Supersalud Resolution 2654: Cybersecurity Requirements for Colombian Healthcare Providers

A patient's medical record is probably the single most sensitive piece of personal data that exists. It reveals what illnesses someone has, what medication they take, whether they've been in psychiatric treatment, whether they carry a genetic condition. That's why Colombia's healthcare sector isn't governed only by the general Habeas Data Law like any other business — the Superintendencia Nacional de Salud imposes additional, sector-specific requirements on EPS health insurers, IPS providers, clinics, and other operators within Colombia's health system, precisely because the data they handle belongs to a special category of information.

If your organization provides healthcare services, or provides technology to someone who does, here's what you need to understand.

Health information is legally classified as sensitive data, alongside sexual orientation, religious beliefs, and political affiliation. Law 1581 already requires a higher level of protection for this category — it demands explicit authorization, generally can't be processed except in narrow exceptions, and its exposure carries more severe legal consequences than a leak of ordinary data like an email address. The Superintendencia de Salud builds on that foundation with sector-specific operational requirements: continuity of service, integrity of electronic medical records, and the ability to respond to incidents that could compromise patient care.

Superintendencia de Salud oversight covers EPS health insurance entities, IPS healthcare providers — clinics, hospitals, laboratories — and generally any operator within Colombia's General Social Security Health System. If your business develops electronic health record software, manages technology infrastructure for a hospital, or provides cybersecurity services to any of these players, sooner or later you'll need to show you understand this framework.

While the exact technical detail varies by type of operator, in practice the requirements the Superintendency expects to see cover these areas:

Protecting the electronic medical record. Strict access control — only medical staff authorized and directly involved in a patient's care should be able to view their record. Systems need to be able to audit who accessed what information and when.

Continuity of service. A hospital can't simply "go down" during a ransomware attack without real consequences for patient care. Continuity planning in healthcare carries a different weight than in other sectors — there are literally lives involved.

Reporting incidents that affect patient information. When a breach compromises health data, the operator needs to be able to document it, report it as required, and show it took containment measures.

Managing technology vendors. As in the financial sector, if a healthcare operator outsources its technology infrastructure or medical record software, it needs to be able to demand equivalent security standards from those vendors.

It's no coincidence hospitals consistently rank among the most ransomware-targeted sectors in the region. A hospital faces operational pressure other businesses don't: it can't simply wait days while negotiating with an attacker, because there are patients in surgery, in emergency rooms, depending on systems that have to keep running. That urgency makes healthcare, from an attacker's perspective, a target with a higher likelihood of fast payment — which, perversely, makes it targeted more often, not less.