{ "name": "Health Record Rights Index", "version": "1.0", "asOf": "2026-10-02", "license": "CC BY 4.0", "creator": "SuperTruth Inc.", "weights": { "access": 20, "control": 20, "privacy": 15, "journey": 15, "commercial": 10, "clinical": 10, "research": 5, "ai": 5 }, "countries": [ { "iso3": "FIN", "name": "Finland", "region": "Europe", "overall": 71, "rank": "1", "likelyRank": "1 to 6", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Finns read a national record in OmaKanta and decide by permit who outside their region sees it, but public bodies cannot yet be fined.", "categories": { "access": { "score": 76, "summary": "OmaKanta shows visit notes, lab and imaging results, vaccinations and prescriptions from public and private care, and 3.3 million people used it in 2025. Records start only when a provider joined Kanta (from 2013), and no app can yet download them.", "sources": [ { "title": "Kantaan tallentuvat tiedot näkyvät OmaKannassa (Kanta.fi)", "url": "https://www.kanta.fi/tiedot-kannassa", "date": "2026-05-21", "publisherClass": "official" }, { "title": "Tilastot (Kanta.fi)", "url": "https://www.kanta.fi/tilastot", "date": "2026-06-10", "publisherClass": "official" }, { "title": "Näin pyydät sinusta tallennettuja tietoja (Kanta.fi)", "url": "https://www.kanta.fi/nain-pyydat-tietojasi", "date": "2026-03-19", "publisherClass": "official" }, { "title": "Kantaan liitetyt hyvinvointisovellukset (Kanta.fi)", "url": "https://www.kanta.fi/kantaan-liitetyt-hyvinvointisovellukset", "date": "2026-01-29", "publisherClass": "official" } ] }, "control": { "score": 74, "summary": "Records leave the region or provider where they were written only if the patient gives a revocable permit, which can be narrowed by visit, register or all data, even in emergencies. OmaKanta shows which units fetched data, but staff names need a log request.", "sources": [ { "title": "Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä 703/2023 (Finlex, säädöskokoelma PDF)", "url": "https://www.finlex.fi/api/media/statute/691372/mainPdf/main.pdf?timestamp=2023-04-13T21%3A00%3A00.000Z", "date": "2023-04-14", "publisherClass": "legal_text" }, { "title": "Potilastietojen luvat ja kiellot (Kanta.fi)", "url": "https://www.kanta.fi/potilastietojen-luvat-ja-kiellot", "date": "2025-11-12", "publisherClass": "official" }, { "title": "Näin tarkistat, missä tietojasi on käsitelty (Kanta.fi)", "url": "https://www.kanta.fi/nain-tarkistat-missa-tietojasi-on-kasitelty", "date": "2026-02-13", "publisherClass": "official" }, { "title": "Näin pyydät sinusta tallennettuja tietoja (Kanta.fi)", "url": "https://www.kanta.fi/nain-pyydat-tietojasi", "date": "2026-03-19", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "GDPR and the Data Protection Act apply, and the ombudsman acts on health cases, but section 24 of the Act bars fines on state and municipal bodies, including the wellbeing counties that hold most records. The government proposed fines for public bodies in April 2026.", "sources": [ { "title": "Tietosuojarikkomuksista määrättävät seuraamusmaksut koskemaan myös julkista sektoria (Valtioneuvosto)", "url": "https://valtioneuvosto.fi/-/1410853/tietosuojarikkomuksista-maarattavat-seuraamusmaksut-koskemaan-myos-julkista-sektoria", "date": "2026-04-09", "publisherClass": "official" }, { "title": "Apulaistietosuojavaltuutettu: hyvinvointialueella puutteita potilastietojen käytön valvonnassa (Tietosuojavaltuutetun toimisto)", "url": "https://tietosuoja.fi/-/apulaistietosuojavaltuutettu-hyvinvointialueella-puutteita-potilastietojen-kayton-valvonnassa", "date": "2026-03-04", "publisherClass": "official" }, { "title": "Hallinto-oikeudelta päätös Yliopiston Apteekille määrätystä seuraamusmaksusta (Tietosuojavaltuutetun toimisto)", "url": "https://tietosuoja.fi/-/hallinto-oikeudelta-paatos-yliopiston-apteekille-maaratysta-seuraamusmaksusta-lakiuudistus-julkisen-sektorin-seuraamusmaksuista-lisaisi-yhdenmukaisuutta", "date": "2026-06-02", "publisherClass": "official" }, { "title": "Kova tuomio vie Vastaamo-hakkeri Aleksanteri Kivimäen takaisin vankilaan (Yle)", "url": "https://yle.fi/a/74-20211792", "date": "2026-02-26", "publisherClass": "news" } ] }, "journey": { "score": 82, "summary": "All public health care, all pharmacies and two thirds of private health firms use Kanta, which stores over two million new documents a day. Health and social care data still cross only locally until March 2027, and the national medication list waits until October 2027.", "sources": [ { "title": "Tilastot (Kanta.fi)", "url": "https://www.kanta.fi/tilastot", "date": "2026-06-10", "publisherClass": "official" }, { "title": "Tietojen luovuttaminen sosiaali- ja terveydenhuollossa (Kanta.fi, ammattilaiset)", "url": "https://www.kanta.fi/ammattilaiset/tietojen-luovuttaminen-ja-valittaminen", "date": "2026-04-21", "publisherClass": "official" }, { "title": "Informationsgången är kärnan i reformen av apoteksverksamheten (Valtioneuvosto)", "url": "https://valtioneuvosto.fi/sv/-/1271139/informationsgangen-ar-karnan-i-reformen-av-apoteksverksamheten?languageId=fi_FI", "date": "2026-02-13", "publisherClass": "official" }, { "title": "Kanta services in 2026: Developing Kanta data to better aid the work of professionals (Kanta.fi)", "url": "https://www.kanta.fi/en/ajankohtaista/kanta-services-in-2026-developing-kanta-data-to-better-aid-the-work-of-professionals", "date": "2026-01-19", "publisherClass": "official" } ] }, "commercial": { "score": 68, "summary": "The Secondary Use Act bans using social and health data for marketing or for pricing individual services such as insurance, and innovation users get only anonymous statistics. But a pharmacy's EUR 1.1 million fine for sending data to Google and Meta was annulled in 2026.", "sources": [ { "title": "Lainsäädäntö (Findata)", "url": "https://findata.fi/palvelut-ja-ohjeet/lainsaadanto/", "date": "2026-09-01", "publisherClass": "official" }, { "title": "Oikeudet tietoihisi (Findata)", "url": "https://findata.fi/tietoa-findatasta/oikeudet-tietoihisi/", "date": "2026-09-18", "publisherClass": "official" }, { "title": "Vuosikatsaus 2025 (Findata)", "url": "https://findata.fi/tietoa-findatasta/vuosikatsaus-2025/", "date": "2026-03-17", "publisherClass": "official" }, { "title": "Hallinto-oikeudelta päätös Yliopiston Apteekille määrätystä seuraamusmaksusta (Tietosuojavaltuutetun toimisto)", "url": "https://tietosuoja.fi/-/hallinto-oikeudelta-paatos-yliopiston-apteekille-maaratysta-seuraamusmaksusta-lakiuudistus-julkisen-sektorin-seuraamusmaksuista-lisaisi-yhdenmukaisuutta", "date": "2026-06-02", "publisherClass": "official" } ] }, "clinical": { "score": 76, "summary": "Clinicians see all records inside their own wellbeing county or provider, and records from elsewhere through Kanta when the patient has given a permit. An emergency rule allows access to an unconscious patient's records unless the patient has forbidden it.", "sources": [ { "title": "Laki sosiaali- ja terveydenhuollon asiakastietojen käsittelystä 703/2023 (Finlex, säädöskokoelma PDF)", "url": "https://www.finlex.fi/api/media/statute/691372/mainPdf/main.pdf?timestamp=2023-04-13T21%3A00%3A00.000Z", "date": "2023-04-14", "publisherClass": "legal_text" }, { "title": "Potilastietojen luvat ja kiellot (Kanta.fi)", "url": "https://www.kanta.fi/potilastietojen-luvat-ja-kiellot", "date": "2025-11-12", "publisherClass": "official" }, { "title": "Reseptitietojen luvat ja kiellot (Kanta.fi)", "url": "https://www.kanta.fi/reseptitietojen-luvat-ja-kiellot", "date": "undated", "publisherClass": "official" }, { "title": "Tietojen luovuttaminen sosiaali- ja terveydenhuollossa (Kanta.fi, ammattilaiset)", "url": "https://www.kanta.fi/ammattilaiset/tietojen-luovuttaminen-ja-valittaminen", "date": "2026-04-21", "publisherClass": "official" } ] }, "research": { "score": 58, "summary": "Findata grants time-limited permits to pseudonymised data in a secure environment, under an opt-out model with no individual consent. The opt-out is fragmented, so the score sits low in its band: each controller must be asked separately, and Findata received 181 objections in 2025.", "sources": [ { "title": "Lainsäädäntö (Findata)", "url": "https://findata.fi/palvelut-ja-ohjeet/lainsaadanto/", "date": "2026-09-01", "publisherClass": "official" }, { "title": "Vuosikatsaus 2025 (Findata)", "url": "https://findata.fi/tietoa-findatasta/vuosikatsaus-2025/", "date": "2026-03-17", "publisherClass": "official" }, { "title": "Tietojen käyttö tutkimuksessa (Kanta.fi)", "url": "https://www.kanta.fi/tietojen-kaytto-tutkimuksessa", "date": "2026-05-25", "publisherClass": "official" }, { "title": "Findata supports many of the solutions proposed for the national implementation of the EHDS (Findata)", "url": "https://findata.fi/en/news/findata-supports-many-of-the-solutions-proposed-for-the-national-implementation-of-the-ehds/", "date": "2026-08-14", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI is governed by EU device law and the AI Act, whose duties for AI in medical devices now start 2 August 2028. Finland's 2025 law only names supervisors, with Fimea for medical devices, and adds no clinical AI rules.", "sources": [ { "title": "Tekoälyn käyttö lääkinnällisissä laitteissa (Fimea)", "url": "https://fimea.fi/laakinnalliset_laitteet/tekoalyn-kaytto-laakinnallisissa-laitteissa", "date": "undated", "publisherClass": "official" }, { "title": "Uudet säännöt vahvistavat luottamusta tekoälyyn Euroopassa (Traficom)", "url": "https://traficom.fi/fi/uutiset/uudet-saannot-vahvistavat-luottamusta-tekoalyyn-euroopassa", "date": "2026-01-07", "publisherClass": "official" }, { "title": "Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025 (Finlex)", "url": "https://www.finlex.fi/fi/lainsaadanto/saadoskokoelma/2025/1377", "date": "2025", "publisherClass": "legal_text" }, { "title": "Digital Omnibus on AI has been published (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023)", "level": "National", "year": "2023", "what": "Runs Kanta and OmaKanta: disclosure permits, targeted denials, emergency access and logging.", "url": "https://www.finlex.fi/api/media/statute/691372/mainPdf/main.pdf?timestamp=2023-04-13T21%3A00%3A00.000Z" }, { "name": "Act on the Secondary Use of Health and Social Data (552/2019), amended by 1159/2025", "level": "National", "year": "2019", "what": "Permit-based secondary use with GDPR opt-out; bans marketing and insurance pricing uses.", "url": "https://www.finlex.fi/fi/lainsaadanto/2019/552" }, { "name": "Data Protection Act (1050/2018)", "level": "National", "year": "2018", "what": "Supplements GDPR; section 24 bars administrative fines on state and municipal bodies.", "url": "https://www.finlex.fi/fi/lainsaadanto/2018/1050" }, { "name": "Act on the Supervision of Certain AI Systems (1377/2025)", "level": "National", "year": "2025", "what": "Names AI Act supervisors from 2026, with Fimea for medical devices.", "url": "https://www.finlex.fi/fi/lainsaadanto/saadoskokoelma/2025/1377" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "In force March 2025; secondary-use rules apply from March 2029.", "url": "https://findata.fi/faq/mika-on-toisiolaki/" }, { "name": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)", "level": "Supranational", "year": "2026", "what": "Moves AI Act high-risk duties for AI in medical devices to 2 August 2028.", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-02-10", "headline": "Provider said its system could not show who opened a patient's record and when", "paraphrase": "A patient asked a health provider for log data showing who had viewed their records over two years, with times and reasons. The provider said its system could not produce usable logs. The deputy ombudsman ordered it to supply them.", "source": "Tietosuojavaltuutettu (Office of the Data Protection Ombudsman), decision TSV/1507/2024", "url": "https://www.edilex.fi/tsv/20252464", "theme": "access_refused", "status": "finding" }, { "date": "2026-07-13", "headline": "Sentence final for hacker who published about 33,000 people's patient records", "paraphrase": "An attacker broke into a private health provider's system, downloaded its patient database and published the data of about 33,000 people online. The Supreme Court refused his appeal, so the appeal court's sentence of six years and 11 months stands.", "source": "Yle", "url": "https://yle.fi/a/74-20236144", "theme": "breach", "status": "finding" }, { "date": "2025-09-24", "headline": "Patient's log request revealed two staff had viewed about 150 people's records", "paraphrase": "A patient obtained the log of who had opened their record and reported it to police. The wellbeing region found two employees had viewed nearly 150 people's records without a care relationship, and its chief medical officer apologised.", "source": "Yle", "url": "https://yle.fi/a/74-20184732", "theme": "breach", "status": "admitted" }, { "date": "2026-09-28", "headline": "About 50 health workers charged with reading a colleague's patient record", "paraphrase": "A doctor treated at his own workplace learned colleagues knew details of his care when one raised it in a shop. About 50 nurses and doctors are charged with unlawfully reading his record. He said he lost faith in healthcare.", "source": "Yle", "url": "https://yle.fi/a/74-20248250", "theme": "breach", "status": "alleged" }, { "date": "2026-02-11", "headline": "Doctors in a university study say the capital region's record system buries patient information", "paraphrase": "In interviews for a university study, 25 doctors said the region's patient record system makes information hard to find, slows their work and endangers patient safety, and that their correction requests often go unanswered.", "source": "Helsingin Sanomat", "url": "https://www.hs.fi/helsinki/art-2000011807677.html", "theme": "other", "status": "alleged" } ] }, { "iso3": "DNK", "name": "Denmark", "region": "Europe", "overall": 70, "rank": "2", "likelyRank": "1 to 8", "band": "Strong", "keysModel": "Shared", "confidence": "medium", "headline": "Danes see hospital records, labs and medicines on sundhed.dk and can block lookups, but GP notes are only now arriving and registers have no opt-out.", "categories": { "access": { "score": 78, "summary": "The Commission gave Denmark a 98% eHealth maturity score for 2025, and over 3 million Danes use sundhed.dk or MinSundhed each year. GP notes are only starting to appear, and the full hospital record still needs an access request.", "sources": [ { "title": "Adgang til egen sundhedsjournal (Indenrigs- og Sundhedsministeriet)", "url": "https://www.ism.dk/sundhed/patientrettigheder/adgang-til-egen-sundhedsjournal", "date": "2024-09-23", "publisherClass": "official" }, { "title": "Bekendtgørelse af sundhedsloven, LBK nr. 275 af 12. marts 2025 (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/275", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "2026 Digital Decade eHealth Indicator Study, final report (European Commission)", "url": "https://data.europa.eu/doi/10.2759/1486195", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "Millioner har deres sundhedsdata i lommen: Danskerne har taget MinSundhed-appen til sig (sundhed.dk via Ritzau)", "url": "https://via.ritzau.dk/pressemeddelelse/14744026/millioner-har-deres-sundhedsdata-i-lommen-danskerne-har-taget-minsundhed-appen-til-sig?publisherId=10524793&lang=da", "date": "2026-01-08", "publisherClass": "official" } ] }, "control": { "score": 70, "summary": "Patients can refuse lookups by named staff, units or time periods, and can block access on sundhed.dk. A log on sundhed.dk shows who looked, but treatment lookups need no consent and refusals give way to overriding interests.", "sources": [ { "title": "Bekendtgørelse af sundhedsloven, LBK nr. 275 af 12. marts 2025 (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/275", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Opslag i patientjournalen, praksissammenfatning (Styrelsen for Patientklager)", "url": "https://www.stpk.dk/viden/praksissammenfatninger/opslag-i-patientjournalen/", "date": "undated", "publisherClass": "official" }, { "title": "Din journal: spørgsmål og svar om opslag i patientjournaler (Region Sjælland)", "url": "https://www.regionsjaelland.dk/sundhed/digitale-loesninger/din-journal", "date": "2025-04-22", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "GDPR applies, but the Data Protection Agency cannot fine and must go through police and courts. A court fined Region Syddanmark DKK 500,000 in March 2026, and a 2025 research platform error exposed data on about 260,000 people to regional staff.", "sources": [ { "title": "Bødesager (Datatilsynet)", "url": "https://www.datatilsynet.dk/afgoerelser/boedesager", "date": "undated", "publisherClass": "official" }, { "title": "Region Syddanmark frikendt i en sag og idømt bøde i en anden sag om brud på GDPR-reglerne (Region Syddanmark)", "url": "https://regionsyddanmark.dk/om-region-syddanmark/presse-og-nyheder/nyhedsarkiv/2026/marts-2026/region-syddanmark-frikendt-i-en-sag-og-idomt-bode-i-en-anden-sag-om-brud-pa-gdpr-reglerne", "date": "2026-03-23", "publisherClass": "official" }, { "title": "Stort antal borgere får besked om databrud (Region Midtjylland via Ritzau)", "url": "https://via.ritzau.dk/pressemeddelelse/14290783/stort-antal-borgere-far-besked-om-databrud?publisherId=13561276&lang=da", "date": "2025-03-04", "publisherClass": "official" }, { "title": "AI har haft adgang til over 100.000 beskeder med fortrolig data om danske patienter (Radar/Ingeniøren)", "url": "https://radar.dk/artikel/ai-har-haft-adgang-til-over-100000-beskeder-med-fortrolig-data-om-danske-patienter-de-overtraeder", "date": "2026-09-29", "publisherClass": "news" } ] }, "journey": { "score": 82, "summary": "The Shared Medication Record links GPs, hospitals, home care and pharmacies, and all doctors must use it. GP journal notes and in-clinic lab results are still being connected, and EU cross-border exchange was not yet live.", "sources": [ { "title": "Baggrund for Fælles Medicinkort (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/digitale-loesninger/faelles-medicinkort/baggrund-og-organisering/baggrund-for-fmk", "date": "undated", "publisherClass": "official" }, { "title": "Opkobling af almen praksis, Sundhedsjournalen (MedCom)", "url": "https://medcom.dk/projekter/basisaktiviteter/sundhedsjournalen/opkobling-af-almen-praksis/", "date": "2026-07-13", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, final report (European Commission)", "url": "https://data.europa.eu/doi/10.2759/1486195", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "MyHealth@EU (Danish Health Data Authority)", "url": "https://english.sundhedsdatastyrelsen.dk/health-data-and-registers/european-health-data-space/myhealth@eu", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "Disclosure of record data for non-treatment purposes needs consent, normally written, and register access is limited to authorised research environments. A 2025 law creates one entry point to research data. No Danish ban on selling health data or marketing use beyond GDPR was found.", "sources": [ { "title": "Bekendtgørelse af sundhedsloven, LBK nr. 275 af 12. marts 2025 (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/275", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Lov nr. 717 af 20. juni 2025 om ændring af sundhedsloven m.fl. (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/717", "date": "2025-06-20", "publisherClass": "legal_text" }, { "title": "Ansøg om autorisation til Forskermaskinen (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/data-og-registre/forskerservice/ansoeg-om-data/autorisation-til-forskermaskinen", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 78, "summary": "Treating clinicians can look up hospital e-journals, labs and the medication record across providers without asking, within the Health Act's treatment rule. GP notes will reach hospital clinicians only after patients get them, and patient refusals limit lookups.", "sources": [ { "title": "Bekendtgørelse af sundhedsloven, LBK nr. 275 af 12. marts 2025 (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/275", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Opslag i patientjournalen, praksissammenfatning (Styrelsen for Patientklager)", "url": "https://www.stpk.dk/viden/praksissammenfatninger/opslag-i-patientjournalen/", "date": "undated", "publisherClass": "official" }, { "title": "Baggrund for Fælles Medicinkort (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/digitale-loesninger/faelles-medicinkort/baggrund-og-organisering/baggrund-for-fmk", "date": "undated", "publisherClass": "official" }, { "title": "PLO'rientering 2/2026: status på deling af journalnotater (Praktiserende Lægers Organisation)", "url": "https://laeger.dk/foreninger/plo/plorientering/plorientering-22026", "date": "2026-01-30", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Register research runs without individual consent and with no general opt-out, inside ethics approval and a secure server for authorised teams. The only personal opt-out covers tissue samples and genetic data.", "sources": [ { "title": "Bekendtgørelse af sundhedsloven, LBK nr. 275 af 12. marts 2025 (Retsinformation)", "url": "https://www.retsinformation.dk/eli/lta/2025/275", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Brug af data til forskning (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/borger/om-sundhedsdata/brug-til-forskning", "date": "undated", "publisherClass": "official" }, { "title": "Ansøg om autorisation til Forskermaskinen (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/data-og-registre/forskerservice/ansoeg-om-data/autorisation-til-forskermaskinen", "date": "undated", "publisherClass": "official" }, { "title": "Brug af biologisk materiale og genetiske oplysninger (Sundhedsdatastyrelsen)", "url": "https://sundhedsdatastyrelsen.dk/borger/selvbetjening-og-services/brug-af-vaevsproever", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, whose duties for AI in regulated products now start 2 August 2028. Denmark has named AI Act authorities and published patient safety guidance, but no binding national clinical-AI rules were verified.", "sources": [ { "title": "AI Omnibus (Digitaliseringsstyrelsen)", "url": "https://digst.dk/tilsyn/ai-forordningen/ai-omnibus/", "date": "undated", "publisherClass": "official" }, { "title": "Tilsyn med AI-forordningen (Digitaliseringsstyrelsen)", "url": "https://digst.dk/tilsyn/ai-forordningen/tilsyn-med-ai-forordningen/", "date": "undated", "publisherClass": "official" }, { "title": "Digital sundhedsfaglig behandling: ansvar og pligter (Styrelsen for Patientsikkerhed)", "url": "https://stps.dk/sundhedsfaglig/ansvar-og-retningslinjer/sundhedsfaglig-vejledning/digital-sundhedsfaglig-behandling", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Danish Health Act (Sundhedsloven), LBK 275 of 2025", "level": "National", "year": "2025", "what": "Right of access within 7 working days, treatment lookups, right to refuse lookups, research disclosure rules.", "url": "https://www.retsinformation.dk/eli/lta/2025/275" }, { "name": "Act no. 717 of 20 June 2025 amending the Health Act", "level": "National", "year": "2025", "what": "Lets providers withhold staff names from access requests; Ét Kontaktpunkt research data entry starts on a ministerial date.", "url": "https://www.retsinformation.dk/eli/lta/2025/717" }, { "name": "L 44 (2025-26) amending the Health Act, adopted 16 December 2025", "level": "National", "year": "2025", "what": "Moves Health Data Authority tasks to Digital Sundhed Danmark; lets pharmacy staff look up prescriptions.", "url": "https://www.folketingstidende.dk/samling/20251/lovforslag/L44/20251_L44_som_vedtaget.pdf" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "Free access, restriction rights, access logs and secondary-use opt-out; key parts apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "EU AI Act as amended by the AI Omnibus", "level": "Supranational", "year": "2026", "what": "High-risk duties for AI in regulated products such as medical devices start 2 August 2028.", "url": "https://digst.dk/tilsyn/ai-forordningen/ai-omnibus/" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-03-27", "headline": "Clinic told a patient abroad to fetch their record in person on USB", "paraphrase": "A patient living outside Denmark asked a general practice for an electronic copy of their record. The clinic said it could only hand it over on a new USB stick the patient brought in person. The board criticised the clinic.", "source": "Styrelsen for Patientklager (Danish Patient Complaints Board), 26SFP21", "url": "https://www.stpk.dk/afgorelser-og-domme/afgorelser-fra-styrelsen-for-patientklager/26sfp21/", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-03-19", "headline": "Women found in their access logs that a doctor had looked up their records", "paraphrase": "Women checked the access log for their records on sundhed.dk and saw that a doctor with no part in their care had looked them up. The regions found many more unauthorised lookups and reported him to police.", "source": "TV 2 Øst", "url": "https://www.tv2east.dk/region-sjaelland/laege-snagede-i-journaler-fik-sit-livs-chok", "theme": "breach", "status": "admitted" }, { "date": "2025-09-08", "headline": "Millions of hospital records used for AI research without a prior risk check", "paraphrase": "Experts said two regions gave a research project access to 3.65 million people's hospital records without first assessing data protection risks. A regional director said the analysis perhaps should have been done. The regulator opened an inquiry.", "source": "DR", "url": "https://www.dr.dk/nyheder/indland/datatilsynet-gaar-ind-i-sag-om-brug-af-millioner-af-danskeres-sygehusjournaler-til", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2025-01-21", "headline": "Hackers posted patients' health details from a GP chain online", "paraphrase": "After a cyberattack on a nationwide chain of GP practices, hackers posted patient information including illness history, hospital referrals and medication. The chain had confirmed personal data on an unknown number of patients was compromised.", "source": "DR", "url": "https://www.dr.dk/nyheder/indland/dybt-foelsomme-patientoplysninger-fra-alles-laegehus-laekket-online", "theme": "breach", "status": "admitted" }, { "date": "2024-10-04", "headline": "Regulator criticised a university for passing on research participants' health data without permission", "paraphrase": "After inspecting eight research projects using health information, the data protection authority gave serious criticism: the university had several times passed personal data on without the required permission and supervised partners poorly. The university said it takes the criticism seriously.", "source": "DR", "url": "https://www.dr.dk/nyheder/seneste/efter-kritik-fra-datatilsynet-universitet-lover-passe-bedre-paa-folks", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "EST", "name": "Estonia", "region": "Europe", "overall": 68, "rank": "3=", "likelyRank": "1 to 13", "band": "Strong", "keysModel": "Shared", "confidence": "medium", "headline": "Every provider must feed one national record that patients can read, log-check and close, but police and security services can query it without consent.", "categories": { "access": { "score": 80, "summary": "The Health Portal shows documents, prescriptions, invoices and access logs, kept without time limit, and 60% of people aged 16 to 74 read records online in 2024 (EU 28%). Export was not verified, so the score sits in the lower half of its band.", "sources": [ { "title": "Tervishoiuteenuste korraldamise seadus (Health Services Organisation Act), consolidated text from 01.10.2026, sections 59¹ to 59³", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Tervise infosüsteemi põhimäärus (Government Regulation No. 138 on the health information system), sections 16 to 21", "url": "https://www.riigiteataja.ee/akt/128032026002", "date": "2026-03-28", "publisherClass": "legal_text" }, { "title": "Kontaktid ja korduma kippuvad küsimused (Terviseportaal)", "url": "https://www.terviseportaal.ee/kontaktid-ja-kkk", "date": "undated", "publisherClass": "official" }, { "title": "Individuals, internet activities: accessing personal health records online (Eurostat dataset isoc_ci_ac_i, 2024)", "url": "https://ec.europa.eu/eurostat/databrowser/view/isoc_ci_ac_i/default/table", "date": "undated", "publisherClass": "intergov" } ] }, "control": { "score": 68, "summary": "Patients can close their whole record or single documents in the portal and read a logbook of who viewed each document. Uploads need no consent, prescription views are not in the portal log, and police can obtain data for criminal proceedings without consent.", "sources": [ { "title": "Tervishoiuteenuste korraldamise seadus, consolidated text from 01.10.2026, sections 4¹(1), 59²(1), 59³", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Terviseportaali KKK (TEHIK)", "url": "https://www.tehik.ee/terviseportaali-kkk", "date": "undated", "publisherClass": "official" }, { "title": "Tervishoid, KKK (Andmekaitse Inspektsioon)", "url": "https://www.aki.ee/isikuandmed/kkk/tervishoid", "date": "2026-03-20", "publisherClass": "official" }, { "title": "Social minister butts heads with doctors over doctor-patient confidentiality (ERR News)", "url": "https://news.err.ee/1610151619/social-minister-butts-heads-with-doctors-over-doctor-patient-confidentiality", "date": "2026-09-30", "publisherClass": "news" } ] }, "privacy": { "score": 55, "summary": "The regulator's EUR 3 million fine over a pharmacy loyalty breach was upheld in court in September 2026. Against that, the security service queried health data on about 13,000 people in 13 months, and a dental IT breach touched over 300 providers.", "sources": [ { "title": "Allium UPI-le määratud 3 miljoni euro suurune trahv oli kohtu hinnangul põhjendatud (Andmekaitse Inspektsioon)", "url": "https://www.aki.ee/uudised/allium-upi-le-maaratud-3-miljoni-euro-suurune-trahv-oli-kohtu-hinnangul-pohjendatud", "date": "2026-09-02", "publisherClass": "official" }, { "title": "Estonian police and ISS say most health data queries are lawful (ERR News)", "url": "https://news.err.ee/1610104594/estonian-police-and-iss-say-most-health-data-queries-are-lawful", "date": "2026-08-07", "publisherClass": "news" }, { "title": "Patient health data leaked from dentists' information system (ERR News)", "url": "https://news.err.ee/1610127079/patient-health-data-leaked-from-dentists-information-system", "date": "2026-09-03", "publisherClass": "news" }, { "title": "Tervise infosüsteemi põhimäärus (Government Regulation No. 138), section 8", "url": "https://www.riigiteataja.ee/akt/128032026002", "date": "2026-03-28", "publisherClass": "legal_text" } ] }, "journey": { "score": 80, "summary": "One national system receives mandatory uploads from every provider and serves waiting lists, medical images and state registries. The National Audit Office found in December 2025 that 79% of discharge summaries still arrive in an outdated format and some are never sent.", "sources": [ { "title": "Tervishoiuteenuste korraldamise seadus, consolidated text from 01.10.2026, sections 59¹ and 59²", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Terviseandmete õigsuse, täpsuse ja ajakohasuse tagamine (Riigikontroll audit)", "url": "https://www.riigikontroll.ee/auditiaruanded/terviseandmete-oigsuse-tapsuse-ja-ajakohasuse-tagamine", "date": "2025-12-05", "publisherClass": "official" }, { "title": "Cross-border data exchange (TEHIK)", "url": "https://www.tehik.ee/en/cross-border-data-exchange", "date": "undated", "publisherClass": "official" }, { "title": "Estonia: Country Health Profile 2025 (OECD and European Observatory)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/estonia_8621837c/0eb3b75b-en.pdf", "date": "2025-12", "publisherClass": "intergov" } ] }, "commercial": { "score": 58, "summary": "From 1 October 2026 the state may charge EUR 58 an hour to release health system data for research, development and innovation, inside a secure environment. Insurers may not seek genetic data, but no Estonian ban on selling health data beyond GDPR was found.", "sources": [ { "title": "Andmepäringud: miks, kellele ja mis tingimustel? (TEHIK Teabekeskus)", "url": "https://teabekeskus.tehik.ee/et/andmeparing", "date": "2026-04-29", "publisherClass": "official" }, { "title": "2025 andmeväljastused (TEHIK Teabekeskus)", "url": "https://teabekeskus.tehik.ee/et/andmeparing/2025", "date": "undated", "publisherClass": "official" }, { "title": "Inimgeeniuuringute seadus (Human Genes Research Act), adopted 25.02.2026", "url": "https://www.riigiteataja.ee/akt/117032026001", "date": "2026-03-17", "publisherClass": "legal_text" }, { "title": "Tervishoiuteenuste korraldamise seadus, consolidated text from 01.10.2026, section 59³(9) to (15)", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" } ] }, "clinical": { "score": 75, "summary": "Any treating provider may read the national record without consent unless the patient has closed it, and a national dashboard pulls tests and visits from many providers. Gaps in what providers send limit what clinicians actually see.", "sources": [ { "title": "Tervishoiuteenuste korraldamise seadus, consolidated text from 01.10.2026, sections 4¹(1), 59³", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Estonia plans 7 million upgrade to centralized health specialist dashboard (ERR News)", "url": "https://news.err.ee/1610059153/estonia-plans-7-million-upgrade-to-centralized-health-specialist-dashboard", "date": "2026-06-19", "publisherClass": "news" }, { "title": "Terviseportaali KKK (TEHIK)", "url": "https://www.tehik.ee/terviseportaali-kkk", "date": "undated", "publisherClass": "official" }, { "title": "Terviseandmete õigsuse, täpsuse ja ajakohasuse tagamine (Riigikontroll audit)", "url": "https://www.riigikontroll.ee/auditiaruanded/terviseandmete-oigsuse-tapsuse-ja-ajakohasuse-tagamine", "date": "2025-12-05", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Health system data can be used for research without consent and with no general opt-out, mainly in pseudonymised form after ethics committee review. Safeguards are documented: a secure processing environment, a public list of data releases, and opt-in consent for the biobank.", "sources": [ { "title": "Isikuandmete kaitse seadus (Personal Data Protection Act), consolidated text from 01.10.2026, section 6", "url": "https://www.riigiteataja.ee/akt/130062026052", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Tervishoiuteenuste korraldamise seadus, consolidated text from 01.10.2026, sections 59³ and 59⁴", "url": "https://www.riigiteataja.ee/akt/130062026132", "date": "2026-06-30", "publisherClass": "legal_text" }, { "title": "Inimgeeniuuringute seadus (Human Genes Research Act), sections 18 and 20", "url": "https://www.riigiteataja.ee/akt/117032026001", "date": "2026-03-17", "publisherClass": "legal_text" }, { "title": "2025 andmeväljastused (TEHIK Teabekeskus)", "url": "https://teabekeskus.tehik.ee/et/andmeparing/2025", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, whose duties for AI built into products such as medical devices now start 2 August 2028. The data regulator has warned clinicians about ChatGPT and scribes, but that guidance is not binding.", "sources": [ { "title": "Tehisintellektisüsteemid (Tarbijakaitse ja Tehnilise Järelevalve Amet)", "url": "https://ttja.ee/ariklient/ohutus/tooted-teenused/tehisintellektisusteemid", "date": "undated", "publisherClass": "official" }, { "title": "Tähelepanu juhtimine: üldotstarbelise tehisintellekti kasutamine tervishoius (Andmekaitse Inspektsioon)", "url": "https://www.aki.ee/sites/default/files/documents/2026-06/Tahelepanu%20juhtimine.%20%C3%9Cldotstarbelise%20tehisintellekti%20kasutamine%20tervishoius_0.pdf", "date": "2026-05-07", "publisherClass": "official" }, { "title": "Seisukohad (Andmekaitse Inspektsioon decisions and opinions list)", "url": "https://www.aki.ee/kiirelt-katte/aki-otsused/seisukohad", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Health Services Organisation Act (Tervishoiuteenuste korraldamise seadus)", "level": "National", "year": "2001", "what": "Mandatory uploads to the national record, patient access and right to block providers, consent exceptions, research fees.", "url": "https://www.riigiteataja.ee/akt/130062026132" }, { "name": "Government Regulation No. 138, Statute of the Health Information System", "level": "National", "year": "2016", "what": "Portal contents, closing records, representatives, 30-year logs and the patient's view of access logs.", "url": "https://www.riigiteataja.ee/akt/128032026002" }, { "name": "Personal Data Protection Act (Isikuandmete kaitse seadus)", "level": "National", "year": "2018", "what": "Applies GDPR; section 6 allows research without consent, mainly pseudonymised, with ethics committee checks.", "url": "https://www.riigiteataja.ee/akt/130062026052" }, { "name": "Human Genes Research Act (Inimgeeniuuringute seadus)", "level": "National", "year": "2026", "what": "Opt-in biobank consent, donor rights, and a ban on insurers using genetic data.", "url": "https://www.riigiteataja.ee/akt/117032026001" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "Access, restriction and access-log rights, and a secondary-use opt-out; main parts apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation (EU) 2024/1689 (AI Act), as amended by Regulation (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; high-risk duties for AI in products such as medical devices from 2 August 2028.", "url": "https://ttja.ee/ariklient/ohutus/tooted-teenused/tehisintellektisusteemid" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-05", "headline": "Provider ignored a patient's request to correct entries in the national health system", "paraphrase": "A patient asked a provider to correct data it had sent to the national health system. The provider said the entries were right and would not discuss it. The audit office said this broke the provider's complaints rules.", "source": "Riigikontroll (National Audit Office of Estonia), report to the Riigikogu", "url": "https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2025-12-05", "headline": "Patient found portal entries from a doctor they were not registered with", "paraphrase": "Checking the national patient portal, a patient found that a family doctor whose list they were not on had recorded a diagnosis and treatment for them. The audit office warned that a misleading history can affect later care decisions.", "source": "Riigikontroll (National Audit Office of Estonia), report to the Riigikogu", "url": "https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2025-12-05", "headline": "One wrong letter in a code put a false diagnosis on record", "paraphrase": "For years, documents sent to the national system carried a diagnosis code one letter away from the right one, recording an unrelated finding. The audit office noted such errors can mislead treatment and harm a person's reputation and job prospects.", "source": "Riigikontroll (National Audit Office of Estonia), report to the Riigikogu", "url": "https://www.riigikontroll.ee/sites/default/files/documents/2025-12/19886_RKTR_6609_2-1.4_2352_002-1.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2026-09-03", "headline": "Patient health data downloaded from a dental records system used by 300 providers", "paraphrase": "Someone repeatedly entered a records system used by over 300 Estonian dental and health providers and downloaded patients' ID codes, emails and health data. Police arrested a suspect; prosecutors said the data appears not to have been shared.", "source": "ERR", "url": "https://www.err.ee/1610127001/hambaarstide-infosusteemist-lekkisid-patsientide-terviseandmed", "theme": "breach", "status": "alleged" } ] }, { "iso3": "HUN", "name": "Hungary", "region": "Europe", "overall": 68, "rank": "3=", "likelyRank": "1 to 13", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Hungary's EESZT links every GP, hospital and pharmacy, and patients can block doctors and read an access log, though very few use those controls.", "categories": { "access": { "score": 72, "summary": "Through the EESZT portal and the EgészségAblak app, patients can see documents from their care, prescriptions and referrals, and the EU scored Hungary 85.98 on record access in 2024. Medical images are not yet shown to citizens, so the score stays inside the portal band.", "sources": [ { "title": "Lakosság (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/lakossagi-szolgaltatasok", "date": "undated", "publisherClass": "official" }, { "title": "1997. évi CLIV. törvény az egészségügyről, 24. § (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700154.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "2025 Country Report Hungary, SWD(2025) 294 final, Part 13/27 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/116912", "date": "2025-06-16", "publisherClass": "intergov" }, { "title": "Több millióan használják már az EgészségAblakot (Világgazdaság)", "url": "https://www.vg.hu/vilaggazdasag-magyar-gazdasag/2025/11/e-egeszsegugy-magyarorszag-egeszsegablak-eeszt-rekord", "date": "2025-11-28", "publisherClass": "news" } ] }, "control": { "score": 72, "summary": "Patients can open their record to all, block whole specialties, block a single doctor or hospital, or block everyone, and they can read a log of every query. Only about 0.6 percent of people have changed the default.", "sources": [ { "title": "Önrendelkezés (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/onrendelkezes", "date": "undated", "publisherClass": "official" }, { "title": "Önrendelkezés: GYIK (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/onrendelkezes-gyik", "date": "undated", "publisherClass": "official" }, { "title": "Az önrendelkezési beállítások típusai az EESZT-ben (Tisztességes Adatkezelés)", "url": "https://www.tisztessegesadatkezeles.org/2025/08/az-onrendelkezesi-beallitasok-tipusai-az-eeszt-ben/", "date": "2025-08-09", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 62, "summary": "A dedicated health data act and the GDPR apply, and the regulator NAIH has fined providers that withheld records, including HUF 10 million in a 2024 case. We found no major Hungarian health breach reported in the last 12 months.", "sources": [ { "title": "NAIH-4137-8/2022: döntés egészségügyi dokumentáció másolatának kiadásáról (NAIH)", "url": "https://www.naih.hu/hatarozatok-vegzesek?download=570%3Aegeszsegugyi-dokumentacio-masolatanak-kiadasa", "date": "2022", "publisherClass": "official" }, { "title": "1997. évi XLVII. törvény (Eüak) (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "Önrendelkezés: GYIK (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/onrendelkezes-gyik", "date": "undated", "publisherClass": "official" }, { "title": "Analysis of the NAIH 2024 Cases with Fines (DMP)", "url": "https://dmp.hu/en/data-protection/analysis-of-the-naih-2024-cases-with-fines/", "date": "2025-04-22", "publisherClass": "law_firm" } ] }, "journey": { "score": 78, "summary": "Since November 2017 every GP service, outpatient clinic, hospital and pharmacy has been on EESZT, and private doctors joined from 2020. About 19 million e-prescriptions and 17 million reports appear in it each month.", "sources": [ { "title": "Lakosság (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/lakossagi-szolgaltatasok", "date": "undated", "publisherClass": "official" }, { "title": "1997. évi XLVII. törvény (Eüak), 36/A. § (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "Bővül az EESZT-ben rögzítendő adatok köre (Jogkövető)", "url": "https://jogkoveto.hu/tudastar/bovul-az-eeszt-ben-rogzitendo-adatok-kore", "date": "2026-07-22", "publisherClass": "news" }, { "title": "Több millióan használják már az EgészségAblakot (Világgazdaság)", "url": "https://www.vg.hu/vilaggazdasag-magyar-gazdasag/2025/11/e-egeszsegugy-magyarorszag-egeszsegablak-eeszt-rekord", "date": "2025-11-28", "publisherClass": "news" } ] }, "commercial": { "score": 55, "summary": "The 2023 national data asset law lets public health data be reused by outside users, for a fee, once pseudonymised or anonymised in a secure environment. The EU health data space will ban marketing uses of reused data from 2029.", "sources": [ { "title": "2023. évi CI. törvény a nemzeti adatvagyon hasznosításáról (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=a2300101.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "1997. évi XLVII. törvény (Eüak), 35/W. § (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 76, "summary": "Any new GP or specialist treating a patient becomes a treating doctor in EESZT and can see everything except the most sensitive categories. In an emergency, doctors can override a patient's blocks, and each override is logged.", "sources": [ { "title": "Önrendelkezés: GYIK (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/onrendelkezes-gyik", "date": "undated", "publisherClass": "official" }, { "title": "Önrendelkezés (EESZT Információs portál)", "url": "https://e-egeszsegugy.gov.hu/en/onrendelkezes", "date": "undated", "publisherClass": "official" }, { "title": "1997. évi XLVII. törvény (Eüak), 3. § (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv", "date": "undated", "publisherClass": "legal_text" } ] }, "research": { "score": 47, "summary": "Health data can be reused through the national data asset system without individual consent, and we found no general opt-out. Safeguards include a permit body, a secure processing environment and pseudonymisation, and Hungary has already named its EHDS access body in law.", "sources": [ { "title": "1997. évi XLVII. törvény (Eüak), 21/A. § and 35/W. § (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 54, "summary": "Act LXXV of 2025, Hungary's first AI law, took effect mostly on 1 December 2025 and sets up AI notifying and market surveillance authorities, an AI Council and a sandbox. We found no national rule written for clinical AI.", "sources": [ { "title": "2025. évi LXXV. törvény az EU MI-rendelet végrehajtásáról (Jogtár)", "url": "https://net.jogtar.hu/jogszabaly?docid=a2500075.tv", "date": "undated", "publisherClass": "legal_text" }, { "title": "Az EU mesterséges intelligencia rendeletének végrehajtása Magyarországon (GDPR blog)", "url": "https://gdpr.blog.hu/2025/11/05/az_eu_mesterseges_intelligencia_rendeletenek_vegrehajtasa_magyarorszagon", "date": "2025-11-05", "publisherClass": "blog_vendor" }, { "title": "Mesterséges intelligencia: ilyen törvény még nem volt Magyarországon (Világgazdaság)", "url": "https://www.vg.hu/vilaggazdasag-magyar-gazdasag/2025/11/mesterseges-intelligencia-torveny-magyarorszag-kormany", "date": "2025-11-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Act CLIV of 1997 on Health (Eütv.)", "level": "National", "year": "1997", "what": "Patient right to know the contents of their medical documentation; discharge and outpatient reports on completion.", "url": "https://net.jogtar.hu/jogszabaly?docid=99700154.tv" }, { "name": "Act XLVII of 1997 on Health Data (Eüak.)", "level": "National", "year": "1997", "what": "Legal base for EESZT, digital self-determination, emergency access, and health data asset reuse.", "url": "https://net.jogtar.hu/jogszabaly?docid=99700047.tv" }, { "name": "EMMI Decree 39/2016 on EESZT detailed rules", "level": "National", "year": "2016", "what": "What providers must upload to EESZT and when; school health added from July 2026.", "url": "https://net.jogtar.hu/jogszabaly?docid=a1600039.emm" }, { "name": "Act CI of 2023 on the National Data Asset System (Nahtv.)", "level": "National", "year": "2023", "what": "Fee-based reuse of public data, including health data; implements Data Governance Act and EHDS.", "url": "https://net.jogtar.hu/jogszabaly?docid=a2300101.tv" }, { "name": "Act LXXV of 2025 implementing the EU AI Act", "level": "National", "year": "2025", "what": "Creates AI authorities, an AI Council and a regulatory sandbox; mostly in force 1 December 2025.", "url": "https://net.jogtar.hu/jogszabaly?docid=a2500075.tv" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Free access, restriction and access-log rights, opt-out from secondary use; key parts apply from 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-03-20", "headline": "Former family doctor opened an ex-patient's national health record 47 times", "paraphrase": "A patient checked the access log in the national health record system and found a doctor they had left kept viewing their results and prescriptions for 19 months. The doctor also ignored their access request. The regulator imposed a fine.", "source": "Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), decision NAIH-273-7/2026", "url": "https://www.naih.hu/hatarozatok-vegzesek?download=1450%3Ajogalap-nelkuli-hozzaferes-az-eeszt-rendszerehez-es-hozzaferesi-kerelem-nemteljesitese", "theme": "breach", "status": "finding" }, { "date": "2026-03", "headline": "Clinic charged per page for a patient's records, regulator rules access is free", "paraphrase": "A patient asked a health institution to email all their outpatient records. It demanded a per-page fee and said records could only be collected in person. It sent them free months later, after the regulator opened a case.", "source": "Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2025, case NAIH-2306-1/2025", "url": "https://www.naih.hu/eves-beszamolok?download=1431:naih-beszamolo-a-2025-evi-tevekenysegrol", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2026-03", "headline": "Stranger's visit record filed in a patient's national health record by name mix-up", "paraphrase": "A health institution uploaded another person's outpatient visit sheet into a patient's national record because they shared a name. The regulator found the record inaccurate and faulted the institution for not reporting the resulting breach.", "source": "Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2025, case NAIH-9859/2025", "url": "https://www.naih.hu/eves-beszamolok?download=1431:naih-beszamolo-a-2025-evi-tevekenysegrol", "theme": "record_wrong", "status": "finding" }, { "date": "2025-03", "headline": "Patient files left in a closed health building after repeated break-ins", "paraphrase": "A health institution left large volumes of patient records in a closed building that intruders kept entering, scattering files inside. It did not remove them or tell patients for over nine months. The regulator fined it two million forints.", "source": "Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), annual report on 2024, case NAIH-295/2024", "url": "https://www.naih.hu/eves-beszamolok?download=1167:naih-beszamolo-a-2024-evi-tevekenysegrol", "theme": "breach", "status": "finding" }, { "date": "2025-04-10", "headline": "Ransomware group claims it stole a private clinic's patient files", "paraphrase": "A ransomware group said it took about 178,000 files from a private clinic, including invoices and treatment reports, and threatened to publish them. The clinic had not answered press questions when the report appeared.", "source": "Pénzcentrum (citing Telex)", "url": "https://www.penzcentrum.hu/egeszseg/20250410/dobbenetes-hekkertamadas-erhette-a-sasszemklinikat-ez-mar-tenyleg-a-legalja-1177280", "theme": "breach", "status": "alleged" } ] }, { "iso3": "SWE", "name": "Sweden", "region": "Europe", "overall": 67, "rank": "5", "likelyRank": "1 to 17", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Swedes read nearly all their record in 1177 and must consent before another provider looks, but registers have no opt-out and consent may soon go.", "categories": { "access": { "score": 77, "summary": "Every region shows records in 1177, and the Commission found all 13 data types it checks available in all 21 regions, with images only on request. About 8 million people have logged in, but 1177 offers reading and paper copies, not a download.", "sources": [ { "title": "Patientdatalag (2008:355) (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientdatalag-2008355_sfs-2008-355/", "date": "undated", "publisherClass": "legal_text" }, { "title": "1177 journal (Inera)", "url": "https://www.inera.se/tjanster/journalen/", "date": "undated", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, Annex: Country Factsheets (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/53637948-66ce-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-15", "publisherClass": "intergov" }, { "title": "Öppen info: 1177 journal, Statistik och användning (Inera)", "url": "https://inera.atlassian.net/wiki/spaces/OIJ/pages/442106604", "date": "2025-03-04", "publisherClass": "official" } ] }, "control": { "score": 72, "summary": "Another provider may read shared records only with the patient's consent, patients can object and have data blocked at once, and some regions show the access log in 1177. A June 2026 proposal would drop the consent rule from July 2027; it is not yet law.", "sources": [ { "title": "Lag (2022:913) om sammanhållen vård- och omsorgsdokumentation (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022913-om-sammanhallen-vard-och_sfs-2022-913/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Patientdatalag (2008:355) (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientdatalag-2008355_sfs-2008-355/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Din journal (1177)", "url": "https://www.1177.se/sa-fungerar-varden/sa-skyddas-och-hanteras-dina-uppgifter/din-journal/", "date": "undated", "publisherClass": "official" }, { "title": "Ett första steg i genomförandet av en nationell digital infrastruktur på hälsodataområdet, S2026/01360 (Regeringen)", "url": "https://www.regeringen.se/rattsliga-dokument/departementsserien-och-promemorior/2026/06/ett-forsta-steg-i-genomforandet-av-en-nationell-digital-infrastruktur-pa-halsodataomradet/", "date": "2026-06-18", "publisherClass": "official" } ] }, "privacy": { "score": 64, "summary": "IMY can fine public health bodies up to SEK 10 million and fined pharmacy chain Apoteket SEK 37 million in 2024. But fines on five hospitals and regions were overturned in court in 2022, and police can get some patient data.", "sources": [ { "title": "Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Regioner och sjukhus slipper att betala miljoner i sanktionsavgifter (Läkartidningen)", "url": "https://lakartidningen.se/nyheter/regioner-och-sjukhus-slipper-att-betala-miljoner-i-sanktionsavgifter/", "date": "2022-05-17", "publisherClass": "news" }, { "title": "Sanktionsavgifter mot Apoteket och Apohem för överföring av personuppgifter till Meta (IMY)", "url": "https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/", "date": "2024-08-30", "publisherClass": "official" }, { "title": "Dom: Sjukhus tvingas lämna ut uppgifter om papperslös (Dagens Samhälle)", "url": "https://www.dagenssamhalle.se/styrning-och-beslut/juridik/dom-sjukhus-tvingas-lamna-ut-uppgifter-om-papperslos/", "date": "2026-07-10", "publisherClass": "news" } ] }, "journey": { "score": 66, "summary": "Sweden has no single national record: regions run their own systems, joined by the NPÖ viewer that every region and municipality uses. The National Medicines List links all pharmacies, but four regions, including Stockholm, Skåne and Västra Götaland, are connected only to read it, or still connecting.", "sources": [ { "title": "NPÖ, Nationell patientöversikt (Inera)", "url": "https://www.inera.se/tjanster/nationell-patientoversikt-npo/", "date": "undated", "publisherClass": "official" }, { "title": "Följ anslutningen till Nationella läkemedelslistan (E-hälsomyndigheten)", "url": "https://www.ehalsomyndigheten.se/verksamhet/nationella-lakemedelslistan/folj-anslutningen-till-nationella-lakemedelslistan/", "date": "undated", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, Annex: Country Factsheets (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/53637948-66ce-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-15", "publisherClass": "intergov" }, { "title": "Ett första steg i genomförandet av en nationell digital infrastruktur på hälsodataområdet, S2026/01360 (Regeringen)", "url": "https://www.regeringen.se/rattsliga-dokument/departementsserien-och-promemorior/2026/06/ett-forsta-steg-i-genomforandet-av-en-nationell-digital-infrastruktur-pa-halsodataomradet/", "date": "2026-06-18", "publisherClass": "official" } ] }, "commercial": { "score": 60, "summary": "The Patient Data Act limits care records to a closed list of care, quality and statistics purposes, and IMY fined Apoteket SEK 37 million for leaking customer health data to Meta. No Swedish ban on selling health data or using it for marketing beyond GDPR was found.", "sources": [ { "title": "Patientdatalag (2008:355) (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientdatalag-2008355_sfs-2008-355/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Lag (1998:543) om hälsodataregister (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-1998543-om-halsodataregister_sfs-1998-543/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Sekretessprövning hos Socialstyrelsen (Socialstyrelsen)", "url": "https://bestalladata.socialstyrelsen.se/data-for-forskning/sekretessprovning/", "date": "undated", "publisherClass": "official" }, { "title": "Sanktionsavgifter mot Apoteket och Apohem för överföring av personuppgifter till Meta (IMY)", "url": "https://www.imy.se/nyheter/sanktionsavgifter-mot-apoteket-och-apohem-for-overforing-av-personuppgifter-till-meta/", "date": "2024-08-30", "publisherClass": "official" } ] }, "clinical": { "score": 64, "summary": "A clinician at another provider can see records through NPÖ and the national medicines list, but only with a care relationship and the patient's active consent. An emergency rule covers patients who cannot consent, and what NPÖ shows varies by provider.", "sources": [ { "title": "Lag (2022:913) om sammanhållen vård- och omsorgsdokumentation (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022913-om-sammanhallen-vard-och_sfs-2022-913/", "date": "undated", "publisherClass": "legal_text" }, { "title": "NPÖ, Nationell patientöversikt (Inera)", "url": "https://www.inera.se/tjanster/nationell-patientoversikt-npo/", "date": "undated", "publisherClass": "official" }, { "title": "Samtycken och spärrar (E-hälsomyndigheten)", "url": "https://www.ehalsomyndigheten.se/verksamhet/nationella-lakemedelslistan/samtycken-och-sparrar/", "date": "undated", "publisherClass": "official" }, { "title": "Ett första steg i genomförandet av en nationell digital infrastruktur på hälsodataområdet, S2026/01360 (Regeringen)", "url": "https://www.regeringen.se/rattsliga-dokument/departementsserien-och-promemorior/2026/06/ett-forsta-steg-i-genomforandet-av-en-nationell-digital-infrastruktur-pa-halsodataomradet/", "date": "2026-06-18", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "All providers must report to national health registers, which are used for research without consent or a general opt-out, under ethics approval and absolute secrecy. Quality registers are the exception: a person can object and have their data erased.", "sources": [ { "title": "Lag (1998:543) om hälsodataregister (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-1998543-om-halsodataregister_sfs-1998-543/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Sekretessprövning hos Socialstyrelsen (Socialstyrelsen)", "url": "https://bestalladata.socialstyrelsen.se/data-for-forskning/sekretessprovning/", "date": "undated", "publisherClass": "official" }, { "title": "Lag (2003:460) om etikprövning av forskning som avser människor (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2003460-om-etikprovning-av-forskning-som_sfs-2003-460/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Patientdatalag (2008:355) (Sveriges riksdag)", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientdatalag-2008355_sfs-2008-355/", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "Clinical AI is governed by EU device law and the AI Act, whose duties for AI in medical devices now start 2 August 2028. Sweden has named AI Act authorities and issued guidance, but no binding national clinical-AI rules were verified.", "sources": [ { "title": "Digital Omnibus on AI has been published (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" }, { "title": "AI-förordningen (PTS)", "url": "https://pts.se/ai/ai-forordningen/", "date": "2026-07-31", "publisherClass": "official" }, { "title": "Ny version av Läkemedelsverkets AI-vägledning till sjukvården (Läkemedelsverket, via TT)", "url": "https://via.tt.se/pressmeddelande/4319887/ny-version-av-lakemedelsverkets-ai-vagledning-till-sjukvarden?publisherId=3235477&lang=sv", "date": "2026-04-08", "publisherClass": "official" }, { "title": "Granskning av Region Gävleborgs användning av AI-transkribering i primärvården (IMY)", "url": "https://www.imy.se/nyheter/granskning-av-region-gavleborgs-anvandning-av-ai-transkribering-i-primarvarden/", "date": "2026-05-07", "publisherClass": "official" } ] } }, "laws": [ { "name": "Patient Data Act (Patientdatalag 2008:355)", "level": "National", "year": "2008", "what": "Record duties, closed purpose list, blocks within a provider, access logs, quality register opt-out.", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientdatalag-2008355_sfs-2008-355/" }, { "name": "Act on coordinated care and social care documentation (2022:913)", "level": "National", "year": "2022", "what": "Sharing between providers: patient may object; reading another provider's data needs consent.", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2022913-om-sammanhallen-vard-och_sfs-2022-913/" }, { "name": "Data Protection Act (2018:218)", "level": "National", "year": "2018", "what": "Supplements GDPR; lets IMY fine public authorities up to SEK 10 million.", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/" }, { "name": "Health Data Registers Act (1998:543)", "level": "National", "year": "1998", "what": "Mandatory reporting to national health registers for statistics, follow-up and research.", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-1998543-om-halsodataregister_sfs-1998-543/" }, { "name": "Ethical Review Act (2003:460)", "level": "National", "year": "2003", "what": "Research on sensitive personal data needs ethics approval.", "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2003460-om-etikprovning-av-forskning-som_sfs-2003-460/" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "Patient access, restriction and opt-out rights; exchange and secondary use from March 2029 and 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)", "level": "Supranational", "year": "2026", "what": "Delays AI Act high-risk duties for AI in medical devices to 2 August 2028.", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2024-11-26", "headline": "Region reports new record system to regulator after patient notes went missing", "paraphrase": "Within days of a large region switching record systems, staff reported record information that was missing or disappeared, plus failures registering and finding patients. The region reported the system to the medical products regulator and paused it.", "source": "SVT Nyheter", "url": "https://www.svt.se/nyheter/lokalt/vast/journalsystemet-millennium-anmals-till-lakemedelsverket-igen", "theme": "record_wrong", "status": "admitted" }, { "date": "2025-02-12", "headline": "Patient identity numbers, some linked to diagnosis codes, offered for sale after hack", "paraphrase": "A ransomware attack hit a private hospital's administrative systems. The clinical record system was not affected, but personal identity numbers, in some cases linked to diagnosis codes, were stolen and put up for sale. The hospital refused to pay.", "source": "Läkartidningen", "url": "https://lakartidningen.se/aktuellt/nyheter/2025/02/chefslakare-om-hackerattacken-det-var-dramatiskt/", "theme": "breach", "status": "admitted" }, { "date": "2025-11-18", "headline": "Region's own review recommends scrapping its troubled patient record system", "paraphrase": "A region's 90-page internal report found unclear saving of notes, wrong sample labels, medication lists that could not be printed and prescriptions failing to send. The region had filed ten serious-incident reports and the review recommended dropping the system.", "source": "Vårdfokus", "url": "https://www.vardfokus.se/nyheter/rapport-uppmanar-vastra-gotaland-att-skrota-millennium-krangligt-och-ologiskt/", "theme": "other", "status": "admitted" }, { "date": "2026-05-28", "headline": "Another patient's health declaration was filed in the wrong patient's record", "paraphrase": "A health declaration belonging to one patient was placed in another patient's record ahead of planned care. The error was found later. The region reported it under the serious-incident law, saying the wrong information could have affected safety.", "source": "Skillingaryd.nu", "url": "https://skillingaryd.nu/vaggeryd/nyheter/halsodeklaration-infor-operation-bifogades-i-fel-journal/", "theme": "record_wrong", "status": "admitted" }, { "date": "2026-06-04", "headline": "Nurse convicted for years of unauthorised lookups in patients' records", "paraphrase": "A district court convicted a former nurse of data intrusion for unauthorised record lookups over several years, ordering a conditional sentence and 115,000 kronor in damages. Nineteen cases were tried; about 60 people had reported her to police.", "source": "SVT Nyheter", "url": "https://www.svt.se/nyheter/lokalt/orebro/efter-otillatna-journalslagningar-sjukskoterskan-doms-till-villkorlig-dom", "theme": "breach", "status": "finding" } ] }, { "iso3": "AUS", "name": "Australia", "region": "Oceania", "overall": 66, "rank": "6=", "likelyRank": "2 to 20", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Australia's opt-out national record holds over 25 million records patients can lock and audit, and test results now upload to it by default.", "categories": { "access": { "score": 70, "summary": "My Health Record held 25.16 million records in July 2026, and from 1 July 2026 pathology and imaging reports must be uploaded by default. It is a summary, not the full chart, and copies from providers may carry a fee.", "sources": [ { "title": "My Health Record statistics and insights, July 2026 (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/sites/default/files/documents/my-health-record-statistics-july-2026-landscape.