Waiting-list website rindapiearsta.lv still offline; health service gives no restoration date

The Latvian website “rindapiearsta.lv”, where residents can check approximate waiting times for state-funded outpatient healthcare services, remains offline. The National Health Service (NVD) told the news agency LETA that it is currently impossible to forecast precisely when the site will be available again, because work to eliminate an identified security vulnerability is continuing.

Working with the site's developers, the service is taking steps to fix a vulnerability in the PHP programming language and to restore the service safely. The site will return once all necessary security measures have been put in place and tested.

Where to find the information

The NVD stresses that alternatives exist. Its own website has a section titled “Information during the interruption of rindapiearsta.lv”, where people can download a report on waiting lists for planned outpatient treatment. It compiles data on waiting times at outpatient care providers. If a service is temporarily unavailable at a particular institution, the table marks it with the letter “N”, while the number “5” means there is no queue or it is shorter than five days. Medical institutions gather and submit the approximate waiting-time data once a month.

With questions, residents can call the NVD Customer Service Centre on the free number 80001234 or write to its email address. The centre is open Monday to Thursday from 8:30 to 17:00 and on Fridays from 8:30 to 15:00. Waiting times and appointments can also be checked with the registry of the medical institution concerned.

Background

Two critical vulnerabilities were found in PHP, a language widely used to build websites, which could allow an unauthenticated attacker to run commands on an affected system. On the evening of 21 October, access to a number of government websites was restricted, including a temporary suspension of the unified website platform that hosts the sites of 165 state institutions and municipalities. Public-sector websites are now almost fully restored. A new vulnerability found on 26 October can only be exploited in very specific circumstances, so no emergency patch is planned, according to Cert.lv, Latvia's IT security incident response institution.