# Launch content for review

Generated from lib/data/launch_content.php. Regulatory status checked 15 October 2026; re-check before publishing updates.

## Vendor directory (47)

Neutral descriptions only; ratings come from member reviews.

| Vendor | Category | HQ | Description |
| --- | --- | --- | --- |
| [Epic Systems](https://www.epic.com) | HIS / EHR | US | Electronic health record and hospital information system used by large health systems. |
| [Oracle Health](https://www.oracle.com/health/) | HIS / EHR | US | Electronic health record platform (formerly Cerner) and health data services. |
| [MEDITECH](https://ehr.meditech.com) | HIS / EHR | US | Electronic health record for acute, ambulatory and long-term care. |
| [InterSystems](https://www.intersystems.com) | HIS / EHR | US | TrakCare hospital information system and HealthShare interoperability platform. |
| [Dedalus](https://www.dedalus.com) | HIS / EHR | IT | Clinical, administrative and diagnostic software for hospitals and health systems. |
| [Altera Digital Health](https://www.alterahealth.com) | HIS / EHR | US | Acute and ambulatory electronic health record products, including Sunrise. |
| [athenahealth](https://www.athenahealth.com) | HIS / EHR | US | Cloud electronic health record and practice management for ambulatory care. |
| [eClinicalWorks](https://www.eclinicalworks.com) | HIS / EHR | US | Cloud electronic health record and practice management. |
| [KareXpert](https://www.karexpert.com) | HIS / EHR | IN | Cloud hospital information system for hospitals in India and abroad. |
| [Caresoft Systems](https://www.caresoft.co.in) | HIS / EHR | IN | Hospital information system and related products. Disclosure: technology partner of this platform, listed under the same rules as every vendor. |
| [Sectra](https://medical.sectra.com) | LIS, RIS and PACS | SE | Enterprise imaging, PACS and digital pathology. |
| [Agfa HealthCare](https://www.agfahealthcare.com) | LIS, RIS and PACS | BE | Enterprise imaging and radiology information systems. |
| [Philips](https://www.philips.com/healthcare) | LIS, RIS and PACS | NL | Imaging systems, PACS, patient monitoring and informatics. |
| [GE HealthCare](https://www.gehealthcare.com) | LIS, RIS and PACS | US | Medical imaging, ultrasound, patient care solutions and digital tools. |
| [Siemens Healthineers](https://www.siemens-healthineers.com) | LIS, RIS and PACS | DE | Imaging, laboratory diagnostics and digital health software. |
| [Fujifilm Healthcare](https://healthcaresolutions-us.fujifilm.com) | LIS, RIS and PACS | JP | Synapse enterprise imaging and diagnostic imaging systems. |
| [Clinisys](https://www.clinisys.com) | LIS, RIS and PACS | GB | Laboratory information systems for hospital and public health laboratories. |
| [Microsoft](https://www.microsoft.com/industry/health) | Cloud and infrastructure | US | Azure cloud, Microsoft 365 and Dragon Copilot clinical documentation. |
| [Amazon Web Services](https://aws.amazon.com/health/) | Cloud and infrastructure | US | Cloud infrastructure and health data services. |
| [Google Cloud](https://cloud.google.com/solutions/healthcare-life-sciences) | Cloud and infrastructure | US | Cloud infrastructure, Healthcare API and data analytics. |
| [Nutanix](https://www.nutanix.com) | Cloud and infrastructure | US | Hyperconverged infrastructure and hybrid cloud software. |
| [Dell Technologies](https://www.dell.com) | Cloud and infrastructure | US | Servers, storage, end-user devices and data protection. |
| [Hewlett Packard Enterprise](https://www.hpe.com) | Networking | US | Servers, storage and Aruba networking. |
| [Cisco](https://www.cisco.com) | Networking | US | Networking, security and collaboration infrastructure. |
| [Palo Alto Networks](https://www.paloaltonetworks.com) | Cybersecurity | US | Firewalls, secure access and security operations platforms. |
| [Fortinet](https://www.fortinet.com) | Cybersecurity | US | Firewalls, secure networking and security operations. |
| [CrowdStrike](https://www.crowdstrike.com) | Cybersecurity | US | Endpoint protection, threat intelligence and managed detection. |
| [Check Point](https://www.checkpoint.com) | Cybersecurity | IL | Network, cloud and endpoint security. |
| [Sophos](https://www.sophos.com) | Cybersecurity | GB | Endpoint, firewall and managed detection and response. |
| [Claroty](https://claroty.com) | Cybersecurity | US | Security for medical devices and building systems in hospitals. |
| [Armis](https://www.armis.com) | Cybersecurity | US | Asset visibility and security for connected and medical devices. |
| [Imprivata](https://www.imprivata.com) | Cybersecurity | US | Clinical single sign-on and identity management for healthcare. |
| [Teladoc Health](https://www.teladochealth.com) | Telehealth | US | Virtual care services and telehealth platforms. |
| [Amwell](https://business.amwell.com) | Telehealth | US | Telehealth platform for health systems and payers. |
| [Practo](https://www.practo.com) | Telehealth | IN | Online consultations, clinic software and patient booking. |
| [Health Catalyst](https://www.healthcatalyst.com) | Analytics and AI | US | Healthcare data platform and analytics. |
| [Qure.ai](https://www.qure.ai) | Analytics and AI | IN | AI for medical imaging interpretation. |
| [Aidoc](https://www.aidoc.com) | Analytics and AI | IL | AI for radiology triage and clinical workflow. |
| [Waystar](https://www.waystar.com) | Revenue cycle and billing | US | Revenue cycle and claims management software. |
| [R1 RCM](https://www.r1rcm.com) | Revenue cycle and billing | US | Revenue cycle management services and technology. |
| [SAP](https://www.sap.com) | ERP and finance | DE | ERP, finance, supply chain and HR software. |
| [Workday](https://www.workday.com) | ERP and finance | US | HR, finance and planning software. |
| [Omnicell](https://www.omnicell.com) | Pharmacy systems | US | Medication management automation for hospital pharmacies. |
| [BD](https://www.bd.com) | Pharmacy systems | US | Medication dispensing (Pyxis), infusion and diagnostics. |
| [Swisslog Healthcare](https://www.swisslog-healthcare.com) | Pharmacy systems | CH | Pharmacy automation and hospital logistics. |
| [Accenture](https://www.accenture.com) | Consulting and implementation | IE | Technology consulting and system integration. |
| [Deloitte](https://www.deloitte.com) | Consulting and implementation | GB | Consulting, cyber and implementation services. |

