Cybersecurity Vulnerabilities and Data Privacy in Modern Healthcare Systems: A Systematic Review

Abstract

Background: Healthcare has become one of the most heavily digitised and most frequently attacked sectors. Electronic records, connected medical devices, telemedicine platforms and artificial intelligence (AI) now depend on a large and often fragile digital infrastructure.

Objective: This review identifies, compares and critically analyses the cybersecurity vulnerabilities and data-privacy risks reported for modern healthcare systems. It also evaluates the technical, organisational, legal and equity-related responses proposed in the literature.

Methods: A review protocol was developed following the PRISMA 2020 statement. Eligibility criteria, information sources, selection, data extraction and synthesis are reported in Table 1. Findings were integrated through an analytical thematic synthesis and compared across earlier reviews and across regulatory regimes.

Results: Seven interlocking themes emerged: (i) a threat landscape dominated by ransomware, phishing and insider error; (ii) weak security in connected devices and smart environments; (iii) the limits of de-identification and the promise of privacy-enhancing technologies; (iv) organisational and leadership failures; (v) inequity and stigma as privacy harms; (vi) fragmented legal frameworks; and (vii) systemic resilience, including supply chains, remote work and infrastructure.

Conclusion: Healthcare security is a patient-safety problem and not only an information-technology problem. Technical controls fail without governance, workforce capacity and legal clarity. Privacy harms fall unevenly on vulnerable populations. A layered, equity-aware and leadership-driven model of "security by design" is proposed.