Industries · Healthcare
Since January 2024 every fasyankes in Indonesia has been required to run electronic medical records, interoperable with SATUSEHAT. Care that used to survive a system failure on paper no longer can. Zentara works with hospitals and clinics on the question a director actually asks — not whether the data is safe, but whether patients can still be treated at 3am when it is not.
What we are defending
The record and its integration. Your obligation does not stop at your own system — your RME provider must be officially integrated and registered, and their exposure is now yours.
Infusion pumps, monitors, analysers. Vendor-certified, frequently unpatchable, and on the same network as everything else because that is how they were installed.
Large, old, and quietly reachable. Imaging archives are among the most consistently exposed systems we find in a hospital estate.
Downtime procedure is not an IT artefact. It is whether the nurse on shift can safely administer without the system, and whether anyone has practised it.
Dispensing, stock and cold chain. An outage here is a patient safety issue within hours rather than days.
Fast user switching, badge access, session timeouts that clinicians will defeat if the timeout is set by someone who has never run a clinic.
Instrument · Obligation · Clinical outcome
Permenkes 24/2022 made electronic records compulsory and SATUSEHAT interoperability part of the deal. Both are the right direction. Both also removed the paper process that used to absorb a system failure, and very few facilities replaced it with a rehearsed one.
Permenkes 24/2022
Kemenkes
Requires
Every health facility — hospital, puskesmas, clinic, pharmacy, laboratory and telemedicine provider — must operate electronic medical records, compatible and interoperable with the SATUSEHAT platform.
We do
Assess the RME estate and its integrations as one system, including the provider you depend on, and rebuild the downtime procedure the electronic record replaced.
What the facility ends up with
Integration risk register, tested downtime procedure
UU PDP
Republik Indonesia
Requires
Health data is specific personal data, requiring a stronger lawful basis, tighter access control, and breach notification within 72 hours.
We do
Access model built around clinical roles rather than IT convenience, and a notification runbook that survives contact with a hospital's own governance.
What the facility ends up with
DPIA, role-based access model, runbook
PSE registration
Komdigi
Requires
Electronic system providers operating in Indonesia must be registered — including the RME vendor a facility relies on.
We do
Supplier assessment that checks registration and integration status rather than accepting a sales assurance.
What the facility ends up with
Supplier assurance file
IEC 80001-1
Guidance
Requires
Risk management for IT networks incorporating medical devices — the reference for handling equipment that cannot simply be patched.
We do
Segmentation and compensating controls for devices where the answer is genuinely not to touch the device, agreed with biomedical engineering.
What the facility ends up with
Device zone model, compensating controls
ISO 27001
Certifiable
Requires
Information security management system across the organisation, increasingly asked for in accreditation and payer contracting.
We do
Implementation scoped so clinical systems are inside it rather than carved out to make certification simpler.
What the facility ends up with
Certifiable ISMS with clinical systems in scope
Downtime · The only question at 3am
Every other question in healthcare security is downstream of this one. Before 2024 the answer was usually yes — the ward reverted to paper, because paper was still how half the process worked. Mandatory electronic records removed that cushion without anyone deliberately deciding to, and most facilities have not rebuilt it. This is not an argument against RME, which is plainly the right direction. It is an argument that the downtime procedure is now a clinical control and needs to be drilled like one.
Clinical downtime capability
Improvised
No downtime procedure. Staff work it out on the night, differently on each ward.
Written
A procedure exists in a folder. Nobody on the current roster has used it.
Drilled
Practised on one ward, on a quiet day, by staff who knew it was coming.
Sustained
Care deliverable for days, across departments, with reconciliation back into the record planned.
Exercised whole
Full-facility exercise including reconciliation, with clinical leadership present and findings acted on.
Highlighted: where a facility has to be before it can say care continues through an outage.
Framing derived from Permenkes 24/2022 and clinical continuity practice
Sector threat model
What this sector answers to
The regulatory landscape for healthcare. Our own accreditations are listed on certifications.
Track record
Penetration testing delivered for global pharmaceutical companies.
For puskesmas, clinics and small facilities
Permenkes 24/2022 does not scale its requirements to the size of the facility. A puskesmas carries the RME obligation, the SATUSEHAT integration and the UU PDP duty with an IT function that is frequently one person doing it alongside another job. Pretending that is a smaller version of a hospital problem is why the gap persists.
Before you have to justify us internally
So here is the answer to the questions your risk committee will ask, before they ask them.
Testing that touches a system in use is scoped with the clinical lead, not only with IT, and stops when they say stop. A finding is never worth a patient safety incident.
We work on site, on your systems, and take no clinical data away. Where we need evidence for a report it is redacted before it leaves the room.
Where a device cannot be changed without voiding certification, the answer is segmentation and compensating control, agreed with biomedical engineering — not a finding that nobody can action.
Many facilities have no CISO. Reports are written so a hospital director and a head of nursing can act on them without translation.
Assessment scheduled around theatre lists and ward rounds. Convenience for us is not a reason to interrupt care.
Healthcare reputational harm attaches to the institution and lands on its patients. Nothing about an engagement is published, ever.
Recommended
VAPT & Offensive Security
27 services in the catalog apply to Healthcare — from point-in-time pentests to red team and continuous validation.
Black-box test of internet-facing assets, perimeter exposure, and exploitable services.
Assumed-breach lateral movement, AD abuse, sensitive data discovery from inside.
Verifies VLAN/firewall isolation between zones (CDE, OT, corporate).
Kerberoasting, AS-REP, ACL abuse, BloodHound paths, hybrid identity review.
Rule base hygiene, ACL drift, hardening against CIS Benchmarks.
IKE/IPsec, SSL VPN, split tunneling, ZTNA migration readiness.
SPF/DKIM/DMARC, MTA-STS, DNSSEC, BIMI, phishing surface.
OWASP Top 10, business logic, authenticated/unauthenticated flows.
What we have written about it
Many organisations treat a Data Protection Impact Assessment (DPIA) as a compliance document. Regulators increasingly see it differently. A DPIA is only valuable if the risks it identifies are actually addressed. In January 2026, France’s data protection regulator (CNIL) fined France Travail E
Most organisations do not fail at data breach response because they lack a plan. They fail because the clock had already been running for weeks before anyone noticed. Notification deadlines start when you become aware of a breach. That single word governs everything that follows. An organisation tha
Most of the guidance you will find on privacy information management systems is out of date. It tells you that a PIMS is an extension of ISO 27001, and that you need an ISO 27001 certificate before you can certify one. Several certification bodies still publish this on their websites today. It stopp
Start with a scored maturity baseline or go straight to a specialist conversation.