Personal data protection in healthcare: hospitals, clinics, pharmacies and MedTech apps
Data protection in healthcare is stricter than in other industries. Almost everything a healthcare provider does involves health data, a sensitive category of personal data under Decree 356/2025/ND-CP. Hospitals, clinics, pharmacies and MedTech apps therefore cannot use the DPIA and DPO relief for small businesses, and must also comply with Article 26 of Law No. 91/2025/QH15 and the medical confidentiality rules of the Law on Medical Examination and Treatment.
Personal Data Protection Law No. 91/2025/QH15 (Article 26); Decree 356/2025/ND-CP; Decree 330/2026/ND-CP; Law on Medical Examination and Treatment No. 15/2023/QH15 (Articles 10, 45, 69); Circular 13/2025/TT-BYT; Circular 33/2025/TT-BYT
Official legal texts
- Law 91/2025/QH15 — Government e-portal (official Vietnamese text)
- Decree 356/2025/ND-CP — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Circular 33/2025/TT-BYT on retention periods for health sector records — Government e-portal (official Vietnamese text)
Key takeaways on data protection in healthcare
- The first rule of data protection in healthcare is patient consent. A healthcare provider processing health data must have the patient's consent throughout collection and processing, except in the cases under Clause 1, Article 19 of Law 91/2025/QH15, such as emergencies to protect life and health (Point a, Clause 1, Article 26).
- Personal data must not be provided to third parties that are healthcare providers or health or life insurers, unless the patient asks in writing or a case under Clause 1, Article 19 applies (Clause 2, Article 26).
- Because they directly process sensitive data, healthcare businesses cannot use the DPIA and DPO relief for small businesses, start-ups and household businesses (Clauses 2 and 3, Article 38 of Law 91/2025/QH15): they must file a DPIA dossier with the A05 Department within 60 days and designate a data protection function or hire a service provider.
Personal data processed in healthcare
| Data group | Examples | Classification |
|---|---|---|
| Patient administrative details | Name, date of birth, phone number, address, health insurance number | Basic |
| Health data | Medical records, diagnoses, test results, imaging, prescriptions, vaccination history | Sensitive |
| Genetic and biometric data | Genome sequencing results, DNA tests, fingerprints or faces used to identify patients | Sensitive |
| Private life and sex life | Reproductive health, sexually transmitted infections, psychological counselling | Sensitive |
| Citizen ID card images, e-identity accounts | ID card photos taken at registration, log-in with the national e-identity app | Sensitive |
| Location data | Location of patients or staff in home visit and home sample collection apps | Sensitive |
Classified under the lists in Articles 3 and 4 of Decree 356/2025/ND-CP. The same information may be classified differently depending on the context of processing.
1. Who must comply with data protection in healthcare?
Data protection in healthcare applies to every organisation processing health data in Vietnam. All of them are subject to Article 26 of Personal Data Protection Law No. 91/2025/QH15, whether public, private or foreign-invested:
- Hospitals and general or specialist clinics: medical records, diagnostic results, health insurance billing data.
- Laboratories, imaging centres, genetic testing providers: specimens linked to identity, genetic data, results sent to partners abroad for analysis.
- Pharmacy chains: prescriptions, purchase history, loyalty programmes.
- MedTech, telemedicine and booking apps: user accounts, recorded consultations, wearable data, location for home visits.
- Aesthetic clinics, dental clinics, wellness centres: before-and-after photos, medical history.
The biggest difference from other industries is that health data is sensitive under Article 4 of Decree 356/2025/ND-CP. Even a small clinic therefore cannot opt out of the DPIA dossier or the data protection function, because the relief excludes organisations that directly process sensitive data (Clauses 2 and 3, Article 38 of Law 91/2025/QH15).
2. Article 26: four specific rules for health data
Article 26 of Law 91/2025/QH15 adds specific rules on top of the general ones:
- Consent throughout collection and processing of health data, except in the cases under Clause 1, Article 19, such as emergencies to protect life or health, or where the law requires it (Point a, Clause 1).
- No disclosure to third parties that are healthcare providers or health or life insurers, unless the patient asks in writing or a case under Clause 1, Article 19 applies (Clause 2).
- Health apps must fully comply with data protection rules from the development stage (Clause 3).
- Reinsurance involving data transfers to partners must be stated clearly in the contract with the customer (Clause 4), which applies to insurance businesses (see data protection in insurance in Vietnam).
3. Sector rules: medical records confidentiality and patient data protection
Healthcare providers must comply with Law 91/2025/QH15 and the sector rules below at the same time. Under Clause 2, Article 5 of Law 91, specific data protection rules in laws passed before 1 January 2026, such as the Law on Medical Examination and Treatment, still apply as long as they do not conflict with the principles of Law 91.
- Patients' right to confidentiality: patients are entitled to confidentiality of the information in their medical records and of private information given to practitioners, unless they agree to share it or a case under Clauses 3 and 4 of Article 69 applies (Clause 2, Article 10 of the Law on Medical Examination and Treatment No. 15/2023/QH15). Practitioners must keep patients' conditions and records confidential (Clause 5, Article 45).
