Handles health records, in Croatia

Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 29. i 30. · Read the law's page

• Take risk-management measures sized to your exposure, covering at minimum: risk-analysis and information-system-security policies, incident-handling procedures (monitoring, logging and reporting), business continuity including backup management and disaster recovery, supply-chain security accounting for your direct suppliers' and service providers' vulnerabilities, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security and access control including asset inventories, and, where appropriate, multi-factor or continuous authentication and secured communications.
• Have the members of your management body, or, if you are a public entity, the heads of your state administration or local self-government body, approve these measures and control their implementation, and have them attend, and make available to your staff, appropriate cybersecurity training covering risk-management issues and their effect on your services.
• This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; you become an important entity at the general medium-enterprise-or-larger size threshold Article 10 applies to Annex II entities. The wider sector classes the Act also reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing, research, education and others) are reached too where you meet the Article 9 or 10 criteria for them; the competent authority categorizes you and notifies you of your category and your obligations (Articles 17(1) and 19(1)).

Zakon o kibernetičkoj sigurnosti, Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85. · Read the law's page

• Notify the competent CSIRT of every significant incident on this clock, set by the Cybersecurity Regulation rather than the Act itself: an early warning without delay and no later than 24 hours after becoming aware of it (24 hours also for a trust service provider's initial notification), an initial notification no later than 72 hours otherwise, an interim report if the CSIRT requests one, and a final report no later than 30 days after your initial notification, or, if the incident is still unresolved at that point, a progress report instead, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of your last progress report.
• Submit an interim report to the CSIRT when it requests one, within the period the CSIRT sets, of no less than 48 hours and no more than seven days from receipt of the request.
• Notify the recipients of your service, without delay and no later than 72 hours after you become aware of a significant incident likely to affect them, in a clear and easily verifiable way, and send them any details that were not yet known within 72 hours of sending that notice. Separately notify them of a serious cyber threat and of any protective measures or remedies they can take.
• Same fine tiers and misdemeanor-prosecution mechanism as this jurisdiction's companion risk-management-and-governance row: EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover for an essential entity, EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent for an important entity, whichever amount is higher, enforced either by a misdemeanor order the competent authority issues itself or by referral to the state attorney for misdemeanor prosecution.
• This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.
• If you are newly categorized as an essential or important entity, you have 30 days from the date you receive your Article 19(1) categorization notice before these notification duties bind you.

Pravilnik o načinu obrade zdravstvenih i drugih osobnih podataka u zdravstvenim nacionalnim i institucionalnim informacijskim sustavima u zdravstvu (Narodne novine 150/2024), čl. 6-10 · Read the law's page

• If you operate or build a system that stores or processes health or other personal data in a Croatian national or institutional health information system, process the data with appropriate security and confidentiality and apply pseudonymization, encryption, restoration and regular testing measures (Rulebook Articles 6 and 7).
• Allow access only to users on the basis of user roles, authentication and authorization, keep audit records of all activity in the system, and require strong passwords of at least 16 characters (Article 8).
• Make backups at suitable intervals, test them regularly, and keep them on equipment and at a location different from the primary storage (Article 8).
• If you are a software provider in these systems, keep the personal data you learn permanently confidential and take the technical and organizational measures needed to secure confidentiality, integrity and availability (Article 9, paragraphs 2 and 3).
• If you use a health information system, identify and authenticate with an identification digital certificate or another credential of substantial assurance level, and do not let anyone else use it (Article 10, paragraphs 1 and 2).