Cybersecurity · Free online course
Cybersecurity for Healthcare and Medical Devices
How hospitals are attacked and how they recover: WannaCry, AIIMS and Ascension, ransomware and double extortion, the HHS 405(d) practices, phishing aimed at clinical staff, connected medical devices and FDA Section 524B, patient data under India's DPDP Act, backups that survive ransomware, and incident response when patients are on the wards.
- 9 modules
- 3h 20m of video
- Beginner
- English
- ₹0, free
₹0Free for good
Worth ₹2,499 by length and depth against classroom training. It has always been free; that is not a former price.
No card. Checkout takes a minute and gives you a receipt.
Overview
About Cybersecurity for Healthcare and Medical Devices
How hospitals are attacked and how they recover: WannaCry, AIIMS and Ascension, ransomware and double extortion, the HHS 405(d) practices, phishing aimed at clinical staff, connected medical devices and FDA Section 524B, patient data under India's DPDP Act, backups that survive ransomware, and incident response when patients are on the wards.
Cybersecurity for Healthcare and Medical Devices is a free, self-paced online course from EDWartens for hospital IT teams, clinical engineers and healthcare managers. It has 9 modules and 3h 20m of video lessons by Professor Messer, CNBC Television, Christian Espinosa and others, with written notes and worked problems, a practical project with a document pack and a 15-question final assessment (pass mark 60%). Learning is free with an account; an optional certificate with a public verification code is issued when you pass. Last updated 27 September 2026.
Who it is for: Hospital IT teams, clinical engineers and healthcare managers
This course includes
- 3h 20m of video lessons
- 9 modules with written notes and diagrams
- One final assessment: 15 questions, pass mark 60%
- Ask-an-engineer support from practising engineers
- Lifetime access, the course does not expire
- Optional verifiable certificate when you finish
- Step 1 of 3
Learn the 9 modules
3h 20m of video lessons, written notes and a practice task per module, at your own pace.
- Step 2 of 3
Pass the final assessment
15 questions drawn from every module, pass mark 60%, 3 attempts.
- Step 3 of 3
Take the certificate, if you want it
Optional, paid once, only if you choose it. The course stays free either way.
See the certificate and its price
A look inside
From the lessons
Why hospitals are targets
by YaleCourses
Ransomware in healthcare now
by EC-Council
The HHS 405(d) health industry practices
by PAHCOM
Phishing and the people inside a hospital
by Professor Messer
Connected medical devices
by U.S. Food and Drug Administration
Patient data, privacy and clinical AI
by NBEMS
Lesson frames belong to the creators named in the Credits and are shown from YouTube.
What you learn
What you will be able to do
Explain why hospitals are targeted, using WannaCry, AIIMS and Ascension; describe how modern ransomware and double extortion work; apply the HHS 405(d) threats and practices to a hospital of any size; run a phishing awareness programme and measure it; secure connected medical devices and use FDA Section 524B, SBOMs and MDS2 forms when buying; protect patient data under the DPDP Act 2023 and use clinical AI safely; set RPO and RTO and prove backups with timed restores; and lead a hospital through an incident, including the CERT-In and DPDP reporting deadlines.
- Explain why hospitals are targeted, using WannaCry, AIIMS and Ascension
- Describe modern ransomware and double extortion
- Apply the five HICP threats and ten practices
- Run and measure a phishing awareness programme
- Secure connected medical devices and buy with SBOMs and MDS2 forms
- Protect patient data under the DPDP Act and use clinical AI safely
- Set RPO and RTO and prove backups with timed restores
- Lead a hospital incident and meet the CERT-In and DPDP deadlines
Syllabus
Course content, module by module
In order, at whatever pace suits you. Each module ends with a practice task that builds on the last.
- Modules
- 9
- Video lessons
- 25
- Of video
- 3h 20m
- Final questions
- 15
- 01
Why hospitals are targets
3 lessons · 12m - 02
Ransomware in healthcare now
2 lessons · 21m - 03
The HHS 405(d) health industry practices
3 lessons · 30m - 04
Phishing and the people inside a hospital
4 lessons · 20m - 05
Connected medical devices
3 lessons · 32m - 06
Patient data, privacy and clinical AI
3 lessons · 26m - 07
Backups, resilience and recovery
3 lessons · 27m - 08
Incident response in a hospital
3 lessons · 28m Final assessment · 15 questions, pass mark 60%
Project
The course project
Optional practice that ends in the kind of job the course prepares you for, with the documents that go with it.
