Handles health records, in Finland

Laki sosiaali- ja terveystietojen toissijaisesta käytöstä 552/2019, 14, 15, 51 and 52 § · Read the law's page

• If you are the permit authority or an organisation named in section 6 that has granted a data permit or made a positive data request decision, pseudonymise or anonymise the data set before the permit holder processes it, or produce the aggregated statistical data the request asks for (section 14).
• If you are the permit authority or an organisation named in section 6, keep a description of how you formed each data set and aggregated statistic you released, of the pseudonymisation and anonymisation methods you used and of the results you released (section 14).
• If you release personal data as pseudonymised data under several different data utilisation plans, pseudonymise it with a different identifier for each release (section 14).
• If you are the authority that granted a data permit on pseudonymised data, keep the identifiers securely, so that the data set can be made identifiable again and reproduced, for as long as the research and the checking of its results need them (section 15).
• If you hold a data permit and want to bring results out of the secure processing environment, anonymise them, tell the permit authority that you intend to bring them out, and expect the permit authority to verify the anonymisation on a risk-based assessment (section 52).

79-90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) · Read the law's page

• If you manufacture or supply a social or health care information system, or a wellbeing application, used to process client data in Finland, make it meet the essential requirements on interoperability, information security and data protection, and functionality, whether it is used alone or with the systems connected to it (Act 703/2023, section 84).
• For a Class A system or application, certify it before production use: give the statement that it meets its functionality requirements, pass the approved interoperability test, and obtain the information-security assessment certificate from an information-security assessment body (sections 85, 86 and 87).
• Do not put a Class A system or application into production use until it is certified and registered, or after its information-security assessment certificate has expired (section 81).
• For a Class B system, give a written statement that, properly installed, maintained and used, it meets the essential requirements for its purpose (section 85).

90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023) · Read the law's page

• It reaches you if you are a social or health care service provider, a pharmacy, the Social Insurance Institution (Kela), the provider or manufacturer of an information system used to process client data, an intermediary, or the manufacturer of a wellbeing application (section 90).
• If you are a service provider or a pharmacy and detect a significant deviation in how an information system meets the essential requirements, notify the information system service provider (section 90).
• If a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto); if you are a pharmacy and the deviation may put your operations at significant risk, also notify the Finnish Medicines Agency (section 90).
• Notify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks you use that may significantly endanger the use of information systems or the provision of social and health care services; a pharmacy whose operations may be significantly endangered also notifies the Finnish Medicines Agency without delay (section 90).