Taiwan's Legislature passes law to regulate personal health data

Taipei, Dec. 2 (CNA) The Legislative Yuan passed a law on Tuesday regulating the use of National Health Insurance (NHI) data, granting individuals the right to opt out of having their records used for nonmedical purposes and imposing fines of up to NT$10 million (US$318,183) for unauthorized access.

The law, which establishes a framework for the management of NHI data, aims to strengthen privacy protections while enabling continued use of the data to support healthcare quality, public health, social welfare, academic research and government operations.

Currently, the NHI database -- which includes insurance and medical records of approximately 99.9 percent of insured individuals -- may be accessed by government agencies or research institutions, provided the data is anonymized.

Under the new law, individuals may request that the Ministry of Health and Welfare or the National Health Insurance Administration stop the use of all or part of their NHI records for nonmedical purposes.

However, exceptions apply when authorities are legally obligated to use the data or when necessary to prevent imminent danger to life, health or property. Such use is limited to government agencies, which must clearly specify the purpose, necessity, duration and method of data use.

Individuals will have 30 days from the law's implementation to submit an initial opt-out request. Those who do not will be deemed to have consented to the nonmedical use of their data, although they may still withdraw their consent later.

The law also sets out rules on who may apply to use NHI data, the purposes for which it may be used, and the procedures for reviewing applications.

Unauthorized use of NHI data for nonmedical purposes will carry fines of NT$2 million to NT$10 million, and violators will be barred from submitting new applications for one year. In addition, anyone who steals, alters or otherwise unlawfully tampers with the NHI system or insured individuals' data will face prison terms of one to seven years and fines of up to NT$10 million.

Those who commit such crimes with the intent to threaten national security or disrupt social stability may face up to 10 years in prison and an additional fine of NT$50 million.

The legislation was drafted in response to an August 2022 Constitutional Court ruling that ordered the government to create, within three years, a mechanism giving NHI beneficiaries greater control over the use of their personal data.