Norge · GDPR · pasientjournalforskriften § 14 · helsepersonelloven · arbeidsmiljøloven § 1-8 · Normen
A Norwegian patient may ask who has opened their record, and be told. Most systems treat the access log as something a regulator sees after an incident. Norway puts it in the patient's hands, and we have logged every read since the first version of the document service — so the rule that sounds hardest is the one we are furthest ahead on.
This page sets out the Norwegian layer on top of the GDPR, what is built and running, and what we have not built. The last part is short, specific and not hidden.
Norway is in the EEA, so the GDPR applies in full. Everything on the GDPR page holds here unchanged — lawful basis under Article 9(2)(h) rather than consent, erasure by destroying the key, the 72-hour clock.
On top of that sits Norwegian health law, and its character is different from Germany's. Germany adds a criminal rule about your supplier. Norway adds rules about people: what the patient may see, who counts as a health professional, who may speak for a patient, and on what terms you engage the clinicians who deliver the sessions. Five pieces matter to a software decision.
Not a summary, and not only the records they are allowed to read. The right covers access to health information about them, including the notes they are not shown.
Why it matters: this is a feature no Norwegian competitor in our research has been shown to offer, and it is live. Section 02.
Only authorised health personnel may call themselves psykolog, lege or fysioterapeut, and each one carries a number in the national register HPR. Therapists without authorisation are alternative practitioners, with their own rules.
Why it matters: a profile that uses a protected title without the authorisation is an offence, and the software now refuses to publish one. Section 03.
The nearest relative is chosen by the patient. At 16 a young person consents to their own care. Between 12 and 16 they may ask that their parents are not told, for reasons that should be respected.
Why it matters: the rule is enforced where information actually leaves, not as a filter on a screen. Section 04.
Norway does not count down a number of years for a private practice's journals. They are kept as long as they are needed, and when the practice closes they go to a successor or to the national health archive.
Why it matters: a retention engine that only knows how to destroy on a date is the wrong shape for Norway. Section 05.
Arbeidsmiljøloven § 1-8. Since 1 January 2024, someone who works for a clinic is presumed to be an employee unless the clinic can show otherwise. Our payout engine exists to pay clinicians per session, which is exactly the arrangement the presumption is aimed at. It is the largest commercial exposure on this page, it belongs to the clinic rather than to us, and section 06 is what we do about it.
Every read of a clinical record has always been written to a tamper-evident log — the entry is made before the content is decrypted, so a download somebody abandons is still recorded. What Norway adds is who gets to see that log.
/my/records/access-logEvery access to every record about them, newest first: when, what happened, and the name of the person who did it. Not a role — a name. The subject of a record is exactly who should be able to ask why a named individual read it.
A clinical report or a private note is not shown to the client. The access to it still is. For those rows the page shows the kind of record and never its title, because a title is stored unencrypted and is often the sensitive part.
Nothing on the page opens a document the reader could not already open. The per-document history stays where it was; this is a view across all of them.
The gateway serves the same list to the mobile app on an authenticated route. No app screen displays it yet — it is on the portal only. Said plainly here because a demo on a phone will not show it.
Norwegian law closes a list of professions and protects their titles. The platform used to hold qualifications as prose, which meant it could neither show a client who was authorised nor stop a profile from claiming a title it had no right to.
Authorisation, licence, alternative practitioner or none; the HPR number; specialist approval under § 53; and whether the practitioner is in Brønnøysund's voluntary register of alternative practitioners.
A number somebody typed counts as declared. Only a check against HPR or against the authorisation document counts as checked, and the date of that check is kept. After twelve months it is flagged as stale.
In a Norwegian company, a profile whose name or description uses a protected title cannot be published without a matching, checked authorisation. The check runs when the record is written, so the sync from the main server cannot get round it.
The public profile shows Authorised psychologist · HPR 1234567, or Alternative practitioner — not health personnel, taken from the register entry rather than from what the profile says about itself.
In Norway, psykoterapeut is not a protected title — anyone may use it. In Finland the equivalent word is protected. The two country packs therefore keep separate title lists on purpose; a single shared list would be wrong in one of the two countries.
Clients often have somebody who speaks for them. Norway names four such people and gives each a different basis, and the ages 12 and 16 change the answer.
Each with the authority it rests on, the document behind it where there is one, and the period it runs for. Only one nearest relative at a time, because the patient chooses one. A clinician may refuse to treat somebody as the representative, and the reason is kept.
The ordinary case, and the software does not stand in the way of it.
Where the child asks that parents are not told and the reasons should be respected, a disclosure to a registered parent is refused at the disclosure register, with the reason in the refusal. What parents need in order to exercise parental responsibility still reaches them.
