Ransomware fallback and a 6-hour incident desk for mid-size private hospitals
TL;DR Coldspare is a managed service that gets a 50–300-bed private hospital ready for a ransomware attack - offline backups it can restore from, logs kept as the law requires, practised paper downtime and a desk that files the CERT-In report on time. Hospitals pay a yearly fee. It sells recovery speed, not immunity.
In November 2022 attackers hit about 50 servers at AIIMS Delhi. The hospital information system stayed down for over two weeks, and wards, clinics and labs went back to paper[1]. A 2026 review calls healthcare one of the most attacked sectors in India[1], and another notes that national digital health rules say little about staying available or recovering after an attack[2].
Mid-size private hospitals have more digital exposure every year and usually one or two IT staff. Since 2022 they have also had to report specified cyber incidents within six hours and keep 180 days of logs inside India[3]. How many have tested whether they could do either at 2 a.m.? Very few, I'd bet.
What it does, in regulatory terms: IT security and incident-response service only. Coldspare touches no patient care, makes no clinical decisions and is not a medical device. It helps a hospital meet CERT-In and DPDP duties, and the hospital stays the responsible entity.
The seed proposed AI that monitors and fixes "healthcare compliance". I narrowed it, because automatic changes inside a live hospital network are dangerous and "compliance" is far too vague to sell. Coldspare does four things - It installs backups that ransomware cannot reach and proves monthly that they restore. It collects and keeps logs from the hospital's systems for the required 180 days. It runs a quarterly downtime drill so wards can work on paper for 72 hours. And when something goes wrong, its desk helps contain it and files the six-hour report to CERT-In.
The buyer is the hospital's owner, CEO or CFO, usually advised by the IT head. Mid-size private and trust hospitals, multi-specialty chains with three to ten sites, and large diagnostic labs are the core. They already pay for hospital software, annual maintenance contracts and audits. No public price exists for a hospital-specific readiness service in India, so the pitch is a yearly fee lower than a week of lost billing.
CERT-In's directions took effect in June 2022, with penalties of up to a year in prison or a ₹1 lakh fine for non-compliance[4]. The DPDP Act adds penalties of up to ₹250 Cr for failing to protect personal data[5]. Hospitals are also linking to national digital health systems, which widens their exposure[2].
No public figure exists for what Indian hospitals spend on cybersecurity or recovery. The narrow evidence is the AIIMS outage of more than two weeks[1] and a legal duty that now applies to every hospital run by a company[3]. Adjacent: the WEF counts more than 1,000 attacks a week on healthcare organisations worldwide[2]. Treat that as context, not your market.
General managed security providers and the big IT services firms sell monitoring to large hospital chains. Hospital software vendors offer backups as part of maintenance contracts, though restores are rarely tested. I couldn't verify an Indian provider that packages tested recovery, log retention, downtime drills and CERT-In filing for mid-size hospitals, which is the gap.
| Difficulty | Moderate (46/100) |
| Starting capital | ₹1.2–2.2 Cr |
| Time to launch | 6–9 months |
Backups and log collection are known technology. The hard parts are getting into each hospital's messy mix of old software, running an incident desk that answers at night, and selling to owners who are sure an attack won't happen to them. Expect long sales cycles until the first public incident in your region.
No sector licence is needed for an IT security service, as long as you stay clear of clinical systems.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Never let AI change anything inside a live hospital network on its own. A wrong automatic action can stop care, so every change goes through a person.
Want to work out the AI layer for Coldspare? Talk to Yash →
I like this for a founder with incident-response experience and contacts among hospital owners. If you're hoping to sell software without staff on call then it is a poor fit. First prove that five hospitals will let you run a full restore test and a paper drill, and that two will pay for a year after seeing the results.
Plan for roughly ₹1.2–2.2 Cr, mostly for skilled security staff, a response desk and backup infrastructure.
No sector licence. You build to the CERT-In directions, act as a DPDP processor and stay out of clinical systems so medical-device rules don't apply.
Yes. Hospitals everywhere face ransomware. Incident-reporting deadlines and health data rules differ, so check your local regulator first.
The free Coldspare validation kit has the line-by-line capital breakdown, the effort scoring, the CERT-In and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for hospital owners and IT heads, and 5 assumptions to test. Download the kit →
Thinking about building Coldspare or something close to it? The make-or-break work is earning enough trust to touch a hospital's live systems before it has ever been attacked, and that's where a second pair of eyes helps. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.