Hospital Cybersecurity Is No Longer Optional: From Compliance to Real Readiness

Keamanan Siber Rumah Sakit Bukan Lagi Pilihan: Dari Sekadar Patuh ke Benar-Benar Siap

Oke jadi gini. Keamanan siber rumah sakit itu sekarang bukan lagi soal "yang penting sistemnya jalan dan laporan terkirim". Bukan. Kalau lo masih mikir keamanan data pasien itu urusan nomor sekian, sementara yang penting rekam medis elektronik (RME) lo bisa nyambung ke Satu Sehat biar gak kena denda — lo lagi main api.

Gw ngerti sih, pressure-nya nyata. Ada PMK yang mewajibkan RME. Ada tuntutan interoperabilitas. Ada "No Claim No RME" yang mulai jalan di rumah sakit piloting. Dan di sisi lain, anggaran terbatas, tim IT sedikit, dan yang paling penting: pasien tetap harus dilayani.

Tapi justru di situlah masalahnya. Karena menurut gw, banyak dari kita masih berhenti di tahap "compliance". Padahal yang sebenarnya dibutuhkan adalah "readiness".

Bingung gw kadang. Bedanya apa coba?

Compliance vs Readiness: Apa Bedanya Sih?

Compliance itu sederhana: lo patuh sama aturan. Ada checklist, lo centang. Sistem sudah terkirim ke Satu Sehat, oke, beres. Security-nya "nomor sekian yang penting jalan".

Readiness itu beda. Readiness itu pertanyaan yang lebih menakutkan:

Kalau malam ini sistem lo kena serangan ransomware, berapa lama lo bisa balikin data? Dan berapa banyak data yang hilang?

Nah lo. Pertanyaan itu sederhana, tapi jawabannya bisa bikin gw gak bisa tidur.

Karena serangan siber itu bukan soal "kalau", tapi soal "kapan". Tinggal nunggu waktu aja. Rumah sakit di berbagai negara sudah kena. Tinggal kita lihat sejauh mana kita siap.

Kenapa Rumah Sakit Jadi Target?

Logikanya gampang. Rumah sakit itu gak bisa berhenti. Sistemnya harus jalan 24/7. Kalau sistem mati, layanan berhenti. Kalau layanan berhenti, nyawa bisa taruhannya. Dan penyerang tahu itu.

Belum lagi data yang dipegang rumah sakit. Data medis itu sensitif banget. Dan sekarang, dengan transformasi digital, permukaan serangannya makin luas. Lo bikin pendaftaran online? Bagus, itu memudahkan pasien. Tapi begitu sistem lo bisa diakses publik, di situlah celah kerentanannya muncul.

Misalnya pendaftaran online minta upload foto KTP. Pertanyaannya: lo udah bikin sanitasi input beneran? Atau lo cuma cek ekstensi file-nya doang?

Karena kalau cuma cek ekstensi, orang bisa upload file yang ekstensinya JPG tapi isinya malware. Dan begitu petugas lo double-klik, ya sudah. Sistem lo bisa kena ransomware, atau lebih parah, malware-nya menanam backdoor yang diam-diam ngambil data sedikit demi sedikit — dan itu gak bisa dilihat pakai mata.

Tantangan Nyata di Lapangan

Kalau gw rangkum, kira-kira ada beberapa tantangan yang mau gak mau harus dihadapi:

1. Keamanan Data Medis Pasien

Ini bukan cuma soal teknis. Ini soal amanah. Data pasien itu bukan punya kita. Kita cuma dititipi. Kalau sampai bocor, itu bukan cuma masalah reputasi, tapi juga masalah hukum.

2. Sistem Harus Jalan 24/7

RME sekarang sudah full digital. Hybrid hampir gak dipakai, paling cuma buat skenario BCP (Business Continuity Plan) dengan formulir cadangan di tablet. Artinya, kalau sistem down, lo harus punya rencana yang benar-benar teruji. Bukan cuma rencana di atas kertas.

3. Serangan dari Dalam dan Luar

Kita kenal serangan dari luar — hacker, malware, ransomware. Tapi serangan dari dalam juga nyata: bisa dari kelalaian staf, phishing, atau social engineering. Vulnerability sistem juga jadi pintu masuk.