Consent is theirs. A disclosure to a parent needs it, and asking for it is a conversation rather than a setting. Parental-responsibility matters still reach parents until 18.
A filter on a page hides information from whoever is looking at that page. The duty is not to hide it — it is not to disclose it. So the check sits on the disclosure register, which is the thing every disclosure has to pass through, and a refusal is recorded with its reason rather than happening silently.
Our retention engine has five clocks, and every one of them ends in automatic disposal. A Norwegian install given any of them would destroy records the law expects to be kept. So Norway gets a sixth kind that has no disposal date at all.
When the interval passes — five years in the shipped rule — a review is opened and a named person decides: keep, with a reason, or dispose. The nightly disposal job never gets a date for these records, so it can never shred one on its own.
A review that decides to dispose goes through the same two-approval request as every other disposal. Disposal destroys the encryption key; the row and its audit trail stay.
One practitioner's records or the whole clinic's, exported once to a successor, to Norsk helsearkiv, or to Nasjonalarkivet. The archive is built at the moment of download and never stored on the server.
Every document handed over gets an entry in the disclosure register naming the recipient, and the hand-over can be downloaded once. A second copy is a second hand-over, with its own record.
Since January 2024, a person who works for a clinic is presumed to be an employee unless the clinic shows that an independent engagement is more likely. A clinic reclassified later owes holiday pay, employer contributions and sick pay it never ran.
The answer, the basis the clinic relied on under the two statutory factors, a snapshot of the facts the product holds, and a review date — a year out by default, because facts change and a 2024 decision is not evidence about a 2026 engagement.
The snapshot shows what we know: how many payout lines came from this clinic in the last year against how many came from elsewhere, and how many of the practitioner's session resources sit on a schedule the clinic runs. It does not add them up. The question is legal, and a number would look like an answer.
In a Norwegian company, a run that pays per session cannot be confirmed while a line has no current determination, or one that says employment. Salary lines are exempt. A clinic may turn the check off, and that is its own recorded decision.
a-melding, arbeidsgiveravgift and holiday pay belong to a Norwegian payroll provider. We refuse to compute them rather than guess at them.
A designation is not satisfied by knowing who holds it today. It is satisfied by being able to show it was somebody, without a gap — and the failure is the fortnight between one person leaving and the next being appointed.
Required under GDPR Article 37 where health data is processed on a large scale. The clinic says whether it is required; the coverage check then reports any period with nobody designated.
Checked for every Norwegian company. The equivalent role existed before under a US name; it now has its own, because a Norwegian auditor asks for it by the Norwegian one.
The Norwegian check runs only for companies whose country is Norway, and the American one only for the American roles. Coverage reports that cry wolf stop being read.
Pasientjournalloven §§ 19 and 22 ask that access follows a service need, is logged, and is followed up. Access here follows a current care relationship, the access decision has no superuser branch, and every read is logged — our strongest structural match to Norwegian law.
Four things, stated before you find them. None of them is a data-protection gap; three of them need an account with somebody else before any code can be written.
Norwegian e-invoicing through an access point, Vipps as a payment method, and a checked SAF-T export are not built. Nor is the cash-register declaration, and we do not recommend selling our point of sale in Norway.
Norwegian services of this kind are normally entered with BankID. We support a second factor and device lock; we do not support BankID. Expect this question from a privacy lead in the first meeting.
Universal design has been law for private web services in Norway for some time. We have not had the booking flow audited against it, and claiming compliance without one would be the kind of statement this page exists to avoid.
There is a Norwegian locale in the mobile app, but most of its strings are still the English text. The portal and the expert workspace are not translated. This site is not in Norwegian yet either.
Checking an HPR number automatically needs a Maskinporten client, which a deployment registers for itself; until then a person checks the number and records that they did. And the patient's access log is on the portal but has no screen in the mobile app yet.
The same boundary as every other country page, with the Norwegian names on it.
Whether a child's reasons should be respected, whether an engagement is genuinely independent, whether a record is still needed. The software records who decided, when and why. It does not decide.
Self-hosted means the clinic or its hosting partner owns the servers, the backups and the restore test. We will not describe your backups as ours.
Encryption, the access decision, the log nobody can edit, the registers, and the refusals that are recorded rather than silent.
Section 08 is the part of this page to read twice. A supplier who tells you what they do not have is easier to plan around than one who finds out with you.
This page was written from published summaries of Norwegian law and checked against the code, not settled with Norwegian counsel. Confirm each rule before relying on it, and treat the section numbers as a starting point for that conversation rather than as its conclusion.