Cybersecurity
Cybersecurity for Healthcare and Medical Devices
Protect a hospital from ransomware and phishing, and secure its connected medical devices and patient data. No security background needed.
Cybersecurity for Healthcare and Medical Devices is a free, self-paced online course from EDWartens for hospital IT teams, clinical engineers and healthcare managers. It has 9 modules and takes about 6.2 hours, with written notes, a practice task per module, a practical project and a final assessment of 15 questions (pass mark 60%). Learning costs nothing and needs only a free account. The optional EDWartens Certificate of Completion, verifiable by code, is a one-off US$23.99 for you; it is not a vendor credential. Updated 1 November 2026.
- Free
- Beginner
- 6.2 hours
- Self-paced
- Certificate optional
- Lab practice in your browser
No card, no trial. The course is free for good. Certificate US$23.99, optional.
- Who it is for
- Hospital IT teams, clinical engineers and healthcare managers
- Jobs
- Roles that use this skill: OT security analyst, security engineer, network engineer and compliance analyst. No course guarantees a job.
- Tools
- None required. A spreadsheet and a document editor for the practice tasks and the project. Hardware: none.
- Updated
After this course you can
By the end you will be able to:
- Explain how modern ransomware and double extortion work
- Apply the HHS 405(d) practices to a hospital of any size
- Secure connected medical devices and use SBOMs when buying
- Set RPO and RTO and prove backups with timed restores
- Lead a hospital through an incident
Who it is for, and what you need first
Who it is for
Hospital IT teams, clinical engineers and healthcare managers.
Level: Beginner. Beginner. For hospital IT and biomedical teams, health administrators, and clinicians with an interest in security. No security background is needed.
What you need
Software: None required. A spreadsheet and a document editor for the practice tasks and the project..
Hardware: None.. What to download, and how.
How this course works
Watch the lessons
Short video lessons, one module at a time, at your own pace.
Read the notes
Open the Reading tab for the written notes and diagrams of the module.
Practise in the 3D labOptional
Try the module in the free 3D lab, in your browser.
Check yourself
Answer the questions to see what stuck before you move on.
Final assessment
Pass the final once you have been through the modules.
Certificate, if you want oneOptional
Optional, with a page anyone can use to verify it.
What you learn
9 modules in order, at your own pace. 6.2 hours of video lessons, with written notes and a practice task in each module.
- 1Why hospitals are targets12m
- 2Ransomware in healthcare now21m
- 3The HHS 405(d) health industry practices30m
- 4Phishing and the people inside a hospital20m
- 5Connected medical devices, with lab practice: 32m
- 6Patient data, privacy and clinical AI20m
- 7Backups, resilience and recovery, with lab practice: 27m
- 8Incident response in a hospital, with lab practice: 28m
Show the other 1 modules
- 9Final Assessment
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
Nothing to install
A spreadsheet and a document editor are enough for the practice tasks and the project.
Show what to download (1 tool)
Optional
Useful, not needed to finish the course.
- 01Free
LibreOffice
The Document Foundation
- Runs on
- Windows 10 or 11, macOS 11 or newer (Intel or Apple silicon), Linux
- Account
- None needed
- Size
- up to 1.5 GB of disk space on Windows
LibreOffice is free, open-source software under the Mozilla Public License 2.0, for any use including business. Calc is its spreadsheet.
Steps
- 1.Open the LibreOffice download page.
- 2.Check the page has picked your operating system, then select Download.
- 3.Run the installer (administrator rights are needed on Windows).
- 4.Start LibreOffice Calc for spreadsheet work.
- 5.Save as .xlsx if you need to share files with Excel users.
- Choose the latest main version unless your organisation asks for the older, more conservative release.
Official download pagelibreoffice.org
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
Practise in the 3D lab
Practise separating devices that cannot be patched, proving backups and running an incident response in the OT security lab; hospital device networks face the same problems.
- Zones and conduits: split a flat networkOT security labOpen in the lab (opens in a new tab): Zones and conduits: split a flat network
- Backup and recovery: known-good copies and a proved restoreOT security labOpen in the lab (opens in a new tab): Backup and recovery: known-good copies and a proved restore
- Incident drill: a simulated note on an operator screenOT security labOpen in the lab (opens in a new tab): Incident drill: a simulated note on an operator screen
Optional. Skip it whenever you like: it never blocks your progress or your certificate.
Course project, about 10 hours
Ransomware readiness for a 220-bed hospital: device inventory, risk register, downtime procedure and tabletop report
Prepare a mid-sized hospital for ransomware as its newly appointed information security lead. Build the clinical asset inventory and the cyber risk register, write the first-hour procedure, run a tabletop exercise and brief the board. The sample pack shows each document. Work on paper and in documents, and never test attacks on live clinical systems.
- 4documents in the pack
- 5steps to follow
- Laboptional: in the 3D lab
- 6things to hand in
- 10 hof work, at your pace
- Asset inventoryClinical asset inventory: Lakeside Regional Hospital
- Risk registerCyber risk register: ransomware readiness
- ProcedureEHR downtime and first-hour ransomware procedure
- ReportTabletop exercise report: ransomware at 02:00 on a Saturday
Do it in the lab: 5 steps.
The project is optional practice. The certificate needs only the modules and the final assessment.
After the course, your next step
Show what you can do, then keep going in the same field.
A certificate you can verify
Finish the modules and pass the final assessment (15 questions, pass mark 60%) and you can add a certificate with a public verification page. One-off, US$23.99 for you. It is not a vendor credential.
Want a free certificate? Do the matching Free internship: 4 weeks, nothing to buy, with a free certificate of completion.
