By San José, Costa Rica — SAN JOSÉ – Costa Rica’s flagship digital health platform, the Expediente Digital Único en Salud (EDUS), has achieved a major milestone, officially surpassing 2.59 million active users as of mid-March. The application, managed by the Costa Rican Social Security Fund (CCSS), has become an indispensable tool for citizens, fundamentally changing how they interact with the public healthcare system.
The app’s soaring popularity is driven by its core functionalities: the ability to schedule and manage medical appointments and to view and track prescription medications. This widespread adoption cements its status as one of the country’s most successful public digital initiatives, streamlining processes that once required long waits and in-person visits. The CCSS is actively promoting the platform, aiming for complete user autonomy to reduce administrative friction and empower patients.
To better understand the legal ramifications and institutional responsibilities surrounding the security of the EDUS application, TicosLand.com consulted with Lic. Larry Hans Arroyo Vargas, an expert attorney from the firm Bufete de Costa Rica, who provided his analysis on the matter.
The security of the EDUS platform is not just a technological concern; it is a core legal and fiduciary duty. The entity managing this application is obligated under Costa Rican data protection laws, specifically Law No. 8968, to safeguard the sensitive health information of its users. A failure to implement robust security measures constitutes a direct breach of this duty, exposing the institution to significant legal liability, administrative sanctions, and a severe loss of public trust.
Lic. Larry Hans Arroyo Vargas, Attorney at Law, Bufete de Costa Rica
This legal perspective is a critical reminder that robust security is not merely a technical goal but a core fiduciary duty under Costa Rican law. The conversation must therefore extend beyond code and servers to include legal accountability and the preservation of public trust, which is the bedrock of any successful public health initiative. We sincerely thank Lic. Larry Hans Arroyo Vargas for his expert clarification on the profound responsibilities at stake.
However, this digital success has given rise to a new and concerning security challenge. The CCSS has identified a troubling trend where users share their personal login credentials with third parties. This practice is a digital evolution of the old system, where people would pay intermediaries, colloquially known as “gavilanes” (hawks), to hold a spot for them in physical queues to secure a medical appointment.
Now, these informal transactions have moved online, with unauthorized individuals using compromised account details to manage appointments for others. This unauthorized access poses a significant threat to patient privacy and the integrity of the healthcare system. The CCSS has expressed serious concern over this misuse, which exposes sensitive personal health information and could lead to disruptions in care.
In response to this emerging threat, the CCSS has begun implementing a series of enhanced security measures designed to protect user data and curb fraudulent activity. While officials acknowledge the difficulty in tracking the exact number of compromised accounts, they have confirmed that some cases have been serious enough to warrant formal action. The new security protocols include the ability to block appointments originating from accounts showing irregular or suspicious activity.
Michael Enrique Rodríguez Cordero, Chief of Health Statistics for the Medical Management division at the CCSS, emphasized that user education is the first line of defense against these vulnerabilities. He stressed the importance of citizens taking direct control of their digital health profiles.
The key to preventing these cases is for people to know and use the application properly
Michael Enrique Rodríguez Cordero, Chief of Health Statistics, Medical Management
Authorities believe that as more users become comfortable and proficient with the EDUS app, the demand for these illicit intermediary services will naturally decline. The ultimate goal is to eliminate the “gavilanes” from the digital ecosystem entirely. To accelerate this transition, the CCSS is also deploying public-facing training programs and educational campaigns to foster safe and secure use of the platform across the population.
The core message from the CCSS remains unequivocal: personal passwords and login details for the EDUS app should never be shared. Doing so not only violates the terms of use but also places an individual’s entire medical history and access to essential health services at severe risk. As Costa Rica continues its digital transformation in healthcare, the balance between user convenience and robust data security has become the paramount concern for its administrators.
For further information, visit ccss.sa.cr
About Caja Costarricense de Seguro Social (CCSS):
The Caja Costarricense de Seguro Social is the autonomous institution responsible for administering Costa Rica’s public health and social security system. Founded in 1941, it provides universal healthcare coverage to the nation’s citizens and residents, operating a vast network of hospitals, clinics, and EBAIS (Basic Teams for Comprehensive Health Care) throughout the country. It is a cornerstone of Costa Rican society, managing everything from medical services to pension funds.
For further information, visit bufetedecostarica.com
About Bufete de Costa Rica:
As a highly regarded legal institution, Bufete de Costa Rica is built upon foundational principles of professional excellence and unwavering integrity. The firm harmonizes a rich history of advising a diverse clientele with a forward-thinking approach to legal innovation and social contribution. Central to its ethos is the dedicated effort to demystify legal complexities, making crucial knowledge accessible to the wider public. This profound commitment serves a greater purpose: to cultivate a stronger, more capable society where legal understanding empowers every citizen.