About 10 hours
Ransomware readiness for a 220-bed hospital: clinical asset inventory, cyber risk register, downtime procedure and tabletop exercise report
Prepare a mid-sized hospital for a ransomware attack as its newly appointed information security lead: build the clinical asset inventory, write the cyber risk register, write the EHR downtime and first-hour ransomware procedure, and run and report a tabletop exercise with the clinical and IT leads. The sample pack shows each document for a hospital in Coimbatore. Work on paper and in documents; never test attacks on live clinical systems.
Sample document pack, 4 documents, filled in for the scenario
- Asset inventoryClinical asset inventory: Nilgiri Crest Hospital
- Risk registerCyber risk register: ransomware readiness
- ProcedureEHR downtime and first-hour ransomware procedure
- ReportTabletop exercise report: ransomware at 02:00 on a Saturday
Read inside the course and download as a workbook. The project is optional practice, marked when you submit it; the certificate needs only the modules and the final assessment.
Tools
Software, hardware and lessons
Software
None required. A spreadsheet and a document editor for the practice tasks and the project.
Hardware
None.
Who it is for
Beginner. For hospital IT and biomedical teams, health administrators, and clinicians with an interest in security. No security background is needed.
Video lessons by
- Professor Messer
- CNBC Television
- Christian Espinosa
- EC-Council
Independent creators, credited in full under Credits.
Software you need
What to download, where from, what it costs and how to install it. Every link goes to the maker's own site, never a mirror.
Nothing to install
A spreadsheet and a document editor are enough for the practice tasks and the project.
Optional
Useful, not needed to finish the course.
- 01Free
LibreOffice
The Document Foundation
- Runs on
- Windows 10 or 11, macOS 11 or newer (Intel or Apple silicon), Linux
- Account
- None needed
- Size
- up to 1.5 GB of disk space on Windows
LibreOffice is free, open-source software under the Mozilla Public License 2.0, for any use including business. Calc is its spreadsheet.
Steps
- 1.Open the LibreOffice download page.
- 2.Check the page has picked your operating system, then select Download.
- 3.Run the installer (administrator rights are needed on Windows).
- 4.Start LibreOffice Calc for spreadsheet work.
- 5.Save as .xlsx if you need to share files with Excel users.
- Choose the latest main version unless your organisation asks for the older, more conservative release.
Official download pagelibreoffice.org
Checked against each maker's own page on 27 September 2026. Trial lengths and editions change; the maker's page is the final word.
What you walk away with
Your certificate for Cybersecurity for Healthcare and Medical Devices
Finish the course, pass the final, and this is the document with your name on it.
Verifiable by anyone
Adds to LinkedIn in one click
QR code on the certificate
Names what you can do
A permanent link
Earned, not attended
Learning is free. The certificate is optional.
Add it now and pay only when you have finished the course, or come back for it later. One-off, US$23.99, with a receipt.
Issued by Wartens Ltd (England and Wales, company no. 15262249) through the EDWartens training portal, as a Certificate of Completion for this self-paced course. Sold in India by Wartens Automation Private Limited. It is not a vendor certification, a university award or a CPD-accredited activity, and it does not certify competence on live equipment. Delivered electronically; see the refund policy.
FAQ
Common questions
Who is the Cybersecurity for Healthcare and Medical Devices course for?
Hospital IT and biomedical engineering staff, health administrators and managers, and clinicians who want to understand the cyber risks to patient care. No security background is needed.
Is this a CompTIA Security+ course?
No. Several lessons come from Professor Messer's free Security+ SY0-701 series because they explain general security ideas well, but the course is about healthcare and is not affiliated with CompTIA.
Does it cover Indian law?
Yes. It covers the DPDP Act 2023 and DPDP Rules 2025 (most of whose duties apply from May 2027), and the CERT-In Directions of 2022 on reporting incidents, with HIPAA and GDPR for comparison. It is not legal advice; check current requirements with your legal team.
Is the HHS 405(d) guidance relevant outside the US?
Yes. HICP is free, practical and written for health organisations of every size. Its threats and practices apply to any hospital, including in India.
How long does the Cybersecurity for Healthcare and Medical Devices course take?
About 6 hours of video lessons, notes and practice questions, plus about 10 hours if you do the optional project. You work at your own pace.