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "Australians already seeing the benefits of sharing health information by default (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/newsroom/media/australians-already-seeing-the-benefits-of-sharing-health-information-by-default", "date": "2026-07-08", "publisherClass": "official" }, { "title": "Access your health information (OAIC)", "url": "https://www.oaic.gov.au/privacy/your-privacy-rights/health-information/access-your-health-information", "date": "undated", "publisherClass": "official" }, { "title": "About My Health Record (healthdirect, Australian Government)", "url": "https://www.healthdirect.gov.au/my-health-record", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 68, "summary": "People can cancel the record, lock it or single documents with access codes, stop uploads, and read an access log with alerts. But the default lets every treating provider see everything, and only about 72,000 people use advanced access controls.", "sources": [ { "title": "My Health Record access controls (OAIC)", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/health-service-providers/my-health-record/my-health-record-access-controls", "date": "undated", "publisherClass": "official" }, { "title": "Manage your My Health Record (OAIC)", "url": "https://www.oaic.gov.au/privacy/your-privacy-rights/health-information/my-health-record/manage-your-my-health-record", "date": "undated", "publisherClass": "official" }, { "title": "My Health Records Act 2012 (compilation C2026C00277, 1 July 2026)", "url": "https://www.legislation.gov.au/C2012A00063/latest/text", "date": "2026-07-01", "publisherClass": "legal_text" }, { "title": "My Health Record statistics and insights, July 2026 (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/sites/default/files/documents/my-health-record-statistics-july-2026-landscape.pdf", "date": "2026-07", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million, the first civil penalties under the Privacy Act, for a pathology breach. Yet health providers led 2025 breach notifications with 225 of a record 1,205.", "sources": [ { "title": "Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach (OAIC)", "url": "https://www.oaic.gov.au/news/media-centre/australian-clinical-labs-ordered-to-pay-penalties-in-relation-to-medlab-pathology-data-breach-in-first-for-privacy-act", "date": "2025-10-09", "publisherClass": "official" }, { "title": "Data breach notifications increase to all-time high in 2025, new NDB stats show (OAIC)", "url": "https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show", "date": "2026-07-06", "publisherClass": "official" }, { "title": "Annual report of the Australian Information Commissioner's activities in relation to digital health 2024-25 (OAIC)", "url": "https://www.oaic.gov.au/about-the-OAIC/our-corporate-information/digital-health-annual-reports/annual-report-of-the-australian-information-commissioners-activities-in-relation-to-digital-health-202425", "date": "2025-10-20", "publisherClass": "official" }, { "title": "Australia publishes initial proposals for second wave of Privacy Act reforms (IAPP)", "url": "https://iapp.org/news/a/australia-publishes-initial-proposals-for-second-wave-of-privacy-act-reforms", "date": "2026-08-31", "publisherClass": "news" } ] }, "journey": { "score": 70, "summary": "One national record links GPs, pharmacies, public hospitals, labs and imaging: 99% of GPs and pharmacies and 97% of public hospitals are registered. Specialists and aged care lag, and the national exchange program is still being built.", "sources": [ { "title": "My Health Record statistics and insights, July 2026 (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/sites/default/files/documents/my-health-record-statistics-july-2026-landscape.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "Health Connect Australia (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/health-connect-australia", "date": "undated", "publisherClass": "official" }, { "title": "Understanding the Exploration of Electronic Prescriptions in Australia (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/newsroom/blogs/understanding-the-exploration-of-electronic-prescriptions-in-australia", "date": "2025-10-10", "publisherClass": "official" }, { "title": "My Health Record (Share by Default) Rules 2025 (F2025L01569)", "url": "https://www.legislation.gov.au/F2025L01569/asmade/text", "date": "2025-12-12", "publisherClass": "legal_text" } ] }, "commercial": { "score": 65, "summary": "The My Health Records Act bans use of record data for insurance underwriting or employment, with civil penalties of 1,500 penalty units. In June 2026 the regulator ruled that health websites need consent before tracking pixels feed advertising.", "sources": [ { "title": "My Health Records Act 2012 (compilation C2026C00277, 1 July 2026)", "url": "https://www.legislation.gov.au/C2012A00063/latest/text", "date": "2026-07-01", "publisherClass": "legal_text" }, { "title": "Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation (OAIC)", "url": "https://www.oaic.gov.au/news/media-centre/privacy-commissioner-finds-privacy-breaches-in-third-party-tracking-pixel-investigation", "date": "2026-06-24", "publisherClass": "official" }, { "title": "Secondary use of data (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/initiatives-and-programs/my-health-record/manage-your-record/privacy-and-access/secondary-use-of-data", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 66, "summary": "GPs, pharmacists and public hospital staff can open a patient's national record at the point of care, with an emergency override. But it holds summaries and reports, not each provider's full notes, and specialist use is low.", "sources": [ { "title": "My Health Record access controls (OAIC)", "url": "https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/health-service-providers/my-health-record/my-health-record-access-controls", "date": "undated", "publisherClass": "official" }, { "title": "My Health Records Act 2012 (compilation C2026C00277, 1 July 2026)", "url": "https://www.legislation.gov.au/C2012A00063/latest/text", "date": "2026-07-01", "publisherClass": "legal_text" }, { "title": "My Health Record statistics and insights, July 2026 (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/sites/default/files/documents/my-health-record-statistics-july-2026-landscape.pdf", "date": "2026-07", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "People can switch off research use of their My Health Record, but that data has not yet been released and other health data has no general opt-out. Ethics committees can approve use without consent under NHMRC guidelines, inside a registered data-sharing scheme.", "sources": [ { "title": "Secondary use of data (Australian Digital Health Agency)", "url": "https://www.digitalhealth.gov.au/initiatives-and-programs/my-health-record/manage-your-record/privacy-and-access/secondary-use-of-data", "date": "undated", "publisherClass": "official" }, { "title": "Guidelines approved under Section 95A of the Privacy Act 1988 (NHMRC)", "url": "https://www.nhmrc.gov.au/about-us/publications/guidelines-approved-under-section-95a-privacy-act-1988", "date": "2024", "publisherClass": "official" }, { "title": "The DATA Scheme safeguards (Office of the National Data Commissioner)", "url": "https://www.datacommissioner.gov.au/data-scheme/data-scheme-safeguards", "date": "undated", "publisherClass": "official" }, { "title": "My Health Records Act 2012 (compilation C2026C00277, 1 July 2026)", "url": "https://www.legislation.gov.au/C2012A00063/latest/text", "date": "2026-07-01", "publisherClass": "legal_text" } ] }, "ai": { "score": 55, "summary": "The TGA regulates AI software that meets the device definition, requires notice of significant changes, and is starting compliance action on AI scribes. But change control for adaptive AI is case by case, no human oversight mandate exists, and mandatory AI guardrails were dropped.", "sources": [ { "title": "Report: Clarifying and strengthening the regulation of Medical Device Software including AI, v1.0 (TGA)", "url": "https://consultations.tga.gov.au/tga/clarifying-and-strengthening-the-regulation-of-ai/supporting_documents/tga-report-clarifying-and-strengthening-the-regulation-of-medical-device-software-including-artificial-intelligence-aipdf", "date": "2025-07", "publisherClass": "official" }, { "title": "TGA AI Review: Outcomes report published (TGA)", "url": "https://www.tga.gov.au/news/news-articles/tga-ai-review-outcomes-report-published", "date": "2025-07-30", "publisherClass": "official" }, { "title": "TGA flags compliance action on AI scribes as review finds safety concerns (Medical Republic)", "url": "https://www.medicalrepublic.com.au/tga-flags-compliance-action-on-ai-scribes-as-review-finds-safety-concerns/127888", "date": "2026-08-04", "publisherClass": "news" }, { "title": "Government drops AI 'mandatory guardrails', reveals road map on data centres (ABC News)", "url": "https://www.abc.net.au/news/2025-12-02/national-artificial-intelligence-plan-growth-existing-laws/106086474", "date": "2025-12-02", "publisherClass": "news" } ] } }, "laws": [ { "name": "My Health Records Act 2012", "level": "National", "year": "2012", "what": "Opt-out national record; access controls, cancellation, insurance and employment bans, court order for agency access.", "url": "https://www.legislation.gov.au/C2012A00063/latest/text" }, { "name": "Health Legislation Amendment (Modernising My Health Record, Sharing by Default) Act 2025", "level": "National", "year": "2025", "what": "Requires prescribed providers to share key information to My Health Record by default.", "url": "https://www.legislation.gov.au/C2025A00008/asmade/text" }, { "name": "Privacy Act 1988", "level": "National", "year": "1988", "what": "Health data is sensitive information; right of access (APP 12), breach notification, civil penalties.", "url": "https://www.legislation.gov.au/C2004A03712/latest/text" }, { "name": "Privacy and Other Legislation Amendment Act 2024", "level": "National", "year": "2024", "what": "First tranche of reform: new OAIC enforcement powers, automated decision transparency, statutory privacy tort.", "url": "https://www.legislation.gov.au/C2024A00128/asmade/text" }, { "name": "Data Availability and Transparency Act 2022", "level": "National", "year": "2022", "what": "Accredited sharing of public sector data with registered agreements and a re-identification ban.", "url": "https://www.legislation.gov.au/C2022A00011/latest/text" }, { "name": "Therapeutic Goods Act 1989", "level": "National", "year": "1989", "what": "Regulates medical devices, including software and AI that meet the device definition.", "url": "https://www.legislation.gov.au/C2004A03952/latest/text" }, { "name": "Health Records and Information Privacy Act 2002 (NSW)", "level": "State/Provincial", "year": "2002", "what": "Right to access health information held by NSW public and private providers.", "url": "https://legislation.nsw.gov.au/view/html/inforce/current/act-2002-071" } ], "dti": { "grade": 81, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-08-14", "headline": "AI note-taker put a false statement into a patient's specialist letter", "paraphrase": "A patient agreed to have a specialist appointment transcribed by an AI tool. She later found a letter to her GP claimed something she says she never said. After she complained, the specialist apologised and corrected it.", "source": "ABC News", "url": "https://www.abc.net.au/news/2026-08-14/ai-medical-scribe-error-leaves-patient-devastated/107031672", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-07-22", "headline": "Another woman's hospital history merged into a patient's record; family told she died", "paraphrase": "Months of another woman's appointments and tests were added to a Victorian woman's health record. The other woman flagged wrong details four times. After she died, police told the patient's family she was dead. Mercy Health apologised.", "source": "ABC News", "url": "https://www.abc.net.au/news/2026-07-22/mistaken-identity-data-hospital-error-death-notice-police/106936454", "theme": "record_wrong", "status": "admitted" }, { "date": "2025-11-21", "headline": "Doctor passed a patient's record details to her estranged partner, tribunal finds", "paraphrase": "A doctor in Western Australia opened a patient's records on 12 days and passed details to her estranged partner despite a restraining order. The State Administrative Tribunal found misconduct and the doctor was deregistered.", "source": "ABC News", "url": "https://www.abc.net.au/news/2025-11-21/perth-doctor-suspended-for-patient-confidentiality-breach/106034508", "theme": "breach", "status": "finding" }, { "date": "2026-06-30", "headline": "Former patients still locked out of their records months after clinic closed", "paraphrase": "A general practice in regional Victoria closed without warning. More than five months later its former patients still could not get their medical records, which remained under the closed practice's control while health agencies sought a fix.", "source": "South Gippsland Sentinel-Times", "url": "https://www.sgst.com.au/leongatha-patients-still-locked-out-of-medical-records/", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2026-03-10", "headline": "Minister's office accused of giving a patient's health details to journalists", "paraphrase": "After a South Australian patient spoke publicly about her care, the state health minister's office shared confidential details about her with journalists, the opposition claimed. She says she did not consent.", "source": "InDaily (South Australia)", "url": "https://www.indailysa.com.au/news/just-in/2026/03/10/second-labor-govt-patient-information-leak-liberals-claim", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "FRA", "name": "France", "region": "Europe", "overall": 66, "rank": "6=", "likelyRank": "2 to 20", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Nearly everyone has an opt-out Mon espace santé with blocking and an access history, but only a third use it and vendors leak.", "categories": { "access": { "score": 70, "summary": "French law gives a free right to the whole record within 8 days, and Mon espace santé exists for about 97% of people by default. It holds documents providers deposit, not the full chart, and only 33.6% of accounts are activated.", "sources": [ { "title": "Accès au dossier médical (Service-Public.fr, vérifié le 28 février 2025)", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F12210", "date": "2025-02-28", "publisherClass": "official" }, { "title": "Mon espace santé (Service-Public.fr, vérifié le 31 décembre 2025)", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F10872", "date": "2025-12-31", "publisherClass": "official" }, { "title": "En 2026, Mon espace santé amorce un nouveau virage (ARS Nouvelle-Aquitaine, communiqué)", "url": "https://www.nouvelle-aquitaine.ars.sante.fr/communique-de-presse-en-2026-mon-espace-sante-amorce-un-nouveau-virage-pour-devenir-loutil-central", "date": "2026-02-06", "publisherClass": "official" } ] }, "control": { "score": 68, "summary": "Mon espace santé is opt-out, but inside it patients can block named professionals, hide documents, get a notification when a professional connects and read an activity history. Emergency staff can open the record unless the patient objected.", "sources": [ { "title": "Mon espace santé (Service-Public.fr, vérifié le 31 décembre 2025)", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F10872", "date": "2025-12-31", "publisherClass": "official" }, { "title": "Mon Espace Santé, le service public numérique (ARS Centre-Val de Loire)", "url": "https://www.centre-val-de-loire.ars.sante.fr/mon-espace-sante-le-service-public-numerique-pour-faciliter-les-echanges-entre-patient-et-3", "date": "2026-09-09", "publisherClass": "official" } ] }, "privacy": { "score": 58, "summary": "CNIL enforces in health, with a 5 million euro fine on IQVIA and a 500,000 euro fine on a private hospital in 2026. But a software attack may have exposed data of about 15 million patients, about 164,000 with sensitive data (not necessarily health data).", "sources": [ { "title": "Violation de données en matière de santé : sanction de 500 000 euros à l'encontre de l'Hôpital privé de la Loire (CNIL)", "url": "https://www.cnil.fr/fr/sanction-hopital-prive-loire", "date": "2026-09-03", "publisherClass": "official" }, { "title": "Cegedim : l'État acte l'ampleur de la fuite (Caducée.net)", "url": "https://www.caducee.net/actualite-medicale/16822/cegedim-l-etat-acte-l-ampleur-de-la-fuite-et-precise-le-risque-donnees-sensibles-pour-164-000-personnes.html", "date": "2026-02-28", "publisherClass": "news" }, { "title": "Code de la santé publique, article L1111-8 (copy of the official text, Espace éthique Hauts-de-France)", "url": "https://www.ethique-hdf.fr/fileadmin/user_upload/Article_L1111-8_CSP_-_Hebergement_des_donnees_de_sante_a_caractere_personnel.pdf", "date": "2017-01-12", "publisherClass": "legal_text" }, { "title": "Scaleway devient l'hébergeur du Health Data Hub (Le Monde Informatique)", "url": "https://www.lemondeinformatique.fr/actualites/lire-scaleway-devient-l-hebergeur-du-health-data-hub-99998.html", "date": "2026-04-23", "publisherClass": "news" } ] }, "journey": { "score": 72, "summary": "The SNDS links insurance claims, hospital stays, causes of death and disability data nationally, and providers must deposit key documents in Mon espace santé. Feeding is high but uneven, and software for reading the record is being upgraded.", "sources": [ { "title": "SNDS : Système national des données de santé (CNIL)", "url": "https://www.cnil.fr/fr/snds-systeme-national-des-donnees-de-sante", "date": "2017-03-30", "publisherClass": "official" }, { "title": "Mon espace santé (Service-Public.fr, vérifié le 31 décembre 2025)", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F10872", "date": "2025-12-31", "publisherClass": "official" }, { "title": "En 2026, Mon espace santé amorce un nouveau virage (ARS Nouvelle-Aquitaine, communiqué)", "url": "https://www.nouvelle-aquitaine.ars.sante.fr/communique-de-presse-en-2026-mon-espace-sante-amorce-un-nouveau-virage-pour-devenir-loutil-central", "date": "2026-02-06", "publisherClass": "official" } ] }, "commercial": { "score": 66, "summary": "French law bans selling identifying health data even with consent, and bars using the national claims database to promote health products or price insurance. Yet IQVIA built warehouses on tens of millions of people from pharmacy data customers were not told about.", "sources": [ { "title": "Code de la santé publique, article L1111-8 (copy of the official text, Espace éthique Hauts-de-France)", "url": "https://www.ethique-hdf.fr/fileadmin/user_upload/Article_L1111-8_CSP_-_Hebergement_des_donnees_de_sante_a_caractere_personnel.pdf", "date": "2017-01-12", "publisherClass": "legal_text" }, { "title": "SNDS : Système national des données de santé (CNIL)", "url": "https://www.cnil.fr/fr/snds-systeme-national-des-donnees-de-sante", "date": "2017-03-30", "publisherClass": "official" }, { "title": "Données de santé : sanction de 5 millions d'euros à l'encontre de la société IQVIA (CNIL)", "url": "https://www.cnil.fr/fr/donnees-sante-sanction-5-millions-iqvia", "date": "2026-05-28", "publisherClass": "official" }, { "title": "Mon Espace Santé, le service public numérique (ARS Centre-Val de Loire)", "url": "https://www.centre-val-de-loire.ars.sante.fr/mon-espace-sante-le-service-public-numerique-pour-faciliter-les-echanges-entre-patient-et-3", "date": "2026-09-09", "publisherClass": "official" } ] }, "clinical": { "score": 62, "summary": "Treating professionals the patient has not blocked can read the shared record, and emergency access applies unless refused. About 70,000 professionals, 38,000 of them private doctors, consult records each month, and software ease of use is still poor.", "sources": [ { "title": "Mon espace santé (Service-Public.fr, vérifié le 31 décembre 2025)", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F10872", "date": "2025-12-31", "publisherClass": "official" }, { "title": "En 2026, Mon espace santé amorce un nouveau virage (ARS Nouvelle-Aquitaine, communiqué)", "url": "https://www.nouvelle-aquitaine.ars.sante.fr/communique-de-presse-en-2026-mon-espace-sante-amorce-un-nouveau-virage-pour-devenir-loutil-central", "date": "2026-02-06", "publisherClass": "official" }, { "title": "Mon Espace Santé, le service public numérique (ARS Centre-Val de Loire)", "url": "https://www.centre-val-de-loire.ars.sante.fr/mon-espace-sante-le-service-public-numerique-pour-faciliter-les-echanges-entre-patient-et-3", "date": "2026-09-09", "publisherClass": "official" } ] }, "research": { "score": 60, "summary": "People can object to research use of their SNDS data, private users need CNIL authorisation and every project is listed publicly. The opt-out is exercised by writing to one's insurance fund and does not cover state public health missions.", "sources": [ { "title": "SNDS : Système national des données de santé (CNIL)", "url": "https://www.cnil.fr/fr/snds-systeme-national-des-donnees-de-sante", "date": "2017-03-30", "publisherClass": "official" }, { "title": "Protection de la donnée (snds.gouv.fr)", "url": "https://www.snds.gouv.fr/SNDS/Protection-de-la-donnee", "date": "undated", "publisherClass": "official" }, { "title": "Tous les projets, répertoire public (Plateforme des données de santé)", "url": "https://www.health-data-hub.fr/projets", "date": "undated", "publisherClass": "official" }, { "title": "Publication de la stratégie nationale sur l'intelligence artificielle et les données de santé (Health Data Hub)", "url": "https://www.health-data-hub.fr/actualites/publication-de-la-strategie-nationale-sur-lintelligence-artificielle-et-les-donnees-de", "date": "2025-11-27", "publisherClass": "official" } ] }, "ai": { "score": 54, "summary": "Clinical AI falls under EU device law and the AI Act, plus HAS hospital certification criteria on AI risk since September 2025. A 2021 law requires patients be told when AI devices are used, but its implementing order was not found.", "sources": [ { "title": "Digital Omnibus on AI has been published (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" }, { "title": "Certification des établissements de santé : lancement officiel du 6e cycle (HAS)", "url": "https://www.has-sante.fr/jcms/p_3643724/fr/certification-des-etablissements-de-sante-lancement-officiel-du-6e-cycle-au-1er-septembre-2025", "date": "2025-09-04", "publisherClass": "official" }, { "title": "Principaux textes réglementant l'intelligence artificielle (Conseil national de l'Ordre des médecins)", "url": "https://www.conseil-national.medecin.fr/medecin/exercice/principaux-textes-reglementant-lintelligence-artificielle", "date": "undated", "publisherClass": "official" }, { "title": "Guide HAS/CNIL, bon usage des systèmes d'IA en contexte de soins (AP-HP, Direction des affaires juridiques)", "url": "https://affairesjuridiques.aphp.fr/textes/guide-has-cnil-accompagner-le-bon-usage-des-systemes-dintelligence-artificielle-en-contexte-de-soins-fevrier-2026/", "date": "2026-02-18", "publisherClass": "official" } ] } }, "laws": [ { "name": "Code de la santé publique, L1110-4 and R1111-1 to R1111-7", "level": "National", "year": "2004", "what": "Medical secrecy and free patient access to health information within 8 days, 2 months if older.", "url": "https://www.service-public.gouv.fr/particuliers/vosdroits/F12210" }, { "name": "Code de la santé publique, article L1111-8 (health data hosting)", "level": "National", "year": "2017", "what": "Certified hosting of health data; bans paid transfer of identifying health data, even with consent.", "url": "https://www.ethique-hdf.fr/fileadmin/user_upload/Article_L1111-8_CSP_-_Hebergement_des_donnees_de_sante_a_caractere_personnel.pdf" }, { "name": "Loi de modernisation de notre système de santé (SNDS)", "level": "National", "year": "2016", "what": "Created the SNDS; bans product promotion and insurance pricing uses; research opt-out.", "url": "https://www.cnil.fr/fr/snds-systeme-national-des-donnees-de-sante" }, { "name": "Code de la santé publique, article L4001-3 (bioethics law)", "level": "National", "year": "2021", "what": "Patients informed when AI-based medical devices are used; designers must ensure explicability.", "url": "https://www.conseil-national.medecin.fr/medecin/exercice/principaux-textes-reglementant-lintelligence-artificielle" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health data is a special category (Art. 9); access right, breach notification, large fines.", "url": "https://www.cnil.fr/fr/reglement-europeen-protection-donnees" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access logs, restriction rights and secondary-use opt-out; key parts apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk rules for AI; high-risk AI in regulated products applies from 2 August 2028.", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-02-13", "headline": "Top court upholds fine over patient data passed on without true anonymisation", "paraphrase": "Doctors' software gathered patients' health data, such as prescriptions and sick leave, with identifiers that allowed care pathways to be traced. The court agreed the data were not anonymous and rejected the company's challenge to an 800,000 euro fine.", "source": "Conseil d'État", "url": "https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2026-02-13/498628", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-02-20", "headline": "Court backs family's right to see hospital's adverse-event report on a relative", "paraphrase": "A hospital refused to give a woman the serious adverse-event report it filed after her brother died. The courts ordered release of the parts about his health and care, and the hospital's appeal was rejected.", "source": "Conseil d'État", "url": "https://www.conseil-etat.fr/fr/arianeweb/CE/decision/2025-02-20/493519", "theme": "access_refused", "status": "finding" }, { "date": "2024-11-19", "headline": "Hospital records of about 750,000 people posted online after stolen login used", "paraphrase": "A hacker posted a database of about 758,000 people taken from hospital management software, including contact details, treating doctor, prescriptions and death declarations. The software maker said a privileged account at a client hospital was misused.", "source": "Clubic", "url": "https://www.clubic.com/actualite-544139-fichiers-et-dossiers-patients-sensibles-francais-en-fuite-sur-le-dark-web-que-se-passe-t-il.html", "theme": "breach", "status": "admitted" }, { "date": "2026-02-27", "headline": "Doctors' private notes on patients exposed in attack on medical software", "paraphrase": "Attackers reached files of 1,500 doctors using one practice software. Administrative data on 15 million patients leaked, and the health minister said sensitive doctor annotations on 164,000 patients were exposed. The vendor said structured medical records were intact.", "source": "franceinfo", "url": "https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/quinze-millions-de-patients-concernes-1-500-medecins-vises-une-enquete-ouverte-ce-que-l-on-sait-de-la-cyberattaque-qui-a-cible-un-logiciel-medical_7833611.html", "theme": "breach", "status": "admitted" }, { "date": "2026-03-30", "headline": "Lab network says attackers reached patient analysis reports and social security numbers", "paraphrase": "A national lab network reported unauthorised access, through a server run by an outside IT supplier, to patient names, emails, encrypted passwords, analysis reports and social security numbers. It was the network's second attack in about a year.", "source": "Le Moniteur des pharmacies", "url": "https://www.lemoniteurdespharmacies.fr/business/numerique/digitalisation/cerballiance-une-cyberattaque-expose-les-donnees-de-millions-de-patients", "theme": "breach", "status": "admitted" } ] }, { "iso3": "NOR", "name": "Norway", "region": "Europe", "overall": 66, "rank": "6=", "likelyRank": "2 to 20", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Norwegians control a national core record with opt-out, blocks and a lookup log, but full notes rarely follow them between GP, hospital and municipality.", "categories": { "access": { "score": 68, "summary": "Norway has a statutory right to see and copy the whole record, and Helsenorge logged 104.7 million logins in 2025. But GP records are not on Helsenorge, and the Commission found imaging reports and images are not online at all.", "sources": [ { "title": "Lov om pasient- og brukerrettigheter (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/1999-07-02-63/KAPITTEL_5", "date": "2026-06-19", "publisherClass": "legal_text" }, { "title": "Om Pasientjournal (Helsenorge)", "url": "https://www.helsenorge.no/pasientjournal/om/", "date": "undated", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, Annex: Country Factsheets (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/53637948-66ce-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "Antall innlogginger på Helsenorge (Helsedirektoratet)", "url": "https://www.helsedirektoratet.no/statistikk/nasjonal-digitaliseringsmonitor/antall-innlogginger-pa-helsenorge--selvbetjeningslosninger", "date": "2026-04-28", "publisherClass": "official" } ] }, "control": { "score": 74, "summary": "Patients can opt out of the national Kjernejournal, block all or some items, block named staff even in emergencies, and read a log of who looked. A 2026 law adds a right to see which data were shared, while widening direct access between providers.", "sources": [ { "title": "Kjernejournal: spørsmål og svar (Norsk helsenett)", "url": "https://www.nhn.no/tjenester/kjernejournal/sporsmal-og-svar", "date": "undated", "publisherClass": "official" }, { "title": "Lov om behandling av helseopplysninger ved ytelse av helsehjelp (pasientjournalloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-42", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Lov om pasient- og brukerrettigheter (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/1999-07-02-63/KAPITTEL_5", "date": "2026-06-19", "publisherClass": "legal_text" }, { "title": "Lov 23. januar 2026 nr. 1 om endringer i helsepersonelloven og pasientjournalloven mv. (Lovdata)", "url": "https://lovdata.no/dokument/LTI/lov/2026-01-23-1", "date": "2026-01-23", "publisherClass": "legal_text" } ] }, "privacy": { "score": 62, "summary": "GDPR applies through the EEA, and the regulator found major gaps in the Helseplattformen record system in December 2025 after many breach reports. Health enforcement is mostly orders and reprimands: in 2025 an online pharmacy and a doctor service got reprimands for tracking pixels.", "sources": [ { "title": "Varsel om pålegg om retting til Helseplattformen AS (Datatilsynet)", "url": "https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2025/varsel-om-palegg-til-helseplattformen-as/", "date": "2025-12-02", "publisherClass": "official" }, { "title": "Ulovlig deling av personopplysninger gjennom sporingspiksler hos seks nettsteder (Datatilsynet)", "url": "https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2025/ulovlig-deling-av-personopplysninger-gjennom-sporingspiksler-hos-seks-nettsteder/", "date": "2025-06-12", "publisherClass": "official" }, { "title": "Lov om helseregistre og behandling av helseopplysninger (helseregisterloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-43", "date": "2025-12-22", "publisherClass": "legal_text" }, { "title": "Statsforvalteren åpner tilsyn etter snoking i pasientjournal ved Helgelandssykehuset (Dagens Medisin/NTB)", "url": "https://www.dagensmedisin.no/arbeidsliv-helgelandssykehuset-pasientjournal/statsforvalteren-apner-tilsyn-etter-snoking-i-pasientjournal-ved-helgelandssykehuset/726961", "date": "2026-01-12", "publisherClass": "news" } ] }, "journey": { "score": 66, "summary": "Kjernejournal is available in all hospitals and 90% of GP offices, and about 93% of prescriptions are electronic. But the shared medication list only began national rollout in 2026, Central Norway has not started it, and GP records do not feed the core record.", "sources": [ { "title": "Kjernejournal: spørsmål og svar (Norsk helsenett)", "url": "https://www.nhn.no/tjenester/kjernejournal/sporsmal-og-svar", "date": "undated", "publisherClass": "official" }, { "title": "Om e-resept (Norsk helsenett)", "url": "https://www.nhn.no/tjenester/e-resept/om-e-resept", "date": "undated", "publisherClass": "official" }, { "title": "Plan og status for innføring av pasientens legemiddelliste (Helsedirektoratet)", "url": "https://www.helsedirektoratet.no/digitalisering-og-e-helse/pasientens-legemiddelliste/plan-for-utproving", "date": "2026-09-30", "publisherClass": "official" }, { "title": "Det europeiske helsedataområdet: høring av gjennomføringsregelverk (Stortinget EU/EØS-nytt)", "url": "https://www.stortinget.no/no/Hva-skjer-pa-Stortinget/EU-EOS-informasjon/EU-EOS-nytt/2026/eueos-nytt---16.-april-2026/det-europeiske-helsedataomradet--horing-av-gjennomforingsregelverk/", "date": "2026-04-16", "publisherClass": "official" } ] }, "commercial": { "score": 64, "summary": "The Health Registry Act bars registry data from going to employers, insurers or prosecutors even with the person's consent, and a 2026 law limits what insurers can get from records. We found no Norwegian ban on selling health data beyond GDPR.", "sources": [ { "title": "Lov om helseregistre og behandling av helseopplysninger (helseregisterloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-43", "date": "2025-12-22", "publisherClass": "legal_text" }, { "title": "Lov om helsepersonell (helsepersonelloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/1999-07-02-64", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Lov 23. januar 2026 nr. 1 om endringer i helsepersonelloven og pasientjournalloven mv. (Lovdata)", "url": "https://lovdata.no/dokument/LTI/lov/2026-01-23-1", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Ulovlig deling av personopplysninger gjennom sporingspiksler hos seks nettsteder (Datatilsynet)", "url": "https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2025/ulovlig-deling-av-personopplysninger-gjennom-sporingspiksler-hos-seks-nettsteder/", "date": "2025-06-12", "publisherClass": "official" } ] }, "clinical": { "score": 68, "summary": "Any clinician with a work need can open Kjernejournal at every hospital and most GP offices, with an emergency override for blocks. Full notes from other providers stay hard to reach, since GP records are not shared and document sharing is early.", "sources": [ { "title": "Kjernejournal: spørsmål og svar (Norsk helsenett)", "url": "https://www.nhn.no/tjenester/kjernejournal/sporsmal-og-svar", "date": "undated", "publisherClass": "official" }, { "title": "Lov om helsepersonell (helsepersonelloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/1999-07-02-64", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Pasientens journaldokumenter: status og ambisjoner for innføring (Helsedirektoratet)", "url": "https://www.helsedirektoratet.no/digitalisering-og-e-helse/pasientens-journaldokumenter-pjd/status-og-ambisjoner-for-innforing", "date": "2026-03-18", "publisherClass": "official" }, { "title": "Pasientens prøvesvar (Norsk helsenett)", "url": "https://www.nhn.no/tjenester/pasientens-provesvar", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Central health registries are used for research without consent or a general opt-out, inside permits, secrecy rules and criminal penalties. Some registries allow a partial opt-out, and the Health Data Service delivered data to 513 applicants and projects in 2025.", "sources": [ { "title": "Lov om helseregistre og behandling av helseopplysninger (helseregisterloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-43", "date": "2025-12-22", "publisherClass": "legal_text" }, { "title": "Lov om medisinsk og helsefaglig forskning (helseforskningsloven) (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2008-06-20-44", "date": "2025-06-20", "publisherClass": "legal_text" }, { "title": "Reservasjonsrett i Kommunalt pasient- og brukerregister (FHI)", "url": "https://www.fhi.no/he/kpr/reservasjonsrett-i-kpr/", "date": "2024-03-05", "publisherClass": "official" }, { "title": "Kortere behandlingstid og økt utlevering av helsedata i 2025 (FHI)", "url": "https://www.fhi.no/nyheter/2026/kortere-behandlingstid-og-okt-utlevering-av-data-i-2025/", "date": "2026-01-23", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device rules applied through the 2020 Medical Devices Act, but the EU AI Act is not yet part of the EEA Agreement. A Norwegian AI bill is planned for spring 2027, and health agencies offer guidance, not binding rules.", "sources": [ { "title": "Lov om medisinsk utstyr (Lovdata)", "url": "https://lovdata.no/dokument/NL/lov/2020-05-07-37", "date": "2026-06-19", "publisherClass": "legal_text" }, { "title": "Nye krav til KI-merking i EU: hva betyr dette for Norge? (Nkom)", "url": "https://nkom.no/ki/regulering/nye-krav-til-ki-merking-i-eu--hva-betyr-dette-for-norge", "date": "2026-08-10", "publisherClass": "official" }, { "title": "Kunstig intelligens (Helsedirektoratet)", "url": "https://www.helsedirektoratet.no/digitalisering-og-e-helse/kunstig-intelligens", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Patient and User Rights Act (pasient- og brukerrettighetsloven)", "level": "National", "year": "1999", "what": "Right to see and copy the whole record (section 5-1); right to object to sharing (section 5-3).", "url": "https://lovdata.no/dokument/NL/lov/1999-07-02-63/KAPITTEL_5" }, { "name": "Patient Records Act (pasientjournalloven)", "level": "National", "year": "2014", "what": "Basis for Kjernejournal with opt-out (sections 13, 17); disclosure log patients can see (section 22 a).", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-42" }, { "name": "Health Registry Act (helseregisterloven)", "level": "National", "year": "2014", "what": "Central registries without consent; 30 or 60 working day release deadlines; no data to employers or insurers.", "url": "https://lovdata.no/dokument/NL/lov/2014-06-20-43" }, { "name": "Act of 23 January 2026 no. 1 on secrecy and sharing of patient data", "level": "National", "year": "2026", "what": "From 1 July 2026, widens direct access between providers and requires logs of shared data.", "url": "https://lovdata.no/dokument/LTI/lov/2026-01-23-1" }, { "name": "Health Research Act (helseforskningsloven)", "level": "National", "year": "2008", "what": "Consent as main rule for health research; public list of projects; amendments in force 1 November 2026.", "url": "https://lovdata.no/dokument/NL/lov/2008-06-20-44" }, { "name": "Medical Devices Act (lov om medisinsk utstyr)", "level": "National", "year": "2020", "what": "Applies the EU device regulations (MDR, IVDR) in Norway, covering medical AI software.", "url": "https://lovdata.no/dokument/NL/lov/2020-05-07-37" }, { "name": "General Data Protection Regulation (via EEA Agreement)", "level": "Supranational", "year": "2016", "what": "Health data as special category; access rights; fines enforced by Datatilsynet.", "url": "https://lovdata.no/dokument/NL/lov/2018-06-15-38" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-06-11", "headline": "Doctors warn records moved to new system arrive with missing documents and wrong dates", "paraphrase": "Doctors said moving 25 years of patient records into a new system produced missing documents, absent operation notes and wrong dates. The regional health authority confirmed only about half of 200 million documents had been moved.", "source": "NRK", "url": "https://www.nrk.no/mr/legar-i-midt-noreg-fryktar-overforing-av-data-til-helseplattforma-trugar-pasient-tryggleiken-1.17437171", "theme": "record_wrong", "status": "admitted" }, { "date": "2025-06-16", "headline": "System change missed messages from outside hospitals in thousands of patient cases", "paraphrase": "A record-system change made in 2023 failed to flag certain messages about discharge reports from other hospitals and specialists. Hospitals identified 3,445 cases needing review. The hospital said an early check found some needed follow-up.", "source": "VG", "url": "https://www.vg.no/nyheter/i/kw9yaX/to-aar-gammel-endring-i-helseplattformen-kan-ha-rammet-pasienter", "theme": "lost_between_providers", "status": "admitted" }, { "date": "2025-09-10", "headline": "Municipal employee read patient records without reason for about 15 years", "paraphrase": "A random audit found an employee had looked into municipal care records without a work reason for around 15 years, affecting about 2,100 residents. The municipality reported it to police and said it saw no sign of onward sharing.", "source": "NRK", "url": "https://www.nrk.no/nordland/vefsn-kommune_-ansatt-snek-i-pasientjournaler-i-15-ar-1.17565826", "theme": "breach", "status": "admitted" }, { "date": "2026-04-15", "headline": "Patient spotted repeated snooping in their own access log; regulator found breaches", "paraphrase": "A patient saw in the national health portal that a hospital worker had opened their record on several dates without reason. The county governor found clear breaches of confidentiality but closed the case without sanction.", "source": "NRK", "url": "https://www.nrk.no/sorlandet/sykehusansatt-snoket-i-pasientjournal---slipper-straff-1.17846230", "theme": "breach", "status": "finding" }, { "date": "2025-12-02", "headline": "Regulator finds significant privacy failings in a regional patient record system", "paraphrase": "After complaints and breach reports, the data protection authority inspected the record system used by hospitals and municipalities in central Norway. It found significant deficiencies, privacy breaches and unclear responsibilities, and gave notice of a correction order.", "source": "Dagens Medisin (NTB)", "url": "https://www.dagensmedisin.no/datatilsynet-e-helse-helse-midt-norge-rhf/datatilsynet-kritiserer-helseplattformen-etter-tilsyn-varsler-palegg-om-retting/720948", "theme": "other", "status": "finding" } ] }, { "iso3": "AUT", "name": "Austria", "region": "Europe", "overall": 65, "rank": "9", "likelyRank": "3 to 23", "band": "Strong", "keysModel": "Shared", "confidence": "high", "headline": "Austria's opt-out ELGA record gives strong controls and a full access log, but holds reports and medicines, not complete charts, and few use it.", "categories": { "access": { "score": 63, "summary": "Patients have a statutory right to see their records and get a free first copy, and the ELGA portal shows discharge letters, lab and radiology reports and 18 months of medicines. Images, GP notes and documents from before 2016 are missing, and uptake is low.", "sources": [ { "title": "Ärztegesetz 1998 § 51 Dokumentationspflicht und Auskunftserteilung (RIS)", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10011138&Paragraf=51", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "ELGA-Portal FAQ (ELGA GmbH)", "url": "https://www.elga.gv.at/faq/elga-portal/", "date": "undated", "publisherClass": "official" }, { "title": "Mit einer App die eigenen Befunde und Röntgenbilder sehen (Die Presse)", "url": "https://www.diepresse.com/20620100/mit-einer-app-die-eigenen-befunde-und-roentgenbilder-sehen", "date": "2026-02-24", "publisherClass": "news" }, { "title": "ELGA soll aus Dornröschenschlaf erwachen (Kronen Zeitung)", "url": "https://www.krone.at/3791556", "date": "2025-05-22", "publisherClass": "news" } ] }, "control": { "score": 72, "summary": "Everyone is in ELGA unless they opt out, fully or for e-reports or e-medication, and patients can hide or delete single documents, block a provider and read a full access log. There is no opt-out from the e-vaccination record or e-prescriptions.", "sources": [ { "title": "Gesundheitstelematikgesetz 2012, consolidated text (RIS)", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008120", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "ELGA-Portal FAQ (ELGA GmbH)", "url": "https://www.elga.gv.at/faq/elga-portal/", "date": "undated", "publisherClass": "official" }, { "title": "ELGA: Login und Teilnahme gestalten (Gesundheitsportal)", "url": "https://www.gesundheit.gv.at/gesundheitsleistungen/elga/elga-login-teilnahme.html", "date": "undated", "publisherClass": "official" }, { "title": "Elektronische Gesundheitsakte ELGA und ELGA GmbH, Bericht 2024/32 (Rechnungshof)", "url": "https://www.rechnungshof.gv.at/rh/home/home/2024_32_ELGA.pdf", "date": "2024-10-31", "publisherClass": "official" } ] }, "privacy": { "score": 63, "summary": "ELGA data may be used only for treatment, insurers and employers are barred by law, and unauthorised access carries fines up to EUR 10,000. But Austrian law forbids GDPR fines on public bodies and bodies acting under a legal mandate, and the regulator reports fewer staff.", "sources": [ { "title": "Gesundheitstelematikgesetz 2012, consolidated text (RIS)", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008120", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Datenschutzgesetz, consolidated text (RIS)", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Newsletter der Datenschutzbehörde Nr. 1/2026 (DSB)", "url": "https://dsb.gv.at/sites/site0344/media/downloads/nl0126bf.pdf", "date": "2026", "publisherClass": "official" }, { "title": "DSB Bescheid 2025-0.745.017, video surveillance in operating theatres (RIS)", "url": "https://ris.bka.gv.at/Dokumente/Dsk/DSBT_20260225_2025_0_745_017_00/DSBT_20260225_2025_0_745_017_00.pdf", "date": "2026-02-25", "publisherClass": "official" } ] }, "journey": { "score": 68, "summary": "Public hospitals, care homes, pharmacies and contracted doctors use ELGA, e-prescriptions replaced paper prescriptions, and outpatient labs and radiology must upload since July 2025. Specialist reports are not due until 2030 and there is no patient summary yet.", "sources": [ { "title": "Radiologie- und Laborbefunde ab Juli in der ELGA verfügbar (Sozialministerium)", "url": "https://www.sozialministerium.gv.at/Services/Aktuelles/Archiv-2025/ELGA-befunde.html", "date": "2025-01-28", "publisherClass": "official" }, { "title": "Ärztegesetz 1998 § 49 (RIS)", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10011138&Paragraf=49", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "ELGA-News: EU-Rezept, e-Impfpass, e-Bilddaten (ELGA GmbH)", "url": "https://www.elga.gv.at/news/", "date": "2026-02", "publisherClass": "official" }, { "title": "Patient Summary soll Versorgung erleichtern (medianet)", "url": "https://medianet.at/news/health-economy/patient-summary-soll-versorgung-erleichtern-76589.html", "date": "2026-09-07", "publisherClass": "news" } ] }, "commercial": { "score": 66, "summary": "Austrian law bars insurers and employers from using genetic test results, restricts how private insurers gather health data, and bans demands for ELGA data. No Austrian rule specific to health data brokers or consumer health apps was found.", "sources": [ { "title": "Gentechnikgesetz § 67 (RIS)", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10010826&Paragraf=67", "date": "2017-01-01", "publisherClass": "legal_text" }, { "title": "Versicherungsvertragsgesetz § 11a (RIS)", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001979&Artikel=&Paragraf=11a&Anlage=&Uebergangsrecht=", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Gesundheitstelematikgesetz 2012, consolidated text (RIS)", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008120", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Der EHDS: Neue Regeln für Gesundheitsdaten (Haslinger / Nagele)", "url": "https://www.haslinger-nagele.com/der-ehds-neue-regeln-fuer-gesundheitsdaten-ueberblick-und-ausblick/", "date": "undated", "publisherClass": "law_firm" } ] }, "clinical": { "score": 66, "summary": "Once a patient's e-card is read, doctors, hospitals and care homes can open ELGA for 90 days, and pharmacies and ambulance services see the medication list for 28 days. They see reports and medicines, not other providers' full charts.", "sources": [ { "title": "Allgemeines zu ELGA (oesterreich.gv.at, Sozialministerium)", "url": "https://www.oesterreich.gv.at/de/themen/gesundheit/elektronisches-gesundheitssystem/elga_elektronische_gesundheitsakte/Seite.3110001", "date": "2026-08-26", "publisherClass": "official" }, { "title": "Gesundheitstelematikgesetz 2012, consolidated text (RIS)", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008120", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "ELGA-News: EU-Rezept, e-Impfpass, e-Bilddaten (ELGA GmbH)", "url": "https://www.elga.gv.at/news/", "date": "2026-02", "publisherClass": "official" }, { "title": "Patient Summary soll Versorgung erleichtern (medianet)", "url": "https://medianet.at/news/health-economy/patient-summary-soll-versorgung-erleichtern-76589.html", "date": "2026-09-07", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Registers are opened for research by decree, without consent or a general opt-out, through a secure Statistik Austria data centre with accredited institutions and a public project list. ELGA data are barred from research, and the health ministry has not opened its registers.", "sources": [ { "title": "Anfragebeantwortung 4833/AB zu Registerdaten im AMDC (Bundeskanzler)", "url": "https://www.parlament.gv.at/dokument/XXVIII/AB/4833/imfname_1758088.pdf", "date": "2026-05-19", "publisherClass": "official" }, { "title": "Austrian Micro Data Center (Statistik Austria)", "url": "https://www.statistik.at/services/tools/datenzugang/center-wissenschaft/austrian-micro-data-center-amdc", "date": "undated", "publisherClass": "official" }, { "title": "Registerforschung (Wissenschaftsministerium BMFWF)", "url": "https://www.bmfwf.gv.at/forschung/forschung-oesterreich/strategische-ausrichtung-beratende-gremien/leitthemen/registerforschung.html", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI in Austria falls under EU device law and the EU AI Act only. No national clinical-AI rule was found, and the data protection authority wrote in 2026 that Austria had not yet named its AI Act market surveillance authorities.", "sources": [ { "title": "AI Act: regulatory framework for AI (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "date": "undated", "publisherClass": "intergov" }, { "title": "KI-Verordnung (Digital Austria, Bundeskanzleramt)", "url": "https://www.digitalaustria.gv.at/themen/kuenstliche-intelligenz/ai-act.html", "date": "undated", "publisherClass": "official" }, { "title": "Newsletter der Datenschutzbehörde Nr. 1/2026 (DSB)", "url": "https://dsb.gv.at/sites/site0344/media/downloads/nl0126bf.pdf", "date": "2026", "publisherClass": "official" } ] } }, "laws": [ { "name": "Gesundheitstelematikgesetz 2012 (GTelG 2012)", "level": "National", "year": "2012", "what": "ELGA legal base: opt-out, document hiding, access log, ban on non-care use, fines up to EUR 10,000.", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008120" }, { "name": "Datenschutzgesetz (DSG)", "level": "National", "year": "2018", "what": "Austrian GDPR companion law; research rules in § 7; no fines on public bodies under § 30(5).", "url": "https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597" }, { "name": "Ärztegesetz 1998, §§ 49 and 51", "level": "National", "year": "1998", "what": "Doctors must give a free first copy of records and use ELGA by 1 January 2026.", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10011138&Paragraf=51" }, { "name": "Krankenanstalten- und Kuranstaltengesetz (KAKuG) § 10, with state hospital acts", "level": "National", "year": "2018", "what": "Federal framework: states must make hospitals keep records 30 years and grant patients inspection and copies.", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10010285&Paragraf=10" }, { "name": "Wiener Krankenanstaltengesetz 1987, § 17a", "level": "State/Provincial", "year": "1987", "what": "Vienna patient rights in hospitals, including inspection and a copy of the record against cost.", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=LrW&Gesetzesnummer=20000282&Paragraf=17a" }, { "name": "Gentechnikgesetz § 67", "level": "National", "year": "1994", "what": "Bars employers and insurers from requesting or using genetic test results.", "url": "https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10010826&Paragraf=67" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient access and control rights, opt-out from secondary use; key parts apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-10-20", "headline": "Hospital security manager copied a patient's record and emailed it to police", "paraphrase": "A patient learned during a court case that a hospital report about them had reached third parties. The regulator found the hospital's security manager had copied the electronic record and emailed it to police. The court upheld that finding.", "source": "Federal Administrative Court (Bundesverwaltungsgericht), W108 2276075-1, upholding a Datenschutzbehörde decision", "url": "https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20251020_W108_2276075_1_00/BVWGT_20251020_W108_2276075_1_00.html", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-08-21", "headline": "Doctor opened an employee's national e-health record without consent; regulator fined her", "paraphrase": "A practice assistant found through the ELGA access log that her employer, a doctor, had opened her stored results and medication data without her consent. The regulator found a violation and imposed a 1,000 euro fine.", "source": "Datenschutzbehörde (Austrian Data Protection Authority), penal decision 2025-0.625.944", "url": "https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20250821_2025_0_625_944_00/DSBT_20250821_2025_0_625_944_00.html", "theme": "breach", "status": "finding" }, { "date": "2026-01-09", "headline": "Therapy centre left handwritten notes out of a patient's access request", "paraphrase": "A patient asked a therapy centre for all data held about them. The centre left out notes a staff member kept by hand. The regulator found this breached the right of access and ordered full disclosure within four weeks.", "source": "Datenschutzbehörde (Austrian Data Protection Authority), decision 2026-0.018.391", "url": "https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20260109_2026_0_018_391_00/DSBT_20260109_2026_0_018_391_00.html", "theme": "access_refused", "status": "finding" } ] }, { "iso3": "PRT", "name": "Portugal", "region": "Europe", "overall": 64, "rank": "10", "likelyRank": "3 to 26", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Portugal's SNS 24 shows patients who opened their record and asks consent before clinicians look; a May 2026 credential theft tested both.", "categories": { "access": { "score": 70, "summary": "Portugal scored 88.1 on the EU 2025 record-access indicator against an EU average of 82.7, and SNS 24 shows prescriptions, lab results, vaccines and five years of care history. Lei 12/2005 gives a right to the whole record, but the portal is not the full chart.", "sources": [ { "title": "Portugal 2025 Digital Decade country report (Council of the EU, ST 10407/25 ADD 23)", "url": "https://data.consilium.europa.eu/doc/document/ST-10407-2025-ADD-23/en/pdf", "date": "2025-06-18", "publisherClass": "intergov" }, { "title": "State of Health in the EU: Portugal Country Health Profile 2025 (OECD and European Observatory)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/portugal_6d4acb43/56041c8e-en.pdf", "date": "2025-12", "publisherClass": "intergov" }, { "title": "Lei n.