Norsk helsenett SF

Norway · owned by Ministry of Health and Care Services (Norway) (Norway) · nhn.no · 32 vendors

Norsk helsenett SF is a Norwegian state enterprise that provides national ICT infrastructure and e-health solutions for the healthcare sector. The company connects healthcare providers, citizens, and other stakeholders through secure digital platforms and services including electronic prescriptions, health records, and telemedicine solutions.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 32 sub-vendors.

Insights

Last updated 2026-02-18 · revision 11

32 direct vendors, 324 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Confidence: Low. The internal technology stack is not publicly disclosed. This score is a neutral estimate. A high degree of custom, legacy, or on-premise infrastructure for national critical services could result in a lower score (1-3). Conversely, adoption of modern, containerized, or cloud-native platforms, even in a private cloud environment, could warrant a higher score (7-9). Without further information, a mid-range score is assigned.

Compliance

5 in-scope frameworks identified; showing 3.

ISAE 3000 (source) — Assessment Required

Independent assurance reporting under ISAE 3000 would verify the effectiveness of controls for stakeholders of critical healthcare infrastructure.

As a provider of critical healthcare IT services and infrastructure, ISAE 3000 assurance reporting could be valuable for providing independent verification of their control environment to customers and stakeholders. The risk is medium because while not mandatory, lack of independent assurance reporting could impact stakeholder confidence and business relationships, particularly given their role in critical healthcare infrastructure.

SOC 2 (source) — Assessment Required

As a provider of cloud-based healthcare IT services, SOC2 would provide third-party validation of security controls for customers and partners.

While SOC2 is not mandatory, as a provider of critical cloud-based healthcare IT services and infrastructure, SOC2 compliance would be valuable for demonstrating security controls to customers and partners. The risk is medium because lack of SOC2 certification could impact business relationships and customer trust, though it's not legally required. Given their role as a service provider to healthcare organizations, SOC2 would provide valuable third-party validation of their security practices.

Evidence: https://www.nhn.no/om-oss/Personvern-og-informasjonssikkerhet

ISO 27001 (source) — Partially Compliant

The company uses ISO 27001 as the primary framework for its information security management system (ISMS).

The company explicitly references ISO 27001 as the foundation for their information security management system and has established comprehensive security frameworks based on this standard. However, without formal certification evidence, there's medium risk that their implementation may not meet full certification requirements. Given their critical role in healthcare infrastructure, formal ISO 27001 certification would provide important third-party validation of their security practices.

Evidence: https://www.nhn.no/om-oss/Personvern-og-informasjonssikkerhet

Financials

Three-year financials

Financial Resilience Score: 9/10

Norsk Helsenett SF (NHN) exhibits exceptionally high financial resilience as a 100% state-owned enterprise under the Norwegian Ministry of Health and Care Services. The company serves as the critical national provider of ICT infrastructure and e-health solutions for the entire Norwegian health sector. This strategic positioning ensures a stable and predictable revenue model, where approximately 40% of funding is provided through direct government grants from the National Budget, while the remaining 60% comes from service sales and mandatory sector memberships. The enterprise maintains a robust balance sheet with zero long-term debt and a solid equity ratio, which was reported at over 40% of total capital in recent years. This liquidity allows NHN to manage large-scale national infrastructure projects and withstand economic shocks. Although the company does not operate for profit, it consistently generates a positive operating surplus (EBIT) to maintain strategic reserves and fund necessary technological upgrades. Its financial risks are considered limited due to the creditworthiness of its primary customer base, which consists of public health trusts, municipalities, and government agencies.

Key strengths: 100% State-owned by the Norwegian Government, Guaranteed funding via the National Budget, Critical national infrastructure provider with zero competition, Strong equity position with no long-term debt

Risk factors: High exposure to cybersecurity and data privacy threats, Dependence on government policy and healthcare budget allocations, Challenges in recruiting specialized ICT talent in a competitive market

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report