The Role of Cybersecurity Education in Nigeria’s Healthcare Sector

Abstract

Background: Nigeria’s uptake of digital health through electronic records, telemedicine and connected devices has expanded the cyber-attack surface of health facilities. Cybersecurity failures are not only data-governance problems; they can interrupt prescribing, diagnostics, referral pathways and emergency workflows, with downstream implications for patient safety and trust. Evidence from hospital incidents shows that ransomware and recovery efforts can disrupt services and degrade the timeliness of care when staff are unprepared, underscoring the need to treat cyber resilience as a clinical quality domain.

Main Argument: This letter argues that the most scalable risk reduction in low-resource settings is workforce capability: many healthcare breaches exploit human and workflow weaknesses rather than novel technical exploits. We outline a minimum, role-based cybersecurity education package for medical students and practicing clinicians covering: (1) governance, policies and third-party risk management; (2) core technical controls clinicians encounter daily (access control, encryption, patching, segmentation and logging); (3) training and awareness focused on phishing, social engineering and safe downtime workarounds; (4) incident response and recovery integrated into clinical continuity planning; and (5) compliance and ethics aligned to Nigeria’s data protection requirements.

Conclusion: Embedding these competencies in curricula, accreditation and continuing professional development, reinforced through drills and monitoring, can protect sensitive information and keep essential services running during disruption.