Study of the Adequacy of Cybersecurity Infrastructure in Nigerian Teaching Hospitals in the North Central Zone

Teaching hospitals in the North Central zone manage sensitive patient records and are attractive targets for ransomware and data theft attacks, yet the adequacy of their cybersecurity infrastructure has not been comprehensively evaluated in the academic literature. This study assessed the cybersecurity infrastructure adequacy at three teaching hospitals in the North Central zone: University of Ilorin Teaching Hospital (Kwara), Jos University Teaching Hospital (Plateau), and Benue State University Teaching Hospital. A structured IT security infrastructure audit combined with a survey of 90 IT and health informatics staff was employed. Infrastructure dimensions assessed included firewall deployment, network segmentation, endpoint protection, data encryption, backup systems, access control, and incident response documentation. Results showed that firewalls were deployed in all three hospitals. Network segmentation for clinical systems was present in only one hospital. Endpoint protection was deployed on fewer than 60 percent of devices in all three hospitals. Patient data at rest was encrypted in only one hospital. Regular data backups were conducted in two hospitals. Only one hospital had a documented incident response procedure. Security training was absent in two hospitals. The study concludes that cybersecurity infrastructure in North Central teaching hospitals is inconsistent and inadequate for protecting sensitive health data. Recommendations include a Federal Ministry of Health minimum hospital cybersecurity standard, NHIA-linked security infrastructure compliance requirements, and dedicated health cybersecurity technical assistance for teaching hospitals.

Keywords: hospital cybersecurity infrastructure, teaching hospital, North Central Nigeria, health data security, ransomware preparedness