Healthcare Cybersecurity in Ethiopia: Current Status and Way to Move forward
Cybersecurity in Healthcare is a Global Challenge
The digitalization of healthcare institutions is an accelerating development, not only in developed countries, but also in developing countries like Ethiopia [1]. The digitalization of healthcare promotes the exchange of health data [2], streamlines patient treatment, increases patient safety [3] and improves the availability, both for patients and for medical professionals [4].
However, this trend comes with a risk. The increased digitalization leads to more cyber incidents [5]. This trend is reflected globally, cyber-attacks cause substantial financial damage, disrupt patient treatment, and can even cause physical harm for patients [6].
Developed countries have created extensive security measures for cybersecurity in healthcare, such as machine learning-based intrusion-detection-systems [7], comprehensive training programs, and advanced encryption of medical data [8].
But how is the situation in third-world countries like Ethiopia? How do health professionals (HCPs) in this region practice cybersecurity?
Cybersecurity behavior of Ethiopian Healthcare Professionals
In their study Gebeyew et al. 2025 focused on analyzing the cybersecurity behavior of HCPs in Ethiopia. They conducted a survey with 402 professionals from the Amhara Region in Ethiopia. Additionally, they performed seven semi-structured interviews with key informants with greater insight of the cybersecurity practice of Ethiopian HCPs [1].
The vast majority of Ethiopian HCPs taking part at the survey uses digital technologies routinely. 92% of them use digital devices to handle health data daily, 98% use the internet and 63% have basic computer skills. However, more than 80% hadn’t received cybersecurity training before, more than 50% stated that they had poor cybersecurity knowledge, but had favorable behaviors in practicing cybersecurity [1].
The subsequent interviews unveiled, that Ethiopian HCPs lack cybersecurity skills. For example, data is exchanged without encryption. Different challenges became apparent, examples are age and education, that strongly influenced the cybersecurity behavior, as well as a lack of training and infrastructure [1].
Improving the Cybersecurity Situation in Developing Countries
In their review Hasegawa et al. investigated which factors facilitate and which factors hinder cybersecurity interventions in low- and middle-income countries (Figure 1) [9].
Figure 1: Facilitators and Barriers for Cybersecurity Interventions in Low- and Middle-Income Countries [9]
Their analysis underscores key results of the work from Gebeyew et al. 2025. Both papers identify national or regional factors like cybersecurity policies, organizational factors like staff engagement and infrastructure, and individual factors like staff training as key elements for improving cybersecurity [1, 9]
With regards Amhara Region in Ethiopia it is alarming that more than 80% of HCPs hadn’t received cybersecurity trainings yet, although staff with knowledge on digital data security was 76.6% more likely to practice it [1]. Practical and systematic training concepts that consider key factors like age and education of HCPs in this region should be a key initiative for improving cybersecurity. Such trainings could be conducted in specialized teaching hospitals [1]. In terms of policy, in mid-2024 the Ethiopian government passed a Data Protection Proclamation, which is a central step in protecting personal data, especially sensitive date like health data [10]. Developing countries like Ethiopia will have to focus on solutions they can implement with fever resources at first, especially in organizational policies, such as password policies and awareness campaigns. When they have implemented a basic security level, additional security solutions should follow.
References
- Gebeyew AS, Zemene W, Tilahun BC, Mengestie ND, Endehabtu BF, Wordofa ZR, et al. Digital health data security practices among health professionals in low-resource settings: cross-sectional study in Amhara Region, Ethiopia. BMC Med Inform Decis Mak. 2025;25:60. doi:10.1186/s12911-025-02902-2.
- Holmgren AJ, Esdar M, Hüsers J, Coutinho-Almeida J. Health Information Exchange: Understanding the Policy Landscape and Future of Data Interoperability. Yearb Med Inform. 2023;32:184–94. doi:10.1055/s-0043-1768719.
- Li E, Clarke J, Ashrafian H, Darzi A, Neves AL. The Impact of Electronic Health Record Interoperability on Safety and Quality of Care in High-Income Countries: Systematic Review. J Med Internet Res. 2022;24:e38144. doi:10.2196/38144.
- Lyles CR, Nelson EC, Frampton S, Dykes PC, Cemballi AG, Sarkar U. Using Electronic Health Record Portals to Improve Patient Engagement: Research Priorities and Best Practices. Ann Intern Med. 2020;172:S123-S129. doi:10.7326/M19-0876.
- Choi SJ, Chen M, Tan X. Assessing the impact of health information exchange on hospital data breach risk. Int J Med Inform. 2023;177:105149. doi:10.1016/j.ijmedinf.2023.105149.
- Iftikhar S. Cyberterrorism as a global threat: a review on repercussions and countermeasures. PeerJ Comput Sci. 2024;10:e1772. doi:10.7717/peerj-cs.1772.
- Alalhareth M, Hong S-C. An Adaptive Intrusion Detection System in the Internet of Medical Things Using Fuzzy-Based Learning. Sensors (Basel) 2023. doi:10.3390/s23229247.
- Cartwright AJ. The elephant in the room: cybersecurity in healthcare. J Clin Monit Comput. 2023;37:1123–32. doi:10.1007/s10877-023-01013-5.
- Hasegawa K, O’Brien N, Prendergast M, Ajah CA, Neves AL, Ghafur S. Cybersecurity Interventions in Health Care Organizations in Low- and Middle-Income Countries: Scoping Review. J Med Internet Res. 2024;26:e47311. doi:10.2196/47311.
- FEDERAL DEMOCRATIC REPUBLIC OF ETHIOPIA. Personal Data Protection Proclamation: Proclamation No. 1321 /2024; 24.07.2024.
Grigori Rogge
