Cybersecurity for healthcare that cannot stop

Brazil’s LGPD (General Data Protection Law) treats health information as sensitive personal data and requires technical and administrative controls to prevent incidents; the ANPD, the national data protection authority, enforces it and applies sanctions. On top of that come the standards of ANVISA, the health regulatory agency, for medical technologies, systems and devices, the guidelines of the CFM (Federal Council of Medicine), contractual requirements with health plan operators and partners, applicable ISO standards and ONA certification.

Under the LGPD (PT), Brazil’s General Data Protection Law, health data is sensitive personal data (art. 5, II) and may only be processed in the cases set out in art. 11: with the data subject’s specific and highlighted consent or, without it, when indispensable, for example, to comply with a legal or regulatory obligation, for studies by a research body or for the protection of health, in a procedure performed by health professionals, health services or a health authority. The law prohibits controllers from sharing health data to obtain economic advantage, except in cases such as the provision of health services for the benefit of data subjects (art. 11, § 4), and forbids health plan operators from using this data for risk selection (art. 11, § 5). The institution must also adopt technical and administrative security measures (art. 46) and notify the ANPD and the data subjects of any incident that may cause relevant risk or harm (art. 48). Vortex supports LGPD compliance through its consulting and is ISO/IEC 27701 certified, for privacy management.

The resolution of the Federal Council of Medicine regulates the use of artificial intelligence in medicine, has been in force since August 2026, 180 days after publication, and also applies to systems that were already in use or under development at medical institutions. Institutions must assess the risk level of each AI system (low, medium or high, described in Annex II, or unacceptable), maintain continuous governance, specialized auditing and monitoring, protect data, models and environments against loss, alteration, unauthorized access and leakage, and process data in accordance with general personal data protection (art. 16, as corrected on March 5, 2026). The physician remains responsible for decisions, records the use of AI as support in the medical record and may not use systems without minimum information security standards compatible with sensitive data.

With Vortex AI Journey, where the recommended starting point is the AI Journey Assessment, of maturity in AI governance and security, with references such as ISO/IEC 42001, the OWASP Top 10 for LLM Applications and MITRE ATLAS. Protection can include discovering and controlling shadow AI, preventing leakage of sensitive data in prompts, uploads and integrations with generative AI, and classifying sensitive data, with a focus on the LGPD. Telemetry from AI security solutions can be integrated into the Cyber Defense Center, the Vortex NG-SOC Convergente, which operates 24x7x365.

Because of the criticality of its operations. System unavailability interrupts care, exams, surgeries and treatments and can put lives at risk, which makes the sector especially vulnerable to prolonged shutdowns and extortion. In addition, health information is sensitive personal data under the LGPD, and the leakage of this data is one of the sector’s risks.

With layers that add up: discovery and classification of sensitive data, data loss prevention (DLP) across network, endpoint and cloud, including in generative AI tools, and identity and access management with the principle of least privilege. Vortex itself is ISO/IEC 27701 certified, for privacy management.

Starting with visibility: mapping connected equipment, its communication flows and its operational particularities, with agents, sensors and connectors integrated with the technologies the institution already uses. On top of this inventory come network segmentation, dedicated monitoring, policies compatible with clinical environments and vulnerability management that considers the clinical and operational criticality of each asset.

With the behavioral analytics (UEBA) of the Cyber Defense Center, the Vortex NG-SOC Convergente. The platform learns the normal behavior of users, devices and services and flags deviations such as atypical access, lateral movement, anomalous use of credentials, data exfiltration and abuse of privileged accounts. It is an effective layer against insider threats and attacks with legitimate credentials, which controls based solely on signatures or rules cannot see.

Through automation: alerts arrive enriched with threat intelligence, and triage, containment and mitigation are orchestrated by playbooks approved by the institution, from a library of more than 3,000, which reduces response time (MTTR) in environments where time is critical. Whatever is not resolved automatically goes to the Vortex incident response team, which conducts the analysis, containment, eradication and recovery support. When several teams need to act together, Vortex opens a virtual war room, which stays open 24 hours a day.

Yes. Vortex is certified to ISO/IEC 27001 (information security), ISO/IEC 27701 (information privacy) and ISO 22301 (business continuity). With 27001 and 27701, Vortex’s own processes and the handling of client information follow international security and privacy standards, which matters to anyone dealing with patient data.

Yes. In healthcare, Vortex serves Assim Saúde, Central Nacional Unimed and the Instituto de Tecnologia em Imunobiológicos Bio-Manguinhos. The Bio-Manguinhos case is published: the institute is served by the Vortex 24x7x365 SOC, with SOAR and vulnerability management; the first technologies were deployed in 40 days, ahead of the 60-day deadline, and an attack suffered in 2023 was contained. See the case.