FinlandLaki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Essential Requirements and Certification of Health and Social Care Information Systems
79-90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023)
In force since .
A product security requirements rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, DPIA
As of .
What it requires
- If you manufacture or supply a social or health care information system, or a wellbeing application, used to process client data in Finland, make it meet the essential requirements on interoperability, information security and data protection, and functionality, whether it is used alone or with the systems connected to it (Act 703/2023, section 84).NIST CSF 2.0PR.PS-06
- For a Class A system or application, certify it before production use: give the statement that it meets its functionality requirements, pass the approved interoperability test, and obtain the information-security assessment certificate from an information-security assessment body (sections 85, 86 and 87).NIST CSF 2.0ID.IM-01
- Do not put a Class A system or application into production use until it is certified and registered, or after its information-security assessment certificate has expired (section 81).NIST CSF 2.0GV.OC-03
- For a Class B system, give a written statement that, properly installed, maintained and used, it meets the essential requirements for its purpose (section 85).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.IM-01Improvements are identified from evaluations
- PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
2 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Licensing and Supervisory Authority (Lupa- ja valvontavirasto), whose task under section 89 is to supervise and promote the conformity of information systems and wellbeing applications.
Settledness
- As of
What this law does
An information system or wellbeing application used to process client data in social and health care must meet the essential requirements on interoperability, information security and data protection, and functionality (section 84).
A Class A system or application, which covers the national information system services, systems meant to connect to them, systems certified by their purpose and intermediary services, must show its conformity by certification, which includes the certificate of an information-security assessment body, and the provider is responsible for the certification (sections 79 and 85).
A Class A system or application may be put into production use only after it has been certified, and not if the certificate of its information-security assessment has expired (section 81). The information-security assessment is made on the application of the system service provider or the wellbeing application manufacturer (section 87). The certificate is valid for at most three years and can be extended by up to three years at a time (section 87).
The Licensing and Supervisory Authority (Lupa- ja valvontavirasto) supervises and promotes the conformity of information systems and wellbeing applications and may inspect without prior notice (section 89). Its decisions under the Act can be backed by a conditional fine (section 96). The Act took effect on and repealed the earlier Act 784/2021 on the electronic processing of client data (section 101).
When LexLint raises it
When your app profile says your app distributes a software product or handles health records.