Filter Search for grants
Call Navigation
Call key data
Dedicated action to reinforcing hospitals and healthcare providers
Funding Program
Digital Europe
Call number
DIGITAL-ECCC-2025-DEPLOY-CYBER-08-CYBERHEALTH
deadlines
Opening
12.06.2025
Deadline
07.10.2025 17:00
Funding rate
50%
Call budget
€ 30,000,000.00
Estimated EU contribution per project
between € 3,000,000.00 and € 5,000,000.00
Link to the call
Link to the submission
Call content
short description
This action aims to strengthen the cybersecurity of hospitals and healthcare providers. The goal is to ensure that hospitals and healthcare providers, which are crucial operators in the health sector, can effectively detect, monitor, and respond to cyber threats, particularly ransomware, which pose significant risks, thereby enhancing the resilience of the European healthcare system. The action will contribute to the EU action plan on cybersecurity in hospitals and healthcare, adopted by the Commission in January 2025.
Call objectives
This action addresses the growing need for continuous cybersecurity monitoring, threat intelligence, and incident response in hospitals and healthcare providers, which often lack dedicated cybersecurity resources to adequately protect themselves from cyber threats.
The action will support pilot projects, which will bring together stakeholders such as regional and/or national clusters associations of hospitals and healthcare providers (such as national healthcare systems, hospitals or associations of hospitals, healthcare providers and/or professional associations of healthcare practitioners), as well as cybersecurity service providers.
The pilot projects will define the state of preparedness of clusters of hospitals and healthcare providers in the European Union, to be able to assess their needs. Based on this analysis, they will prepare an overview of the state-of-the-art cybersecurity solutions and resources needed (technologies, services, tools, human resources, training needs, etc.) for hospitals and healthcare providers to meet the scope of the action. These may include, for example: Security Operation Centres offering real-time monitoring, threat detection, and rapid incident response, and advanced cybersecurity tools, such as Security Information and Event Management (SIEM) platforms, threat intelligence, and automated response capabilities, among others.
The pilots will develop technical plans, tailored to the needs of representative hospitals and healthcare providers (e.g. small or large hospitals, private healthcare providers, etc.) which will also need to include best implementation recommendations and cost estimates for effective deployment.
The pilot projects will conduct a demo implementation of these technical plans to demonstrate their effectiveness in operations at the stakeholders’ sites, showcasing different use cases for different user groups at small, medium and large hospitals and healthcare providers, at least in two different Member States.
The pilot projects will serve as demonstration projects and will also provide cybersecurity education and training to the staff of their partner hospitals and healthcare providers, enhancing awareness and ensuring best practices in safeguarding sensitive healthcare information.
Finally, in cooperation with each other, the pilot projects will undertake wide dissemination activities of best practices across the EU, with the specific goal of helping replicate and scale up the pilots’ activities as widely as possible.
The pilot projects will support healthcare institutions complying with the NIS 2 Directive.
read more
Expected results
- Mapping of common cybersecurity needs of hospitals and healthcare providers.
- Guidelines for healthcare providers to assess their current state of cybersecurity protection and relevant needs.
- Technical cybersecurity plans to enhance preparedness and cyber resilience: improved detection and response capabilities for healthcare institutions minimising the impact of cyberattacks, particularly for ransomware. This also includes dedicated training courses to staff.
- Pilot cybersecurity demo installations at partner hospitals and healthcare provider sites to ensure hospitals and healthcare providers can maintain operational continuity in the face of cybersecurity incidents. This should be monitored through specific KPIs.
- Wide dissemination campaigns to help scale up preparedness of hospitals and healthcare providers in Europe.
Applicants should provide KPI’s and metrics relevant for the action to measure progress and performance. Proposals may include the indicators listed below or those of their choice.
When applicable, baseline and target values must be provided.
