Handles health records, in the United Kingdom

The Network and Information Systems Regulations 2018, SI 2018/506, reg. 10 · Read the law's page

• Applies to an operator of an essential service: a person whose essential service of a kind listed in Schedule 2 (electricity, oil, gas, air, water, rail and road transport, health care settings, drinking water supply and distribution, and digital infrastructure) relies on network and information systems and meets the Schedule 2 threshold, or whom a competent authority designates under regulation 8(3). Reached by declaring that you operate an essential service, and, for a health care setting, that you handle health records.
• Take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of the network and information systems on which your essential service relies (regulation 10(1)).
• Take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting those systems, with a view to ensuring the continuity of your essential service (regulation 10(2)).
• Ensure, having regard to the state of the art, a level of security of network and information systems appropriate to the risk posed (regulation 10(3)).
• Have regard to any relevant guidance issued by your designated competent authority when carrying out these duties (regulation 10(4)).

The Network and Information Systems Regulations 2018, SI 2018/506, reg. 11 · Read the law's page

• Applies to the operators of essential services described in the security duties of regulation 10: a person whose essential service of a kind listed in Schedule 2 relies on network and information systems and meets the Schedule 2 threshold, or whom a competent authority designates. Reached by declaring that you operate an essential service, and, for a health care setting, that you handle health records.
• Notify your designated competent authority in writing about any incident that has a significant impact on the continuity of the essential service you provide (regulation 11(1)).
• Give the notification without undue delay and in any event no later than 72 hours after you are aware that the incident has occurred, in the form and manner the competent authority determines (regulation 11(3)(b)).
• In judging the significance of the impact, have regard to the number of users affected by the disruption, the duration of the incident and the geographical area affected (regulation 11(2)).
• State in the notification your name and the essential services you provide, the time and duration of the incident, its nature and impact, any cross-border impact, and any other information that may help the competent authority (regulation 11(3)(a)).
• Where you rely on a relevant digital service provider to provide the essential service, notify your competent authority without undue delay of any significant impact on the continuity of the service caused by an incident affecting that provider (regulation 12(9)).