Cypruse-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health Data
Law 59(I)/2019 (Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019), Arts. 26-27, 32-35
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Governance, Disclosure
As of .
What it requires
- If you provide health services in Cyprus, create a Provider Bank within the period the National eHealth Authority sets (Law 59(I)/2019 Article 26).
- Keep backup copies of the health data in your Provider Bank and log any recovery of data from backups, so that the nature and extent of any data loss can be assessed (Article 27, paragraph 1, point (d)).
- Keep the health data in the Provider Bank fully confidential, and have your authorized employees do the same (Article 27, paragraph 3).
- Log every access to the Electronic Health Record with at least the date and time, a unique transaction number, the type of processing, the unique identifier of the person accessing, the identifier of the data used, the search criteria and any error messages (Article 32).
- Do not access an Electronic Health Record without the citizen's consent (Article 34).
If you get it wrong
Penalty structure
Article 35(2) lets the Authority impose an administrative fine of up to EUR 10,000 per case, an additional fine of up to EUR 200 for each further case where the violation continues, and a fine of EUR 10,000 per Electronic Health Record.
- Rule
- Per violation only
- As of
- Currency
- EUR
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
National eHealth Authority (Εθνική Αρχή Ηλεκτρονικής Υγείας), which examines violations of the Law on complaint or on its own initiative and imposes the administrative fines.
What this law does
Within a period set by the National eHealth Authority, every health service provider must create a Provider Bank. The Provider Bank must keep backup copies of the health data, and any recovery of data from backups must be logged so that the nature and extent of any data loss can be assessed. The provider and its authorized employees must keep the health data in the Provider Bank fully confidential.
Any access to the Electronic Health Record must be logged, and each log entry must contain at least the date and time of access, a unique transaction number, the type of processing, the unique identifier of the person accessing, the identifier of the data used, the search criteria and any error messages. A person who violates the Law, or who gains access to an Electronic Health Record without the citizen's consent, is subject to an administrative fine imposed by the Authority.
When LexLint raises it
When your app profile says your app handles health records.