CardioSignal- Application for detecting signs of atrial fibrillation

Intended benefits of the product 

The CardioSignal smartphone application is intended to detect possible atrial fibrillation, enabling users to seek further medical evaluation. The aim is to facilitate timely access to healthcare services and reduce the risk of stroke. Early detection of atrial fibrillation may promote health, support the maintenance of functional capacity and contribute to overall well-being.  

The solution is based on mechanocardiography, which utilises the smartphone’s built-in accelerometer and gyroscope sensors to measure micro-movements of the chest caused by cardiac activity. During the measurement, the user lies down and places the smartphone on their chest for one minute. The sensors record movements generated by cardiac activity without the need for electrodes or other additional devices. 

Clinical evidence related to the product under assessment 

Studies have demonstrated that mechanocardiography based on built-in smartphone accelerometer and gyroscope sensors can accurately detect atrial fibrillation without the need for additional devices [2,3,4,5]. A proof-of-concept study published in 2018 demonstrated the feasibility of the method in a small study population comprising 16 patients with atrial fibrillation and 23 controls. The application demonstrated high diagnostic accuracy in detecting atrial fibrillation, with a sensitivity of 93.8%, specificity of 100%, and overall accuracy of 97.4% [2]. 

In a subsequent validation study, the method was evaluated in a larger cohort of hospital patients (n = 300). The method demonstrated a sensitivity of 95.3% and a specificity of 96.0% compared with telemetry electrocardiography (ECG). The method also performed well in older participants. The mean age of the participants was 74.8 years, and 44% were women [3]. 

In a third study, the machine learning-based detection algorithm was further developed and evaluated in a total of 435 participants. The refined algorithm achieved a sensitivity of 98.6% and a specificity of 95.0% in cross-validation. In a separate test dataset, sensitivity reached up to 92.5% and specificity was 96.8%. Overall classification accuracy was 97% in the development dataset and 95% in the test dataset [4]. 

A fourth study investigated the use of the CardioSignal application for monitoring patients following catheter ablation for atrial fibrillation. Application adherence remained good throughout the six-month follow-up period. Some patients required repeat ablation due to recurrent atrial fibrillation. The findings suggest that early detection of atrial fibrillation recurrence using the application may help identify patients at increased risk of recurrence following ablation [5]. 

CARE-DETECT was a randomised controlled trial evaluating atrial fibrillation screening using a smartphone application (CardioSignal) and a bed sensor (EMFIT QS) in patients at risk of atrial fibrillation and stroke following a cardiac procedure. The study included 150 patients (median age 71 years), of whom 78 were randomised to the intervention group and 72 to the control group. The intervention group used the CardioSignal application and EMFIT QS bed sensor for three months, while the control group received usual care. 

During the three-month follow-up period, newly diagnosed atrial fibrillation was detected in 7.7% (6/78) of patients in the intervention group, compared with none in the control group. The between-group difference was statistically significant (risk difference 7.7%, 95% confidence interval 1.8–13.6%; p = 0.029). Approximately 13 patients needed to be screened to detect one case of atrial fibrillation. 

The combination of CardioSignal and EMFIT QS increased the detection of atrial fibrillation compared with usual care, although the screening approach was associated with false-positive alerts. The CardioSignal application was the first to detect three of the six new cases of atrial fibrillation. The remaining three cases were detected through routine monitoring, including standard electrocardiography (ECG), telemetry monitoring and remote pacemaker monitoring. 

The generalisability of the study findings was limited by the single-centre design, small sample size, short follow-up period, lack of comparison with other screening methods, occurrence of false-positive alerts and modifications to the inclusion criteria [6]. 

Literature reviews 

Atrial fibrillation is an often asymptomatic and paroxysmal cardiac arrhythmia that may increase the risk of stroke, among other adverse outcomes. International clinical guidelines recommend opportunistic screening for atrial fibrillation in individuals aged 65 years and older, as well as consideration of systematic screening in individuals aged 75 years and older and those at high risk of stroke. The aim of screening is to identify previously undiagnosed cases of atrial fibrillation as early as possible, as timely initiation of treatment may prevent adverse events associated with the condition [7,8,9,10]. The detection rate of newly diagnosed atrial fibrillation in screening studies has ranged from 0.1% to 5.0% [10]. 

