Information system database for social welfare and healthcare
Valvira maintains a public information system database, as referred to in the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare, of information systems intended for the processing, storing and maintenance of client data and of patient data. The database also contains details of the client data transfer systems through which a client or patient information system can be linked to the Kanta Services.
The information system database maintained by Valvira is an official register containing details of client and patient information systems as referred to in the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare, of pharmacy systems and of client data transfer systems that social welfare and healthcare service providers are allowed to deploy. If for any information system there are no current details in the Valvira information system database, or if there is a note in the database to the effect that a data security certificate has expired, then service providers are not allowed to deploy such an information system.
Information system database for social welfare and healthcare (in Finnish)
The information system database is in Excel format and it was last updated on 26.4.2024.
The Valvira information system database for social welfare and healthcare contains details on:
- social welfare and healthcare information systems intended for production use, their purpose and their compliance with essential requirements
- results of the interoperability testing of category A2 and A3 social welfare and healthcare information systems,
- validity of the data security certificates issued on the basis of data security audits conducted on category A social welfare and healthcare information systems,
- significant nonconformities noted in a category A information system in production use, for the duration of the nonconformity.
Category A information systems registered by Valvira have passed their category-appropriate certification, in addition to which the information system supplier declares in the registration notification that the information system is compliant with the essential requirements relevant for its purpose.
Registration of category B information systems requires that the information system supplier has submitted a written report to Valvira affirming that the information system, when appropriately installed, maintained and used, complies with the essential requirements relevant for its purpose.
Information system suppliers are responsible for entering their systems in the Valvira information system database.
The information system details entered in the database constitute a crucial information source for the oversight required in the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare.
Register an information system in accordance with the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare
Information system suppliers must notify Valvira about information systems in accordance with the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare so that they can be registered in the Valvira information system database. An information system must not be deployed until its details have been entered in the information system database for social welfare and health care.
Information system suppliers must also notify Valvira of any changes which have a bearing on the details in the information system database or which are otherwise crucial from the perspective of the essential requirements for the system or their oversight. Further information on notifications of changes can be found under Frequently Asked Questions about information system registration (questions 4 and 5).
When an information system supplier registers an information system with Valvira, the supplier becomes responsible for ensuring that the system will comply with the essential requirements relevant for its purpose for the duration of its production use.
Registration is subject to a fee
Registration under the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare is subject to a fee. Fees for information system registration:
- First registration of a category A information system (including wellbeing applications), EUR 1200
- First registration of a category B information system, EUR 600
- Information system change notification registration, EUR 300
- Before submitting a registration notification, please carefully read Frequently Asked Questions about information system registration.
Make a registration notification
Frequently Asked Questions about information system registration
The registration notification page will guide you through filling out and submitting the notification. Filling out the registration notification and the appended system form fully and accurately will expedite the processing of your notification.
Once you have filled out the registration notification, attached all the required appendices and sent it, it will be delivered to the Valvira registry.
Please check the following before filling out the registration notification:
- you are about to register an information system according to the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare
- you know to which category the information system belongs
- you know what the purpose of the information system is and its profile(s)
- you have carefully filled out the THL system form.
- if your information system is in category A, you have verified that the system has been issued all the documents required for registration (a joint testing statement or statements from Kela and a data security certificate issued by a data security inspection body).
Once a registration notification is received by Valvira, Valvira will verify that the notification contains all the information required for registration. Valvira will also verify that all the documents required for processing were submitted as appendices to the notification.
If there are any unclear points, omissions, errors or discrepancies in the information provided, these must be investigated before the information system can be entered in the information system database or details already in the database updated. In such a case, Valvira will contact the information system service supplier.
An information system will be entered in the database, or details already in the database updated, once Valvira has received the full and correct information required.
Although not all of the details requested in the registration notification, system form and other appendices will be published in the information system database, the details will nevertheless be stored in the Valvira case management system. If any supervisory measures are taken in respect of a system, the details in the registration notification may be used as baseline data in those supervisory measures.
Valvira typically releases a new version of the information system database every Friday. However, if no updates have been made to the database during the week, the release of the new version will be postponed to the following Friday.
Please note that public holidays and annual holidays may also have an impact on information system database updates.
Once an information system has been entered in the Valvira information system database for social welfare and health care, the information system supplier must ensure that the details in the database are kept up to date until such time as the information system is deleted from the database.
Information system suppliers are required to notify Valvira of the following changes:
- any new functionality implemented in the information system concerning which a new joint testing statement has been issued for the system,
- any changes or repairs made to the information system which have been verified in Kela joint testing and concerning which a new joint testing statement has been issued for the system,
- any changes or repairs made to the information system on the basis of which an information security inspection body has performed a change audit on the information system and issued a data security certificate for the system,
- updates made to keep the information system compliant with requirements,
- changes to the details of the information system, e.g. change of the product name of the system,
- changes to the details of the information system supplier, e.g. change of the name of the supplier or supplier replacement as a result of a corporate acquisition,
- removing the information system from production use.
Valvira will charge a fee for updating the information system database when an information system supplier notifies Valvira of any of the following changes:
- any new functionality implemented in the information system concerning which a new joint testing statement has been issued for the system,
- any changes made to the information system pursuant to which a data security inspection body has performed a data security change audit on the information system or, at the request of the supplier, a complete data security audit; the information system receives a new data security certificate,
- updates made to keep the information system compliant with requirements,
- replacement of the information system supplier, e.g. due to a corporate acquisition.
Valvira will not charge a fee when an information system supplier notifies Valvira of any of the following changes, even though they may require updating the information system database:
- changes in the purpose, profile, context or version of the information system,
- termination of production use of an information system,
- significant nonconformity report
- new product name for the information system,
- new details for the contact person,
- new name for the information system supplier.