Classified Meeting Held on Åland's Controversial VIS System

Key Stakeholders Convene on VIS System Challenges

The Data Inspection (DI) in the Åland Islands recently held a two-hour, classified meeting with representatives from Ålands Hälso- och sjukvård (ÅHS) and the regional government. The high-level discussion centered on critical issues surrounding the new healthcare information system, known as VIS, and the necessary steps to rectify them. This meeting underscores the ongoing scrutiny and challenges associated with the system's implementation in the autonomous region.

Background of the VIS System and Its Controversies

The VIS system refers to Cambio Cosmic, a new healthcare information system being implemented by ÅHS, the authority responsible for public healthcare in Åland. The project has been a subject of considerable debate due to its significant costs and complex implementation. Estimates suggest the total cost could reach tens of millions of euros. A substantial portion of the funding, approximately 4.8 million euros, is expected to come from EU resilience funds, which stipulate an 80% implementation rate by the end of 2025. A unique requirement for a Swedish-language system compatible with Finnish authorities has been cited as a factor contributing to the project's expense.

Data Inspection's Oversight and Conditions

The Data Inspection, an independent supervisory authority under the Åland regional government, has been actively overseeing the VIS system's rollout to ensure the protection of sensitive patient data. Lena Nordman, the head of the DI, has voiced concerns about 'unacceptable haste and incompleteness' in the project's execution. In September 2025, the DI issued a temporary prohibition on the system's implementation, which was lifted three days later after ÅHS committed to addressing the DI's stringent conditions. These conditions included requirements for:

• Approval of a differentiated risk matrix.
• An updated control plan for the vendor.
• Adherence to guidelines for assessing personal data incidents.
• Sufficient time for the municipal sector to review and sign project agreements.
• Clarification of agreements with subcontractors, particularly regarding data processing outside the EU/EEA and confidentiality.

The DI has emphasized that the system could still be halted if data protection standards are not met. As of late September 2025, ÅHS and DI were holding two meetings per week to ensure ongoing compliance.

Collaborative Efforts for Resolution

The recent classified meeting, which included officials from the regional government, signifies a concerted effort by Åland's key administrative bodies to navigate the complexities of the VIS system. The involvement of the Ålands landskapsregering highlights the political and administrative commitment to finding a sustainable solution for the healthcare information system. The discussions aim to establish effective cooperation patterns for future work, ensuring that the system not only becomes operational but also fully compliant with data protection regulations.