Handles health records, in the Netherlands

Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg, Arts. 15d and 15e · Read the law's page

• If you are a care provider, give a client who asks for access to or a copy of the client's file, or of the client's data that you make available through an electronic exchange system, that access or copy electronically and at reasonable intervals (Wabvpz Article 15d, paragraph 1).
• If you are a pharmacist, give a client who asks direct electronic access to the client's medication data when dispensing medicines (Article 15d, paragraph 2).
• Provide the electronic access and the electronic copies free of charge (Article 15d, paragraph 3).
• On the client's request, include in a copy under Article 15d, paragraph 1 who made certain information available through the exchange system and on what date, and who viewed or requested certain information and on what date (Article 15e).

Cyberbeveiligingsbesluit (Besluit van 8 juli 2026), Artt. 2, 4-13 en 24-25 · Read the law's page

• If you are an essential or important entity under the Cyberbeveiligingswet, take at least the measures of Articles 6 to 18 of the Cyberbeveiligingsbesluit to implement Article 21 of the Act (Article 5). A DNS service provider, top-level domain registry, cloud-computing, data-centre, content-delivery-network, managed-service or managed-security-service provider, online marketplace, online search engine, social-networking platform or trust service provider answers to Implementing Regulation (EU) 2024/2690 instead (Article 4).
• Record in writing, and apply demonstrably, policies on the security of your network and information systems, on risk management (with a risk-management method and risk-acceptance criteria), on incident handling, and on business continuity and crisis management (Articles 6 to 9).
• Record a supply-chain security policy and check periodically that your direct suppliers and service providers meet your security requirements (Article 10).
• Apply a policy for the risks of acquiring software, hardware or services, apply secure-development processes across all development phases where they apply, and apply maintenance processes that cover at least configuration management and change management (Article 11).
• Make your staff aware of the risks to your network and information systems, have them apply cyber-hygiene practices, and give those whose roles need security expertise regular training (Article 12); keep a written cryptography policy that sets out when cryptography is used and who is responsible for key management (Article 13).
• In the early warning of a significant incident, give the presumed start time of the incident and, where possible, a description of its nature and visible effects, an estimate of the recovery time and the measures you plan or have taken, and make the notification at the reporting point the Minister sets up (Articles 24 and 25).

Cyberbeveiligingswet, Artt. 21 en 24 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your work or to provide your services, and to prevent an incident or limit its effect on the recipients of your services and on other services.
• Cover at minimum: risk analysis and information-system security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the direct suppliers and service providers you rely on; security in acquiring, developing and maintaining your systems, including vulnerability handling and disclosure; policies to assess the effectiveness of your risk-management measures; basic cyber-hygiene practices and staff training; cryptography and, where applicable, encryption policy; personnel security, access control and asset management; and, where appropriate, multi-factor or continuous authentication, and secure voice, video, text and emergency communications.
• Have your management board approve these measures, and ensure every board member holds the knowledge and skills to identify network-and-information-system risks, assess your cybersecurity risk-management measures, and assess their consequences for your services, within two years of this duty taking effect or, for a member appointed afterwards, within two years of appointment.
• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2; Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1's digital-infrastructure and ICT-service-management entries separately name a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, so a service in any of those six lines is reached at the medium-enterprise size threshold or above; the wider sector classes (energy, transport, banking, health, drinking water, public administration and the rest of the Annexes) are reached too, by declaring that you are an essential or important entity. A financial entity covered by Regulation (EU) 2022/2554 answers under that Regulation instead, because Article 22 sets this Article aside where a sector-specific act of the European Union is at least equivalent.

Cyberbeveiligingswet, Artt. 25-29 · Read the law's page

• This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2, on the same scope as this jurisdiction's companion risk-management row: Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1 separately names a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, each at the medium-enterprise size threshold or above; the wider sector classes are reached as on that row. A financial entity covered by Regulation (EU) 2022/2554 reports under that Regulation instead, because Article 31 sets Articles 25 to 30 aside where a sector-specific act of the European Union is at least equivalent.
• Give your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects.
• Follow with a notification, without delay or, if that is not possible, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident's severity and effects. If you provide a trust service and the incident affects its provision, file this notification without delay or, if that is not possible, within 24 hours of becoming aware of the incident instead.
• Submit an interim report if your CSIRT or competent authority asks for one.
• Submit a final report no later than one month after your notification, describing the incident in detail, its severity and effects, the likely threat or root cause, mitigating measures applied, and any cross-border effects; if the incident is still ongoing at that point, submit a progress report instead and the final report within one month of resolution.
• Where appropriate, inform the recipients of your service of the incident and of any measures they can take in response (Article 30).

Burgerlijk Wetboek Boek 7, Art. 457 · Read the law's page

• If you are a care provider treating a patient, give no one other than the patient information about the patient, or access to or a copy of the data in the patient's file, without the patient's consent, unless a rule of or under the law makes the provision obligatory (Burgerlijk Wetboek Boek 7 Article 457, paragraph 1).
• Where you do provide information, provide it only so far as that does not harm the privacy of another person (Article 457, paragraph 1).

Burgerlijk Wetboek Boek 7, Art. 458 · Read the law's page

• If you are a care provider, give information about a patient or access to the patient's file to another person for statistics or scientific research in the field of public health without the patient's consent only where asking consent is reasonably impossible and the research provides safeguards against disproportionate harm to the patient's privacy, or where consent cannot reasonably be demanded and you have seen to it that the data are provided in a form that reasonably prevents tracing them to individual natural persons (Burgerlijk Wetboek Boek 7 Article 458, paragraph 1).
• Provide the data only if the research serves a general interest, cannot be carried out without the data, and the patient has not expressly objected to the provision (Article 458, paragraph 2).
• Note each such provision of information in the patient's file (Article 458, paragraph 3).

Burgerlijk Wetboek Boek 7, Arts. 455 and 456 · Read the law's page

• If you are a care provider treating a patient, destroy the data in the patient's file after a written or electronic request from the patient, except for data whose retention is reasonably likely to be of considerable importance to someone other than the patient, or where a rule of or under the law opposes destruction (Burgerlijk Wetboek Boek 7 Article 455).
• Give the patient who asks access to, and a copy of, the data in the patient's file, withholding them only so far as necessary to protect another person's privacy (Article 456).

Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg, Arts. 15a and 15f · Read the law's page

• If you are a care provider, make a client's data available through an electronic exchange system only so far as you have established that the client gave express consent (Wabvpz Article 15a, paragraph 1).
• Make a client's data available through an electronic exchange system only so far as another care provider's consultation of the data does not harm the privacy of someone other than the client (Article 15a, paragraph 3).
• If you work as a company doctor, insurance doctor or examining doctor for medical examinations under the Wet op de medische keuringen, do not obtain access to electronic exchange systems and do not process data from them (Article 15f, paragraph 2).