Handles health records, in Chile

Ley 20.120, Sobre la Investigación Científica en el Ser Humano, su Genoma, y Prohíbe la Clonación Humana, art. 9 (identidad genética) · Read the law's page

• Investigate and determine a person's genetic identity only with that person's prior and informed consent or, failing that, the consent of whoever must supply the person's will in accordance with the law (Article 9); courts keep their powers in the cases and form the law establishes.

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 4 y 7 · Read the law's page

• This binds an institution that provides a service qualified as essential under article 4 (a State body, a public-service concessionaire, or a private institution in electricity, fuels, water, telecommunications, digital infrastructure, digital and managed information technology services, transport, banking, financial services and payment means, social-security administration, postal and courier services, institutional health care, or pharmaceutical production or research), and an institution the Agency designates an operator of vital importance (reached by declaring that you operate an essential service). The Agency identifies the specific infrastructure, processes or functions so qualified by exempt resolution. These duties apply from 1 January 2025.
• Apply permanently measures to prevent, report and resolve cybersecurity incidents, which may be technological, organizational, physical or informational (article 7).
• Implement the protocols and standards the Agencia Nacional de Ciberseguridad sets, and the particular cybersecurity standards issued under the sectoral regulation that applies to you (article 7).

Decreto N° 295, Reglamento de Reporte de Incidentes de Ciberseguridad de la Ley N° 21.663, arts. 2, 3, 5, 6 y 8 a 13 · Read the law's page

• This binds a public or private institution that provides a service qualified as essential and an institution qualified as an operator of vital importance (reached by declaring that you operate an essential service). The regulation details the reporting duty of article 9 of the Act, which applies from 1 March 2025.
• Report to the CSIRT Nacional every cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, affect the integrity or confidentiality of computer assets or the availability of a network or system, involve unauthorized use of or entry into networks or systems, or affect systems holding personal data (articles 2 and 3).
• Make every report through the notification platform the Agency provides, and leave all personal data out of it (articles 6 and 8).
• Send an early warning within a maximum of three hours from becoming aware of the incident, with at least the identification of the institution, its cybersecurity delegate, the date and time you learned of it, the signs of the incident and the assets affected (articles 5 and 9).
• Send a second report after seventy-two hours from becoming aware of the incident, or within twenty-four hours if you are an operator of vital importance whose essential service is affected, updating all the information with an initial assessment of severity and impact and any indicators of compromise (article 10).
• If you are an operator of vital importance, implement and report your action plan within no more than seven calendar days from becoming aware of the incident, including a data recovery programme, technical and administrative responsibilities and an estimate of the time to restore services (article 11).
• Within a maximum of fifteen calendar days from sending the early warning, and once the incident has been managed, send a final report; while it is not managed, send a partial report updated every fifteen days (articles 12 and 13).

Ley N° 21.663, Ley Marco de Ciberseguridad, arts. 9 y 27 · Read the law's page

• This binds every public and private institution named in article 4, that is an institution that provides a service qualified as essential or is qualified as an operator of vital importance (reached by declaring that you operate an essential service). These duties apply from 1 March 2025.
• Report to the CSIRT Nacional, as soon as possible, any cyberattack or cybersecurity incident that may have significant effects, meaning one that can interrupt an essential service, affect the physical integrity or health of persons, or affect systems holding personal data (articles 9 and 27).
• Send an early warning within a maximum of three hours from becoming aware of the incident (article 9, letter a).
• Within a maximum of seventy-two hours, send an update with an initial assessment of the incident, its severity and impact, and indicators of compromise if available; if you are an operator of vital importance whose essential service is affected, send it within a maximum of twenty-four hours (article 9, letter b).
• Within a maximum of fifteen calendar days from the early warning, send a final report with a detailed description of the incident, the type of threat or main cause, the mitigation measures applied and under way, and any cross-border repercussions (article 9, letter c).
• If you are an operator of vital importance, also report your action plan to the CSIRT Nacional as soon as you adopt it, no later than seven calendar days after becoming aware of the incident (article 9).

Ley 20.584, Regula los Derechos y Deberes que Tienen las Personas en Relación con Acciones Vinculadas a su Atención en Salud, arts. 12 and 13 (ficha clínica) · Read the law's page

• Treat all information in a ficha clínica, and in the studies and documents recording procedures and treatments, as sensitive data under Ley 19.628 (Article 12).
• Keep the ficha clínica for at least fifteen years, complete, accessible, preserved and confidential in whatever medium it is held (Articles 12 and 13).
• Give no access to the ficha clínica to third parties not directly related to the person's health care, including staff of the same provider who are not linked to the care (Article 13).
• Deliver or make accessible the ficha clínica, in whole or in part, on the express request of the holder, the holder's legal representative or heirs, and of the other persons and bodies Article 13 lists, in the cases and form it states.
• Where you receive access to a ficha clínica, keep the holder's identity and the sensitive data in it confidential and use the information only for the purpose for which it was requested (Article 13).

Ley 21.719, art. 16 bis of Ley 19.628 as inserted by Artículo primero (datos personales sensibles relativos a la salud y al perfil biológico humano) · Read the law's page

• From 1 December 2026, process data on a person's health or human biological profile (including genetic, proteomic or metabolic data) only with the data subject's express consent under Article 16 and only for the purposes the special health laws provide, unless an Article 16 bis exception applies.
• From 1 December 2026, do not process or cede health or biological profile data, or biological samples tied to an identifiable person, that were collected in a labor, educational, sports, social, insurance, security or identification setting, unless the law expressly authorizes it in a qualified case (Article 16 bis).