#Norsk Helsenett and HelseID: Supplier Status

STM-NO-002 v1.0.0, Last Modified On 01 August 2026, Tier: Public

Pensieve Labs is not an approved supplier in the Norwegian health network, has not signed the supplier terms, has not passed the identity-service code review, and holds no national service integration approval as at 01 August 2026. Every one of those is a prerequisite to exchanging health data with Norwegian national services. This document states what each gate is, what it costs, and, importantly, what a Norwegian hospital can do with the Platform before they are cleared.

---

#Applicability

The gates below attach to the supplier and the software, not to the hosting arrangement. Choosing DM-4 does not avoid them.

---

#1. The gate that decides the Norwegian timeline

Helsenettet is the closed sector network operated by the national health network undertaking. Any system exchanging health data with Norwegian national services runs over it, and the network is genuinely closed: with a health network connection, only sites inside it are reachable without a client-side change.

This is the hardest single gate in any of Pensieve Labs's five markets, not because any step is individually difficult but because step 6 is a code review conducted by a state body with no published service level. No amount of commercial pressure shortens it, and there is no paid expedite path.

---

#2. The 2026 membership change, and why a supplier must not plan around joining

Membership terms changed with 2026 as a transition year, and two changes matter:

1. Every independent healthcare-provider undertaking must itself become a member.
2. Membership is restricted to undertakings that provide healthcare, health registries and health administration. Suppliers acting as data processors are no longer to be members.

Point 2 is the trap. Edsol Edtech Pvt. Ltd. does not join the health network. It is instead governed by a separate supplier instrument (the terms for suppliers integrating with health network services), and signing those terms is stated to be a requirement for participating in trials and for ordering services going forward.

[UNVERIFIED: the current version of the supplier terms was not parsed in the research pass. They govern liability, security obligations, incident reporting and termination. **Obtain and read them in full before committing to any Norwegian timeline.** no/README.md Section 6 item 1.]

Who pays for the network. The membership charge falls on the hospital, not on Pensieve Labs: supplier processors are outside the membership regime entirely. The published monthly charges for health service providers are modest. Health network cost is not a sales objection; the integration effort is.

---

#3. The prerequisites, in order

A separate approval exists for suppliers of health network connectivity itself. Pensieve Labs does not supply connectivity and does not seek it.

---

#4. The code review, and why it is worth more than a certificate

The identity service is the sector's identity and access service. Its documentation is explicit: before going into production, a supplier must have passed a code review in which the identity team confirms the software was built in accordance with the security profile.

Signing the supplier terms also creates an ongoing obligation: the company must stay current with changes to the security profile and introduce the corresponding changes in its software. It is not a one-off.

A third-party code review by a national authority, with no published service level, is not compatible with a fourteen-day sales cycle. It is also the closest thing to a certification Norway will give Pensieve Labs, and it is free. Once passed, it is a real, checkable, health-specific claim that no general-purpose security certificate substitutes for. Pensieve Labs treats it as the highest-value Norwegian credential to acquire.

---

#5. The public register: the marketing asset that costs nothing

The health network undertaking publishes a public register of systems with approved integrations, mirrored by the health directorate. Getting Pensieve onto that list is the single highest-value Norwegian credibility asset available: it is state-published, checkable in ten seconds, and costs no certification money.

It is also the direct answer to "you have no security certification", not a rebuttal, but a different and more specific credential.

Pensieve Labs is not on it as at 01 August 2026.

---

#6. The national collaboration services

Integration with the national collaboration services is a mandatory requirement class in Norwegian patient record procurement, with a regulatory hook behind it.

---

#7. The per-customer step that belongs in the onboarding runbook

A Norwegian health undertaking delegates rights to its record-system supplier through the national business portal, so that Pensieve Labs can act on the hospital's behalf in the identity service.

That is a per-customer task on the critical path to go-live, performed by the hospital's authorised signatory, not by Pensieve Labs. It must appear in the onboarding runbook as a named customer task with an owner and a service level, because a delegation that nobody chased is a go-live delayed by a week for a five-minute action.

RBK-GL-001 carries it; CHK-NO-001 Section G verifies it.

---

#8. The boundary, stated affirmatively

Edsol Edtech Pvt. Ltd. does not become a Norwegian health-sector participant in its own name, does not hold the hospital's national-service entitlements, and does not represent that it does.

Pensieve Labs calls the national services as the hospital, on the hospital's own authority. DIS-GL-024 states the integration boundary and DIS-GL-025 the credential custody, rotation, revocation and offboarding model. It is the same doctrine Pensieve Labs applies to every national digital health scheme, stated as a deliberate architectural position rather than as an apology.

DM-2 note. A shared platform reaching national services for several hospitals must demonstrate per-tenant credential isolation in writing before it touches those services. The questions and answers are the same as in the Danish pack; DIS-GL-032 and DIS-GL-025 are the evidence. DM-1 is the recommendation and it is also the fastest.

---

#9. What a Norwegian hospital can do before these gates are cleared

This section exists because the honest answer is not "nothing", and a hospital deserves to know exactly where the line falls.

But be careful with this table in a Norwegian sales conversation. Unlike Denmark, where the national gate blocks clinical scope and a phased operating-substrate deployment is genuinely viable, a Norwegian hospital's registry reporting duty is statutory, and a production hospital cannot operate indefinitely without it. The Norwegian phased offer is therefore narrower and shorter than the Danish one, and Pensieve Labs should not oversell it.

---

#10. Current status: the honest table

---

#11. Limitations

11.1 The supplier terms have not been read in full. Any Norwegian timeline built before they are read is provisional. This is the single highest-priority Norwegian action.

11.2 The code review has no published service level. The 10 to 45 day figure is an estimate drawn from the research and is [ESTIMATE]. It may not be quoted to a customer.

11.3 Per-service approval durations vary widely and depend on the service and on the health network undertaking's own capacity.

11.4 The welfare-technology hub roadmap is unresolved. [VERIFY] before allocating engineering. The current recommendation is to allocate none.

11.5 This statement claims no approval. Every row of Section 10 that says "no" means no.

---

#12. Related documents

---

#13. Signature

---

#14. Change history