Patient records, imaging systems and connected medical devices, protected by Sophos and sized by a partner that serves healthcare providers across Canada and the United States. Sophos Silver Partner. Offices in Markham, Ontario and Dallas, Texas. Quotes in CAD and USD, shipping to Canada and the United States. Three questions every healthcare owner asks. Tap a card to jump to the detail. Each row shows what can go wrong, which rule or standard expects you to control it, and the products that do. The tags under each risk show where Sophos or TrendAI name the same risk on their own industry pages or in their research. The EHR, imaging and scheduling go dark, and procedures are canceled until systems are restored. Exploited vulnerabilities started 33% of ransomware attacks on healthcare providers. Source Rules and standards One clicked link hands an attacker a clinician's account and the patient records behind it. The human element was involved in 54% of healthcare incidents. Source Rules and standards What fixes it Pumps and imaging run old software, and vendors keep standing remote access to them. A third party was involved in 32% of healthcare breaches. Source Rules and standards Staff copy notes into a consumer AI tool the clinic has no agreement with. One in five organizations reported a breach due to shadow AI. Source Rules and standards Orange links are Sophos, 1Password, N-able and Axcient products; blue links are TrendAI. A product supports the control; meeting a rule also takes your own policies and records. What breach and ransomware research says about this sector. Every figure links to its source. 1,492 incidents and 1,438 confirmed breaches in the healthcare vertical, Verizon 2026 DBIR. Sophos surveyed 292 healthcare IT and security leaders in 17 countries whose organizations were hit by ransomware. Source: Sophos Healthcare is in the top three of TrendAI's 2026 Cyber Risk Index for the second year running (40.3), held up by devices that cannot be patched without regulatory approval or risk to patient care. TrendAI's Cyber Risk Index combines individual asset and risk-factor scores into one figure for an organization's overall security risk. Bars start at 35 so the gaps are visible. Source: TrendAI 2026 Cyber Risk Report The same four stages appear in nearly every breach. Each stage below shows what it looks like in this sector and the control that breaks the chain. The rules and expectations that shape a security purchase in this sector, in both countries. Status is as of September 2026; check the linked source before relying on a date. What the rules above ask you to do, in everyday words. Three dates and numbers to know first, then the requirements that come up again and again. for an Ontario public hospital to report a critical cyber incident after confirming it, in force July 1, 2026 to restore critical systems after an incident, under the proposed HIPAA update (not final) A password alone is not enough. Staff, admins and anyone working remotely confirm each sign-in with a phone app or key. Covered by: Sophos ITDR finds who is missing it; 1Password; Sophos Workspace Protection Every laptop, desktop and server runs protection that blocks and rolls back ransomware. Covered by: Sophos Endpoint and Endpoint for Server; MDR watches it 24/7 Information is encrypted when it travels and when it is stored on laptops and phones, so a stolen device or intercepted message is unreadable. Covered by: Sophos Firewall VPN, Sophos Mobile, Axcient x360Sync Systems log sign-ins and changes, and the logs are kept long enough to investigate. Covered by: Sophos Next-Gen SIEM, Sophos XDR A written plan for a breach, people to carry it out, and notices sent to regulators and customers within the deadline. Covered by: Sophos MDR Plus responds 24/7 and documents the incident Copies of your data that an attacker cannot delete, and a restore you have actually tested. Covered by: N-able Cove, Axcient x360Recover and x360Cloud A risk assessment and regular scans, with the most dangerous gaps fixed first. Covered by: Sophos Managed Risk, TrendAI Vision One CREM An up-to-date list of every device, including ones that cannot run security software. Covered by: Sophos NDR, Sophos Managed Risk The tags show which rule or buyer asks for each item. Insurers, investors and large customers often ask for the same controls even where no law requires them. Each row is one job your security has to do, in plain words. Pick one product per row from the vendor you prefer: Sophos and TrendAI cover most rows; N-able Cove or Axcient cover backup; 1Password covers passwords. The last column shows the healthcare rule each row helps with. Decide who is responsible, which rules apply and what is allowed. List what you have and find the gaps before