Healthcare data security in Saudi Arabia means protecting patient records, medical images, insurance claims and clinical systems from unauthorised access, loss and cyberattacks — and being able to prove it to regulators. For hospitals, clinics, laboratories and health insurers, three sets of rules now define what "secure" looks like: the Personal Data Protection Law (PDPL) and its Implementing Regulation, the National Cybersecurity Authority's (NCA) controls, and the health-sector requirements set by the Ministry of Health and other health regulators.
This guide explains why health data is targeted, which Saudi rules apply, the ten best practices that close the most common gaps, the security solutions that support them, and exactly what to do in the first 72 hours after a breach.
In short
- Health data is classed as sensitive personal data and needs extra protection under the PDPL.
- Article 26 of the PDPL Implementing Regulation sets specific duties for anyone processing health data.
- Government hospitals and critical infrastructure operators must also meet the NCA Essential Cybersecurity Controls (ECC-2:2024).
- A personal data breach must be reported to the regulator within 72 hours of becoming aware of it.
Why Healthcare Data Is a Prime Target for Cyberattacks
A medical record holds far more than a credit card number: national ID, contact details, diagnoses, prescriptions, insurance details and family history. Unlike a card, it cannot be cancelled and reissued. That makes it valuable to criminals and highly sensitive for patients.
The cost of getting it wrong is the highest of any sector. According to IBM's Cost of a Data Breach Report 2026, the global average cost of a breach reached a record US$4.99 million, and healthcare again carried the highest breach costs of all industries, averaging US$6.64 million per incident.
The impact is not only financial. When ransomware locks a hospital information system, appointments are cancelled, lab results are delayed and clinicians fall back on paper. In healthcare, data security is part of patient safety.
The Saudi Rules That Define "Secure" for Health Data
Saudi healthcare organisations do not need to guess what good security looks like — the requirements are written down. The table below shows the main obligations and who they apply to.
| Requirement | Who it applies to | What it requires |
|---|---|---|
| PDPL Implementing Regulation, Article 23 (Information Security) | Every controller of personal data | Security and technical measures to reduce breach risk, and compliance with NCA controls and standards where applicable |
| PDPL Implementing Regulation, Article 26 (Processing Health Data) | Healthcare providers, insurers, claims managers and their contractors | Apply health-regulator controls, segregate duties, grade staff access, document every processing stage, bind processors by contract, minimise data |
| PDPL Implementing Regulation, Article 24 (Breach Notification) | Every controller | Notify the competent authority within 72 hours; notify affected patients without undue delay where harm is likely |
| NCA Essential Cybersecurity Controls (ECC-2:2024) | Government entities and their affiliates, and private entities that own, operate or host critical national infrastructure | 108 controls across four domains: governance, defence, resilience, and third-party and cloud security |
Source: PDPL Implementing Regulation — Umm Al-Qura official gazette; NCA Essential Cybersecurity Controls (ECC-2:2024)
Article 26 is the one every healthcare compliance team should know by heart. It requires controllers to adopt the requirements and controls issued by the Ministry of Health, the Saudi Health Council, the Council of Health Insurance and other competent bodies, and to build the PDPL's provisions into their internal policies. The Ministry of Health's privacy statement confirms that records revealing a person's health condition are treated as a sensitive category of data.
Private hospitals and clinics that are not classed as critical infrastructure should also watch NCA's newer control set for the private sector, explained in our guide to NCA's NCNICC-1 cybersecurity controls for private sector entities. For the privacy side of the law — consent, patient rights and lawful processing — see how the PDPL protects healthcare data privacy and security.
The Biggest Cyber Threats Facing Saudi Hospitals
Most healthcare incidents start with one of six weaknesses:
- Ransomware that encrypts electronic health records, PACS imaging or lab systems and halts clinical operations.
- Phishing emails aimed at busy clinical and administrative staff to steal credentials.
- Identity and credential misuse, including shared logins, accounts left active after staff leave, and excessive administrator rights.
- Insider threats and human error, such as staff viewing records without a clinical reason or sending files to the wrong recipient.
- Legacy systems and connected medical devices that cannot be patched quickly and sit on flat, unsegmented networks.
- Third-party and cloud exposure from vendors, billing partners and software suppliers with remote access to patient data.
10 Healthcare Data Security Best Practices
1. Map and classify every type of health data
You cannot protect what you have not found. Build an inventory of where patient data lives — EHR, PACS, laboratory systems, billing, email and shared drives — and classify it by sensitivity. Article 26 also requires you to document every stage of health data processing and identify who is responsible for each stage.
2. Grant access on a need-to-know basis
Article 26 requires duties to be divided between staff and access to be graded according to role. Use role-based access so a receptionist, a nurse and a radiologist each see only what their job requires, and review access rights regularly.
3. Secure identities first
Identity security is now the front line of healthcare data security. Enforce multi-factor authentication for remote and privileged access, remove shared accounts, manage administrator rights through privileged access management, and switch off accounts the day a staff member or contractor leaves. Keep a controlled "break-glass" procedure for emergency clinical access and log every use.
