Austrian HealthCERT established for healthcare cybersecurity; health-sector entities face new incident-reporting duty
A new § 8a in Austria's Health Telematics Act (Gesundheitstelematikgesetz 2012 – GTelG 2012) creates the 'Austrian HealthCERT,' a specialist cyber-incident-response team for healthcare, and requires essential and important health-sector facilities to report cybersecurity incidents to it. The provision enters into force nine months after publication of BGBl. I Nr. 94/2025, on the first of the following month.
What changed
A new § 8a inserts the 'Austrian HealthCERT' into the Health Telematics Act as a sector-specific computer emergency response team (CSIRT) for healthcare. The federal health minister is legally responsible for running it and may assign it additional tasks by ministerial ordinance, with the option to engage a private service provider. A strategic advisory body — the Cybersecurity Committee for eHealth (CSAeH) — is also established, bringing together federal and provincial government partners under federal chairmanship.
Who is affected
Healthcare facilities and other entities classified as 'essential' or 'important' under Austria's Network and Information Systems Security Act 2026 (NISG 2026) that operate in the healthcare sector. They must now send their sector-specific cybersecurity incident reports (under NISG 2026 §§ 34 and 37) to the Austrian HealthCERT; all other reporting duties remain unaffected.
What to look out for
The new § 8a takes effect nine months after publication of BGBl. I Nr. 94/2025, on the first of the month following that period (§ 26 para. 22). In a separate clean-up, § 27 para. 14 was updated to remove references to already-expired sub-paragraphs (12a/12b), with no change to the rule's substance.