attackers do. Firewall, email and device protection, safe logins and remote access. Watch accounts, networks and logs for signs of an attack. Contain an attack fast, work out what happened, and tell the people who need to know. Backups you have tested, so you can restore instead of paying. The six steps are the functions of the NIST Cybersecurity Framework 2.0. TrendAI equivalents appear in the table below. Source A dash means that vendor does not sell a product for that row through Nuformat. A product supports the control; meeting a rule also takes your own policies and records. All 17 Sophos product lines Nuformat sells, what each one does in this sector, and the standard or framework control it supports. This is a high-level map: products supply the technical safeguards, and compliance still depends on your policies, people and evidence. Section and control numbers point to the requirement a product helps with. Your auditor or assessor decides whether the control is met. Nuformat maps a specific questionnaire or assessment to these products on request. Cyber insurance pays for the cost of an attack or a data breach. Before quoting, insurers check a short list of security controls; missing ones raise the premium, cut the limit, or end the conversation. Policies differ. Read the exclusions, waiting period and sublimits, especially for ransomware and social engineering fraud. The list follows Marsh's twelve key cyber controls. Source Where insurers dig deeper: Healthcare applications get the closest look at backups and recovery time, MFA on remote access to clinical systems, and how medical devices that cannot be patched are kept apart. A clinic group with a main site, three satellite clinics, about 120 staff and an on-premises EHR server would typically run: Licenses are sold in 1, 2 or 3-year terms or month to month through Nuformat. Hardware is bought outright or as Hardware as a Service. Every quote states the currency. Send us your site list, user count and any questionnaire you have been given. A Nuformat specialist maps the products to it and returns a quote within two to three business days. Available in Canada and the USA. Sophos Silver Partner. The main ones on this page are listed by country. In the United States: HIPAA Security Rule (in force; HHS proposed an update in January 2025), HHS 405(d) Health Industry Cybersecurity Practices. In Canada, Ontario: O. Reg. 51/26, Enhancing Digital Security and Trust Act. In Canada: PHIPA (Ontario) and provincial health privacy acts. Many organizations also organize the work with the voluntary NIST Cybersecurity Framework 2.0 and its six functions: govern, identify, protect, detect, respond and recover. Check the linked sources for current status and dates. Sophos covers the firewall, endpoint, email, identity, network detection and 24/7 managed detection and response, and TrendAI Vision One offers an alternative for most of the same needs, except the firewall itself. Neither Sophos nor TrendAI sells backup or a password manager through Nuformat, so N-able Cove or Axcient handle backup and recovery, and 1Password Business handles passwords. The feature match table on this page lists each need with the product from each vendor. No product does on its own. HIPAA and PHIPA are obligations on the organization. Sophos supplies the technical safeguards those rules ask for: encryption in transit, MFA and access monitoring, malware protection, logging, and the ability to restore. Nuformat maps the products to the safeguard list so the paperwork matches the network. According to the Verizon 2026 DBIR healthcare snapshot, System Intrusion, which is mostly ransomware, accounts for 61% of healthcare breaches, and exploited vulnerabilities (20%) are now the most common first step, ahead of phishing (14%). Put them on their own network segment behind the Sophos XGS firewall, allow only the traffic they need, and watch that segment with a Sophos NDR sensor. Detection then happens on the wire, so the device itself is never touched. O. Reg. 51/26, in force July 1, 2026, requires public hospitals to name a senior cyber security contact, report critical incidents to the ministry within 72 hours, and submit a cyber maturity assessment by July 1, 2027 and every two years after that. Yes. Nuformat is a Sophos Silver Partner with offices in Markham, Ontario and Dallas, Texas, quotes in CAD or USD, and ships to both countries. It covers much of what insurers ask about: MFA visibility, EDR, email security, logging and 24/7 response through MDR. Backups come from N-able Cove or Axcient. Insurers decide coverage and price, so answer the application accurately; Nuformat can map your current controls to the questionnaire before you submit it.Cybersecurity for clinics, hospitals and health networks.