Various digital technologies have become increasingly common in the detection of atrial fibrillation, and their suitability as screening tools has been investigated in a growing number of studies. These technologies are primarily based on electrocardiography (ECG), photoplethysmography (PPG) or mechanocardiography (MCG). They include smartphone applications, smartwatches, fitness trackers and portable ECG devices. Several studies have demonstrated good diagnostic accuracy in detecting atrial fibrillation, with both sensitivity and specificity exceeding 90% [7,9,11,12,13,14,15,16,17,18]. 

Smartphone applications offer the advantages of widespread availability and low additional costs. Smartwatches, fitness trackers, patches and other wearable devices, in turn, enable continuous or long-term, unobtrusive cardiac rhythm monitoring outside healthcare settings [12,15]. 

According to studies, approximately 7–15% of measurements may be of insufficient quality, particularly among older individuals. Measurement results may be affected by motion artefacts, skin contact, lighting conditions and other cardiac arrhythmias. Frequent premature heartbeats may lead to false-positive interpretations of atrial fibrillation. Therefore, results obtained from screening devices should not be considered a definitive diagnosis, and suspected atrial fibrillation should always be confirmed by a 12-lead electrocardiogram (ECG) performed in a healthcare setting [7,8,12,13,14,15]. 

In ageing populations, digital technologies may serve as an initial step in atrial fibrillation screening and help identify individuals who require further diagnostic evaluation [10,14,16]. They may also promote active patient engagement in their own care and support remote care models. Digital technologies have also improved the detection of atrial fibrillation recurrence, which has, in some cases, reduced the need for hospitalisation [11]. 

Screening studies conducted in pharmacies and primary healthcare settings, including during vaccination appointments, have identified new cases of previously undiagnosed atrial fibrillation [9,19]. Automated or continuous monitoring detected more cases of atrial fibrillation than user-initiated measurements, which is particularly important for identifying asymptomatic and paroxysmal atrial fibrillation [16,17]. Approaches combining continuous PPG monitoring with ECG recording when indicated appeared to be the most effective [14]. 

Advances in smartphone technology have substantially expanded opportunities for atrial fibrillation screening. However, further randomised controlled trials are needed to establish the effects of screening on patient health outcomes, mortality and cost-effectiveness. Screening also presents several challenges, including false-positive findings, uncertainty regarding the clinical significance of very brief episodes of atrial fibrillation, and the need to confirm screening findings using conventional ECG examinations [7,10,11]. The use of digital technologies may also be associated with risks of overdiagnosis and unnecessary anticoagulant therapy [9]. 

The clinical implementation of digital technologies requires adequate validation and further research, particularly studies comparing different screening methods. Furthermore, evidence regarding the comparative effectiveness of different devices and technologies remains limited. Their performance has been found to vary according to the technology used, the measurement approach (continuous or intermittent monitoring) and the population studied [16,17,18]. The widespread implementation of atrial fibrillation screening in national screening programmes requires further research into the cost-effectiveness of different methods, as well as clearly defined clinical pathways for interpreting screening results and ensuring appropriate follow-up care [13,14,19]. 

Other recommendation and assessments 

The Finnish Current Care Guidelines (Käypä hoito) identify smartphone applications as potential tools for self-monitoring of cardiac rhythm among patients belonging to high-risk groups [20]. 

The risks associated with the product and its use have been comprehensively identified and documented as part of demonstrating compliance with CE marking requirements. 

The manufacturer has identified and documented the key limitations related to the safe use of the product. The product is not suitable for individuals under 18 years of age or those with a cardiac pacemaker. These limitations are described in the instructions for use and are also presented to users during the initial setup of the application. 

Documented clinical evidence is available regarding the safety of the smartphone accelerometer-based measurement method used by the product, with no serious device-related adverse events reported [1]. 

According to the manufacturer, the product has not compromised patient or user safety. 

Improper use of the product may be associated with adverse consequences, such as delays in seeking medical evaluation and stress or anxiety experienced by users [1]. 

Potential safety risks have been considered during product development, and measures have been taken to minimise them. The risk of improper use is mitigated through instructions for use and user guidance. 

The product is intended for individuals over 18 years of age, and its health-related threshold values cannot be customised for individual users. 

The manufacturer follows the risk management standard ISO 14971:2019, although compliance with the standard has not been independently certified. 

The manufacturer has established a risk management plan defining the processes and reporting procedures intended to ensure product safety. Comprehensive risk analyses have been conducted for the product and are regularly updated as part of the risk management process [1]. 

The manufacturer has designated a person responsible for product safety.

Costs are determined by the number of users. The service organisation procuring the product purchases a specified number of licences and determines the costs charged to end users. Maintenance costs are included in the licence fee. 