- Number of cybersecurity and/or tools deployed;
- Number of users and user communities getting access to the tools deployed;
- Number of entities supported in strengthening preparedness for and response to major cybersecurity incidents;
- Number of tools, methods, organisational and management practices dedicated to detection and response capabilities for minimising the impact of cyberattacks, adopted in healthcare and health institutions, and in particular small and medium-size entities;
- Number of cybersecurity dedicated training courses to healthcare institutions staff;
- Number of pilot cybersecurity demo installations at partner hospitals and healthcare provider sites;
- Number of people reached by dissemination campaigns.
read more
Eligibility Criteria
Regions / countries for funding
Iceland (Ísland), Liechtenstein, Norway (Norge)
eligible entities
Education and training institution, Non-Profit Organisation (NPO) / Non-Governmental Organisation (NGO), Other, Private institution, incl. private company (private for profit), Public Body (national, regional and local; incl. EGTCs), Research Institution incl. University, Small and medium-sized enterprise (SME)
Mandatory partnership
Yes
Project Partnership
In order to be eligible, the applicants (beneficiaries and affiliated entities) must:
- be legal entities (public or private bodies)
- be established in one of the eligible countries, i.e.:
- EU Member States (including overseas countries and territories (OCTs))
- EEA countries (Norway, Iceland, Liechtenstein)
Specific cases
Natural persons are NOT eligible (with the exception of self-employed persons, i.e. sole traders, where the company does not have legal personality separate from that of the natural person).
International organisations are NOT eligible, unless they are International organisations of European Interest within the meaning of Article 2 of the Digital Europe Regulation (i.e. international organisations the majority of whose members are Member States or whose headquarters are in a Member State).
Entities which do not have legal personality under their national law may exceptionally participate, provided that their representatives have the capacity to undertake legal obligations on their behalf, and offer guarantees for the protection of the EU financial interests equivalent to that offered by legal persons.
EU bodies (with the exception of the European Commission Joint Research Centre) can NOT be part of the consortium.
Entities composed of members may participate as ‘sole beneficiaries’ or ‘beneficiaries without legal personality’. Please note thatif the action will be implemented by the members, they should also participate (either as beneficiaries or as affiliated entities, otherwise their costs will NOT be eligible).
Beneficiaries from countries with ongoing negotiations for participating in the programme (see list of participating countries above) may participate in the call and can sign grants if the negotiations are concluded before grant signature and if the association covers the call (i.e. is retroactive and covers both the part of the programme and the year when the call was launched).
Special rules apply for entities subject to EU restrictive measures under Article 29 of the Treaty on the European Union (TEU) and Article 215 of the Treaty on the Functioning of the EU (TFEU). Such entities are not eligible to participate in any capacity, including as beneficiaries, affiliated entities, associated partners, subcontractors or recipients of financial support to third parties (if any).
Special rules apply for entities subject to measures adopted on the basis of EU Regulation 2020/2092. Such entities are not eligible to participate in any funded role (beneficiaries, affiliated entities, subcontractors, recipients of financial support to third parties, etc). Currently such measures are in place for Hungarian public interest trusts established under the Hungarian Act IX of 2021 or any entity they maintain (see Council Implementing Decision (EU) 2022/2506, as of 16 December 2022).
other eligibility criteria
This topic targets in particular stakeholders such as regional and/or national clusters associations of hospitals and healthcare providers (such as national healthcare systems, hospitals or associations of hospitals, healthcare providers and/or professional associations of healthcare practitioners), as well as cybersecurity service providers.
Proposals must be submitted by minimum 2 independent applicants (beneficiaries; not affiliated entities) from at least 2 eligible countries.
Additional information
Topics
Relevance for EU Macro-Region
EUSAIR - EU Strategy for the Adriatic and Ionian Region, EUSALP - EU Strategy for the Alpine Space, EUSBSR - EU Strategy for the Baltic Sea Region, EUSDR - EU Strategy for the Danube Region
UN Sustainable Development Goals (UN-SDGs)
project duration
18 or 24 months
Additional Information
Applications must be submitted electronically via the Funders & Tenders Portal electronic submission system (accessible via the topic page in the Search Funding & Tenders section). Paper submissions are NOT possible.
Proposals must be complete and contain all the requested information and all required annexes and supporting documents:
- Application Form Part A — contains administrative information about the participants (future coordinator, beneficiaries and affiliated entities) and the summarised budget for the project (to be filled in directly online)
- Application Form Part B — contains the technical description of the project (template to be downloaded from the Portal Submission System, completed, assembled and re-uploaded)
- mandatory annexes and supporting documents (templates to be downloaded from the Portal Submission System, completed, assembled and re-uploaded):
- ownership control declarations (including for associated partners and subcontractors)
Proposals are limited to maximum 70 pages (Part B).
Call documents
Call Document DIGITAL-ECCC-2025-DEPLOY-CYBER-08Call Document DIGITAL-ECCC-2025-DEPLOY-CYBER-08(kB)
Contact
applicants@eccc.europa.eu
Website
To see more information about this call, you can register for free here
or log in with an existing account.
Log in
Register now