Handles health records, in Romania

Ordonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17 · Read the law's page

• Report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).
• Report to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)).
• Submit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the CSIRT requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point.
• Where relevant, notify the recipients of your services of a significant incident that could affect them.
• If you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock.
• This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Ordonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 11-14 · Read the law's page

• Take technical, operational and organisational measures proportionate to your risk exposure to identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services.
• Cover at least: risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of your risk-management measures; cryptography and encryption policy; supply-chain security, including the security of your relationship with your direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access control and asset management; incident management; business continuity, including backups, disaster recovery and crisis management; basic cyber-hygiene practices and training; and multi-factor or continuous authentication.
• Have your governing body approve these measures, supervise their implementation and bear responsibility for them; have each member of the governing body attend accredited cybersecurity training and train all your staff regularly; establish permanent means of contact and allocate the resources the measures need; and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying you and entering you in the register.
• This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure, public administration, and a size-gated telecom or managed-security-service provider) are reached too, by declaring that you are an essential or important entity.

Ordinul directorului DNSC nr. 1/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-6 · Read the law's page

• If you are an entity in a sector of Annex 1 or 2 of Ordonanța de urgență nr. 155/2024, use the NIS2@RO platform or the NIS2@RO tool to evaluate whether you are an essential or important entity and to generate the notification form for registration (Articles 2 and 3).
• Complete the notification form's six sections: general data, specific data (including size, services, contact points and your network address ranges), specific situations, attached documents, preliminary assessment and entity representation (Articles 4 and 5).
• Attach the documents that show you meet the medium or large enterprise thresholds, and any further documents DNSC asks for before registration (Article 5(4)).
• Have your legal representative sign the form with a qualified electronic signature and upload it to the platform, or send it to evidenta@dnsc.ro or file it on paper at DNSC's headquarters when you use the tool (Article 6).

Ordinul directorului DNSC nr. 2/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-5 · Read the law's page

• If you are an entity within Annex 1 or 2 of Ordonanța de urgență nr. 155/2024 that has not been qualified as essential or important under its Articles 5, 6 and 9 criteria, assess the degree of disruption of each service you provide that falls within those Annexes, using the thresholds in Annex 1 to Order 2/2025, and use the result to complete the registration information (Article 1).
• Calculate your overall risk score with the formulas in Annex 2 to the order, starting from the base values for your entity type or sector and your size, and implement the category of security measures that the score sets (Articles 4 and 5(1)).
• If you operate in several sectors, assess your risk level for each sector and implement the level of measures that matches your highest overall score (Article 5(2)).
• If your own impact or probability values differ from the sector base values, send DNSC an analysis with a sound reason for each value you ask to change (Article 5(3)).
• Recalculate your overall score every three years and whenever the high impact threshold for your sector is exceeded, unless you already apply the highest level of measures (Article 5(5)).