Alternatively, end users may purchase the product directly as consumers. 

Implementation involves an initial fee covering training, updates and any necessary development work. Implementation may require modifications to existing operational processes. Changes to operational processes, end-user guidance, communication activities (e.g. distribution of informational materials) and integration of the product into the organisation’s existing systems may incur additional costs. 

A cost-savings analysis estimating the potential benefits of the product has been conducted in collaboration with an EU-level insurance company [1]. 

Based on the information provided by the manufacturer, the costs associated with using the product appear reasonable in relation to the anticipated benefits for the organisation.

The assessment was conducted using the information security and data protection requirements database for health and social care procurement, together with the documentation provided by CardioSignal [1]. 

Risk Management and Security Testing 

The manufacturer has an ISO 27001-certified risk management process in place. Documented processes have been established for information security management, risk management and the maintenance of security controls. The manufacturer has reported applying widely recognised information security frameworks and practices throughout the development process [1]. 

Automated security testing is performed at various stages of the product release process. The testing covers source code, software dependencies, application programming interfaces (APIs) and user interface functionalities. In addition, manual penetration testing is conducted by an external third party. 

The manufacturer has designated individuals responsible for managing information security incidents [1]. 

Log management 

The product generates comprehensive log data covering events relevant to security, auditing and operational monitoring. Logs from the Amazon Web Services (AWS) environment are collected in AWS CloudWatch log groups. Indexed logs are centralised in a log repository for long-term retention. Logs are protected at rest using modern encryption algorithms. Data in transit is protected using TLS 1.2 or 1.3, and access to logs is restricted through access controls [1]. 

The functionality of the logging system is verified weekly, and any identified errors are analysed. In addition, administrators conduct monthly log reviews, which are documented [1]. 

User Management and Access Control 

End users authenticate to the service using an email address and password. Access permissions are restricted to users’ own data and the functionalities necessary for using the service. Access permissions are managed through an Access Policy mechanism, and authorisation is verified for each API request. The password policy is based on the NIST SP 800-63B guidelines. 

Administrative access to the infrastructure is separated from end-user access and requires two-factor authentication (2FA). Infrastructure access permissions are managed through Identity and Access Management (IAM) roles, applying role-based access control (RBAC) and the principle of least privilege [1]. 

Technical Infrastructure 

The product is a Software as a Service (SaaS) solution implemented using Amazon Web Services (AWS) cloud infrastructure. The service is accessed through a mobile application available for Android and iOS operating systems. According to the manufacturer, the cloud environments follow the AWS Virtual Private Cloud (VPC) architecture, with each separate cloud environment deployed within its own dedicated VPC [1]. 

Data Protection 

Data subject to the General Data Protection Regulation (GDPR) is stored within the European Union (EU) and/or the European Economic Area (EEA). The encryption algorithms and practices employed are consistent with current industry standards, and data is protected by encryption at rest [1]. 

A Data Protection Impact Assessment (DPIA) has been conducted for the product [1]. 

The manufacturer acts as the data controller for the processing of personal data associated with the service. Where the service is implemented as an embedded integration within a customer’s service, the customer acts as the data controller and the manufacturer as the data processor. 

General Guidance for Procurement 

During the procurement process, organisations should always consult their IT management, information security specialists and data protection specialists to assess whether the product meets their organisational requirements. 

In addition, we recommend that wellbeing services counties refer to the procurement cybersecurity guidelines published by the European Union Agency for Cybersecurity (ENISA) to support their procurement processes [22].

CardioSignal is available to end users as a mobile application for iOS and Android devices. 

Usability 

Usability studies and testing have been conducted as part of the product development process, and supporting documentation is available. The participants represented the product’s intended end users and individuals with varying levels of digital literacy. As the primary target population consists of individuals aged over 50 years, the studies and tests also included participants who do not actively use other digital technologies [1]. 

The manufacturer has applied the IEC 62366-1:2015 standard in the development and testing of the user interface. Areas for improvement identified during usability testing have been addressed in subsequent product development. 

According to the manufacturer, the usability and accessibility of the product are continuously improved, and user feedback and suggestions for further development are collected through user surveys [1]. 

Accessibility 

Efforts have been made to ensure that the textual content of the product is clear and concise. 

According to the manufacturer, the following user groups with specific accessibility needs have been considered in the design of the product’s usability and accessibility: 

• Individuals with low vision or visual impairments 
  • Visibility and readability are enhanced through appropriate colour contrast, scalable text, support for system-level font size adjustments, and touch targets measuring at least 44 × 44 pixels. Information is not conveyed through colour alone; icons and textual indicators are also used. 