º 12/2005, informação genética pessoal e informação de saúde (PGD Lisboa, consolidated)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1660&tabela=leis&ficha=1&pagina=1", "date": "2005-01-26", "publisherClass": "legal_text" }, { "title": "Direito de acesso à informação de saúde e à proteção de dados pessoais (ERS)", "url": "https://www.ers.pt/pt/utentes/perguntas-frequentes/faq/direito-de-acesso-a-informacao-de-saude-e-a-protecao-de-dados-pessoais/", "date": "2025-02-26", "publisherClass": "official" } ] }, "control": { "score": 70, "summary": "Clinicians cannot open the national record without the patient's authorisation, set in SNS 24 or given at the visit, and patients can see every access. Lei 58/2019 requires that people be notified of any access to their health data.", "sources": [ { "title": "Lei n.º 58/2019, execução do RGPD (Diário da República)", "url": "https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf", "date": "2019-08-08", "publisherClass": "legal_text" }, { "title": "Manual do Utilizador: acesso à Área do Profissional do RSE para médicos e enfermeiros (ACSS/SPMS)", "url": "https://www.acss.min-saude.pt/wp-content/uploads/2016/12/Manual-de-Utilizador-RSE-PCPMACNO_VF.pdf", "date": "2025-04-15", "publisherClass": "official" }, { "title": "SNS 24: saiba quem teve acesso às suas informações e como gerir autorizações (Pplware)", "url": "https://pplware.sapo.pt/internet/sns-24-saiba-quem-teve-acesso-as-suas-informacoes-e-como-gerir-autorizacoes/", "date": "2026-05-26", "publisherClass": "news" }, { "title": "ULS do Alto Minho admite roubo de credenciais médicas para aceder a dados de utentes (HealthNews)", "url": "https://healthnews.pt/2026/05/22/uls-do-alto-minho-admite-roubo-de-credenciais-medicas-para-aceder-a-dados-de-utentes/", "date": "2026-05-22", "publisherClass": "news" } ] }, "privacy": { "score": 56, "summary": "Health data has strong statutory protection, but in May 2026 a doctor's stolen credentials were used to improperly access data of more than 100,000 SNS users. The regulator CNPD opened an inquiry and reported possible crimes to prosecutors.", "sources": [ { "title": "Lei n.º 58/2019, execução do RGPD (Diário da República)", "url": "https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf", "date": "2019-08-08", "publisherClass": "legal_text" }, { "title": "Comissão Nacional de Proteção de Dados averigua acesso indevido a dados de saúde (ECO)", "url": "https://eco.sapo.pt/2026/05/26/comissao-nacional-de-protecao-de-dados-averigua-acesso-indevido-a-dados-de-saude/", "date": "2026-05-26", "publisherClass": "news" }, { "title": "ULS do Alto Minho admite roubo de credenciais médicas para aceder a dados de utentes (HealthNews)", "url": "https://healthnews.pt/2026/05/22/uls-do-alto-minho-admite-roubo-de-credenciais-medicas-para-aceder-a-dados-de-utentes/", "date": "2026-05-22", "publisherClass": "news" }, { "title": "Hospital do Barreiro multado em 400 mil euros por não proteger dados clínicos dos doentes (Jornal de Negócios)", "url": "https://www.jornaldenegocios.pt/economia/saude/detalhe/hospital-do-barreiro-multado-em-400-mil-euros-por-nao-proteger-dados-clinicos-dos-doentes", "date": "2018-10-18", "publisherClass": "news" } ] }, "journey": { "score": 68, "summary": "A central agency, SPMS, gives every public provider and most private ones a common data centre, network and software, and the RSE timeline lists episodes from all SNS institutions. Private providers have no legal duty to share records.", "sources": [ { "title": "State of Health in the EU: Portugal Country Health Profile 2025 (OECD and European Observatory)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/portugal_6d4acb43/56041c8e-en.pdf", "date": "2025-12", "publisherClass": "intergov" }, { "title": "Manual do Utilizador: acesso à Área do Profissional do RSE para médicos e enfermeiros (ACSS/SPMS)", "url": "https://www.acss.min-saude.pt/wp-content/uploads/2016/12/Manual-de-Utilizador-RSE-PCPMACNO_VF.pdf", "date": "2025-04-15", "publisherClass": "official" }, { "title": "Lei n.º 95/2019, Lei de Bases da Saúde (PGD Lisboa)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3197&tabela=leis&ficha=1", "date": "2019-09-04", "publisherClass": "legal_text" } ] }, "commercial": { "score": 62, "summary": "Lei 12/2005 says health information may be used only for care, health research and other uses set by law, and bans insurers from using genetic data. A 2021 law stops lenders and insurers using past cancer and other overcome conditions.", "sources": [ { "title": "Lei n.º 12/2005, informação genética pessoal e informação de saúde (PGD Lisboa, consolidated)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1660&tabela=leis&ficha=1&pagina=1", "date": "2005-01-26", "publisherClass": "legal_text" }, { "title": "Lei n.º 75/2021, direito ao esquecimento no crédito e nos seguros (PGD Lisboa)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3478&tabela=leis", "date": "2021-11-18", "publisherClass": "legal_text" } ] }, "clinical": { "score": 64, "summary": "With the patient's authorisation, a doctor or nurse sees a timeline of episodes from every SNS institution and can open each source record over the health network. Data held only by private providers is often missing.", "sources": [ { "title": "Manual do Utilizador: acesso à Área do Profissional do RSE para médicos e enfermeiros (ACSS/SPMS)", "url": "https://www.acss.min-saude.pt/wp-content/uploads/2016/12/Manual-de-Utilizador-RSE-PCPMACNO_VF.pdf", "date": "2025-04-15", "publisherClass": "official" }, { "title": "Lei n.º 12/2005, informação genética pessoal e informação de saúde (PGD Lisboa, consolidated)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1660&tabela=leis&ficha=1&pagina=1", "date": "2005-01-26", "publisherClass": "legal_text" }, { "title": "State of Health in the EU: Portugal Country Health Profile 2025 (OECD and European Observatory)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/portugal_6d4acb43/56041c8e-en.pdf", "date": "2025-12", "publisherClass": "intergov" } ] }, "research": { "score": 48, "summary": "Anonymised health data may be used for research without individual consent under Lei 12/2005, and no general opt-out exists yet. Trials need informed consent and ethics approval, and Portugal was first to list a dataset on HealthData@EU.", "sources": [ { "title": "Lei n.º 12/2005, informação genética pessoal e informação de saúde (PGD Lisboa, consolidated)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1660&tabela=leis&ficha=1&pagina=1", "date": "2005-01-26", "publisherClass": "legal_text" }, { "title": "Lei n.º 58/2019, execução do RGPD (Diário da República)", "url": "https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf", "date": "2019-08-08", "publisherClass": "legal_text" }, { "title": "Lei n.º 21/2014, lei da investigação clínica (PGD Lisboa)", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=2089&tabela=leis", "date": "2014-04-16", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Portugal relies on EU law for clinical AI, with no national AI law. ANACOM supervises the AI Act and the health regulator ERS protects fundamental rights for high-risk AI, both EU-required roles.", "sources": [ { "title": "Regulamento da Inteligência Artificial (ERS)", "url": "https://www.ers.pt/pt/atividade/regulamento-da-inteligencia-artificial/", "date": "undated", "publisherClass": "official" }, { "title": "Anacom escolhida pelo Governo para regular inteligência artificial em Portugal (ECO)", "url": "https://eco.sapo.pt/2025/09/19/anacom-escolhida-pelo-governo-para-regular-inteligencia-artificial-em-portugal/", "date": "2025-09-19", "publisherClass": "news" }, { "title": "State of Health in the EU: Portugal Country Health Profile 2025 (OECD and European Observatory)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/portugal_6d4acb43/56041c8e-en.pdf", "date": "2025-12", "publisherClass": "intergov" }, { "title": "Digital Omnibus on AI has been published (Regulation (EU) 2026/1744) (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Lei n.º 12/2005, informação genética pessoal e informação de saúde", "level": "National", "year": "2005", "what": "Health data belongs to the person; right to the whole record; insurers barred from genetic data.", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=1660&tabela=leis&ficha=1&pagina=1" }, { "name": "Lei n.º 58/2019, execução do RGPD", "level": "National", "year": "2019", "what": "Applies GDPR; health data need to know, secrecy duty, and notice to people of every access.", "url": "https://files.diariodarepublica.pt/1s/2019/08/15100/0000300040.pdf" }, { "name": "Lei n.º 95/2019, Lei de Bases da Saúde", "level": "National", "year": "2019", "what": "Health information is the person's property; SNS systems must interoperate.", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3197&tabela=leis&ficha=1" }, { "name": "Lei n.º 75/2021, direito ao esquecimento", "level": "National", "year": "2021", "what": "Lenders and linked insurers may not use overcome serious health conditions after set periods.", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3478&tabela=leis" }, { "name": "Lei n.º 21/2014, lei da investigação clínica", "level": "National", "year": "2014", "what": "Clinical studies need informed consent, ethics approval, withdrawal rights and insurance.", "url": "https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=2089&tabela=leis" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access logs, restrictions and secondary-use opt-out; exchange from March 2029 and 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "EU AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "High-risk AI duties now apply from December 2027, and August 2028 for medical devices.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-29", "headline": "Hospital admitted staff outside the care team opened a patient's record", "paraphrase": "A family member with power of attorney obtained the record's access log and found entries by staff outside the care team. The hospital admitted improper access but withheld names; the commission said the names must be given.", "source": "Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 392/2026", "url": "https://www.cada.pt/files/pareceres/2026/392.pdf", "theme": "breach", "status": "finding" }, { "date": "2026-07-29", "headline": "Hospital demanded an ID card copy before releasing a patient's records to their lawyer", "paraphrase": "A patient's lawyer asked for certified copies of the full record with a signed special power of attorney. The hospital insisted on a copy of the patient's ID card and ignored the commission; it ruled the demand unjustified.", "source": "Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 406/2026", "url": "https://www.cada.pt/files/pareceres/2026/406.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2026-01-28", "headline": "Patient says hospital resent the same report with only a new date", "paraphrase": "A patient in the Algarve asked for a clinical report needed to seek care abroad. After no reply, the hospital resent an earlier report with only the date changed; the commission told it to supply anything missing.", "source": "Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 48/2026", "url": "https://www.cada.pt/files/pareceres/2026/048.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2025-12-17", "headline": "Hospital ignored repeated requests for a patient's own records and the regulator", "paraphrase": "A patient asked a public hospital group several times for her own clinical records without success. The hospital did not answer the commission either; it ruled the records must be released, or their absence explained.", "source": "Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 481/2025", "url": "https://www.cada.pt/files/pareceres/2025/481.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2025-11-19", "headline": "Part of a patient's file stayed missing despite repeated requests", "paraphrase": "A patient in Madeira received some records but, after repeated requests, a key part of the file was still missing. The health service did not reply to the commission, which ruled it must provide the records or justify refusal.", "source": "Comissão de Acesso aos Documentos Administrativos (CADA), Parecer 437/2025", "url": "https://www.cada.pt/files/pareceres/2025/437.pdf", "theme": "access_delay_or_cost", "status": "finding" } ] }, { "iso3": "BEL", "name": "Belgium", "region": "Europe", "overall": 63, "rank": "11=", "likelyRank": "5 to 30", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Belgian records are indexed unless patients object, providers need consent to open them, and patients can block named doctors and see who looked.", "categories": { "access": { "score": 68, "summary": "The law gives a free first copy, paper or electronic, within 15 days, and the EU rates Belgian record access 100 out of 100. The federal portal shows linked documents, not one full record, and French speakers cannot see vaccines or test results in the app.", "sources": [ { "title": "Loi du 22 août 2002 relative aux droits du patient, version consolidée (Justel)", "url": "https://www.ejustice.just.fgov.be/eli/loi/2002/08/22/2002022737/justel", "date": "2002-08-22", "publisherClass": "legal_text" }, { "title": "Masanté : consultez et gérez vos données de santé en ligne et via notre application mobile (INAMI)", "url": "https://www.inami.fgov.be/fr/themes/esante/masante-consultez-et-gerez-vos-donnees-de-sante-en-ligne-et-via-notre-application-mobile", "date": "undated", "publisherClass": "official" }, { "title": "Digital Decade 2026 country report, Belgium, SWD(2026) 155 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/128636", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "Abrumet soupçonne une volonté fédérale de centraliser les réseaux de santé (Le Spécialiste)", "url": "https://www.lespecialiste.be/fr/actualites/e-health/abrumet-soupconne-une-volonte-federale-de-centraliser-les-reseaux-de-sante.html", "date": "2026-06-23", "publisherClass": "news" } ] }, "control": { "score": 72, "summary": "The national index lists where a patient's data sits unless the patient objects, but another provider may open it only with revocable consent. Patients can exclude named providers and see who consulted their data; exclusion works only name by name.", "sources": [ { "title": "Loi du 22 avril 2019 relative à la qualité de la pratique des soins de santé (Justel)", "url": "https://www.ejustice.just.fgov.be/eli/loi/2019/04/22/2019041141/justel", "date": "2019-04-22", "publisherClass": "legal_text" }, { "title": "Wet van 21 augustus 2008 houdende oprichting en organisatie van het eHealth-platform, gecoördineerde tekst (eHealth-platform)", "url": "https://www.ehealth.fgov.be/ehealthplatform/nl/wet-van-21-augustus-2008-houdende-oprichting-en-organisatie-van-het-ehealth-platform", "date": "2023-12-06", "publisherClass": "official" }, { "title": "Privacy Notice (eHealth-platform)", "url": "https://www.ehealth.fgov.be/ehealthplatform/nl/privacy-notice", "date": "2021-06", "publisherClass": "official" }, { "title": "Retrait de l'AR sur l'accès aux données de santé (ABSyM)", "url": "https://www.absym-bvas.be/fr/actualite/retrait-de-lar-sur-lacces-aux-donnees-de-sante-confirmation-de-preoccupations-legitimes", "date": "2026-04-27", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 54, "summary": "The data protection authority acts on hospital cases, but in 2025 it imposed only four fines totalling 75,700 euros, and a court cut a hospital ransomware fine from 200,000 to 50,000 euros. In January 2026 a supplier flaw exposed identity data of about 71,000 hospital patients.", "sources": [ { "title": "Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel (etaamb)", "url": "https://etaamb.openjustice.be/fr/loi-du-30-juillet-2018_n2018040581.html", "date": "2018-07-30", "publisherClass": "legal_text" }, { "title": "Rapport annuel 2025 (Autorité de protection des données)", "url": "https://www.autoriteprotectiondonnees.be/index.php/publications/rapport-annuel-2025.pdf", "date": "2026-03-04", "publisherClass": "official" }, { "title": "Décision quant au fond 209/2025 du 18 décembre 2025 (Chambre Contentieuse, APD)", "url": "https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-209-2025.pdf", "date": "2025-12-18", "publisherClass": "official" }, { "title": "Ook bij 3 andere Vlaamse ziekenhuizen lag toegang tot patiëntengegevens open voor hackers (VRT NWS)", "url": "https://www.vrt.be/vrtnws/nl/2026/01/14/ziekenhuizen-cyberaanval-impact/", "date": "2026-01-14", "publisherClass": "news" } ] }, "journey": { "score": 68, "summary": "A national metahub indexes which regional hub holds a patient's documents, and electronic prescribing is mandatory for most outpatient prescriptions. Data stays decentralised and largely document-based, and the structured integrated record is planned for 2027 to 2029.", "sources": [ { "title": "Verwijzingsrepertorium (Metahub) (eHealth-platform)", "url": "https://www.ehealth.fgov.be/ehealthplatform/nl/service-verwijzingsrepertorium-metahub", "date": "2025-10-09", "publisherClass": "official" }, { "title": "Geneesmiddelen verplicht elektronisch voorschrijven (RIZIV)", "url": "https://www.riziv.fgov.be/nl/thema-s/verzorging-kosten-en-terugbetaling/wat-het-ziekenfonds-terugbetaalt/geneesmiddelen/geneesmiddel-voorschrijven/geneesmiddelen-verplicht-elektronisch-voorschrijven", "date": "undated", "publisherClass": "official" }, { "title": "BIHR (Belgian Integrated Health Record) : un système d'information intégré pour des soins de qualité (INAMI)", "url": "https://www.inami.fgov.be/fr/themes/esante/bihr-belgian-integrated-health-record-un-systeme-d-information-integre-pour-des-soins-de-qualite", "date": "undated", "publisherClass": "official" }, { "title": "E-gezondheid: het plan wordt al uitgevoerd zonder te wachten op de formele goedkeuring (Medi-Sfeer)", "url": "https://www.medi-sfeer.be/nl/nieuws/e-health/e-gezondheid-het-plan-wordt-al-uitgevoerd-zonder-te-wachten-op-de-formele-goedkeuring.html", "date": "2026-06-04", "publisherClass": "news" } ] }, "commercial": { "score": 54, "summary": "Insurers may not receive genetic data or use genetic tests to predict future health, but the 2023 Health Data Agency law covers reuse for commercial as well as non-commercial purposes. A Belgian ban on selling health data beyond the GDPR was not verified.", "sources": [ { "title": "Loi du 4 avril 2014 relative aux assurances, articles 58 et 61 (etaamb)", "url": "https://etaamb.openjustice.be/fr/loi-du-04-avril-2014_n2014011239.html", "date": "2014-04-04", "publisherClass": "legal_text" }, { "title": "Wet van 14 maart 2023 houdende oprichting en organisatie van het Gezondheids(zorg)data-agentschap (etaamb)", "url": "https://etaamb.openjustice.be/nl/wet-van-14-maart-2023_n2023041135.html", "date": "2023-03-14", "publisherClass": "legal_text" }, { "title": "Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel (etaamb)", "url": "https://etaamb.openjustice.be/fr/loi-du-30-juillet-2018_n2018040581.html", "date": "2018-07-30", "publisherClass": "legal_text" } ] }, "clinical": { "score": 62, "summary": "With consent and a therapeutic relationship, a clinician can reach relevant data held in hospitals, labs and imaging centres across Belgium, with emergency access in law. No official usage figure was found, and what a clinician sees depends on profession and on what providers publish.", "sources": [ { "title": "Loi du 22 avril 2019 relative à la qualité de la pratique des soins de santé (Justel)", "url": "https://www.ejustice.just.fgov.be/eli/loi/2019/04/22/2019041141/justel", "date": "2019-04-22", "publisherClass": "legal_text" }, { "title": "Verwijzingsrepertorium (Metahub) (eHealth-platform)", "url": "https://www.ehealth.fgov.be/ehealthplatform/nl/service-verwijzingsrepertorium-metahub", "date": "2025-10-09", "publisherClass": "official" }, { "title": "L'échange d'informations électroniques dans les soins de santé en Belgique (Frank Robben, eHealth platform head, personal site)", "url": "https://www.frankrobben.be/fr/lechange-dinformations-electroniques-dans-les-soins-de-sante-en-belgique/", "date": "2025-03-11", "publisherClass": "blog_vendor" }, { "title": "Décision quant au fond 209/2025 du 18 décembre 2025 (Chambre Contentieuse, APD)", "url": "https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-209-2025.pdf", "date": "2025-12-18", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Secondary use runs through authorisations of the Information Security Committee, which lists 1,093 public deliberations, recent ones largely on pseudonymised data. There is no individual consent or general opt-out for secondary use today; the EHDS opt-out arrives from 2029.", "sources": [ { "title": "Het IVC in het kort (Kruispuntbank van de Sociale Zekerheid)", "url": "https://www.ksz-bcss.fgov.be/nl/page/ivc-in-het-kort", "date": "undated", "publisherClass": "official" }, { "title": "Beraadslagingen van het Informatieveiligheidscomité (eHealth-platform)", "url": "https://www.ehealth.fgov.be/ehealthplatform/nl/sectoraal-comite/documenten", "date": "undated", "publisherClass": "official" }, { "title": "Wet van 14 maart 2023 houdende oprichting en organisatie van het Gezondheids(zorg)data-agentschap (etaamb)", "url": "https://etaamb.openjustice.be/nl/wet-van-14-maart-2023_n2023041135.html", "date": "2023-03-14", "publisherClass": "legal_text" }, { "title": "Loi du 7 mai 2004 relative aux expérimentations sur la personne humaine (Justel)", "url": "https://www.ejustice.just.fgov.be/eli/loi/2004/05/07/2004022376/justel", "date": "2004-05-07", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "EU device law and the AI Act govern clinical AI; rules for AI in medical devices apply from 2 August 2028. Belgium's 2022 AI plan has a health objective, but no binding national clinical AI rules were found.", "sources": [ { "title": "AI Omnibus enters into force (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force", "date": "2026-07-27", "publisherClass": "intergov" }, { "title": "Digital Decade 2026 country report, Belgium, SWD(2026) 155 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/128636", "date": "2026-06-17", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Loi du 22 août 2002 relative aux droits du patient", "level": "National", "year": "2002", "what": "Right to a kept file, consultation within 15 days, free first copy on paper or electronically.", "url": "https://www.ejustice.just.fgov.be/eli/loi/2002/08/22/2002022737/justel" }, { "name": "Loi du 22 avril 2019 relative à la qualité de la pratique des soins de santé", "level": "National", "year": "2019", "what": "Access to others' records needs consent and a therapeutic link; emergency access; patients can see who accessed.", "url": "https://www.ejustice.just.fgov.be/eli/loi/2019/04/22/2019041141/justel" }, { "name": "Loi du 30 juillet 2018 relative à la protection des données", "level": "National", "year": "2018", "what": "Implements the GDPR; extra duties for health data: named access categories and confidentiality.", "url": "https://etaamb.openjustice.be/fr/loi-du-30-juillet-2018_n2018040581.html" }, { "name": "Loi du 4 avril 2014 relative aux assurances (articles 58 and 61)", "level": "National", "year": "2014", "what": "Genetic data may not be given to insurers; no genetic tests to predict future health.", "url": "https://etaamb.openjustice.be/fr/loi-du-04-avril-2014_n2014011239.html" }, { "name": "Wet van 14 maart 2023 Gezondheids(zorg)data-agentschap", "level": "National", "year": "2023", "what": "Creates the Health Data Agency to facilitate commercial and non-commercial reuse of health data.", "url": "https://etaamb.openjustice.be/nl/wet-van-14-maart-2023_n2023041135.html" }, { "name": "Decreet van 8 juli 2022 tot oprichting van het platform Vitalink", "level": "Regional", "year": "2022", "what": "Flemish sharing platform; consent required for sharing, revocable; research gets pseudonymised data only.", "url": "https://codex.vlaanderen.be/PrintDocument.ashx?id=1037408&datum=&geannoteerd=true&print=false" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient summaries and e-prescriptions from March 2029, labs and imaging 2031; secondary-use opt-out.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-18", "headline": "Access list showed a therapist opened a patient's test results without a care reason", "paraphrase": "A patient asked her hospital group who had opened her electronic record. The list showed a therapist working there had viewed her test results three times. The regulator reprimanded the hospital for weak access controls; an appeal is pending.", "source": "Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), Litigation Chamber decision 209/2025", "url": "https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-209-2025.pdf", "theme": "breach", "status": "finding" }, { "date": "2024-12-17", "headline": "Ransomware hit a hospital whose patient record system had weak password protection", "paraphrase": "An attacker locked a hospital's servers and exported about 5 gigabytes of data. The regulator found security failings, including weak protection of access to the electronic patient record, and fined the hospital 390,000 euros. An appeal court later reduced it.", "source": "Gegevensbeschermingsautoriteit (Belgian Data Protection Authority), Litigation Chamber decision 166/2024", "url": "https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-166-2024.pdf", "theme": "breach", "status": "finding" }, { "date": "2024-10-04", "headline": "Hackers took 53,900 sick-leave check files including doctors' comments", "paraphrase": "A company that runs employer-requested sick-leave checks said hackers had taken 53,900 files, including names, addresses, incapacity levels and examining doctors' comments, and published them a week later. It warned of phishing using the data.", "source": "RTBF", "url": "https://www.rtbf.be/article/la-societe-medicheck-informe-que-des-hackers-ont-mis-la-main-sur-53-900-dossiers-de-medecins-controle-11444168", "theme": "breach", "status": "admitted" }, { "date": "2026-06-25", "headline": "Overheated outside server took a hospital's electronic patient record offline", "paraphrase": "A hospital's electronic patient record went down after an external server abroad overheated. Planned appointments and operations were cancelled, and patients could not consult their own medical file until the system came back.", "source": "Medi-Sfeer", "url": "https://www.medi-sfeer.be/nl/nieuws/hitte-storing-bij-elektronisch-patientendossier-in-az-sint-lucas-van-de-baan.html", "theme": "other", "status": "alleged" } ] }, { "iso3": "DEU", "name": "Germany", "region": "Europe", "overall": 63, "rank": "11=", "likelyRank": "5 to 30", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "About 73 million Germans have an opt-out ePA with an access log and blocking options, but only 5.1 million have the ID to open it.", "categories": { "access": { "score": 64, "summary": "Since 6 February 2026 the BGB gives a free first copy of the complete treatment record, including electronic copies, and insurers have created about 73 million ePAs. Only 5.1 million people had the GesundheitsID needed to read theirs.", "sources": [ { "title": "§ 630g BGB Einsichtnahme in die Behandlungsakte (gesetze-im-internet.de)", "url": "https://www.gesetze-im-internet.de/bgb/__630g.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "Merkblatt: Einsichtnahme in ärztliche Behandlungsunterlagen (Ärztekammer Berlin)", "url": "https://www.aekb.de/fileadmin/migration/pdf/25_Merkblatt_Einsichtsrechte_in_Patientenunterlagen.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Ein Jahr ePA für alle: mehr als 100 Millionen hinterlegte Dokumente (gematik)", "url": "https://www.gematik.de/newsroom/news-detail/ein-jahr-epa-fuer-alle-mehr-als-100-millionen-hinterlegte-dokumente-verbessern-behandlung-und-versorgung-in-deutschland", "date": "2026-04-15", "publisherClass": "official" }, { "title": "Elektronische Patientenakte: Datenschutz stärkt Vertrauen und Nutzung (BfDI Datenbarometer)", "url": "https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2025/18_Datenbarometer-ePA.html", "date": "2025-12-18", "publisherClass": "official" } ] }, "control": { "score": 66, "summary": "Patients can object to the whole ePA, to single uses, or to named facilities, hide documents, change access periods and read an access log. Hiding is all-or-nothing: a document cannot be hidden from one practice only.", "sources": [ { "title": "§ 353 SGB V Erklärung des Widerspruchs; Erteilung der Einwilligung", "url": "https://www.gesetze-im-internet.de/sgb_5/__353.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "§ 342 SGB V Angebot und Nutzung der elektronischen Patientenakte", "url": "https://www.gesetze-im-internet.de/sgb_5/__342.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "Wie verwalte ich meine ePA? (gesund.bund.de, BMG)", "url": "https://gesund.bund.de/wie-verwalte-ich-meine-epa", "date": "undated", "publisherClass": "official" }, { "title": "Seit dem freiwilligen ePA-Start stagniert die Zahl der Widersprüche (zm-online)", "url": "https://www.zm-online.de/news/detail/seit-dem-freiwilligen-epa-start-stagniert-die-zahl-der-widersprueche", "date": "2025-10-22", "publisherClass": "news" } ] }, "privacy": { "score": 58, "summary": "Strong law and an active federal regulator sit beside real failures: an April 2026 attack on billing firm Unimed exposed patient data at many university hospitals, and researchers say ePA identity checks remain weak.", "sources": [ { "title": "Datenschutzaufsicht 2025: BfDI stellt 34. Tätigkeitsbericht vor (BfDI)", "url": "https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2026/06_TB34.html", "date": "2026-05", "publisherClass": "official" }, { "title": "Cyberangriff auf Abrechnungsdienstleister betrifft viele Kliniken (heise online)", "url": "https://www.heise.de/news/Patientendaten-betroffen-Cyberangriff-auf-Abrechnungsdienstleister-von-Kliniken-11304982.html", "date": "2026-05-22", "publisherClass": "news" }, { "title": "39C3: Ein Jahr elektronische Patientenakte, hat sich die Lage verbessert? (heise online)", "url": "https://www.heise.de/news/39C3-Ein-Jahr-elektronische-Patientenakte-hat-sich-die-Lage-verbessert-11126272.html", "date": "2025-12-30", "publisherClass": "news" }, { "title": "§ 9 GDNG Strafvorschriften (gesetze-im-internet.de)", "url": "https://www.gesetze-im-internet.de/gdng/__9.html", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 66, "summary": "Practices, pharmacies and hospitals share one telematics network, e-prescriptions passed one billion in October 2025, and ePA use is mandatory for providers since 1 October 2025. Hospitals still lag behind practices.", "sources": [ { "title": "Ein Jahr ePA für alle: mehr als 100 Millionen hinterlegte Dokumente (gematik)", "url": "https://www.gematik.de/newsroom/news-detail/ein-jahr-epa-fuer-alle-mehr-als-100-millionen-hinterlegte-dokumente-verbessern-behandlung-und-versorgung-in-deutschland", "date": "2026-04-15", "publisherClass": "official" }, { "title": "Eine Milliarde eingelöste E-Rezepte (gematik)", "url": "https://www.gematik.de/newsroom/news-detail/eine-milliarde-eingeloeste-e-rezepte", "date": "2025-10-17", "publisherClass": "official" }, { "title": "ePA für alle (Bundesministerium für Gesundheit)", "url": "https://www.bundesgesundheitsministerium.de/themen/digitalisierung/elektronische-patientenakte/epa-fuer-alle", "date": "2026-03-04", "publisherClass": "official" }, { "title": "DEMIS: Deutsches Elektronisches Melde- und Informationssystem (RKI)", "url": "https://www.rki.de/DE/Themen/Infektionskrankheiten/Meldewesen/DEMIS/demis-node.html", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 70, "summary": "German law bans using research health data for marketing, advertising or insurance decisions and punishes misuse for gain with up to three years in prison. Companies may still apply for pseudonymised data when the purpose qualifies.", "sources": [ { "title": "§ 303e SGB V Datenverarbeitung (Forschungsdatenzentrum)", "url": "https://www.gesetze-im-internet.de/sgb_5/__303e.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "§ 9 GDNG Strafvorschriften (gesetze-im-internet.de)", "url": "https://www.gesetze-im-internet.de/gdng/__9.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "§ 4 DiGAV Anforderungen an Datenschutz und Datensicherheit", "url": "https://www.gesetze-im-internet.de/digav/__4.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "§ 25b SGB V Datengestützte Erkennung individueller Gesundheitsrisiken", "url": "https://www.gesetze-im-internet.de/sgb_5/__25b.html", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 62, "summary": "Reading the patient's card gives a practice 90 days of access to the whole unhidden ePA, but doctors are not required to look and the record only holds documents uploaded since 2025.", "sources": [ { "title": "Elektronische Patientenakte (KBV)", "url": "https://www.kbv.de/praxis/digitalisierung/anwendungen/elektronische-patientenakte", "date": "undated", "publisherClass": "official" }, { "title": "Wie verwalte ich meine ePA? (gesund.bund.de, BMG)", "url": "https://gesund.bund.de/wie-verwalte-ich-meine-epa", "date": "undated", "publisherClass": "official" }, { "title": "Ein Jahr ePA für alle: mehr als 100 Millionen hinterlegte Dokumente (gematik)", "url": "https://www.gematik.de/newsroom/news-detail/ein-jahr-epa-fuer-alle-mehr-als-100-millionen-hinterlegte-dokumente-verbessern-behandlung-und-versorgung-in-deutschland", "date": "2026-04-15", "publisherClass": "official" }, { "title": "Kliniken fremdeln mit der elektronischen Patientenakte (Süddeutsche Zeitung)", "url": "https://www.sueddeutsche.de/bayern/nuernberg-kliniken-patientenakte-erler-epa-li.3391093", "date": "2026-02-22", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "The only research flow running today, claims data of all statutory insured to the FDZ, has no opt-out, which a lawsuit challenges. An opt-out for ePA data exists in law but its transfers only start in mid-December 2026.", "sources": [ { "title": "§ 363 SGB V Verarbeitung von Daten der ePA zu Forschungszwecken", "url": "https://www.gesetze-im-internet.de/sgb_5/__363.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "Daten aus der elektronischen Patientenakte (FDZ Gesundheit, BfArM)", "url": "https://www.forschungsdatenzentrum-gesundheit.de/infoportal/datensatz-des-fdz-gesundheit/daten-aus-der-epa", "date": "2026-09-30", "publisherClass": "official" }, { "title": "Klage gegen zentrale Speicherung von Gesundheitsdaten geht weiter (netzpolitik.org)", "url": "https://netzpolitik.org/2026/gesellschaft-fuer-freiheitsrechte-klage-gegen-zentrale-speicherung-von-gesundheitsdaten-geht-weiter/", "date": "2026-02-25", "publisherClass": "news" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI is governed by EU device law and the AI Act, whose duties for AI in medical devices now start 2 August 2028. Germany's KI-MIG of July 2026 mainly designates authorities, which earns no national credit.", "sources": [ { "title": "KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG)", "url": "https://www.gesetze-im-internet.de/ki-mig/BJNR0DF0B0026.html", "date": "2026-07-22", "publisherClass": "legal_text" }, { "title": "Digital Omnibus on AI, Regulation (EU) 2026/1744 (AI Act Explorer)", "url": "https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/", "date": "2026-07", "publisherClass": "blog_vendor" }, { "title": "EU AI Act News: Digital Omnibus on AI (Mayer Brown)", "url": "https://www.mayerbrown.com/en/insights/publications/2026/07/eu-ai-act-news-digital-omnibus-on-ai-new-guidance-on-risk-classification-gpai-and-transparency-obligations", "date": "2026-07-30", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Bürgerliches Gesetzbuch § 630g (as amended 2026)", "level": "National", "year": "2026", "what": "Right to inspect the complete treatment record, electronic copies, free first copy since 6 February 2026.", "url": "https://www.gesetze-im-internet.de/bgb/__630g.html" }, { "name": "SGB V ePA provisions §§ 337-363 (Digital-Gesetz)", "level": "National", "year": "2025", "what": "Opt-out ePA created early 2025; objections per use or provider, access log, research opt-out.", "url": "https://www.gesetze-im-internet.de/sgb_5/__353.html" }, { "name": "Gesundheitsdatennutzungsgesetz (GDNG)", "level": "National", "year": "2024", "what": "Secrecy duty for research health data users; up to three years prison for misuse for gain.", "url": "https://www.gesetze-im-internet.de/gdng/" }, { "name": "Digitale Gesundheitsanwendungen-Verordnung (DiGAV)", "level": "National", "year": "2020", "what": "Reimbursed health apps process data only with consent and for a closed list of purposes.", "url": "https://www.gesetze-im-internet.de/digav/__4.html" }, { "name": "KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG)", "level": "National", "year": "2026", "what": "Implements the EU AI Act in Germany; names supervisory authorities and sets up an AI sandbox.", "url": "https://www.gesetze-im-internet.de/ki-mig/BJNR0DF0B0026.html" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient summaries and e-prescriptions exchange from March 2029; secondary-use rules apply from 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "EU AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk rules for AI; duties for AI in medical devices apply from 2 August 2028.", "url": "https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-05-20", "headline": "Practices answered online reviews by publishing patients' names and record details", "paraphrase": "Patients left anonymous negative reviews online. Medical practices replied in public, naming the patients and disclosing details from their records. The state regulator listed these among cases where it imposed fines in 2024.", "source": "Hessian Commissioner for Data Protection and Freedom of Information (HBDI)", "url": "https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-05-20", "headline": "Practice manager took patient files home where guests could read them", "paraphrase": "The state regulator reported a practice manager who took patient records home and left them unsecured, where party guests could see them, and who also sent photos of patient files to a partner by messaging app.", "source": "Hessian Commissioner for Data Protection and Freedom of Information (HBDI)", "url": "https://datenschutz.hessen.de/presse/hbdi-stellt-taetigkeitsberichte-zum-datenschutz-und-zur-informationsfreiheit-fuer-das-jahr-2024-vor", "theme": "breach", "status": "finding" }, { "date": "2025-10-24", "headline": "Man switching insurers found diagnoses in his ePA that he says he never had", "paraphrase": "Seeking private insurance, a man opened his electronic patient record and found three diagnoses he says do not apply to him, billed during routine visits. Insurers saw him as high risk. Only the treating doctor can correct them.", "source": "t-online", "url": "https://www.t-online.de/gesundheit/aktuelles/id_100965028/elektronische-patientenakte-epa-versicherte-entdecken-falsche-diagnosen.html", "theme": "record_wrong", "status": "self_reported" }, { "date": "2025-07-21", "headline": "Hospital group says patient data may have been taken in a cyberattack", "paraphrase": "After an attack disrupted all its German facilities, a hospital group said data on patients, staff and partners may have been accessed without authorisation and could be misused or passed to others.", "source": "heise online", "url": "https://www.heise.de/news/Hacker-Angriff-auf-Kliniken-Moeglicherweise-Patientendaten-betroffen-10495015.html", "theme": "breach", "status": "admitted" }, { "date": "2025-02-20", "headline": "Former patient found a rehab app exposed medical reports without a login", "paraphrase": "A former patient noticed a rehabilitation provider's app talked to its servers unencrypted, and that patient files, including medical reports, could be opened without authentication. The provider said the gap was closed and it saw no sign of data outflow.", "source": "c't (heise)", "url": "https://www.heise.de/select/ct/2025/5/2503112000914901106", "theme": "breach", "status": "alleged" } ] }, { "iso3": "ITA", "name": "Italy", "region": "Europe", "overall": 63, "rank": "11=", "likelyRank": "5 to 31", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Italians can hide documents and read who opened their regional record, but fewer than half let doctors see it.", "categories": { "access": { "score": 68, "summary": "Law 24/2017 obliges providers to release records within seven days, and every regional FSE shows lab, discharge and ER reports. Italy scored 84.1 on the EU record-access indicator (EU 82.7), but the full hospital chart is online in only 6 of 21 regions.", "sources": [ { "title": "Legge 8 marzo 2017, n. 24 (Gelli-Bianco), art. 4 (Gazzetta Ufficiale)", "url": "https://www.gazzettaufficiale.it/eli/id/2017/03/17/17G00041/sg", "date": "2017-03-17", "publisherClass": "legal_text" }, { "title": "Decreto 7 settembre 2023, Fascicolo sanitario elettronico 2.0 (Gazzetta Ufficiale n. 249)", "url": "https://www.gazzettaufficiale.it/eli/id/2023/10/24/23A05829/sg", "date": "2023-10-24", "publisherClass": "legal_text" }, { "title": "I numeri del Fascicolo: utilizzo e documenti del FSE (Ministero della Salute monitoring site; consent data to 31 Aug 2026)", "url": "https://monitopen.fse.salute.gov.it/usage", "date": "undated", "publisherClass": "official" }, { "title": "Italy 2025 Digital Decade country report (Council of the EU, ST 10407/25 ADD 16)", "url": "https://data.consilium.europa.eu/doc/document/ST-10407-2025-ADD-16/en/pdf", "date": "2025-06-18", "publisherClass": "intergov" } ] }, "control": { "score": 72, "summary": "Clinicians may consult the FSE only after the patient gives explicit, revocable consent, and patients can hide any document online and read the access log, both available in all 21 regions. Documents still flow into the FSE automatically without consent.", "sources": [ { "title": "Decreto 7 settembre 2023, Fascicolo sanitario elettronico 2.0 (Gazzetta Ufficiale n. 249)", "url": "https://www.gazzettaufficiale.it/eli/id/2023/10/24/23A05829/sg", "date": "2023-10-24", "publisherClass": "legal_text" }, { "title": "Fascicolo sanitario elettronico (FSE): FAQ (Garante Privacy)", "url": "https://www.garanteprivacy.it/temi/fse", "date": "undated", "publisherClass": "official" }, { "title": "I numeri del Fascicolo: utilizzo e documenti del FSE (Ministero della Salute monitoring site; consent data to 31 Aug 2026)", "url": "https://monitopen.fse.salute.gov.it/usage", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 56, "summary": "Italian law bans publishing health data, makes harmful misuse a crime, and the Garante fines hospitals for snooping. But cyberattacks on health bodies doubled to 57 in 2024, and by January 2026 the Garante's board was under criminal investigation.", "sources": [ { "title": "Codice in materia di protezione dei dati personali, testo coordinato V 12.0 (Garante Privacy)", "url": "https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Relazione sull'attività 2025, sintesi per la stampa (Garante Privacy)", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10266612", "date": "2026-07-02", "publisherClass": "official" }, { "title": "Newsletter n. 551 dell'11 settembre 2026: Azienda sanitaria di Udine sanzionata per 24mila euro (Garante Privacy)", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10294220", "date": "2026-09-11", "publisherClass": "official" }, { "title": "Si dimette Guido Scorza, componente del Garante della Privacy (Rainews)", "url": "https://www.rainews.it/articoli/2026/01/si-dimette-guido-scorza-componente-del-garante-della-privacy-3ce8bda7-3ced-4e6d-8b94-ce4fb7de8298.html", "date": "2026-01-18", "publisherClass": "news" } ] }, "journey": { "score": 66, "summary": "Hospitals, labs and GPs feed the regional FSEs at near full rates, 98.7% of lab, radiology, pathology, discharge and ER events in June 2026, and e-prescriptions run on one national system. The national health data ecosystem (EDS) that should link it all is not yet live.", "sources": [ { "title": "I numeri del Fascicolo: utilizzo e documenti del FSE (Ministero della Salute monitoring site; consent data to 31 Aug 2026)", "url": "https://monitopen.fse.salute.gov.it/usage", "date": "undated", "publisherClass": "official" }, { "title": "Adozione e utilizzo da parte della Regione Sardegna del FSE, relazione (Corte dei conti, Sezione di controllo Sardegna, delibera 373/2026)", "url": "https://cmsras.regione.sardegna.it/api/assets/redazionaleras/9c56d81c-9a7b-47da-8a02-857485a05120/allegato-delibera-373-2026-pnrr-marcato.pdf?version=0", "date": "undated", "publisherClass": "official" }, { "title": "Ricetta elettronica: come funziona (Sistema Tessera Sanitaria, MEF)", "url": "https://sistemats1.sanita.finanze.it/portale/ricetta-elettronica-come-funziona", "date": "undated", "publisherClass": "official" }, { "title": "Fascicolo sanitario elettronico (FSE): FAQ (Garante Privacy)", "url": "https://www.garanteprivacy.it/temi/fse", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 60, "summary": "Italian law bans publishing health data and bars insurers and banks from asking about cancer cured over ten years earlier. No ban on selling health data beyond GDPR was found, and Law 132/2025 lets private firms in public research projects reuse de-identified data without consent.", "sources": [ { "title": "Codice in materia di protezione dei dati personali, testo coordinato V 12.0 (Garante Privacy)", "url": "https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Legge 7 dicembre 2023, n. 193, diritto all'oblio oncologico (Gazzetta Ufficiale)", "url": "https://www.gazzettaufficiale.it/eli/id/2023/12/18/23G00206/sg", "date": "2023-12-18", "publisherClass": "legal_text" }, { "title": "Legge 23 settembre 2025, n. 132, disposizioni in materia di intelligenza artificiale (Gazzetta Ufficiale)", "url": "https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/SG", "date": "2025-09-25", "publisherClass": "legal_text" } ] }, "clinical": { "score": 50, "summary": "Treating doctors, nurses and pharmacists can read the FSE only if the patient has consented, and nationally 43.5% had by August 2026. Consent ranges from 3.8% in Calabria to 90.3% in Trento, so access depends heavily on region.", "sources": [ { "title": "Decreto 7 settembre 2023, Fascicolo sanitario elettronico 2.0 (Gazzetta Ufficiale n. 249)", "url": "https://www.gazzettaufficiale.it/eli/id/2023/10/24/23A05829/sg", "date": "2023-10-24", "publisherClass": "legal_text" }, { "title": "I numeri del Fascicolo: utilizzo e documenti del FSE (Ministero della Salute monitoring site; consent data to 31 Aug 2026)", "url": "https://monitopen.fse.salute.gov.it/usage", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Health data can be used for research without consent when a law or regulation provides for it or informing people is impossible, and there is no general opt-out. Ethics review and Garante notification, criminal penalties and FSE masking give three safeguard classes, at the band cap.", "sources": [ { "title": "Codice in materia di protezione dei dati personali, testo coordinato V 12.0 (Garante Privacy)", "url": "https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Legge 23 settembre 2025, n. 132, disposizioni in materia di intelligenza artificiale (Gazzetta Ufficiale)", "url": "https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/SG", "date": "2025-09-25", "publisherClass": "legal_text" }, { "title": "Fascicolo sanitario elettronico (FSE): FAQ (Garante Privacy)", "url": "https://www.garanteprivacy.it/temi/fse", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission, DG SANTE)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 54, "summary": "Italy's AI law, in force since 10 October 2025, gives patients a right to be told when AI is used and keeps every clinical decision with the doctor. That is one national addition to EU law; the follow-up ministerial decree was not verified.", "sources": [ { "title": "Legge 23 settembre 2025, n. 132, disposizioni in materia di intelligenza artificiale (Gazzetta Ufficiale)", "url": "https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/SG", "date": "2025-09-25", "publisherClass": "legal_text" }, { "title": "Assistenza primaria: al via la sperimentazione nazionale della Piattaforma di Intelligenza Artificiale (Panorama della Sanità)", "url": "https://panoramadellasanita.it/site/assistenza-primaria-al-via-la-sperimentazione-nazionale-della-piattaforma-di-intelligenza-artificiale/", "date": "2025-11-17", "publisherClass": "news" }, { "title": "Digital Omnibus on AI has been published (Regulation (EU) 2026/1744) (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Legge 8 marzo 2017, n. 24 (Gelli-Bianco), art. 4", "level": "National", "year": "2017", "what": "Facilities must supply the patient's records within seven days, additions within 30 days.", "url": "https://www.gazzettaufficiale.it/eli/id/2017/03/17/17G00041/sg" }, { "name": "Decreto-legge 18 ottobre 2012, n. 179, art. 12, as amended by DL 19 maggio 2020, n. 34, art. 11", "level": "National", "year": "2012", "what": "Creates the FSE; since 2020 it is fed continuously by all treating professionals.", "url": "https://www.gazzettaufficiale.it/eli/id/2020/05/19/20G00052/sg" }, { "name": "Decreto 7 settembre 2023, Fascicolo sanitario elettronico 2.0", "level": "National", "year": "2023", "what": "Consent to consultation, masking, access log, notifications and emergency access rules for the FSE.", "url": "https://www.gazzettaufficiale.it/eli/id/2023/10/24/23A05829/sg" }, { "name": "Decreto legislativo 30 giugno 2003, n. 196 (Codice privacy)", "level": "National", "year": "2003", "what": "Health data safeguards, ban on dissemination, research rules (art. 110), criminal penalties (art. 167).", "url": "https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29" }, { "name": "Legge 23 settembre 2025, n. 132 (AI law)", "level": "National", "year": "2025", "what": "Right to know about AI in care; doctor decides; consent-free de-identified data for AI research.", "url": "https://www.gazzettaufficiale.it/eli/id/2025/09/25/25G00143/SG" }, { "name": "Legge 7 dicembre 2023, n. 193 (oblio oncologico)", "level": "National", "year": "2023", "what": "Banks and insurers may not ask about cancer cured over ten years ago.", "url": "https://www.gazzettaufficiale.it/eli/id/2023/12/18/23G00206/sg" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access, restriction and access-log rights; secondary-use opt-out; key parts apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-18", "headline": "Clinic warned after sending a patient's test report to the wrong email address", "paraphrase": "A patient learned his report had gone to an address one letter different from his, carrying his name, birth date and tax code. The regulator found no address check was in place and issued a formal warning.", "source": "Garante per la protezione dei dati personali", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10210247", "theme": "breach", "status": "finding" }, { "date": "2025-03-13", "headline": "Private clinic warned after a patient's full medical file was lost in archiving", "paraphrase": "A clinic could not produce a patient's medical file when investigators asked for it; the archive company said it never received the file. The regulator found the clinic failed to report the loss in time and issued a warning.", "source": "Garante per la protezione dei dati personali", "url": "https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10132289", "theme": "other", "status": "finding" }, { "date": "2024-11-13", "headline": "Hospital warned after hiding a report in a patient's e-record changed its date", "paraphrase": "A patient said a hospital put a report in her electronic health record without telling her. When she asked for it to be hidden, the system created a replacement dated the day of the change. The regulator issued a warning.", "source": "Garante per la protezione dei dati personali", "url": "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10087191", "theme": "record_wrong", "status": "finding" }, { "date": "2025-12-31", "headline": "Prescriptions of about 90,000 Lombardy patients offered for sale after software breach", "paraphrase": "Data stolen in March from the company running a portal family doctors use to send prescriptions went on sale online: prescriptions, sick notes, exemption certificates, emails, phones and addresses. The company reported it to police and warned patients of phishing.", "source": "Il Post", "url": "https://www.ilpost.it/2025/12/31/dati-sanitari-90mila-pazienti-vendita-dark-web/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "TWN", "name": "Taiwan", "region": "Asia", "overall": 63, "rank": "11=", "likelyRank": "5 to 32", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Taiwan's single insurer offers every insured person three years of claims-based records online, with 12.48 million registered users, but full charts stay in each hospital.", "categories": { "access": { "score": 68, "summary": "The Medical Care Act gives a right to a copy of the record, and My Health Bank shows three years of visits, medicines, lab results and imaging reports to 12.48 million registered users. Copies cost the patient, and Liberty Times reported only 1 to 3 million regular users.", "sources": [ { "title": "Medical Care Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020021", "date": "2026-09-23", "publisherClass": "legal_text" }, { "title": "Use My Health Bank to care for your father (MOHW)", "url": "https://www.mohw.gov.tw/cp-3797-43159-1.html", "date": "2018-08-06", "publisherClass": "official" }, { "title": "My Health Bank queries pass 600 million at NHI's 31st anniversary (NHIA)", "url": "https://www.nhi.gov.tw/ch/cp-19750-2913e-3255-1.html", "date": "2026-03-28", "publisherClass": "official" }, { "title": "My Health Bank passes 600 million uses; to shift toward daily health behaviour (Liberty Times)", "url": "https://health.ltn.com.tw/article/breakingnews/5385491", "date": "2026-03-28", "publisherClass": "news" } ] }, "control": { "score": 52, "summary": "A person can set an NHI card password that stops all contracted doctors and pharmacists from viewing their MediCloud data, and a separate opt-out covers research use. The block is a single switch that must be set in person at an NHIA or district office.", "sources": [ { "title": "NHI MediCloud: how does it help my care? Card password option (NHIA medical quality portal)", "url": "https://med.nhi.gov.tw/ihqe0000/pepM1825_1.html", "date": "undated", "publisherClass": "official" }, { "title": "Can I keep some test results from doctors? MediCloud FAQ 22 (NHIA)", "url": "https://www.nhi.gov.tw/ch/cp-7638-9581a-2727-1.html", "date": "2023-11-29", "publisherClass": "official" }, { "title": "Request to stop use of NHI data beyond its specified purpose (NHIA)", "url": "https://www.nhi.gov.tw/ch/np-4049-1.html", "date": "2025-08-07", "publisherClass": "official" }, { "title": "National Health Insurance Data Management Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0060042", "date": "2025-12-19", "publisherClass": "legal_text" } ] }, "privacy": { "score": 50, "summary": "Medical records are a special category under the Personal Data Protection Act, but the independent commission named in the law still does not exist, and sector ministries enforce with fines of NT$50,000 to 500,000. Ransomware attacks in 2025 exposed about 16.6 million patient records.", "sources": [ { "title": "Personal Data Protection Act, version in force (amended 31 May 2023), Laws & Regulations Database", "url": "https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021", "date": "2023-05-31", "publisherClass": "legal_text" }, { "title": "PDPA amendment promulgated 11 November 2025; start date to be set by the Executive Yuan (PDPC Preparatory