October 25, 2023
One significant development in the health sector in Indonesia is the use of information technology and communication in the implementation of health efforts—particularly digital health services such as telehealth and telemedicine integrated into the country’s National Health Information System.
This development was addressed in a major new piece of legislation for the healthcare sector in Indonesia. Enacted in August 2023, Law No. 17 of 2023 concerning Health (the “Health Law”) provides the updates needed to support the development of healthcare services in Indonesia.
Under the Health Law, health information system (HIS) providers must:
Carry out processing of data and health information in the territory of Indonesia, except for certain limited and specific processing activities that may be conducted outside Indonesia when permitted by the relevant authorities and in compliance with relevant regulations.
Ensure the reliability of its HIS, including availability, security, maintenance, and integration with Indonesia’s National Health Information System.
Provide quality health data and information.
Process data and health information, which includes planning, collection, storage, inspection, transfer, utilization, and destruction.
Record its data- and information-processing history.
Protect every person’s data and health information.
Obtain approval from the relevant personal data subject or comply with relevant regulations if the processing of data and health information involves an individual’s health data.
Inform the data owner if there is a failure to protect data and individual health information.
The Health Law’s personal data protection requirements listed above appear to be aligned with the provisions in Law No. 27 of 2022 concerning Personal Data Protection (the “PDP Law”). Under this law, data and information relating to health are identified as “specific personal data,” the processing of which carries a high potential risk of impacting the relevant personal data subject.
In the implementation of digital health services, patients’ personal data or medical records must be generated by a health service facility. Health service facilities are