## Regulatory radar (14)

### IN: DPDP Rules 2025: phased obligations under the Digital Personal Data Protection Act

*MeitY / Data Protection Board of India. Stage: in force. Effective 2025-11-13. [Official source](https://www.meity.gov.in/)*

The DPDP Rules were notified on 13 November 2025 and bring the 2023 Act into force in three stages. The Data Protection Board started immediately. Consent-manager provisions apply from November 2026. The main duties for hospitals as data fiduciaries apply from 13 May 2027: clear notice and consent, reasonable security safeguards, breach reporting to the Board and to affected people, verifiable consent for children's data, and response to data principal requests within 90 days. Penalties reach up to 250 crore rupees per breach of duty.

- [ ] Map where patient and staff personal data is collected, stored and shared
- [ ] Rewrite privacy notices and consent flows (registration, apps, portals) in plain language
- [ ] Set up a breach-reporting runbook covering the Board and affected patients
- [ ] Plan a request desk for access, correction and erasure within 90 days
- [ ] Check whether your organisation may be notified as a Significant Data Fiduciary
- [ ] Target readiness well before 13 May 2027

### IN: CERT-In directions: report cyber incidents within 6 hours

*CERT-In (MeitY). Stage: in force. Effective 2022-06-28. [Official source](https://www.cert-in.org.in/)*

CERT-In's directions of 28 April 2022 apply to service providers, intermediaries, data centres and body corporates, including private hospitals. Listed cyber incidents must be reported to CERT-In within 6 hours of noticing them. ICT system logs must be kept securely for a rolling 180 days within India, and system clocks must be synchronised to the NIC or NPL time servers or equivalent.