Office)", "url": "https://www.pdpc.gov.tw/News_Content/20/1010/", "date": "2025-11-11", "publisherClass": "official" }, { "title": "Which government bodies are being stalled? PDPC organic act frozen over 300 days (Watchout)", "url": "https://watchout.tw/reports/DMubi9rCnYi0TRNXD2ZA", "date": "2026-08-05", "publisherClass": "news" }, { "title": "Two charged for buying Mackay and Changhua Christian patient data from hackers (Mirror Media)", "url": "https://www.mirrormedia.mg/story/20260615edi016", "date": "2026-06-15", "publisherClass": "news" } ] }, "journey": { "score": 72, "summary": "One insurer contracts with about 93% of providers, including every hospital, and NHI MediCloud pools 13 types of data plus CT and MRI images from all of them. Full hospital charts are only now being linked through FHIR, with clinics due in 2028.", "sources": [ { "title": "Taiwan Can Help: NHI's contribution in COVID-19 (NHIA)", "url": "https://www.nhi.gov.tw/en/np-47-2.html", "date": "undated", "publisherClass": "official" }, { "title": "Introduction to NHI MediCloud (NHIA)", "url": "https://www.nhi.gov.tw/ch/np-2722-1.html", "date": "2026-03-27", "publisherClass": "official" }, { "title": "MOHW pushes FHIR, 'no penalties first', aims to link all medical centres this year (Storm Media)", "url": "https://www.storm.mg/article/11120658", "date": "2026-04-13", "publisherClass": "news" }, { "title": "RxNorm Taiwan 2025, part 3: Taiwan's e-prescription plan (MOHW AI centres)", "url": "https://aicenter.mohw.gov.tw/AC/cp-7200-85622-208.html", "date": "2026-02-23", "publisherClass": "official" } ] }, "commercial": { "score": 62, "summary": "The NHI Data Management Act bars secondary use of insurance data for commercial profit and limits applicants to government, hospitals, universities and research bodies. Hospital records and consumer apps outside the NHI database fall back on the general privacy law and its small fines.", "sources": [ { "title": "National Health Insurance Data Management Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0060042", "date": "2025-12-19", "publisherClass": "legal_text" }, { "title": "Personal Data Protection Act, version in force (amended 31 May 2023), Laws & Regulations Database", "url": "https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021", "date": "2023-05-31", "publisherClass": "legal_text" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 78, "summary": "Any contracted doctor or pharmacist can see a patient's medicines, results, discharge summaries and images from other providers through MediCloud once the patient's card is inserted. Results and images go back only 12 months, and full notes from other hospitals are not yet shared.", "sources": [ { "title": "Does viewing test results need the patient's signed consent? MediCloud FAQ 15 (NHIA)", "url": "https://www.nhi.gov.tw/ch/cp-7631-ccbac-2727-1.html", "date": "2026-06-03", "publisherClass": "official" }, { "title": "Can my 10 years of hospital tests be viewed elsewhere? MediCloud FAQ 10 (NHIA)", "url": "https://www.nhi.gov.tw/ch/cp-7626-18210-2727-1.html", "date": "2026-06-03", "publisherClass": "official" }, { "title": "Introduction to NHI MediCloud (NHIA)", "url": "https://www.nhi.gov.tw/ch/np-2722-1.html", "date": "2026-03-27", "publisherClass": "official" }, { "title": "Electronic record integration from May; no discs needed across hospitals (PTS)", "url": "https://news.pts.org.tw/article/803567", "date": "2026-04-14", "publisherClass": "news" } ] }, "research": { "score": 66, "summary": "Researchers keep access to near-national insurance data, but since August 2026 the law lets anyone opt out of all or part of it, with public lists of approved projects. By September 2026, 24,511 people, about 1 in 1,000, had opted out.", "sources": [ { "title": "National Health Insurance Data Management Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0060042", "date": "2025-12-19", "publisherClass": "legal_text" }, { "title": "Request to stop use of NHI data beyond its specified purpose (NHIA)", "url": "https://www.nhi.gov.tw/ch/np-4049-1.html", "date": "2025-08-07", "publisherClass": "official" }, { "title": "MOHW: nearly 25,000 apply to opt out of NHI data secondary use (CNA)", "url": "https://www.cna.com.tw/news/ahel/202609160155.aspx", "date": "2026-09-16", "publisherClass": "news" }, { "title": "Human Subjects Research Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020176", "date": "2019-01-02", "publisherClass": "legal_text" } ] }, "ai": { "score": 58, "summary": "Clinical AI software is a medical device that needs TFDA approval, and changes to listed items need approval too. The AI-specific change plan route (2024) and machine learning principles (2026) are guidance, not law, so Taiwan sits low in the device-regulation band.", "sources": [ { "title": "Medical Devices Act, full text (Laws & Regulations Database)", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0030106", "date": "2020-01-15", "publisherClass": "legal_text" }, { "title": "Notice: predetermined change control plan guide for AI/ML medical device software (TFDA)", "url": "https://www.fda.gov.tw/TC/siteListContent.aspx?sid=11652&id=47477", "date": "2024-09-25", "publisherClass": "official" }, { "title": "Notice: good machine learning practice for AI medical devices (TFDA)", "url": "https://www.fda.gov.tw/TC/siteListContent.aspx?id=50868&sid=310", "date": "2026-06-08", "publisherClass": "official" }, { "title": "Guideline on generative AI in medical institutions (MOHW)", "url": "https://www.mohw.gov.tw/dl-100614-c7d35394-0a6b-448e-9d90-295294596d98.html", "date": "2026-05-29", "publisherClass": "official" } ] } }, "laws": [ { "name": "National Health Insurance Data Management Act", "level": "National", "year": "2025", "what": "Opt-out from secondary use, no commercial-profit use, fines up to NT$10 million; in force 10 August 2026.", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0060042" }, { "name": "Personal Data Protection Act", "level": "National", "year": "1995", "what": "Health data special category; rights to copy and delete; 2025 amendment creating breach reporting not yet in force.", "url": "https://law.moj.gov.tw/LawClass/LawOldVer.aspx?pcode=I0050021" }, { "name": "Medical Care Act", "level": "National", "year": "1986", "what": "Patients may get a copy of their record at their own cost; privacy duties; last amended September 2026.", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020021" }, { "name": "Human Subjects Research Act", "level": "National", "year": "2011", "what": "Ethics committee approval and withdrawable informed consent for research on people.", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0020176" }, { "name": "Medical Devices Act", "level": "National", "year": "2020", "what": "Software is a medical device; registration and approval of designated changes required.", "url": "https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=L0030106" }, { "name": "Artificial Intelligence Basic Act", "level": "National", "year": "2026", "what": "Seven AI principles including human oversight; warnings required on AI deemed high risk.", "url": "https://www.president.gov.tw/File/Doc/d961e5b2-f8c4-424b-8993-4a52702ae8c7" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-03-06", "headline": "Mackay Memorial Hospital apologises after ransomware attack that may have taken patient data", "paraphrase": "After a ransomware attack, the hospital issued statements apologising and saying hackers may have stolen data while encrypting its systems. Millions of patient records were reportedly offered for sale; the ministry said the source still needed checking.", "source": "Knews (知新聞)", "url": "https://www.knews.com.tw/news/8A16D5DBB40F177A4BECE981103631A9", "theme": "breach", "status": "admitted" }, { "date": "2026-06-15", "headline": "Two men charged with buying hacked hospital patient records to resell online", "paraphrase": "Prosecutors charged two men with paying cryptocurrency for a file of about 20,000 hospital patients' visit and health records stolen by hackers, then advertising hospital data for sale on a messaging app. Prosecutors asked for heavy sentences.", "source": "Central News Agency (中央社)", "url": "https://www.cna.com.tw/news/asoc/202606150041.aspx", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-09-21", "headline": "Doctor charged with looking up other doctors' patients' records to win their business", "paraphrase": "Prosecutors charged a hospital doctor with opening the records and contact details of three patients under other doctors' care, then texting them to criticise their doctors and urge them to switch to him. He has not been convicted.", "source": "Central News Agency (中央社)", "url": "https://www.cna.com.tw/news/asoc/202609210043.aspx", "theme": "other", "status": "alleged" } ] }, { "iso3": "TUR", "name": "Turkey", "region": "Europe", "overall": 63, "rank": "11=", "likelyRank": "4 to 29", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "e-Nabız gives nearly every Turk one national record with an access log and SMS-code consent, but the state holds the data centrally.", "categories": { "access": { "score": 74, "summary": "The Patient Rights Regulation gives a right to examine the file and take a copy, and the national e-Nabız portal shows labs, imaging, prescriptions, diagnoses and reports. The minister said it served over 79 million citizens in 2025.", "sources": [ { "title": "Hasta Hakları Yönetmeliği (mevzuat.gov.tr)", "url": "https://www.mevzuat.gov.tr/File/GeneratePdf?mevzuatNo=4847&mevzuatTur=KurumVeKurulusYonetmeligi&mevzuatTertip=5", "date": "1998-08-01", "publisherClass": "legal_text" }, { "title": "e-Nabız Yardım (Sağlık Bakanlığı)", "url": "https://enabiz.gov.tr/Yardim/Index", "date": "undated", "publisherClass": "official" }, { "title": "Bakan Memişoğlu'ndan sağlıkta dijital dönüşüm çalışmalarına ilişkin paylaşım (Hürriyet)", "url": "https://www.hurriyet.com.tr/gundem/bakan-memisoglundan-saglikta-dijital-donusum-calismalarina-iliskin-paylasim-43070060", "date": "2025-12-28", "publisherClass": "news" }, { "title": "Milyonlarca kişiyi ilgilendiren güncelleme: e-Nabız yenilendi (Ekonomim)", "url": "https://www.ekonomim.com/gundem/milyonlarca-kisiyi-ilgilendiren-guncelleme-e-nabiz-yenilendi-haberi-825172", "date": "2025-06-18", "publisherClass": "news" } ] }, "control": { "score": 62, "summary": "Patients can see every access to their e-Nabız account by date and time, and can require an SMS code before most doctors see their past data. Family, emergency and inpatient doctors keep access, and records held by the ministry cannot be deleted.", "sources": [ { "title": "e-Nabız Yardım (Sağlık Bakanlığı)", "url": "https://enabiz.gov.tr/Yardim/Index", "date": "undated", "publisherClass": "official" }, { "title": "e-Nabız (Sağlık Bakanlığı)", "url": "https://enabiz.gov.tr/", "date": "undated", "publisherClass": "official" }, { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelik (Resmî Gazete)", "url": "https://www.resmigazete.gov.tr/eskiler/2019/06/20190621-3.htm", "date": "2019-06-21", "publisherClass": "legal_text" }, { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelikte Değişiklik Yapılmasına Dair Yönetmelik (Resmî Gazete 33096)", "url": "https://www.resmigazete.gov.tr/eskiler/2025/12/20251203-2.htm", "date": "2025-12-03", "publisherClass": "legal_text" } ] }, "privacy": { "score": 50, "summary": "Law 6698 (KVKK) treats health data as special-category data, and the regulator has fined clinics for snooping in e-Nabız. The European Commission's 2025 report says the law is not adequate and enforcement has serious gaps.", "sources": [ { "title": "Kişisel Verilerin Korunması Kanunu No. 6698 (mevzuat.gov.tr)", "url": "https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf", "date": "2016-04-07", "publisherClass": "legal_text" }, { "title": "KVKK Board decision 2023/695: unlawful access to e-Nabız by a private medical center", "url": "https://www.kvkk.gov.tr/Icerik/7754/2023-695", "date": "2023-05-02", "publisherClass": "official" }, { "title": "Türkiye 2025 Report, SWD(2025) 756 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/4bb4ddd1-4f20-4ee0-92db-926996ec8dd1_en?filename=t%C3%BCrkiye-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Sağlık Verilerinin Güvenli Olarak Toplanması ve Paylaşımı Çalıştayı raporu (TÜSEB, İTÜ)", "url": "https://bm.itu.edu.tr/docs/librariesprovider92/default-document-library/svg-rapor.pdf?sfvrsn=1cb04587_2", "date": "2025-10", "publisherClass": "academic" } ] }, "journey": { "score": 80, "summary": "Since 2019 the social security fund (SGK) will not pay for a service unless the provider has sent it to e-Nabız, which ties public and private hospitals to one record. A central teleradiology archive stores images nationwide.", "sources": [ { "title": "e-Nabız SGK (Medula) veri doğrulaması hk. (Sağlık Bakanlığı)", "url": "https://e-saglik.gov.tr/TR,53387/e-nabiz-sgk-medula-veri-dogrulamasi-hk.html", "date": "undated", "publisherClass": "official" }, { "title": "Sağlık Verilerinin Güvenli Olarak Toplanması ve Paylaşımı Çalıştayı raporu (TÜSEB, İTÜ)", "url": "https://bm.itu.edu.tr/docs/librariesprovider92/default-document-library/svg-rapor.pdf?sfvrsn=1cb04587_2", "date": "2025-10", "publisherClass": "academic" }, { "title": "Milyonlarca kişiyi ilgilendiren güncelleme: e-Nabız yenilendi (Ekonomim)", "url": "https://www.ekonomim.com/gundem/milyonlarca-kisiyi-ilgilendiren-guncelleme-e-nabiz-yenilendi-haberi-825172", "date": "2025-06-18", "publisherClass": "news" } ] }, "commercial": { "score": 55, "summary": "Health data needs explicit consent or a legal basis, and the regulator ruled that even consent cannot let a private hospital use patient data for advertising. No Turkish rule on selling de-identified health data was verified.", "sources": [ { "title": "KVKK Board decision 2023/787: hospital advertising using patient health data", "url": "https://www.kvkk.gov.tr/Icerik/7692/2023-787", "date": "2023-05-11", "publisherClass": "official" }, { "title": "Kişisel Verilerin Korunması Kanunu No. 6698 (mevzuat.gov.tr)", "url": "https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf", "date": "2016-04-07", "publisherClass": "legal_text" }, { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelik (Resmî Gazete)", "url": "https://www.resmigazete.gov.tr/eskiler/2019/06/20190621-3.htm", "date": "2019-06-21", "publisherClass": "legal_text" } ] }, "clinical": { "score": 64, "summary": "The family doctor sees the record without limit, and emergency and inpatient doctors see it until discharge. Other access to past records needs the patient's phone code, so the score stays in the mixed band despite a broad shared record.", "sources": [ { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelik (Resmî Gazete)", "url": "https://www.resmigazete.gov.tr/eskiler/2019/06/20190621-3.htm", "date": "2019-06-21", "publisherClass": "legal_text" }, { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelikte Değişiklik Yapılmasına Dair Yönetmelik (Resmî Gazete 33096)", "url": "https://www.resmigazete.gov.tr/eskiler/2025/12/20251203-2.htm", "date": "2025-12-03", "publisherClass": "legal_text" }, { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelik'te yapılan son değişiklikler (Acar Ergönen)", "url": "https://acarergonen.av.tr/tr/yayinlar/duyurular/kisisel-saglik-verileri-hakkinda-yonetmelik-te-yapilan-son-degisiklikler", "date": "2025-12-24", "publisherClass": "law_firm" }, { "title": "KVKK Board decision 2021/962: hospital doctor accessed e-Nabız without consent", "url": "https://www.kvkk.gov.tr/Icerik/7074/-Ilgili-kisinin-talebi-ya-da-rizasi-olmaksizin-ozel-bir-hastane-calisani-hekim-tarafindan-e-nabiz-sistemine-erisim-saglanmasi-hakkinda-Kisisel-Verileri-Koruma-Kurulunun-21-09-2021-tarihli-ve-2021-962-sayili-Karari", "date": "2021-09-21", "publisherClass": "official" } ] }, "research": { "score": 44, "summary": "The health data regulation allows research on anonymised data without consent, and on identifiable data if safeguards exist. No general opt-out or public register was verified, though drug trials need written consent and ethics approval.", "sources": [ { "title": "Kişisel Sağlık Verileri Hakkında Yönetmelik (Resmî Gazete)", "url": "https://www.resmigazete.gov.tr/eskiler/2019/06/20190621-3.htm", "date": "2019-06-21", "publisherClass": "legal_text" }, { "title": "Beşeri Tıbbi Ürünlerin Klinik Araştırmaları Hakkında Yönetmelik (Resmî Gazete)", "url": "https://www.resmigazete.gov.tr/eskiler/2023/05/20230527-5.htm", "date": "2023-05-27", "publisherClass": "legal_text" }, { "title": "Türkiye 2025 Report, SWD(2025) 756 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/4bb4ddd1-4f20-4ee0-92db-926996ec8dd1_en?filename=t%C3%BCrkiye-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Medical AI software falls under Turkey's 2021 Medical Device Regulation, which mirrors EU MDR 2017/745. Turkey has no AI law yet; an AI Action Plan for 2026 to 2030 was published in August 2026.", "sources": [ { "title": "Tıbbi Cihaz Mevzuatı (TİTCK)", "url": "https://www.titck.gov.tr/faaliyetalanlari/tibbicihaz/tibbi-cihaz-mevzuati", "date": "undated", "publisherClass": "official" }, { "title": "Türkiye 2025 Report, SWD(2025) 756 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/4bb4ddd1-4f20-4ee0-92db-926996ec8dd1_en?filename=t%C3%BCrkiye-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Türkiye Yapay Zeka Eylem Planı Genelgesi Resmi Gazete'de (Memurlar.net)", "url": "https://www.memurlar.net/haber/1175670/turkiye-yapay-zeka-eylem-plani-genelgesi-resmi-gazete-de.html", "date": "2026-08-18", "publisherClass": "news" }, { "title": "TBMM'nin Yapay Zekâ Komisyonu raporuna ilişkin TMMOB görüşü (BMO)", "url": "https://www.bmo.org.tr/2026/04/01/tbmmnin-yapay-zeka-komisyonu-raporuna-iliskin-tmmob-gorusu/", "date": "2026-03-30", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Law No. 6698 on the Protection of Personal Data (KVKK)", "level": "National", "year": "2016", "what": "Health is special-category data; access rights; breach notice; amended 2024 by Law 7499.", "url": "https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf" }, { "name": "Regulation on Personal Health Data (Kişisel Sağlık Verileri Hakkında Yönetmelik)", "level": "National", "year": "2019", "what": "Sets who may access e-Nabız data, privacy settings, and research use of anonymised data.", "url": "https://www.resmigazete.gov.tr/eskiler/2019/06/20190621-3.htm" }, { "name": "Amendment to the Regulation on Personal Health Data (Official Gazette 33096)", "level": "National", "year": "2025", "what": "Past data needs a patient phone code; lists doctors who keep access without one.", "url": "https://www.resmigazete.gov.tr/eskiler/2025/12/20251203-2.htm" }, { "name": "Patient Rights Regulation (Hasta Hakları Yönetmeliği)", "level": "National", "year": "1998", "what": "Right to examine and copy one's health records and ask for corrections.", "url": "https://www.mevzuat.gov.tr/File/GeneratePdf?mevzuatNo=4847&mevzuatTur=KurumVeKurulusYonetmeligi&mevzuatTertip=5" }, { "name": "Medical Device Regulation (Tıbbi Cihaz Yönetmeliği)", "level": "National", "year": "2021", "what": "Harmonised with EU MDR 2017/745; covers medical device software including AI.", "url": "https://www.titck.gov.tr/faaliyetalanlari/tibbicihaz/tibbi-cihaz-mevzuati" }, { "name": "Regulation on Clinical Trials of Human Medicinal Products", "level": "National", "year": "2023", "what": "Written informed consent, withdrawal at any time, ethics and agency approval.", "url": "https://www.resmigazete.gov.tr/eskiler/2023/05/20230527-5.htm" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-23", "headline": "Ministry inspectors penalise hospital staff who sold patient details to claims firms", "paraphrase": "Staff at a public hospital copied patients' identity and contact details from the hospital information system and passed them to unlicensed insurance claims firms for commission. Health Ministry inspectors dismissed staff and suspended a doctor; a criminal investigation continues.", "source": "Bizim Sakarya", "url": "https://www.bizimsakarya.com.tr/seahta-veri-sizintisi-skandali-hasta-bilgilerini-satan-saglikcilara-ihrac-yagdi", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-04-04", "headline": "Ransomware attack on a private hospital exposes highly sensitive patient data", "paraphrase": "Attackers encrypted servers at a private hospital. The breach notice published by the data protection authority lists patients, staff and visitors among those affected, with data including sexual life and biometric details. The number affected was not yet known.", "source": "T24", "url": "https://t24.com.tr/gundem/ozel-hastaneye-siber-saldiri-hastalarin-cinsel-yasam-bilgileri-dahil-verileri-sizdirildi,1312070", "theme": "breach", "status": "admitted" }, { "date": "2026-08-03", "headline": "Records of about 20,000 private hospital patients reportedly posted for free download", "paraphrase": "A user claiming to hold a private hospital's database reportedly posted patients' identity numbers, addresses, diagnoses, prescriptions and insurance details online. The leak was unconfirmed and neither the hospital nor authorities had commented when reported.", "source": "Pamukkale Haber", "url": "https://www.pamukkalehaber.com/denizliyi-sarsan-iddia-hasta-verileri-internete-dustu", "theme": "breach", "status": "alleged" }, { "date": "2026-09-09", "headline": "Health services company tells regulator ransomware encrypted its systems; affected people still unknown", "paraphrase": "A health services company notified the data protection authority that a ransomware attack encrypted its data over two days. It could not yet say which people or data categories were affected. The board ordered the notice published.", "source": "Kişisel Verileri Koruma Kurumu (KVKK)", "url": "https://www.kvkk.gov.tr/Icerik/8956/kamuoyu-duyurusu-veri-ihlali-bildirimi-ada-mert-saglik-hizmetleri-ticaret-as", "theme": "breach", "status": "admitted" } ] }, { "iso3": "ISL", "name": "Iceland", "region": "Europe", "overall": 62, "rank": "16=", "likelyRank": "5 to 32", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Iceland's records are linked across nearly all public care and patients can block sharing, but the Heilsuvera portal shows only part of the record.", "categories": { "access": { "score": 62, "summary": "The Medical Records Act gives a right to a copy of the whole record, clarified by a 2025 amendment. Heilsuvera shows prescriptions, vaccinations and dates of hospital and clinic visits, but not clinical notes or lab results.", "sources": [ { "title": "Lög um sjúkraskrár nr. 55/2009 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2009055.html", "date": "2026-09-01", "publisherClass": "legal_text" }, { "title": "Breytingar á lögum um sjúkraskrár samþykktar á Alþingi (Stjórnarráðið)", "url": "https://www.stjornarradid.is/efst-a-baugi/frettir/stok-frett/2025/11/21/Breytingar-a-logum-um-sjukraskrar-samthykktar-a-Althingi/", "date": "2025-11-21", "publisherClass": "official" }, { "title": "Persónuverndarstefna Heilsuveru", "url": "https://www.heilsuvera.is/personuverndarstefna/", "date": "2025-06-03", "publisherClass": "official" }, { "title": "Aðgangur að sjúkraskrá (island.is)", "url": "https://island.is/sjukraskra", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 55, "summary": "Patients can ban sharing through linked record systems, for a whole provider, a department or a named party, and have a legal right to learn who looked at their record. Bans need a signed form, and the access log comes on request only.", "sources": [ { "title": "Lög um sjúkraskrár nr. 55/2009 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2009055.html", "date": "2026-09-01", "publisherClass": "legal_text" }, { "title": "Access to health records: FAQ (island.is)", "url": "https://island.is/en/access-to-health-records/faq-health-records", "date": "undated", "publisherClass": "official" }, { "title": "Persónuverndarstefna Heilsuveru", "url": "https://www.heilsuvera.is/personuverndarstefna/", "date": "2025-06-03", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "GDPR applies through the EEA and Act 90/2018, and the regulator has fined health bodies. In 2023 it fined the Directorate of Health 12 million kr after a Heilsuvera flaw left messages and maternity attachments open to other logged-in users.", "sources": [ { "title": "Sekt vegna öryggisveikleika í Heilsuveru (Persónuvernd)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/sekt-vegna-oryggisveikleika-i-heilsuveru", "date": "2023-06-27", "publisherClass": "official" }, { "title": "Sekt á hendur Heilsugæslu höfuðborgarsvæðisins (Persónuvernd)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/sekt-a-hendur-heilsugaeslu-hofudborgarsvaedisins-vegna-vinnslu-personuupplysinga-i-sameiginlegu-sjukraskrarkerfi", "date": "2025-02-17", "publisherClass": "official" }, { "title": "Lög um persónuvernd og vinnslu persónuupplýsinga nr. 90/2018 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2018090.html", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 76, "summary": "A 2019 Nordic Council of Ministers report says all hospitals and primary care clinics share records over the national HealthNet, and every pharmacy is linked for e-prescriptions. Some private providers still keep non-digital records until a December 2026 deadline.", "sources": [ { "title": "eHealth standardisation in the Nordic countries (TemaNord 2019:537)", "url": "https://norden.diva-portal.org/smash/get/diva2:1340369/FULLTEXT01.pdf", "date": "2019", "publisherClass": "intergov" }, { "title": "Breytingar á lögum um sjúkraskrár samþykktar á Alþingi (Stjórnarráðið)", "url": "https://www.stjornarradid.is/efst-a-baugi/frettir/stok-frett/2025/11/21/Breytingar-a-logum-um-sjukraskrar-samthykktar-a-Althingi/", "date": "2025-11-21", "publisherClass": "official" }, { "title": "Heilbrigðisþjónusta yfir landamæri (island.is)", "url": "https://island.is/heilbrigdisthjonusta-yfir-landamaeri", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "The Medical Records Act bars any access to records without a legal basis, which shuts out insurers and employers by default. No Iceland-specific ban on selling health data or using it for marketing beyond GDPR was verified.", "sources": [ { "title": "Lög um sjúkraskrár nr. 55/2009 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2009055.html", "date": "2026-09-01", "publisherClass": "legal_text" }, { "title": "Sekt á hendur Heilsugæslu höfuðborgarsvæðisins (Persónuvernd)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/sekt-a-hendur-heilsugaeslu-hofudborgarsvaedisins-vegna-vinnslu-personuupplysinga-i-sameiginlegu-sjukraskrarkerfi", "date": "2025-02-17", "publisherClass": "official" } ] }, "clinical": { "score": 74, "summary": "Treating staff can reach records at other providers through linked systems unless the patient has banned it, and every doctor can see all prescriptions and dispensings. Patients can pre-authorise sharing of key data for emergency care elsewhere in the EEA.", "sources": [ { "title": "Lög um sjúkraskrár nr. 55/2009 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2009055.html", "date": "2026-09-01", "publisherClass": "legal_text" }, { "title": "Aðgangur að lyfjagagnagrunni (island.is)", "url": "https://island.is/adgangur-ad-lyfjagagnagrunni", "date": "2026-09-11", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Research on health records can proceed without individual consent once an ethics committee approves, and each research look into a record is logged in it. Patients can bar identifiable storage in research health-data collections, but no general opt-out from record research was found.", "sources": [ { "title": "Lög um vísindarannsóknir á heilbrigðissviði nr. 44/2014 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2014044.html", "date": "2026-09-01", "publisherClass": "legal_text" }, { "title": "Lífsýni (island.is)", "url": "https://island.is/lifsyni", "date": "undated", "publisherClass": "official" }, { "title": "Lög nr. 34/2025 um breytingu á lögum um landlækni og lýðheilsu og lögum um sjúkraskrár", "url": "https://www.althingi.is/altext/stjt/2025.034.html", "date": "2025-06-19", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "EU medical device rules apply through Act 132/2020, but the EU AI Act is not yet law in Iceland. The minister said on 27 September 2026 that a consultation on adopting it would open this autumn.", "sources": [ { "title": "Lög um lækningatæki nr. 132/2020 (Alþingi)", "url": "https://www.althingi.is/lagas/nuna/2020132.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "Boðar fyrstu lögin og reglurnar gagnvart gervigreind (Vísir)", "url": "https://www.visir.is/g/20262939826d/bodar-fyrstu-login-og-reglurnar-gagnvart-gervigreind", "date": "2026-09-27", "publisherClass": "news" } ] } }, "laws": [ { "name": "Medical Records Act (lög um sjúkraskrár) no. 55/2009", "level": "National", "year": "2009", "what": "Right to a copy, who-accessed information, bans on linked sharing, research storage ban, penalties.", "url": "https://www.althingi.is/lagas/nuna/2009055.html" }, { "name": "Act no. 81/2025 amending the Medical Records Act", "level": "National", "year": "2025", "what": "Clarifies right to copies, sets copy fees and appeals, requires digital records by 1 December 2026.", "url": "https://www.althingi.is/altext/stjt/2025.081.html" }, { "name": "Act no. 34/2025 on health registries and quality registries", "level": "National", "year": "2025", "what": "Sets Directorate of Health registries and quality registries; de-identified data for research and planning.", "url": "https://www.althingi.is/altext/stjt/2025.034.html" }, { "name": "Data Protection Act no. 90/2018 (GDPR via EEA)", "level": "National", "year": "2018", "what": "Gives GDPR force in Iceland; health data sensitive; independent regulator Persónuvernd.", "url": "https://www.althingi.is/lagas/nuna/2018090.html" }, { "name": "Health Research Act (lög um vísindarannsóknir á heilbrigðissviði) no. 44/2014", "level": "National", "year": "2014", "what": "Consent rules for health research; ethics committee may approve record use without consent.", "url": "https://www.althingi.is/lagas/nuna/2014044.html" }, { "name": "Medical Devices Act (lög um lækningatæki) no. 132/2020", "level": "National", "year": "2020", "what": "Gives EU MDR and IVDR legal force in Iceland from 26 May 2021.", "url": "https://www.althingi.is/lagas/nuna/2020132.html" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-05-12", "headline": "Specialist doctor's repeated look-ups in a patient's record ruled unlawful", "paraphrase": "A specialist doctor opened an adult's health record six times over several years without a treatment relationship or consent. The data protection authority ruled those look-ups unlawful but imposed no fine.", "source": "Persónuvernd (Icelandic Data Protection Authority)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/uppflettingar-landspitala-og-serfraedilaeknis-i-sjukraskra", "theme": "breach", "status": "finding" }, { "date": "2025-11-17", "headline": "National hospital sent a patient's health data to the wrong primary care clinic", "paraphrase": "The national hospital sent an adult patient's sensitive health information to a primary care clinic she was not registered with. The data protection authority ruled the disclosure unlawful; the hospital said it regretted the mistake.", "source": "Persónuvernd (Icelandic Data Protection Authority)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/uppflettingar-laeknis-i-sjukraskra-og-midlun-landspitalans-a-vidkvaemum-personuupplysingum-17-11-2025", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-11-03", "headline": "Hospital employee's look-ups in a patient's record ruled unlawful", "paraphrase": "A hospital employee opened an adult patient's health record twice with no work reason. The data protection authority held the employee personally responsible and ruled the look-ups unlawful.", "source": "Persónuvernd (Icelandic Data Protection Authority)", "url": "https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/oheimilar-uppflettingar-starfsmanns-landspitala-i-sjukraskra-3-11-2025", "theme": "breach", "status": "finding" }, { "date": "2025-06-11", "headline": "Court upholds fine over patient portal flaw that exposed other people's health files", "paraphrase": "A district court confirmed the data protection authority's finding that the national patient portal had a serious security weakness letting users open others' health files and messages. It cut the fine on the Directorate of Health to ISK 8 million.", "source": "Persónuvernd (Icelandic Data Protection Authority), on Reykjavík District Court case E-2571/2024", "url": "https://island.is/en/news/akvoerdun-personuverndar-um-oeryggisveikleika-i-heilsuveru-stadfest-i", "theme": "breach", "status": "finding" }, { "date": "2025-12-29", "headline": "Patient alleges doctors falsified record entries as complaint waits over three years", "paraphrase": "A patient told the parliamentary ombudsman that two doctors entered false information in their health record and that access requests were mishandled. A complaint to the Directorate of Health had been pending since November 2022.", "source": "DV", "url": "https://www.dv.is/frettir/2025/12/29/laeknar-sakadir-um-ad-falsa-sjukraskyrslu-til-rannsoknar-hja-landlaekni-thrju-ar/", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "ISR", "name": "Israel", "region": "Middle East", "overall": 62, "rank": "16=", "likelyRank": "6 to 34", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Every Israeli can read most of their record in their health fund's app, but the national exchange offers only an all-or-nothing opt-out.", "categories": { "access": { "score": 66, "summary": "The Patient's Rights Act gives a right to the record and a copy, and a 2019 ministry circular makes all four health funds show members structured and free-text data online. No fixed deadline was found and no official usage figure was verified.", "sources": [ { "title": "Chok Zchuyot HaCholeh, 1996 (Patient's Rights Act), sections 18 to 20, consolidated text (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94", "date": "undated", "publisherClass": "legal_text" }, { "title": "Takanot Zchuyot HaCholeh (maximum fee for a copy of a medical record or viewing it), 2019 (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%AA%D7%A7%D7%A0%D7%95%D7%AA_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94_(%D7%AA%D7%A9%D7%9C%D7%95%D7%9D_%D7%9E%D7%A8%D7%91%D7%99_%D7%91%D7%A2%D7%93_%D7%9E%D7%A1%D7%99%D7%A8%D7%AA_%D7%94%D7%A2%D7%AA%D7%A7_%D7%A8%D7%A9%D7%95%D7%9E%D7%94_%D7%A8%D7%A4%D7%95%D7%90%D7%99%D7%AA_%D7%90%D7%95_%D7%A2%D7%99%D7%95%D7%9F_%D7%91%D7%94)", "date": "undated", "publisherClass": "legal_text" }, { "title": "Director-General Circular 8/2019: giving patients access to personal health data, 'Health in the palm of your hand' (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk08-2019/he/files_circulars_mk_mk08_2019.pdf", "date": "2019-11-11", "publisherClass": "official" }, { "title": "Clalit app: your medical information (Clalit Health Services)", "url": "https://www.clalit.co.il/he/info/services/Pages/new_app.aspx", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 50, "summary": "Everyone is in the national Eitan exchange by default and can leave only completely, by a request at a health fund branch that is handled within 30 days. Every view is logged, but no patient-facing view of that log was found.", "sources": [ { "title": "HaReshet HaLeumit LeShituf Meida Refui, Eitan (Ministry of Health)", "url": "https://www.gov.il/he/pages/shared-medical-info", "date": "2026-09-10", "publisherClass": "official" }, { "title": "Director-General Circular 8/2019: giving patients access to personal health data, 'Health in the palm of your hand' (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk08-2019/he/files_circulars_mk_mk08_2019.pdf", "date": "2019-11-11", "publisherClass": "official" }, { "title": "Chok Zchuyot HaCholeh, 1996 (Patient's Rights Act), sections 18 to 20, consolidated text (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94", "date": "undated", "publisherClass": "legal_text" }, { "title": "Chok Niyud Meida Refui, 2024 (Medical Information Portability Law), consolidated with Amendment 2 of 2025 (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%A0%D7%99%D7%95%D7%93_%D7%9E%D7%99%D7%93%D7%A2_%D7%A8%D7%A4%D7%95%D7%90%D7%99", "date": "undated", "publisherClass": "legal_text" } ] }, "privacy": { "score": 58, "summary": "Amendment 13, in force since 14 August 2025, makes health data specially sensitive and forces hospitals and health funds to appoint data protection officers. In July 2026 the regulator fined Meuhedet NIS 256,000 for reporting a breach two months late.", "sources": [ { "title": "Chok Haganat HaPratiut, 1981 (Protection of Privacy Law), consolidated with Amendment 13 (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%94%D7%92%D7%A0%D7%AA_%D7%94%D7%A4%D7%A8%D7%98%D7%99%D7%95%D7%AA", "date": "undated", "publisherClass": "legal_text" }, { "title": "Israel: Significant Amendment to the Privacy Law Takes Effect (Pearl Cohen)", "url": "https://www.pearlcohen.com/israel-significant-amendment-to-the-privacy-law-takes-effect/", "date": "2025-09-03", "publisherClass": "law_firm" }, { "title": "Meuhedet fined NIS 256,000, first fine since the privacy law amendment (NWS News)", "url": "https://nws.report/health-and-environment/151313/", "date": "2026-07-21", "publisherClass": "news" }, { "title": "Clalit probes suspected cyberattack after Iranian-linked hackers leak patient files (Ynet News)", "url": "https://www.ynetnews.com/health_science/article/ry0gesnobl", "date": "2026-02-25", "publisherClass": "news" } ] }, "journey": { "score": 78, "summary": "Eitan links hospitals, health funds, mother and child clinics, district health offices and prison medicine, and health funds receive emergency and discharge summaries every day. Each health fund keeps primary care, labs and pharmacy in one record.", "sources": [ { "title": "HaReshet HaLeumit LeShituf Meida Refui, Eitan (Ministry of Health)", "url": "https://www.gov.il/he/pages/shared-medical-info", "date": "2026-09-10", "publisherClass": "official" }, { "title": "Digital prescriptions (Maccabi Healthcare Services)", "url": "https://www.maccabi4u.co.il/31276/digital-services/medication/digital_prescriptions/", "date": "undated", "publisherClass": "official" }, { "title": "Chok Niyud Meida Refui, 2024 (Medical Information Portability Law), consolidated with Amendment 2 of 2025 (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%A0%D7%99%D7%95%D7%93_%D7%9E%D7%99%D7%93%D7%A2_%D7%A8%D7%A4%D7%95%D7%90%D7%99", "date": "undated", "publisherClass": "legal_text" }, { "title": "Publication of the National Health Registries Draft Bill (2025) for public comment (Gornitzky)", "url": "https://www.gornitzky.com/publication-of-the-national-health-registries-draft-bill-2025-for-public-comment/", "date": "2025-12-28", "publisherClass": "law_firm" } ] }, "commercial": { "score": 56, "summary": "Ministry circulars bar exclusive data deals beyond 18 months, require a stated public benefit and forbid uses aimed at insurance or employment discrimination. These are circulars, not statute, and they regulate commercial collaborations rather than ban them.", "sources": [ { "title": "Director-General Circular 2/2018: collaborations based on secondary use of health data (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk02-2018/he/files_circulars_mk_MK02_2018.pdf", "date": "2018-01-17", "publisherClass": "official" }, { "title": "Director-General Circular 1/2018: secondary uses of health data (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk01-2018/he/files_circulars_mk_MK01_2018.pdf", "date": "2018-01-17", "publisherClass": "official" }, { "title": "Chok Meida Geneti, 2000 (Genetic Information Law), insurer provisions (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%9E%D7%99%D7%93%D7%A2_%D7%92%D7%A0%D7%98%D7%99", "date": "undated", "publisherClass": "legal_text" }, { "title": "Chok Haganat HaPratiut, 1981 (Protection of Privacy Law), consolidated with Amendment 13 (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%94%D7%92%D7%A0%D7%AA_%D7%94%D7%A4%D7%A8%D7%98%D7%99%D7%95%D7%AA", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 75, "summary": "Authorised clinicians at any member hospital or health fund can view a patient's data from other members during the visit, without asking for consent. Highly confidential items are never shown, and patients who opted out appear with no data.", "sources": [ { "title": "HaReshet HaLeumit LeShituf Meida Refui, Eitan (Ministry of Health)", "url": "https://www.gov.il/he/pages/shared-medical-info", "date": "2026-09-10", "publisherClass": "official" }, { "title": "Chok Zchuyot HaCholeh, 1996 (Patient's Rights Act), sections 18 to 20, consolidated text (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94", "date": "undated", "publisherClass": "legal_text" }, { "title": "Director-General Circular 8/2019: giving patients access to personal health data, 'Health in the palm of your hand' (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk08-2019/he/files_circulars_mk_mk08_2019.pdf", "date": "2019-11-11", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Identifiable data needs specific consent for research, but Helsinki ethics committees may waive consent for properly de-identified data, and there is no general opt-out. Ministry rules push research into secure research rooms inside each organisation.", "sources": [ { "title": "Director-General Circular 1/2018: secondary uses of health data (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/policy/mk01-2018/he/files_circulars_mk_MK01_2018.pdf", "date": "2018-01-17", "publisherClass": "official" }, { "title": "Chok Zchuyot HaCholeh, 1996 (Patient's Rights Act), sections 18 to 20, consolidated text (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94", "date": "undated", "publisherClass": "legal_text" }, { "title": "Psifas: Israeli National Genomic Medicine Initiative", "url": "https://psifas.org.il/en/%D7%93%D7%A3-%D7%94%D7%91%D7%99%D7%AA-english/", "date": "undated", "publisherClass": "official" }, { "title": "Israel's health ministry plans controversial genetic mega-database (Calcalist Ctech)", "url": "https://www.calcalistech.com/ctechnews/article/kiutzefjf", "date": "2026-01-25", "publisherClass": "news" } ] }, "ai": { "score": 50, "summary": "The Medical Equipment Law requires registration of devices and the software that runs them, with approval for every change. The ministry's February 2026 AI trial principles are guidance for ethics committees, so the cell sits at the top of the guidance-only band.", "sources": [ { "title": "Chok Tziud Refui, 2012 (Medical Equipment Law), consolidated text (Hebrew Wikisource)", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%A6%D7%99%D7%95%D7%93_%D7%A8%D7%A4%D7%95%D7%90%D7%99", "date": "undated", "publisherClass": "legal_text" }, { "title": "Key Principles for Evaluating AI-Driven Interventional Trials (Ministry of Health)", "url": "https://www.gov.il/BlobFolder/rfp/key-principles-for-evaluating-ai-driven-interventional-trials/he/subjects_Digital_Medical_Technology_Key-Principles-for-Evaluating-AI-Driven-Interventional-Trials-en.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Israel Life Sciences & Healthcare: Regulatory Overview (2026) (Arnon, Tadmor-Levy)", "url": "https://arnontl.com/news/israel-life-sciences-healthcare-regulatory-overview-2026/", "date": "2026-04-21", "publisherClass": "law_firm" }, { "title": "Israel blocks public AI tools on government hospital computers over data leak fears (Ynet News)", "url": "https://www.ynetnews.com/health_science/article/bkqtty2fze", "date": "2026-06-26", "publisherClass": "news" } ] } }, "laws": [ { "name": "Patient's Rights Act 1996", "level": "National", "year": "1996", "what": "Right to record information and a copy; confidentiality; disclosure to other clinicians for treatment without consent.", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94" }, { "name": "Patient's Rights Regulations (maximum fee for a medical record copy) 2019", "level": "National", "year": "2019", "what": "Free online viewing; computerised copy capped at NIS 10; free discharge letters and test results.", "url": "https://he.wikisource.org/wiki/%D7%AA%D7%A7%D7%A0%D7%95%D7%AA_%D7%96%D7%9B%D7%95%D7%99%D7%95%D7%AA_%D7%94%D7%97%D7%95%D7%9C%D7%94_(%D7%AA%D7%A9%D7%9C%D7%95%D7%9D_%D7%9E%D7%A8%D7%91%D7%99_%D7%91%D7%A2%D7%93_%D7%9E%D7%A1%D7%99%D7%A8%D7%AA_%D7%94%D7%A2%D7%AA%D7%A7_%D7%A8%D7%A9%D7%95%D7%9E%D7%94_%D7%A8%D7%A4%D7%95%D7%90%D7%99%D7%AA_%D7%90%D7%95_%D7%A2%D7%99%D7%95%D7%9F_%D7%91%D7%94)" }, { "name": "Protection of Privacy Law 1981, Amendment 13", "level": "National", "year": "2024", "what": "Health data specially sensitive; mandatory officers for hospitals and health funds; regulator fines; in force August 2025.", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%94%D7%92%D7%A0%D7%AA_%D7%94%D7%A4%D7%A8%D7%98%D7%99%D7%95%D7%AA" }, { "name": "Medical Information Portability Law 2024", "level": "National", "year": "2024", "what": "Consent-based transfer of 16 data baskets between providers via a ministry permission system, starting July 2027.", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%A0%D7%99%D7%95%D7%93_%D7%9E%D7%99%D7%93%D7%A2_%D7%A8%D7%A4%D7%95%D7%90%D7%99" }, { "name": "Genetic Information Law 2000", "level": "National", "year": "2000", "what": "Insurers and health funds may not request genetic tests or use identified genetic data, with narrow exceptions.", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%9E%D7%99%D7%93%D7%A2_%D7%92%D7%A0%D7%98%D7%99" }, { "name": "Medical Equipment Law 2012", "level": "National", "year": "2012", "what": "Devices, including software needed to run them, must be registered; changes need approval.", "url": "https://he.wikisource.org/wiki/%D7%97%D7%95%D7%A7_%D7%A6%D7%99%D7%95%D7%93_%D7%A8%D7%A4%D7%95%D7%90%D7%99" }, { "name": "Director-General Circulars 1/2018 and 2/2018", "level": "National", "year": "2018", "what": "Consent or de-identification for secondary use; limits on exclusivity and discriminatory uses in data deals.", "url": "https://www.gov.il/BlobFolder/policy/mk02-2018/he/files_circulars_mk_MK02_2018.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-07-21", "headline": "Health fund fined for slow reporting of a fault exposing members' medical files", "paraphrase": "A member reported he could open a relative's medical file because of a system fault. The regulator found the fund knew in November 2025 but reported only in January, and fined it 256,000 shekels. The fund plans to appeal.", "source": "Calcalist (reporting a Privacy Protection Authority decision)", "url": "https://www.calcalist.co.il/local_news/article/hjnnojpezl", "theme": "breach", "status": "finding" }, { "date": "2025-10-03", "headline": "Health ministry confirms patients' medical information leaked in hospital cyberattack", "paraphrase": "The health ministry said initial checks showed emails sent to and from the hospital on one day had leaked, including medical information in them. It said there was no sign so far of a leak from the central record system.", "source": "Walla News", "url": "https://news.walla.co.il/item/3784752", "theme": "breach", "status": "admitted" }, { "date": "2026-02-25", "headline": "Hackers claim they published thousands of patient documents taken from a health fund", "paraphrase": "A hacker group claimed to have stolen and posted documents of more than 10,000 patients, including referrals and sick-leave notes. The fund said it was checking the claim with national cyber authorities and had reported to the privacy regulator.", "source": "Channel 14 (C14)", "url": "https://www.c14.co.il/article/1472789", "theme": "breach", "status": "alleged" } ] }, { "iso3": "LVA", "name": "Latvia", "region": "Europe", "overall": 62, "rank": "16=", "likelyRank": "7 to 34", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "The E-veselība record, with an access log and patient bans, covers prescriptions, labs and discharges, but staff snooping persists and the portal is being rebuilt.", "categories": { "access": { "score": 64, "summary": "The free national E-veselība portal shows prescriptions, referrals, discharge summaries and lab results (from 2024), and the law gives one free copy within three working days. Export and full history depth were not verified, so the score sits in the lower half of its band.", "sources": [ { "title": "Pacientu tiesību likums (Patient Rights Law), Article 9", "url": "https://likumi.lv/ta/id/203008-pacientu-tiesibu-likums", "date": "2009-12-17", "publisherClass": "legal_text" }, { "title": "Kādi dati pieejami E-veselības sistēmā, un kas tiem var piekļūt? (LV portāls)", "url": "https://lvportals.lv/skaidrojumi/388343-kadi-dati-pieejami-e-veselibas-sistema-un-kas-tiem-var-pieklut-2026", "date": "2026-04-17", "publisherClass": "official" }, { "title": "Latvijas Digitālās veselības centrs: pirmajā darbības gadā paveikts būtisks darbs", "url": "https://ldvc.lv/latvijas-digitalas-veselibas-centrs-pirmaja-darbibas-gada-paveikts-butisks-darbs-digitalas-veselibas-attistiba/", "date": "2026-02-02", "publisherClass": "official" }, { "title": "State of Health in the EU: Latvia Country Health Profile 2025 (OECD and European Commission)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/latvia_49bcb16d/acdd6b03-en.pdf", "date": "2025-12", "publisherClass": "intergov" } ] }, "control": { "score": 62, "summary": "Patients can see an audit log of who opened their record, ban all access or block chosen providers and data, and delegate access. Records are open to treating staff by default, and repeated snooping cases keep the score in the lower half of the band.", "sources": [ { "title": "Noteikumi par vienoto veselības nozares elektronisko informācijas sistēmu (Cabinet Regulation No. 134)", "url": "https://likumi.lv/ta/id/264943", "date": "2014-03-11", "publisherClass": "legal_text" }, { "title": "Kādi dati pieejami E-veselības sistēmā, un kas tiem var piekļūt? (LV portāls)", "url": "https://lvportals.lv/skaidrojumi/388343-kadi-dati-pieejami-e-veselibas-sistema-un-kas-tiem-var-pieklut-2026", "date": "2026-04-17", "publisherClass": "official" }, { "title": "Doctor raises alarm over unauthorized patient data access (LSM)", "url": "https://eng.lsm.lv/article/society/health/29.01.2024-doctor-raises-alarm-over-unauthorized-patient-data-access.a540705/", "date": "2024-01-29", "publisherClass": "news" } ] }, "privacy": { "score": 58, "summary": "Patient data may be disclosed only with written consent or under listed exceptions, and an independent regulator oversees GDPR. Health-sector enforcement is mild: staff snooping in E-veselība drew mostly warnings in 2025 and one EUR 250 fine.", "sources": [ { "title": "Pacientu tiesību likums (Patient Rights Law), Article 10", "url": "https://likumi.lv/ta/id/203008-pacientu-tiesibu-likums", "date": "2009-12-17", "publisherClass": "legal_text" }, { "title": "Fizisko personu datu apstrādes likums (Personal Data Processing Law)", "url": "https://likumi.lv/ta/id/300099-fizisko-personu-datu-apstrades-likums", "date": "2018-06-21", "publisherClass": "legal_text" }, { "title": "E-veselības dati skatīti bez iemesla: DVI atklāj pārkāpumus Latvijā (BNN)", "url": "https://bnn.lv/e-veselibas-dati-skatiti-bez-iemesla-dvi-atklaj-parkapumus-latvija/", "date": "2026-03-20", "publisherClass": "news" }, { "title": "Damaged cable leaves patients without meds in Latvia (LSM)", "url": "https://eng.lsm.lv/article/society/health/30.06.2026-damaged-cable-leaves-patients-without-meds-in-latvia.a653205/", "date": "2026-06-30", "publisherClass": "news" } ] }, "journey": { "score": 70, "summary": "Prescriptions, lab reports, imaging, discharge summaries and referrals flow into one national system: in August 2026 pharmacies filled about 1.1 million e-prescriptions and 30 paper ones. Low ICT investment and a fragile network link hold the score down.", "sources": [ { "title": "E-veselības un e-vakcinācijas lietojuma pārskats, 2026 augusts (LDVC)", "url": "https://ldvc.lv/wp-content/uploads/2026/09/EVES_EVAK_2026_augusts.pdf", "date": "2026-09", "publisherClass": "official" }, { "title": "Noteikumi par vienoto veselības nozares elektronisko informācijas sistēmu (Cabinet Regulation No. 134)", "url": "https://likumi.lv/ta/id/264943", "date": "2014-03-11", "publisherClass": "legal_text" }, { "title": "Digital referrals now mandatory in Latvia's healthcare system (LSM)", "url": "https://eng.lsm.lv/article/society/health/05.05.2026-digital-referrals-now-mandatory-in-latvias-healthcare-system.a645708/", "date": "2026-05-05", "publisherClass": "news" }, { "title": "State of Health in the EU: Latvia Country Health Profile 2025 (OECD and European Commission)", "url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/12/country-health-profile-2025-country-notes_7e72146d/latvia_49bcb16d/acdd6b03-en.pdf", "date": "2025-12", "publisherClass": "intergov" } ] }, "commercial": { "score": 55, "summary": "Providers may release patient data only with written consent or under a closed legal list, and research access is permit-based. No Latvia-specific ban on selling health data or on health apps beyond GDPR was verified.", "sources": [ { "title": "Pacientu tiesību likums (Patient Rights Law), Article 10", "url": "https://likumi.lv/ta/id/203008-pacientu-tiesibu-likums", "date": "2009-12-17", "publisherClass": "legal_text" }, { "title": "Kārtība, kādā atļauj izmantot pacienta datus konkrētā pētījumā (Cabinet Regulation No. 446)", "url": "https://likumi.lv/ta/id/275747-kartiba-kada-atlauj-izmantot-pacienta-datus-konkreta-petijuma", "date": "2015-08-04", "publisherClass": "legal_text" } ] }, "clinical": { "score": 66, "summary": "Treating staff can see nearly all of a patient's national record, apart from psychiatric and addiction data that only specially authorised staff can open. The structured patient summary is rarely filled in, and patient bans can hide data.", "sources": [ { "title": "Kādi dati pieejami E-veselības sistēmā, un kas tiem var piekļūt? (LV portāls)", "url": "https://lvportals.lv/skaidrojumi/388343-kadi-dati-pieejami-e-veselibas-sistema-un-kas-tiem-var-pieklut-2026", "date": "2026-04-17", "publisherClass": "official" }, { "title": "Noteikumi par vienoto veselības nozares elektronisko informācijas sistēmu (Cabinet Regulation No. 134)", "url": "https://likumi.lv/ta/id/264943", "date": "2014-03-11", "publisherClass": "legal_text" }, { "title": "E-veselības un e-vakcinācijas lietojuma pārskats, 2026 augusts (LDVC)", "url": "https://ldvc.lv/wp-content/uploads/2026/09/EVES_EVAK_2026_augusts.pdf", "date": "2026-09", "publisherClass": "official" }, { "title": "Latvia will start exchanging laboratory data with other EU states (LSM)", "url": "https://eng.lsm.lv/article/society/health/04.06.2026-latvia-will-start-exchanging-laboratory-data-with-other-eu-states.a650077/", "date": "2026-06-04", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Identifiable records can be used for research without consent if a state permit is granted and the patient has not filed a written ban. The ban is filed with each provider, not as one general opt-out, so the score tops the no-opt-out band.", "sources": [ { "title": "Pacientu tiesību likums (Patient Rights Law), Article 10(7) to 10(9)", "url": "https://likumi.lv/ta/id/203008-pacientu-tiesibu-likums", "date": "2009-12-17", "publisherClass": "legal_text" }, { "title": "Kārtība, kādā atļauj izmantot pacienta datus konkrētā pētījumā (Cabinet Regulation No. 446)", "url": "https://likumi.lv/ta/id/275747-kartiba-kada-atlauj-izmantot-pacienta-datus-konkreta-petijuma", "date": "2015-08-04", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "2026-07-08", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the EU AI Act, which Latvia applies through administrative measures with no national AI Act law. No Latvia-specific clinical AI rules or guidance were verified.", "sources": [ { "title": "Latvija sper soli pretī drošam un atbildīgam mākslīgajam intelektam (VARAM)", "url": "https://www.varam.gov.lv/lv/jaunums/latvija-sper-soli-preti-drosam-un-atbildigam-maksligajam-intelektam-valdiba-izskata-mi-akta-ieviesanas-planu", "date": "2025-02-25", "publisherClass": "official" }, { "title": "Mākslīgā intelekta (MI) akts (VARAM)", "url": "https://www.varam.gov.lv/lv/maksliga-intelekta-mi-akts", "date": "2026-09-29", "publisherClass": "official" } ] } }, "laws": [ { "name": "Patient Rights Law (Pacientu tiesību likums)", "level": "National", "year": "2009", "what": "Right to see and copy records, written consent for disclosure, research rules with a written ban right.", "url": "https://likumi.lv/ta/id/203008-pacientu-tiesibu-likums" }, { "name": "Cabinet Regulation No. 134 on the unified health sector information system", "level": "National", "year": "2014", "what": "Runs E-veselība: upload deadlines, access logs, patient full or partial access bans, retention periods.", "url": "https://likumi.lv/ta/id/264943" }, { "name": "Cabinet Regulation No. 446 on permits to use patient data in research", "level": "National", "year": "2015", "what": "Disease control centre grants research permits and publishes each permit within five working days.", "url": "https://likumi.lv/ta/id/275747-kartiba-kada-atlauj-izmantot-pacienta-datus-konkreta-petijuma" }, { "name": "Personal Data Processing Law (Fizisko personu datu apstrādes likums)", "level": "National", "year": "2018", "what": "Applies GDPR in Latvia and names the independent Data State Inspectorate as regulator.", "url": "https://likumi.lv/ta/id/300099-fizisko-personu-datu-apstrades-likums" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "Cross-border record access and a secondary-use opt-out; main duties apply from March 2029 and 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation (EU) 2024/1689 (AI Act)", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules, including high-risk duties; Latvia applies it through designated agencies.", "url": "https://www.varam.gov.lv/lv/maksliga-intelekta-mi-akts" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-03", "headline": "Manager reprimanded for checking an employee's sick-leave record in the national health system", "paraphrase": "A health worker who supervised a colleague opened the colleague's national health record to check whether sick leave was open. The person had restricted access to their health data. The regulator still found the lookup unlawful and issued a reprimand.", "source": "Datu valsts inspekcija (Data State Inspectorate of Latvia)", "url": "https://www.dvi.gov.lv/lv/media/5032/download?attachment", "theme": "breach", "status": "finding" }, { "date": "2025-11-03", "headline": "Health worker fined for reading a grown daughter's national health record", "paraphrase": "A health worker used work access to read an adult daughter's national health record for personal reasons. The person said the information reached a former spouse. The regulator found no lawful basis and fined the worker 250 euros.", "source": "Datu valsts inspekcija (Data State Inspectorate of Latvia)", "url": "https://www.dvi.gov.lv/lv/media/4310/download?attachment", "theme": "breach", "status": "finding" }, { "date": "2025-09-22", "headline": "Hospital reprimanded after a software supplier's