Cybersecurity (IT and OT)
Eight short weeks of security basics, networks, access control, a security operations centre, industrial (OT) security, IEC 62443 and incident response: notes, diagrams, a few videos and worked exercises. Finish weeks 1 to 4 and the final, then claim a free Internship Completion Certificate with your real dates and study hours, and a QR code anyone can scan to verify it. Training, not employment.
See the internshipMore free courses
Roles that use this skill
- OT security analyst
- Security engineer
- Network engineer
- Compliance analyst
These are the kinds of roles where the skill is used. We make no promise of a job or an interview.
Plain notes
- Free: the whole course, the notes, the practice tasks, the final assessment and support from practising engineers.
- Paid, and optional: the course certificate, and the Engineer-verified internship (the Free internship costs nothing).
- No job promise: the course teaches a skill. It does not place you in a job.
- Lessons by: Professor Messer, CNBC Television, Christian Espinosa, EC-Council. Independent creators; the lessons stream from their own channels. EDWartens wrote the study plan, notes, practice tasks and assessments.
Professor Messer · CNBC Television · Christian Espinosa · EC-Council · FTCvideos · First Health Advisory · Healthcare IT Today · Medical Dialogues · Mike Chapple · PAHCOM · StarFish Medical · U.S. Food and Drug Administration · World CyberSecurity News Channel · YaleCourses. If you are one of these creators and want a lesson removed or credited differently, write to info@edwartens.com.
Practise what you learn in the free 3D lab
Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.
- Practise safely, so a mistake costs nothing.
- The lab checks your work like a site test, so you know when it is right.
- Free, in your browser, with nothing to install.
Why learn with EDWartens
What you get with this course, and what comes after it.
- Free from the first lesson to the final assessment.
- Practice in a free 3D lab in your browser, with nothing to install.
- Video lessons with written notes and a project.
- An optional certificate that anyone can verify online.
- Free internships to keep practising afterwards.
Common questions
Who is the Cybersecurity for Healthcare and Medical Devices course for?
Hospital IT and biomedical engineering staff, health administrators and managers, and clinicians who want to understand the cyber risks to patient care. No security background is needed.
Is this a CompTIA Security+ course?
No. Several lessons come from Professor Messer's free Security+ SY0-701 series because they explain general security ideas well, but the course is about healthcare and is not affiliated with CompTIA.
Which countries' laws does it cover?
India's in depth, as the worked example: the DPDP Act 2023 and DPDP Rules 2025 (most of whose duties apply from May 2027), and the CERT-In Directions of 2022 on reporting incidents, with HIPAA and GDPR for comparison. It is not legal advice; check current requirements with your legal team.
Is the HHS 405(d) guidance relevant outside the US?
Yes. HICP is free, practical and written for health organisations of every size. Its threats and practices apply to any hospital, in any country.
How long does the Cybersecurity for Healthcare and Medical Devices course take?
About 6 hours of video lessons, notes and practice questions, plus about 10 hours if you do the optional project. You work at your own pace.
What is the project in the Cybersecurity for Healthcare and Medical Devices course?
You prepare a 220-bed hospital for ransomware as its new information security lead: a clinical asset inventory, a cyber risk register, an EHR downtime and first-hour procedure, a tabletop exercise report and a board summary. A sample pack shows each document.
Is the Cybersecurity for Healthcare and Medical Devices course really free?
Yes. Every module, the notes, the project and the final assessment. The only paid item is the certificate, if you want it.
What certificate does the Cybersecurity for Healthcare and Medical Devices course give?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a number anyone can verify on our site.
Do I have to use the lab?
No. The lab is optional practice. You can skip it whenever you like, and it never blocks your progress, the final assessment or your certificate.
Is the lab free?
Yes. Every lab level for this course opens in your browser, free, with nothing to install.
What topics does the Cybersecurity for Healthcare and Medical Devices course cover, module by module?
The Cybersecurity for Healthcare and Medical Devices course has 9 modules. It opens with "Why hospitals are targets", goes through "Ransomware in healthcare now", "Phishing and the people inside a hospital", "Patient data, privacy and clinical AI" and "Incident response in a hospital" and ends with "Final Assessment". The full list with minutes is under "What you learn" on this page.
What can I do after the Cybersecurity for Healthcare and Medical Devices course?
After the Cybersecurity for Healthcare and Medical Devices course: Explain why hospitals are targeted, using WannaCry, AIIMS and Ascension; Describe modern ransomware and double extortion; Apply the five HICP threats and ten practices. These are the practical outcomes the course is written around, and the final assessment of 15 questions checks them.
What software and hardware do I need for the Cybersecurity for Healthcare and Medical Devices course, and does it cost anything?
For the Cybersecurity for Healthcare and Medical Devices course, software: None required. A spreadsheet and a document editor for the practice tasks and the project. Hardware: none. The course itself is free.
Is the Cybersecurity for Healthcare and Medical Devices course suitable for me, and what level is it?
Cybersecurity for Healthcare and Medical Devices is rated beginner. Beginner. For hospital IT and biomedical teams, health administrators, and clinicians with an interest in security. No security background is needed. It is written for hospital IT teams, clinical engineers and healthcare managers, and takes about 6.2 hours at your own pace.
Which jobs use the skills from the Cybersecurity for Healthcare and Medical Devices course?
Skills from the Cybersecurity for Healthcare and Medical Devices course (for example: explain why hospitals are targeted, using WannaCry, AIIMS and Ascension) are used in roles such as OT security analyst, security engineer, network engineer and compliance analyst, and in healthcare information security officer work. The course gives you practical evidence of the skill; it does not promise a job, and employers decide on experience and interview.
Start free today
Cybersecurity for Healthcare and Medical Devices, at your own pace. Add the certificate only if you want one.