• Individuals with limited reach, grasping ability or physical strength 
  • During measurement, the smartphone is placed against the chest. Performing the measurement does not require precise or demanding fine motor movements. The measurement duration has been kept short to minimise physical strain. 

• Individuals with colour vision deficiencies
  • Information is conveyed through icons, shapes and textual indicators in addition to colour. 

• Individuals with hearing impairments and sign language users
  • The use of the application and the communication of information do not depend on audio. Instructions, measurement-related feedback and results are presented visually. According to the manufacturer, sign language content is not considered necessary, as the application does not include content requiring spoken communication. 

• Individuals with cognitive difficulties (perception, memory or learning)
  • According to the manufacturer, the user interface has been designed to be simple and easy to use. The application provides step-by-step guidance to support users throughout the process and reduce cognitive load. 

• Individuals with fine motor difficulties
  • Fine motor limitations have been considered through the use of large buttons and a clear user interface. 

• Individuals with epilepsy
  • The application does not contain video content, flashing graphics or rapidly animated elements that could pose a risk to individuals with epilepsy. 

The accessibility of the product has not been evaluated against the technical accessibility requirements of the EN 301 549 standard, and no accessibility statement was available for the product [23,24]. However, certain accessibility features have been incorporated, including sufficient user interface contrast, font settings that comply with system-level accessibility preferences, and audio and vibration feedback indicating the progress and completion of measurements. 

Accessibility-related feedback can be submitted via email directly through the application. According to the manufacturer, responses to feedback are provided within five days [1]. 

Updates to the application are released in a controlled manner across different platforms to maintain a consistent user experience. 

A demonstration version is available to other customer groups but not to individual consumers. 

Instructions for use are available in Finnish and Swedish, both within the application and on the manufacturer’s website. 

The native iOS and/or Android application supports the accessibility features provided by the respective operating systems [1]. 

General Guidance for Procurement 

The procuring organisation must take into account the accessibility requirements established by the legislation in force at the time of procurement [23,24,25]. 

Interoperability 

The product does not integrate with websites or other software applications and services. 

Data cannot currently be exported in a standardised format, as standardised external integrations have not been required for the system. 

The product integrates with cloud service APIs for authentication and retrieval of analysis results. 

The product utilises data generated by other systems through APIs, and this data can be distinguished within the system [1].

Technical Performance 

All source code and configuration files are subject to version control and auditing processes. 

The manufacturer applies the IEC 62304 standard for the software life cycle processes of medical devices. 

Product testing processes have been defined and are implemented as part of product development. System functionality is tested at multiple levels throughout all stages of the development life cycle [1]. 

The manufacturer receives and processes product-related error reports as part of its post-market surveillance (PMS) activities. 

The product can be rolled back to a previous version if necessary. 

The manufacturer proactively monitors product performance to detect potential failures through both manual monitoring of system functions and automated alerts based on predefined metrics [1]. 

The product life cycle management process includes a documented procedure for its controlled withdrawal from the market. 

According to the manufacturer, the product has experienced no service interruptions or downtime due to system failures during the preceding six months. 

Before product updates are released, their functionality is verified through comprehensive system testing. Updates are deployed in accordance with a documented release process. The latest version is automatically made available to all users, and older versions cannot be used [1]. 

Product updates do not cause significant service interruptions. Users are notified of scheduled maintenance downtime within the application, which is unavailable for use during the update process. 

The product requires a Wi-Fi or mobile network connection to function. If the network connection is weak or unavailable, the application notifies the user accordingly [1]. 

Training and Product Support 

The manufacturer provides product support primarily via email, but telephone support is also available when necessary. 

Instructions for use are available in English, Finnish, Bulgarian, Danish, Dutch, French, German, Italian, Norwegian, Spanish and Swedish [1].

Consumer Protection 

The manufacturer commits to responding to customer enquiries within five working days. However, the customer support team aims to provide an initial response within 48 hours on working days [1]. 

The intended purpose of the product is communicated to end users through the mobile application, the manufacturer’s website and the instructions for use. Customers also have the opportunity to familiarise themselves with the application and its features online before beginning to use the product [1]. 

Information regarding the product’s features and pricing is available on the manufacturer’s website and in the application store. The product does not involve automatically renewing subscriptions or time-limited special offers. 

Customers may discontinue using the product at any stage of the care process. Users may also delete their accounts directly through the application. 

