Subsection 4: Categories of incidents, terms and conditions for reporting significant or serious information systems security incidents

I.-The reporting of serious information system security incidents as provided for in Article L. 1111-8-2 is intended to : 1° Provide the competent State authorities with the information they need to decide on preventive measures in terms of information system security or to ensure the continuity of healthcare provision ; 2° Helping health establishments, organisations and services involved in preventive, diagnostic or care activities to take any useful measures to…

I.-Reports of significant or serious information system security incidents, without prejudice to other mandatory reports, are made without delay by the director of the health establishment, the organisation or service providing preventive, diagnostic or care activities, or the medico-social establishment, or the person delegated for this purpose, to the public interest group mentioned in article L. 1111-24. The public interest grouping is responsible for : -analysing significant or serious information…

For the purposes of this sub-section, the health establishments, organisations and services carrying out prevention, diagnosis or care activities mentioned in article D. 1111-16-2 and medico-social establishments are : -health establishments ; -army hospitals medical biology laboratories; – radiotherapy centres -radiotherapy centres; -medical-social establishments.