Handles health records, in Ireland

Disability Act 2005 (No. 14 of 2005), Part 4, ss. 41 and 42 · Read the law's page

• Do not process genetic data in Ireland in relation to a person's employment, a policy of insurance or life assurance, a policy of health insurance or health-related insurance, an occupational pension, a retirement annuity contract or other pension arrangement, or the mortgaging of property.
• Do not carry out genetic testing on a person in Ireland unless the testing is not prohibited by law and you have the person's consent to the processing of the genetic data the testing will produce, obtained in accordance with the GDPR.
• Before you process genetic data in Ireland, take all reasonable steps to give the data subject all appropriate information about the purpose and possible outcomes of the processing and any potential implications for the data subject's health that may become known as a result.

Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 · Read the law's page

• If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
• Where your assessment of the health research indicates a high risk to the rights and freedoms of individuals, carry out a data protection impact assessment.
• Obtain each data subject's explicit consent before the health research begins, record and retain it, and give the data subject a copy, unless Regulation 3A (an approved low-risk retrospective chart review) or a declaration by the Committee under Regulation 5 removes the requirement.

S.I. No. 360/2018, Regs. 17 and 21 · Read the law's page

• Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.
• As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services in the energy, transport, health, drinking water supply and distribution, or digital infrastructure sectors under Schedule 1 (Regulation 17 does not apply in the banking and financial market infrastructure sectors); the operator-of-essential-services class is reached by declaring that you operate an essential service.

S.I. No. 360/2018, Regs. 18 and 22 · Read the law's page

• Notify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on.
• Notify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)).
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services under Schedule 1; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.

Data Protection Act 2018 (Access Modification) (Health) Regulations 2022 (S.I. No. 121 of 2022), regs. 4 to 9 · Read the law's page

• You may restrict a person's GDPR Article 15 right of access to their health data in Ireland only to the extent necessary and proportionate, and only for as long as necessary to protect the health of the data subject.
• You must still grant access to so much of the health data sought as can be granted without causing serious harm to the physical or mental health of the data subject.
• If you withhold health data under Regulation 6 or 7, advise the data subject that, if they ask, you will offer access to a health practitioner they specify, and keep the data available for that purpose.

Health Information Act 2026 (No. 10 of 2026), ss. 10, 12, 19-22 · Read the law's page

• If you are a health services provider in Ireland, record each patient's personal public service number and associate it with any record you make about the health service you provide to that patient, and do not refuse a service solely because the patient has no number or cannot provide it (Health Information Act 2026 Section 12).
• Do not refuse a health service to a patient solely because the patient has not been assigned an Electronic Health Record (Section 10, paragraph 3).
• If the Health Service Executive requests, in writing, the classes of personal health data it specifies for the Electronic Health Record, provide them in the digital format and within the period the request sets (Section 19, paragraphs 3 and 4).
• If the Executive requests health information from you as a relevant person, provide the classes it specifies (Section 22, paragraph 1).

Head 15, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Notify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15).
• Where the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15).
• If you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15).
• Where appropriate, notify the recipients of your service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached as on this jurisdiction's companion risk-management row.

Head 29, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached too, by declaring that you are an essential or important entity.

Health Information Act 2026 (No. 10 of 2026), ss. 7-8, 13-15 · Read the law's page

• If you are a health services provider treating a patient, forward the personal health data you consider relevant, necessary and proportionate to another provider also treating the patient, in a digital format using the standards in the guidelines and within the period they specify (Health Information Act 2026 Section 7).
• If a patient asks you in writing to furnish a copy of the patient's personal health data to another provider of the patient, furnish it free of charge as soon as practicable and within one month of receiving the notice (Section 8, paragraphs 1 and 2).
• After furnishing the copy, advise the patient or the specified person in writing that you have done so (Section 8, paragraph 3).
• If you are the Health Service Executive, provide access to an Electronic Health Record to the patient, an appropriate person and a provider treating the patient, let a patient request rectification, and make information about each access available to the patient free of charge and without delay (Sections 13 and 15).