The page in 30 seconds
See the top risks →
See what they ask for →
See the feature match →1. The problem: your top 4 risks, the rule behind each, and what fixes it
1Ransomware that stops patient care
2Phishing and stolen staff logins
3Medical devices and suppliers you cannot patch
4Patient data pasted into AI tools
The risk in numbers
If ransomware hits a healthcare provider
Ranked #2 of the 10 highest-risk industries
How an attack unfolds here, and where Sophos stops it
What you have to comply with
Where Rule or expectation What it asks for United States HIPAA Security Rule (in force; HHS proposed an update in January 2025) Encryption of ePHI, MFA, annual asset inventory, vulnerability scanning every six months, 72-hour restoration capability. Still a proposal as of September 2026; HHS targets finalization in 2027. Source United States HHS 405(d) Health Industry Cybersecurity Practices Voluntary practices HHS uses as the yardstick after a breach: email protection, endpoint protection, access management, network management, incident response. Source Canada, Ontario O. Reg. 51/26, Enhancing Digital Security and Trust Act Public hospitals must name a senior cyber contact, report critical incidents within 72 hours, and file a cyber maturity assessment by July 1, 2027, then every two years. In force July 1, 2026. Source Canada PHIPA (Ontario) and provincial health privacy acts Custodians must safeguard personal health information and notify the commissioner and patients of breaches. Source 2. The rules, in plain English
1Lock every login with a second step
2Stop malware and ransomware on every computer
3Scramble sensitive data
4Keep a record of who did what
5Have a plan, and report on time
6Back up, and prove you can restore
7Find and fix weak spots on a schedule
8Know everything that is connected
Feature match: what you need, and who covers it
How the pieces fit together
Set the rules
Know your weak spots
Keep attackers out
Spot what gets through
Stop it fast
Get back to work
What you need Sophos TrendAI Backup: N-able Cove or Axcient 1Password Helps meet
ProtectSophos Firewall (XGS) TrendAI Network Security (intrusion prevention, used alongside a firewall) – – HIPAA 164.312(e) transmission security; HICP 6 Network management
ProtectSophos Endpoint
Sophos Endpoint for ServerTrendAI Endpoint Security – – HIPAA 164.308(a)(5)(ii)(B) malicious software; HICP 2 Endpoint protection
ProtectSophos Email TrendAI Email and Collaboration Security – – HICP 1 Email protection; HIPAA 164.308(a)(5)(ii)(B)
Detect and RespondSophos MDR TrendAI MDR – – HIPAA 164.308(a)(6) incident procedures; HICP 8 SOC and incident response
Protect and DetectSophos ITDR TrendAI Identity Security – 1Password Business HIPAA 164.312(a) access control and 164.312(d) authentication; HICP 3; HIPAA 164.308(a)(5)(ii)(D) password management
DetectSophos NDR TrendAI XDR for Networks (NDR) – – HICP 9 Network-connected medical devices; HICP 5 Asset management
ProtectSophos Workspace Protection (ZTNA) TrendAI ZTSA Private Access – – HIPAA 164.312(a) and 164.312(d); HICP 3 Access management
IdentifySophos Managed Risk TrendAI Cyber Risk Exposure Management – – HIPAA 164.308(a)(1)(ii)(A) risk analysis; HICP 7
Protect and DetectSophos Next-Gen SIEM TrendAI Agentic SIEM – – HIPAA 164.312(b) audit controls; HICP 8
Protect and Recover– – N-able Cove for Microsoft 365
Axcient x360Cloud– HIPAA 164.308(a)(7)(ii)(A) data backup plan
Protect and Recover– – N-able Cove for PCs, Macs and servers
Axcient x360Recover– HIPAA 164.308(a)(7)(ii)(B) and (C) emergency mode operation
Protect– – Axcient x360Sync – HIPAA 164.312(e) transmission security; PHIPA s. 12
Govern and ProtectSophos AI Defense TrendAI ZTSA AI Service Access – – HICP 4 Data protection and loss prevention; PHIPA s. 12 safeguards
ProtectSophos Mobile TrendAI Mobile Security protects phones from malicious apps but does not manage, lock or wipe them. – – HIPAA 164.310(d) device and media controls, 164.312(a)(2)(iv) encryption; HICP 2 Every Sophos product line, mapped to healthcare (17 lines)
Sophos product line Use in healthcare Helps meet Sophos Firewall (XGS)Protect Perimeter and clinic-to-clinic SD-WAN; IPS in front of the EHR; VLANs that keep medical devices apart. HIPAA 164.312(e) transmission security; HICP 6 Network management Sophos Virtual FirewallProtect Protects EHR, PACS or billing systems hosted in Azure, AWS or a private cloud. HIPAA 164.312(e); HICP 6 Webserver Protection add-onProtect Shields the patient portal and appointment booking site from web attacks. HIPAA 164.312(c) integrity; HICP 7 Vulnerability management Sophos SwitchProtect Separate ports and VLANs for clinical devices, staff PCs and guests. HICP 6 Network management; HICP 9 Medical devices Sophos AP6 wirelessProtect Separate clinical, staff and patient Wi-Fi with WPA3 and guest isolation. HIPAA 164.312(e); HICP 6 Sophos EndpointProtect Stops ransomware and exploits on nursing stations, front desks and laptops. HIPAA 164.308(a)(5)(ii)(B) malicious software; HICP 2 Endpoint protection