breach exposed patient and staff data", "paraphrase": "Attackers reached a municipal system the hospital used, taking names, personal codes and addresses of its staff and clients. The regulator found the hospital had not supervised the supplier or reported on time, and reprimanded it. The hospital appealed.", "source": "Datu valsts inspekcija (Data State Inspectorate of Latvia)", "url": "https://www.dvi.gov.lv/lv/media/4403/download?attachment", "theme": "breach", "status": "finding" }, { "date": "2025-02-21", "headline": "Regulator rejects mistyped-code excuse after a person's health record was opened", "paraphrase": "A person complained that staff at a family practice they did not use had opened their record and prescriptions. The practice blamed a mistyped personal code. The regulator found the lookup unrelated to care and issued a reprimand.", "source": "Datu valsts inspekcija (Data State Inspectorate of Latvia)", "url": "https://www.dvi.gov.lv/lv/media/4112/download?attachment", "theme": "breach", "status": "finding" }, { "date": "2024-12-03", "headline": "Hospital physician assistant fined for repeatedly viewing three people's health records", "paraphrase": "Over several years a physician assistant used work logins to the national health system and two hospital systems to view three people's health data for personal reasons. The regulator found no care purpose and fined him 500 euros.", "source": "Datu valsts inspekcija (Data State Inspectorate of Latvia)", "url": "https://www.dvi.gov.lv/lv/media/4259/download?attachment", "theme": "breach", "status": "finding" } ] }, { "iso3": "SGP", "name": "Singapore", "region": "Asia", "overall": 62, "rank": "16=", "likelyRank": "6 to 34", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "A 2026 law, not yet in force, makes every provider feed one national record without consent; patients can block access, but very few do.", "categories": { "access": { "score": 62, "summary": "Patients can view medications, immunisations and lab results from the national record in HealthHub, and the PDPA gives a right to request the rest from each provider. But providers may charge a fee and need not hand over copies of doctors' notes.", "sources": [ { "title": "NEHR FAQ (Synapxe, operator of the NEHR)", "url": "https://www.synapxe.sg/healthtech/national-programmes/national-electronic-health-record-nehr/faq", "date": "undated", "publisherClass": "official" }, { "title": "Overview of the Health Information Act (HIA) (healthinfo.gov.sg, MOH)", "url": "https://www.healthinfo.gov.sg/hia/", "date": "undated", "publisherClass": "official" }, { "title": "Advisory Guidelines for the Healthcare Sector, revised 20 September 2023 (PDPC)", "url": "https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-for-the-healthcare-sector-sep-2023.pdf", "date": "2023-09-20", "publisherClass": "official" }, { "title": "Personal Data Protection Act 2012, sections 4, 21, 26D and 48J (Singapore Statutes Online)", "url": "https://sso.agc.gov.sg/Act/PDPA2012", "date": "undated", "publisherClass": "legal_text" } ] }, "control": { "score": 58, "summary": "Data flows into the NEHR without consent, but a person can block all provider access and can see a one-year log of which institutions opened their record. Only about 2,300 people have placed a block since 2011, and finer choices in HealthHub are planned from 2027.", "sources": [ { "title": "Health Information Act 2026 (No. 1 of 2026), Singapore Statutes Online", "url": "https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260624040946?DocDate=20260212", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Overview of the Health Information Act (HIA) (healthinfo.gov.sg, MOH)", "url": "https://www.healthinfo.gov.sg/hia/", "date": "undated", "publisherClass": "official" }, { "title": "NEHR FAQ (Synapxe, operator of the NEHR)", "url": "https://www.synapxe.sg/healthtech/national-programmes/national-electronic-health-record-nehr/faq", "date": "undated", "publisherClass": "official" }, { "title": "Health Information Bill to support coordinated care across Singapore's healthcare ecosystem (MOH)", "url": "https://www.moh.gov.sg/newsroom/health-information-bill-to-support-coordinated-care-across-singapore-s-healthcare-ecosystem/", "date": "2026-01-12", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "PDPA requires breach notice within 3 days, and PDPC fined SingHealth and IHiS S$1 million in total over the 2018 breach of 1.5 million patients' data. The Health Information Act, not yet in force, adds MOH incident reporting and up to 2 years' jail for improper record access.", "sources": [ { "title": "Grounds of Decision: Singapore Health Services Pte Ltd and others (PDPC)", "url": "https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Grounds-of-Decision---SingHealth-IHiS---150119.pdf", "date": "2019-01-14", "publisherClass": "official" }, { "title": "Personal Data Protection Act 2012, sections 4, 21, 26D and 48J (Singapore Statutes Online)", "url": "https://sso.agc.gov.sg/Act/PDPA2012", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Information Act 2026 (No. 1 of 2026), Singapore Statutes Online", "url": "https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260624040946?DocDate=20260212", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Extra safeguards for more sensitive medical info like mental health conditions: MOH (The Straits Times)", "url": "https://www.straitstimes.com/singapore/health/added-safeguards-for-medical-records-that-are-more-sensitive-such-as-mental-health-conditions-moh", "date": "2026-01-16", "publisherClass": "news" } ] }, "journey": { "score": 64, "summary": "Public hospitals, which handle 90% of acute care, have used the NEHR since 2011, and about 70% of over 2,000 GP clinics had joined by October 2025. Three of nine private hospitals, many specialists, labs and dental clinics were still outside.", "sources": [ { "title": "Health Information Bill to support coordinated care across Singapore's healthcare ecosystem (MOH)", "url": "https://www.moh.gov.sg/newsroom/health-information-bill-to-support-coordinated-care-across-singapore-s-healthcare-ecosystem/", "date": "2026-01-12", "publisherClass": "official" }, { "title": "All healthcare service providers must contribute and share patients' key health information (The Straits Times)", "url": "https://www.straitstimes.com/singapore/politics/all-healthcare-service-providers-must-contribute-and-share-patients-key-health-information", "date": "2026-01-12", "publisherClass": "news" }, { "title": "Overview of the Health Information Act (HIA) (healthinfo.gov.sg, MOH)", "url": "https://www.healthinfo.gov.sg/hia/", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 62, "summary": "Using the NEHR for insurance or employment is an offence carrying up to S$100,000 and four years in jail, and insurers cannot use most genetic test results. Outside the NEHR, health data held by firms and apps falls under the general PDPA.", "sources": [ { "title": "Health Information Bill to support coordinated care across Singapore's healthcare ecosystem (MOH)", "url": "https://www.moh.gov.sg/newsroom/health-information-bill-to-support-coordinated-care-across-singapore-s-healthcare-ecosystem/", "date": "2026-01-12", "publisherClass": "official" }, { "title": "Patients must be notified, give consent for their health information to be shared with insurers (The Straits Times)", "url": "https://www.straitstimes.com/singapore/health/patients-need-to-be-notified-and-consent-sought-for-sharing-of-relevant-information-with-insurers", "date": "2026-01-26", "publisherClass": "news" }, { "title": "Moratorium on Genetic Testing and Insurance (MOH)", "url": "https://www.moh.gov.sg/others/resources-and-statistics/moratorium-on-genetic-testing-and-insurance/", "date": "undated", "publisherClass": "official" }, { "title": "Advisory Guidelines for the Healthcare Sector, revised 20 September 2023 (PDPC)", "url": "https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-for-the-healthcare-sector-sep-2023.pdf", "date": "2023-09-20", "publisherClass": "official" } ] }, "clinical": { "score": 68, "summary": "Treating doctors, nurses, pharmacists and allied health staff can open the NEHR by default, and a 'break glass' feature works even past a restriction. Gaps in private specialist, lab and dental data limit what they see until mandatory contribution starts.", "sources": [ { "title": "Health Information Bill to support coordinated care across Singapore's healthcare ecosystem (MOH)", "url": "https://www.moh.gov.sg/newsroom/health-information-bill-to-support-coordinated-care-across-singapore-s-healthcare-ecosystem/", "date": "2026-01-12", "publisherClass": "official" }, { "title": "Health Information Act 2026 (No. 1 of 2026), Singapore Statutes Online", "url": "https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260624040946?DocDate=20260212", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Extra safeguards for more sensitive medical info like mental health conditions: MOH (The Straits Times)", "url": "https://www.straitstimes.com/singapore/health/added-safeguards-for-medical-records-that-are-more-sensitive-such-as-mental-health-conditions-moh", "date": "2026-01-16", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "The Health Information Act lets the Minister release NEHR-derived data for public health or public interest purposes without consent, and a restriction does not block it. Safeguards include ethics review, a secure research platform and fines up to S$50,000.", "sources": [ { "title": "Health Information Act 2026 (No. 1 of 2026), Singapore Statutes Online", "url": "https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260624040946?DocDate=20260212", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "NEHR FAQ (Synapxe, operator of the NEHR)", "url": "https://www.synapxe.sg/healthtech/national-programmes/national-electronic-health-record-nehr/faq", "date": "undated", "publisherClass": "official" }, { "title": "Regulation of human biomedical research (MOH)", "url": "https://www.moh.gov.sg/others/health-regulation/regulation-of-human-biomedical-research/", "date": "undated", "publisherClass": "official" }, { "title": "How TRUST ensures data is safe (TRUST Platform)", "url": "https://www.trustplatform.sg/about-us/how-trust-ensures-data-is-safe/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 62, "summary": "HSA regulates AI software as medical devices, with ML labelling and a change management program for planned model updates. MOH's March 2026 guidelines call human oversight mandatory for clinical AI but are guidance, not law, so the cell sits mid-band.", "sources": [ { "title": "GL-04 Revision 4: Regulatory Guidelines for Software Medical Devices including Machine Learning-Enabled Medical Devices (HSA)", "url": "https://isomer-user-content.by.gov.sg/409/26808a93-6a7a-4551-8c66-13046c6124c5/gl-04-r4-regulatory-guidelines-for-software-medical-devices---a-life-cycle-approach-(2025-dec)-pub.pdf", "date": "2025-12", "publisherClass": "official" }, { "title": "Artificial Intelligence in Healthcare Guidelines (AIHGle) Version 2.0 (MOH and HSA)", "url": "https://isomer-user-content.by.gov.sg/3/23fb5b36-56b4-4abb-9370-75c9ddcaf3ed/AIHGle%202.0.pdf", "date": "2026-03", "publisherClass": "official" }, { "title": "Singapore: MOH and HSA Launch Refreshed AI in Healthcare Guidelines (Baker McKenzie)", "url": "https://www.bakermckenzie.com/en/insight/publications/2026/03/singapore-moh-and-hsa-launch-refreshed-ai-in-healthcare-guidelines", "date": "2026-03-31", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Health Information Act 2026", "level": "National", "year": "2026", "what": "Mandatory NEHR contribution without consent, access restrictions, insurance and employment ban, breach notification; not yet in force.", "url": "https://sso.agc.gov.sg/Act/HIA2026/Uncommenced/20260624040946?DocDate=20260212" }, { "name": "Personal Data Protection Act 2012", "level": "National", "year": "2012", "what": "General privacy law: access right, consent, breach duties, fines up to 10% of turnover; excludes public agencies.", "url": "https://sso.agc.gov.sg/Act/PDPA2012" }, { "name": "Human Biomedical Research Act 2015", "level": "National", "year": "2015", "what": "Requires appropriate consent for human biomedical research and tissue use, with regulated exemptions.", "url": "https://sso.agc.gov.sg/Act/HBRA2015" }, { "name": "HSA GL-04 Revision 4, software and ML medical devices", "level": "National", "year": "2025", "what": "Life-cycle rules for AI and ML devices: labelling, change notification, change management program.", "url": "https://isomer-user-content.by.gov.sg/409/26808a93-6a7a-4551-8c66-13046c6124c5/gl-04-r4-regulatory-guidelines-for-software-medical-devices---a-life-cycle-approach-(2025-dec)-pub.pdf" }, { "name": "Artificial Intelligence in Healthcare Guidelines (AIHGle) 2.0", "level": "National", "year": "2026", "what": "MOH and HSA guidance: duties for developers, deployers, clinicians; human oversight for clinical AI.", "url": "https://isomer-user-content.by.gov.sg/3/23fb5b36-56b4-4abb-9370-75c9ddcaf3ed/AIHGle%202.0.pdf" }, { "name": "Moratorium on Genetic Testing and Insurance (2025)", "level": "National", "year": "2025", "what": "MOH and insurer agreement barring use of most genetic test results in underwriting.", "url": "https://www.moh.gov.sg/others/resources-and-statistics/moratorium-on-genetic-testing-and-insurance/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-05-21", "headline": "Patient's record used to approach them for research without express consent", "paraphrase": "A patient complained that a hospital researcher, given the patient's name by their doctor, approached them in a waiting area to join a study. The regulator found implied consent sufficed but said express consent would have been better practice.", "source": "Personal Data Protection Commission Singapore", "url": "https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/gd_institute-of-mental-health_21052025.pdf", "theme": "other", "status": "finding" }, { "date": "2025-04-11", "headline": "Hospital worker fined for looking up a former patient's record without reason", "paraphrase": "A hospital staff member opened a former patient's record on the hospital system for personal reasons and filmed the screen showing their ID number, address and contacts. The patient complained; she pleaded guilty and was fined.", "source": "HRD Asia (HCA Magazine)", "url": "https://www.hcamag.com/asia/specialisation/employment-law/nuh-employee-fined-for-unauthorised-access-of-patient-information-reports/531778", "theme": "breach", "status": "finding" }, { "date": "2025-06-13", "headline": "Former specialist centre employee charged with accessing patients' data without authorisation", "paraphrase": "A former public specialist centre employee was charged with accessing personal data of 18 patients without authorisation and downloading photos of 42 patients from its systems. The centre said it began an internal probe and filed a police report.", "source": "Malay Mail (citing CNA)", "url": "https://www.malaymail.com/news/singapore/2025/06/13/former-national-dental-centre-singapore-staff-accused-of-taking-illicit-photos-of-female-patients-breasts/180231", "theme": "breach", "status": "alleged" }, { "date": "2026-09-20", "headline": "Specialist centre's email error let 467 invitees see each other's addresses", "paraphrase": "A public specialist centre emailed an invitation to a patient event using CC instead of BCC, so all 467 recipients could see each other's addresses. The centre apologised and reported the incident to the health ministry and the privacy regulator.", "source": "AsiaOne", "url": "https://www.asiaone.com/singapore/national-cancer-centre-email-leak", "theme": "breach", "status": "admitted" } ] }, { "iso3": "SVN", "name": "Slovenia", "region": "Europe", "overall": 62, "rank": "16=", "likelyRank": "6 to 33", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Slovenia's zVEM portal shows patients their reports, prescriptions and an access log, but data flows to the central register without consent.", "categories": { "access": { "score": 66, "summary": "The Patients' Rights Act gives a right to see and copy the record within five working days, and the national zVEM portal shows test results, prescriptions, referrals and appointments. Some providers still send less than they should, so the portal is not the full chart.", "sources": [ { "title": "41. clen ZPacP: Nacin seznanitve z zdravstveno dokumentacijo (zakonodaja.com)", "url": "https://zakonodaja.com/zakon/zpacp/41-clen-nacin-seznanitve-z-zdravstveno-dokumentacijo", "date": "undated", "publisherClass": "legal_text" }, { "title": "Portal in mobilna aplikacija zVEM (NIJZ)", "url": "https://nijz.si/informatika-v-zdravstvu/ezdravje/portal-in-mobilna-aplikacija-zvem-vase-zdravje-na-dosegu-roke/", "date": "2026-08-26", "publisherClass": "official" }, { "title": "Kateri izvajalci zdravstvene dejavnosti posredujejo podatke v CRPP? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/kateri-izvajalci-zdravstvene-dejavnosti-posredujejo-podatke-v-crpp/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 60, "summary": "Patients can block viewing of their Patient Data Summary for one provider or all providers and can see which institution opened their records. They cannot stop data going to the central register, and the log names institutions, not staff.", "sources": [ { "title": "Zakon o spremembah in dopolnitvah ZZPPZ (ZZPPZ-A), Uradni list RS 47/2015", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2015-01-1933?sop=2015-01-1933", "date": "2015-06-30", "publisherClass": "legal_text" }, { "title": "Na kaksen nacin lahko prepovem vpogled v svoj Povzetek podatkov o pacientu? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/na-kaksen-nacin-lahko-prepovem-vpogled-v-svoj-povzetek-podatkov-o-pacientu/", "date": "undated", "publisherClass": "official" }, { "title": "Na koga naj se obrnem za natancnejse podatke o vpogledih v svojo zdravstveno dokumentacijo? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/na-koga-naj-se-obrnem-za-natancnejse-podatke-o-vpogledih-v-svojo-zdravstveno-dokumentacijo-ali-lahko-pridobim-poimenske-podatke-oseb-zdravstvenih-delavcev-ki-dostopajo-do-mojih-podatkov/", "date": "undated", "publisherClass": "official" }, { "title": "Kateri zdravstveni delavci imajo vpogled v CRPP in pod kaksnimi pogoji? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/kateri-zdravstveni-delavci-imajo-vpogled-v-crpp-in-pod-kaksnimi-pogoji/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "Health data is covered by the GDPR and the 2022 Personal Data Protection Act (ZVOP-2), enforced by the Information Commissioner. In January 2025 the Commissioner opened a priority inspection after patient records from Celje General Hospital were found in the trash.", "sources": [ { "title": "Zakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS 163/2022", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2022-01-4187?sop=2022-01-4187", "date": "2022-12-27", "publisherClass": "legal_text" }, { "title": "Malomarno ravnanje: obcutljivi podatki bolnikov v smeteh (24ur)", "url": "https://www.24ur.com/novice/slovenija/malomarno-ravnanje-obcutljivi-podatki-bolnikov-v-smeteh.html", "date": "2025-01-15", "publisherClass": "news" }, { "title": "41. clen ZPacP: Nacin seznanitve z zdravstveno dokumentacijo (zakonodaja.com)", "url": "https://zakonodaja.com/zakon/zpacp/41-clen-nacin-seznanitve-z-zdravstveno-dokumentacijo", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 66, "summary": "eZdravje links providers through a central patient register, e-prescriptions, e-referrals, e-booking and a vaccination register, built since 2008. Every provider must send documents, but some do not, so coverage is uneven.", "sources": [ { "title": "eHealth (eZdravje)", "url": "https://ezdrav.si/en/ehealth/", "date": "undated", "publisherClass": "official" }, { "title": "Kateri izvajalci zdravstvene dejavnosti posredujejo podatke v CRPP? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/kateri-izvajalci-zdravstvene-dejavnosti-posredujejo-podatke-v-crpp/", "date": "undated", "publisherClass": "official" }, { "title": "Elektronska komunikacija z zdravnikom po novem: kaj moram storiti (N1)", "url": "https://n1info.si/novice/slovenija/elektronska-komunikacija-z-zdravnikom-po-novem-kaj-moram-storiti/", "date": "2026-01-07", "publisherClass": "news" }, { "title": "Patient information notices: Slovenia (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/digital-health-and-care/electronic-cross-border-health-services/patient-information-notices-slovenia_en", "date": "undated", "publisherClass": "intergov" } ] }, "commercial": { "score": 60, "summary": "Commercial use of health data is limited by the GDPR and ZVOP-2, and the EU health data space will bar marketing and decisions that harm people from 2029. No Slovenia-specific ban on health data brokers or app data sales was verified.", "sources": [ { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Data protection (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Zakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS 163/2022", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2022-01-4187?sop=2022-01-4187", "date": "2022-12-27", "publisherClass": "legal_text" } ] }, "clinical": { "score": 68, "summary": "The chosen GP sees the full central record, other doctors see it with a referral or consent, and emergency units get automatic access. Elsewhere a doctor can open an 8-hour emergency window, which is logged.", "sources": [ { "title": "Kateri zdravstveni delavci imajo vpogled v CRPP in pod kaksnimi pogoji? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/kateri-zdravstveni-delavci-imajo-vpogled-v-crpp-in-pod-kaksnimi-pogoji/", "date": "undated", "publisherClass": "official" }, { "title": "Na kaksen nacin lahko zdravnik pridobi dostop do dokumentacije v izrednih primerih? (eZdravje podpora)", "url": "https://podpora.ezdrav.si/faq/na-kaksen-nacin-lahko-zdravnik-pridobi-dostop-do-dokumentacije-v-izrednih-primerih/", "date": "undated", "publisherClass": "official" }, { "title": "Zakon o spremembah in dopolnitvah ZZPPZ (ZZPPZ-A), Uradni list RS 47/2015", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2015-01-1933?sop=2015-01-1933", "date": "2015-06-30", "publisherClass": "legal_text" } ] }, "research": { "score": 45, "summary": "ZVOP-2 allows research reuse when another law permits it or the person has not prohibited it; professional secrets need written consent. A central way to register that prohibition was not verified, and the national health data access body is still being built.", "sources": [ { "title": "Zakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS 163/2022", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2022-01-4187?sop=2022-01-4187", "date": "2022-12-27", "publisherClass": "legal_text" }, { "title": "Podpora institucijam za dostop do zdravstvenih podatkov v Sloveniji (NIJZ)", "url": "https://nijz.si/projekti/podpora-institucijam-za-dostop-do-zdravstvenih-podatkov-v-sloveniji/", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, which Slovenia implemented with a national law in force since 21 November 2025. That law names authorities but adds no new duties, and AI Act rules for medical devices start 2 August 2028.", "sources": [ { "title": "Zakon o izvajanju uredbe (EU) o dolocitvi harmoniziranih pravil o umetni inteligenci (ZIUDHPUI), Uradni list RS 85/2025", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2025-01-3035/zakon-o-izvajanju-uredbe-eu-o-dolocitvi-harmoniziranih-pravil-o-umetni-inteligenci-ziudhpui", "date": "2025-11-06", "publisherClass": "legal_text" }, { "title": "Kaj prinasa Zakon o izvajanju Akta o umetni inteligenci? (Jadek & Pensa)", "url": "https://www.jadek-pensa.si/kaj-prinasa-zakon-o-izvajanju-akta-o-umetni-inteligenci/", "date": "2025-12-05", "publisherClass": "law_firm" }, { "title": "AI Act: regulatory framework for AI (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "date": "2026-08-03", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Patients' Rights Act (Zakon o pacientovih pravicah, ZPacP)", "level": "National", "year": "2008", "what": "Right to view and copy records within five working days; Information Commissioner hears access disputes.", "url": "https://zakonodaja.com/zakon/zpacp/41-clen-nacin-seznanitve-z-zdravstveno-dokumentacijo" }, { "name": "Health Data Collections Act amendment (ZZPPZ-A)", "level": "National", "year": "2015", "what": "Sets up eZdravje and the CRPP register; patients may block viewing of their Patient Data Summary.", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2015-01-1933?sop=2015-01-1933" }, { "name": "Personal Data Protection Act (ZVOP-2)", "level": "National", "year": "2022", "what": "Supplements the GDPR; Article 69 sets conditions for research reuse, including a right to prohibit it.", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2022-01-4187?sop=2022-01-4187" }, { "name": "Act implementing the EU AI Regulation (ZIUDHPUI)", "level": "National", "year": "2025", "what": "Names AI Act authorities; JAZMP is notifying authority for AI in medical devices.", "url": "https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2025-01-3035/zakon-o-izvajanju-uredbe-eu-o-dolocitvi-harmoniziranih-pravil-o-umetni-inteligenci-ziudhpui" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "EU data protection law applicable since 25 May 2018; health is special-category data.", "url": "https://commission.europa.eu/law/law-topic/data-protection_en" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient summaries and e-prescriptions from 2029; opt-out from secondary use; bans marketing use.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "EU Artificial Intelligence Act (EU) 2024/1689", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; high-risk duties for AI in medical devices from 2 August 2028.", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-18", "headline": "Hospital confirms employee shared photos of patients and a document with personal data", "paraphrase": "A hospital employee photographed patients and a document holding sensitive personal data and shared the images outside the hospital. The hospital confirmed it, disciplined the worker and reported the case to the data protection authority and police.", "source": "N1 Slovenija", "url": "https://n1info.si/novice/slovenija/zaposlena-v-ukc-ljubljana-fotografirala-bolnike-med-zdravljenjem-in-delila-slike/", "theme": "breach", "status": "admitted" }, { "date": "2024-10-05", "headline": "Clinic confirms a nurse repeatedly opened a former patient's record without authorisation", "paraphrase": "A former patient complained that a staff member had viewed her health record while she was not in care there. The clinic confirmed repeated unauthorised access and misuse of login details, and notified police and the data protection authority.", "source": "Žurnal24", "url": "https://www.zurnal24.si/slovenija/ljubljana-vohljala-je-za-zdravjem-pacientke-univerzitetna-psihiatricna-klinika-bojan-zalar-ministrica-izredni-nadzor-430457", "theme": "breach", "status": "admitted" }, { "date": "2025-01-15", "headline": "Patient test results and operation lists reported found in the rubbish", "paraphrase": "A TV programme received a bag of patients' results, operation lists and doctors' notes said to have been thrown out by a hospital. The hospital disputed where the bag came from; the data protection authority opened an inspection.", "source": "RTV Slovenija", "url": "https://www.rtvslo.si/zdravje/v-smeteh-koncali-izvidi-pacientov-in-druga-obcutljiva-dokumentacija-iz-celjske-bolnisnice/733409", "theme": "breach", "status": "alleged" }, { "date": "2025-12-29", "headline": "Patient receives two wrong scan reports, one apparently belonging to someone else", "paraphrase": "A patient says his first imaging report described the wrong part of the body and a corrected report mentioned a procedure that was never done, suggesting a mix-up with another patient. He says staff told him mistakes happen.", "source": "Necenzurirano.si", "url": "https://necenzurirano.si/clanek/preiskave/radiologi-preiskava-magnetna-resonanca-napaka-zzzs-ukc-maribor-zdravniki-1870449", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-01-15", "headline": "Patient handed another person's test result, which reported a serious illness", "paraphrase": "A patient received a test report carrying another person's name and findings, and only learned of the mistake when his doctor pointed it out. The Ministry of Health called this kind of mix-up a serious safety incident.", "source": "Svet24", "url": "https://svet24.si/novice/slovenija/bolnik-izvid-napaka-incident-bolezen-1873740", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "LIE", "name": "Liechtenstein", "region": "Europe", "overall": 61, "rank": "21=", "likelyRank": "7 to 35", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Every insured person has an opt-out eGD with access logs and patient-unlocked doctor access, but active use is unproven and EU health-data rules lag.", "categories": { "access": { "score": 64, "summary": "By law every insured person has an eGD they can read in full, holding letters, reports, labs, imaging findings and medicines since 2023. Older records and full charts stay with each doctor, and no official figure on active use was found.", "sources": [ { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" }, { "title": "Weiterentwicklung des elektronischen Gesundheitsdossiers (Regierung des Fürstentums Liechtenstein)", "url": "https://www.regierung.li/medienportal-medium/16182/234283/0/medienmitteilung", "date": "2026-03-03", "publisherClass": "official" }, { "title": "Gesetz über die Ärzte (Ärztegesetz), Fassung 01.01.2026", "url": "https://www.gesetze.li/konso/pdf/2003239000?version=14", "date": "2026-01-01", "publisherClass": "legal_text" }, { "title": "eGD: Akzeptanz-Problem (lie:zeit)", "url": "https://www.lie-zeit.li/2026/04/egd-akzeptanz-problem/", "date": "2026-04-19", "publisherClass": "news" } ] }, "control": { "score": 74, "summary": "Patients can opt out at any time, hide or delete single documents, see an access log, and must unlock each provider before access. The opt-out is all or nothing: it deletes the whole dossier.", "sources": [ { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" }, { "title": "Verordnung über das elektronische Gesundheitsdossier (EGDV), Fassung 01.03.2024", "url": "https://www.gesetze.li/konso/pdf/2022365000?version=2", "date": "2024-03-01", "publisherClass": "legal_text" }, { "title": "Kleine Anfrage Elektronisches Gesundheitsdossier (eGD) (Landtag)", "url": "https://www.landtag.li/printkleineanfrage/25139/?t=638267490026099788", "date": "2023-06-02", "publisherClass": "official" }, { "title": "Volksabstimmungen zu den beiden Energievorlagen und dem E-Gesundheitsdossier vom 21. Januar 2024 (Liechtenstein-Institut)", "url": "https://s3.eu-central-1.amazonaws.com/ext-linst-c5-web-liechtenstein-institut.li-2019/4717/0800/9706/LI_Aktuell_2024_1_Energie_eGD_final.pdf", "date": "2024", "publisherClass": "academic" } ] }, "privacy": { "score": 62, "summary": "The GDPR applies through the EEA, and the eGD law adds fines up to CHF 50,000 for unlawful access. The regulator reports rising complaints and limited capacity, and has issued only one recent fine, not health-related.", "sources": [ { "title": "EEA-Lex factsheet: Regulation (EU) 2016/679 (EFTA)", "url": "https://www.efta.int/eea-lex/32016r0679", "date": "undated", "publisherClass": "intergov" }, { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" }, { "title": "Tätigkeitsbericht 2025 (Datenschutzstelle Liechtenstein)", "url": "https://www.datenschutzstelle.li/aktuelles/taetigkeitsbericht-2025", "date": "2026-09-04", "publisherClass": "official" }, { "title": "IT-Sicherheit beim elektronischen Gesundheitsdossier im Fürstentum Liechtenstein (Pentagrid)", "url": "https://www.pentagrid.ch/en/blog/it-sicherheit-beim-elektronischen-gesundheitsdossier-im-fuerstentum-liechtenstein/", "date": "2023-09-14", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 54, "summary": "Since July 2023 the hospital, doctors, pharmacists, dentists and care homes must upload key documents within 90 days, and Swiss hospitals began uploading in 2026. Actual upload compliance and links to claims and public health were not verified.", "sources": [ { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" }, { "title": "Verordnung über das elektronische Gesundheitsdossier (EGDV), Fassung 01.03.2024", "url": "https://www.gesetze.li/konso/pdf/2022365000?version=2", "date": "2024-03-01", "publisherClass": "legal_text" }, { "title": "Weiterentwicklung des elektronischen Gesundheitsdossiers (Regierung des Fürstentums Liechtenstein)", "url": "https://www.regierung.li/medienportal-medium/16182/234283/0/medienmitteilung", "date": "2026-03-03", "publisherClass": "official" }, { "title": "Anbindung an das elektronische Gesundheitsdossier (eGD) des Fürstentums Liechtenstein (HOCH Health Ostschweiz)", "url": "https://www.h-och.ch/ueber-uns/news/anbindung-an-das-elektronische-gesundheitsdossier-e-gd-des-fuerstentums-liechtenstein-2026-04-14/", "date": "2026-04-14", "publisherClass": "official" } ] }, "commercial": { "score": 54, "summary": "GDPR rules on health data apply through the EEA, and eGD data may only be used for the law's care purposes. The EU health data space bans on advertising and insurance uses do not yet apply, as it is not in the EEA Agreement.", "sources": [ { "title": "EEA-Lex factsheet: Regulation (EU) 2016/679 (EFTA)", "url": "https://www.efta.int/eea-lex/32016r0679", "date": "undated", "publisherClass": "intergov" }, { "title": "EEA-Lex factsheet: Regulation (EU) 2025/327, European Health Data Space (EFTA)", "url": "https://www.efta.int/eea-lex/32025r0327", "date": "undated", "publisherClass": "intergov" }, { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" } ] }, "clinical": { "score": 63, "summary": "Once a patient unlocks access, treating doctors see all eGD documents for 28 days, trusted providers for 365 days, and pharmacists see medicines for 24 hours. The dossier holds key documents, not full charts.", "sources": [ { "title": "Verordnung über das elektronische Gesundheitsdossier (EGDV), Fassung 01.03.2024", "url": "https://www.gesetze.li/konso/pdf/2022365000?version=2", "date": "2024-03-01", "publisherClass": "legal_text" }, { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" } ] }, "research": { "score": 42, "summary": "eGD data may only be used for the law's care purposes, so it is not a research source, and ethics review runs through the Zurich cantonal ethics committee. A Liechtenstein human research law and any general opt-out were not verified.", "sources": [ { "title": "Summary Report of the Coordination Office for Human Research (Kofam) 2021 (FOPH / swissethics)", "url": "https://swissethics.ch/assets/swissethics/jahresberichte/bag_jahresbericht_2021_a4_en.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Gesetz über das elektronische Gesundheitsdossier (EGDG), Fassung 01.02.2026", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4", "date": "2026-02-01", "publisherClass": "legal_text" }, { "title": "EEA-Lex factsheet: Regulation (EU) 2025/327, European Health Data Space (EFTA)", "url": "https://www.efta.int/eea-lex/32025r0327", "date": "undated", "publisherClass": "intergov" }, { "title": "Verwaltungsvereinbarung Amt für Gesundheit und Swissmedic (LGBl. 2024 Nr. 74)", "url": "https://gesetze.li/konso/html/2024074000?search_loc=&search_text=&version=1", "date": "2024-02-27", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "The EU medical device regulation has applied through the EEA since June 2020, but the EU AI Act is not yet in the EEA Agreement. A government legal expert hopes it is adopted in the course of 2027, and no national clinical AI rules were verified.", "sources": [ { "title": "EEA-Lex factsheet: Regulation (EU) 2017/745 (EFTA)", "url": "https://www.efta.int/eea-lex/32017r0745", "date": "undated", "publisherClass": "intergov" }, { "title": "EEA-Lex factsheet: Regulation (EU) 2024/1689, AI Act (EFTA)", "url": "https://www.efta.int/eea-lex/32024r1689", "date": "undated", "publisherClass": "intergov" }, { "title": "Verwaltungsvereinbarung Amt für Gesundheit und Swissmedic (LGBl. 2024 Nr. 74)", "url": "https://gesetze.li/konso/html/2024074000?search_loc=&search_text=&version=1", "date": "2024-02-27", "publisherClass": "legal_text" }, { "title": "Der AI-Act ist gestaffelt anwendbar (digital-liechtenstein.li)", "url": "https://digital-liechtenstein.li/der-ai-act-ist-gestaffelt-anwendbar/", "date": "2026-07-27", "publisherClass": "news" } ] } }, "laws": [ { "name": "Gesetz über das elektronische Gesundheitsdossier (EGDG)", "level": "National", "year": "2021", "what": "Opt-out eGD for all insured; read, hide, delete rights; mandatory uploads; access logs; fines up to CHF 50,000.", "url": "https://www.gesetze.li/konso/pdf/2021213000?version=4" }, { "name": "Verordnung über das elektronische Gesundheitsdossier (EGDV)", "level": "National", "year": "2022", "what": "Patient unlock of provider access; 28-day, 365-day and 24-hour windows; notice of unauthorised access.", "url": "https://www.gesetze.li/konso/pdf/2022365000?version=2" }, { "name": "Gesetz über die Ärzte (Ärztegesetz), Art. 14", "level": "National", "year": "2003", "what": "Doctors must keep records ten years and give patients information and a copy on request.", "url": "https://www.gesetze.li/konso/pdf/2003239000?version=14" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Applies in Liechtenstein through the EEA since 20 July 2018; health is special-category data.", "url": "https://www.efta.int/eea-lex/32016r0679" }, { "name": "Medical Device Regulation (EU) 2017/745", "level": "Supranational", "year": "2017", "what": "Covers medical device software including AI; in force in the EEA since 12 June 2020.", "url": "https://www.efta.int/eea-lex/32017r0745" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Under EEA scrutiny; no Joint Committee Decision, so not yet applicable in Liechtenstein.", "url": "https://www.efta.int/eea-lex/32025r0327" }, { "name": "EU Artificial Intelligence Act (EU) 2024/1689", "level": "Supranational", "year": "2024", "what": "Under EEA scrutiny; not yet applicable in Liechtenstein; implementing law planned.", "url": "https://www.efta.int/eea-lex/32024r1689" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ESP", "name": "Spain", "region": "Europe", "overall": 61, "rank": "21=", "likelyRank": "8 to 36", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Spaniards can read key reports from any region and hide them from other doctors, but the national record is summaries, not the chart.", "categories": { "access": { "score": 66, "summary": "Ley 41/2002 gives a free right to the clinical record, and the national HCDSNS shows up to nine report types from any region. Spain scored 88.3 on the EU record-access indicator (Digital Decade 2025, 2024 data; EU 82.7), but what each region publishes varies.", "sources": [ { "title": "Ley 41/2002, básica reguladora de la autonomía del paciente (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188", "date": "2002-11-15", "publisherClass": "legal_text" }, { "title": "Historia Clínica Digital del SNS: preguntas frecuentes (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/profesionales/hcdsns/Preguntas_frecuentes.htm", "date": "undated", "publisherClass": "official" }, { "title": "Digital Decade 2025 country report: Spain (European Commission, published by the Spanish government)", "url": "https://digital.gob.es/content/dam/portal-mtdfp/comunicacion/comunicacion_sedia/2025/06/16-06-2025/20250616InformeEspanaDecadaDigitalSDD25.pdf", "date": "2025-06-16", "publisherClass": "intergov" }, { "title": "La AEPD sanciona a un centro médico por cobrar 30 euros por entregar una historia clínica (Iberley)", "url": "https://www.iberley.es/noticias/la-aepd-sanciona-cobrar-30-euros-acceder-historia-clinica-36403", "date": "2026-04-30", "publisherClass": "news" } ] }, "control": { "score": 64, "summary": "Patients can hide individual reports from other doctors in HCDSNS and see every access, with a form to complain about unjustified ones. Choice covers only the shared national layer; inside each region clinicians treating the patient read the record by law.", "sources": [ { "title": "Historia Clínica Digital del SNS: preguntas frecuentes (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/profesionales/hcdsns/Preguntas_frecuentes.htm", "date": "undated", "publisherClass": "official" }, { "title": "Historia Clínica Digital del Sistema Nacional de Salud (Comunidad de Madrid)", "url": "https://www.comunidad.madrid/salud/historia-clinica-digital-sistema-nacional-salud", "date": "2025-11-20", "publisherClass": "official" }, { "title": "Preguntas frecuentes, La Meva Salut (Generalitat de Catalunya)", "url": "https://lamevasalut.gencat.cat/es/web/cps/ajuda/preguntes-frequents", "date": "undated", "publisherClass": "official" }, { "title": "Trazabilidad de los accesos a datos de salud: la AEPD anticipa el estándar del EHDS (Cuatrecasas)", "url": "https://www.cuatrecasas.com/es/spain/farmaceutico-sanitario/art/trazabilidad-accesos-datos-salud", "date": "2026-07-13", "publisherClass": "law_firm" } ] }, "privacy": { "score": 56, "summary": "GDPR and the LOPDGDD protect health data and the AEPD fines private providers, including 1.2 million euros against a Quirón hospital company. But public health services cannot be fined under LOPDGDD Article 77, only declared in breach.", "sources": [ { "title": "Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673", "date": "2018-12-06", "publisherClass": "legal_text" }, { "title": "Un hospital del Grupo Quirón recibe una multa de 1,2 millones de euros por perder el CD de un paciente (Infobae)", "url": "https://www.infobae.com/espana/2026/02/12/un-hospital-del-grupo-quiron-recibe-una-multa-de-12-millones-de-euros-por-perder-el-cd-de-un-paciente-que-aporto-resonancias-hechas-en-otros-centros/", "date": "2026-02-12", "publisherClass": "news" }, { "title": "El software para psicólogos Eholo sufre una grave filtración de datos (Escudo Digital)", "url": "https://www.escudodigital.com/ciberseguridad/eholo-startup-filtracion-datos-pacientes.html", "date": "2026-03-05", "publisherClass": "news" }, { "title": "Un grupo de hackers asegura haber robado datos médicos y financieros de pacientes de Quirón en España (La Voz del Sur)", "url": "https://www.lavozdelsur.es/actualidad/salud/un-grupo-de-hackers-asegura-haber-robado-datos-medicos-y-financieros-de-pacientes-de-quiron-en-espana.html", "date": "2026-08-11", "publisherClass": "news" } ] }, "journey": { "score": 64, "summary": "HCDSNS links nine report types across the regional health services, and e-prescriptions can be filled in any region's pharmacy. Spain has no nationwide longitudinal record; the Ministry commissioned a 2026 roadmap toward one.", "sources": [ { "title": "Historia Clínica Digital del SNS: preguntas frecuentes (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/profesionales/hcdsns/Preguntas_frecuentes.htm", "date": "undated", "publisherClass": "official" }, { "title": "Receta Electrónica del Sistema Nacional de Salud (RESNS) (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/areas/saludDigital/recetaElectronicaSNS/home.htm", "date": "undated", "publisherClass": "official" }, { "title": "Recommendations for a national electronic health record in Spain: a Delphi study (The Lancet Digital Health, via University of Edinburgh)", "url": "https://www.research.ed.ac.uk/en/publications/recommendations-for-a-national-electronic-health-record-in-spain-/", "date": "2026-08-19", "publisherClass": "academic" }, { "title": "Presentado el Espacio Nacional de Datos de Salud (Ministerio para la Transformación Digital y de la Función Pública)", "url": "https://digital.gob.es/digitalizacion/la-economia-del-dato/actualidad/2026/01/presentado-el-espacio-nacional-de-datos-de-salud", "date": "2026-01-29", "publisherClass": "official" } ] }, "commercial": { "score": 60, "summary": "Ley 41/2002 ties the clinical record to care, and since 2023 life insurers may not consider cancer five years after treatment ends. No Spanish ban on selling health data beyond GDPR was found, and the 2026 national data space is open to companies.", "sources": [ { "title": "Ley 41/2002, básica reguladora de la autonomía del paciente (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188", "date": "2002-11-15", "publisherClass": "legal_text" }, { "title": "Real Decreto-ley 5/2023, art. 209: derecho al olvido oncológico en el contrato de seguro (BOE)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2023-15135", "date": "2023-06-28", "publisherClass": "legal_text" }, { "title": "Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673", "date": "2018-12-06", "publisherClass": "legal_text" }, { "title": "Presentado el Espacio Nacional de Datos de Salud (Ministerio para la Transformación Digital y de la Función Pública)", "url": "https://digital.gob.es/digitalizacion/la-economia-del-dato/actualidad/2026/01/presentado-el-espacio-nacional-de-datos-de-salud", "date": "2026-01-29", "publisherClass": "official" } ] }, "clinical": { "score": 60, "summary": "Inside each region clinicians usually share one record; Catalonia's HC3 reaches every public hospital and primary care centre. Across regions, a doctor sees only the HCDSNS report types, needs the patient's authorisation outside emergencies, and is told when reports are hidden.", "sources": [ { "title": "Ley 41/2002, básica reguladora de la autonomía del paciente (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188", "date": "2002-11-15", "publisherClass": "legal_text" }, { "title": "La història clínica compartida, present a tots els hospitals i els CAP de la xarxa sanitària pública (Govern de Catalunya)", "url": "https://govern.cat/gov/notes-premsa/275211/la-historia-clinica-compartida-present-a-tots-els-hospitals-i-els-cap-de-la-xarxa-sanitaria-publica", "date": "2014-09-01", "publisherClass": "official" }, { "title": "Historia Clínica Digital del SNS: preguntas frecuentes (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/profesionales/hcdsns/Preguntas_frecuentes.htm", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Pseudonymised health data may be used for research without consent under the LOPDGDD, with no general opt-out, but with ethics review, separation of identity and a penalty for re-identification. The EHDS opt-out from secondary use starts in 2029.", "sources": [ { "title": "Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (BOE, texto consolidado)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673", "date": "2018-12-06", "publisherClass": "legal_text" }, { "title": "Real Decreto 1090/2015, ensayos clínicos con medicamentos (BOE)", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2015-14082", "date": "2015-12-04", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Consulta pública previa sobre el Anteproyecto de Ley de Salud Digital (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/normativa/docs/2025.09.22_CPP_CPP_APL_Salud_Digital1_.pdf", "date": "2025-09-22", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Spain relies on EU law for clinical AI. AESIA, the national AI supervisor, is an authority designation, and the national AI bill approved by the Council of Ministers in May 2026 was not yet law.", "sources": [ { "title": "¿Qué es la AESIA? (Agencia Española de Supervisión de Inteligencia Artificial)", "url": "https://aesia.digital.gob.es/es", "date": "undated", "publisherClass": "official" }, { "title": "El Gobierno regula la inteligencia artificial para asegurar un uso confiable, ético y garantista (La Moncloa, Consejo de Ministros 26.5.2026)", "url": "https://www.lamoncloa.gob.es/consejodeministros/resumenes/paginas/2026/260526-rueda-prensa-ministros.aspx", "date": "2026-05-26", "publisherClass": "official" }, { "title": "Consulta pública previa sobre el Anteproyecto de Ley de Salud Digital (Ministerio de Sanidad)", "url": "https://www.sanidad.gob.es/normativa/docs/2025.09.22_CPP_CPP_APL_Salud_Digital1_.pdf", "date": "2025-09-22", "publisherClass": "official" }, { "title": "Digital Omnibus on AI has been published (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Ley 41/2002, básica reguladora de la autonomía del paciente", "level": "National", "year": "2002", "what": "Right to access and copy the clinical record; limits record use to care; anonymity for secondary uses.", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188" }, { "name": "Ley Orgánica 3/2018 (LOPDGDD)", "level": "National", "year": "2018", "what": "Applies GDPR; pseudonymised research rules; re-identification offence; no fines for public bodies.", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673" }, { "name": "Real Decreto-ley 5/2023 (derecho al olvido oncológico)", "level": "National", "year": "2023", "what": "Life insurers may not consider cancer five years after treatment ends; bars health-condition discrimination.", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2023-15135" }, { "name": "Real Decreto 1090/2015, ensayos clínicos con medicamentos", "level": "National", "year": "2015", "what": "Informed consent and ethics committee rules for clinical trials, applying EU Regulation 536/2014.", "url": "https://www.boe.es/buscar/act.php?id=BOE-A-2015-14082" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient access, access logs and EU exchange from 2029 and 2031; secondary-use rules and opt-out.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health data is a special category; free first copy within one month; breach notification and fines.", "url": "https://www.boe.es/buscar/doc.php?id=DOUE-L-2016-80807" }, { "name": "EU AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; duties for AI in medical devices apply from 2 August 2028.", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-04-20", "headline": "Clinic charged a patient 30 euros for a first copy of her record", "paraphrase": "After leaving her private insurer, a patient had to request her record in person and pay 30 euros in cash for a one-page copy. The regulator found the charge unlawful; the clinic accepted responsibility and paid a reduced fine.", "source": "Agencia Española de Protección de Datos (AEPD), PS-00560-2025 (EXP202503617)", "url": "https://www.aepd.es/documento/ps-00560-2025.pdf", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2026-07-07", "headline": "Employer's health service ignored a request for a medical record for three years", "paraphrase": "A police employee asked the force's medical service for their full record in 2022 and 2025 with no answer; copies came only after a complaint. The regulator upheld it, citing the right to know who holds the data.", "source": "Agencia Española de Protección de Datos (AEPD), PD-00068-2026 (EXP202518019)", "url": "https://www.aepd.es/documento/pd-00068-2026.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2025-01-28", "headline": "Specialist could not see a report held by another public hospital", "paraphrase": "After a long wait for an appointment, a patient was told the specialist could not see a report held at another public hospital and was asked to fetch it herself. The ombudsman recommended records be reachable from every public centre.", "source": "Síndic de Greuges de la Comunitat Valenciana (regional ombudsman), complaint 2403790", "url": "https://www.elsindic.com/Resoluciones/expedientes/2024/202403790/12238270.pdf", "theme": "lost_between_providers", "status": "finding" }, { "date": "2025-02-07", "headline": "Doctor convicted for opening a colleague's clinical record three times", "paraphrase": "A primary care doctor used her own login to open a colleague's clinical record three times, though the colleague was not her patient. A provincial court gave her a suspended prison term, six years' disqualification and 50,000 euros in damages.", "source": "Salud y Medicina", "url": "https://saludymedicina.org/post/seis-anos-de-inhabilitacion-y-dos-de-carcel-por-tres-visitas-a-la-historia-clinica-de-su-colega", "theme": "breach", "status": "finding" } ] }, { "iso3": "HRV", "name": "Croatia", "region": "Europe", "overall": 60, "rank": "23=", "likelyRank": "9 to 38", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Croatians can see labs, prescriptions and hospital letters online and block whole groups of doctors, but private clinics stay outside CEZIH until 2027.", "categories": { "access": { "score": 62, "summary": "The 2004 patient rights law gives a right to the whole record, with copies at the patient's cost. Portal zdravlja shows lab results, prescriptions, referrals and hospital letters, but its user count was not verified, so the score sits in the lower half of the band.", "sources": [ { "title": "Zakon o zastiti prava pacijenata (NN 169/04)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/full/2004_12_169_2953.html", "date": "2004-12-03", "publisherClass": "legal_text" }, { "title": "HZZO za e-Gradane", "url": "https://hzzo.hr/e-gradani/hzzo-za-e-gradane", "date": "undated", "publisherClass": "official" }, { "title": "Portal zdravlja dostupan i na mobilnim uredajima (gov.hr)", "url": "https://gov.hr/hr/portal-zdravlja-dostupan-i-na-mobilnim-uredjajima/2340", "date": "undated", "publisherClass": "official" }, { "title": "Pravilnik o opsegu i sadrzaju podataka te nacinu vodenja e-Kartona (NN 74/2023)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2023_07_74_1210.html", "date": "2023-07-06", "publisherClass": "legal_text" } ] }, "control": { "score": 66, "summary": "In Portal zdravlja patients can allow or block access by whole groups, such as all family doctors, emergency doctors or hospital specialists. A law-backed log shows who viewed which data and when, but sharing is on by default.", "sources": [ { "title": "eKarton pravila privatnosti (Ministarstvo zdravstva)", "url": "https://mobilne.portal.zdravlje.hr/ek/ekarton-pravila-privatnosti.html", "date": "2026-06-24", "publisherClass": "official" }, { "title": "Pravilnik o opsegu i sadrzaju podataka te nacinu vodenja e-Kartona (NN 74/2023)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2023_07_74_1210.html", "date": "2023-07-06", "publisherClass": "legal_text" }, { "title": "Zakon o podacima i informacijama u zdravstvu (NN 14/19)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/full/2019_02_14_269.html", "date": "2019-02-07", "publisherClass": "legal_text" }, { "title": "HZZO za e-Gradane", "url": "https://hzzo.hr/e-gradani/hzzo-za-e-gradane", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 52, "summary": "The regulator AZOP has fined hospitals, including EUR 190,000 for lost radiology images. But Croatian law bars fines on public authorities, fines on public services must not disrupt them, and hospitals and the ministry have been hacked.", "sources": [ { "title": "Zakon o provedbi Opce uredbe o zastiti podataka (NN 42/18)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html", "date": "2018-05-09", "publisherClass": "legal_text" }, { "title": "Izdane nove upravne novcane kazne u ukupnom iznosu od 270.700 eura (AZOP)", "url": "https://azop.hr/izdane-nove-upravne-novcane-kazne-u-ukupnom-iznosu-od-270-700-eura/", "date": "2024-09-13", "publisherClass": "official" }, { "title": "Izreceno novih sedam upravnih novcanih kazni u iznosu od 169.000 eura (AZOP)", "url": "https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/", "date": "2025-03-24", "publisherClass": "official" }, { "title": "KBC Zagreb je kontaktirao AZOP, ali pacijente i dalje nije obavijestio (Faktograf)", "url": "https://faktograf.hr/2024/07/08/kbc-zagreb-je-kontaktirao-azop-ali-pacijente-i-dalje-nije-obavijestio-o-mogucoj-kradi-podataka/", "date": "2024-07-08", "publisherClass": "news" } ] }, "journey": { "score": 68, "summary": "By law every provider must exchange data through CEZIH, which carries e-prescriptions, e-referrals, lab results and hospital letters. Private clinics outside HZZO contracts got two extensions and now have until 1 January 2027.", "sources": [ { "title": "Zakon o podacima i informacijama u zdravstvu (NN 14/19, HLK copy)", "url": "https://www.hlk.hr/EasyEdit/UserFiles/propisi/zakon-o-podacima-i-informacijama-u-zdravstvu-nn-14-2019.pdf", "date": "2019-02-07", "publisherClass": "legal_text" }, { "title": "Developing an integrated e-health system in Croatia (WHO Europe)", "url": "https://www.integratedcare4people.org/practices/327/developing-an-integrated-e-health-system-in-croatia-to-drive-care-improvements/", "date": "2016", "publisherClass": "intergov" }, { "title": "Introduction of electronic health records in hospitals (WHO European Observatory)", "url": "https://eurohealthobservatory.who.int/monitors/health-systems-monitor/updates/hspm/croatia-2022/introduction-of-electronic-health-records-in-hospitals", "date": "2022-10-21", "publisherClass": "intergov" }, { "title": "Rok za prikljucivanje produljen (Glas Slavonije)", "url": "https://www.glas-slavonije.hr/novosti/hrvatska/2026/08/13/rok-za-prikljucivanje-produljen-nalazi-privatnih-lijecnika-tek-od-1-sijecnja-iduce-godine-u-cezih-u-779594/", "date": "2026-08-13", "publisherClass": "news" } ] }, "commercial": { "score": 56, "summary": "Croatia relies on the GDPR, and its health data law bars collecting health data from secondary sources unless another law allows it. No Croatian ban on selling de-identified health data was verified, and the same law lists commercial use among legitimate data users.", "sources": [ { "title": "Zakon o podacima i informacijama u zdravstvu (NN 14/19, HLK copy)", "url": "https://www.hlk.hr/EasyEdit/UserFiles/propisi/zakon-o-podacima-i-informacijama-u-zdravstvu-nn-14-2019.pdf", "date": "2019-02-07", "publisherClass": "legal_text" }, { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "date": "2016-04-27", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 64, "summary": "The chosen family doctor, the paediatrician and clinicians who start treatment can see the e-Karton through CEZIH. Patients can block groups such as emergency doctors, and private findings will be missing until 2027.", "sources": [ { "title": "Pravilnik o opsegu i sadrzaju podataka te nacinu vodenja e-Kartona (NN 74/2023)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2023_07_74_1210.html", "date": "2023-07-06", "publisherClass": "legal_text" }, { "title": "eKarton pravila privatnosti (Ministarstvo zdravstva)", "url": "https://mobilne.portal.zdravlje.hr/ek/ekarton-pravila-privatnosti.html", "date": "2026-06-24", "publisherClass": "official" }, { "title": "Rok za prikljucivanje produljen (Glas Slavonije)", "url": "https://www.glas-slavonije.hr/novosti/hrvatska/2026/08/13/rok-za-prikljucivanje-produljen-nalazi-privatnih-lijecnika-tek-od-1-sijecnja-iduce-godine-u-cezih-u-779594/", "date": "2026-08-13", "publisherClass": "news" } ] }, "research": { "score": 45, "summary": "The 2019 law allows further processing of health data for research and statistics, with no individual consent or general opt-out found. A national health data access body (CHDC) is being built by the HZJZ institute until November 2027.", "sources": [ { "title": "Zakon o podacima i informacijama u zdravstvu (NN 14/19, HLK copy)", "url": "https://www.hlk.hr/EasyEdit/UserFiles/propisi/zakon-o-podacima-i-informacijama-u-zdravstvu-nn-14-2019.pdf", "date": "2019-02-07", "publisherClass": "legal_text" }, { "title": "Hrvatski centar za zdravstvene podatke (CHDC) (HZJZ)", "url": "https://www.hzjz.hr/en/projekti/hrvatski-centar-za-zdravstvene-podatke-eng-croatian-health-data-centre-chdc/", "date": "undated", "publisherClass": "official" }, { "title": "Zakon o zastiti prava pacijenata (NN 169/04)", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/full/2004_12_169_2953.html", "date": "2004-12-03", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU law only: the AI Act and the medical device rules. Croatia named fundamental-rights bodies in 2024, but no national AI law or health-AI rule was verified as adopted.", "sources": [ { "title": "Objavljen popis nadleznih tijela sukladno Uredbi o umjetnoj inteligenciji (MPUDT)", "url": "https://mpudt.gov.hr/vijesti/objavljen-popis-nadleznih-tijela-sukladno-uredbi-o-umjetnoj-inteligenciji/29657?lang=hr", "date": "2024-12-05", "publisherClass": "official" }, { "title": "Hrvatska priprema zakonski okvir za nadzor primjene umjetne inteligencije (financije.hr)", "url": "https://financije.hr/hrvatska-priprema-zakonski-okvir-za-nadzor-primjene-umjetne-inteligencije/", "date": "2025-07-21", "publisherClass": "news" }, { "title": "AI Act: regulatory framework for AI (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Zakon o podacima i informacijama u zdravstvu (NN 14/19)", "level": "National", "year": "2019", "what": "Creates e-Karton, limits access to treating clinicians, obliges every provider to exchange data via CEZIH.", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/full/2019_02_14_269.html" }, { "name": "Zakon o zastiti prava pacijenata (NN 169/04)", "level": "National", "year": "2004", "what": "Right to the whole medical record, copies at own cost; written consent for research.", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/full/2004_12_169_2953.html" }, { "name": "Pravilnik o opsegu i sadrzaju podataka te nacinu vodenja e-Kartona (NN 74/2023)", "level": "National", "year": "2023", "what": "Sets e-Karton contents and access; portal must show who viewed which data and when.", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2023_07_74_1210.html" }, { "name": "Zakon o provedbi Opce uredbe o zastiti podataka (NN 42/18)", "level": "National", "year": "2018", "what": "Implements GDPR; public authorities cannot be fined by AZOP.", "url": "https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health is special-category data; fines up to EUR 20M or 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Free access, access log, restriction rights and secondary-use opt-out; main parts apply from 2029.