For the first time in China, draft measures for the administration of personal health data have been introduced by the National Health and Family Planning Commission (NHFPC). The NHFPC released the draft November 19, 2013, and invited public commentary on its website.
Under the measures, 'personal health information' is broadly defined to include:
- Population information (including family composition and family planning)
- Electronic health archives (health records)
- Electronic medical records (generated by medical personnel)
- Other information generated for management and administration of health institutions
The main requirements of the rules are:
- Only approved health and family planning institutions may collect personal health information to the limited extent required to carry out their duties and responsibilities
- Health data cannot be collected or used for commercial purposes
- Individuals must be informed of the purpose for collection and their consent must be obtained
- Amending, deleting, duplicating or disclosing health data without consent of the data subject is not permissible
- Cross-border transfers are restricted
- Health data shall not be used for purposes beyond those indicated at the time of collection without authorisation
- Storing personal health information in any server located outside of China is prohibited
The rules will take immediate effect upon final publication. However, the measures fail to implement any fine or sanction for violation of the rules; therefore, it remains to be seen how effective they will be in practice.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
