Violence against healthcare in armed conflict reflects disregard for the rules of war and unprecedented civilian and medical personnel casualties. This study analyses the use of digital tools and open-source intelligence (OSINT) by international institutions and civil society actors to document attacks on healthcare during the ongoing war in Ukraine (2022–2024). It examines how civil society organisations and international bodies use OSINT and digital platforms to document attacks on healthcare, and what this reveals about accountability practices for protecting health systems as critical civilian infrastructure in contemporary security contexts. A qualitative comparative case study examined four organisations recording illegal attacks on healthcare in Ukraine, including surveillance by the World Health Organisation (WHO) and multi-actor civil society initiatives. The study analyses documentation practices, verification protocols, and cross-sector engagement via open-source and hybrid legal–journalistic methods. The WHO’s approach provided institutional surveillance with limited reach because of political barriers, while civil society actors achieved broader impact through adaptive and networked uses of OSINT and digital verification. These practices linked grassroots evidence collection with national and international justice mechanisms, enhancing awareness, accuracy, and multi-level accountability for the illegal use of force. The study highlights an urgent need for cross-level, multi-stakeholder engagement to safeguard healthcare as a legally protected, non-combatant activity during war. The identified shift from institution-centred to networked accountability may reflect evolving strategies to hold perpetrators of illegal attacks in war to account and guide the scaling and implementation of innovative frameworks to prevent or address attacks on healthcare and strengthen its resilience in complex security settings.