Three clinical systems widely used in Switzerland turned out to have more than 40 medium or severe vulnerabilities. The flaw was not in the hospitals.

Picture this: an aesthetic medicine clinic in Zurich signs up with an online booking provider. To connect it to the clinic’s software, the provider asks for permanent remote access, in case something needs fixing. Nobody asks who at that company can use it, from where, or how it is logged. Two years later, the clinic has six suppliers with similar access and no list of them.

When people talk about cybersecurity at a clinic, they think of the antivirus and the password at reception. The Swiss findings of 2025 point somewhere else: to the software the clinic buys and to the people who maintain it.

What the national testing institute found.

In January 2025, the National Test Institute for Cybersecurity (NTC) published the results of a year spent analysing three clinical information systems widely used in Swiss hospitals, under real conditions. It found more than 40 medium or severe vulnerabilities, three of them of the highest criticality. According to the report, many were so obvious and easy to exploit that, within a few hours of testing, they allowed full control of the system and of patient data.

The report adds two details worth reading slowly. First, some manufacturers asked the institute and the hospitals to sign confidentiality agreements that would have prevented them from warning others affected, and the NTC refused. Second, most of the flaws have since been fixed, but some underlying problems require the software’s architecture to be rebuilt, which, according to the manufacturers themselves, may take several years.

What changed in 2025.

Since 1 April 2025, Swiss information security law has required a list of organisations to report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovering it. The list includes healthcare institutions on a cantonal hospital list and also, less often mentioned, makers of software used by critical infrastructure where the software has remote maintenance access. Since October 2025, anyone who ignores a formal order from the BACS faces a fine of up to 100,000 francs.

According to the BACS annual report as cited in the Swiss press, 222 mandatory reports came in during 2025, almost one a day, on top of 64,733 voluntary ones. And in August 2025, 18 hospitals founded an association to share information about attacks, the Healthcare Cyber Security Center, open since September to hospitals with a public mandate.

The blind spot: the private clinic is on its own.

An aesthetic, dental or longevity clinic that is not on the cantonal hospital list is generally under no duty to report, and cannot join the association the hospitals created. It can report to the BACS voluntarily, and it is worth knowing that. But it shares information with nobody as a matter of course, and its suppliers, for the website, the booking system, the chatbot or the CRM, usually have more access than anyone has written down.

The law itself recognises the risk: it includes makers of software with remote maintenance access among those required to report. If the legislator treats that access as a door to be watched in a hospital, it is one in a private clinic too.

Your clinic is as secure as the least watched supplier that holds a key.

Where I stand.

I think a private clinic should ask its digital suppliers for what the institute recommends to hospitals: security requirements written into the contract before buying, regular testing, timely updates, a patient network kept apart from the working network, and no confidentiality agreement that stops it warning whoever it should. And a living list of who has access to what. The website and the contact form belong on that list, because that is where health data comes in. Security is not bought with the software. It is demanded in the contract and checked afterwards.

Whether your clinic is required to report is something the BACS itself will confirm on request, or your legal adviser. I am not a lawyer, and this note does not replace that advice.

What I would check.

• The access list. Which suppliers can get into your systems, with which account and from where.
• The contracts. Whether they include security requirements, deadlines for fixes and a duty to tell you about an incident.
• The silence clauses. Whether any agreement stops you from telling others affected, or the authorities, about a flaw.
• The website form. Where the data a patient leaves is stored and who can see it.
• The 24-hour plan. Whom the clinic calls if something fails on a Saturday, and who decides to report it.

Where to start.

1. This week

   Make the list

   Every supplier with access to your systems, your website or your data, and what access each has.

2. This month

   Read the contracts

   Security, incident notification and confidentiality, supplier by supplier.

3. This quarter

   Close doors

   Remove access nobody uses and separate the patient network from the working one.

4. Every year

   Test

   An independent security test of the website and of the systems that handle patient data.

A question for the next committee meeting: if your clinical software provider discovered a serious vulnerability tomorrow, how long would it take you to find out? And from whom: the provider, the press or a patient?

And another that almost nobody asks out loud: how many people who do not work at your clinic can get into your systems today, and when did anyone last review that list?

If you would like me to review where your patients’ data enters your website today and who else touches it, start with the Strategic Diagnostic. Which providers to keep, and on what terms, is for your clinic’s management to decide, not a designer.