Africa’s healthcare systems are becoming more digital. Electronic health records, hospital information systems, telemedicine and connected medical devices are changing how patient information is collected and used. These technologies can improve access to care and support clinical decisions, but they also make reliable digital infrastructure essential to everyday healthcare.

That raises a question that deserves more attention: who is accountable for keeping digital health systems secure, available and trustworthy?

This is not simply a technical question. It is a question of governance, patient safety and institutional responsibility.

Digital health is critical infrastructure

A hospital’s digital environment may include patient records, laboratory systems, pharmacy applications, medical devices, networks and services supplied by external vendors. These components increasingly depend on one another. If a critical system becomes unavailable, the consequences can reach beyond administrative inconvenience and affect clinical workflows, service continuity and patient confidence.

A systematic review by Ewoh and Vartiainen (2024) describes healthcare cybersecurity as a socio-technical challenge. It identifies human error, underinvestment, connected devices, legacy systems and rapid digitalisation among the factors that leave healthcare systems vulnerable. The lesson is straightforward: technology alone cannot secure a health system. People, processes and organisational decisions matter too.

The problem is bigger than hackers

Public discussions of cybersecurity often focus on external attackers, malware and data breaches. Those threats are real, but weaknesses can also grow out of routine institutional practices.

Staff may share accounts because individual access is inconvenient. Former employees may retain access after leaving. Software updates may be delayed because maintenance could interrupt clinical services. Backups may exist without regular restoration tests. A hospital may depend on a vendor without having clearly agreed who handles security incidents or how access will be removed when a contract ends.

These are examples of risks institutions should assess, not claims that every hospital experiences them. Their significance is that cybersecurity controls are difficult to sustain when responsibilities are unclear, staff are not trained or managers treat security as an IT department’s problem alone.

Cybersecurity governance must connect technical safeguards with the institutional conditions that determine whether those safeguards work in practice.

Shared responsibility must not mean unclear accountability

Health ministries set policy and allocate resources. Hospital executives oversee institutional priorities. IT teams operate systems and respond to incidents. Clinical teams depend on digital services. Vendors supply platforms and technical support. Regulators establish legal and professional expectations.

All these actors have a role, but responsibility can become fragmented. A hospital may assume that a vendor is responsible for security, while the vendor expects the hospital to manage user access and staff behaviour. Senior management may receive technical updates without a clear picture of the clinical consequences of a disruption.

A scoping review by Chumba et al (2025) finds that health information technology governance is operationalised through governance mechanisms and context-specific practices, and that the literature has concentrated mainly on hospital and national systems. The authors also report that the alignment aspect of governance is not addressed in the reviewed studies, although they regard it as essential. This supports a practical point: institutions need to connect national policy, organisational priorities and day-to-day system management.

Hospital leadership should oversee significant digital risks. IT teams should implement and monitor controls. Clinical leaders should help ensure that security measures fit safe workflows. Vendors should be bound by clear contractual obligations. Someone must be responsible for ensuring that these parts work together.

Security begins before a system is purchased

Procurement is one of the most consequential, and often least visible, cybersecurity decisions. A hospital buying a digital platform is also entering a relationship that may determine how patient data is accessed, where it is processed, how vulnerabilities are fixed and how services can be restored if the provider becomes unavailable.

Purchasing decisions based mainly on price and immediate functionality can create long-term risks. Before signing a contract, healthcare institutions should assess whether a provider supports strong authentication, appropriate encryption, timely security updates, incident reporting, tested recovery arrangements and clear limits on vendor access. Contracts should also address data retrieval and migration if the relationship ends.

These requirements should reflect the sensitivity and clinical importance of the system. They also need to be checked after deployment. A contract is not a substitute for ongoing oversight. Ghana’s policy ambitions need operational follow-through

Ghana already has legal instruments that address data protection and cybersecurity. A scoping review of digital health governance in Ghana by Nyarko et al. (2026) notes that the Data Protection Act, 2012 and the Cybersecurity Act, 2020 establish obligations on data processing, security safeguards and the protection of critical information infrastructure, although these laws apply across sectors rather than being designed specifically for health. The same review concludes that Ghana’s digital health challenges reflect a governance execution gap rather than an absence of strategies or technologies. Authority is spread across several institutions, and compliance with security safeguards is variable.

