Ordered HSE card from a third party?
Many businesses choose to use external suppliers to order HSE cards. But giving such parties access to order cards on your behalf can have unexpected consequences – for security, privacy and finances.
Risks of sharing login information
If your business has shared your login information, such as BankID details, with a third-party vendor, there could be serious consequences. Some vendors even use fake login pages to collect this information. This allows them to order HSE cards in your name and change critical information, such as your business contact information.
Important: You should never share BankID details with anyone – neither your national ID number, password nor one-time codes.
Authorization gives access to more than just ordering
When a third-party supplier is authorized in the HSE card solution, they not only have the ability to order cards – they can also access personal information about employees and make changes that may affect communication between the Norwegian Labour Inspection Authority and the business.
– We have seen examples of suppliers changing the contact information of the business. This can lead to important information not reaching the recipient, says Bente Merethe Skjetne, section manager at the Norwegian Labour Inspection Authority.
Financial responsibility and hidden costs
If you order HSE cards directly via hmskort.no , each card costs 132.90 kroner + VAT. However, some third-party suppliers charge several hundred kroner extra per card. Even if you use an external party, the business is still financially responsible if payment is not made.
Privacy is the responsibility of the company
When personal data is shared with a third party, you as the employer are responsible for ensuring that it is handled in accordance with the General Data Protection Regulation (GDPR). This requires that a data processing agreement is entered into with the supplier, and that their routines for security and data processing are satisfactory.
How to check who has access to order HSE cards
To ensure that only authorized persons can order HSE cards on behalf of your business, you should do the following:
-
Go to hmskort.no and log in.
-
Select the business you manage.
-
Click on “Business” in the top menu.
-
Go to “Access” in the menu on the left.
-
Remove users who should no longer have access.
-
Click on the user icon in the top menu and select “User Profile” .
-
Please verify that the contact information for the business is correct.
Recommendations for businesses using third-party vendors
-
Make sure you have a written data processing agreement .
-
Never share BankID information – this is personal and should only be used by you.
-
Investigate what security procedures the supplier has for personal data.
-
Ask for a full breakdown of the service , including all costs and what is actually provided.
Using third-party providers can be convenient, but it's important to be aware of the risks. Make sure that both security and privacy are taken care of, and that you have full control over who can represent your business.