Handles health records, in Norway

Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 7 and 10 · Read the law's page

• Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors (reached by declaring that you operate an essential service), and to providers of online marketplaces, online search engines and cloud services. A bank or health provider among them is also reached by declaring that you provide financial services or handle health records.
• A provider of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the digital-service security duty (digitalsikkerhetsforskriften section 2, as the National Security Authority's guide states it).
• Carry out a risk assessment of the network and information systems you use to deliver the service (sections 7 and 10).
• Put in place appropriate and proportionate technical and organisational security measures that together secure a level of security adapted to the risk (sections 7 and 10).
• Put in place proportionate measures to prevent, detect and reduce the consequences of incidents, so that delivery of the service can be maintained (sections 7 and 10).

Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 8 and 11 · Read the law's page

• Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors, and to providers of online marketplaces, online search engines and cloud services. The essential-service classes are reached by declaring that you operate an essential service, provide financial services or handle health records.
• Notify the body the King designates, without undue delay and regardless of confidentiality duties, of incidents that significantly affect the delivery of an essential societal service (section 8) or a digital service (section 11).
• As an essential-service provider, send the first notice within 24 hours of becoming aware of the incident, an update within 72 hours, and an incident report within one month of the first notice (digitalsikkerhetsforskriften section 17, as the National Security Authority states it).
• As a digital-service provider, the 24-hour, 72-hour and one-month deadlines do not apply; notify without undue delay (section 11). A provider with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the notification duty, as the National Security Authority's guide states it.