Folkehelseinstituttet

Norway · owned by Norwegian Government (Norway) · fhi.no · 27 vendors

Folkehelseinstituttet (Norwegian Institute of Public Health) is Norway's national public health institute with responsibilities including infectious disease control, mental and physical health, environmental medicine, epidemiology and substance abuse. The organization conducts health surveillance, research, and provides expert advice to support public health policy in Norway.

Resilience scores

Technology vendors

Insights

Last updated 2026-02-17 · revision 14

27 direct vendors, 319 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Migration readiness is low due to the highly sensitive nature of the data handled (National Health Registries, epidemiological data) and strict regulatory constraints. Compliance with the Norwegian Health Registry Act, GDPR, and data residency requirements (storage within Norway/EEA) severely limits public cloud options and complicates cross-border data strategies. The financial contraction (over 50% revenue drop since 2022) likely limits available capital for large-scale digital transformation projects. Furthermore, the reliance on specialized 'Laboratory Information Systems' and 'Health Registries' implies a tech stack with significant legacy debt and on-premise infrastructure that is difficult to containerize or shift to the cloud. While the use of 74 external services indicates some familiarity with third-party integrations, the critical nature of the infrastructure under the Norwegian Security Act necessitates cautious, slow-moving migration strategies.

Compliance

6 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

Appropriate for FHI's operations involving sensitive health data, national health registries, and critical public health infrastructure.

ISO 27001 certification would be highly beneficial for FHI given their handling of sensitive health data and critical infrastructure role. While not legally mandatory, Norwegian public sector guidelines often recommend ISO 27001 for information security management. Risk is moderate as it affects operational security posture.

GDPR (source) — Assessment Required

FHI is located in Norway (EEA member) and processes extensive personal data including health records, epidemiological data, and registry information.

As a Norwegian public health institute processing extensive personal health data of EU/EEA residents, GDPR compliance is mandatory. Non-compliance could result in fines up to 4% of annual turnover or €20M. Given FHI's role in health registries, epidemiological studies, and population health monitoring, the volume and sensitivity of personal data processed creates high regulatory risk.

NIS2 (source) — Assessment Required

FHI operates in the health sector as an Essential Entity, providing critical public health services and maintaining health registries.

FHI operates critical health infrastructure and digital services that likely qualify as Essential Entity under NIS2's health sector provisions. As Norway implements NIS2 through national legislation, non-compliance could result in significant fines and operational restrictions. The institute's role in national health surveillance and emergency preparedness creates high cybersecurity risk exposure.

Financials

Three-year financials

Financial Resilience Score: 8/10

Folkehelseinstituttet (NIPH) is a state-owned administrative body under the Norwegian Ministry of Health and Care Services, providing it with high financial security through government budget allocations. The institute saw significant revenue volatility between 2021 and 2024, primarily driven by the conclusion of emergency COVID-19 funding and a major 2024 reorganization that transferred several regulatory functions to the Norwegian Directorate of Health. Despite these budget reductions, NIPH remains a core national institution with an essential mandate. The institute's resilience is bolstered by its diversified funding model, which includes substantial external grants from the Research Council of Norway and the European Union. Although it underwent a period of downsizing in 2023 to adjust to lower post-pandemic budgets, the integration of new departments (such as the Cancer Registry of Norway) in 2024 has stabilized its workforce and expanded its strategic importance as a knowledge and data hub for the Norwegian health sector.

Key strengths: Stable state budget allocations, Critical national mandate for health data and infection control, Strong track record in securing international research grants, High organizational expertise and public trust

Risk factors: Vulnerability to political restructuring and mandate shifts, Phasing out of large-scale pandemic-related funding, Recent cost-cutting measures and staff reductions in 2023

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report