Hospital-level evidence points the same way. In a survey of 307 doctors and nurses in hospitals with at least 50 beds in Kumasi, conducted in 2021, Ofori et al (2026) found that the hospitals studied lacked an organisation-wide information governance programme and that staff awareness of health information security was low. Over half of respondents (53%) showed limited awareness of programmes for managing confidential health information, and 24.7% reported having experienced a data breach. This is a single-city study and should not be generalised to all facilities, but it shows why implementation needs to be assessed where services are actually delivered.

Policy documents are important, but their value depends on implementation. Hospitals need to know which systems are most critical, who owns them, which users can access them, how incidents are escalated and how essential services will continue during disruption. They also need recurring resources for maintenance, staff training, incident response and recovery.

The wider lesson applies across Africa: digital health ambitions must be matched by institutional capacity. This is not a claim that every facility has the same weaknesses. It is a call to assess implementation at the level where digital services are actually delivered.

Five practical priorities

African health institutions can make progress by focusing on five priorities:

• 1.Make accountability explicit. Assign a senior leader responsibility for digital risk oversight and require regular reporting on critical systems.
• 2.Know what must be protected. Maintain an inventory of essential applications, infrastructure, data flows, vendors and dependencies. Prioritise protection according to clinical impact.
• 3.Control access. Use individual accounts, least-privilege permissions, multifactor authentication where appropriate, prompt removal of unnecessary access and periodic access reviews.
• 4.Test recovery. Keep protected backups, test restoration and rehearse incident response with technical and clinical teams. An untested recovery plan provides little assurance.
• 5.Govern vendors throughout the relationship. Set security requirements before procurement, review external access, agree incident-notification procedures and preserve the ability to retrieve data and move to another provider.

Not every hospital can immediately establish a sophisticated security operations centre. Every institution can, however, identify its most important risks, assign responsibility and make measurable improvements over time.

Cybersecurity is part of patient safety

Digital health should not be judged only by the number of facilities connected, records digitised or applications deployed. Those measures show adoption, not whether services are secure, dependable and accountable.

A stronger measure of progress asks whether healthcare institutions can protect patient information, maintain essential services during disruption and recover when systems fail. Cybersecurity investment is not simply a cost imposed on innovation. It helps protect the value of digital health itself.

No hospital can eliminate every cyber risk. The responsibility is to understand the most consequential risks, decide who will manage them and prepare credibly for incidents. Africa does not need to choose between expanding digital health and securing it. The two must advance together. Digital health becomes a sustainable public benefit only when governance is built into the systems that deliver it, and patients and health workers can continue to trust those systems.

References

• Chumba, H. K., Waema, T. M., & Ochieng, D. O. (2025). Health information technology governance: A scoping review of literature. Journal of Health Informatics in Africa, 12(1), 1—19. https://doi.org/10.12856/JHIA-2025-v12-i1-509
• Ewoh, P., & Vartiainen, T. (2024). Vulnerability to cyberattacks and sociotechnical solutions for health care systems: Systematic review. Journal of Medical Internet Research, 26, e46904. https://doi.org/10.2196/46904
• Nyarko, S., Atinga, R. A., Bardoe, D., & Owusu, A. N. (2026). Digital health system integration in Ghana: A scoping review of governance arrangements, interoperability aspirations, and regulatory gaps. BMC Health Services Research, 26, Article 529. https://doi.org/10.1186/s12913-026-14324-5
• Ofori, J. A., Jenkins, J., & Yeboah, E. A. (2026). Clinical staff members’ awareness of the security and privacy components of hospital health information governance in Kumasi, Ghana. Health Information Management Journal. Advance online publication. https://doi.org/10.1177/18333583261433386