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" }, { "name": "Artificial Intelligence Act (EU) 2024/1689", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; high-risk duties for AI in medical devices from August 2028.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-04", "headline": "Patients asked a private hospital for their scans; the images had been lost", "paraphrase": "Several patients complained that a private hospital never sent copies of their records. The regulator found imaging files had been irretrievably lost, no backups existed, the loss was never reported, and fined the hospital 190,000 euros.", "source": "Agencija za zaštitu osobnih podataka (AZOP), final decision UP/I-034-01/24-01/23", "url": "https://azop.hr/wp-content/uploads/2026/04/AZOP_Rjesenje-pravomocno_Medico.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2025-07", "headline": "Hospital worker photographed a patient's test result on screen and it reached the media", "paraphrase": "An unknown hospital employee photographed a patient's result in the hospital system and it was published by the media. The hospital neither reported the breach nor told the patient until their lawyer wrote. The regulator fined it.", "source": "Agencija za zaštitu osobnih podataka (AZOP), anonymised decision 567-UP/I-034-01/24-01/31", "url": "https://azop.hr/wp-content/uploads/2025/07/bolnica2-clanak-32-33-13-34.pdf", "theme": "breach", "status": "finding" }, { "date": "2025-07", "headline": "Ransomware attacker spent a week inside a hospital network and copied data out", "paraphrase": "After a ransomware attack, the regulator found a hospital's weak technical safeguards let an attacker roam its systems unnoticed for about seven days and copy at least 3 GB out. The hospital was fined 20,000 euros.", "source": "Agencija za zaštitu osobnih podataka (AZOP), anonymised decision 567-UP/I-034-01/24-01/34", "url": "https://azop.hr/wp-content/uploads/2025/07/bolnica1-clanak-32.pdf", "theme": "breach", "status": "finding" }, { "date": "2026-08-23", "headline": "Hackers claim to have posted thousands of patient records from a Croatian practice", "paraphrase": "A hacking group claimed it broke into a private medical practice and posted about 9,400 records for free download, including names, national ID numbers, addresses, medicines, doctors' notes and scanned medical documents. The practice was not named.", "source": "Dnevnik.hr (Nova TV)", "url": "https://dnevnik.hr/vijesti/hrvatska/udar-na-privatnost-pod-zastitom-gdpr-a-hakeri-besplatno-dijele-medicinsku-dokumentaciju-hrvatskih-gradjana---997427.html", "theme": "breach", "status": "alleged" } ] }, { "iso3": "LTU", "name": "Lithuania", "region": "Europe", "overall": 60, "rank": "23=", "likelyRank": "9 to 38", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "A national e-health record with per-document hiding and a visible view history, undercut by weak clinician logins and a shaky central system.", "categories": { "access": { "score": 67, "summary": "The law gives patients their records and certified copies, and the national E. sveikata portal shows diagnoses, prescriptions, referrals, images and vaccinations. An EC study scored Lithuania 95% on eHealth maturity, but lab results were only being added from October 2025.", "sources": [ { "title": "Lietuvos Respublikos pacientų teisių ir žalos sveikatai atlyginimo įstatymas I-1562 (suvestinė redakcija nuo 2025-07-01)", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/TAIS.31932/asr", "date": "2025-07-01", "publisherClass": "legal_text" }, { "title": "E. sveikata (E. sveikatos portalas)", "url": "https://www.esveikata.lt/e-sveikata", "date": "2025-10-14", "publisherClass": "official" }, { "title": "2025 Digital Decade eHealth indicator study, final report (European Commission, DG CNECT)", "url": "http://espanadigital.gob.es/sites/espanadigital/files/2025-12/Estudio%20de%20Indicadores%20de%20eHealth%20de%20la%20D%C3%A9cada%20Digital%202025.pdf", "date": "2025", "publisherClass": "intergov" }, { "title": "Pacientų laboratorinių tyrimų duomenys bus keliami į E. sveikatą", "url": "https://www.esveikata.lt/naujiena/259", "date": "2025-10-07", "publisherClass": "official" } ] }, "control": { "score": 62, "summary": "Patients can hide individual documents and see who viewed each one, when and on what basis. Hiding does not stop primary care doctors, emergency doctors or representatives, and uploads need no consent.", "sources": [ { "title": "4.21 Peržiūrėti ESI įrašą (E. sveikatos paciento portalo pagalba)", "url": "https://pacientas.esveikata.lt/help/pages/perzireti-esi-irasa.html", "date": "undated", "publisherClass": "official" }, { "title": "Overview of the national laws on electronic health records in the EU Member States: Lithuania (European Commission)", "url": "https://ec.europa.eu/health/system/files/2016-11/laws_lithuania_en_0.pdf", "date": "2016-11", "publisherClass": "intergov" }, { "title": "Siurbiami ne tik Registrų centro duomenys: jūsų sveikatos duomenis gali perskaityti ir valytoja (15min)", "url": "https://www.15min.lt/verslas/naujiena/bendroves/siurbiami-ne-tik-registru-centro-duomenys-jusu-sveikatos-duomenis-gali-perskaityti-ir-valytoja-663-2698800", "date": "2026-06-05", "publisherClass": "news" } ] }, "privacy": { "score": 50, "summary": "Patient information is confidential by law and GDPR applies, but clinician access to E. sveikata relies on a username and password. In June 2026 the ministry tabled a cybersecurity law package after an intrusion into a health agency subsystem.", "sources": [ { "title": "Lietuvos Respublikos pacientų teisių ir žalos sveikatai atlyginimo įstatymas I-1562 (suvestinė redakcija nuo 2025-07-01)", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/TAIS.31932/asr", "date": "2025-07-01", "publisherClass": "legal_text" }, { "title": "Atsakas kibernetinėms grėsmėms: Seime registruoti strateginiai įstatymų pakeitimai E. sveikatos stiprinimui", "url": "https://www.esveikata.lt/naujiena/318", "date": "2026-06-10", "publisherClass": "official" }, { "title": "Siurbiami ne tik Registrų centro duomenys: jūsų sveikatos duomenis gali perskaityti ir valytoja (15min)", "url": "https://www.15min.lt/verslas/naujiena/bendroves/siurbiami-ne-tik-registru-centro-duomenys-jusu-sveikatos-duomenis-gali-perskaityti-ir-valytoja-663-2698800", "date": "2026-06-05", "publisherClass": "news" } ] }, "journey": { "score": 68, "summary": "One national system, ESPBI IS, holds visits, diagnoses, e-prescriptions and referrals, and since October 2025 labs are moving onto it in a structured format. A November 2025 upgrade left clinicians unable to work properly.", "sources": [ { "title": "Pacientų laboratorinių tyrimų duomenys bus keliami į E. sveikatą", "url": "https://www.esveikata.lt/naujiena/259", "date": "2025-10-07", "publisherClass": "official" }, { "title": "Lietuvoje išrašytus e. receptus pripažins daugiau ES valstybių", "url": "https://www.esveikata.lt/naujiena/210", "date": "2024-09-04", "publisherClass": "official" }, { "title": "Registrų centras tęsia E. sveikatos trikdžių šalinimą", "url": "https://www.esveikata.lt/naujiena/274", "date": "2025-11-10", "publisherClass": "official" }, { "title": "Data Resource Profile: The Lithuanian health data reuse pathway (International Journal of Epidemiology)", "url": "https://academic.oup.com/ije/article/54/4/dyaf118/8186979", "date": "2025-07-06", "publisherClass": "academic" } ] }, "commercial": { "score": 54, "summary": "The 2021 health data reuse law limits reuse to six purposes, and marketing is not one of them, but businesses may get permits for innovation. No explicit ban on selling health data or using it for advertising was found.", "sources": [ { "title": "Lietuvos Respublikos pakartotinio sveikatos duomenų naudojimo įstatymas XIV-789 (suvestinė redakcija nuo 2023-09-01)", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/72c77a52626411ecb2fe9975f8a9e52e/asr", "date": "2023-09-01", "publisherClass": "legal_text" } ] }, "clinical": { "score": 64, "summary": "Clinicians use a national specialist portal to read records from other providers, and patient hiding cannot block emergency or primary care doctors. Cross-provider lab results only began arriving in late 2025.", "sources": [ { "title": "4.21 Peržiūrėti ESI įrašą (E. sveikatos paciento portalo pagalba)", "url": "https://pacientas.esveikata.lt/help/pages/perzireti-esi-irasa.html", "date": "undated", "publisherClass": "official" }, { "title": "Pacientų laboratorinių tyrimų duomenys bus keliami į E. sveikatą", "url": "https://www.esveikata.lt/naujiena/259", "date": "2025-10-07", "publisherClass": "official" }, { "title": "Registrų centras tęsia E. sveikatos trikdžių šalinimą", "url": "https://www.esveikata.lt/naujiena/274", "date": "2025-11-10", "publisherClass": "official" }, { "title": "Premjerė e.sveikatą vadina anekdotu, tikisi IT progreso viešajame sektoriuje (tv3.lt, BNS)", "url": "https://www.tv3.lt/naujiena/lietuva/premjere-e-sveikata-vadina-anekdotu-tikisi-it-progreso-viesajame-sektoriuje-n1468966", "date": "2025-11-12", "publisherClass": "news" } ] }, "research": { "score": 48, "summary": "Data collected for care can be reused for research under a State Data Agency permit without the person's consent, and no general opt-out exists. Safeguards include a public register of permitted uses and checks that published results are anonymised.", "sources": [ { "title": "Lietuvos Respublikos pakartotinio sveikatos duomenų naudojimo įstatymas XIV-789 (suvestinė redakcija nuo 2023-09-01)", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/72c77a52626411ecb2fe9975f8a9e52e/asr", "date": "2023-09-01", "publisherClass": "legal_text" }, { "title": "Biomedicininių tyrimų etikos įstatymo Nr. VIII-1679 pakeitimo įstatymas XIII-2758", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/b34677de288611ea8f0dfdc2b5879561/asr", "date": "2019-12-20", "publisherClass": "legal_text" }, { "title": "Data Resource Profile: The Lithuanian health data reuse pathway (International Journal of Epidemiology)", "url": "https://academic.oup.com/ije/article/54/4/dyaf118/8186979", "date": "2025-07-06", "publisherClass": "academic" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, whose duties for medical devices now start 2 August 2028. Lithuania has named the regulators the AI Act requires, but no national clinical AI rules were verified.", "sources": [ { "title": "AI Act Service Desk: national resources (European Commission)", "url": "https://ai-act-service-desk.ec.europa.eu/en/national-resources", "date": "undated", "publisherClass": "intergov" }, { "title": "EU Digital Omnibus on AI enters into force (K&L Gates, Cyber Law Watch)", "url": "https://www.cyberlawwatch.com/2026/07/31/eu-digital-omnibus-on-ai-enters-into-force/", "date": "2026-07-31", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Law on the Rights of Patients and Compensation for Damage to Health (I-1562)", "level": "National", "year": "1996", "what": "Right to see records and get certified copies; confidentiality of patient information; consent for disclosure.", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/TAIS.31932/asr" }, { "name": "Law on the Reuse of Health Data (XIV-789)", "level": "National", "year": "2021", "what": "Permit-based reuse by the State Data Agency for six purposes; no consent needed for care data.", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/72c77a52626411ecb2fe9975f8a9e52e/asr" }, { "name": "Law on Biomedical Research Ethics (VIII-1679), amended by XIII-2758", "level": "National", "year": "2019", "what": "Informed written consent for biomedical research and biobank participation.", "url": "https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/b34677de288611ea8f0dfdc2b5879561/asr" }, { "name": "Regulation (EU) 2025/327 (European Health Data Space)", "level": "Supranational", "year": "2025", "what": "Free access, restriction rights, access logs and secondary-use opt-out; main duties apply from March 2029 and 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)", "level": "Supranational", "year": "2026", "what": "Delays AI Act duties for AI in medical devices to 2 August 2028.", "url": "https://www.cyberlawwatch.com/2026/07/31/eu-digital-omnibus-on-ai-enters-into-force/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-03", "headline": "Regulator reprimands sanatorium for opening a patient's unrelated national e-health documents", "paraphrase": "A patient saw in the national e-health log that a sanatorium's staff had opened a referral written for a different specialist. The regulator found no lawful basis for viewing it and reprimanded the sanatorium.", "source": "Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)", "url": "https://vdai.lrv.lt/public/canonical/1788937777/1540/2026-09-03%20sprendimas%20Nr.%203R-1575%20(2.13-1.E).pdf", "theme": "breach", "status": "finding" }, { "date": "2026-06-19", "headline": "Private clinic group fined 450,000 euros after two breaches of patient records", "paraphrase": "A leaked staff login let an outsider open 63 patients' files, and a later ransomware attack hit systems holding records of about 383,000 patients. The regulator found security was inadequate and fined the company 450,000 euros.", "source": "Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)", "url": "https://vdai.lrv.lt/public/canonical/1782465015/1462/2026-06-19%20sprendimas%20Nr.%203R-1143%20", "theme": "breach", "status": "finding" }, { "date": "2026-06-05", "headline": "Doctor fined for opening 1,231 patients' files and contacting them without a lawful basis", "paraphrase": "While on sick leave and about to leave a public primary care centre, a doctor viewed 1,231 patients' files in its records system and used their contacts to email and text them. The regulator fined the doctor 1,153 euros.", "source": "Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)", "url": "https://vdai.lrv.lt/public/canonical/1780997432/1430/2026-06-05%20sprendimas%20Nr.%203R-1040%20", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-08-20", "headline": "Nurse logged a visit that never happened in a patient's national e-health record", "paraphrase": "While handling a records transfer, a nurse at a health centre registered a visit the patient never made, then deleted it. The regulator accepted the centre's fixes and rejected the complaint as posing no real risk.", "source": "Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania)", "url": "https://vdai.lrv.lt/public/canonical/1755688163/1060/2025-08-20%20sprendimas%20Nr.%203R-1087%20(2.13-1.E).pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2026-06-22", "headline": "Clinic's system error sent health check invitations to women registered with other providers", "paraphrase": "Women received text invitations from a clinic they had never used. The clinic blamed a backend fault in an information system shared with other providers, could not say how many people were reached, and said no data left the system.", "source": "Respublika.lt (Vakaro žinios)", "url": "https://www.respublika.lt/lt/naujienos/lietuva/kitos-lietuvos-zinios/ne-jiems-skirtas-sms-gave-pacientai-baiminasi-ar-nenutekejo-ju-duomenys/", "theme": "record_wrong", "status": "admitted" } ] }, { "iso3": "NLD", "name": "Netherlands", "region": "Europe", "overall": 60, "rank": "23=", "likelyRank": "11 to 40", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Dutch records move between providers only with the patient's explicit opt-in, but few people use their copy apps and an EHDS opt-out is planned.", "categories": { "access": { "score": 55, "summary": "Dutch law gives a copy of the whole file and free electronic access, and about 93% of GPs connect to certified apps. Only 571,000 people fetched records that way in 2024, and the EU scores Dutch record access 69.35 against an 86.51 average.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7, art. 7:454-7:458 (WGBO), geldende versie (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0005290/2026-01-01/0", "date": "2026-01-01", "publisherClass": "legal_text" }, { "title": "Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz), art. 15a-15f (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0023864/2025-07-05/0", "date": "2025-07-05", "publisherClass": "legal_text" }, { "title": "Digital Decade 2026 country report, the Netherlands, SWD(2026) 155 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/128656", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "Ruim half miljoen Nederlanders haalden in 2024 via MedMij gegevens op (Stichting MedMij)", "url": "https://medmij.nl/media/ruim-half-miljoen-nederlanders-haalden-in-2024-via-medmij-gegevens-op/", "date": "2025-02-13", "publisherClass": "official" } ] }, "control": { "score": 72, "summary": "Under the Wabvpz a provider may share data through an exchange system only with the patient's explicit consent, and patients can see on Volgjezorg who viewed their data via the national switch point. Consent is split across several systems, and the government plans an EHDS opt-out.", "sources": [ { "title": "Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz), art. 15a-15f (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0023864/2025-07-05/0", "date": "2025-07-05", "publisherClass": "legal_text" }, { "title": "Vragen & antwoorden (Mitz, Stichting GVvZ / VZVZ)", "url": "https://www.mitz-toestemming.nl/kennis-en-ondersteuning/vragen-antwoorden", "date": "undated", "publisherClass": "official" }, { "title": "Volgjezorg: grip op je medische gegevens (VZVZ)", "url": "https://www.volgjezorg.nl/", "date": "undated", "publisherClass": "official" }, { "title": "MijnMitz: toestemmingskeuzes voor het delen van medische gegevens (Mitz)", "url": "https://www.mijnmitz.nl", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 52, "summary": "The 2025 hack of lab Clinical Diagnostics exposed data of up to 850,000 people, and the health inspectorate found the lab had not met the required NEN 7510 security norm but cannot fine it. Health and welfare filed over 6,800 breach reports in 2024.", "sources": [ { "title": "Clinical Diagnostics voldeed niet aan wettelijke norm voor informatiebeveiliging (IGJ)", "url": "https://www.igj.nl/actueel/nieuws/2026/05/13/clinical-diagnostics-voldeed-niet-aan-wettelijke-norm-voor-informatiebeveiliging", "date": "2026-05-13", "publisherClass": "official" }, { "title": "AP gaat databeveiliging in de zorg controleren (Autoriteit Persoonsgegevens)", "url": "https://www.autoriteitpersoonsgegevens.nl/actueel/ap-gaat-databeveiliging-in-de-zorg-controleren", "date": "2025-12-03", "publisherClass": "official" }, { "title": "Boete OLVG (Autoriteit Persoonsgegevens)", "url": "https://www.autoriteitpersoonsgegevens.nl/documenten/boete-olvg", "date": "2021-02-11", "publisherClass": "official" }, { "title": "Hackers laboratorium hadden toegang tot gegevens 850.000 mensen (NOS)", "url": "https://nos.nl/artikel/2580363-hackers-laboratorium-hadden-toegang-tot-gegevens-850-000-mensen", "date": "2025-08-29", "publisherClass": "news" } ] }, "journey": { "score": 60, "summary": "The national switch point carries more than a billion messages a year, mainly between GPs and pharmacies, and the Wegiz can make set data flows electronic by law. The Commission still calls Dutch health digitalisation fragmented, with no overview of which hospitals share data.", "sources": [ { "title": "Jaarterugblik AORTA-LSP 2025 (VZVZ)", "url": "https://www.vzvz.nl/nieuws/jaarterugblik-aorta-lsp-2025", "date": "2026-02-03", "publisherClass": "official" }, { "title": "Wegiz: uitleg over de wet (Data voor gezondheid, ministerie van VWS)", "url": "https://www.datavoorgezondheid.nl/onderwerpen/w/wegiz/uitleg-over-de-wet", "date": "undated", "publisherClass": "official" }, { "title": "Digital Decade 2026 country report, the Netherlands, SWD(2026) 155 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/128656", "date": "2026-06-17", "publisherClass": "intergov" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission, DG SANTE)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "commercial": { "score": 62, "summary": "Dutch law bars health insurers, company doctors and insurance doctors from the electronic exchange systems, and limits genetic questions in insurance medical checks. Certified patient apps are contractually barred from selling data, and the EHDS bans marketing use of research data from 2029.", "sources": [ { "title": "Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz), art. 15a-15f (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0023864/2025-07-05/0", "date": "2025-07-05", "publisherClass": "legal_text" }, { "title": "Wet op de medische keuringen, art. 5 (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0008819/2025-01-01/0", "date": "2025-01-01", "publisherClass": "legal_text" }, { "title": "Veelgestelde vragen van zorggebruikers (Stichting MedMij)", "url": "https://medmij.nl/zorggebruikers/vragen-van-zorggebruikers/", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission, DG SANTE)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 58, "summary": "A treating clinician can see GP and pharmacy data through the national switch point once the patient has consented, and pharmacists say most patients do. What is shared is limited by professional rules, such as six months of dispensed medication.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7, art. 7:454-7:458 (WGBO), geldende versie (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0005290/2026-01-01/0", "date": "2026-01-01", "publisherClass": "legal_text" }, { "title": "Vragen & antwoorden (Mitz, Stichting GVvZ / VZVZ)", "url": "https://www.mitz-toestemming.nl/kennis-en-ondersteuning/vragen-antwoorden", "date": "undated", "publisherClass": "official" }, { "title": "Landelijk Schakelpunt (LSP), dossier medicatieoverdracht (KNMP)", "url": "https://www.knmp.nl/dossiers/medicatieoverdracht/landelijk-schakelpunt-lsp", "date": "2026-07-31", "publisherClass": "official" }, { "title": "Mijlpaal: 1 miljoen bezoekers op MijnMitz.nl (VZVZ)", "url": "https://www.vzvz.nl/nieuws/mijlpaal-1-miljoen-bezoekers-op-mijnmitznl", "date": "2025-11-21", "publisherClass": "official" } ] }, "research": { "score": 57, "summary": "Records may go to health research without consent only when asking is not feasible or data are de-identified, and never if the patient has expressly objected. Objection is made at each provider, with no national register.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7, art. 7:454-7:458 (WGBO), geldende versie (wetten.overheid.nl)", "url": "https://wetten.overheid.nl/BWBR0005290/2026-01-01/0", "date": "2026-01-01", "publisherClass": "legal_text" }, { "title": "Privacybescherming Nivel Zorgregistraties Eerste Lijn (Nivel)", "url": "https://www.nivel.nl/nl/panels-en-registraties/nivel-zorgregistraties-eerste-lijn/deelnemen-en-deelnemers/privacybescherming", "date": "undated", "publisherClass": "academic" }, { "title": "Internetconsultatie Wet op het Gezondheidsinformatiestelsel gestart (Data voor gezondheid, ministerie van VWS)", "url": "https://www.datavoorgezondheid.nl/actueel/nieuws/2026/06/09/internetconsultatie-wet-op-het-gezondheidsinformatiestelsel-gestart", "date": "2026-06-09", "publisherClass": "official" }, { "title": "Kamerbrief over de implementatie van de EHDS, Kamerstuk 27 529 nr. 356 (Minister van VWS)", "url": "https://www.tweedekamer.nl/downloads/document?id=2026D02216", "date": "2026-01-20", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, whose duties for AI in medical devices now start 2 August 2028. Dutch national guidance on AI in care is voluntary, so no national credit is given.", "sources": [ { "title": "Leidraad kwaliteit AI in de zorg nader onderzocht (Data voor gezondheid, ministerie van VWS)", "url": "https://www.datavoorgezondheid.nl/actueel/nieuws/2025/09/08/leidraad-kwaliteit-ai-in-de-zorg-nader-onderzocht", "date": "2025-09-08", "publisherClass": "official" }, { "title": "Digital Omnibus on AI, Regulation (EU) 2026/1744, text and dates (AI Act Explorer, artificialintelligenceact.eu)", "url": "https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Digital Decade 2026 country report, the Netherlands, SWD(2026) 155 (European Commission)", "url": "https://ec.europa.eu/newsroom/dae/redirection/document/128656", "date": "2026-06-17", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Burgerlijk Wetboek Boek 7, afdeling 5 (WGBO)", "level": "National", "year": "1994", "what": "Right to access and copy the file, 20-year retention, secrecy, research without consent unless the patient objects.", "url": "https://wetten.overheid.nl/BWBR0005290/2026-01-01/0" }, { "name": "Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Wabvpz)", "level": "National", "year": "2008", "what": "Explicit consent for electronic exchange, free electronic copies, access log on request, insurers barred.", "url": "https://wetten.overheid.nl/BWBR0023864/2025-07-05/0" }, { "name": "Wet elektronische gegevensuitwisseling in de zorg (Wegiz)", "level": "National", "year": "2023", "what": "Framework law making named data flows electronic and standardised, with certified software.", "url": "https://www.datavoorgezondheid.nl/onderwerpen/w/wegiz/uitleg-over-de-wet" }, { "name": "Wet op de medische keuringen (Wmk)", "level": "National", "year": "1997", "what": "Bans genetic and hereditary disease questions in insurance medical checks below a set amount.", "url": "https://wetten.overheid.nl/BWBR0008819/2025-01-01/0" }, { "name": "Wet op het Gezondheidsinformatiestelsel (Wet GIS), bill", "level": "National", "year": "2026", "what": "First EHDS implementing law; creates the Health Data Authority. In consultation from 27 May 2026.", "url": "https://www.datavoorgezondheid.nl/actueel/nieuws/2026/06/09/internetconsultatie-wet-op-het-gezondheidsinformatiestelsel-gestart" }, { "name": "Regulation (EU) 2025/327, European Health Data Space", "level": "Supranational", "year": "2025", "what": "Access, restriction and secondary-use opt-out rights; key parts apply from March 2029 and 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation (EU) 2026/1744, Digital Omnibus on AI", "level": "Supranational", "year": "2026", "what": "Sets 2 August 2028 for AI Act duties on high-risk AI in products such as medical devices.", "url": "https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-04-14", "headline": "Nurse reprimanded for repeatedly opening patient files with no care reason", "paraphrase": "A hospital's log checks showed a nurse had opened the electronic files of several patients he was not treating, more than once and over a long period. He admitted it, citing curiosity and boredom. The tribunal reprimanded him.", "source": "Regionaal Tuchtcollege voor de Gezondheidszorg Amsterdam", "url": "https://tuchtrecht.overheid.nl/ECLI_NL_TGZRAMS_2026_80", "theme": "breach", "status": "finding" }, { "date": "2025-02-03", "headline": "Appeal tribunal upholds complaint that a surgeon refused to hand over a medical file", "paraphrase": "A patient complained that her surgeon refused to provide her medical file, among other complaints. On appeal, the national disciplinary tribunal found the complaint about the file partly justified, and the reprimand stayed in place.", "source": "Centraal Tuchtcollege voor de Gezondheidszorg", "url": "https://tuchtrecht.overheid.nl/zoeken/resultaat/uitspraak/2025/ECLI_NL_TGZCTG_2025_19", "theme": "access_refused", "status": "finding" }, { "date": "2024-11-13", "headline": "Doctor reprimanded for giving a patient's records to an outside expert without consent", "paraphrase": "During a civil case he brought against a patient, a doctor passed her medical data to an outside expert without asking her. The tribunal found confidentiality was breached and reprimanded him.", "source": "Regionaal Tuchtcollege voor de Gezondheidszorg 's-Hertogenbosch", "url": "https://tuchtrecht.overheid.nl/ECLI:NL:TGZRSHE:2024:125", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-08-11", "headline": "Hackers took screening results and addresses of 485,000 women from a lab", "paraphrase": "A lab running part of a national screening programme confirmed it was hacked. Test results, names, addresses, provider names and GP referrals of about 485,000 women, going back years, were stolen. The screening organisation said several years were involved.", "source": "NOS", "url": "https://nos.nl/artikel/2578296-gegevens-honderdduizenden-vrouwen-gehackt-bij-bevolkingsonderzoek-baarmoederhalskanker", "theme": "breach", "status": "admitted" }, { "date": "2025-09-11", "headline": "One in ten hospital patients hit a near miss because records were missing", "paraphrase": "A patient survey found more than one in ten people treated in hospital in 2024 experienced something going, or nearly going, wrong because a provider lacked their medical information. Reported harms included repeat scans and medication errors.", "source": "ICT&health", "url": "https://www.icthealth.nl/nieuws/patientenfederatie-nationale-aanpak-gebrekkige-gegevensuitwisseling", "theme": "lost_between_providers", "status": "self_reported" } ] }, { "iso3": "KOR", "name": "South Korea", "region": "Asia", "overall": 60, "rank": "23=", "likelyRank": "8 to 38", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Koreans can copy their whole record and see 10 years of claims online, and clinical records move only with opt-in consent.", "categories": { "access": { "score": 66, "summary": "The Medical Service Act lets patients view or copy their whole record, though copies carry a fee and we found no deadline. Since May 2026 NHIS lets every insured person view and download up to 10 years of claims-based treatment history online.", "sources": [ { "title": "Medical Service Act, current text (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%98%EB%A3%8C%EB%B2%95", "date": "2026-03-24", "publisherClass": "legal_text" }, { "title": "Standard on certificate fees of medical institutions (MOHW notice, hosted by HIRA)", "url": "https://www.hira.or.kr/cms/inform/01/__icsFiles/afieldfile/2017/09/19/1.pdf", "date": "2017-09-19", "publisherClass": "official" }, { "title": "All 47 tertiary hospitals now visible in My Health Record app (MOHW via korea.kr)", "url": "https://www.korea.kr/news/policyNewsView.do?newsId=148948286", "date": "2025-08-27", "publisherClass": "official" }, { "title": "NHIS starts mobile issuance of 10 years of treatment history (Edaily via Daum)", "url": "https://v.daum.net/v/20260511101017677", "date": "2026-05-11", "publisherClass": "news" } ] }, "control": { "score": 55, "summary": "Records move between hospitals, or to apps and firms, only with the patient's opt-in consent, chosen by institution, item and period and revocable. We found no way for patients to see who opened their chart, which holds control at the top of the 40 to 55 band.", "sources": [ { "title": "Medical Service Act, current text (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%98%EB%A3%8C%EB%B2%95", "date": "2026-03-24", "publisherClass": "legal_text" }, { "title": "What is the Health Information Highway service? (MOHW / KHIS portal)", "url": "https://www.myhealthway.go.kr/portal/index?page=Individual/Portal/MediMyData/MydataService", "date": "undated", "publisherClass": "official" }, { "title": "Health-sector data transmitters expanded to general hospitals (PIPC press release)", "url": "https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=11899", "date": "2026-03-18", "publisherClass": "official" }, { "title": "Even viewing an EMR will leave an access record from December (Korean Nurses Association news)", "url": "https://www.nursenews.co.kr/news/articleView.html?idxno=44048", "date": "2026-09-09", "publisherClass": "news" } ] }, "privacy": { "score": 65, "summary": "PIPA treats health data as sensitive, and the independent PIPC has sanctioned hospitals with administrative fines and improvement orders rather than revenue-based penalties. Since 11 September 2026 serious violations can cost up to 10% of revenue, and the EU confirmed Korea's GDPR adequacy in July 2026.", "sources": [ { "title": "PIPC sanctions 17 general hospitals over patient data leak (PIPC press release)", "url": "https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=9056", "date": "2023-07-27", "publisherClass": "official" }, { "title": "Personal Information Protection Act, current text in force 11 Sep 2026 (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EA%B0%9C%EC%9D%B8%EC%A0%95%EB%B3%B4_%EB%B3%B4%ED%98%B8%EB%B2%95", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "PIPC decides sanctions on Coupang and affiliates for leak and rights violations (PIPC press release)", "url": "https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12171", "date": "2026-06-11", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "2026-07-23", "publisherClass": "intergov" } ] }, "journey": { "score": 62, "summary": "Claims, medication and vaccination data are national, and the consent-based exchange links 10,332 facilities. Clinical records still sit in each provider's system, only about 600 facilities can share CT or MRI images, and a merged national platform is planned for 2029.", "sources": [ { "title": "All 47 tertiary hospitals now visible in My Health Record app (MOHW via korea.kr)", "url": "https://www.korea.kr/news/policyNewsView.do?newsId=148948286", "date": "2025-08-27", "publisherClass": "official" }, { "title": "Records follow you when you change hospitals: exchange passes 10,000 facilities (MOHW press release)", "url": "https://www.mohw.go.kr/board.es?mid=a10503010100&bid=0027&act=view&list_no=1489085&tag=&nPage=4", "date": "2026-02-12", "publisherClass": "official" }, { "title": "Is DUR really checked by 99% of providers? (Medigate News)", "url": "https://www.medigatenews.com/news/3461624456", "date": "2025-10-17", "publisherClass": "news" }, { "title": "Government to merge exchange and Health Information Highway by 2029 (Electronic Times)", "url": "https://www.etnews.com/20251020000130", "date": "2025-10-20", "publisherClass": "news" } ] }, "commercial": { "score": 55, "summary": "Providers who release records face criminal penalties, and health data needs separate consent. But PIPA lets companies use pseudonymised health data without consent for research that includes private investment research, and patients can send records to commercial apps.", "sources": [ { "title": "Medical Service Act, current text (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%98%EB%A3%8C%EB%B2%95", "date": "2026-03-24", "publisherClass": "legal_text" }, { "title": "Personal Information Protection Act, current text in force 11 Sep 2026 (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EA%B0%9C%EC%9D%B8%EC%A0%95%EB%B3%B4_%EB%B3%B4%ED%98%B8%EB%B2%95", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "PIPC sanctions 17 general hospitals over patient data leak (PIPC press release)", "url": "https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=9056", "date": "2023-07-27", "publisherClass": "official" }, { "title": "What is the Health Information Highway service? (MOHW / KHIS portal)", "url": "https://www.myhealthway.go.kr/portal/index?page=Individual/Portal/MediMyData/MydataService", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 58, "summary": "A doctor can pull records from another provider through the national exchange with the patient's consent, and without it for unconscious or emergency patients. Use is thin: about 1.81 million exchanges in 2025, and medication safety checks rarely change prescriptions.", "sources": [ { "title": "Medical Service Act, current text (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%98%EB%A3%8C%EB%B2%95", "date": "2026-03-24", "publisherClass": "legal_text" }, { "title": "Records follow you when you change hospitals: exchange passes 10,000 facilities (MOHW press release)", "url": "https://www.mohw.go.kr/board.es?mid=a10503010100&bid=0027&act=view&list_no=1489085&tag=&nPage=4", "date": "2026-02-12", "publisherClass": "official" }, { "title": "Is DUR really checked by 99% of providers? (Medigate News)", "url": "https://www.medigatenews.com/news/3461624456", "date": "2025-10-17", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Pseudonymised health data can be used for research without consent and with no general opt-out. Safeguards cap the cell at 50: data review boards, secure analysis centres, a 5-year prison penalty for re-identification, and a consent route for data donation.", "sources": [ { "title": "Personal Information Protection Act, current text in force 11 Sep 2026 (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EA%B0%9C%EC%9D%B8%EC%A0%95%EB%B3%B4_%EB%B3%B4%ED%98%B8%EB%B2%95", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "MOHW revises Health and Medical Data Utilisation Guideline (Korea Medical & Pharmaceutical News)", "url": "https://www.kmpnews.co.kr/news/articleView.html?idxno=68913", "date": "2026-01-01", "publisherClass": "news" }, { "title": "Safe Use Centres for health data (K-CURE, MOHW)", "url": "https://k-cure.mohw.go.kr/portal/pfm/kif/use/viewPfmKifUse.do", "date": "undated", "publisherClass": "official" }, { "title": "What is the Health Information Highway service? (MOHW / KHIS portal)", "url": "https://www.myhealthway.go.kr/portal/index?page=Individual/Portal/MediMyData/MydataService", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 66, "summary": "Korea's Digital Medical Products Act, in force since January 2025, requires change approval for significant software changes, and the AI Basic Act names healthcare AI high-impact and requires human oversight. MFDS issued generative AI device guidance and approved the first such device in April 2026.", "sources": [ { "title": "Digital Medical Products Act (CaseNote mirror of Korean statute)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EB%94%94%EC%A7%80%ED%84%B8%EC%9D%98%EB%A3%8C%EC%A0%9C%ED%92%88%EB%B2%95", "date": "2024-01-23", "publisherClass": "legal_text" }, { "title": "Framework Act on AI Development and Trust (AI Basic Act), current text (CaseNote mirror)", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5_%EB%B0%9C%EC%A0%84%EA%B3%BC_%EC%8B%A0%EB%A2%B0_%EA%B8%B0%EB%B0%98_%EC%A1%B0%EC%84%B1_%EB%93%B1%EC%97%90_%EA%B4%80%ED%95%9C_%EA%B8%B0%EB%B3%B8%EB%B2%95", "date": "2026-01-20", "publisherClass": "legal_text" }, { "title": "MFDS publishes world-first approval and review guideline for generative AI medical devices (MFDS press release)", "url": "https://www.mfds.go.kr/brd/m_99/view.do?seq=48833", "date": "2025-01-24", "publisherClass": "official" }, { "title": "MFDS approves Korea's first generative-AI digital medical device (MFDS press release)", "url": "https://www.mfds.go.kr/brd/m_99/view.do?seq=49815", "date": "2026-04-01", "publisherClass": "official" } ] } }, "laws": [ { "name": "Medical Service Act (2024 amendment; Articles 21, 21-2, 21-3, 88)", "level": "National", "year": "2024", "what": "Right to view and copy records, consent-based transfer between providers, criminal penalty for unlawful disclosure.", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%98%EB%A3%8C%EB%B2%95" }, { "name": "Personal Information Protection Act (2026 amendment)", "level": "National", "year": "2026", "what": "Separate consent for health data, consent-free pseudonymised research, data transfer right, fines up to 10% of revenue.", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EA%B0%9C%EC%9D%B8%EC%A0%95%EB%B3%B4_%EB%B3%B4%ED%98%B8%EB%B2%95" }, { "name": "Digital Medical Products Act", "level": "National", "year": "2024", "what": "Dedicated law for digital and AI medical devices with change approval, real-world evaluation and certification; in force 2025.", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EB%94%94%EC%A7%80%ED%84%B8%EC%9D%98%EB%A3%8C%EC%A0%9C%ED%92%88%EB%B2%95" }, { "name": "Framework Act on AI Development and Trust (AI Basic Act)", "level": "National", "year": "2025", "what": "Healthcare AI is high-impact; requires risk management, explanation and human oversight; in force 22 Jan 2026.", "url": "https://casenote.kr/%EB%B2%95%EB%A0%B9/%EC%9D%B8%EA%B3%B5%EC%A7%80%EB%8A%A5_%EB%B0%9C%EC%A0%84%EA%B3%BC_%EC%8B%A0%EB%A2%B0_%EA%B8%B0%EB%B0%98_%EC%A1%B0%EC%84%B1_%EB%93%B1%EC%97%90_%EA%B4%80%ED%95%9C_%EA%B8%B0%EB%B3%B8%EB%B2%95" }, { "name": "EU adequacy decision for the Republic of Korea", "level": "Supranational", "year": "2021", "what": "Lets personal data flow from the EU to Korea; confirmed after first review on 23 July 2026.", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-03-19", "headline": "Rights commission finds a hospital routinely wrote false entries in a patient's record", "paraphrase": "After a patient died in hospital, the commission found staff had, as a routine practice, recorded a doctor as giving orders that the doctor never gave. It referred hospital staff to prosecutors and recommended changes to the law.", "source": "National Human Rights Commission of Korea", "url": "https://www.humanrights.go.kr/base/board/read?boardManagementNo=24&boardNo=7611008&searchCategory=&page=4&searchType=&searchWord=&menuLevel=3&menuNo=91", "theme": "record_wrong", "status": "finding" }, { "date": "2026-09-14", "headline": "Doctor took thousands of patients' details; hospital fined for late notice, not the leak", "paraphrase": "A doctor deliberately took 3,976 patients' personal data while preparing to open a practice. The privacy regulator fined the hospital for late notification and weak supervision of staff, but found no breach of security duties.", "source": "Hankyung (Korea Economic Daily)", "url": "https://www.hankyung.com/article/202609143107H", "theme": "breach", "status": "finding" }, { "date": "2024-12-27", "headline": "Hospital doctors passed patients' prescription records to a drug company, court rules", "paraphrase": "Three senior doctors at a Seoul hospital gave drug company staff patients' prescription records, more than 17,000 entries, at the company's request. A court fined the doctors and the hospital's operator for failing to prevent it.", "source": "Pharmnews", "url": "https://www.pharmnews.com/news/articleView.html?idxno=256304", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-09-07", "headline": "Court fines dentist for writing false entries in a patient's record", "paraphrase": "A court fined a dentist one million won for writing a smaller medication amount in a patient's record than was actually given, and for recording health checks that were never carried out.", "source": "Law Issue (로이슈)", "url": "https://www.lawissue.co.kr/view.php?ud=2026090617253378379a8c8bf58f_12", "theme": "record_wrong", "status": "finding" }, { "date": "2026-09-14", "headline": "Staff at public health agencies looked up personal data for private reasons, files show", "paraphrase": "Disciplinary files that the public health insurer and claims review agency gave a lawmaker show staff viewing relatives' and an ex-partner's data, querying colleagues, and emailing sensitive screening files home. Penalties ranged from reprimand to dismissal.", "source": "Money Today (머니투데이)", "url": "https://www.mt.co.kr/thebio/2026/09/14/2026091409464048356", "theme": "breach", "status": "alleged" } ] }, { "iso3": "BGR", "name": "Bulgaria", "region": "Europe", "overall": 59, "rank": "27=", "likelyRank": "11 to 40", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Bulgaria's national health information system records every visit, prescription and hospital stay, with consent rules and an access history, but few patients use it.", "categories": { "access": { "score": 62, "summary": "The Health Act gives a right to copies, and the national record shows exams, referrals, lab results, vaccines, prescriptions and hospital stays. Use is low: about 500,000 records were reachable through the eZdrave app in February 2026, so the score sits low in its band.", "sources": [ { "title": "Закон за здравето (consolidated text, Health Act)", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf", "date": "2025-04-09", "publisherClass": "legal_text" }, { "title": "Наредба № Н-6 от 21 декември 2022 г. за функционирането на НЗИС (Държавен вестник)", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160", "date": "2022-12-24", "publisherClass": "legal_text" }, { "title": "Личните лекари вече имат достъп до електронните здравни досиета на пациентите си (МЗ)", "url": "https://www.mh.government.bg/bg/novini/aktualno/4340", "date": "2024-12-20", "publisherClass": "official" }, { "title": "Близо 500 000 граждани имат достъп до здравните си досиета чрез еЗдраве (БТА)", "url": "https://www.bta.bg/bg/news/bulgaria/1065556-blizo-500-000-grazhdani-imat-dostap-do-zdravnite-si-dosieta-chrez-mobilnoto-pril", "date": "2026-02-17", "publisherClass": "news" } ] }, "control": { "score": 62, "summary": "Access by providers, the health fund and insurers needs the patient's express written consent, which can be limited and withdrawn, and patients can check an access history in the app. The patient's own GP has standing access.", "sources": [ { "title": "Наредба № Н-6 от 21 декември 2022 г. за функционирането на НЗИС (Държавен вестник)", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160", "date": "2022-12-24", "publisherClass": "legal_text" }, { "title": "Здравните досиета на близо 15 000 пациенти са били прегледани от личните им лекари за месец (НЗИС)", "url": "https://his.bg/bg/news/89", "date": "2025-01-23", "publisherClass": "official" }, { "title": "Закон за здравето (consolidated text, Health Act)", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf", "date": "2025-04-09", "publisherClass": "legal_text" } ] }, "privacy": { "score": 55, "summary": "GDPR applies and the data protection commission (CPDP) watches the health sector, which drew 23 complaints in 2025. Fines are small: in 2025 they ranged from BGN 500 to BGN 100,000.", "sources": [ { "title": "Годишен отчет на КЗЛД за 2025 г.", "url": "https://cpdp.bg/wp-content/uploads/2026/04/corrected-Annual-report_2025_CPDP-12.03.2026-%D1%84%D0%B8%D0%BD%D0%B0%D0%BB.pdf", "date": "2026-03-12", "publisherClass": "official" }, { "title": "Хакерска атака спря работата на онкоболницата в Хасково (Утро Русе)", "url": "https://utroruse.com/article/987626/", "date": "2023-12-18", "publisherClass": "news" }, { "title": "Data protection in the EU (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 70, "summary": "Every provider, public or private, must send a signed electronic record of each activity to the national system. In January to July 2025 it logged nearly 29 million e-exams, and it links prescriptions, labs, hospitals and the health fund.", "sources": [ { "title": "Закон за здравето (consolidated text, Health Act)", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf", "date": "2025-04-09", "publisherClass": "legal_text" }, { "title": "Близо 29 млн. е-прегледа регистрирани в НЗИС от началото на 2025 г. (zdrave.net)", "url": "https://www.zdrave.net/%D0%9D%D0%BE%D0%B2%D0%B8%D0%BD%D0%B8/%D0%91%D0%BB%D0%B8%D0%B7%D0%BE-29-%D0%BC%D0%BB%D0%BD.-%D0%B5-%D0%BF%D1%80%D0%B5%D0%B3%D0%BB%D0%B5%D0%B4%D0%B0-%D1%80%D0%B5%D0%B3%D0%B8%D1%81%D1%82%D1%80%D0%B8%D1%80%D0%B0%D0%BD%D0%B8-%D0%B2-%D0%9D%D0%97%D0%98%D0%A1-%D0%BE%D1%82-%D0%BD%D0%B0%D1%87%D0%B0%D0%BB%D0%BE%D1%82%D0%BE-%D0%BD%D0%B0-2025-%D0%B3.,-%D0%BD%D0%B0%D0%B4-%D0%BF%D0%BE%D0%BB%D0%BE%D0%B2%D0%B8%D0%BD%D0%B0%D1%82%D0%B0-%D1%81%D0%B0-%D0%BF%D1%80%D0%B8-%D0%B4%D0%B6%D0%B8%D0%BF%D0%B8%D1%82%D0%B0/n34757", "date": "2025-07-25", "publisherClass": "news" }, { "title": "План за развитие (НЗИС)", "url": "https://his.bg/bg/info/roadmap", "date": "undated", "publisherClass": "official" }, { "title": "Спешното пациентско досие влиза в Е-здраве (zdrave.to)", "url": "https://zdrave.to/saveti-ot-spetsialisti/speshnoto-pacientsko-dosie-vliza-v-e-zdrave", "date": "2026-08-04", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "GDPR limits commercial use of health data, but the Health Act names licensed health insurers among those who may access the national record, with the patient's written consent. No Bulgaria-specific ban on selling health data was verified.", "sources": [ { "title": "Закон за здравето (consolidated text, Health Act)", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf", "date": "2025-04-09", "publisherClass": "legal_text" }, { "title": "Наредба № Н-6 от 21 декември 2022 г. за функционирането на НЗИС (Държавен вестник)", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160", "date": "2022-12-24", "publisherClass": "legal_text" } ] }, "clinical": { "score": 62, "summary": "Since December 2024 about 4,000 GPs can see their patients' full national record, specialists get 30 days after an exam, and emergency staff can see key data without consent. Ordinance N-6 ties routine access to the patient's consent rules.", "sources": [ { "title": "Личните лекари вече имат достъп до електронните здравни досиета на пациентите си (МЗ)", "url": "https://www.mh.government.bg/bg/novini/aktualno/4340", "date": "2024-12-20", "publisherClass": "official" }, { "title": "Наредба № Н-6 от 21 декември 2022 г. за функционирането на НЗИС (Държавен вестник)", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160", "date": "2022-12-24", "publisherClass": "legal_text" }, { "title": "Спешното пациентско досие влиза в Е-здраве (zdrave.to)", "url": "https://zdrave.to/saveti-ot-spetsialisti/speshnoto-pacientsko-dosie-vliza-v-e-zdrave", "date": "2026-08-04", "publisherClass": "news" } ] }, "research": { "score": 44, "summary": "The Health Act allows health data to be used for statistics and research once identifying data are removed, with no individual consent or opt-out. A public transparency register was not verified; the EU EHDS adds an opt-out from 2029.", "sources": [ { "title": "Закон за здравето (consolidated text, Health Act)", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf", "date": "2025-04-09", "publisherClass": "legal_text" }, { "title": "Наредба № Н-6 от 21 декември 2022 г. за функционирането на НЗИС (Държавен вестник)", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160", "date": "2022-12-24", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the AI Act, whose duties for AI in medical devices apply from 2 August 2028. Bulgaria has no national AI law in force; a draft bill reached parliament in September 2026.", "sources": [ { "title": "AI Act: regulatory framework for AI (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "date": "undated", "publisherClass": "official" }, { "title": "България все още няма надзор над високорисковите системи с изкуствен интелект (Дебати)", "url": "https://debati.bg/zakonodatelen-akt-za-izkustveniya-intelekt-balgariya-vse-osthe-nyama-nadzor-nad-visokoriskovite-sistemi/", "date": "2026-01-09", "publisherClass": "news" }, { "title": "Нов Закон за използването и развитието на изкуствения интелект (novini247)", "url": "https://novini247.com/novini/nov-zakon-za-izpolzvaneto-i-razvitieto-na-izkustveniya-intelekt-e_11238882.html", "date": "2026-09-26", "publisherClass": "news" } ] } }, "laws": [ { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "EU-wide data protection law, in force since 24 May 2016 and applying since 25 May 2018.", "url": "https://commission.europa.eu/law/law-topic/data-protection/data-protection-eu_en" }, { "name": "Health Act (Закон за здравето)", "level": "National", "year": "2004", "what": "Right to copies; creates the national health information system; consent needed for third-party access since 2024.", "url": "https://asp.government.bg/uploaded/files/7032-zakon-za-zdraveto-28032025.pdf" }, { "name": "Ordinance N-6 of 21 December 2022 on the National Health Information System", "level": "National", "year": "2022", "what": "Sets patient access, consent and withdrawal, access logging, emergency access and anonymised reuse.", "url": "https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=182160" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access and restriction rights, opt-out from secondary use; main rules apply from March 2029.