The paper analyzes information security issues in Russian healthcare in the context of digital transformation. Digitalization of the healthcare sector, including integration of information systems of medical and pharmaceutical organizations with the Uniform State Health Information System (EGISZ), improves the quality of medicines and healthcare provided to the population. Meanwhile, the risk of patient personal data leakage and computer attacks on healthcare organizational information systems is increasing. The purpose of the study is to develop an integrated approach to information security in medical and pharmaceutical organizations. The research uses content analysis, logical and structural analysis of scientific papers and regulatory legal acts in the field of information technology in healthcare. The authors identify the stages of information security regulation from protecting medical secrets to categorizing critical information infrastructure and using domestic software. The classification of security threats to digital systems is provided based on the location of the threat source depending on whether they originate outside or inside the organization’s network perimeter. The directions and evaluation criteria for improving information security are provided based on modern methods and technologies of information protection, including technical means of protection, legal mechanisms, as well as organizational and managerial methods.