Significant incidents
Article 13
1. A national contact point for digital health, or the Commission as relevant, shall notify the chair of the steering group, the Commission and any relevant affected national contact points for digital health as soon as possible, and in any event within 24 hours of becoming aware of a significant incident. 2. Following notification referred to in paragraph 1, or on its own initiative, the Commission, in agreement with the chair of the steering group, shall address the significant incident. 3. The national contact point for digital health whose cross-border exchange of personal electronic health data is affected by the significant incident, and the steering group if necessary, shall take the necessary measures to mitigate that incident. Such measures may include the temporary suspension of the exchange of personal electronic health data. 4. The national contact point for digital health concerned shall, following approval of the steering group, restore the suspended cross-border exchange of personal electronic health data as soon as possible following resolution of the significant incident. 5. The national contact point for digital health whose cross-border exchange of personal electronic health data was affected by the significant incident or the Commission, if a service referred to in Article 3(1) was affected by the significant incident, shall report to the steering group no later than one month after submission of the notification referred to in paragraph 1. This shall include at least the following: (a) a detailed description of the significant incident, including its severity and impact; (b) the type of threat or root cause that is likely to have triggered the significant incident; (c) the mitigation measures already taken and still being taken.