4. Kepatuhan Hukum dan Denda

Undang-undang PDP sudah punya ketentuan denda. Semakin tidak taat, semakin besar dendanya. Dan yang lebih menakutkan: tuntutan hukum. Ada angka dua persen dari total revenue yang bisa jadi bayangan. Belum lagi kalau sampai ada unsur kesengajaan, bisa ada hukuman pidana.

Siapa yang Harus Bertanggung Jawab?

Nah ini yang sering jadi perdebatan. Menurut gw, jawabannya: semua pihak, tapi dengan peran yang jelas.

Karena sekarang, kalau SIMRS rusak, efeknya bukan lagi cuma "masalah IT". Efeknya bisa ke operasional: antrean online rusak, pasien harus datang manual, tumpukan antrean di loket. Bisa juga ke proses verifikasi eligibilitas peserta asuransi — dan di situ, petugas dihadapkan pada pilihan yang gak enak: layani tapi gak jelas ter-cover, atau gak layani tapi melanggar kewajiban pelayanan.

Itu namanya gambling. Dan gak seharusnya layanan kesehatan jadi tempat gambling administratif.

Makanya, pembagian tanggung jawab — terutama saat berbagi data dengan pihak lain — harus jelas dan tertulis. Kalau terjadi insiden, siapa yang bertanggung jawab dan apa tanggung jawabnya? Ini harus clear dari awal.

Empat Komponen Wajib dalam Penanganan Insiden

Kalau lo mau serius, ada empat komponen yang gak bisa ditawar. Ini semacam fondasi.

1. SDM yang Kompeten

Kompetensi minimal diukur dari tiga aspek: education, experience, dan certification atau training. Minimal dua dari tiga harus dimiliki. Pertanyaannya sederhana: lo punya orang yang benar-benar kompeten, atau cuma orang yang "ditunjuk" karena gak ada yang lain?

2. SOP yang Jelas

Gak mungkin lo bisa tangani insiden dengan baik kalau SOP-nya gak ada. Dan SOP itu harus diuji, bukan cuma disimpan. Ada namanya table top exercise — simulasi di mana tim lo dihadapkan pada skenario, misalnya petugas admisi lapor komputernya nge-blank dan ada tulisan minta tebusan Bitcoin.

Pertanyaannya: berapa lama dia lapor ke IT? Apa yang IT lakukan? Apakah langsung menangani, atau identifikasi dulu, atau lokalisasi sistem yang terdampak? Eskalasinya ke mana? Perlu info ke pimpinan? Ke humas? Itu yang diuji. Dan dari situ lo bisa hitung SLA downtime lo realistis atau enggak.

3. Teknologi yang Andal

Kalau di dunia fisik lo punya satpam di depan pintu, di dunia digital lo juga butuh "satpam digital". Ada IDS, ada firewall, ada next-gen firewall, ada enkripsi untuk data in-transit maupun at-rest. Dan yang paling penting: ada sistem yang bisa mendeteksi anomali traffic dan ngasih alert. Karena lo gak mungkin mantau traffic pakai mata.

4. Mitra Strategis

Gak semua rumah sakit punya resource untuk semua hal. Kolaborasi dengan BSSN, Kementerian Kesehatan, atau mitra industri itu penting. Termasuk bergabung dengan komunitas berbagi informasi insiden — supaya lo bisa tahu potensi ancaman yang ada di luar sana sebelum kena ke lo.

Kenapa Harus Mulai Sekarang?

Karena pemerintah sudah mulai "memaksa". Ada aturan yang mewajibkan pembentukan tim tanggap insiden siber di fasilitas kesehatan. Ada 180 yang ditunjuk untuk piloting pertama. Dan di suratnya, ada konsekuensi yang jelas: kalau gak selesai di akhir Desember, ada peninjauan ulang akreditasi.

Gw ngerti, ini terasa seperti "pemaksaan". Tapi menurut gw, ini justru trigger yang bagus. Bukan untuk bikin sistem di bulan Desember, tapi untuk bikin kita menilai diri sendiri: siap atau enggak?

Karena pada akhirnya, pertanyaannya bukan "apakah kita patuh". Pertanyaannya: kalau serangan datang malam ini, apakah kita bisa hadapi?

Kalau jawabannya ragu, ya berarti masih ada PR.

Apakah rumah sakit kecil juga wajib punya tim tanggap insiden siber?

Idealnya iya, tapi skalanya bisa disesuaikan. Yang penting fungsinya ada: ada orang yang bertanggung jawab, ada SOP, dan ada teknologi minimal untuk deteksi. Kalau resource terbatas, kolaborasi dengan mitra strategis jadi kunci.