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "AI Act (EU) 2024/1689", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; duties for AI in medical devices apply from 2 August 2028.", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2024-10-23", "headline": "Health fund sanctions providers after patients spot unperformed care in their records", "paraphrase": "Insured people using the eZdrave app found medical activities in their electronic records that had never been carried out. After checks, the national health fund imposed fines, partly ended contracts and recovered money paid.", "source": "zdrave.net", "url": "https://www.zdrave.net/%D0%9D%D0%BE%D0%B2%D0%B8%D0%BD%D0%B8/%D0%A1%D0%B0%D0%BD%D0%BA%D1%86%D0%B8%D0%B8-%D0%B7%D0%B0-%D0%BE%D1%82%D1%87%D0%B5%D1%82%D0%B5%D0%BD%D0%B8-%D0%BD%D0%B5%D0%B8%D0%B7%D0%B2%D1%8A%D1%80%D1%88%D0%B5%D0%BD%D0%B8-%D0%B4%D0%B5%D0%B9%D0%BD%D0%BE%D1%81%D1%82%D0%B8-%D0%BD%D0%B0%D0%BB%D0%BE%D0%B6%D0%B8-%D0%9D%D0%97%D0%9E%D0%9A-%D0%BF%D0%BE-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%BD%D0%B0-%D0%BF%D0%BE%D1%82%D1%80%D0%B5%D0%B1%D0%B8%D1%82%D0%B5%D0%BB%D0%B8-%D0%BD%D0%B0-%D0%B5%D0%97%D0%B4%D1%80%D0%B0%D0%B2%D0%B5-(%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%B5%D0%BD%D0%B0)/n31819", "theme": "record_wrong", "status": "finding" }, { "date": "2026-09-03", "headline": "Patients flag 1,760 record entries they say never happened", "paraphrase": "A new eZdrave feature asks patients whether they attended each recorded visit. Within weeks they had sent 1,760 reports of exams, test results and hospital stays they did not recognise, and 560 checks had begun.", "source": "Gospodari.com", "url": "https://gospodari.com/novini/nov-modul-v-ezdrave-pokazva-dali-na-vashe-ime-sa-otcheteni-fiktivni-medicinski-deynosti", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-09-25", "headline": "Complaints about wrong entries in electronic health records rise by two thirds", "paraphrase": "Complaints that electronic records list care patients never received rose 68.75 percent in July and August 2026 over a year earlier. The health fund links the rise to wider use of the eZdrave app.", "source": "Paragraf.bg", "url": "https://paragraf.bg/za-1-g-zhalbite-za-nesaotvetstviya-mezhdu-otrazeni-v-dosieto-i-polzvanite-meditsinski-uslugi-sa-68-75-poveche", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-01-25", "headline": "Regulator fined a hospital for revealing a patient's health details on television", "paraphrase": "A patient went on television saying her discharge record listed a procedure she never had. A hospital director responded on air with her health details. The data protection commission fined the hospital 10,000 leva, rejecting its consent argument.", "source": "Dnes Bulgaria", "url": "https://dnesbulgaria.com/%D0%BA%D0%B7%D0%BB%D0%B4-%D0%B3%D0%BB%D0%BE%D0%B1%D0%B8-%D0%B1%D0%BE%D0%BB%D0%BD%D0%B8%D1%86%D0%B0-%D1%81%D1%8A%D1%80%D1%86%D0%B5-%D0%B8-%D0%BC%D0%BE%D0%B7%D1%8A%D0%BA-%D0%B2-%D0%B1%D1%83%D1%80/", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "LUX", "name": "Luxembourg", "region": "Europe", "overall": 59, "rank": "27=", "likelyRank": "12 to 42", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Every insured person gets a shared record with an access log and blocking tools, but few patients activate it and the EU says access lags.", "categories": { "access": { "score": 64, "summary": "The 2014 patient rights law gives a right to a full copy within 15 working days, and a national shared record holds lab, imaging and discharge reports. Patients activate only about 3,257 accounts a month, and the EU rates record access as lagging.", "sources": [ { "title": "Loi du 24 juillet 2014 relative aux droits et obligations du patient (Journal officiel)", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2014-07-24-n2-jo-fr-html.html", "date": "2014-07-24", "publisherClass": "legal_text" }, { "title": "Activation du compte eSanté pour accéder au Dossier de Soins Partagé (Guichet.lu)", "url": "https://guichet.public.lu/fr/citoyens/sante/droits-devoirs-patient/droits-devoirs-patient/dsp.html", "date": "2026-05-26", "publisherClass": "official" }, { "title": "Luxembourg's 2026 Digital Decade Country Report (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/factpages/luxembourgs-2026-digital-decade-country-report", "date": "2026-08-28", "publisherClass": "intergov" }, { "title": "Santé numérique : l'année de l'accélération pour l'Agence eSanté (Le Quotidien)", "url": "https://lequotidien.lu/politique-societe/sante-numerique-lannee-de-lacceleration-pour-lagence-esante/", "date": "2026-07-07", "publisherClass": "news" } ] }, "control": { "score": 70, "summary": "The patient can oppose sharing at any time, close the record, block named professionals or mask data, and see a log of every access. The record is created by default, and the referring doctor cannot be blocked.", "sources": [ { "title": "Règlement grand-ducal du 6 décembre 2019, dossier de soins partagé (Journal officiel)", "url": "https://data.legilux.public.lu/filestore/eli/etat/leg/rgd/2019/12/06/a909/jo/fr/html/eli-etat-leg-rgd-2019-12-06-a909-jo-fr-html.html", "date": "2019-12-06", "publisherClass": "legal_text" }, { "title": "Code de la sécurité sociale, Art. 60quater (SECU)", "url": "https://www.secu.lu/assurance-maladie/livre-i/chapitre-v-relations-avec-les-prestataires-de-soins/art-60quater/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Activation du compte eSanté pour accéder au Dossier de Soins Partagé (Guichet.lu)", "url": "https://guichet.public.lu/fr/citoyens/sante/droits-devoirs-patient/droits-devoirs-patient/dsp.html", "date": "2026-05-26", "publisherClass": "official" }, { "title": "Accès facile au Dossier de soins partagé via MyGuichet.lu (Ministère de la Santé et de la Sécurité sociale)", "url": "https://m3s.gouvernement.lu/fr/actualites.gouvernement2024%2Bfr%2Bactualites%2Btoutes_actualites%2Bcommuniques%2B2025%2B12-decembre%2B01-dsp-myguichet.html", "date": "2025-12-01", "publisherClass": "official" } ] }, "privacy": { "score": 54, "summary": "Luxembourg applies the GDPR through its law of 1 August 2018, but the regulator's published decisions we reviewed show no health-sector case. An August 2026 attack on an IT provider cut at least 80 medical practices off from patient files.", "sources": [ { "title": "Loi du 1er août 2018 portant organisation de la CNPD (Journal officiel)", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2018-08-01-a686-jo-fr-html.html", "date": "2018-08-01", "publisherClass": "legal_text" }, { "title": "Décisions (CNPD)", "url": "https://cnpd.public.lu/fr/decisions-sanctions.html", "date": "undated", "publisherClass": "official" }, { "title": "Au Luxembourg: 80 cabinets médicaux auraient été touchés par une cyberattaque (L'essentiel)", "url": "https://www.lessentiel.lu/fr/story/au-luxembourg-80-cabinets-medicaux-auraient-ete-touches-par-une-cyberattaque-103629329", "date": "2026-09-07", "publisherClass": "news" }, { "title": "Exclusif: Une cyberattaque qui fait paniquer les médecins (Reporter.lu)", "url": "https://www.reporter.lu/fr/exclusif-sante-digitale-une-cyberattaque-qui-fait-paniquer-les-medecins/", "date": "2026-09-07", "publisherClass": "news" } ] }, "journey": { "score": 54, "summary": "One national record collects hospital, lab and imaging documents, and professionals must upload useful data. National e-prescription use was not verified, and the EU tells Luxembourg to speed up its record rollout.", "sources": [ { "title": "Règlement grand-ducal du 6 décembre 2019, dossier de soins partagé (Journal officiel)", "url": "https://data.legilux.public.lu/filestore/eli/etat/leg/rgd/2019/12/06/a909/jo/fr/html/eli-etat-leg-rgd-2019-12-06-a909-jo-fr-html.html", "date": "2019-12-06", "publisherClass": "legal_text" }, { "title": "Patient Information Notices: Luxembourg (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/digital-health-and-care/electronic-cross-border-health-services/patient-information-notices-luxembourg_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Luxembourg's 2026 Digital Decade Country Report (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/factpages/luxembourgs-2026-digital-decade-country-report", "date": "2026-08-28", "publisherClass": "intergov" }, { "title": "Santé numérique : l'année de l'accélération pour l'Agence eSanté (Le Quotidien)", "url": "https://lequotidien.lu/politique-societe/sante-numerique-lannee-de-lacceleration-pour-lagence-esante/", "date": "2026-07-07", "publisherClass": "news" } ] }, "commercial": { "score": 54, "summary": "National law bans processing genetic data for employment and insurance purposes, and only anonymised shared-record data may leave care for statistics. No Luxembourg ban on selling health data or on health advertising was verified, so the score stays low in its band.", "sources": [ { "title": "Loi du 1er août 2018 portant organisation de la CNPD (Journal officiel)", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2018-08-01-a686-jo-fr-html.html", "date": "2018-08-01", "publisherClass": "legal_text" }, { "title": "Code de la sécurité sociale, Art. 60quater (SECU)", "url": "https://www.secu.lu/assurance-maladie/livre-i/chapitre-v-relations-avec-les-prestataires-de-soins/art-60quater/", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 56, "summary": "Treating professionals can open the shared record within a profession-based access matrix, unless the patient blocks them. Professionals opened only 34,129 documents a month in 2025, so clinical use is still small.", "sources": [ { "title": "Code de la sécurité sociale, Art. 60quater (SECU)", "url": "https://www.secu.lu/assurance-maladie/livre-i/chapitre-v-relations-avec-les-prestataires-de-soins/art-60quater/", "date": "undated", "publisherClass": "legal_text" }, { "title": "DSP (Dossier de Soins Partagé) (Agence eSanté)", "url": "https://www.esante.lu/portal/en/e-sant-information/services-esante-pour-les-patients-406-574.html", "date": "undated", "publisherClass": "official" }, { "title": "Santé numérique : l'année de l'accélération pour l'Agence eSanté (Le Quotidien)", "url": "https://lequotidien.lu/politique-societe/sante-numerique-lannee-de-lacceleration-pour-lagence-esante/", "date": "2026-07-07", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Trials need ministry approval after ethics committee review, and the data law requires pseudonymisation or similar safeguards for research. No general opt-out from secondary use exists yet, and the EHDS access body is still being prepared.", "sources": [ { "title": "Statuts / Législation (Comité National d'Ethique de Recherche)", "url": "https://cner.gouvernement.lu/fr/statuts-legislation.html", "date": "2025-11-05", "publisherClass": "official" }, { "title": "Project HDAB-LU (LNDS)", "url": "https://www.lnds.lu/hdab-lu/", "date": "undated", "publisherClass": "official" }, { "title": "Loi du 1er août 2018 portant organisation de la CNPD (Journal officiel)", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2018-08-01-a686-jo-fr-html.html", "date": "2018-08-01", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the EU AI Act only. Bill 8476, which would name national AI Act authorities, was still in committee after a State Council opinion of 10 July 2026.", "sources": [ { "title": "Dossier parlementaire 8476 (Chambre des Députés)", "url": "https://www.chd.lu/fr/dossier/8476", "date": "2026-07-10", "publisherClass": "official" }, { "title": "L'AI Act en action (CNPD)", "url": "https://cnpd.public.lu/fr/actualites/national/2026/01/ai-act-in-action-cp-jan2026.html", "date": "2026-01-20", "publisherClass": "official" } ] } }, "laws": [ { "name": "Loi du 24 juillet 2014 relative aux droits et obligations du patient", "level": "National", "year": "2014", "what": "Right to a patient file and a copy within 15 working days, at copying cost; ten-year retention.", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2014-07-24-n2-jo-fr-html.html" }, { "name": "Code de la sécurité sociale, Article 60quater (dossier de soins partagé)", "level": "National", "year": "2010", "what": "Creates the shared record; rights to access, see who accessed, and oppose sharing at any time.", "url": "https://www.secu.lu/assurance-maladie/livre-i/chapitre-v-relations-avec-les-prestataires-de-soins/art-60quater/" }, { "name": "Règlement grand-ducal du 6 décembre 2019 (dossier de soins partagé)", "level": "National", "year": "2019", "what": "Access matrix, patient blocking and masking levels, full access logs, ten-year retention.", "url": "https://data.legilux.public.lu/filestore/eli/etat/leg/rgd/2019/12/06/a909/jo/fr/html/eli-etat-leg-rgd-2019-12-06-a909-jo-fr-html.html" }, { "name": "Loi du 1er août 2018 portant organisation de la CNPD", "level": "National", "year": "2018", "what": "Implements the GDPR, sets up the CNPD, research safeguards, bans genetic data use in employment and insurance.", "url": "https://data.legilux.public.lu/file/eli-etat-leg-loi-2018-08-01-a686-jo-fr-html.html" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health data is a special category; access right, breach notification, fines up to 4% of turnover.", "url": "https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient summaries and e-prescriptions exchanged from March 2029, images, labs, discharge reports from 2031; secondary use rules.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "EU AI Act (EU) 2024/1689, amended by the 2026 AI Omnibus", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; high-risk duties for AI in medical devices apply from 2 August 2028.", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-09", "headline": "Cyberattack on an IT firm serving doctors hit 40 medical practices", "paraphrase": "An IT company serving medical practices said a cyberattack affected 40 practices. It filed a police complaint, notified the data protection authority and said experts found no data leak. Services were later restored.", "source": "Le Quotidien", "url": "https://lequotidien.lu/a-la-une/cyberattaque-dans-des-cabinets-medicaux-40-etablissements-en-ont-ete-victimes/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "MLT", "name": "Malta", "region": "Europe", "overall": 59, "rank": "27=", "likelyRank": "11 to 42", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Malta's myHealth portal shows most public-sector records online, but private clinics, hospitals and prescribers are still largely outside the national record.", "categories": { "access": { "score": 72, "summary": "Malta scored 93.71 on the EU's 2024 record-access indicator against an EU average of 82.7. myHealth shows public hospital summaries, labs, imaging reports, prescriptions and vaccines, but the Commission found no private-sector data and no mobile app.", "sources": [ { "title": "Digital Decade 2025 country report, Malta (European Commission, Council doc 10407/25 ADD 51)", "url": "https://data.consilium.europa.eu/doc/document/ST-10407-2025-ADD-51/en/pdf", "date": "2025-06-16", "publisherClass": "intergov" }, { "title": "myHealth (Ministry for Health, archived 1 Aug 2026)", "url": "https://web.archive.org/web/20260801073650/https://health.gov.mt/public-facing-services/myhealth/", "date": "undated", "publisherClass": "official" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" } ] }, "control": { "score": 50, "summary": "Patients choose which doctors can see their myHealth data and can remove a link at any time, and they set cross-border consent country by country. No patient-visible access log was found; the 2030 strategy only promises a way to see who contributes to records.", "sources": [ { "title": "myHealth User Guide for Patients v2.2 (Information Management Unit)", "url": "https://web.archive.org/web/20250712071632/https://health.gov.mt/wp-content/uploads/2024/10/myHealth-User-Guide-for-Patients-v.2.2-19Aug19.pdf", "date": "2019-08-19", "publisherClass": "official" }, { "title": "myHealth: About, disclaimer and privacy policy (archived 1 Aug 2026)", "url": "https://web.archive.org/web/20260801073639/https://myhealth.gov.mt/home/about", "date": "undated", "publisherClass": "official" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" } ] }, "privacy": { "score": 62, "summary": "GDPR and the Data Protection Act (Cap. 586) apply, and the IDPC has acted on health cases, including a EUR 20,000 fine on a private clinic in April 2025. No major Maltese health-system breach was found for 2025 to 2026.", "sources": [ { "title": "The Commissioner imposed an administrative fine of EUR 20,000 on a private clinic (IDPC)", "url": "https://idpc.org.mt/news-latest/the-commissioner-imposed-an-administrative-fine-of-e20000-on-a-private-clinic/", "date": "2025-04-07", "publisherClass": "official" }, { "title": "Decisions (Information and Data Protection Commissioner)", "url": "https://idpc.org.mt/decisions/", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Act, Cap. 586 (Legislation Malta)", "url": "https://legislation.mt/eli/cap/586/eng", "date": "2023-09-19", "publisherClass": "legal_text" } ] }, "journey": { "score": 60, "summary": "Public hospitals, health centres, public nursing homes and POYC pharmacy data flow to one portal. Private hospitals and private GPs are not connected, and most private-sector prescribing is still on paper.", "sources": [ { "title": "Digital Decade 2025 country report, Malta (European Commission, Council doc 10407/25 ADD 51)", "url": "https://data.consilium.europa.eu/doc/document/ST-10407-2025-ADD-51/en/pdf", "date": "2025-06-16", "publisherClass": "intergov" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "Malta's health secondary-use regulations list permitted purposes and require GDPR consent for anything else, which limits resale. There is no specific ban on selling health data or on health-based advertising.", "sources": [ { "title": "S.L. 528.10 Processing of Personal Data (Secondary Processing) (Health Sector) Regulations", "url": "https://legislation.mt/eli/sl/528.10/eng", "date": "2019-10-08", "publisherClass": "legal_text" }, { "title": "myHealth: About, disclaimer and privacy policy (archived 1 Aug 2026)", "url": "https://web.archive.org/web/20260801073639/https://myhealth.gov.mt/home/about", "date": "undated", "publisherClass": "official" }, { "title": "Decisions (Information and Data Protection Commissioner)", "url": "https://idpc.org.mt/decisions/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 56, "summary": "A family doctor the patient has linked in myHealth can see Government hospital summaries, labs, imaging and prescriptions. Records held by private hospitals and clinics are not shared, so the view is public-sector only.", "sources": [ { "title": "myHealth (Ministry for Health, archived 1 Aug 2026)", "url": "https://web.archive.org/web/20260801073650/https://health.gov.mt/public-facing-services/myhealth/", "date": "undated", "publisherClass": "official" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" }, { "title": "myHealth User Guide for Patients v2.2 (Information Management Unit)", "url": "https://web.archive.org/web/20250712071632/https://health.gov.mt/wp-content/uploads/2024/10/myHealth-User-Guide-for-Patients-v.2.2-19Aug19.pdf", "date": "2019-08-19", "publisherClass": "official" } ] }, "research": { "score": 48, "summary": "Research use of health records needs public interest, ethics approval and prior IDPC authorisation, with pseudonymised data where possible. There is no individual consent or general opt-out.", "sources": [ { "title": "S.L. 528.10 Processing of Personal Data (Secondary Processing) (Health Sector) Regulations", "url": "https://legislation.mt/eli/sl/528.10/eng", "date": "2019-10-08", "publisherClass": "legal_text" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 50, "summary": "Clinical AI is governed by EU device law and the AI Act. Malta added L.N. 226 of 2025, naming the MDIA as lead AI market surveillance authority with fines up to EUR 350,000 or 1% of turnover.", "sources": [ { "title": "L.N. 226 of 2025, Artificial Intelligence Regulations, 2025 (Legislation Malta)", "url": "https://legislation.mt/eli/ln/2025/226/eng", "date": "2025-10-10", "publisherClass": "legal_text" }, { "title": "Digital Health and Health Data Strategy 2030 (Ministry for Health and Active Ageing)", "url": "https://web.archive.org/web/20260727061320/https://health.gov.mt/wp-content/uploads/2025/11/Digital-Health-Health-Data-Strategy-Document.pdf", "date": "2025-11", "publisherClass": "official" }, { "title": "Digital Omnibus on AI has been published (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Data Protection Act (Cap. 586)", "level": "National", "year": "2018", "what": "Malta's GDPR implementing law; the IDPC supervises and decides complaints.", "url": "https://legislation.mt/eli/cap/586/eng" }, { "name": "Processing of Personal Data (Secondary Processing) (Health Sector) Regulations (S.L. 528.10)", "level": "National", "year": "2019", "what": "Lists permitted secondary uses; research needs ethics approval and IDPC authorisation; other uses need consent.", "url": "https://legislation.mt/eli/sl/528.10/eng" }, { "name": "Artificial Intelligence Regulations, 2025 (L.N. 226 of 2025)", "level": "National", "year": "2025", "what": "Names MDIA as AI Act market surveillance authority; fines up to EUR 350,000 or 1% of turnover.", "url": "https://legislation.mt/eli/ln/2025/226/eng" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient access, access logs, restriction rights and secondary-use opt-out, applying mainly from March 2029 and 2031.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health data is a special category; right of access, breach notification, fines up to 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "EU AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk rules for AI; obligations for AI in medical devices now apply from 2 August 2028.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-30", "headline": "Health provider employee opened a patient's record for personal reasons, regulator finds", "paraphrase": "A staff member with no role in the patient's care opened their record for personal reasons. The regulator found the access unauthorised. The provider had dismissed the employee and told the patient, so no further action followed.", "source": "Information and Data Protection Commissioner (Malta)", "url": "https://idpc.org.mt/wp-content/uploads/2025/05/0547_001.pdf", "theme": "breach", "status": "finding" }, { "date": "2025-04-02", "headline": "Clinic kept a wrong address after repeated requests and posted health reports there", "paraphrase": "A private provider filled in a patient's file with an address taken from the electoral register, years out of date. Despite repeated requests it did not correct it, and medical reports reached the current occupants. Fines totalled €20,000.", "source": "Information and Data Protection Commissioner (Malta)", "url": "https://idpc.org.mt/wp-content/uploads/2025/04/0476_001.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2025-03-14", "headline": "Court protects patient's complaint that a former doctor kept reading her records", "paraphrase": "A patient complained to the data protection regulator that a doctor kept accessing her medical records after she left his care. He sued her for libel. A court dismissed the suit, ruling her complaints were privileged.", "source": "Newsbook", "url": "https://newsbook.com.mt/ginekologu-jitlef-libell-fuq-talbiet-ta-access-ghall-informazzjoni-minn-eks-pazjenta/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "POL", "name": "Poland", "region": "Europe", "overall": 59, "rank": "27=", "likelyRank": "12 to 42", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Over 20 million Poles can see prescriptions, visits and documents in a national patient account and control specialist access, but 2026 vendor leaks hit millions.", "categories": { "access": { "score": 70, "summary": "The law gives a right to records and a free first copy, and the national patient account (IKP) shows prescriptions, referrals, visit history, NFZ payments and uploaded documents to 53% of citizens. An EC study finds lab results, discharge reports and images only partly available.", "sources": [ { "title": "Ustawa o prawach pacjenta i Rzeczniku Praw Pacjenta, tekst jednolity Dz.U. 2024 poz. 581 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2024/581/text.pdf", "date": "2024-04-02", "publisherClass": "legal_text" }, { "title": "O IKP (pacjent.gov.pl, Ministerstwo Zdrowia i NFZ)", "url": "https://pacjent.gov.pl/internetowe-konto-pacjenta", "date": "2019-09-06", "publisherClass": "official" }, { "title": "Czy Twoi pacjenci korzystaja z IKP? (ezdrowie.gov.pl, Centrum e-Zdrowia)", "url": "https://www.ezdrowie.gov.pl/portal/artykul/czy-twoi-pacjenci-korzystaja-z-ikp-ulatwia-to-prace-lekarzom", "date": "undated", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, final report (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/7de84d62-66d1-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-15", "publisherClass": "intergov" } ] }, "control": { "score": 55, "summary": "Outside a few groups named in law, a clinician can see a patient's records only with consent given in the IKP or mojeIKP, limited in scope and time and revocable. Patients cannot block their family doctor, the record's author or emergency staff.", "sources": [ { "title": "Ustawa o systemie informacji w ochronie zdrowia, tekst jednolity Dz.U. 2026 poz. 208 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/208/text.pdf", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Twoje dane medyczne to Twoja wlasnosc (pacjent.gov.pl)", "url": "https://pacjent.gov.pl/aktualnosc/twoje-dane-medyczne-twoja-wlasnosc", "date": "2025-03-10", "publisherClass": "official" }, { "title": "O IKP (pacjent.gov.pl, Ministerstwo Zdrowia i NFZ)", "url": "https://pacjent.gov.pl/internetowe-konto-pacjenta", "date": "2019-09-06", "publisherClass": "official" }, { "title": "Kto ogladal nasze dane medyczne? Nocne wizyty na koncie pacjenta (Gazeta Prawna)", "url": "https://www.gazetaprawna.pl/biznes/zdrowie/artykuly/11153064,kto-ogladal-nasze-dane-medyczne-nocne-wizyty-na-koncie-pacjenta.html", "date": "2023-09-21", "publisherClass": "news" } ] }, "privacy": { "score": 46, "summary": "Health data has special GDPR protection and the regulator is active, but UODO says the 2026 leak at software firm MyDr affects 19 million people, and a second attack on Medyc software may reach 5 million. Fines on public bodies are capped at 100,000 zloty.", "sources": [ { "title": "Po nowym wycieku danych medycznych PUODO zapowiada kontrole (UODO)", "url": "https://uodo.gov.pl/pl/138/4585", "date": "2026-09-25", "publisherClass": "official" }, { "title": "Dodatkowe kontrole UODO w podmiotach sektora ochrony zdrowia (UODO)", "url": "https://uodo.gov.pl/pl/138/4570", "date": "2026-09-16", "publisherClass": "official" }, { "title": "Niepowiadomienie o blednym wyslaniu dokumentu: kara 40 tys. zl dla Gyncentrum (UODO)", "url": "https://uodo.gov.pl/pl/138/3933", "date": "2025-10-27", "publisherClass": "official" }, { "title": "Ustawa o ochronie danych osobowych, tekst jednolity Dz.U. 2019 poz. 1781 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2019/1781/text.pdf", "date": "2019-08-30", "publisherClass": "legal_text" } ] }, "journey": { "score": 70, "summary": "One national platform, P1, links e-prescriptions, e-referrals, medical events and NFZ claims, and the EC counts nearly all provider types as connected. Some document types still arrive late or not at all, and central booking is being made compulsory specialty by specialty.", "sources": [ { "title": "Ustawa o systemie informacji w ochronie zdrowia, tekst jednolity Dz.U. 2026 poz. 208 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/208/text.pdf", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Czy Twoi pacjenci korzystaja z IKP? (ezdrowie.gov.pl, Centrum e-Zdrowia)", "url": "https://www.ezdrowie.gov.pl/portal/artykul/czy-twoi-pacjenci-korzystaja-z-ikp-ulatwia-to-prace-lekarzom", "date": "undated", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, final report (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/7de84d62-66d1-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-15", "publisherClass": "intergov" }, { "title": "Od 1 sierpnia centralna e-rejestracja rozszerza sie o kolejne swiadczenia (ezdrowie.gov.pl)", "url": "https://www.ezdrowie.gov.pl/portal/artykul/od-1-sierpnia-centralna-e-rejestracja-rozszerza-sie-o-kolejne-swiadczenia", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 54, "summary": "Only the GDPR's general rules limit commercial use of health data, and no Polish ban on selling or advertising with it was found. In September 2026 UODO asked the pharmacy inspector whether data-sharing modules in over 4,000 pharmacies sent patient data to drug wholesalers.", "sources": [ { "title": "Pismo Prezesa UODO do Glownego Inspektora Farmaceutycznego, DKN.5101.480.2026 (UODO)", "url": "https://uodo.gov.pl/pl/file/8051", "date": "undated", "publisherClass": "official" }, { "title": "Ponad 900 milionow zlotych kar dla hurtowni farmaceutycznych (UOKiK)", "url": "https://uokik.gov.pl/mniej-konkurencji-za-to-wiecej-do-zaplaty-za-leki-w-aptece-ponad-900-milionow-zlotych-kar-dla-hurtowni-farmaceutycznych", "date": "2026-09-21", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 60, "summary": "Family doctors, the record's author, the same facility, cancer and cardiac network teams and emergency staff can see the shared record without asking. Other specialists need the patient's consent, and lab and discharge documents are only partly in the system.", "sources": [ { "title": "Ustawa o systemie informacji w ochronie zdrowia, tekst jednolity Dz.U. 2026 poz. 208 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/208/text.pdf", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Twoje dane medyczne to Twoja wlasnosc (pacjent.gov.pl)", "url": "https://pacjent.gov.pl/aktualnosc/twoje-dane-medyczne-twoja-wlasnosc", "date": "2025-03-10", "publisherClass": "official" }, { "title": "Twoja dokumentacja medyczna w mojeIKP (pacjent.gov.pl)", "url": "https://pacjent.gov.pl/aktualnosc/twoja-dokumentacja-medyczna-w-mojeikp", "date": "2026-03-11", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, final report (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/7de84d62-66d1-11f1-9b18-01aa75ed71a1/language-en", "date": "2026-06-15", "publisherClass": "intergov" } ] }, "research": { "score": 46, "summary": "Records and registry data may go to researchers only in a form that cannot identify the patient, with no consent and no opt-out. UODO says national law lacks adequate rules for research use, and Poland has not yet set up the EU health data access body.", "sources": [ { "title": "Ustawa o systemie informacji w ochronie zdrowia, tekst jednolity Dz.U. 2026 poz. 208 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/208/text.pdf", "date": "2026-02-13", "publisherClass": "legal_text" }, { "title": "Wystapienie Prezesa UODO do Ministra Zdrowia i Ministra Nauki, DPNT.413.39.2025 (UODO)", "url": "https://uodo.gov.pl/pl/file/6426", "date": "2025-09-01", "publisherClass": "official" }, { "title": "Wdrozenie EHDS w Polsce i rola Ministerstwa Zdrowia (MZ Departament e-Zdrowia, via UODO)", "url": "https://uodo.gov.pl/pl/file/7458", "date": "2026-03-25", "publisherClass": "official" }, { "title": "Ustawa o badaniach klinicznych produktow leczniczych stosowanych u ludzi, Dz.U. 2023 poz. 605 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2023/605/text.pdf", "date": "2023-03-09", "publisherClass": "legal_text" } ] }, "ai": { "score": 54, "summary": "Clinical AI falls under EU device law and the AI Act, and Poland's AI Systems Act of 2026 mainly names the regulator. One verified national addition: since January 2025 the medical ethics code lets doctors use AI only with patient consent and certified tools.", "sources": [ { "title": "Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji, Dz.U. 2026 poz. 1003 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/1003/text.pdf", "date": "2026-07-27", "publisherClass": "legal_text" }, { "title": "Nowelizacja Kodeksu Etyki Lekarskiej, tekst z art. 12 (Naczelna Izba Lekarska)", "url": "https://nil.org.pl/izba/krajowy-zjazd-lekarzy/nadzwyczajny-xvi-krajowy-zjazd-lekarzy/8487-nowelizacja-kodeksu-etyki-lekarskiej-kamien-milowy-dla-srodowiska-lekarskiego", "date": "undated", "publisherClass": "official" }, { "title": "Ustawa o izbach lekarskich, tekst jednolity Dz.U. 2021 poz. 1342 (Sejm ELI)", "url": "https://api.sejm.gov.pl/eli/acts/DU/2021/1342/text.pdf", "date": "2021-06-25", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Act on Patient Rights and the Patient Rights Ombudsman", "level": "National", "year": "2008", "what": "Right to records in paper or electronic form; free first copy; research use only without identifying data.", "url": "https://api.sejm.gov.pl/eli/acts/DU/2024/581/text.pdf" }, { "name": "Act on the Health Care Information System", "level": "National", "year": "2011", "what": "Creates P1 and the IKP; mandatory electronic records; sets who may access records without consent.", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/208/text.pdf" }, { "name": "Act on Personal Data Protection", "level": "National", "year": "2018", "what": "Polish GDPR implementing act; caps fines on public finance sector units at 100,000 zloty.", "url": "https://api.sejm.gov.pl/eli/acts/DU/2019/1781/text.pdf" }, { "name": "Act on Clinical Trials of Medicinal Products for Human Use", "level": "National", "year": "2023", "what": "Sets trial ethics review, with the national bioethics committee at the Medical Research Agency.", "url": "https://api.sejm.gov.pl/eli/acts/DU/2023/605/text.pdf" }, { "name": "Act on Artificial Intelligence Systems", "level": "National", "year": "2026", "what": "Names the national AI Act regulator, sets complaints, sandboxes and fines; in force 11 August 2026.", "url": "https://api.sejm.gov.pl/eli/acts/DU/2026/1003/text.pdf" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health is special-category data; right of access within one month; fines up to 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access, restriction and secondary-use opt-out rights; bans marketing use; key parts apply from 2029.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-06-24", "headline": "Court backs ombudsman: closed clinic's records must still be released to patients", "paraphrase": "After a medical practice closed, the former partner holding its records stopped releasing them to patients during a dispute with the other partner. The ombudsman ordered the practice to stop, and an administrative court rejected the appeal.", "source": "Rzecznik Praw Pacjenta (Patient Rights Ombudsman)", "url": "https://www.gov.pl/web/rpp/sad-potwierdzil-obowiazek-udostepniania-dokumentacji-medycznej-po-zakonczeniu-dzialalnosci-podmiotu-leczniczego", "theme": "lost_between_providers", "status": "finding" }, { "date": "2025-09-02", "headline": "Doctor reprimanded for leaving patient cards readable in a parked car", "paraphrase": "A patient saw patient record cards in a clear box on the front seat of a doctor's parked car, with one card's name, address, birth date and ID number readable. The regulator reprimanded the doctor and ordered the patient notified.", "source": "Urząd Ochrony Danych Osobowych (UODO)", "url": "https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_6/content", "theme": "breach", "status": "finding" }, { "date": "2024-12-16", "headline": "Hospital fined after a patient was handed another person's medical records", "paraphrase": "A patient received someone else's medical records, including name, birth date, national ID number and health data. The hospital did not report the breach or tell the affected person in time. The regulator fined it 29,648 zloty.", "source": "Urząd Ochrony Danych Osobowych (UODO)", "url": "https://uodo.gov.pl/pl/138/3475", "theme": "breach", "status": "finding" }, { "date": "2026-09-25", "headline": "Clinic software flaw exposed patient ID numbers and hospital discharge papers", "paraphrase": "Attackers used a flaw in practice software used by hundreds of clinics to take names, national ID numbers, contacts and discharge documents. It went unnoticed for over two weeks. The vendor said it fixed the flaw and forced password changes.", "source": "Wprost", "url": "https://biznes.wprost.pl/innowacje/12452412/tym-razem-medyc-znow-doszlo-do-poteznego-wycieku-danych-medycznych-polakow.html", "theme": "breach", "status": "admitted" }, { "date": "2025-05-09", "headline": "National patient portal flaw let a user open other people's medical documents", "paraphrase": "A user found that changing a web address in the national patient account showed other patients' documents, with names, national ID numbers, ID card numbers and health data. The ministry confirmed the flaw but would not name the facility.", "source": "CyberDefence24", "url": "https://cyberdefence24.pl/cyberbezpieczenstwo/blad-w-ikp-mozna-bylo-uzyskac-dokumentacje-pacjentow", "theme": "breach", "status": "admitted" } ] }, { "iso3": "GBR", "name": "United Kingdom", "region": "Europe", "overall": 59, "rank": "27=", "likelyRank": "11 to 41", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "In England, 39 million are registered on the NHS App and can opt out of the Summary Care Record, but not the Palantir-built data platform.", "categories": { "access": { "score": 66, "summary": "UK GDPR gives a free copy of the record within one month, and 39.1 million people are registered on the NHS App. But the app shows only new GP record entries, not historic or hospital records; a single patient record is promised from 2028.", "sources": [ { "title": "Right of access: health information (ICO)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/health-information/", "date": "2025-12-08", "publisherClass": "official" }, { "title": "NHS App Management Information, August 2026 (NHS England Digital)", "url": "https://digital.nhs.uk/data-and-information/publications/statistical/nhs-app-statistics/august-2026", "date": "2026-09-25", "publisherClass": "official" }, { "title": "Online access to new GP health record information (NHS England)", "url": "https://www.england.nhs.uk/long-read/online-access-to-new-gp-health-record-information/", "date": "2023-11-01", "publisherClass": "official" }, { "title": "Health Bill: single patient record fact sheet (GOV.UK, DHSC)", "url": "https://www.gov.uk/government/publications/health-bill-single-patient-record-fact-sheet/health-bill-single-patient-record-fact-sheet", "date": "2026-05-19", "publisherClass": "official" } ] }, "control": { "score": 52, "summary": "Patients can opt out of the national Summary Care Record, and staff must ask permission before viewing it outside emergencies. But there is no opt-out from the Palantir-built Federated Data Platform, and access logs are available only by formal request.", "sources": [ { "title": "Summary Care Records (SCR): information for patients (NHS England Digital)", "url": "https://digital.nhs.uk/services/summary-care-records-scr/summary-care-records-scr-information-for-patients", "date": "2025-05-28", "publisherClass": "official" }, { "title": "Information Governance Framework: Shared Care Records (NHS England Digital)", "url": "https://digital.nhs.uk/data-and-information/information-governance/guidance/information-governance-framework-shared-care-records", "date": "2026-05-21", "publisherClass": "official" }, { "title": "Opt out of sharing your health records (NHS website)", "url": "https://www.nhs.uk/using-the-nhs/about-the-nhs/opt-out-of-sharing-your-health-records/", "date": "2024-06-06", "publisherClass": "official" }, { "title": "NHS patients can't opt out of Palantir's data platform, but their hospital can (The Register)", "url": "https://www.theregister.com/databases/2026/06/13/nhs-patients-cant-opt-out-of-palantirs-data-platform-but-their-hospital-can/5254766", "date": "2026-06-13", "publisherClass": "news" } ] }, "privacy": { "score": 56, "summary": "Health data is protected by UK GDPR and an active regulator that fined an NHS IT supplier 3.07 million pounds. But NHS England admitted its platform impact assessment was wrong, and UK Biobank data on 500,000 people was offered for sale in April 2026.", "sources": [ { "title": "Advanced Computer Software Group Limited, monetary penalty (ICO)", "url": "https://ico.org.uk/action-weve-taken/enforcement/2025/03/advanced-computer-software-group-limited/", "date": "2025-03-26", "publisherClass": "official" }, { "title": "National Data Guardian statement on NHS Federated Data Platform data access (GOV.UK)", "url": "https://www.gov.uk/government/news/national-data-guardian-statement-on-nhs-federated-data-platform-data-access-in-response-to-the-not-with-my-nhs-data-campaign", "date": "2026-06-03", "publisherClass": "official" }, { "title": "UK Biobank health data listed for sale in China, government confirms (BBC News)", "url": "https://www.bbc.co.uk/news/articles/cpvxgl3n138o", "date": "2026-04-23", "publisherClass": "news" }, { "title": "Receiving personal information from the EEA: UK adequacy (ICO)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/receiving-personal-information-from-the-eea/", "date": "2026-01-15", "publisherClass": "official" } ] }, "journey": { "score": 62, "summary": "Over 95% of prescriptions in England are electronic, and a national Summary Care Record is drawn from GP records at 98% of practices. Hospitals connect through regional shared care records that, the government says, do not link nationally.", "sources": [ { "title": "Electronic Prescription Service (NHS England Digital)", "url": "https://digital.nhs.uk/services/electronic-prescription-service", "date": "2026-09-18", "publisherClass": "official" }, { "title": "Summary Care Record (SCR) service page (NHS England Digital)", "url": "https://digital.nhs.uk/services/summary-care-records-scr", "date": "2026-08-27", "publisherClass": "official" }, { "title": "Health Bill: single patient record fact sheet (GOV.UK, DHSC)", "url": "https://www.gov.uk/government/publications/health-bill-single-patient-record-fact-sheet/health-bill-single-patient-record-fact-sheet", "date": "2026-05-19", "publisherClass": "official" }, { "title": "NHS Federated Data Platform uptake and benefits (NHS England)", "url": "https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/solution-exchange/fdp-uptake-and-benefits/", "date": "2026-09-25", "publisherClass": "official" } ] }, "commercial": { "score": 60, "summary": "The law lets NHS England release patient data only for health care or the promotion of health, and NHS policy bars disclosure for marketing or insurance without explicit consent. A private US firm built the national data platform under a contract worth up to 330 million pounds.", "sources": [ { "title": "Health and Social Care Act 2012, section 261 (legislation.gov.uk)", "url": "https://www.legislation.gov.uk/ukpga/2012/7/section/261", "date": "undated", "publisherClass": "legal_text" }, { "title": "Understanding the national data opt-out (NHS England Digital)", "url": "https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out", "date": "2023-05-16", "publisherClass": "official" }, { "title": "Opt out of sharing your health records (NHS website)", "url": "https://www.nhs.uk/using-the-nhs/about-the-nhs/opt-out-of-sharing-your-health-records/", "date": "2024-06-06", "publisherClass": "official" }, { "title": "Palantir should not have significant role in NHS and other public services, say MPs (BMJ)", "url": "https://www.bmj.com/content/393/bmj-2026-035692", "date": "2026-06-04", "publisherClass": "news" } ] }, "clinical": { "score": 60, "summary": "Any authorised clinician in England can view the national Summary Care Record of medicines and allergies, used by about 129,000 staff a month. A fuller cross-provider view depends on which regional shared care record covers the patient.", "sources": [ { "title": "Summary Care Record (SCR) service page (NHS England Digital)", "url": "https://digital.nhs.uk/services/summary-care-records-scr", "date": "2026-08-27", "publisherClass": "official" }, { "title": "Summary Care Records (SCR): information for patients (NHS England Digital)", "url": "https://digital.nhs.uk/services/summary-care-records-scr/summary-care-records-scr-information-for-patients", "date": "2025-05-28", "publisherClass": "official" }, { "title": "The single patient record explained (The King's Fund)", "url": "https://www.kingsfund.org.uk/insight-and-analysis/long-reads/the-single-patient-record-explained-what-could-it-mean-for-patients-and-the-health-and-care-system", "date": "2026-08-04", "publisherClass": "academic" }, { "title": "Health Bill: single patient record fact sheet (GOV.UK, DHSC)", "url": "https://www.gov.uk/government/publications/health-bill-single-patient-record-fact-sheet/health-bill-single-patient-record-fact-sheet", "date": "2026-05-19", "publisherClass": "official" } ] }, "research": { "score": 64, "summary": "Patients can block use of their confidential data for research and planning through the national data opt-out, used by 5.69% in July 2026. Exemptions cover public health, legal duties and data NHS England is directed to collect.", "sources": [ { "title": "Understanding the national data opt-out (NHS England Digital)", "url": "https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out", "date": "2023-05-16", "publisherClass": "official" }, { "title": "Opt out of sharing your health records (NHS website)", "url": "https://www.nhs.uk/using-the-nhs/about-the-nhs/opt-out-of-sharing-your-health-records/", "date": "2024-06-06", "publisherClass": "official" }, { "title": "Using patient data for research: challenges and policy developments (House of Lords Library)", "url": "https://lordslibrary.parliament.uk/using-patient-data-for-research-challenges-and-policy-developments/", "date": "2026-08-04", "publisherClass": "official" }, { "title": "Launch of clinical trial reforms (MHRA and HRA, GOV.UK)", "url": "https://www.gov.uk/government/news/launch-of-clinical-trial-reforms", "date": "2026-04-27", "publisherClass": "official" } ] }, "ai": { "score": 55, "summary": "AI medical devices fall under the UK Medical Devices Regulations 2002, with new post-market surveillance duties in force since June 2025. Change control plans rest on 2023 guiding principles, and the national AI commission asked the MHRA to clarify them.", "sources": [ { "title": "Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024, S.I. 2024/1368", "url": "https://www.legislation.gov.uk/uksi/2024/1368/made", "date": "2024-12-16", "publisherClass": "legal_text" }, { "title": "Predetermined change control plans for machine learning-enabled medical devices: guiding principles (MHRA, FDA, Health Canada)", "url": "https://www.gov.uk/government/publications/predetermined-change-control-plans-for-machine-learning-enabled-medical-devices-guiding-principles/predetermined-change-control-plans-for-machine-learning-enabled-medical-devices-guiding-principles", "date": "2023-10-24", "publisherClass": "official" }, { "title": "National Commission into the Regulation of AI in Healthcare: recommendations for a future regulatory framework (GOV.UK)", "url": "https://www.gov.uk/government/publications/national-commission-into-the-regulation-of-ai-in-healthcare-recommendations-for-a-future-regulatory-framework/national-commission-into-the-regulation-of-ai-in-healthcare-recommendations-for-a-future-regulatory-framework", "date": "2026-09-10", "publisherClass": "official" }, { "title": "Advancing AI regulation in healthcare: insights from AI Airlock phase 2 (MHRA MedRegs blog)", "url": "https://medregs.blog.gov.uk/2026/06/09/advancing-ai-regulation-in-healthcare-insights-from-ai-airlock-phase-2/", "date": "2026-06-09", "publisherClass": "official" } ] } }, "laws": [ { "name": "UK GDPR and Data Protection Act 2018", "level": "National", "year": "2018", "what": "Health is special category data; free access copy, usually within one month; ICO enforcement.", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/health-information/" }, { "name": "Data (Use and Access) Act 2025", "level": "National", "year": "2025", "what": "Amends UK data protection, replaces the ICO with an Information Commission, sets binding health IT standards (s.121).", "url": "https://www.legislation.gov.uk/ukpga/2025/18/contents" }, { "name": "Health and Social Care Act 2012, s.261", "level": "National", "year": "2012", "what": "NHS England may release collected data only for health care, social care or promotion of health.", "url": "https://www.legislation.gov.uk/ukpga/2012/7/section/261" }, { "name": "Health Service (Control of Patient Information) Regulations 2002 (NHS Act 2006, s.251)", "level": "National", "year": "2002", "what": "Lets confidential patient data be used without consent on CAG approval; national opt-out then applies.", "url": "https://www.legislation.gov.uk/uksi/2002/1438/contents/made" }, { "name": "Medical Devices Regulations 2002, as amended by S.I. 2024/1368", "level": "National", "year": "2024", "what": "Device rules covering AI software; post-market surveillance duties in force from June 2025.", "url": "https://www.legislation.gov.uk/uksi/2024/1368/made" }, { "name": "Health Bill (single patient record), before Parliament", "level": "National", "year": "2026", "what": "Would create a national single patient record viewable in the NHS App; no new opt-out.", "url": "https://www.gov.uk/government/publications/health-bill-single-patient-record-fact-sheet/health-bill-single-patient-record-fact-sheet" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-16", "headline": "GP surgery sent 23 years of records to an insurer that asked for five", "paraphrase": "An insurer asked for five years of records, to go to the patient first for review. The surgery emailed 23 years straight to the insurer. The patient said their payout was cut. The ICO issued a reprimand.", "source": "Information Commissioner's Office", "url": "https://ico.org.uk/action-weve-taken/enforcement/2025/12/staines-health-group/", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-03-27", "headline": "Regulator fines NHS software supplier after hackers took data on 79,404 people", "paraphrase": "Hackers entered a supplier's health systems through an account without multi-factor authentication. Data on 79,404 people was taken, including how to enter the homes of 890 people receiving care at home. The ICO fined the supplier £3.07m.", "source": "Information Commissioner's Office", "url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/", "theme": "breach", "status": "finding" }, { "date": "2024-12-13", "headline": "Hospital trust missed the legal deadline on nearly a third of access requests", "paraphrase": "Over a year, a large hospital trust failed to answer 32% of people's requests for their own personal data within one month. It could not say how many requests were in its backlog. The ICO issued a reprimand.", "source": "Information Commissioner's Office", "url": "https://ico.org.uk/action-weve-taken/enforcement/2024/12/united-lincolnshire-teaching-hospitals-nhs-trust/", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-05-02", "headline": "Nearly one in four adults in England found errors in their medical records", "paraphrase": "A survey of 1,800 adults for the patient watchdog found 23% had noticed mistakes or gaps in their NHS records, including wrong personal details, wrong medication and conditions they never had. Most said the errors caused problems.", "source": "Pharmacy Business", "url": "https://www.pharmacy.biz/errors-medical-records-healthwatch-england/", "theme": "record_wrong", "status": "self_reported" }, { "date": "2026-05-27", "headline": "Whistleblower says new hospital record system loses referrals and patient information", "paraphrase": "A clinician at a London hospital trust said its new electronic record system sent referrals to the wrong place, held missing or unreliable information and left patients lost to follow-up. The trust said the rollout caused a number of issues.", "source": "LBC", "url": "https://www.lbc.co.uk/article/nhs-east-london-whistleblower-it-system-patients-5HjdZgg_2/", "theme": "lost_between_providers", "status": "alleged" } ] }, { "iso3": "URY", "name": "Uruguay", "region": "Americas", "overall": 59, "rank": "27=", "likelyRank": "13 to 42", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Uruguayans can view their national health record online, limit who opens it and check who did, but it holds a minimum data set.", "categories": { "access": { "score": 65, "summary": "Ley 18.335 makes the patient the record's owner with a right to a copy, and the national Mi Historia Clinica Digital portal shows adult SNIS members the care events providers registered. Copies cost the patient, and the shared record is a minimum data set.", "sources": [ { "title": "Ley 18.335, derechos y obligaciones de pacientes y usuarios (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/18335-2008", "date": "2008-08-15", "publisherClass": "legal_text" }, { "title": "Mi Historia Clinica Digital (Ministerio de Salud Publica)", "url": "https://www.gub.uy/ministerio-salud-publica/tramites-y-servicios/servicios/mi-historia-clinica-digital", "date": "undated", "publisherClass": "official" }, { "title": "Decreto 122/019, incorporacion a la HCEN y gestion de accesos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos-originales/122-2019", "date": "2019-05-13", "publisherClass": "legal_text" }, { "title": "Receta electronica, simulacion clinica y asistentes de IA: la mirada de 3 expertos (Forbes Uruguay)", "url": "https://www.forbesuruguay.com/especiales/receta-electronica-simulacion-clinica-asistentes-ia-mirada-3-expertos-sobre-transformacion-sistema-salud-n82298", "date": "2025-11-25", "publisherClass": "news" } ] }, "control": { "score": 66, "summary": "By law a patient can block or limit access to their national record and see who opened it. Sharing is on by default, and the Health Ministry keeps its own right of access.", "sources": [ { "title": "Ley 19.670, articulo 194, Historia Clinica Electronica Nacional (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/19670-2018/194", "date": "2018-10-15", "publisherClass": "legal_text" }, { "title": "Decreto 122/019, incorporacion a la HCEN y gestion de accesos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos-originales/122-2019", "date": "2019-05-13", "publisherClass": "legal_text" }, { "title": "Mi Historia Clinica Digital (Ministerio de Salud Publica)", "url": "https://www.gub.uy/ministerio-salud-publica/tramites-y-servicios/servicios/mi-historia-clinica-digital", "date": "undated", "publisherClass": "official" }, { "title": "Desde este viernes, cada persona puede ingresar a su historia clinica electronica (la diaria)", "url": "https://ladiaria.com.uy/salud/articulo/2019/9/desde-este-viernes-cada-persona-puede-ingresar-a-su-historia-clinica-electronica/", "date": "2019-09", "publisherClass": "news" } ] }, "privacy": { "score": 57, "summary": "Health data is sensitive data under Ley 18.331, breaches must be reported, and the EU confirmed Uruguay's adequacy in January 2024. Enforcement is thin: the regulator said in November 2025 it had made no inspections of its own on data leaks in three years.", "sources": [ { "title": "Ley 18.331, proteccion de datos personales (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/18331-2008", "date": "2008-08-11", "publisherClass": "legal_text" }, { "title": "La Comision Europea ratifica el nivel adecuado de Uruguay para la proteccion de datos (URCDP)", "url": "https://www.gub.uy/unidad-reguladora-control-datos-personales/comunicacion/noticias/comision-europea-ratifica-nivel-adecuado-uruguay-para-proteccion-datos-0", "date": "2024-01-15", "publisherClass": "official" }, { "title": "Hackeos al Estado: que dice la Unidad Reguladora de Datos Personales (El Observador)", "url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/hackeos-al-estado-que-dice-la-unidad-reguladora-datos-personales-ataques-organismos-n6024282", "date": "2025-11-12", "publisherClass": "news" }, { "title": "Uruguay bajo fuego: el avance de la infraestructura digital estatal se convierte en blanco del cibercrimen (Grupo R Multimedio)", "url": "https://grupormultimedio.com/uruguay-bajo-fuego-el-avance-de-la-infraestructura-digital-estatal-se-convierte-en-blanco-del-cibercrimen-id194342/", "date": "2026-05-10", "publisherClass": "news" } ] }, "journey": { "score": 60, "summary": "All public and private providers must join the federated national HCEN platform, which links records held by each provider, and 92% of users had at least one document on it by 2020. E-prescribing is still rolling out provider by provider.", "sources": [ { "title": "Ley 19.670, articulo 194, Historia Clinica Electronica Nacional (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/19670-2018/194", "date": "2018-10-15", "publisherClass": "legal_text" }, { "title": "Decreto 122/019, incorporacion a la HCEN y gestion de accesos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos-originales/122-2019", "date": "2019-05-13", "publisherClass": "legal_text" }, { "title": "Historia Clinica Electronica Nacional (Agesic)", "url": "https://www.gub.uy/agencia-gobierno-electronico-sociedad-informacion-conocimiento/historia-clinica-electronica-nacional", "date": "undated", "publisherClass": "official" }, { "title": "Historia Clinica Electronica Nacional (HCEN) (Red Gealc)", "url": "https://www.redgealc.org/contenido-general/noticias/historia-clinica-electronica-nacional-hcen/", "date": "2020-05-15", "publisherClass": "intergov" } ] }, "commercial": { "score": 52, "summary": "Ley 18.331 requires express written consent for sensitive data and bars databases that reveal sensitive data, with narrow exceptions. There is no health-specific rule on data brokers, health apps or ad targeting.", "sources": [ { "title": "Ley 18.331, proteccion de datos personales (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/18331-2008", "date": "2008-08-11", "publisherClass": "legal_text" }, { "title": "Hackeos al Estado: que dice la Unidad Reguladora de Datos Personales (El Observador)", "url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/hackeos-al-estado-que-dice-la-unidad-reguladora-datos-personales-ataques-organismos-n6024282", "date": "2025-11-12", "publisherClass": "news" } ] }, "clinical": { "score": 58, "summary": "A clinician at any SNIS provider can open the documents other providers registered on HCEN during a care event, unless the patient has limited access. What they see is a minimum data set, not the full chart.", "sources": [ { "title": "Mi Historia Clinica Digital (Ministerio de Salud Publica)", "url": "https://www.gub.uy/ministerio-salud-publica/tramites-y-servicios/servicios/mi-historia-clinica-digital", "date": "undated", "publisherClass": "official" }, { "title": "Decreto 122/019, incorporacion a la HCEN y gestion de accesos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos-originales/122-2019", "date": "2019-05-13", "publisherClass": "legal_text" }, { "title": "Receta electronica, simulacion clinica y asistentes de IA: la mirada de 3 expertos (Forbes Uruguay)", "url": "https://www.forbesuruguay.com/especiales/receta-electronica-simulacion-clinica-asistentes-ia-mirada-3-expertos-sobre-transformacion-sistema-salud-n82298", "date": "2025-11-25", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Medical research on people needs express, revocable consent and ethics committee approval, but health data can be used for science without consent once dissociated, with no general opt-out. Ethics bodies, statutory secrecy and fines are the safeguards.", "sources": [ { "title": "Ley 18.335, derechos y obligaciones de pacientes y usuarios (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/18335-2008", "date": "2008-08-15", "publisherClass": "legal_text" }, { "title": "Decreto 158/019, investigacion en seres humanos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos/158-2019", "date": "2019-06-12", "publisherClass": "legal_text" }, { "title": "Ley 18.331, proteccion de datos personales (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/18331-2008", "date": "2008-08-11", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No rule for clinical AI is in force: device registration covers software in general, and the national AI strategy is not clinical guidance. The Health Ministry announced a mandatory registry of health AI projects in September 2026, start date still open.", "sources": [ { "title": "Ley 20.212, articulo 74, estrategia nacional de datos e IA (IMPO)", "url": "https://www.impo.com.uy/bases/leyes/20212-2023/74", "date": "2023-11-06", "publisherClass": "legal_text" }, { "title": "Estrategia Nacional de Inteligencia Artificial 2024-2030 (Agesic)", "url": "https://www.gub.uy/agencia-gobierno-electronico-sociedad-informacion-conocimiento/comunicacion/publicaciones/estrategia-nacional-inteligencia-artificial-2024-2030", "date": "2024-11-22", "publisherClass": "official" }, { "title": "Decreto 3/008, reactivos de diagnostico, dispositivos terapeuticos y equipos medicos (IMPO)", "url": "https://www.impo.com.uy/bases/decretos/3-2008", "date": "2008-01-17", "publisherClass": "legal_text" }, { "title": "El MSP exigira registrar los proyectos de inteligencia artificial en salud (Nacion)", "url": "https://nacion.com.uy/redaccion/msp-registro-proyectos-inteligencia-artificial-salud-setiembre-2026", "date": "2026-09-10", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley 18.335 (derechos de pacientes y usuarios)", "level": "National", "year": "2008", "what": "Patient owns the record; right to review and copy; research needs express revocable consent.", "url": "https://www.impo.com.uy/bases/leyes/18335-2008" }, { "name": "Ley 18.331 (proteccion de datos personales)", "level": "National", "year": "2008", "what": "Health is sensitive data; express written consent; access in five business days; fines to 500,000 UI.", "url": "https://www.impo.com.uy/bases/leyes/18331-2008" }, { "name": "Ley 19.670, articulos 38 y 194", "level": "National", "year": "2018", "what": "Breach notification; all providers join HCEN; anyone may object to access through HCEN.", "url": "https://www.impo.com.uy/bases/leyes/19670-2018" }, { "name": "Decreto 122/019 (HCEN)", "level": "National", "year": "2019", "what": "Patient-managed permissions, patient-visible access log, 24-hour event registration, minimum data sets.", "url": "https://www.impo.com.uy/bases/decretos-originales/122-2019" }, { "name": "Decreto 158/019 (investigacion en seres humanos)", "level": "National", "year": "2019", "what": "Approves research ethics rules drafted by the National Research Ethics Commission.", "url": "https://www.impo.com.uy/bases/decretos/158-2019" }, { "name": "Ley 20.212, articulo 74", "level": "National", "year": "2023", "what": "Mandates a national data and AI strategy and recommendations for AI regulation.", "url": "https://www.impo.com.uy/bases/leyes/20212-2023/74" }, { "name": "Commission Decision 2012/484/EU (adequacy)", "level": "Supranational", "year": "2012", "what": "EU finds Uruguay adequate for data transfers; confirmed by the Commission in January 2024.", "url": "https://www.gub.uy/unidad-reguladora-control-datos-personales/comunicacion/noticias/comision-europea-ratifica-nivel-adecuado-uruguay-para-proteccion-datos-0" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-01-15", "headline": "Appeals court orders Hospital Policial to compensate patient over false entry in record", "paraphrase": "A wrong code put a false serious diagnosis in a man's clinical record, where it stayed for 20 days. An appeals court ordered the hospital to pay him and his wife about US$13,000.", "source": "El País (Uruguay)", "url": "https://www.elpais.com.uy/informacion/judiciales/lo-anotaron-como-portador-de-vih-por-error-y-hospital-policial-debera-pagarle-us-13-000-a-el-y-su-esposa", "theme": "record_wrong", "status": "finding" }, { "date": "2025-12-14", "headline": "Health worker says clinical records are completed afterwards to shield doctors from lawsuits", "paraphrase": "An anonymous staff member at a private health provider told a newspaper that records are often filled in after care and adjusted, so complications are minimised or left out of the patient's record.", "source": "Grupo R Multimedio (La R)", "url": "https://grupormultimedio.com/se-manipulan-historias-clinicas-para-proteger-a-medicos-y-evitar-juicios-un-funcionario-del-casmu-hablo-bajo-proteccion-de-identidad-id179320/", "theme": "record_wrong", "status": "alleged" }, { "date": "2025-03-10", "headline": "Hackers claim access to public health prescription system and leak patient test results", "paraphrase": "A criminal group claimed it could add or delete prescriptions in the public health network and leaked names, ID numbers and lab test results of patients. The provider said its data centre was not entered.", "source": "El Observador", "url": "https://www.elobservador.com.uy/ciencia-y-tecnologia/asse-investiga-un-presunto-hackeo-que-implico-la-posibilidad-eliminar-o-anadir-recetas-medicas-al-sistema-n5988870", "theme": "breach", "status": "alleged" } ] }, { "iso3": "SVK", "name": "Slovakia", "region": "Europe", "overall": 58, "rank": "33", "likelyRank": "16 to 45", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Slovaks can read a national e-health record and see every access, but cannot opt out of clinician sharing, and login needs a chip ID card.", "categories": { "access": { "score": 62, "summary": "The law gives patients the right to see their whole record without delay, and the national electronic health book (EZK) is online through the National Health Portal. Login needs a chip ID card with an activated e-signature, minors cannot log in, and usage figures were not verified.", "sources": [ { "title": "Zakon c. 576/2004 Z. z. o zdravotnej starostlivosti, section 25 (Slov-Lex, version from 1 Aug 2026)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2004/576/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Zakon c. 153/2013 Z. z. o narodnom zdravotnickom informacnom systeme (Slov-Lex, version from 1 Aug 2026)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Pristup do elektronickej zdravotnej knizky (NCZI, ezdravotnictvo.sk)", "url": "https://www.ezdravotnictvo.sk/en/-/pristup-do-elektronickej-zdravotnej-knizky", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 50, "summary": "Patients can see who opened their EZK, when and in what role, and can grant and withdraw extra access. Providers share records without consent by law, and we found no general opt-out from clinician access.", "sources": [ { "title": "Zakon c. 153/2013 Z. z., sections 5 and 5a (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Zakon c. 576/2004 Z. z., section 18 (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2004/576/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Pristup do elektronickej zdravotnej knizky (NCZI)", "url": "https://www.ezdravotnictvo.sk/en/-/pristup-do-elektronickej-zdravotnej-knizky", "date": "undated", "publisherClass": "official" }, { "title": "Mozem ako pacient zakazat pristup do svojej zdravotnej dokumentacie? (nahradaskody.sk)", "url": "https://www.nahradaskody.sk/clanky/zdravotna-dokumentacia/mozem-ako-pacient-zakazat-pristup-do-svojej-zdravotnej-dokumentacie/", "date": "2024-10-23", "publisherClass": "law_firm" } ] }, "privacy": { "score": 58, "summary": "GDPR and Act 18/2018 apply. NCZI may not give EZK data to police, but providers must give record extracts to criminal authorities and courts on written request, and the regulator imposed 542 fines totalling EUR 468,000 in 2025.", "sources": [ { "title": "Sprava o stave ochrany osobnych udajov za rok 2025 (UOOU)", "url": "https://dataprotection.gov.sk/files/annual-reports/uoou_sprava-stave-ochrany-osobnych-udajov_2025.pdf", "date": "2026", "publisherClass": "official" }, { "title": "CEF 2026: spolocna dozorova akcia EDPB zamerana na transparentnost informovania (UOOU)", "url": "https://dataprotection.gov.sk/sk/aktuality/cef-2026-spolocna-dozorova-akcia-edpb-zamerana-transparentnost-informovania-do-ktorej-urad-ochranu-osobnych-udajov-sl.html", "date": "2026-03-19", "publisherClass": "official" }, { "title": "Zakon c. 153/2013 Z. z., section 3a (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Zakon c. 576/2004 Z. z., section 24 (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2004/576/", "date": "2026-08-01", "publisherClass": "legal_text" } ] }, "journey": { "score": 66, "summary": "The national ezdravie system links 14,400 outpatient clinics, 129 hospitals, 2,193 pharmacies and all 3 health insurers. Electronic lab results (2.5 million in 2025) are still rolling out, and Slovakia is not yet on the EU MyHealth@EU network.", "sources": [ { "title": "Vyrocna sprava NCZI 2025", "url": "https://www.nczisk.sk/Documents/download/vyrocna_sprava_NCZI_2025.pdf", "date": "2026", "publisherClass": "official" }, { "title": "Zmena pravidiel vo vykazovani zdravotnej starostlivosti od 1. jula 2026 (NCZI)", "url": "https://www.nczisk.sk/AKTUALITY/Pages/Zmena-pravidiel-vo-vykazovani-zdravotnej-starostlivosti-od-1-jula-2026.aspx", "date": "undated", "publisherClass": "official" }, { "title": "eSluzby: funkcie elektronickeho zdravotnictva (NCZI)", "url": "https://www.ezdravotnictvo.sk/en/functions", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "GDPR limits commercial use of identifiable health data, and the EU health data space will ban marketing uses of reused data. Act 153/2013 lets NCZI release anonymised data to anyone on request, and no Slovak ban on selling health data was verified.", "sources": [ { "title": "Regulation (EU) 2016/679 (GDPR)", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "date": "2016-04-27", "publisherClass": "legal_text" }, { "title": "Zakon c. 153/2013 Z. z., section 3a (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 60, "summary": "The patient's registered GP sees most of the EZK, other treating doctors see parts via referral or the patient's ID card, and any health worker can see the emergency patient summary. Records outside ezdravie, such as paper reports, remain with each provider.", "sources": [ { "title": "Zakon c. 153/2013 Z. z., sections 5, 5a and 6 (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Vyrocna sprava NCZI 2025", "url": "https://www.nczisk.sk/Documents/download/vyrocna_sprava_NCZI_2025.pdf", "date": "2026", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "NCZI gives researchers modified statistical data under written contract, with no individual consent and no general opt-out found. A Slovak health data access body for the EHDS is still being built.", "sources": [ { "title": "Zakon c. 153/2013 Z. z., section 3a and annexes (Slov-Lex)", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/", "date": "2026-08-01", "publisherClass": "legal_text" }, { "title": "Vyrocna sprava NCZI 2025", "url": "https://www.nczisk.sk/Documents/download/vyrocna_sprava_NCZI_2025.pdf", "date": "2026", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under the EU AI Act and EU device rules only. A Slovak bill naming the ministry MIRRI as AI supervisor advanced in parliament in September 2026 and would apply from 1 January 2027, so it adds no points yet.", "sources": [ { "title": "AI Act: regulatory framework for AI (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai", "date": "2026-08-03", "publisherClass": "official" }, { "title": "Dohlad nad umelou inteligenciou preberie MIRRI (Zoznam, openiazoch)", "url": "https://openiazoch.zoznam.sk/technologie/dohlad-nad-umelou-inteligenciou-preberie-mirri-poslanci-posunuli-zakon-dalej/", "date": "2026-09-17", "publisherClass": "news" } ] } }, "laws": [ { "name": "Act No. 153/2013 on the National Health Information System", "level": "National", "year": "2013", "what": "Creates the EZK, role-based access, patient access log, revocable consent and NCZI data release rules.", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2013/153/" }, { "name": "Act No. 576/2004 on Health Care", "level": "National", "year": "2004", "what": "Right to see the full record without delay; ban on relatives' access; no consent needed for lawful sharing.", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2004/576/" }, { "name": "Act No. 18/2018 on Personal Data Protection", "level": "National", "year": "2018", "what": "Supplements the GDPR in Slovakia and sets up the data protection office.", "url": "https://www.slov-lex.sk/ezbierky/pravne-predpisy/SK/ZZ/2018/18/" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health is special-category data; right of access; fines up to EUR 20M or 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Free access, restriction rights and secondary-use opt-out; main rules apply from 2029.