On 2020 July 10, the Hospitals Personal Information Security Measures Regulations (醫院個人資料檔案安全維護計畫實施辦法) was enacted (‘the Regulation’) and takes effect on 2021 January 10. The Regulation applies to public and private hospitals that occupy over 100 beds (article 2, 4, 19).
The purpose of the Regulation is to strengthen the protection of personal information by hospitals. Firstly, the Regulation ensures that personal information is stored safety and is recorded accurately. Secondly, the Regulation aims for hospitals to establish mechanisms in regards to:
- the management of personal information,
- the storing of personal information,
- the auditing of personal information management systems, and
- rectification.
The Regulation is made under section 27 of the Personal Data Protection Act (個人資料保護法) (‘the Act’). Under section 27 of the Act, non-government agencies that are in possession of personal data files shall implement proper security measures. Non-government agencies may be required to establish mechanisms:
- to protect and maintain personal information in a secured manner, and
- to address how personal information is disposed when a transaction, sale, or service is completed.
This article proposes to discuss and summarize some of the important articles of the Regulation, which may be of interest to overseas hospitals or companies in the health sector.
1. Article 7
The collection, processing and use of personal information by hospitals must be made within a specific purpose and must be necessary. Hospitals must:
(1) determine the scope of collection, processing and use of personal information.
(2) lay out the categories of personal information collected, processed and used
(3) conduct checks on personal information stored on a regular basis.
When the collection, processing and use of personal information is outside the specific purpose and is not necessary, or that the specific purpose is no longer present, hospitals must delate, destroy, cease to collect, process or use the personal information.
2. Article 9
Hospitals must notify data subjects when they collect personal information. Hospitals must set down rules regulating the method of notification, the content of the notice, and matters that need attention.
3. Article 13
Hospitals must implement safety mechanisms which include but is not limited to the following:
(1) Hard Copy Personal information: hospitals must put in place relevant equipment and implement management procedures to safeguard personal information;
(2) Electronic Personal information: hospitals must equip computers or automatic machines that include security systems or enable encryption to safeguard personal information. Back up systems and management procedures should also be put in place.
(3) Hospitals must establish elimination procedures.
4. Article 15
Hospitals must keep records documenting how personal information is used, including records of automatic systems that process personal information. Records must be kept for a minimum of 6 months.
5. Article 16
After the performance of a transaction, sale or service, hospitals must destroy, transfer, delete, or cease to use and/or process personal information. A record must be kept for a minimum of 5 years. The record must include the time, place, method of deletion, method of transfer and reason of transfer.
Reference:
1. 醫院個人資料檔案安全維護計畫實施辦法總說明,衛生福利部,https://www.mohw.gov.tw/cp-18-54747-1.html(最後瀏覽日:2020/08/27)。
|