government of Viet Nam. Decree No. 330/2026/NĐ-CP on administrative sanctions in cybersecurity and personal-data protection. Effective 19 August 2026.
National Assembly of Viet Nam. Law on Personal Data Protection No. 91/2025/QH15. Effective 1 January 2026.
Government of Viet Nam. Decree No. 356/2025/NĐ-CP detailing provisions and measures for implementation of the Law on Personal Data Protection. Effective 1 January 2026.
National Assembly of Viet Nam. Law on Data No. 60/2024/QH15. Effective 1 July 2025.
Government of Viet Nam. Decree No. 102/2025/NĐ-CP on Management of Health Data. Effective 1 July 2025.
Ministry of Health of Viet Nam. Circular No. 13/2025/TT-BYT providing guidance on implementation of electronic medical records. Effective 21 July 2025.
Ministry of Health of Viet Nam. Decision No. 965/QĐ-BYT approving the Plan for Implementation of Electronic Medical Records at Healthcare Facilities Nationwide for 2026–2030. 2026.
Ministry of Health of Viet Nam. Electronic Medical Record Portal: List of healthcare facilities announcing implementation of electronic medical records. Accessed 24 September 2026.
World Health Organization Regional Office for Europe. Cybersecurity and Privacy Maturity Assessment and Strengthening for Digital Health Information Systems. 2025.
Neprash H, McGlave C, Nikpay S. Hacked to Pieces? The Effects of Ransomware Attacks on Hospitals and Patients. American Economic Journal: Economic Policy. 2026;18(1):256–281. doi:10.1257/pol.20240594.
van Boven LS, Kusters RWJ, Tin D, et al. Hacking Acute Care: A Qualitative Study on the Health Care Impacts of Ransomware Attacks Against Hospitals. Annals of Emergency Medicine. 2024;83(1):46–56. doi:10.1016/j.annemergmed.2023.04.025.
National Institute of Standards and Technology. The NIST Cybersecurity Framework 2.0. 2024.
International Organization for Standardization. ISO 27799:2025 Health informatics — Information security controls in health based on ISO/IEC 27002. 2025.
U.S. Food and Drug Administration. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. Final Guidance. February 2026.
U.S. Department of Health and Human Services. Healthcare and Public Health Sector Cybersecurity Performance Goals.
Regulatory and educational note
This article provides a general overview of cybersecurity issues relevant to Digital Medicine in Viet Nam as of 24 September 2026. Applicable legal requirements depend on the organization, information system, system classification, services provided, types and volumes of information processed, use of cloud or external service providers and other relevant circumstances.
The cybersecurity-level criteria discussed above should not be used to classify an individual hospital or information system without examining the complete criteria under Law No. 116/2025/QH15 and Decree No. 331/2026/NĐ-CP. Personal-data thresholds are only part of the classification framework and should not be applied independently of the function, scope and other characteristics of the system.
Cybersecurity, personal-data protection and health-data governance overlap but remain legally distinct areas. A cybersecurity incident and a personal-data violation may also trigger different reporting obligations, with different legal thresholds, recipients and timeframes. Compliance with one framework should not automatically be treated as compliance with another. Likewise, cloud and cross-border architectures need to be assessed under both the personal-data protection framework and applicable cybersecurity requirements, including data-localization provisions, based on the actual entities, services, architecture and data flows involved.
The international standards and guidance referenced in this article are useful benchmarks for healthcare cybersecurity practice but do not replace Vietnamese legal requirements unless incorporated through applicable law, regulation, contract or organizational policy.
This article is for educational purposes and does not constitute legal, regulatory, cybersecurity or clinical advice.