Sophos Endpoint for ServerProtect Protects the EHR, PACS and file servers, with ransomware rollback. HIPAA 164.308(a)(5)(ii)(B); HICP 2 Sophos XDRDetect Lets in-house IT investigate alerts across endpoint, firewall and email in one place. HIPAA 164.308(a)(1)(ii)(D) activity review; HICP 8 Sophos MDR and MDR PlusRespond 24/7 analysts who contain an attack at 3 a.m. and support breach reporting. HIPAA 164.308(a)(6) incident procedures; HICP 8 SOC and incident response; O. Reg. 51/26 72-hour reporting (Ontario public hospitals) Sophos ITDRDetect, Respond Finds clinician accounts without MFA, shared logins and stale privileged access. HIPAA 164.312(a) access control and 164.312(d) authentication; HICP 3 Sophos NDRDetect Watches infusion pumps, imaging and lab devices that cannot run an agent. HICP 9 Network-connected medical devices; HICP 5 Asset management Sophos EmailProtect Blocks phishing and look-alike domains aimed at referral and records-request inboxes. HICP 1 Email protection; HIPAA 164.308(a)(5)(ii)(B) Sophos Next-Gen SIEMDetect Keeps logs long enough to answer who saw a record and when. HIPAA 164.312(b) audit controls; HICP 8 Sophos Managed RiskIdentify Finds exposed systems and ranks which vulnerabilities to patch first. HIPAA 164.308(a)(1)(ii)(A) risk analysis; HICP 7 Sophos Workspace Protection (ZTNA)Protect Secure remote access for physicians and billing staff without a full VPN. HIPAA 164.312(a) and 164.312(d); HICP 3 Access management Sophos MobileProtect Enrolls and encrypts phones and tablets used at the bedside; wipes lost devices. HIPAA 164.310(d) device and media controls, 164.312(a)(2)(iv) encryption; HICP 2 Sophos AI Defense Quote on requestGovern, Protect Sees which AI tools staff use and stops patient data being pasted into them. HICP 4 Data protection and loss prevention; PHIPA s. 12 safeguards Cyber insurance: what it pays for and what insurers check
Your own costs
Claims against you
The 12 controls insurers look for
A worked example: a multi-site clinic group
Where What runs there Main site and EHR servers XGS 2300 with Xstream, Sophos Endpoint on servers and PCs, MDR Plus Three satellite clinics XGS 118 or 128 with Xstream, AP6 access points, SD-WAN to the main site Imaging and lab devices Own VLAN behind the firewall, NDR sensor watching it Every mailbox Sophos Email Plus plus MFA, ITDR watching the directory Records and Microsoft 365 Cove backup with a tested restore Get this sized and quoted for your organization
Frequently asked questions
Which cybersecurity rules and frameworks apply to healthcare?
Which products cover the main cybersecurity needs for healthcare?
Does Sophos make a clinic HIPAA or PHIPA compliant?
What is the most common way healthcare organizations are breached?
How do we protect medical devices that cannot run security software?
What does the Ontario cyber regulation require of hospitals?
Can Nuformat quote for both Canadian and US clinics?
Will Sophos help us get or renew cyber insurance?
Industries · Healthcare · Canada and USA
In plain terms: Healthcare is breached through two doors: ransomware crews who know a hospital cannot wait to restore, and ordinary staff mistakes with patient records. The defense has to cover both, and it has to keep the EHR, imaging and devices running while it does.
1The problem
2The rules
3The fix
HIPAA 164.308(a)(5)(ii)(B)HIPAA 164.308(a)(7) backup and recoveryHICP 2O. Reg. 51/26 (Ontario public hospitals)
HICP 1 Email protectionHIPAA 164.312(d) authenticationHICP 3 Access management
HICP 9 Medical devicesHICP 6 Network management
HICP 4 Data protectionPHIPA s. 12 safeguards
61%
of healthcare breaches were System Intrusion, the ransomware pattern
Verizon 2026 DBIR
54%
involved the human element: misdelivery, lost devices, misconfiguration
Verizon 2026 DBIR
32%
involved a third party such as a billing, imaging or IT vendor
Verizon 2026 DBIR
20%
began with an exploited vulnerability, ahead of phishing at 14%
Verizon 2026 DBIR
Most common way in33%Exploited vulnerabilitiesthe most common way in
What it costs$150Kmedian ransom paid
And then$1.02Maverage cost to recover, ransom not included
1Entry
What happensUnpatched VPN or a phished login
What stops itXGS firewall with IPS and TLS inspection; Sophos Email Plus; ITDR flags MFA gaps
2Foothold
What happensAttacker lands on a workstation or server
What stops itSophos Endpoint blocks exploits and ransomware behavior
3Spread
What happensMoves toward the EHR, PACS and file servers
What stops itNDR sees lateral movement; firewall segmentation keeps devices on their own VLANs
4Impact
What happensEncryption, data theft, extortion
What stops itMDR Plus analysts isolate and respond 24/7; Cove backup restores
72hours
72hours
HIPAA (proposed)HHS 405(d)
HIPAA (addressable)HHS 405(d)
HIPAA (addressable)PHIPA
HIPAA
HIPAAO. Reg. 51/26PHIPA
HIPAA
HIPAAO. Reg. 51/26
HIPAA (proposed)HHS 405(d)
Not sure which of these you already cover?Send us what you run today. A Nuformat specialist marks each requirement as covered, partly covered or missing, at no charge.
