Registration of information systems for social welfare and health care
A social welfare and health care information system must be registered in the Astori register before it can be deployed. After registration, the system details must be kept up to date. When a system is taken out of production use, Valvira must be notified thereof so that the system will be removed from the Astori register. The information system service provider is responsible for registration and for updating the data in the register.
Information system suppliers must notify Valvira about information systems in accordance with the Client Data Act so that they can be registered in the Astori register. An information system must not be deployed until its details have been entered in the information system database for social welfare and health care.
Information system suppliers must also notify Valvira of any changes which have a bearing on the details in the information system database or which are otherwise crucial from the perspective of the essential requirements for the system or their oversight. Further information on notifications of changes can be found under Frequently Asked Questions about registration (questions 4 and 5).
When an information system supplier registers an information system with Valvira, the supplier becomes responsible for ensuring that the system will comply with the essential requirements relevant for its purpose for the duration of its production use.
Registration is subject to a fee
Registration under the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare is subject to a fee. Fees for information system registration:
- First registration of a category A information system (including wellbeing applications), EUR 1200
- First registration of a category B information system, EUR 600
- Information system change notification registration, EUR 300
Before submitting a registration notification, please carefully read Frequently Asked Questions about information system registration.
Make a registration notification (in Finnish).
Frequently Asked Questions about registration
The registration notification page will guide you through filling out and submitting the notification. Filling out the registration notification and the appended system form fully and accurately will expedite the processing of your notification.
Once you have filled out the registration notification, attached all the required appendices and sent it, it will be delivered to the Valvira registry.
Please check the following before filling out the registration notification:
- you are about to register an information system or wellbeing application according to the Act on the Electronic Processing of Client Data in Healthcare and Social Welfare
- you know to which category the information system or wellbeing apllication belongs
- you know what the purpose of the information system or wellbeing application is and its profile(s)
- you have carefully filled out the THL system form.
- if your information system or wellbeing application is in category A, you have verified that the system has been issued all the documents required for registration (a joint testing statement or statements from Kela and a data security certificate issued by a data security inspection body).
Once a registration notification is received by Valvira, Valvira will verify that the notification contains all the information required for registration. Valvira will also verify that all the documents required for processing were submitted as appendices to the notification.
If there are any unclear points, omissions, errors or discrepancies in the information provided, these must be investigated before the information system can be entered in the Astori register, or data already in the register updated. In such a situation, Valvira will send a request for further information to the information system service provider.
An information system will be entered in the Astori register, or details already in the register updated, once Valvira has received the full and correct information required. Once the register notification has been processed, Valvira sends the information system service provider a notification of this.
Although not all of the details requested in the registration notification, system form and other appendices will be published in the Astori register, the details will nevertheless be stored in the Valvira case management system. If any supervisory measures are taken in respect of a system, the details in the registration notification may be used as baseline data in those supervisory measures.
Once an information system has been entered in the Astori register, the information system service provider must ensure that the data in the register are kept up to date until such time as the information system is removed from the register.
Information system suppliers are required to notify Valvira of the following changes:
- any new functionality implemented in the information system concerning which a new joint testing statement has been issued for the system,
- any changes or repairs made to the information system which have been verified in Kela joint testing and concerning which a new joint testing statement has been issued for the system,
- any changes or repairs made to the information system on the basis of which an information security inspection body has performed a change audit on the information system and issued a data security certificate for the system,
- updates made to keep the information system compliant with requirements,
- changes to the details of the information system, e.g. change of the product name of the system,
- changes to the details of the information system supplier, e.g. change of the name of the supplier or supplier replacement as a result of a corporate acquisition,
- removing the information system from production use.
Valvira will charge a fee for updating the information system database when an information system supplier notifies Valvira of any of the following changes:
- any new functionality implemented in the information system concerning which a new joint testing statement has been issued for the system,
- any changes made to the information system pursuant to which a data security inspection body has performed a data security change audit on the information system or, at the request of the supplier, a complete data security audit; the information system receives a new data security certificate,
- updates made to keep the information system compliant with requirements,
- replacement of the information system supplier, e.g. due to a corporate acquisition.
Valvira will not charge a fee when an information system supplier notifies Valvira of any of the following changes, even though they may require updating the information system database:
- changes in the purpose, profile, context or version of the information system,
- termination of production use of an information system,
- significant nonconformity report
- new product name for the information system,
- new details for the contact person,
- new name for the information system supplier.