In most industries IT is an internal matter: if a company accepts the risk, nobody asks it any questions. Healthcare is different, because system availability, where records are kept and how long they are held all follow directly from the law. This page does not talk about reliability in general; it shows which deadlines are already running and what they mean for the server standing in your building.
We are not the maker of your practice or hospital software and we do not certify medical devices. We are responsible for the layer beneath the application, meaning the server, network, backups, accounts and availability, and for talking to the software vendor when a problem sits on the boundary. We describe that split under server administration.
The amendment to the Polish national cybersecurity system act, implementing the NIS2 directive, took effect on 3 April 2026. Healthcare is named in it as a sector, and the nearest deadline is not in the distant future.
A healthcare provider that is not an entrepreneur, such as a public clinic, is an important entity with 50 to 249 staff and a key entity from 250. For businesses the size of the company decides: medium means important, large means key. You carry out the self-assessment yourself; nobody will send you a notice.
The act separately names providers of health services acting as subcontractors to key or important entities in the healthcare sector. A small diagnostic lab or a surgery delivering services for a hospital can therefore fall under the duties even though it does not reach the headcount threshold itself.
Entry in the KSC register by 3 October 2026. Connection to the S46 system and implementation of the duties, including an information security management system and incident reporting, by 3 April 2027. The first mandatory audit for key entities by 3 April 2028, then at least once every three years.
Honestly: compliance with this act is mostly documents, procedures and board decisions rather than hardware, and nobody can do that part for the practice. We take the technical side, meaning what an auditor will actually check in the systems: backups, accounts, updates, network separation and the trail left by access. We record the starting point in an IT audit so you know where you begin.
This is the misunderstanding we meet most often. The national P1 platform is not the practice's archive and does not store the content of documents. That changes what the word availability means in this sector.
Electronic medical records stay in the provider's own repository, and what goes to the national system is the information that a document exists and where to find it. Another practice then pulls it directly from you, so your server is part of the public flow of medical records, not merely internal equipment.
Medical event data is submitted without delay and no later than two days after the event ends, or within two days of admission in the case of hospital stays. Prescriptions and referrals go in real time, so a broken internet line in a surgery is felt immediately rather than the following day.
The duty to keep electronic records and report events rests on the provider regardless of whether the service is publicly funded or paid for privately. A purely commercial surgery is subject to the same rules as a clinic with a public contract.
The practical conclusion for infrastructure: the internet line and the server holding the repository stop being a convenience and become a condition for meeting a statutory duty. That is why in practices we usually start with a second line from a different operator with automatic failover, and with backup power for the server and the front desk, which we describe under building a company network.
Article 29 of the patients' rights act imposes retention periods that outlast any server, system and file format. This is the requirement people forget most often when changing software.
As a rule 20 years, counted from the end of the year in which the last entry was made. The exceptions run both ways: 30 years for death caused by bodily injury or poisoning and for blood traceability data, 22 years for children under two, 10 years for X-ray images kept outside the patient record and 5 years for referrals.
A backup exists to get you back after a failure and usually keeps weeks or months of history. Records from nineteen years ago have to be readable today, so a separate set is needed, deliberately kept apart from the working backup, with the format and the method of reading it written down.
When you move to new practice software the retention duty does not end along with the old contract. You have to settle up front whether the data goes into the new system or an archive stays in the old format, and whether it can be read without a licence nobody is paying for any more.
Where imaging is involved size is added to the problem, because DICOM studies grow faster than the rest of the records and after a few years can exceed everything else put together. How to separate the working backup from the archive is described under backup and archiving.
Six areas where the conversation usually starts. Under each one is a link to the page that goes into detail.
A working backup for recovery after a failure, a separate archive for the statutory periods and a periodic restore test with the time measured, because what counts is whether the data comes back, not whether the job reported success.
A second line with automatic failover, backup power for the front desk and the server, and separating networked medical equipment from staff computers.
Named accounts instead of one shared password at the front desk, a second factor for mail and systems, and a readable trail of who looked into a patient record.
Monitoring runs around the clock and telephone on-call is a separate contract option. We say plainly what happens at night instead of printing 24/7 everywhere.
Updates in windows outside consulting hours, watching disk space against growing imaging studies, and tracking the vendor support dates for the hardware.
We build data exchange between the laboratory, the practice software and imaging on the practice's own server, so patient records never pass through an external service.
What we do not do: we are not the maker of practice or hospital software, we do not run the legal side of a GDPR audit, which belongs to a law firm, and we do not carry out penetration tests with a report for an external auditor. For that last one we work with a team that specialises in it.
Working in an open clinic has its own rules, because the front desk cannot be shut down for an afternoon. That is why the first stage is purely about looking.
Thirty minutes about where you stand and what hurts most. We come back with a single page of risks ordered by urgency. No NDA, no commitment, and the list stays with you whatever you decide.
What stands in the server room, where the repository sits, how the backups look and who has access to the records. Along the way we establish whether the practice falls under the cybersecurity act and in which category.
We first fix whatever threatens data loss or a front desk outage. Work needing a break is planned outside consulting hours and agreed with management, not entered into the schedule unilaterally.
Requests from staff, updates in maintenance windows, restore tests and a report once a month. Once a year we review the deadlines: hardware support, licences and whatever has changed in the regulations.
Pages that come up in conversations with medical practices.
Pick your industry and see how comprehensive IT support and IT outsourcing for SMEs can help your company.
It depends on the legal form and the size, and where subcontracting is involved also on who you work for. A provider that is not an entrepreneur is important from 50 staff and key from 250; for businesses the size of the company decides. Subcontractors to key and important entities are named separately, so the headcount threshold alone does not settle it.
The rules do not forbid the cloud, but they do require a conscious decision about where the data sits and who can reach it. In practice a mixed arrangement usually wins: mail and office work in the cloud, with the records repository and imaging studies on a server on site, because that is where fast access and file size matter.
First we establish whether the problem is the environment or the application itself, because that changes who has to fix it. The server, database, network and backups are ours, and if the fault is in the program we contact its vendor and run the case rather than sending you between two companies. The split goes into the contract at the start.
Monitoring runs around the clock, while telephone on-call outside working hours is a separate, paid contract option that we do not add to everyone by default. In a clinic open from seven to six an earlier engineer start is usually enough, and night cover makes sense where the practice genuinely treats patients at night.
As a rule 20 years from the end of the year of the last entry. Shorter for referrals, which is 5 years, and for X-ray images kept outside the patient record, which is 10 years. Longer: 22 years for children under two and 30 years for death caused by bodily injury or poisoning and for blood traceability data.
For day-to-day staff requests it often is, and we do not push anyone to drop someone who knows the practice. It works less well where one person is meant to handle the front desk, the repository server, the backups and now the cybersecurity act as well. The usual arrangement is a split: your person with the people, us with the server layer.
Health data is a special category, so where a breach risks patients' rights the notification to the supervisory authority should follow within 72 hours of becoming aware, and where the risk is high the people affected must be told too. In parallel an entity covered by the cybersecurity act reports the incident to the relevant CSIRT team.
Yes, and we start by recording the state so both sides know what we found. That protects you too, because the commonest dispute when taking over an environment is whether something was already broken. Handovers are planned outside consulting hours, and the master passwords to the systems stay on your side.
The first meeting takes 30 minutes and commits you to nothing. We will tell you straight whether we can help and what we would propose.
2019 - 2024 Interactive Workspace Ltd. - All rights reserved.