Govern
Sophos AI Defense
Identify
Sophos Managed Risk
Protect
Sophos FirewallSophos EndpointSophos Endpoint for ServerSophos EmailSophos ITDR1Password BusinessSophos Workspace ProtectionAxcient x360SyncSophos Mobile
Detect
Sophos NDRSophos ITDRSophos Next-Gen SIEM
Respond
Sophos MDR
Recover
N-able Cove M365Axcient x360CloudN-able CoveAxcient x360Recover
Block attacks at your internet connectionChecks traffic coming in and going out and blocks attacks. A firewall also keeps parts of the network apart; TrendAI Network Security is intrusion prevention that works alongside a firewall.
Stop ransomware and malware on computers and serversProtection on each laptop, PC and server that blocks malicious software and stops files being encrypted.
Stop phishing and fake-invoice emailsChecks email before it reaches staff and blocks phishing links, malware and impersonation.
Experts watching for attacks around the clockA security team monitors your systems 24/7 and acts on attacks, including nights and weekends.
Protect logins and passwordsSpots stolen or risky accounts and missing multi-factor authentication, and gives every person a unique, strong password.
Watch devices that cannot run security softwareWatches network traffic to spot attacks on cameras, scanners, medical or plant equipment and other devices with no protection of their own.
Safe remote access for staff and vendorsLets people reach only the applications they need from home or on the road, instead of the whole network.
Find and fix weak spots before attackers doFinds exposed systems and missing patches, and ranks what to fix first.
Keep logs as proof for auditors and insurersCollects and keeps security records, so you can show what happened and when.
Back up Microsoft 365 or Google WorkspaceKeeps a separate copy of email and cloud files, so a deleted mailbox or an attack does not mean lost data.
Back up servers and PCs, and restore fastBacks up whole machines so you can restore files or entire systems after ransomware or a hardware failure.
Share files with clients and partners securelyControlled file sharing with permissions, instead of email attachments or personal cloud drives.
Control the AI tools staff useShows which AI tools people use and keeps sensitive data out of the ones you have not approved.
Manage, lock and wipe phones and tabletsKeeps company phones and tablets set up securely, and locks or wipes them if they are lost.
Want this priced for your sites?Pick a column or mix them. Tell us your sites, users and servers, and we quote Sophos and TrendAI side by side in CAD or USD within two to three business days.
1
MFA for remote and privileged (admin) accessSophos ITDR shows gaps; 1Password; Workspace Protection
2
Email filtering and web securitySophos Email; Sophos Firewall web filtering
3
Secured, encrypted and tested backupsN-able Cove; Axcient x360Recover and x360Cloud
4
Privileged access managementSophos ITDR flags admin accounts; 1Password vaults admin credentials
5
Endpoint detection and response (EDR)Sophos Endpoint with XDR, or MDR
6
Patch and vulnerability managementSophos Managed Risk; TrendAI CREM
7
Incident response planSophos MDR Plus includes incident response
8
Security awareness training and phishing testsA staff training program; Sophos Email cuts the volume
9
Remote desktop (RDP) lockdown and hardeningSophos Firewall; Workspace Protection replaces exposed RDP
10
Logging and monitoringSophos Next-Gen SIEM; MDR
11
Replace or protect end-of-life systemsFirewall segmentation; Sophos NDR watches what cannot be patched
12
Supply chain and vendor riskWorkspace Protection limits vendor access; ITDR removes stale accounts
Answer the application accurately. In 2022 an Illinois manufacturer's application said it required MFA for email and remote network access. After a ransomware attack, the insurer said MFA was only on the firewall and asked a court to cancel the policy. On August 26, 2022 the court entered judgment rescinding the policy, with the company's agreement, leaving it without coverage. Source
Renewing or applying for cyber insurance?We map your current setup to the twelve controls before you fill in the application, so the answers are accurate and the gaps are known.
Sources