If signs of atrial fibrillation are detected in the measurement results, the application advises the user to contact a healthcare professional. 

The product is intended for adults [1].

Distribution of the product 

The product was marketed as a medical device under the Medical Devices Directive (MDD, 93/42/EEC) in the European Union, the United Kingdom and India between 2019 and 2025. A product version compliant with the Medical Device Regulation (MDR, Regulation (EU) 2017/745) was placed on the market in the European Union and the United Kingdom in November 2025 [1]. 

1. Digi-HTA questionnaire completed by the manufacturer; not publicly available 
2. Lahdenoja, O., Hurnanen, T., Iftikhar, Z., Nieminen, S., Knuutila, T., et al. (2018). Atrial Fibrillation Detection via Accelerometer and Gyroscope of a Smartphone. IEEE journal of biomedical and health informatics, 22(1), 108–118. https://doi.org/10.1109/JBHI.2017.2688473 
3. Jaakkola, J., Jaakkola, S., Lahdenoja, O., Hurnanen, T., Koivisto, T., et al. (2018). Mobile Phone Detection of Atrial Fibrillation With Mechanocardiography: The MODE-AF Study (Mobile Phone Detection of Atrial Fibrillation). Circulation, 137(14), 1524–1527. https://doi.org/10.1161/CIRCULATIONAHA.117.032804 
4. Tadi, M.J., Mehrang, J., Kaisti, M., Lahdenoja, O., Hurnanen, T., et al. (2019). Comprehensive Analysis of Cardiogenic Vibrations for Automated Detection of Atrial Fibrillation Using Smartphone Mechanocardiograms. IEEE Sensors Journal, vol. 19, no. 6, pp. 2230-2242, 15 March15, 2019. https://doi.org/10.1109/JSEN.2018.2882874 
5. Pontoppidan, J., Steen Hansen, P., Mrevlje, B., Jafarian, K., Ingman, V., & Blomster, J. (2026). Post-ablation home monitoring using smartphone mechanocardiography: early detection of atrial fibrillation recurrence and association with re-ablation. Europace, 28(Suppl 1), euag105.1240. https://doi.org/10.1093/europace/euag105.1240 
6. Lehto, J., Nuotio, J., Relander, A., Jaakkola, J., Lahdenoja, O., et al. (2026). Randomized trial of smartphone application and bed sensor for atrial fibrillation detection in high-risk patients. Scientific reports, 16(1), 7088. https://doi.org/10.1038/s41598-026-38273-5 
7. Linz, D., Gawalko, M., Betz, K., Hendriks, J. M., Lip, et al. (2024). Atrial fibrillation: epidemiology, screening and digital health. The Lancet Regional Health–Europe, 37. https://doi.org/10.1016/j.lanepe.2023.100786 
8. Van Gelder, I.C., Rienstra, M., Bunting, K.V., Casado-Arroyo, R., Caso, V., et al. (2024). ESC Scientific Document Group. 2024 ESC Guidelines for the management of atrial fibrillation developed in collaboration with the European Association for Cardio-Thoracic Surgery (EACTS): Developed by the task force for the management of atrial fibrillation of the European Society of Cardiology (ESC), with the special contribution of the European Heart Rhythm Association (EHRA) of the ESC. Endorsed by the European Stroke Organisation (ESO), European Heart Journal, Volume 45, Issue 36, 21 September 2024, Pages 3314–3414. https://doi.org/10.1093/eurheartj/ehae176 
9. Biersteker, T. E., Schalij, M. J., & Treskes, R. W. (2021). Impact of Mobile Health Devices for the Detection of Atrial Fibrillation: Systematic Review. JMIR mHealth and uHealth, 9(4), e26161. https://doi.org/10.2196/26161 
10. Khurshid, S., Healey, J. S., McIntyre, W. F., & Lubitz, S. A. (2020). Population-Based Screening for Atrial Fibrillation. Circulation research, 127(1), 143–154. https://doi.org/10.1161/CIRCRESAHA.120.316341 
11. Lawin, D., Albrecht, U. V., Oftring, Z. S., Lawrenz, T., Stellbrink, C., & Kuhn, S. (2022). Mobile Health zur Detektion von Vorhofflimmern – Status quo und Perspektiven [Mobile health for detection of atrial fibrillation-Status quo and perspectives]. Der Internist, 63(3), 274–280. https://doi.org/10.1007/s00108-022-01267-2 