Apa itu "No Claim No RME" di Satu Sehat?

Ini kebijakan di mana klaim, terutama untuk JKN, hanya bisa diproses kalau rekam medis elektronik dan bukti klaimnya ditandatangani secara elektronik menggunakan tanda tangan tersertifikasi. Tujuannya memastikan integritas data klaim.

Kenapa ransomware jadi ancaman utama rumah sakit?

Karena rumah sakit gak bisa berhenti beroperasi. Penyerang tahu bahwa tekanan operasional membuat korban lebih mungkin membayar. Selain itu, data medis punya nilai jual tinggi di pasar gelap.

Bagaimana cara memastikan file upload di sistem pendaftaran online aman?

Jangan cuma cek ekstensi file. Lakukan validasi tipe file sebenarnya (MIME type), sanitasi input, batasi ukuran file, simpan di lokasi terpisah, dan pastikan file yang di-upload tidak dieksekusi oleh sistem.

Apakah keamanan siber cukup dengan firewall saja?

Enggak. Firewall itu cuma satu lapisan. Lo butuh SDM kompeten, SOP yang teruji, teknologi deteksi anomali, enkripsi, dan mitra strategis. Keamanan itu soal lapisan, bukan satu produk.

Ya jadi gitu. Intinya, jangan tunggu sampai kena baru belajar. Karena di dunia digital, belajar sambil kena itu harganya mahal banget.

Entahlah. Mungkin gw yang terlalu banyak mikir.

Hospital Cybersecurity Is No Longer Optional: From Compliance to Real Readiness (English Version)

Okay, so here's the thing. Hospital cybersecurity isn't about "as long as the system runs and reports get sent" anymore. No. If you still think patient data security is a low-priority number, while the only thing that matters is getting your electronic medical records (EMR) connected to Satu Sehat so you don't get fined — you're playing with fire.

I get it, the pressure is real. There's a ministerial regulation mandating EMR. There's the interoperability requirement. There's "No Claim No EMR" starting at pilot hospitals. And on the other side: limited budgets, small IT teams, and most importantly — patients still need to be served.

But that's exactly the problem. Because in my opinion, many of us stop at the "compliance" stage. When what's actually needed is "readiness."

I get confused sometimes. What's the difference, really?

Compliance vs Readiness: What's the Difference?

Compliance is simple: you follow the rules. There's a checklist, you tick it. System is sent to Satu Sehat, done. Security is "whatever number, as long as it runs."

Readiness is different. Readiness is the scarier question:

If a ransomware attack hits your system tonight, how long until you can restore your data? And how much data would be lost?

There you go. That question is simple, but the answer can keep me up at night.

Because cyberattacks aren't a matter of "if," but "when." It's just a matter of time. Hospitals around the world have been hit. It's just a question of how ready we are.

Why Are Hospitals Prime Targets?

The logic is simple. Hospitals can't stop. Systems must run 24/7. If the system goes down, service stops. If service stops, lives can be at stake. And attackers know this.

Then there's the data hospitals hold. Medical data is extremely sensitive. And now, with digital transformation, the attack surface is wider than ever. You build online registration? Great, it makes things easier for patients. But once your system is publicly accessible, that's where vulnerabilities appear.

For example, online registration asks users to upload a photo of their ID card. The question is: have you actually built proper input sanitization? Or are you just checking the file extension?

Because if you only check the extension, someone can upload a file with a JPG extension but with malware inside. And the moment your staff double-clicks it, that's it. Your system could get ransomware, or worse, the malware plants a backdoor that quietly siphons data bit by bit — and you can't see that with your eyes.

Real Challenges on the Ground

If I had to sum it up, there are several challenges you'll inevitably face:

1. Security of Patient Medical Data

This isn't just a technical issue. It's a matter of trust. Patient data isn't ours. We're just entrusted with it. If it leaks, it's not just a reputation problem — it's a legal problem.

2. Systems Must Run 24/7

EMR is now fully digital. Hybrid is barely used, at most only for BCP (Business Continuity Plan) scenarios with backup forms on tablets. That means if the system goes down, you need a plan that's actually been tested. Not just a plan on paper.

3. Attacks from Inside and Outside

We know external attacks — hackers, malware, ransomware. But insider attacks are real too: staff negligence, phishing, or social engineering. System vulnerabilities are also entry points.