- [ ] Name a point of contact registered with CERT-In
- [ ] Write the 6-hour reporting step into the incident runbook
- [ ] Keep 180 days of logs in India (firewall, servers, applications, VPN)
- [ ] Synchronise clocks to NTP servers of NIC/NPL or traceable equivalents

### IN: Ayushman Bharat Digital Mission (ABDM): ABHA, HFR and HPR integration

*National Health Authority. Stage: in force. [Official source](https://abdm.gov.in/)*

ABDM provides India's digital health building blocks: ABHA health IDs for patients, the Health Facility Registry (HFR), the Healthcare Professionals Registry (HPR), and consent-based exchange of health records. Hospital software must be ABDM-certified to link records. Several state schemes and incentive programmes reward ABDM-linked transactions.

- [ ] Register the facility in HFR and doctors in HPR
- [ ] Confirm your HIS is ABDM-certified for the milestones you need
- [ ] Enable ABHA creation and linking at registration
- [ ] Train front-desk staff on patient consent for record sharing

### EU: EU AI Act amended: high-risk deadlines moved to December 2027 and August 2028

*European Commission. Stage: amended. Effective 2026-07-27. [Official source](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)*

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026. Obligations for stand-alone high-risk AI systems (Annex III, including emergency triage) now apply from 2 December 2027 instead of 2 August 2026. High-risk AI embedded in regulated products such as AI-enabled medical devices (Annex I) now applies from 2 August 2028. Prohibited practices, AI literacy and general-purpose AI duties are unchanged, and the Article 50 transparency rules have applied since 2 August 2026.

- [ ] List the AI systems you use or build and classify them (prohibited, high-risk, limited, minimal)
- [ ] Confirm AI literacy training for staff who use AI tools
- [ ] Ask AI-enabled device suppliers for their AI Act and MDR plans
- [ ] Label AI-generated content and chatbots where Article 50 applies
- [ ] Plan high-risk controls (risk management, human oversight, logging) for 2027–2028

### EU: European Health Data Space (EHDS) Regulation (EU) 2025/327

*European Commission. Stage: enacted. Effective 2027-03-26. [Official source](https://health.ec.europa.eu/)*

The EHDS Regulation entered into force on 26 March 2025 and applies in stages. General provisions apply from 26 March 2027. Patient summaries, ePrescriptions and eDispensations must be exchangeable, and the secondary-use rules apply, from 26 March 2029. Medical images, lab results and discharge reports follow from 26 March 2031. EHR systems will need conformity with common specifications and EU labelling.

- [ ] Ask your EHR supplier for its EHDS conformity roadmap
- [ ] Prepare patient access to electronic health data in the national format
- [ ] Identify data you hold that may be requested for secondary use from 2029
- [ ] Follow your national digital health authority's implementation plan

### EU: NIS2 Directive: hospitals as essential entities

*European Commission / national authorities. Stage: in force. Effective 2024-10-17. [Official source](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive)*

NIS2, Directive (EU) 2022/2555, treats most healthcare providers as essential or important entities. Member States had to transpose it by 17 October 2024; national laws set the details. Management bodies are accountable for cyber risk measures. Significant incidents need an early warning within 24 hours and a fuller notification within 72 hours.

- [ ] Check how your country's NIS2 law classifies your organisation
- [ ] Brief the board on its personal accountability for cyber risk
- [ ] Add 24-hour early warning and 72-hour notification to the incident runbook
- [ ] Review supplier security clauses in IT contracts

### EU: GDPR: health data as special-category data

*European Data Protection Board / national authorities. Stage: in force. Effective 2018-05-25. [Official source](https://commission.europa.eu/law/law-topic/data-protection_en)*

Under the GDPR, health data is special-category data and needs a specific legal basis such as healthcare provision. Large-scale processing usually requires a Data Protection Officer and a Data Protection Impact Assessment. Personal data breaches must be notified to the supervisory authority within 72 hours where there is a risk to people.

- [ ] Keep the record of processing activities up to date
- [ ] Run DPIAs for new systems that process health data at scale
- [ ] Test the 72-hour breach notification process
- [ ] Review international transfer safeguards for cloud services

### US: HIPAA Security Rule overhaul: still a proposed rule

*HHS Office for Civil Rights. Stage: proposed. [Official source](https://www.hhs.gov/hipaa/for-professionals/security/index.html)*

HHS published a proposed update to the HIPAA Security Rule on 6 January 2025, the first major change since 2013. It would make most safeguards mandatory, including encryption, multi-factor authentication, an asset inventory and network map, restoration within 72 hours, vulnerability scans and annual penetration tests. As of October 2026 it is not final: the federal regulatory agenda targets a final rule around July 2027. The current Security Rule remains in force.