12. Wouters, F., Gruwez, H., Smeets, C., Pijalovic, A., Wilms, W., et al. (2025). Comparative Evaluation of Consumer Wearable Devices for Atrial Fibrillation Detection: Validation Study. JMIR formative research, 9, e65139. https://doi.org/10.2196/65139 
13. Li, K. H. C., White, F. A., Tipoe, T., Liu, T., Wong, M. C., et al. (2019). The Current State of Mobile Phone Apps for Monitoring Heart Rate, Heart Rate Variability, and Atrial Fibrillation: Narrative Review. JMIR mHealth and uHealth, 7(2), e11606. https://doi.org/10.2196/11606 
14. Giebel, G. D., & Gissel, C. (2019). Accuracy of mHealth Devices for Atrial Fibrillation Screening: Systematic Review. JMIR mHealth and uHealth, 7(6), e13641. https://doi.org/10.2196/13641 
15. Rizas, K. D., Freyer, L., Sappler, N., von Stülpnagel, L., Spielbichler, P., et al. (2022). Smartphone-based screening for atrial fibrillation: a pragmatic randomized clinical trial. Nature medicine, 28(9), 1823–1830. https://doi.org/10.1038/s41591-022-01979-w 
16. Hermans, A. N. L., Gawalko, M., Dohmen, L., van der Velden, R. M. J., Betz, K., et al. (2022). Mobile health solutions for atrial fibrillation detection and management: a systematic review. Clinical research in cardiology : official journal of the German Cardiac Society, 111(5), 479–491. https://doi.org/10.1007/s00392-021-01941-9 
17. Lopez Perales, C. R., Van Spall, H. G. C., Maeda, S., Jimenez, A., Laţcu, D. G., et al. (2021). Mobile health applications for the detection of atrial fibrillation: a systematic review. Europace : European pacing, arrhythmias, and cardiac electrophysiology : journal of the working groups on cardiac pacing, arrhythmias, and cardiac cellular electrophysiology of the European Society of Cardiology, 23(1), 11–28. https://doi.org/10.1093/europace/euaa139 
18. Hermans, A. N. L., Gawalko, M., Dohmen, L., van der Velden, R. M. J., Betz, K., et al. (2022). A systematic review of mobile health opportunities for atrial fibrillation detection and management. European journal of preventive cardiology, 29(5), e205–e208. https://doi.org/10.1093/eurjpc/zwab158 
19. Smith, S., & Maisrikrod, S. (2025). Wearable Electrocardiogram Technology: Help or Hindrance to the Modern Doctor?. JMIR cardio, 9, e62719. https://doi.org/10.2196/62719 
20. Eteisvärinä. Käypä hoito –suositus. Suomalaisen Lääkäriseuran Duodecimin ja Suomen Kardiologisen Seuran asettama työryhmä. Helsinki: Suomalainen Lääkäriseura Duodecim, 2025. Available at www.kaypahoito.fi. Accessed on 8.9.2026. 
21. National Cyber Security Centre Finland. Information security and data protection requirements for social welfare and healthcare procurements. https://kyberturvallisuuskeskus.fi/en/instructions-and-guides/instructions-and-guides-organisations-and-companies/information-security-and-data-protection-requirements-social-welfare-and-healthcare-procurements Accessed on 09.10.2026 
22. The European Union Agency for Cybersecurity Procurement Guidelines for Cybersecurity in Hospitals. Saatavilla: https://www.enisa.europa.eu/publications/good-practices-for-the-security-of-healthcare-services. Accessed on 09.10.2026 
23. Act on the Provision of Digital Services 306/2019 (Laki digitaalisten palvelujen tarjoamisesta 306/2019). Available at: https://www.finlex.fi/fi/laki/alkup/2019/20190306. Accessed 09.10.2026 
24. Finnish Transport and Communications Agency Traficom, Supervision of Digital Accessibility. Requirements of the Act on the Provision of Digital Services for service providers. Available at: https://saavutettavuusvaatimukset.fi/fi/digipalvelulain-vaatimukset/digipalvelulain-vaatimukset-toimijoille. Accessed 09.10.2026   
25. Act on Public Procurement and Concession Contracts 1397/2016 (Laki julkisista hankinnoista ja käyttöoikeussopimuksista 1397/2016). Available at: https://www.finlex.fi/fi/laki/alkup/2016/20161397.  Accessed 09.10.2026 

Jari Haverinen, Senior planning officer, FinCCHTA 

Raija Järvinen, Senior planning officer, FinCCHTA 

Teemu Mustola, Senior planning officer, FinCCHTA