4. Encrypt data at rest and in transit
SDAIA's PDPL guide lists cybersecurity controls such as data encryption among the technical measures expected of organisations. NCA's Data Cybersecurity Controls (DCC-1:2022) also set minimum requirements for protecting data throughout its lifecycle, which makes them a useful benchmark for classification and encryption. Encrypt databases, laptops, backups and mobile devices, and use secure protocols for every transfer between systems, insurers and partners.
5. Collect and keep only what you need
Article 26 limits health data processing to the minimum needed to provide healthcare or health insurance services. Remove unnecessary fields from forms, set retention periods, and securely delete or anonymise data you no longer need.
6. Hold vendors and processors to the same standard
Article 26 requires contracts with processors to oblige them to follow the same health data procedures. Add security clauses, audit rights and breach-notification duties to every vendor contract, and check where cloud providers store your data and whether any transfer outside the Kingdom meets the PDPL cross-border data transfer rules.
7. Patch, segment and protect medical devices
Keep an asset list of connected medical devices, patch what you can, and isolate what you cannot on separate network segments. A compromised infusion pump or imaging workstation should never be able to reach the EHR database.
8. Monitor, log and audit access
Log who accessed which record and when, and review the logs. Unusual patterns — a user opening hundreds of records, or access at 3 a.m. from a new device — are often the first sign of an insider issue or a stolen account. Continuous monitoring is also central to the defence domain of the NCA Essential Cybersecurity Controls.
9. Make backups ransomware-proof
Keep encrypted, offline or immutable backups of critical clinical systems and test restoring them. A backup that has never been restored is an assumption, not a recovery plan.
10. Train staff continuously
Most breaches involve a human step. Run short, regular awareness sessions on phishing, password hygiene and safe handling of patient files, and make it easy for staff to report a suspicious email.
Healthcare Data Security Solutions: The Technology Stack
Best practices need the right tools behind them. The table below links each security need to the solution that supports it.
| Security need | Solution | What it protects |
|---|---|---|
| Control who gets in | Identity and access management (IAM) with MFA and privileged access management (PAM) | User accounts, administrator rights, remote access |
| Stop malware on devices | Endpoint detection and response (EDR/XDR) | Workstations, servers, clinical PCs |
| Prevent data leaving | Data loss prevention (DLP) and email security | Patient files, reports, emails |
| See attacks early | SIEM with a security operations centre (SOC) | Logs, alerts and access across all systems |
| Make stolen data useless | Encryption and key management | Databases, backups, laptops, transfers |
| Recover from ransomware | Immutable and offline backup | EHR, PACS, laboratory and billing systems |
Choose solutions that produce evidence — reports, logs and dashboards — because during an audit you need to show that a control works, not just that it was purchased.
When a Breach Happens: The 72-Hour Rule
Article 24 of the PDPL Implementing Regulation requires the controller to notify the competent authority within 72 hours of becoming aware of a personal data breach that could harm patients or their rights. A clear sequence keeps the response on time:
- Contain — isolate affected systems and accounts, and preserve evidence.
- Assess — identify what data, which patients and which systems are involved.
- Notify the regulator — report to the competent authority within 72 hours, adding details later if they are not yet available.
- Notify patients — where the breach could harm them, inform them without undue delay in clear, simple language, with steps they can take.
- Recover — restore services from clean backups and close the root cause.
- Review — update policies, controls and training so the same gap does not reopen.
Enforcement is real: SDAIA has already issued its first wave of PDPL enforcement decisions, covered in our analysis of PDPL enforcement in Saudi Arabia and SDAIA's 48 decisions.
The Benefits of Strong Healthcare Data Governance
Good data security is not only about avoiding penalties. Well-governed health data delivers:
- Patient trust, because patients share more accurate information when they believe it is safe.
- Uninterrupted care, because resilient systems keep clinics running during an incident.
- Cleaner, more reliable data for clinical decisions, insurance claims and reporting.
- Faster audits and partnerships, because documented controls make it easier to work with insurers, government programmes and technology partners.
Building a Security-First Culture
Technology and policies only work when people follow them. Give data protection a named owner at leadership level, make security part of induction and annual training, and treat every near-miss as a lesson rather than a blame exercise.
For compliance officers, data protection officers and IT security managers who need a structured grounding in both privacy and security duties, the online course Healthcare Data Privacy and Security Compliance (HIPAA + PDPL) covers the legal framework for health data, governance roles, and cybersecurity and technical controls in healthcare. Teams responsible for the NCA control set can add the NCA ECC Cybersecurity course.
Conclusion
Healthcare data security in Saudi Arabia is now clearly defined: protect health data as sensitive data, follow Article 26 of the PDPL Implementing Regulation, apply NCA controls where they apply, secure identities, and be ready to report a breach within 72 hours. Start with a data map and an access review — those two steps alone close many of the gaps behind most healthcare breaches.
