Exchange of information containing personal data?

Question

VPN

Hello. I work for an insurance company. Employees of the VHI interact with doctors from polyclinics - they exchange passport data and medical data simply by e-mail. This, to put it mildly, is not very correct.
We want to make a connection like our ftp server via vpn, where we would share the necessary information with each other. But the question is how much such a method will comply with 152-FZ and the FSB Order on ensuring security measures when processing PD? Anyone versed in this topic?

Answer 1

Instead of building a certified VPN on your own and carrying out appropriate organizational measures, you can order a similar service from a provider.
For example, at Rostelecom in Nizhny Novgorod, such a service at a speed of 1 Mbps costs 2,000 rubles per month. The solution is built on GOST VPN on FSB-certified equipment.
1 Mbit / s is not enough when you download a movie, but it is enough to transfer documents and scans. There are options for more speed, ask providers.
Thus, you do not need to maintain documentation for working with CIPF, you do not need to track the renewal of certification and other ensuing from the competent use of CIPF.
Recommend.

Answer 2

Here the question, as I understand it, is not only in the 152nd. There is still likely a medical secret, I do not understand this specificity.
You offer an option that is definitely better and more correct, however, from the point of view of the Federal Law, it still will not comply, because the IP is not certified.
In general, you need to do this:
1. Choose a certified solution for raising VPN
2. Document, describe
... and then the question is already in charge. According to 152FZ, the Order of the FSB, and the Instructions of the FSTEC, you must have a person responsible for personal data. If anything to rake him and this is not a joke.