What is the project in the Cybersecurity for Healthcare and Medical Devices course?
You prepare a 220-bed hospital in Coimbatore for ransomware as its new information security lead: a clinical asset inventory, a cyber risk register, an EHR downtime and first-hour procedure, a tabletop exercise report and a board summary. A sample pack shows each document.
Is the Cybersecurity for Healthcare and Medical Devices course really free?
Yes. Every module, the notes, the project and the final assessment. The only paid item is the certificate, if you want it.
What certificate does the Cybersecurity for Healthcare and Medical Devices course give?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a number anyone can verify on our site.
Is the Cybersecurity for Healthcare and Medical Devices course free in India, and what does the certificate cost?
Yes. Learning costs ₹0 in India: every module, the written notes, the practice tasks and the final assessment, with no card and no trial period. The only paid item is the optional EDWartens Certificate of Completion, ₹499 including GST for this beginner course, paid in rupees through Razorpay, and only if you want it after passing the final assessment.
All course factsHide course facts
- Price
- ₹0, free for good. No trial, no card. Comparable classroom training of this length costs about ₹2,499.
- Who it is for
- Hospital IT teams, clinical engineers and healthcare managers
- Format
- 9 self-paced modules, 3h 20m of video, written notes, a practice task per module and one final assessment.
- Level
- Beginner. Beginner. For hospital IT and biomedical teams, health administrators, and clinicians with an interest in security. No security background is needed.
- Brand
- Vendor-neutral
- Software
- None required. A spreadsheet and a document editor for the practice tasks and the project.
- Hardware
- None.
- Certificate
- Optional EDWartens Certificate of Completion, ₹499 inclusive of GST for learners in India, verifiable by code. Not a vendor credential.
- Video lessons by
- Professor Messer, CNBC Television, Christian Espinosa, EC-Council (independent creators, credited below)
- Language
- English
- Last updated
- 27 September 2026
Pairs well with
Cybersecurity · FreeCompTIA Security+ (SY0-701) Exam Prep
Cybersecurity · FreeMicrosoft Sentinel and Defender: SC-200 Exam Prep
PLC programming · FreeSiemens TIA Portal
PLC programming · FreeSiemens TIA Portal in Three HoursMore free courses: Free cyber security courses · Free IT security and SOC analyst courses
Classroom course, Bangalore
PLC training in Bangalore
The Automation Engineer Program (AEP) is our classroom course in PLC programming and industrial automation, taught in person at our Electronic City centre.
Credits
Who made the video lessons
The video lessons in this course were created by the people below, not by EDWartens. Every lesson streams from its creator's own YouTube channel; EDWartens neither hosts nor sells that footage, and the creators are not affiliated with EDWartens and do not endorse this course. What EDWartens wrote is the study plan, the notes, the practice tasks and the assessments.
- Professor Messerthe CompTIA Security+ SY0-701 lessons on phishing, impersonation, security awareness, privacy, protecting data, backups, resiliency, recovery testing, incident response and incident planning, used for their general security content
- CNBC Televisionthe report on growing ransomware attacks against US hospitals
- Christian Espinosathe explainer on Section 524B and the FDA's medical device cybersecurity requirements
- EC-Councilthe talk on the latest ransomware trends in healthcare
- FTCvideosthe Phishy Office video on avoiding phishing scams
- First Health Advisorythe Health Industry Cybersecurity Practices discussion with former FBI agent Elvis Chan
- Healthcare IT Todaythe discussion on the 405(d) programme and working together on healthcare security
- Medical Dialoguesthe report on the ransomware attack on the AIIMS New Delhi servers
- Mike Chapplethe explanation of the incident response process
- PAHCOMthe HHS 405(d) programme video
- StarFish Medicalthe explainer on the FDA's cybersecurity guidance for medical devices
- TDC Groupthe case studies on healthcare data breach risks
- U.S. Food and Drug Administrationthe video on cybersecurity awareness for connected medical devices
- World CyberSecurity News Channelthe account of how Ascension navigated recovery from its 2024 ransomware attack
- YaleCoursesthe WannaCry case study on how a ransomware worm disrupted the UK's National Health Service
- NBEMSthe module on cybersecurity, data privacy and trust in clinical AI systems
If you are one of these creators and would like a lesson removed or credited differently, write to info@wartens.com.