Handles health records, in Russia

Law 187-FZ, art. 9(2) and (3) (Federal Law of 26 July 2017 on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации) · Read the law's page

• This binds a subject of critical information infrastructure: a state body, a state institution or a Russian legal entity that owns, leases or otherwise lawfully holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, state registration of rights to real estate, banking and other financial-market spheres, the fuel and energy complex, atomic energy, defense, rocket and space, mining, metallurgical or chemical industry, or a Russian legal entity that ensures interaction between such systems (Article 2(8)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
• Inform the authorized federal executive authority immediately of computer attacks and computer incidents, in the order it sets; if you operate in the banking sphere or another financial-market sphere, inform the Central Bank of the Russian Federation as well, in an order the authority sets in agreement with the Central Bank (Article 9(2)(1)).
• Assist the officials of that authority in detecting, preventing and eliminating the consequences of computer attacks and in establishing the causes and conditions of computer incidents (Article 9(2)(2)).
• If you hold a significant object, respond to computer incidents in the order the authorized federal executive authority approves and take measures to eliminate the consequences of attacks on significant objects (Article 9(3)(3)).

Law 187-FZ, arts. 2, 7, 9, 10 and 14 (Federal Law of 26 July 2017 on the Security of Critical Information Infrastructure; О безопасности критической информационной инфраструктуры Российской Федерации) · Read the law's page

• This binds a subject of critical information infrastructure: a state body, a state institution or a Russian legal entity that owns, leases or otherwise lawfully holds an information system, telecommunications network or automated control system operating in healthcare, science, transport, communications, energy, state registration of rights to real estate, banking and other financial-market spheres, the fuel and energy complex, atomic energy, defense, rocket and space, mining, metallurgical or chemical industry, or a Russian legal entity that ensures interaction between such systems (Article 2(8)). You reach it by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services.
• Assign one of the three significance categories to each critical information infrastructure object you hold, under the significance criteria and the categorization procedure the law sets (Article 7(4)).
• For each significant object, create a security system and keep it operating, in line with the requirements the authorized federal executive authority approves (Article 10(1)).
• Observe the security requirements that the authorized federal executive authority sets for significant objects, and carry out its officials' orders to remedy violations of those requirements (Article 9(3)(1) and (2)).
• Give the officials of that authority unhindered access to your significant objects when they exercise their state-control powers (Article 9(3)(4)).
• Interact continuously with the state system for detecting, preventing and eliminating the consequences of computer attacks, in the order the authorized federal executive authority sets (Article 9(3)(7)).