Rettslig regulering av samarbeid mellom offentlige og private aktører – digital sikkerhet i helsesektoren

Private sector actors play an important role in assisting the public sector with the provision of welfare services to citizens and residents of Norway. For example, in the health sector, private doctors, clinics and hospitals assist the public sector with the provision of both primary and specialist health care. This collaboration and interaction is usually regulated through a variety of legal instruments that, though national, may stem from Norway’s EEA’s obligations (i.e. are supranational), involve both public law and private law mechanisms, and whose form may span from legally binding rules (hard law) to industry guidelines and self-regulation (soft law). Furthermore, some of these rules are sector-specific, applying only to the health sector, while others are cross-sectoral, i.e. on a subject-matter that applies to different sectors, such as the rules and requirements relating to cybersecurity. This makes for a complex regulatory framework. This chapter examines this legal complexity by focusing on the regulatory framework relating to cybersecurity, with specific reference to the health sector. To do so, this chapter draws upon and builds upon regulatory theory on network or ‘mesh’ regulation as well as theories on decentred and reflexive regulation.