- Who may access medical records: Article 69 lists who may read or copy records, such as trainees and practitioners (with the facility's consent) and investigators, prosecutors, courts and inspectors. Patients or their representatives may read, view and copy their records and receive a summary on written request. Anyone using record information must keep it confidential and use it only for its purpose (Clause 5, Article 69).
- Electronic medical records: electronic records have the same legal value as paper records (Clause 1, Article 69). Under Circular 13/2025/TT-BYT, hospitals had to implement electronic medical records by 30 September 2025, and other healthcare facilities must do so by 31 December 2026. The Circular also requires compliance with personal data protection law.
- Retention periods: Circular 33/2025/TT-BYT requires inpatient and outpatient records to be kept for 10 years; psychiatric, occupational accident, traffic accident, tissue and organ transplant and cosmetic surgery records for 20 years; and records of deaths for 30 years, whether on paper or electronic.
A mandatory retention period is a legitimate reason not to delete medical records when a patient asks (Point c, Clause 1 and Clause 5, Article 14 of Law 91/2025/QH15). The provider must then tell the patient why, and should delete data outside the medical record, such as marketing data and app accounts.
4. Five common risks for data protection in healthcare
The five risks below are the situations LexData meets most often when advising on data protection in healthcare. Each comes with its legal basis and the fine that applies.
Sharing patient information in messaging apps
Messaging apps are a weak point for patient data protection. Doctors posting X-rays or lab results in a ward chat group for a case discussion is common. The data sits on personal phones with no access control or audit log, and can be forwarded outside. Providers should offer a controlled channel for case discussions within their systems, and clearly ban sending patient data through personal apps.
Sending results to insurers or employers
Corporate health checks and life insurance medicals both involve a third party wanting the results. For health and life insurers, Clause 2, Article 26 prohibits disclosure without the examined person's written request. For employers booking check-ups for staff, the provider still needs a legal basis (such as the employee's consent) before sending detailed results.
Marketing based on medical conditions
Reminding patients about follow-up visits is patient care. Using diagnoses to promote service packages or supplements is processing health data for advertising, which needs separate consent under Articles 9 and 28 of Law 91/2025/QH15. Consent must be given for each purpose and must not be made a condition for other purposes (Clause 4, Article 9).
Research and AI training on medical records
Using medical records for research or to train diagnostic AI is a new purpose compared with the original treatment purpose. The provider needs consent for it, or must de-identify the data so it is no longer personal data (Clause 1, Article 2), and must not re-identify it (Point b, Clause 6, Article 14). AI processing must also be classified by risk level (Clause 4, Article 30).
Leaks from HIS and EMR systems
Hospital information systems are frequent ransomware targets. A leak of health data can harm patients' honour and dignity, so it must be reported to the A05 Department within 72 hours of discovery (Clause 1, Article 23 of Law 91/2025/QH15). Reporting later than 72 hours is fined VND 40 to 60 million; failing to contain and remedy the breach is fined VND 60 to 80 million (Article 54 of Decree 330/2026/ND-CP).
5. Data protection in healthcare: key obligations and legal bases
The table below summarises the main obligations. Each row is an item your plan for data protection in healthcare should cover.
Obligations table: data protection in healthcare in Vietnam
| Obligation | Legal basis | How it applies in healthcare |
|---|---|---|
| Consent to collect and process health data | Point a, Clause 1, Article 26, Law 91/2025 | Registration forms, in-app booking, telemedicine |
| Tell patients the data is sensitive | Clause 4, Article 6, Decree 356/2025; Article 43, Decree 330/2026 | Processing notice at reception and in the app |
| Keep medical records confidential and limit access | Articles 10, 45, 69, Law on Medical Examination and Treatment 2023 | HIS/EMR access roles, process for providing record copies |
| Keep records for the set period, then delete securely | Circular 33/2025/TT-BYT; Article 14, Law 91/2025 | 10, 20 or 30 years depending on the record, paper and electronic |
| No disclosure to insurers without a written request | Clause 2, Article 26, Law 91/2025 | Insurance medicals, health insurance claims |
| Protect genetic and biometric data | Clause 4, Article 31, Law 91/2025 | Genetic testing, facial identification of patients |
| DPIA dossier filed with A05 within 60 days | Article 21, Clauses 2 and 3 of Article 38, Law 91/2025 | Mandatory even for small clinics, because data is sensitive |
| Designate a data protection function or hire a provider | Clause 2, Article 33, Law 91/2025 | Hospitals, clinic chains, pharmacies, MedTech |
| Cross-border transfer dossier | Article 20, Law 91/2025; Form No. 09, Decree 356/2025 | Cloud, AI diagnostics, overseas partner laboratories |
| Breach notification within 72 hours | Article 23, Law 91/2025; Article 54, Decree 330/2026 | Attacks on HIS/EMR, leaked medical records |
6. Data protection in healthcare for foreign-invested companies
For foreign-invested hospitals and healthcare companies, data protection in healthcare usually gets difficult where data leaves Vietnam. International hospitals, clinic chains and foreign-invested pharmaceutical companies often use group EMR, CRM or data centres abroad, and send specialist tests to overseas laboratories. Each of these flows is a cross-border transfer (Clause 1, Article 20 of Law 91/2025/QH15) needing its own impact assessment dossier. The rule in Clause 2, Article 26 on disclosure to insurers is also much stricter than practice in some countries, so processes for working with international insurers need to be redesigned for Vietnam.
