REPORT BY THE BOARD OF DIRECTORS
| SUSTAINABILITY STATEMENT
84
and other stakeholders, creates systematic structures and a measure-
ment culture to support the management, development and monitor-
ing of quality and efficacy to ensure safe and effective care for every-
one. Pihlajalinna’s quality management is based on comprehensive
self-monitoring, external quality assurance and comprehensive moni-
toring by the authorities. The realisation and development of patient
safety is evaluated by measuring, for example, deviations, infection
rates, patient injury notifications and the decisions of the Patient In-
A service provider such as Pihlajalinna must prepare a self-monitoring
programme for the tasks and services for which it is responsible. Read
more in section S4-1: Management of material topics and policies.
Pihlajalinna’s positive impact on customers and end-users is strong,
and it materialises through the health benefits produced for custom-
ers, the effects of which are also visible to society, for example, in the
reduction of the need for expensive specialised care or for employers,
for example, in the avoidance of early retirement. Patient safety
(physical patient safety) and data protection are strong and therefore
also material opportunities, the impact of which is reflected in Pihla-
jalinna’s reputational benefits, among other things. These topics are
regularly assessed in connection with the risk survey, for example.
Equal treatment of customers, privacy, data protection and infor-
mation security, access to high-quality information, health and safety,
non-discrimination, availability of products and services and responsi-
ble marketing have positive impacts. In cooperation with its person-
nel, Pihlajalinna produces and distributes information on social and
healthcare themes that are relevant to society. These measures sup-
port the access of consumers and end-users to high-quality up-to-
Pihlajalinna has extensive experience in the development and imple-
mentation of impact-based healthcare concepts. Pihlajalinna Syd-
änkaista is an example of effective care that achieves treatment
goals, reduces healthcare costs and morbidity and improves the pa-
tient’s quality of life. Pihlajalinna Sydänkaista carried out a pilot fol-
low-up period in the wellbeing services county of Southwest Finland
in 2023–2024. In addition to the key clinical metrics, the pilot vali-
dated, among other things, the degree of patient engagement and
Negative impacts
The material negative impacts on consumers and end-users are re-
lated to maintaining customers' patient safety and data protection.
The most significant risks are cyber attacks on infrastructure or hard-
ware and the resulting reputational damage and potential liability for
damages. Pihlajalinna defines the most significant information secu-
rity and data protection incidents as follows: Has an impact as a likely
negative risk of losing a strategically significant account or long-term
loss of several customers. In addition, there is a significant loss of per-
sonnel and significant difficulty in recruiting additional staff in the
long term. The aim is that no significant incidents occur annually that
would lead to financial or other losses.
Pihlajalinna takes account of the continuously increasing information
security requirements that come with the development of digital ser-
vices. Pihlajalinna strengthens its information security by applying up-
to-date and secure methods, such as strong authentication practices,
external monitoring and continuous testing. In addition, Pihlajalinna
invests in monitoring and preventive activities through vulnerability
management, for example. Pihlajalinna has adopted a cyber security
development plan that guides the development of information secu-
rity and the monitoring of the targets set for information security in
the coming years. During 2024, Pihlajalinna implemented several sig-
nificant measures to improve information security. These measures
include the restructuring of the organisation, strengthening the infor-
mation security team with new experts and roles. In addition, re-
sources were increased to better respond to growing information se-
curity challenges and ensure rapid response to potential threats. In
2024, a new disaster recovery system was also procured to improve
the organisation’s preparedness for exceptional situations. In addi-
tion, development measures in vulnerability management and the au-
tomation of response to incidents have improved the organisation’s
ability to detect and handle threats quickly and efficiently.
Pihlajalinna has mandatory information security and protection train-
ing for all personnel, including practitioners. In addition, Pihlajalinna
organises topical targeted training for its personnel. Such training was
organised several dozen times during 2024. In addition, training ses-
sions have been held for regional management teams, the HR man-
agement team and the finance department, among others.
Pihlajalinna uses an SOC service provider that monitors and analyses
information security incidents and escalates critical incidents if neces-
sary. Every month, the SOC assesses thousands of information secu-
rity incidents, some of which have been escalated to Pihlajalinna’s
own information security team for further investigation. Incidents are
classified according to criticality. Pihlajalinna’s target for data protec-
tion is zero successful attempts to gain unauthorised access. This tar-
get was achieved in 2024. Customers can report suspected data pro-
tection or information security incidents through feedback systems or
directly to the personnel. All of Pihlajalinna’s operating locations have
a reporting system for the personnel to report any observed data pro-
tection or IT security deviations. The Group has defined procedures
and tools for detecting information security deviations. Additionally,
action plans are in place for exceptional situations.
Each information
security deviation is recorded and processed for further action. The
incident management process is reviewed and updated regularly. It is
of primary importance to Pihlajalinna that customers and end-users
are provided with clear privacy notices and information on how confi-
dential data is processed, and that they have the right to control their
own data. More information on information security and data protec-
tion measures is available in section S4-1: Management of material
Risks and opportunities
There are significant financial risks related to customers’ privacy, data
protection and information security. The most significant risks are
cyber attacks on infrastructure or hardware and the resulting reputa-
tional damage and potential liability for damages. Pihlajalinna has en-
hanced cooperation between the data protection and information se-
curity teams by establishing a cross-functional cooperation group that
meets regularly. Pihlajalinna has a cyber security development plan in
place that guides the development of information security and the
monitoring of the targets set for information security in the coming
years. The risks related to customers’ privacy, data protection
and in-
formation security are managed using the processes and manage-
ment methods related to data protection and information security
In addition, the risk related to consumers’ freedom of expression can
manifest itself as damage to reputation or customer satisfaction.
Non-discrimination of customers, the accessibility of services and re-
sponsible marketing are also at the heart of Pihlajalinna’s operations.
The related reputational benefit and, on the other hand, reputational
damage can pose both significant financial risks and opportunities.
Customer equality can be increased by improving the availability of
services through the provision of remote services, even in areas
where in-person services or the expert in question may not be availa-
ble. The provision of diverse and demand-oriented services and im-
proving their availability are an essential part of the development of
operations. Pihlajalinna Sydänkaista is an example of effective care
and potential reputational benefit. As a provider of social and