Handles health records, in Uruguay

Ley N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud) · Read the law's page

• Do not require anyone to provide sensitive data (racial or ethnic origin, political opinion, religious or moral conviction, union affiliation, health, or sexual life), and process what you do collect only with the data subject's express written consent.
• Collect and process sensitive data absent that consent only where an interest-general law authorizes it, the requesting body has a legal mandate to do so, or the purpose is statistical or scientific and the data is disassociated from its subject.
• Do not build a database whose content directly or indirectly reveals sensitive data, unless you are a political party, union, church, or other nonprofit body processing only your own members' sensitive data for your own political, religious, or similarly aligned purpose, and even then never communicate it further without the member's consent.
• If you are a health establishment or a health professional, collect and process a patient's physical or mental health data only under the rules of professional secrecy and the applicable health-sector regulations.

Decreto N° 66/025, arts. 10(g) y 12 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Communicate the occurrence of a cybersecurity incident to CERTuy within 24 hours of becoming aware of it, in the form and conditions CERTuy sets (article 10(g)).
• Report the existence of a potential cybersecurity incident fully and immediately, under the criteria CERTuy sets (article 12(a)).
• Make available to CERTuy, and to the sector CSIRT where there is one, all the information they request, within the times they ask (article 12(b)).
• Repair the consequences of incidents that affect critical information assets, in accordance with the recommendations you are given (article 12(c)).

Decreto N° 66/025, arts. 10, 11, 14 a 18 y 21 · Read the law's page

• This binds all public entities and private entities linked to services or sectors critical to the country. The decree defines critical services as the fundamental services of government and the economy in the critical sectors (health, public order, emergency services, energy, telecommunications, transport, drinking water supply, ecology and environment, agro-industry, industry, public services, banking and financial services, and defense, and other sectors the Executive Power determines), any other service that affects more than 30% of the population, and other services the Executive Power determines (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services).
• Adopt effective security measures to protect your critical information assets, following the guidelines AGESIC sets (article 10(a)).
• Designate an information security officer, who may be internal or external to the entity (article 10(c)).
• Keep centralized audit traces of your information systems for no less than twelve months, or the period CERTuy determines (article 11(a)).
• Adopt the Marco de Ciberseguridad AGESIC developed and meet the minimum maturity level assigned to your profile (article 14).
• Carry out audits under the Marco de Ciberseguridad at the periodicity AGESIC defines (article 16), send AGESIC an executive summary within 30 calendar days of finishing each audit, and send a compliance action plan within 60 calendar days of finishing the external audit where improvements are needed (article 17).
• Guarantee that the services you outsource to meet your tasks comply with the Marco de Ciberseguridad (article 18).