Resolution 1644 of 2026: Cybersecurity Requirements for Colombian Clinics, IPS and EPS

Resolution 1644 of 2026, issued by Colombia's Ministry of Health and Social Protection on July 31, 2026, is the rule that now governs telehealth and telemedicine in Colombia, and it repealed Resolution 2654 of 2019 (art. 44). Beyond clinical rules, it sets concrete information-security requirements for clinics, IPS and EPS providing remote care: confidentiality, integrity and availability of data, audit trails, encryption, access control and health-data protection. Compliance is supervised by the Superintendencia Nacional de Salud (art. 42).

Update note (October 17, 2026): an earlier version of this article attributed a cybersecurity «Resolution 2654» to the Superintendencia de Salud. Resolution 2654 of 2019 was issued by the Ministry of Health, regulated telehealth, and was repealed by Resolution 1644 of 2026.

Resolution 2654 of 2019, also from the Ministry of Health, set the rules for telehealth and the parameters for telemedicine. Resolution 1644 of 2026 replaces it from its issue date (art. 44) and separates telehealth activities from services delivered as telemedicine. Providers whose telemedicine services were already authorized have twelve months to align them with the new rule (art. 43), that is, until late July 2027.

Healthcare providers in Colombia's General Social Security Health System that carry out telehealth or deliver telemedicine services, and in practice the technology vendors that supply their platforms. The rule keeps responsibility with the provider: under article 3.27, the provider is responsible for the use of the technologies supplied by the vendor. Outsourcing the platform does not transfer the responsibility.

The rule defines a security breach as a serious incident of unauthorized access, leakage or disclosure of sensitive information (art. 3.5) and requires providers to identify privacy and confidentiality risks and implement specific safeguards (art. 29.1). Incidents and events specific to telemedicine care go into the provider's reporting system and the Quality Information System (art. 29.5). If the breach compromises personal data, the obligations of Law 1581 of 2012 also apply, including reporting security incidents to the Superintendencia de Industria y Comercio.

A hospital faces operational pressure other businesses don't: it can't wait days while negotiating with an attacker, because patients in surgery and emergency care depend on systems that have to keep running. From an attacker's point of view, that urgency makes it a target more likely to pay quickly. Telemedicine adds more surface: platforms, patients' devices and vendors connected to the health record.