Insight from lawyer Ho Thi Ha Nhi
"Healthcare already has a tradition of patient confidentiality, but data protection in healthcare under Law 91/2025/QH15 asks for more than an ethical commitment: consent you can prove, a DPIA dossier, and control over every partner that touches the data. I recommend providers start with the two highest-risk points: data flows to insurers, and the habit of discussing patients in messaging apps."
Data protection in healthcare: implementation checklist
- Map the data across the whole care pathway: registration, HIS/EMR, LIS, PACS, pharmacy, insurance billing, booking app and call centre.
- Separate processing notices and consent forms for each purpose: treatment, customer care, marketing, research. Do not fold marketing consent into the registration form.
- Protect medical records confidentiality by granting access by role (treating doctor, nurse, cashier, IT), keep access logs and review them regularly.
- Sign data processing agreements (DPAs) with HIS/EMR vendors, reference laboratories, cloud providers, call centres and marketing agencies.
- Prepare a DPIA dossier using Form No. 10 of Decree 356/2025/ND-CP and file it with the A05 Department within 60 days of starting processing; update it when systems or partners change.
- If data sits on platforms or servers abroad (cloud, AI diagnostics, overseas laboratories), also prepare a cross-border transfer dossier using Form No. 09.
- Set up an incident response process: notify the A05 Department within 72 hours where notification is required, and notify patients when biometric data is leaked.
- Train staff on data protection in healthcare, especially on sharing patient information in chat apps and on checking before posting case photos on social media.
FAQ: data protection in healthcare in Vietnam
May a clinic send a patient's test results to an insurance company?
No, unless the patient asks in writing or a case under Clause 1, Article 19 of Law 91/2025/QH15 applies. Clause 2, Article 26 prohibits organisations working in the health sector from providing personal data to health or life insurers. In practice, the clinic should obtain the patient's written request or authorisation (on paper or electronic) and keep it with the file before sending anything.
Does a hospital need consent from an unconscious emergency patient?
No. Point a, Clause 1, Article 19 of Law 91/2025/QH15 allows processing without consent to protect the life or health of the data subject or others in an emergency. The hospital bears the burden of proving this case, so it should record the emergency in the file, and it must set up the oversight mechanism required by Clause 2, Article 19.
Is a small private clinic exempt from the DPIA?
Usually not, and this is a key difference in data protection in healthcare. Law 91/2025/QH15 only lets small businesses, start-ups, household businesses and micro-enterprises opt out of the DPIA and DPO requirements if they do not directly process sensitive data (Clauses 2 and 3, Article 38). Health data is sensitive, so clinics and pharmacies that keep medical records or prescriptions are almost always in scope.
Is it a violation for a doctor to post case photos on Facebook for professional discussion?
The risk is high if viewers could recognise the patient from their face, tattoos, name, bed number or setting. Making personal data public requires the data subject's consent or another basis under Clause 2, Article 16 of Law 91/2025/QH15. The safe approach is separate written consent for posting, or thorough de-identification before posting (masking the face, removing names and identifying details).
If a patient asks a hospital to delete their medical records, must it do so?
Usually not during the mandatory retention period. Circular 33/2025/TT-BYT requires inpatient and outpatient records to be kept for 10 years, and some records for 20 or 30 years. Law 91/2025/QH15 allows deletion when the statutory retention period ends (Point c, Clause 1, Article 14), and where data cannot be deleted for a legitimate reason the patient must be told (Clause 5, Article 14). The hospital should still delete data outside the medical record, such as promotional mailing lists, and stop using the data for other purposes.
Do patients have the right to a copy of their medical records?
Yes. Under Article 69 of the Law on Medical Examination and Treatment No. 15/2023/QH15, patients or their representatives may read, view, copy and take notes of their medical records and receive a summary on written request. This is also part of the right to be provided with personal data under Article 4 of Law 91/2025/QH15; the deadline for meeting a request for data is 10 days under Article 5 of Decree 356/2025/ND-CP.
Does a MedTech app hosted on servers in Singapore need any extra dossier?
Yes. Using a platform outside Vietnam to process data collected in Vietnam is a cross-border transfer of personal data (Point c, Clause 1, Article 20 of Law 91/2025/QH15). The business must prepare a cross-border transfer impact assessment dossier and file it with the A05 Department within 60 days of the first transfer, in addition to the DPIA dossier.
Ho Thi Ha Nhi
Founding Lawyer, LexData Consulting · Ho Chi Minh City Bar Association
The Vietnamese original of this page has been reviewed against the Personal Data Protection Law No. 91/2025/QH15, its implementing decrees and the sector legislation cited. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
