Jurisdiction - China
Reports and Analysis
China – Protection Of Personal Information.

31 July, 2014

 

Legal News & Analysis – Asia Pacific – China – Regulatory & Compliance

 

NHFPC Promulgated Administrative Measures for Population Health Information (for Trial Implementation)

 

The Administrative Measures for Population Health Information (for Trial Implementation) (the Administrative Measures”) was issued by the National Health and Family Planning Commission (“NHFPC”) on May 5, 2014 and took effect on the same day. This is the first time the Chinese government has proposed a distinguished and unified framework for the administration and protection of population health information. Compared with the draft circulated for comments in November last year which contains seven chapters and 48 clauses, the Administrative Measures is simplified into 23 clauses and with no division of chapter with more general requirements. 


Definition 


Population Health Information is defined under the Administrative Measures as “the basic demographic information, medical and health care services information and other population health information generated by medical, health care and family planning services agencies of all types and at all levels during the processes of providing services and carrying out management pursuant to State laws and regulations, and according to their work responsibilities”. The Administrative Measure also provides that digital form of population health information created pursuant to law has the same legal effect with the population health information in hardcopy. 


Requirements For Responsible Entities 


Medical, health care and family planning services agencies of all types and at all levels (the Responsible Entities”) that responsible for the collection, utilization, management and protection of population health information are required to:

 

  • Internal control: set up a separate department for management of population health information with corresponding job responsibilities designed, and establish a sound quality control system. 
  • Collection: comply with the principle of “a piece of information must correspond to a unique source” and minimize information to be collected to the extent necessary. 
  • Storage: use a classified storage method, establish a reliable backup system and to achieve long-term data storage and archival management of historical data.
  • Renewal: ensure up-to-date, continuous and valid information with timely update. 
  • Access: provide information inquiry and copying services. 
  • Usage: establish a trace management system, and apply stringent real-name identity authentication and authorization control.

Requirements For Agencies And Service Providers 


An agency entrusted with storage, operation and maintenance functions are required to provide proper technical support for population health information management in accordance with the relevant entrustment agreement, and are prohibited from collecting, developing and using population health information beyond its authority. 


Providers of information technology products and services for systems related to population health information are mainly required to: (a) follow the State information security review system; (b) not to discontinue or otherwise interrupt reasonable technical support and services; and (c) make available secure and convenient conditions for the migration, interaction and sharing of population health information across different systems. 


Special Requirements For Information Transfer 


It is notable that the Administrative Measures specifically prohibits a Responsible Entity from storage of any population health information in overseas servers or hosting or renting overseas servers. 


Our Observation 


The Administrative Measures took the first step in the protection of population health information, a sensitive type of information. We would envisage that many specific and tricky issues are still remaining to be resolved and tested in practice.

 

Jun He 4

 

For further information, please contact:

 

Marissa (Xiao) Dong, Partner, Jun He

dongx@junhe.com


Lena (Qiong) Yuan, Jun He

yuanq@junhe.com 

 

Homegrown Regulatory & Compliance Law Firms in China

 

Comments are closed.