- [ ] Keep complying with the current Security Rule and its risk analysis duty
- [ ] Close gaps the proposal highlights: MFA, encryption, asset inventory, tested backups
- [ ] Watch the Federal Register for the final rule and its compliance window

### US: 42 CFR Part 2 aligned with HIPAA: compliance date 16 February 2026

*HHS (SAMHSA and OCR). Stage: in force. Effective 2026-02-16. [Official source](https://www.hhs.gov/)*

The final rule of February 2024 aligns the confidentiality of substance use disorder treatment records with HIPAA. It allows a single patient consent for treatment, payment and operations, adds breach notification and HIPAA-style penalties, and required updated notices. Compliance was required by 16 February 2026.

- [ ] Confirm Notices of Privacy Practices were updated
- [ ] Check consent capture and record segmentation for Part 2 data in the EHR
- [ ] Include Part 2 records in breach notification procedures

### AE: UAE health data law: Federal Law No. 2 of 2019 on ICT in health fields

*Ministry of Health and Prevention. Stage: in force. [Official source](https://mohap.gov.ae/)*

The law governs health information and communication technology across the UAE. Health data must generally be stored and processed inside the UAE, with limited exceptions set by ministerial decision, and kept for at least 25 years after the last procedure. Emirate regulators (DHA, DoH Abu Dhabi) add their own standards.

- [ ] Confirm where your EHR, backups and cloud services store data
- [ ] Check any cross-border processing against the permitted exceptions
- [ ] Set retention to at least 25 years for health records
- [ ] Align with your emirate regulator's information security standard

### SA: Saudi Personal Data Protection Law (PDPL)

*Saudi Data and AI Authority (SDAIA). Stage: in force. Effective 2023-09-14. [Official source](https://sdaia.gov.sa/)*

The PDPL came into force on 14 September 2023, with enforcement after a one-year transition from 14 September 2024. Health data is sensitive data. Breaches must be reported to SDAIA within 72 hours where they may harm people, and transfers outside the Kingdom are restricted to permitted cases.

- [ ] Register with SDAIA's national data governance platform where required
- [ ] Update privacy notices and consent for patients
- [ ] Add the 72-hour SDAIA breach report to the runbook
- [ ] Review data transfers outside Saudi Arabia

### GB: Data (Use and Access) Act 2025 amends UK GDPR

*Department for Science, Innovation and Technology / ICO. Stage: amended. Effective 2025-06-19. [Official source](https://www.gov.uk/)*

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is commenced in stages. It amends UK GDPR and the Data Protection Act 2018, including recognised legitimate interests, rules on automated decision-making and changes to subject access requests. NHS organisations also continue to complete the Data Security and Protection Toolkit.

- [ ] Track commencement regulations for the provisions that affect you
- [ ] Review automated decision-making used in patient pathways
- [ ] Update subject access request procedures
- [ ] Keep the Data Security and Protection Toolkit submission current

### NG: Nigeria Data Protection Act 2023

*Nigeria Data Protection Commission. Stage: in force. Effective 2023-06-12. [Official source](https://ndpc.gov.ng/)*

The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission and sets duties for data controllers and processors, including hospitals. Health data is sensitive personal data. Controllers of major importance must register with the Commission, and breaches must be reported within 72 hours.

- [ ] Check whether you are a data controller of major importance and register
- [ ] Appoint a Data Protection Officer
- [ ] Add the 72-hour breach report to the runbook

### KE: Kenya Digital Health Act 2023 and Data Protection Act 2019

*Ministry of Health / Office of the Data Protection Commissioner. Stage: in force. [Official source](https://www.health.go.ke/)*

The Digital Health Act 2023 sets up a national framework for digital health services and health information exchange, alongside the Data Protection Act 2019. Health data controllers must register with the Office of the Data Protection Commissioner, and digital health systems are expected to meet national interoperability and security standards.

