The rapid digitalisation of healthcare has underscored the importance of cybersecurity in hospitals. Yet, there is an untapped potential to consider cybersecurity from the start, during the procurement of medical devices. This thesis investigates the current procurement practices in Dutch hospitals, focusing on how cybersecurity considerations are integrated into these processes. Despite the critical role of cybersecurity in protecting patient safety and data integrity, there is a notable gap in the literature regarding its integration into medical device procurement. This research aims to fill this gap by providing a comprehensive analysis of procurement practices and offering insights for improvement.

The study is structured into five phases: an initial literature review to define the research problem and identify knowledge gaps, desk research to overview existing policies, regulations, and scientific literature, semi-structured interviews with stakeholders in three Dutch hospitals and one external stakeholder, a framework analysis of the interview data to identify key themes and dynamics, and synthesis of findings into a comparative case study with practical recommendations.

The findings reveal that the procurement process in Dutch hospitals is multifaceted, involving various stakeholders from within the hospital and outside, such as doctors, IT staff, procurement departments, and manufacturers. The procurement process across the three participating hospitals showed a remarkable resemblance, generally following a similar structured approach. However, it falls short in prioritising cybersecurity, often treating it as a baseline requirement. In addition, external influences, including manufacturers, medical conferences, and peer opinions, could impact procurement decisions. Manufacturers often engage directly with doctors and provide trial installations to promote their devices. However, cybersecurity is often not prioritised, with functional and financial requirements taking precedence.

This thesis makes significant contributions to the field by providing detailed empirical data on procurement practices and stakeholder dynamics, highlighting the role of cybersecurity plays in Dutch hospitals, and offering practical recommendations for enhancing cybersecurity integration. By addressing the gaps in existing literature, this research provides a foundation for future studies and practical improvements in healthcare procurement.

The findings underscore the need for hospitals to adopt more structured and standardised approaches to integrating cybersecurity into procurement decisions, ultimately enhancing the security and resilience of healthcare systems against evolving cyber threats. This research contributes to both the scientific community and healthcare practitioners, providing valuable insights and practical guidance for improving procurement practices and ensuring better patient safety and data protection.