Healthcare providers in the Kingdom are being asked to show that their cloud and SaaS arrangements meet the National Cybersecurity Authority's Essential Cybersecurity Controls. For many, the first serious look at the electronic health-record contract reveals a problem. The agreement was signed before the framework applied to the sector, and it says nothing useful about where patient data lives. This article looks at NCA ECC healthcare data residency through a pattern we describe in composite terms: a provider reads its vendor contract for the first time against the controls and finds gaps in data location and incident notification. It then sets out three amendments that close those gaps without moving platforms.
Why inherited SaaS contracts create the gap
Electronic health-record and patient-portal platforms are usually adopted for clinical or operational reasons. Procurement negotiates price, service levels and support. Cybersecurity obligations, where they appear at all, are often generic.
When the NCA's Essential Cybersecurity Controls later become applicable to a sector, the contract does not change on its own. Three gaps tend to appear:
- The vendor hosts or replicates data, including backups and support access, outside the Kingdom, and the contract does not say so.
- There is no committed timeline for notifying the provider of a security incident.
- The provider has no right to examine the vendor's controls, so it cannot gather evidence for its own assessment.
None of these requires bad faith from the vendor. They are simply topics the original agreement never needed to address.
What the framework asks of you
The NCA is the regulator, and the Essential Cybersecurity Controls are the framework. Two areas matter most here. The first is the protection of data and information, including where it is stored and how it is handled. The second is incident management and reporting, which includes how incidents affecting your services are detected, escalated and communicated.
The controls also address cybersecurity in dealings with third parties and cloud services. In practice, an auditor or assessor will ask for contractual evidence. A verbal assurance from a vendor account manager will not satisfy that request. If the contract is silent, your self-assessment for those controls will show a gap, whatever the vendor's real practices are.
Healthcare data adds weight to this. Patient records are sensitive, and the personal data protection regime in the Kingdom also bears on where and how they are processed. Your contract position should be consistent with both.
Amendment one: a data location schedule
The first amendment is a schedule that states, in plain terms, where your data is processed and stored. It should be specific enough to test.
A useful schedule covers:
- The primary hosting location for production data.
- Locations for backups, disaster-recovery replicas and logs.
- Whether vendor support staff outside the Kingdom can access records, and under what conditions.
- Any subcontractors or sub-processors that handle the data, and where they operate.
- A requirement to give notice, and an opportunity to object, before any location changes.
Some vendors will already hold data in-Kingdom and only need to write it down. Others will need to move specific components, such as backups, while leaving the application in place. Either outcome is workable. The schedule turns an unknown into a documented position that you can assess against the controls and, where needed, remediate.
Amendment two: a breach-notification timeline
The second amendment fixes how quickly and in what form the vendor tells you about an incident. Without it, you may learn of a compromise from the news, or weeks later.
Draft the clause around practical points:
- A defined window for initial notice after the vendor becomes aware of an incident affecting your data or service.
- The minimum content of that notice: what happened, what data and systems are affected, and what containment has begun.
- A named contact on each side, available outside business hours.
- A commitment to provide updates and a written post-incident report.
- Cooperation with your own obligations to report to the relevant authorities.
Set the window with your incident-response plan in mind. Your timeline to regulators and to patients starts from when you know, so the vendor's commitment has to leave you enough time to act. Vendors often accept a clear clause when it is framed as an operational need rather than a penalty.
Amendment three: audit and evidence rights
The third amendment gives you the right to verify. It does not need to be intrusive. Most SaaS vendors will not allow unannounced inspections of shared infrastructure, and insisting on them can stall negotiation.
A balanced clause usually provides for:
- Access to current independent assurance reports and certifications.
- Written responses to reasonable security questionnaires on a regular cycle.
- The right to a targeted audit after a significant incident or where a regulator requires it.
- Cooperation with the NCA or other competent authority where it asks for information.
- Retention of relevant logs and records for a defined period.
This is what lets you demonstrate compliance in your self-assessment. It also makes the first two amendments enforceable in practice, because you can check that the schedule and the notification process are being followed.
Doing this without a migration
The reason these three amendments work is that they change obligations, not architecture. A health-record platform is deeply embedded in clinical workflow, and replacing it is slow and risky. Amending the contract is faster and leaves the platform in place.
A sensible sequence is:
- Inventory every SaaS and cloud agreement that touches patient or sensitive data, not only the main health-record system.
- Compare each against the data protection and incident-reporting expectations of the controls.
- Prioritise by data sensitivity and by how soon your self-assessment is due.
- Approach vendors with a single, consistent set of amendment clauses.
- Record the outcome, including any vendor refusal, so residual risk is visible to management.
Where a vendor will not agree, the gap does not disappear. It becomes a documented risk with an owner and a decision, which may include compensating controls or a later change of provider.
A note for providers already assessed under ECC-1:2018
If you complied with the earlier version of the controls, you are not starting over. The structure and several requirements changed in ECC-2:2024. The useful step is to map your existing compliance to the new controls so you only address what is actually new or different. Contract clauses written for the earlier version should be rechecked in that exercise.
Where to take this next
Contract gaps are easiest to see when each control is checked with evidence. Our NCA Essential Cybersecurity Controls service provides compliance assessment, remediation and self-assessment support, with readiness for ECC-2:2024 assessed control by control. The assessment takes 6–10 weeks and produces a compliance assessment report, a remediation plan and tracker, a policy and procedure set, self-assessment submission support and an executive summary. The report gives control-by-control compliance status with evidence, so vendor contract gaps appear alongside every other finding, and the remediation plan assigns owners, dates and effort. It also leaves you a baseline you can re-measure every year.
If your inherited SaaS agreements have not yet been reviewed against the controls, that is a sound place to begin.
