China Issues Data Protection Measures for the Healthcare and Medical Industry

Further, the Measures emphasize that the leaders of healthcare institutions should take accountability of the security of HM Data. Failure to comply with those requirements may expose entities and responsible individuals to disciplinary actions and other legal liabilities.

In light of this new rule, Chinese healthcare institutions are expected to become more and more reluctant to share HM Data with third parties for data research and development, or other cooperation projects unless there are compelling reasons to do so, and sufficient security protection measures have been put in place.

Healthcare institutions maintaining HM Data as CII operators

The Measures explicitly mention that the security administration of HM data involves national strategy security. Further, Article 19 of the Measures requires upgrading security protection capability on the critical information infrastructure (CII) and critical information systems, which implies that Chinese healthcare institutions maintaining HM Data are viewed as possessing CII for HM Data.

This is consistent with the draft Regulations on the Protection of the Security of Critical Information Infrastructure (关键信息基础设施安全保护条例), published on July 10, 2017 which provides that an entity providing healthcare and medical services shall constitute as a CII operator.

Security assessment for cross-border transfer of HM Data

According to the Measures, HM Data should be stored on a secured and reliable server within China and can only be transferred overseas with sufficient business justifications, subject to the security assessment in accordance with applicable laws and regulations. The Measures sends out a clear signal that HM Data are likely to be viewed as important data from a cybersecurity perspective and NHC is taking a position generally in line with the Cyberspace Administration of China.

Article 37 of the PRC Cybersecurity Law (CSL) requires CII operators to store locally the personal information and important data collected and generated during the operation within the territory of China. If such data has to be transferred outside China due to business needs, it shall be subject to the security assessment conducted in accordance with relevant measures, unless otherwise provided by laws and regulations.

The draft Information Security Technology – Guidance on Security Assessment on Cross-border Data Transfer (信息安全技术 – 数据出境安全评估指南), published on August 30, 2017 which provides detailed guidance in relation to cross-border transfer of data categorizes healthcare information as important data that is subject to security assessment prior to a cross-border transfer. In particular, such healthcare information includes personal electronic medical records, health records and other medical and health data kept by medical institutions and health management service providers.

HM Data protection standard management

The Measures only provide general principles on HM Data protection. Nonetheless, it calls for building up a HM Data standard management system. NHC together with its local counterparts will take lead in planning and preparing the HM Data protection standards and supervise implementation of those standards. Healthcare institutions, research institutions, enterprise, and trade associations are expected to participate in preparing the HM Data protection standards.

WHAT BUSINESS OPERATORS IN HEALTHCARE SECTOR NEED TO CONSIDER?

The Measures clarifies that HM Data will be treated as important data and HM Data operators are likely to be viewed as CII operators under the CSL.

Business operators intending to access HM Data through cooperation with healthcare institutions should be mindful about the strengthened protection extended to HM Data, in particular the local data residency requirements as well as the security assessment for cross-border transfer of important data.

For business operators who wish to provide data processing services to Chinese healthcare institutions, it is important to understand the relevant qualification and capability requirements, as well as the scope of work under the relevant processing agreements.

Separately, since the CSL implementing rules and guidelines with regards to local residency requirements and cross-border data transfer have not been finalized and issued, business operators in the healthcare industry should closely monitor the regulatory development in this area and start formulating plans to comply with various data security requirements as soon as possible.

Last but not least, business operators may consider participating or contributing to the preparation of the HM Data protection standards under the leadership of NHC and its local counterparts.