4. Legal Compliance and Fines

The PDP law already has penalty provisions. The less compliant you are, the bigger the fine. And even scarier: lawsuits. There's a figure of two percent of total revenue looming. Not to mention if there's an element of intent, there could be criminal penalties.

Who Should Be Responsible?

This is where debates often happen. In my opinion, the answer is: everyone, but with clear roles.

Because now, when a hospital information system breaks down, the effect is no longer just "an IT problem." It hits operations: online queues break, patients have to come manually, lines pile up at the counter. It can also hit the process of verifying insurance eligibility — and there, staff are faced with an unpleasant choice: serve but with unclear coverage, or don't serve but violate the obligation to provide care.

That's gambling. And healthcare shouldn't be a place for administrative gambling.

That's why the division of responsibility — especially when sharing data with other parties — must be clear and written down. If an incident occurs, who's responsible and what's their responsibility? This must be clear from the start.

Four Mandatory Components in Incident Handling

If you want to be serious, there are four components you can't negotiate. Think of them as the foundation.

1. Competent Human Resources

Minimum competence is measured across three aspects: education, experience, and certification or training. At least two out of three must be present. The question is simple: do you have genuinely competent people, or just people who were "assigned" because no one else was available?

2. Clear SOPs

You can't handle incidents well without SOPs. And SOPs must be tested, not just stored. There's something called a table top exercise — a simulation where your team is presented with a scenario, like an admissions staff reporting their computer went blank with a message demanding Bitcoin ransom.

The questions: how long until they report to IT? What does IT do? Do they handle it immediately, or identify first, or isolate the affected system? Where does it escalate? Does leadership need to be informed? Public relations? That's what gets tested. And from there you can calculate whether your downtime SLA is realistic or not.

3. Reliable Technology

If in the physical world you have a security guard at the front door, in the digital world you also need a "digital guard." There's IDS, firewall, next-gen firewall, encryption for in-transit and at-rest data. And most importantly: a system that can detect traffic anomalies and give alerts. Because you can't monitor traffic with your eyes.

4. Strategic Partners

Not every hospital has the resources for everything. Collaboration with BSSN, the Ministry of Health, or industry partners matters. That includes joining an incident information-sharing community — so you know about potential threats out there before they hit you.

Why Start Now?

Because the government has started to "push." There are regulations requiring the formation of cyber incident response teams at healthcare facilities. 180 have been designated for the first pilot. And in the letter, the consequence is clear: if it's not completed by the end of December, there will be a review of your accreditation.

I get it, this feels like "coercion." But in my opinion, this is actually a good trigger. Not to build a system in December, but to make us assess ourselves: are we ready or not?

Because in the end, the question isn't "are we compliant." The question is: if an attack comes tonight, can we handle it?

If the answer is uncertain, then there's still homework to do.

Do small hospitals also need a cyber incident response team?

Ideally yes, but the scale can be adjusted. What matters is that the function exists: someone responsible, an SOP, and at least minimal technology for detection. If resources are limited, collaboration with strategic partners is key.

What is "No Claim No EMR" in Satu Sehat?

It's a policy where claims, especially for national health insurance, can only be processed if the electronic medical record and claim evidence are signed electronically using a certified digital signature. The goal is to ensure the integrity of claim data.

Why is ransomware the main threat to hospitals?

Because hospitals can't stop operating. Attackers know that operational pressure makes victims more likely to pay. Plus, medical data has high value on the black market.

How do you make sure file uploads in online registration are safe?

Don't just check file extensions. Validate the actual file type (MIME type), sanitize input, limit file size, store in a separate location, and make sure uploaded files aren't executed by the system.

Is cybersecurity just about having a firewall?

No. A firewall is just one layer. You need competent people, tested SOPs, anomaly detection technology, encryption, and strategic partners. Security is about layers, not a single product.

So that's it. The point is, don't wait until you get hit to learn. Because in the digital world, learning while getting hit is extremely expensive.

I don't know. Maybe I'm overthinking it.

Terima kasih sudah mampir! Jika kamu menikmati konten ini dan ingin menunjukkan dukunganmu, bagaimana kalau mentraktirku secangkir kopi? 😊 Ini adalah gestur kecil yang sangat membantu untuk menjaga semangatku agar terus membuat konten-konten keren. Tidak ada paksaan, tapi secangkir kopi darimu pasti akan membuat hariku jadi sedikit lebih cerah. ☕️

☕ Buy Me Coffee