FinlandLaki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä, Reporting of Deviations in Information Systems and Wellbeing Applications and of Significant Information Security Disturbances
90 §, Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä (703/2023)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Reporting
As of .
What it requires
- It reaches you if you are a social or health care service provider, a pharmacy, the Social Insurance Institution (Kela), the provider or manufacturer of an information system used to process client data, an intermediary, or the manufacturer of a wellbeing application (section 90).
- If you are a service provider or a pharmacy and detect a significant deviation in how an information system meets the essential requirements, notify the information system service provider (section 90).NIST CSF 2.0GV.SC-07
- If a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto); if you are a pharmacy and the deviation may put your operations at significant risk, also notify the Finnish Medicines Agency (section 90).NIST CSF 2.0RS.CO-03
- Notify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks you use that may significantly endanger the use of information systems or the provision of social and health care services; a pharmacy whose operations may be significantly endangered also notifies the Finnish Medicines Agency without delay (section 90).NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of . Also read by: Valvira (the National Supervisory Authority for Welfare and Health, the Lupa- ja valvontavirasto of section 90), presentation by its lawyer to the Kanta services supplier cooperation meeting of on the supervision of information systems (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Licensing and Supervisory Authority (Lupa- ja valvontavirasto), whose task under section 89 is to supervise and promote the conformity of information systems and wellbeing applications.
Settledness
- As of
- Guidance link
- https://www.kanta.fi/documents/portlet_file_entry/20143/06.+Tietoj%C3%A4rjestelmien+valvonnan+periaatteet.pdf/27591235-6b88-580e-3d83-77334aab04c2
- Guidance body
- Valvira (the National Supervisory Authority for Welfare and Health, the Lupa- ja valvontavirasto of section 90), presentation by its lawyer to the Kanta services supplier cooperation meeting of on the supervision of information systems
- Open questions
- When may a deviation in an information system or wellbeing application cause a significant risk to client or patient safety or to information security, so that section 90 requires notice to the Lupa- ja valvontavirasto, and how does that threshold differ from a significant deviation in meeting the essential requirements, which is notified only to the information system service provider?
What this law does
A service provider or pharmacy that detects significant deviations in how an information system meets the essential requirements must notify the information system service provider (section 90).
Where a deviation in an information system or wellbeing application may cause a significant risk to client or patient safety or to information security, a service provider, pharmacy, information system service provider or manufacturer, wellbeing application manufacturer, the Social Insurance Institution (Kela) or the Finnish Institute for Health and Welfare must notify the Licensing and Supervisory Authority (Lupa- ja valvontavirasto) (section 90).
A pharmacy must also notify the Finnish Medicines Agency (Lääkealan turvallisuus- ja kehittämiskeskus) where a deviation in an information system may cause a significant risk to the pharmacy's operations (section 90).
A service provider, pharmacy, the Social Insurance Institution and an information system service provider, information system manufacturer or intermediary must notify the Licensing and Supervisory Authority without delay of a significant information-security disturbance in the operating environments and networks they use that may significantly endanger the use of information systems and the provision of social and health care services (section 90).
The Licensing and Supervisory Authority may issue more detailed regulations on when a disturbance is significant and on the content, form and delivery of the notification (section 90). A pharmacy must also notify the Finnish Medicines Agency without delay of a significant information-security disturbance in the operating environments and networks it uses that may significantly endanger the pharmacy's operations (section 90).
Where notification of a deviation or disturbance is in the public interest, the Licensing and Supervisory Authority may require the notifying party to inform the public or, after hearing the party, inform the public itself (section 90). Section 90 leaves the notification of personal data breaches to the Data Protection Ombudsman to Article 33 of the General Data Protection Regulation. The Act, including section 90, took effect on .
When LexLint raises it
When your app profile says your app distributes a software product or handles health records.