Social welfare and healthcare data systems

Valvira oversees the implementation of the key requirements of the data systems intended for processing social welfare and healthcare customer and patient data.

Data system means software or a system implemented for the electronic processing of social welfare and healthcare customer data and which is used to store and maintain customer and patient documents and the information they contain. A data system must comply with the key requirements regarding interoperability, data security and protection, and functionality before it can be deployed. The data system supplier is responsible for demonstrating compliance.

The Act on the Electronic Processing of Client Data in Healthcare and Social Welfare (784/2021) defines the general requirements for data systems and their suppliers as well as for social welfare and healthcare service providers. Detailed key requirements for data systems are laid down in the regulations of the Finnish Institute for Health and Welfare. As far as this Act is concerned, Valvira’s main task is to maintain a register of compliant data systems. In addition, Valvira receives and deals with reports from service providers concerning significant deviations that jeopardise data security and protection or patient safety. On top of this, Valvira also deals with notifications by data system suppliers about significant deviations from the key requirements of the data system relating to national data system services.

Valvira is also responsible for the steering and supervision of the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare. Valvira also has the right to carry out the inspections required by supervision.

Data systems register

Information notified to Valvira about the data systems is stored in a register in Excel format. A new register version is published roughly once a month. The workbook stores class A and B data systems in their own Excel sheet tabs.

Data system register (Excel, updated 21.1.2022, in Finnish only)

Kela’s joint testing data of Kanta Services systems can be viewed on the Kanta website.

Key definitions

Data system

Software or a system for the electronic processing of social welfare or healthcare customer data and which is used to store and maintain customer and patient documents and the information they contain as well as a file or data resource maintained by automatic data processing of collected data and which has been specifically designed by the supplier for the processing of social welfare or healthcare customer or patient documents and the information they contain.

Intermediary service

Data system also means an intermediary service whereby social welfare and healthcare customer data is transmitted to the national information system services maintained by the Social Insurance Institution of Finland (as provided in section 14 of the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare (784/2021).

Service provider

A provider of healthcare services means a health care unit as referred to in section 2, subsection 4 of the Act on the Status and Rights of Patients (785/1992), an employer as referred to in section 7, subsection 2 of the Occupational Health Care Act (1383/2001) as well as an occupational healthcare professional acting as a self-employed person;
A provider of social welfare means an authority arranging social welfare, a public social services provider as referred to in section 3, subsection 2 of the Act on the Status and Rights of Social Welfare Clients as well as a provider of services referred to in the Act on Private Social Services (922/2011).

Data system classification

Social welfare and healthcare data systems are divided into classes A and B on the basis of their intended uses and characteristics.

Class A

Kanta Services maintained by the Social Insurance Institution of Finland as well as data systems that are intended to be connected to Kanta Services either directly or through a technical intermediary service.

An intermediary service also comes under Class A.

Class B

Other data systems come under Class B.

Notices to Valvira

The supplier must notify Valvira of a data system to be deployed (notification form, pdf). Besides the notification form, a so-called system form must also be completed (system form, xls, in Finnish only), which must be sent as well as the notification form to an email to Valvira’s registry at kirjaamo(at)valvira.fi.

The service provider must report any significant deviations to the data system supplier. Where a deviation can result in a significant risk to patient safety, data security and protection, Valvira must also be notified of the deviation (kirjaamo(at)valvira.fi).

The supplier must, by means of an up-to-date systematic procedure, monitor and assess the experience gained from the data system during its production use. The supplier must notify Valvira of any significant deviations relating to its data systems.