Registration of information systems for healthcare and social welfare
The registration of an information system is ex-ante enforcement carried out by the Finnish Supervisory Agency, the purpose of which is to ensure that the system meets the essential requirements for its purpose. Information systems for social welfare and health care must be registered in Astori before they are commissioned in production use.
Information system service supplier responsible for registration
The information system service supplier is responsible for registering the system. The supplier is also responsible for ensuring that the system’s information is up to date in Astori throughout its production use.
-
Register a system before commissioning
The information system service supplier must notify the Finnish Supervisory Agency of the system in order to register it in Astori. The registration notification initiates a registration at the Finnish Supervisory Agency.
A social welfare and healthcare service provider and a pharmacy can only activate the system after its data is in Astori.
-
Maintain the system’s compliance and keep its information up-to-date in Astori
Once the system has been registered in Astori, the information system service supplier must monitor any changes to the essential requirements and implement these in the system within a specified time period. The supplier is responsible for ensuring that the system meets the essential requirements for its intended purpose throughout its production use.
The information system service supplier must notify the Finnish Supervisory Agency of changes such as the following:
- the expansion or narrowing of the intended purpose of the system that will affect its classification and/or profile information
- new joint testing and/or information security assessment carried out on the system.
Please note that the certificates and statements submitted by Kela and the information security inspection body to the Finnish Supervisory Agency for information do not initiate a registration matter. If a new joint testing statement or information security certificate has been issued to the system, the system supplier must submit a register notification of the change to the Finnish Supervisory Agency.
For more information on submitting notifications on changes, see the “Frequently Asked Questions” section at the end of this page (Questions 4 and 5).
-
Submit a notification when the production use of a system is discontinued
Once the production use of a system ends, the information system service supplier must notify the Finnish Supervisory Agency so the system is removed from Astori. Note that if the system remains in viewing mode, it cannot be removed from Astori. In this case, submit a registration notification on the change of purpose.
Registration is subject to a fee
Registration carried out on the basis of the Act on the Processing of Client Data in Healthcare and Social Welfare is subject to a fee. Maksun määrä perustuu vuosittain annettavaan asetukseen Lupa- ja valvontaviraston maksuista.
Registration prices:
- The first registration of a Category A system and a wellbeing application costs 1,200 euro.
- The first registration of a Category B system costs 600 euro.
- Registration of a system or application change costs 300 euro.
Huomaa, että järjestelmän tai sovelluksen poistoilmoituksen käsittely on muutos, ja siitä peritään 300 euroa.
Maksu peritään myös silloin, kun Lupa- ja valvontavirasto tekee kielteisen päätöksen järjestelmän tai sovelluksen rekisteröinnistä. Myös peruutetusta ja täydentämättä jätetystä rekisteri-ilmoituksesta peritään puolet taulukon mukaisesta maksusta.
Submit a registration notification and a discontinuation notification
Before submitting a registration notification, review the FAQ on information system registration at the end of this page. Rekisteri-ilmoituksella ilmoitat Lupa- ja valvontavirastolle myös tietojärjestelmän muutoksista.
Submit a registration notification (in Finnish)
Submit a notification of discontinuation
Once the production use of a system or app has been discontinued, its data must be removed from Astori. Submit a discontinuation notification using the form below.
Submit a notification of discontinuation (in Finnish)
Frequently asked questions about registering an information system
A registration notification includes instructions on how to complete it. Käytä rekisteri-ilmoitusta, kun ilmoitat
- järjestelmän ensimmäistä kertaa Astoriin
- Lupa- ja valvontavirastolle järjestelmään tehdyistä muutoksista.
When you fill in a registration notification and the system form attached to it carefully, you will speed up the processing of the registration notification.
Once you have completed the registration notification and attached the necessary attachments to it, the notification will be directed directly to the Finnish Supervisory Agency’s registry.
According to THL’s regulation 4/2024, All profiles of essential requirements that correspond to the purpose of the system must be entered in the system form.
Before submitting a registration notification
- make sure that the information system or wellbeing app you are registering is one that falls under the Act on the Processing of Client Data in Healthcare and Social Welfare
- read THL regulations 4/2024 and 5/2024
- read the classification criteria, compile a risk assessment, and classify the system or app according to the criteria
- view the profiles carefully and mark all profiles in the system form that correspond to the purpose of the system
- comment on all mandatory requirements that apply to the system profile(s)
- ensure that a Category A system or app has been issued all the documents required for the registration (Kela’s joint testing statement or statements and the information security certificate of the information security inspection body).
Once an information system service supplier has submitted a registration notification, the Finnish Supervisory Agency verifies that the notification contains all the information and attachments required for registration.
If there are any ambiguities, omissions, or errors in the information provided to the Finnish Supervisory Agency, or the documents provided contain conflicting information, the agency will request further information before the system can be registered in Astori. In such a situation, the Finnish Supervisory Agency will send a request for further information to the information system service supplier.
The information system will be added to Astori or information already in Astori will be updated after sufficient and appropriate information has been provided to the Finnish Supervisory Agency. Once the registration notification has been processed, the Finnish Supervisory Agency will send a notification to the information system service supplier.
If the information system service supplier does not provide sufficient information to the Finnish Supervisory Agency to allow them to assess the fulfilment of the system’s essential requirements, the Finnish Supervisory Agency cannot add the system to Astori and the supplier will be notified by letter. If the system is registered in Astori and the Finnish Supervisory Agency cannot assess the system’s compliance due to incomplete information provided by the supplier, the Finnish Supervisory Agency will undertake enforcement of the system’s compliance.
Although not all information submitted during the registration process is published in Astori, the information is contained in the Finnish Supervisory Agency’s case management system. If enforcement measures are taken with regard to the system, information can be used as background information for enforcement.
Once the information system has been registered in Astori, the information system service supplier must ensure that the information in the register is kept up to date until the system is removed from the register.
The information system service supplier must notify the Finnish Supervisory Agency of the following
- a new function implemented in the system for which it has received a new joint testing report
- a change or correction made to the system on the basis of which the information security inspection body has carried out an information security change assessment and for which the system has received an updated information security certificate
- the reform of system compliance
- changes to system information (e.g. name change)
- a change to the information system service supplier’s information (for example, a change in the company’s name or a change of supplier as a result of a merger)
- decommissioning the system from production use.
Lupa- ja valvontavirasto perii maksun rekisteri-ilmoituksen ja poistoilmoituksen käsittelystä. Peruutetusta ja täydentämättä jätetystä rekisteri-ilmoituksesta peritään puolet maksusta. Maksu peritään myös silloin, kun Lupa- ja valvontavirasto tekee kielteisen päätöksen järjestelmän tai sovelluksen rekisteröinnistä.
The Finnish Supervisory Agency will not charge a fee for registering the following changes:
- a significant nonconformity in the system
- a change to the contact person’s contact information
Contact information
Customer service for health and social services
Ask our customer service by using service form
By e-mail: [email protected]
By calling: +358 295 256 930 (Monday–Friday 9:00–15:00)