- [ ] Register as a data controller with the ODPC
- [ ] Check your HIS against national digital health standards
- [ ] Review consent and data-sharing for health information exchange

## First masterclass

**Reporting cyber risk to your board: a playbook for healthcare CIOs** (1.5 CPE hours, free)

Turn technical security risk into the decisions your board actually needs to make, in four short lessons.

1. What your board actually needs to decide (10 min)
2. Translating technical risk into patient care and money (12 min)
3. A one-page cyber risk report (10 min)
4. Running a ransomware tabletop with clinical leaders (15 min)

## House ads

| Language | Slot | Headline | Text | Link |
| --- | --- | --- | --- | --- |
| en | header_leaderboard | Reach healthcare technology leaders worldwide | Labelled sponsorship. Aggregated reports. No member data shared. | /en/advertise |
| en | sidebar_rect | Become a founding member | Free for verified healthcare technology leaders this year. | /en/join |
| en | sidebar_tall | New masterclass: report cyber risk to your board | Four short lessons, 1.5 CPE hours, certificate included. | /en/app/learning |
| en | feed_native | Ask the club assistant | Get an answer from what members have already shared, with sources. | /en/app/assistant |
| en | in_article | Written by a member like you | Apply to join the club and discuss articles like this in private. | /en/join |
| en | footer_banner | Lead the club in your country | Apply to become a country chapter lead. | /en/contact?kind=chapter_lead |
| ar | header_leaderboard | تواصل مع قادة تقنية الرعاية الصحية حول العالم | رعاية موسومة وتقارير مجمّعة دون مشاركة بيانات الأعضاء. | /en/advertise |
| ar | sidebar_rect | كن عضواً مؤسساً | مجاني لقادة تقنية الرعاية الصحية الموثّقين هذا العام. | /en/join |
| ar | sidebar_tall | دورة جديدة: عرض المخاطر السيبرانية على مجلس الإدارة | أربعة دروس قصيرة، 1.5 ساعة تعليم مستمر، مع شهادة. | /en/app/learning |
| ar | feed_native | اسأل مساعد النادي | إجابات مما شاركه الأعضاء، مع المصادر. | /en/app/assistant |
| ar | in_article | كتبه عضو مثلك | قدّم طلب الانضمام وناقش مقالات كهذه بشكل خاص. | /en/join |
| ar | footer_banner | قُد النادي في بلدك | قدّم لتصبح مسؤول فرع في بلدك. | /en/contact?kind=chapter_lead |
| fr | header_leaderboard | Touchez les dirigeants technologiques de la santé dans le monde | Parrainage signalé. Rapports agrégés. Aucune donnée de membre partagée. | /en/advertise |
| fr | sidebar_rect | Devenez membre fondateur | Gratuit cette année pour les dirigeants technologiques de la santé vérifiés. | /en/join |
| fr | sidebar_tall | Nouvelle masterclass : présenter le risque cyber au conseil | Quatre leçons courtes, 1,5 heure de formation, certificat inclus. | /en/app/learning |
| fr | feed_native | Demandez à l’assistant du club | Une réponse tirée de ce que les membres ont partagé, avec les sources. | /en/app/assistant |
| fr | in_article | Écrit par un membre comme vous | Demandez l’adhésion et échangez en privé sur des articles comme celui-ci. | /en/join |
| fr | footer_banner | Animez le club dans votre pays | Proposez votre candidature comme responsable de chapitre. | /en/contact?kind=chapter_lead |
| es | header_leaderboard | Llegue a líderes de tecnología sanitaria de todo el mundo | Patrocinio identificado. Informes agregados. Sin compartir datos de miembros. | /en/advertise |
| es | sidebar_rect | Sea miembro fundador | Gratis este año para líderes de tecnología sanitaria verificados. | /en/join |
| es | sidebar_tall | Nueva clase magistral: presentar el riesgo cibernético al consejo | Cuatro lecciones breves, 1,5 horas de formación y certificado. | /en/app/learning |
| es | feed_native | Pregunte al asistente del club | Respuestas a partir de lo que los miembros ya compartieron, con fuentes. | /en/app/assistant |
| es | in_article | Escrito por un miembro como usted | Solicite su ingreso y comente artículos como este en privado. | /en/join |
| es | footer_banner | Dirija el club en su país | Postúlese como responsable de capítulo. | /en/contact?kind=chapter_lead |