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-30", "headline": "Patient waits over six months as former doctor holds records after a switch", "paraphrase": "A patient who changed general practitioner says the former doctor did not pass his records to the new one for over six months. Other former patients report the same, and a regional complaint is under review.", "source": "STVR Správy (Slovak public broadcaster)", "url": "https://spravy.stvr.sk/2025/04/pan-peter-ostal-bez-pristupu-k-svojej-zdravotnej-dokumentacii-lekar-na-jeho-ziadost-o-presun-zaznamov-nereaguje/", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2025-12-07", "headline": "Dentists say national eHealth record lacks dental charts and images", "paraphrase": "The dentists' chamber says dental charts and image files do not reach the national electronic record, so other doctors cannot see them. It warns patients may get duplicate prescriptions or repeat imaging as a result.", "source": "Pravda", "url": "https://www.pravda.sk/zdravie/zdravie-a-prevencia/clanok/777566-zubni-lekari-si-stazuju-ze-v-ezdravi-chybaju-dolezite-udaje-pre-diagnostiku-a-rozhodovanie-o-liecbe", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2025-01-25", "headline": "Cyberattack tried to take patient data from the main state health insurer", "paraphrase": "The government said attackers targeted the state health insurer seeking patients' personal and treatment data. The health minister said the attack was repelled, and the insurer stated policyholders' data were safe and had not leaked.", "source": "Bratislavak.sk", "url": "https://www.bratislavak.sk/clanky/5645/aktualizovane-kyberneticky-utok-na-vszp-sa-podarilo-odrazit-vyhlasil-sasko-k-uniku-dat-nedoslo", "theme": "breach", "status": "admitted" } ] }, { "iso3": "AND", "name": "Andorra", "region": "Europe", "overall": 57, "rank": "34=", "likelyRank": "16 to 45", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Andorra's single shared record links almost all care and patients can read results in an app, but opting out is hard and fines are low.", "categories": { "access": { "score": 62, "summary": "Llei 20/2017 gives a right to the whole record, with copies within five working days. The national Andorra Salut app shows reports, test results and vaccinations, but it needs a digital certificate and has about 25,000 users.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" }, { "title": "L'APP 'Andorra Salut' amplia les funcionalitats i facilitarà l'accés a la informació mèdica (Govern d'Andorra)", "url": "https://www.govern.ad/ca/w/l-app-andorra-salut-amplia-les-funcionalitats-i-facilitara-l-acces-a-la-informacio-medica", "date": "2026-02-12", "publisherClass": "official" }, { "title": "Health systems in action 2025: Andorra (European Observatory on Health Systems and Policies)", "url": "https://eurohealthobservatory.who.int/publications/i/health-systems-in-action-2025-andorra", "date": "2026-02-27", "publisherClass": "intergov" } ] }, "control": { "score": 55, "summary": "The law lets a patient block clinicians' direct access to the shared record and get a log of every access within 15 working days. The log comes only on request, and in 2019 patients asking to leave were told no real alternative existed.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" }, { "title": "Usuaris dels serveis sanitaris reclamen una alternativa a la història clínica compartida (Altaveu)", "url": "https://www.altaveu.com/actualitat/usuaris-dels-serveis-sanitaris-reclamen-una-alternativa-a-la-historia-clinica-compartida_10042_102.html", "date": "2019-12-10", "publisherClass": "news" } ] }, "privacy": { "score": 54, "summary": "Llei 29/2021 mirrors the GDPR, with 72-hour breach notice, and the EU recognises Andorra as adequate. But fines stop at 100,000 euros, public bodies such as the public health service can only be warned, and the one recent health case we found ended in warnings.", "sources": [ { "title": "Llei 29/2021 qualificada de protecció de dades personals (consolidated text)", "url": "http://portaljuridicandorra.ad/L2021029", "date": "2021-10-28", "publisherClass": "legal_text" }, { "title": "L'APDA sanciona dos centres de psicologia per intercanvi irregular de documentació clínica (APDA)", "url": "https://www.apda.ad/noticia/l-apda-sanciona-dos-centres-de-psicologia-per-intercanvi-irregular-de-documentacio-clinica", "date": "2025-09-03", "publisherClass": "official" }, { "title": "Jèssica Obiols jura el càrrec com a nova cap de l'APDA (Consell General)", "url": "https://www.consellgeneral.ad/ca/noticies/jessica-obiols-jura-el-carrec-com-a-nova-cap-de-l2019apda", "date": "2025-10-10", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 66, "summary": "One national shared record links the public hospital, primary care and all clinical labs, and a July 2026 decree makes it the main tool for referrals. E-prescription was still in a pilot announced for April 2026.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" }, { "title": "Decret 305/2026, Reglament de l'accés a l'Assistència Sanitària Pública", "url": "https://www.portaljuridicandorra.ad/R20260729B", "date": "2026-07-29", "publisherClass": "legal_text" }, { "title": "Expedient informatiu a un centre de radiologia per no bolcar dades a la història clínica compartida (Altaveu)", "url": "https://www.altaveu.com/actualitat/sanitat/expedient-informatiu-centre-radiologia-us-en-fa-historia-clinica-compartida_55577_102.html", "date": "2024-02-28", "publisherClass": "news" }, { "title": "La prova pilot de la recepta electrònica s'iniciarà en els pròxims deu dies (Diari d'Andorra)", "url": "https://www.diariandorra.ad/nacional/260412/assegura-recepta-electronica-iniciara-prova-pilot-els-proxims-deu-dies_193859.html", "date": "2026-04-12", "publisherClass": "news" } ] }, "commercial": { "score": 56, "summary": "Andorran health law treats giving clinical data to third parties as a very serious offence, with fines up to 100,000 euros. We found no specific rule on health apps, data brokers or insurers' use of health data beyond the general data law.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" }, { "title": "Llei 29/2021 qualificada de protecció de dades personals (consolidated text)", "url": "http://portaljuridicandorra.ad/L2021029", "date": "2021-10-28", "publisherClass": "legal_text" } ] }, "clinical": { "score": 64, "summary": "Any professional authorised in Andorra can open the shared record with a stated reason, and the patient's own doctor without one. Doctors in Spain and France, where some care takes place, are not connected and rely on patient-shared QR codes.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" }, { "title": "Health systems in action 2025: Andorra (European Observatory on Health Systems and Policies)", "url": "https://eurohealthobservatory.who.int/publications/i/health-systems-in-action-2025-andorra", "date": "2026-02-27", "publisherClass": "intergov" }, { "title": "L'APP 'Andorra Salut' amplia les funcionalitats i facilitarà l'accés a la informació mèdica (Govern d'Andorra)", "url": "https://www.govern.ad/ca/w/l-app-andorra-salut-amplia-les-funcionalitats-i-facilitara-l-acces-a-la-informacio-medica", "date": "2026-02-12", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Identifiable record data cannot be used for research without express written consent, and an ethics committee must approve research on people. Use with identities removed needs no consent and has no opt-out.", "sources": [ { "title": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica (consolidated text)", "url": "http://portaljuridicandorra.ad/L2017020", "date": "2017-10-27", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Andorra has a 2024 government AI ethics code, required only for some public-sector processes, and signed the Council of Europe AI convention, but no AI law or clinical AI rules we could find. How AI medical devices are regulated was not verified.", "sources": [ { "title": "El Govern aprova un codi ètic sobre Intel·ligència Artificial (IA) (Govern d'Andorra)", "url": "https://www.govern.ad/ca/w/el-govern-aprova-un-codi-etic-sobre-intel-ligencia-artificial-ia-1", "date": "2024-05-02", "publisherClass": "official" }, { "title": "El Govern signa el Conveni marc del Consell d'Europa en intel·ligència artificial i drets humans, democràcia i estat de dret (Govern d'Andorra)", "url": "https://www.govern.ad/ca/w/el-govern-signa-el-conveni-marc-del-consell-d-europa-en-intel-ligencia-artificial-i-drets-humans-democracia-i-estat-de-dret-1", "date": "2024-09-05", "publisherClass": "official" } ] } }, "laws": [ { "name": "Llei 20/2017 de drets i deures dels usuaris i dels professionals del sistema sanitari i sobre la història clínica", "level": "National", "year": "2017", "what": "Record access in five working days, access trail on request, shared national record, research consent, fines to 100,000 euros.", "url": "http://portaljuridicandorra.ad/L2017020" }, { "name": "Llei 29/2021 qualificada de protecció de dades personals", "level": "National", "year": "2021", "what": "GDPR-style data law: health as special category, 72-hour breach notice, fines up to 100,000 euros.", "url": "http://portaljuridicandorra.ad/L2021029" }, { "name": "Decret 305/2026, Reglament de l'accés a l'Assistència Sanitària Pública", "level": "National", "year": "2026", "what": "Makes the shared record the main tool for coordination and routes internal referrals through it.", "url": "https://www.portaljuridicandorra.ad/R20260729B" }, { "name": "Council of Europe Framework Convention on Artificial Intelligence (signed by Andorra)", "level": "Supranational", "year": "2024", "what": "Binding human-rights treaty on AI; Andorra signed in Vilnius on 5 September 2024.", "url": "https://www.govern.ad/ca/w/el-govern-signa-el-conveni-marc-del-consell-d-europa-en-intel-ligencia-artificial-i-drets-humans-democracia-i-estat-de-dret-1" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-09-03", "headline": "Data regulator rebukes two private clinics for passing patient files without consent", "paraphrase": "Acting on one person's complaint, the data protection authority found that a closing clinic handed clinical files to another clinic without consent or notice, and that both lacked safeguards. It warned both and ordered proof of compliance.", "source": "Diari d'Andorra", "url": "https://www.diariandorra.ad/nacional/250903/amonestats-dos-centres-psicologia-per-cedir-dades-cliniques-forma-irregular_179510.html", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-10-31", "headline": "Doctors say patient files became hard to find after national record system update", "paraphrase": "Several doctors told the newspaper that after a software update to the national shared record, some patients' files could not be found and some entries did not match earlier data, lengthening waits. The operator said the system worked normally.", "source": "Diari d'Andorra", "url": "https://www.diariandorra.ad/nacional/241031/historial-clinic-caotic_160930.html", "theme": "other", "status": "alleged" } ] }, { "iso3": "ARM", "name": "Armenia", "region": "Europe", "overall": 57, "rank": "34=", "likelyRank": "17 to 46", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Armenia's single national e-health system lets patients approve, block and audit each doctor's access, but many state bodies can see records without consent.", "categories": { "access": { "score": 62, "summary": "The law gives patients a right to see and copy their medical files, and the ArMed portal shows diagnoses, services and tests entered by clinics. How complete the portal is for privately paid care was not verified.", "sources": [ { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Arts. 8 and 14", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Protection of Personal Data (2015), Art. 15", "url": "https://www.arlis.am/hy/acts/229131", "date": "undated", "publisherClass": "legal_text" }, { "title": "ArMed: For the patient (personal page features)", "url": "https://corporate.armed.am/", "date": "undated", "publisherClass": "official" }, { "title": "ArMed: About the system", "url": "https://corporate.armed.am/about-system", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 70, "summary": "Since 31 December 2025 a doctor sees a patient's wider history only after the patient approves the request in the ArMed site or app, choosing full history, a summary or listed diagnoses. Consent can be revoked, and patients see every viewing.", "sources": [ { "title": "Minister of Health Order N 40-N on viewing patient data in the e-health system (2021, rewritten by Order N 159-N, December 2025)", "url": "https://www.arlis.am/hy/acts/219158", "date": "2025-12-30", "publisherClass": "legal_text" }, { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Art. 11", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "ArMed: Data protection and security", "url": "https://corporate.armed.am/for-patient/data-protection", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "Health data is a special category that needs consent under the 2015 data law, and leaks must be announced and reported to police and the regulator. Fines of 50,000 to 500,000 dram are low, and no health-sector enforcement was found.", "sources": [ { "title": "Law on Protection of Personal Data (2015), Arts. 3, 12, 21, 24", "url": "https://www.arlis.am/hy/acts/229131", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law HO-447-N amending the Law on Protection of Personal Data", "url": "https://www.arlis.am/hy/acts/218679", "date": "2025-12-25", "publisherClass": "legal_text" }, { "title": "Your Guide to Personal Data Protection in Armenia (MB Legal)", "url": "https://mblegal.am/your-guide-to-personal-data-protection-in-armenia/", "date": "undated", "publisherClass": "law_firm" }, { "title": "ArMed: General rules on use and data privacy, v1.05", "url": "https://corporate.armed.am/privacy-policy", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 62, "summary": "One national system, ArMed, carries clinical, administrative and payment data, and the government says births and vaccinations are fully digital and prescriptions and sick notes run digitally. Lab results were still being digitised in January 2026.", "sources": [ { "title": "Nikol Pashinyan reviews Ministry of Health report (Prime Minister's Office)", "url": "https://www.primeminister.am/ru/press-release/item/2026/01/05/Nikol-Pashinyan-report-Ministry-Health/", "date": "2026-01-05", "publisherClass": "official" }, { "title": "Universal health insurance enters into force from 1 January 2026 (Prime Minister's Office)", "url": "https://www.primeminister.am/hy/press-release/item/2025/12/25/Cabinet-meeting/", "date": "2025-12-25", "publisherClass": "official" }, { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Art. 8", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "Minister of Health Order N 40-N on viewing patient data in the e-health system (2021, rewritten by Order N 159-N, December 2025)", "url": "https://www.arlis.am/hy/acts/219158", "date": "2025-12-30", "publisherClass": "legal_text" } ] }, "commercial": { "score": 50, "summary": "By law the de-identified ArMed database belongs to the state, and the private concession operator says it cannot transfer or sell it. No specific ban on health data brokers or health ads was found.", "sources": [ { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Art. 8", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "ArMed: Clarification on ArMed functions", "url": "https://corporate.armed.am/news/472-%D5%BA%D5%A1%D6%80%D5%A6%D5%A1%D5%A2%D5%A1%D5%B6%D5%B8%D6%82%D5%B4%D5%9D-%D5%A1%D6%80%D5%B4%D5%A5%D5%A4-%D5%AB-%D5%A3%D5%B8%D6%80%D5%AE%D5%A1%D5%BC%D5%B8%D6%82%D5%B5%D5%A9%D5%B6%D5%A5%D6%80%D5%AB-%D5%B4%D5%A1%D5%BD%D5%AB%D5%B6-4", "date": "2026-08-26", "publisherClass": "official" }, { "title": "ArMed: General rules on use and data privacy, v1.05", "url": "https://corporate.armed.am/privacy-policy", "date": "undated", "publisherClass": "official" }, { "title": "Law on Protection of Personal Data (2015), Art. 12", "url": "https://www.arlis.am/hy/acts/229131", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 48, "summary": "A doctor sees the cases they treated, and other history only once the patient approves a request in the system. In an emergency only summary data shows, and only if the patient has switched emergency access on.", "sources": [ { "title": "Minister of Health Order N 40-N on viewing patient data in the e-health system (2021, rewritten by Order N 159-N, December 2025)", "url": "https://www.arlis.am/hy/acts/219158", "date": "2025-12-30", "publisherClass": "legal_text" }, { "title": "Nikol Pashinyan reviews Ministry of Health report (Prime Minister's Office)", "url": "https://www.primeminister.am/ru/press-release/item/2026/01/05/Nikol-Pashinyan-report-Ministry-Health/", "date": "2026-01-05", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Researchers may use de-identified records freely and identifiable ones without consent only under the data law's research rules. No opt-out exists, and a January 2026 paper says Armenia has no biobanking law.", "sources": [ { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Arts. 11, 12", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "Development of biobanking infrastructure in Armenia (Frontiers in Public Health)", "url": "https://www.frontiersin.org/journals/public-health/articles/10.3389/fpubh.2025.1749588/full", "date": "2026-01-13", "publisherClass": "academic" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Joint statement on Armenia's EU accession law (European Parliament)", "url": "https://www.europarl.europa.eu/delegations/en/joint-statement-on-the-adoption-by-the-n/product-details/20250326DPU39920", "date": "2025-03-26", "publisherClass": "intergov" } ] }, "ai": { "score": 40, "summary": "Medical devices, including software, fall under Eurasian Economic Union rules adopted into Armenian law in 2022. No rule on AI change control, transparency or human oversight in care was found.", "sources": [ { "title": "Law amending the Law on Medical Assistance (medical devices chapter), 6 July 2022", "url": "https://www.arlis.am/hy/acts/166215", "date": "2022-07-06", "publisherClass": "legal_text" }, { "title": "Law on Medical Assistance and Service of the Population (HO-42, 1996), Art. on clinical trials of medical devices", "url": "http://www.irtek.am/views/act.aspx?aid=1398", "date": "undated", "publisherClass": "legal_text" }, { "title": "EAEU adopts recommendations on medical device registration (Eurasian Economic Commission)", "url": "https://eec.eaeunion.org/hy/news/prinyaty-rekomendatsii-po-registratsii-meditsinskikh-izdeliy-v-eaes-/", "date": "2024-12-23", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Law on Medical Assistance and Service of the Population (HO-42)", "level": "National", "year": "1996", "what": "Patient right to files and copies, medical secrecy, e-health system rules, research use of records.", "url": "http://www.irtek.am/views/act.aspx?aid=1398" }, { "name": "Law on Protection of Personal Data (HO-49-N)", "level": "National", "year": "2015", "what": "Health is special category data needing consent; free access in five days; leak reporting.", "url": "https://www.arlis.am/hy/acts/229131" }, { "name": "Minister of Health Order N 40-N", "level": "National", "year": "2021", "what": "Doctors see wider history only with patient consent in the app; emergency shows summary only; access log.", "url": "https://www.arlis.am/hy/acts/219158" }, { "name": "Law on Universal Health Insurance", "level": "National", "year": "2025", "what": "Creates insurance fund and electronic register; first groups covered from 1 January 2026.", "url": "https://www.arlis.am/hy/acts/230432" }, { "name": "Law HO-447-N amending the personal data law", "level": "National", "year": "2025", "what": "Moves security rules for information systems to an autonomous body.", "url": "https://www.arlis.am/hy/acts/218679" }, { "name": "Law amending the medical law on medical devices", "level": "National", "year": "2022", "what": "Medical devices, including software, regulated under EAEU treaty and commission decisions.", "url": "https://www.arlis.am/hy/acts/166215" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-09-10", "headline": "Former doctors allege a regional hospital recorded patients who were never treated", "paraphrase": "Former doctors told investigative reporters that hospital management entered names of people who were not ill as state-funded patients, inflating patient numbers. The health ministry referred the claims to anti-corruption investigators; management called them absurd.", "source": "Hetq", "url": "https://hetq.am/hy/article/176726", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "CZE", "name": "Czechia", "region": "Europe", "overall": 57, "rank": "34=", "likelyRank": "16 to 46", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Czechia added an opt-out shared record and the EZKarta app in 2026, but the record is still thin and research use needs no consent.", "categories": { "access": { "score": 60, "summary": "Patients have a legal right to copy their records, and the first copy has been free since 1 October 2024. The EZKarta app shows labs, prescriptions, vaccinations and some hospital documents, but it is still partial, with about 34,000 daily users.", "sources": [ { "title": "Vykladove stanovisko k § 66 odst. 3 zakona o zdravotnich sluzbach (Ministerstvo zdravotnictvi)", "url": "https://mzd.gov.cz/wp-content/uploads/2024/11/Vykladove-stanovisko-k-ustanoveni-%C2%A7-66-odst.-3-zakona-o-zdravotnich-sluzbach-ve-zneni-zakona-c.-240-2024-Sb.pdf", "date": "2024-11", "publisherClass": "official" }, { "title": "Ministerstvo zdravotnictvi spousti novou generaci EZKarty (MZ CR)", "url": "https://mzd.gov.cz/tiskove-centrum-mz/ministerstvo-zdravotnictvi-spousti-novou-generaci-ezkarty-pripomene-preventivni-vysetreni-a-zpristupni-dulezite-zdravotni-informace/", "date": "2026-09-03", "publisherClass": "official" }, { "title": "Nova EZKarta zpristupni pacientum laboratorni vysledky (DigitalHealth.cz)", "url": "https://www.digitalhealth.cz/nova-ezkarta-laboratorni-vysledky-prevence/", "date": "2026-09-03", "publisherClass": "news" }, { "title": "Zdravotnicka dokumentace (NZIP)", "url": "https://www.nzip.cz/clanek/1074-zdravotnicka-dokumentace", "date": "2024-01-31", "publisherClass": "official" } ] }, "control": { "score": 64, "summary": "Clinicians can see the shared health record and the medication record unless the patient objects, and patients can allow named doctors only. The medication record shows patients who viewed it; an access log for the newer shared record was not verified.", "sources": [ { "title": "Zakon c. 325/2021 Sb., o elektronizaci zdravotnictvi (zneni od 1. 4. 2026)", "url": "https://www.zakonyprolidi.cz/cs/2021-325", "date": "2026-04-01", "publisherClass": "legal_text" }, { "title": "Vyjadreni souhlasu/nesouhlasu s nahlizenim na lekovy zaznam (Portal verejne spravy)", "url": "https://portal.gov.cz/sluzby-vs/vyjadreni-souhlasunesouhlasu-s-nahlizenim-na-lekovy-zaznam-S11085", "date": "undated", "publisherClass": "official" }, { "title": "System Sdileny zdravotni zaznam (NCEZ)", "url": "https://ncez.mzcr.cz/cs/node/5545", "date": "undated", "publisherClass": "official" }, { "title": "Zabezpeceni lekoveho zaznamu (SUKL, epreskripce.gov.cz)", "url": "https://epreskripce.gov.cz/zabezpeceni-lekoveho-zaznamu/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 56, "summary": "GDPR and the 2019 Data Protection Act apply, but the regulator's 2025 fines went mostly to marketing cases and no health-sector fine was found. Czech law bars GDPR fines on public bodies, and a health database leaked in August 2026.", "sources": [ { "title": "Vyrocni zprava UOOU za rok 2025", "url": "https://www.ochranaudaju.cz/aktuality/vyrocni-zprava-uoou-za-rok-2025", "date": "2026-03-20", "publisherClass": "official" }, { "title": "Zakon c. 110/2019 Sb., o zpracovani osobnich udaju", "url": "https://www.zakonyprolidi.cz/cs/2019-110", "date": "2019-04-24", "publisherClass": "legal_text" }, { "title": "Kamery v nemocnicich maji sva pravidla (Zdravotnicky denik)", "url": "https://www.zdravotnickydenik.cz/2026/08/kamery-v-nemocnicich-maji-sva-pravidla-uoou-vymezil-kde-konci-ochrana-a-zacina-smirovani/", "date": "2026-08-18", "publisherClass": "news" }, { "title": "Kyberneticke incidenty v CR v srpnu (Feedit)", "url": "https://feedit.cz/2026/09/14/kyberneticke-incidenty-v-cr-v-srpnu-ransomware-uderil-na-zdravotnictvi-vyrobu-i-it-sluzby-unikla-citliva-data-pacientu/", "date": "2026-09-14", "publisherClass": "news" } ] }, "journey": { "score": 55, "summary": "E-prescriptions have been mandatory since 2018 and feed a national medication record, but the shared hospital record covers just over 30 hospitals. E-referrals started on 2 January 2026 as a voluntary pilot.", "sources": [ { "title": "O eReceptu (SUKL, epreskripce.gov.cz)", "url": "https://epreskripce.gov.cz/o-ereceptu/", "date": "undated", "publisherClass": "official" }, { "title": "Portal lekare a pacienta: spusteni novych digitalnich sluzeb (MZ CR)", "url": "https://mzd.gov.cz/tiskove-centrum-mz/spusteni-nove-digitalni-sluzby-portal-lekare-a-pacienta/", "date": "2025-12-31", "publisherClass": "official" }, { "title": "Zakon c. 236/2025 Sb., novela zakona o elektronizaci zdravotnictvi", "url": "https://www.zakonyprolidi.cz/cs/2025-236", "date": "2025-06-12", "publisherClass": "legal_text" }, { "title": "Ministerstvo zdravotnictvi spousti novou generaci EZKarty (MZ CR)", "url": "https://mzd.gov.cz/tiskove-centrum-mz/ministerstvo-zdravotnictvi-spousti-novou-generaci-ezkarty-pripomene-preventivni-vysetreni-a-zpristupni-dulezite-zdravotni-informace/", "date": "2026-09-03", "publisherClass": "official" } ] }, "commercial": { "score": 60, "summary": "GDPR requires an explicit legal basis for any commercial use of health data, and the EU health data space will bar reuse for marketing. No Czech law specific to health data brokers or consumer health apps was found.", "sources": [ { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" }, { "title": "Vyrocni zprava UOOU za rok 2025", "url": "https://www.ochranaudaju.cz/aktuality/vyrocni-zprava-uoou-za-rok-2025", "date": "2026-03-20", "publisherClass": "official" }, { "title": "Art. 83 GDPR (gdpr-info.eu)", "url": "https://gdpr-info.eu/art-83-gdpr/", "date": "undated", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 52, "summary": "Any treating clinician can see the emergency record (blood type, allergies, drug reactions, 12 months of medicines) and the medication record unless the patient objects. Full notes from other providers are shared only by the 30-plus hospitals connected so far.", "sources": [ { "title": "Zakon c. 325/2021 Sb., o elektronizaci zdravotnictvi (zneni od 1. 4. 2026)", "url": "https://www.zakonyprolidi.cz/cs/2021-325", "date": "2026-04-01", "publisherClass": "legal_text" }, { "title": "System Sdileny zdravotni zaznam (NCEZ)", "url": "https://ncez.mzcr.cz/cs/node/5545", "date": "undated", "publisherClass": "official" }, { "title": "O eReceptu (SUKL, epreskripce.gov.cz)", "url": "https://epreskripce.gov.cz/o-ereceptu/", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "National health registers collect data without consent and with no opt-out, a design the Constitutional Court upheld in 2020. Safeguards include non-public registers, access limited by law, and synthetic and aggregate data for researchers.", "sources": [ { "title": "Vyhlaseni nalezu Ustavniho soudu sp. zn. Pl. US 33/16", "url": "https://www.usoud.cz/aktualne/vyhlaseni-nalezu-ustavniho-soudu-sp-zn-pl-us-33-16-dne-18-listopadu-2020-rozhodnuti-zverejnene-s-tiskovou-zpravou", "date": "2020-11-18", "publisherClass": "official" }, { "title": "Zadosti o vystupy NZIS (UZIS CR)", "url": "https://www.uzis.cz/index.php?pg=kontakt--zadosti-vystupy-nzis", "date": "undated", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under the EU AI Act and EU device rules only. A national AI law naming the telecoms office (CTU) as main supervisor was a draft in February 2026, and we did not verify that it has passed.", "sources": [ { "title": "2. srpna 2026 jako klicove datum pro pravidla transparentnosti podle Aktu o AI (CTU)", "url": "https://ctu.gov.cz/tiskova-zprava-2.-srpna-2026-jako-klicove-datum-pro-pravidla-transparentnosti-podle-aktu-o-umele", "date": "2026-07-31", "publisherClass": "official" }, { "title": "AI Act v praxi: cesky adaptacni zakon (LeitnerLaw)", "url": "https://www.leitnerlaw.cz/novinky/ai-act-v-praxi-cesky-adaptacni-zakon-vymezuje-kompetence-postupy-a-sankce/", "date": "2026-02-26", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health is special-category data; free first copy; fines up to EUR 20M or 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "Act 110/2019 Sb. on Personal Data Processing", "level": "National", "year": "2019", "what": "Czech GDPR implementing act; regulator refrains from fining public bodies under GDPR Art. 83(7).", "url": "https://www.zakonyprolidi.cz/cs/2019-110" }, { "name": "Act 372/2011 Sb. on Health Services (as amended by Act 240/2024)", "level": "National", "year": "2011", "what": "Right to view and copy records; first copy free since 1 October 2024; basis for NZIS registers.", "url": "https://mzd.gov.cz/wp-content/uploads/2024/11/Vykladove-stanovisko-k-ustanoveni-%C2%A7-66-odst.-3-zakona-o-zdravotnich-sluzbach-ve-zneni-zakona-c.-240-2024-Sb.pdf" }, { "name": "Act 325/2021 Sb. on the Electronisation of Healthcare", "level": "National", "year": "2021", "what": "Shared health record with patient objection, authorisation register, activity journal, EZKarta.", "url": "https://www.zakonyprolidi.cz/cs/2021-325" }, { "name": "Act 236/2025 Sb. amending the eHealth Act", "level": "National", "year": "2025", "what": "Adds shared health record, eZadanka e-referrals and EZKarta; in force 1 January 2026.", "url": "https://www.zakonyprolidi.cz/cs/2025-236" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Free access, restriction rights, opt-out from secondary use, ban on marketing use; phased from 2027.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-07-18", "headline": "Court upholds fine on clinic that failed to report a patient data breach", "paraphrase": "A cyberattack left a private clinic's patient records unreachable for a week. The clinic, holding data on about 250,000 patients, did not report it in time and could not prove it told patients. The court confirmed a 309,000 crown fine.", "source": "oPojištění.cz (reporting a Supreme Administrative Court ruling of 21 May 2025)", "url": "https://www.opojisteni.cz/legislativa/zkontrolujte-si-proces-pro-rizeni-incidentu-jinak-vam-hrozi-pokuta/c:29468/", "theme": "breach", "status": "finding" }, { "date": "2025-07-09", "headline": "Hospital warns patients a ransomware attack may have exposed their record data", "paraphrase": "After ransomware shut down its systems, a hospital told patients that personal data linked to their medical records may have been stolen. It could not yet confirm whether or how much was taken, and notified the data protection office.", "source": "ČT24 (Česká televize)", "url": "https://ct24.ceskatelevize.cz/clanek/domaci/pri-kyberutoku-na-nemocnici-nymburk-mohla-uniknout-data-pacientu-362785", "theme": "breach", "status": "admitted" }, { "date": "2026-09-14", "headline": "Hackers offer a Czech health facility's patient records for sale", "paraphrase": "A security firm reported that a hacking group stole a database from an unnamed Czech health facility and offered it for sale. It reportedly held patient contacts with health records, booking details with payment and insurance data, and staff profiles.", "source": "Aktuálně.cz", "url": "https://zpravy.aktualne.cz/ekonomika/hackeri-v-srpnu-odcizili-pacientska-data-zdravotnickeho-zarizeni-v-cesku/r~aaa29d5cab5ab9aa374fead6cec97e1a/", "theme": "breach", "status": "alleged" }, { "date": "2025-05-28", "headline": "Hospital lost control of a computer holding examination images of about 1,900 patients", "paraphrase": "A clinic computer storing images and data from nearly two thousand examinations disappeared for four days, then reappeared. The hospital's internal review called it a data incident, its director confirmed it, and it was reported to the data protection office.", "source": "Seznam Zprávy", "url": "https://www.seznamzpravy.cz/clanek/domaci-kauzy-intimni-snimky-pacientu-nic-se-nedeje-rika-exministr-o-zmizeni-pocitace-277656", "theme": "breach", "status": "admitted" } ] }, { "iso3": "GRC", "name": "Greece", "region": "Europe", "overall": 57, "rank": "34=", "likelyRank": "17 to 46", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Greece put one national record in every patient's phone in 2025, but hospital archives are not yet digitised and per-doctor consent is unclear.", "categories": { "access": { "score": 66, "summary": "Since May 2025 the national record (EHFY) shows diagnoses, prescriptions, test results and hospital stays in the MyHealth app and citizen portal. The EC still ranks Greece below the EU average, with no imaging reports in its 2024 data.", "sources": [ { "title": "Ο Εθνικός Ηλεκτρονικός Φάκελος Υγείας (EHFY overview)", "url": "https://ehealthrecord.gov.gr/ehfy-overview-details", "date": "undated", "publisherClass": "official" }, { "title": "Commencement of the new digital platform for the National Electronic Health Record (NEHR)", "url": "https://www.ehealthrecord.gov.gr/en/press-releases/%CE%B7%CE%BC-%CE%B5%CE%B7%CF%86%CF%85-golive", "date": "2025-05", "publisherClass": "official" }, { "title": "2025 Digital Decade eHealth indicator study (European Commission)", "url": "https://op.europa.eu/en/publication-detail/-/publication/bb5838fe-4742-11f0-85ba-01aa75ed71a1/language-en", "date": "2025", "publisherClass": "intergov" }, { "title": "State of Health in the EU: Greece Country Health Profile 2025 (European Commission, OECD)", "url": "https://health.ec.europa.eu/document/download/b9b4092c-b357-4ae3-8d82-d9a252e7e159_en?filename=2025_chp_gr_english.pdf", "date": "2025", "publisherClass": "intergov" } ] }, "control": { "score": 46, "summary": "Greek law logs every access to the record and lets the patient be told who looked and when. The 2019 law only requires that patients be informed of clinician access; a per-doctor consent or opt-out in the live platform is not verified.", "sources": [ { "title": "Νόμος 4600/2019, Άρθρο 84: Ατομικός Ηλεκτρονικός Φάκελος Υγείας (Ministry of Health)", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732", "date": "2019-03-09", "publisherClass": "legal_text" }, { "title": "Ο Εθνικός Ηλεκτρονικός Φάκελος Υγείας (EHFY overview)", "url": "https://ehealthrecord.gov.gr/ehfy-overview-details", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 56, "summary": "The Data Protection Authority does act on hospital breaches, fining Thessaloniki's G. Gennimatas hospital 25,000 euros in September 2026 for posting 2,820 patients' diagnoses online. Fines are small and the case took two years.", "sources": [ { "title": "Πρόστιμο 25.000 ευρώ στο νοσοκομείο Γ. Γεννηματάς στη Θεσσαλονίκη (To Pontiki)", "url": "https://www.topontiki.gr/2026/09/29/prostimo-25-000-evro-sto-nosokomio-g-gennimatas-sti-thessaloniki-gia-diarroi-prosopikon-stichion-2-820-asthenon/", "date": "2026-09-29", "publisherClass": "news" }, { "title": "Δεδομένα υγείας: Συχνές ερωτήσεις (Αρχή Προστασίας Δεδομένων)", "url": "https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/eidikeskatigories/dedomenaugeias/faq_dedomena_ugeias", "date": "undated", "publisherClass": "official" }, { "title": "Νόμος 4600/2019, Άρθρο 84 (Ministry of Health)", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732", "date": "2019-03-09", "publisherClass": "legal_text" } ] }, "journey": { "score": 62, "summary": "National e-prescription and e-referral, run by IDIKA since 2010, feed one record for public and private care. From 1 September 2026 EOPYY-contracted labs must upload results to be paid, but hospital archives remain undigitised.", "sources": [ { "title": "Άρθρο 3, Νόμος 3892/2010 (Lawspot)", "url": "https://www.lawspot.gr/nomothesia/n3892-2010/arthro-3-nomos-3892-2010/", "date": "2010-11-04", "publisherClass": "legal_text" }, { "title": "Νόμος 4600/2019, Άρθρο 84 (Ministry of Health)", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732", "date": "2019-03-09", "publisherClass": "legal_text" }, { "title": "Από τον Σεπτέμβριο οι απεικονιστικές εξετάσεις στο myHealth app (Iatronet)", "url": "https://www.iatronet.gr/article/142194/apo-ton-septemvrio-oi-apeikonistikes-exetaseis-sto-myhealth-app-leitoyrgia-kai-prosvash", "date": "2026-08-14", "publisherClass": "news" }, { "title": "Άδωνις Γεωργιάδης: Αλλάζουν όλα στα νοσοκομεία και γίνονται ηλεκτρονικά μέχρι το καλοκαίρι του 2026 (Ethnos)", "url": "https://www.ethnos.gr/health/article/401035/adonisgeorgiadhsallazoynolastanosokomeiakaiginontaihlektronikamexritokalokairitoy2026", "date": "2026-03-11", "publisherClass": "news" } ] }, "commercial": { "score": 62, "summary": "Law 4600/2019 bans employers, insurers and banks from using record data for other purposes, and the patient cannot waive that ban. The Ministry may still sell aggregate anonymised statistics, and a 2026 bill would open data to companies.", "sources": [ { "title": "Νόμος 4600/2019, Άρθρο 84 (Ministry of Health)", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732", "date": "2019-03-09", "publisherClass": "legal_text" }, { "title": "Η νέα πραγματικότητα της ψηφιακής υγείας: Ποιος θα έχει πρόσβαση στα δεδομένα (Iatropedia)", "url": "https://www.iatropedia.gr/eidiseis/i-nea-pragmatikotita-tis-psifiakis-ygeias-poios-tha-echei-prosvasi-sta-dedomena-ekatommyrion-asthenon-kai-me-poious-orous/227674/", "date": "2026-07-31", "publisherClass": "news" }, { "title": "Εγκρίθηκε από το υπουργικό συμβούλιο το νομοσχέδιο για ελεύθερη πρόσβαση στα δεδομένα υγείας (Ethnos)", "url": "https://www.ethnos.gr/health/article/416159/egkrithhkeapotoypoyrgikosymboyliotonomosxediogiaeleytherhprosbashstadedomenaygeiastiallazei", "date": "2026-07-30", "publisherClass": "news" } ] }, "clinical": { "score": 58, "summary": "Doctors in public and private care open a patient's national record through a dedicated portal, and emergency doctors can see it when a patient is unconscious. Older hospital records are still missing from it.", "sources": [ { "title": "Commencement of the new digital platform for the National Electronic Health Record (NEHR)", "url": "https://www.ehealthrecord.gov.gr/en/press-releases/%CE%B7%CE%BC-%CE%B5%CE%B7%CF%86%CF%85-golive", "date": "2025-05", "publisherClass": "official" }, { "title": "Ο Εθνικός Ηλεκτρονικός Φάκελος Υγείας (EHFY overview)", "url": "https://ehealthrecord.gov.gr/ehfy-overview-details", "date": "undated", "publisherClass": "official" }, { "title": "Από τον Σεπτέμβριο οι απεικονιστικές εξετάσεις στο myHealth app (Iatronet)", "url": "https://www.iatronet.gr/article/142194/apo-ton-septemvrio-oi-apeikonistikes-exetaseis-sto-myhealth-app-leitoyrgia-kai-prosvash", "date": "2026-08-14", "publisherClass": "news" }, { "title": "Άδωνις Γεωργιάδης: Αλλάζουν όλα στα νοσοκομεία και γίνονται ηλεκτρονικά μέχρι το καλοκαίρι του 2026 (Ethnos)", "url": "https://www.ethnos.gr/health/article/401035/adonisgeorgiadhsallazoynolastanosokomeiakaiginontaihlektronikamexritokalokairitoy2026", "date": "2026-03-11", "publisherClass": "news" } ] }, "research": { "score": 44, "summary": "Today research uses anonymised or pseudonymised data with no individual consent and no general opt-out. A bill creating a Health Data Access Body with an EHDS opt-out passed cabinet in July 2026; its enactment is not verified.", "sources": [ { "title": "Δεδομένα υγείας: Συχνές ερωτήσεις (Αρχή Προστασίας Δεδομένων)", "url": "https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/eidikeskatigories/dedomenaugeias/faq_dedomena_ugeias", "date": "undated", "publisherClass": "official" }, { "title": "Φορέας Πρόσβασης στα Δεδομένα Υγείας, GR-HDAB (Υπουργείο Υγείας)", "url": "https://www.moh.gov.gr/articles/ehealth/gr-hdab/14291-foreas-prosbashs-sta-dedomena-ygeias", "date": "undated", "publisherClass": "official" }, { "title": "Νόμος 4600/2019, Άρθρο 84 (Ministry of Health)", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732", "date": "2019-03-09", "publisherClass": "legal_text" }, { "title": "Εγκρίθηκε από το υπουργικό συμβούλιο το νομοσχέδιο για ελεύθερη πρόσβαση στα δεδομένα υγείας (Ethnos)", "url": "https://www.ethnos.gr/health/article/416159/egkrithhkeapotoypoyrgikosymboyliotonomosxediogiaeleytherhprosbashstadedomenaygeiastiallazei", "date": "2026-07-30", "publisherClass": "news" } ] }, "ai": { "score": 54, "summary": "EU device law and the AI Act apply, and Greece adds Law 4961/2022, which makes public bodies, including public hospitals, assess and register AI systems before use. No health-specific AI rules or authority were verified.", "sources": [ { "title": "Νόμος 4961/2022 (Lawspot)", "url": "https://www.lawspot.gr/nomothesia/nomos-4961-2022/", "date": "2022-07-27", "publisherClass": "legal_text" }, { "title": "MyHealth Agent: Διαθέσιμος ο Προσωπικός Βοηθός Υγείας Πολίτη (Lawspot)", "url": "https://www.lawspot.gr/nomika-nea/myhealth-agent-diathesimos-o-prosopikos-boethos-ugeias-polite-meso-tou-myhealth-app/", "date": "2025-12-12", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 4600/2019, Article 84 (Individual Electronic Health Record)", "level": "National", "year": "2019", "what": "Lifelong national record; access logging; patient told who accessed; non-waivable ban on employer, insurer, bank use.", "url": "https://www.moh.gov.gr/articles/newspaper/nomothesia-kanonismoi/3246-nomothesia-hlektronikhs-ygeias?fdl=14732" }, { "name": "Law 3892/2010 (electronic prescriptions and referrals)", "level": "National", "year": "2010", "what": "Doctors must issue prescriptions and referrals electronically through the IDIKA system.", "url": "https://www.lawspot.gr/nomothesia/n3892-2010/arthro-3-nomos-3892-2010/" }, { "name": "Law 3418/2005 (Code of Medical Ethics), Article 14", "level": "National", "year": "2005", "what": "Patient may see and copy their medical file; files kept 20 years after last visit.", "url": "https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/eidikeskatigories/dedomenaugeias/faq_dedomena_ugeias" }, { "name": "Law 4624/2019 (GDPR implementing law)", "level": "National", "year": "2019", "what": "Article 22(1) allows research processing of health data if pseudonymised or anonymised (DPA).", "url": "https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/eidikeskatigories/dedomenaugeias/faq_dedomena_ugeias" }, { "name": "Law 4961/2022 (emerging technologies, AI)", "level": "National", "year": "2022", "what": "Public bodies must assess, disclose and register AI systems before use.", "url": "https://www.lawspot.gr/nomothesia/nomos-4961-2022/" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Access logs and EU exchange from March 2029/2031; secondary-use permits and opt-out.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-05-07", "headline": "Public hospital left its surgery waiting list, with patients' phone numbers, open online", "paraphrase": "A member of the public found, through a search engine, a hospital file listing about 2,820 patients' phone numbers and planned operations, online for months. The hospital reported late, never told patients, and was fined 25,000 euros.", "source": "Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 13/2026", "url": "https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-nosokomeio-gia-mi-tirisi-tehnikon-kai-organotikon", "theme": "breach", "status": "finding" }, { "date": "2025-04-09", "headline": "Private doctor looked up a patient's national health record without permission", "paraphrase": "A patient asked a private doctor for her full file and complained the doctor had also searched her electronic health record. The regulator found the lookup unlawful, done without her knowledge, and fined the doctor 5,000 euros.", "source": "Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 11/2025", "url": "https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-gia-mi-pliri-ikanopoiisi-dikaiomatos-prosbasis", "theme": "breach", "status": "finding" }, { "date": "2024-12-18", "headline": "Doctor kept patient's clinical photos online after she withdrew her consent", "paraphrase": "A patient complained that her doctor posted photos taken during her care on his social media page. The regulator ruled that keeping them up after she withdrew consent was unlawful and ordered his consent forms rewritten.", "source": "Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 50/2024", "url": "https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-asthenoys-gia-parabiasi-dikaiomaton-ek-meroys-iatroy", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-10-11", "headline": "Hospital doctor running for parliament texted campaign messages to former patients", "paraphrase": "People who had been treated at a public hospital received election text messages from a doctor there who was a candidate. He could not show how he got their numbers; the regulator fined him 15,000 euros.", "source": "Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ), decision 37/2024", "url": "https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-ypopsifio-boyleyti-iatro-dimosioy-nosokomeioy-gia", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-02-01", "headline": "Hospital said it could not supply copies of past scans after a cyberattack", "paraphrase": "A man asked a university hospital for copies of his wife's earlier test results. The hospital replied it had no access to its electronic system because of a cyberattack; the outlet reports other patients got the same answer.", "source": "in.gr", "url": "https://www.in.gr/2025/02/01/health/nosokomeio-axepa-anapantita-erotimata-gia-endexomeni-diarroi-eyaisthiton-prosopikon-dedomenon-asthenon/", "theme": "access_refused", "status": "alleged" } ] }, { "iso3": "JPN", "name": "Japan", "region": "Asia", "overall": 56, "rank": "38=", "likelyRank": "19 to 48", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Japanese patients see five years of claims-based records online and choose at each visit what doctors see, but full charts stay with each provider.", "categories": { "access": { "score": 62, "summary": "The privacy law gives a right to a copy, electronic on request, and Mynaportal shows five years of claims-based treatment and medicine data. The law sets no fixed deadline and allows fees, so full charts still come provider by provider.", "sources": [ { "title": "Act on the Protection of Personal Information (Act No. 57 of 2003), e-Gov law text", "url": "https://laws.e-gov.go.jp/law/415AC0000000057", "date": "undated", "publisherClass": "legal_text" }, { "title": "On the guideline for providing medical information: disclosure costs (MHLW notice)", "url": "https://www.mhlw.go.jp/web/t_doc?dataId=00tc3511&dataType=1&pageNo=1", "date": "2018-07-20", "publisherClass": "official" }, { "title": "How many years of treatment and medicine data can be viewed? (Mynaportal FAQ 4902)", "url": "https://faq.myna.go.jp/faq/show/4902?category_id=107&site_domain=default", "date": "2026-05-12", "publisherClass": "official" }, { "title": "Digital Agency at five years (Digital Agency)", "url": "https://www.digital.go.jp/policies/report-2026", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 62, "summary": "At each visit the patient chooses, item by item, whether the clinic may see past treatment, medicine and checkup data, and Mynaportal lists who received it. Hospital viewing without consent in emergencies, even for conscious patients, keeps the score low in its band.", "sources": [ { "title": "Using the My Number card as a health insurance card (Digital Agency)", "url": "https://www.digital.go.jp/policies/mynumber/insurance-card", "date": "undated", "publisherClass": "official" }, { "title": "Medical insurance information provision history (Mynaportal)", "url": "https://myna.go.jp/medical-info-sharing-histories", "date": "undated", "publisherClass": "official" }, { "title": "Emergency medical information viewing: overview for hospitals (MHLW)", "url": "https://www.mhlw.go.jp/content/10200000/001243478.pdf", "date": "2026-06", "publisherClass": "official" }, { "title": "Reference materials, 16th meeting of the review panel on use of medical information (Cabinet Office)", "url": "https://www8.cao.go.jp/iryou/studygloup/20260911/pdf/s-2.pdf", "date": "2026-09-11", "publisherClass": "official" } ] }, "privacy": { "score": 58, "summary": "Medical history is 'special care-required' data, breaches must be reported, and the commission is independent by law. Most sensitive-data leaks come from hospitals and pharmacies, and the regulator cannot impose administrative fines until the 2026 surcharge takes effect.", "sources": [ { "title": "Act on the Protection of Personal Information (Act No. 57 of 2003), e-Gov law text", "url": "https://laws.e-gov.go.jp/law/415AC0000000057", "date": "undated", "publisherClass": "legal_text" }, { "title": "Handling of breach reports, FY2025 Q3 (PPC)", "url": "https://www.ppc.go.jp/files/pdf/260311quarter-report_roueihoukoku.pdf", "date": "2026-03-11", "publisherClass": "official" }, { "title": "Report on personal data leak from cyberattack, 2nd report (Nippon Medical School Musashi Kosugi Hospital)", "url": "https://www.nms.ac.jp/kosugi-h/news/_28832.html", "date": "2026-02-14", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 48, "summary": "Claims-based records reach providers through the My Number card, used in 68.15% of visits in April 2026, and 90.5% of pharmacies handle e-prescriptions. Only 29.5% of clinics and 20.9% of hospitals issue them, and the national EHR sharing service was still in model trials.", "sources": [ { "title": "Smooth use of the My Number insurance card, Medical Insurance Subcommittee material 3 (MHLW)", "url": "https://www.mhlw.go.jp/content/12401000/001712851.pdf", "date": "2026-06-18", "publisherClass": "official" }, { "title": "Progress of electronic prescriptions, Medical Insurance Subcommittee material 4 (MHLW)", "url": "https://www.mhlw.go.jp/content/12401000/001742903.pdf", "date": "2026-08-27", "publisherClass": "official" }, { "title": "EHR Information Sharing Service overview v2.1 (MHLW)", "url": "https://www.mhlw.go.jp/content/10800000/001457777.pdf", "date": "2026-07-21", "publisherClass": "official" }, { "title": "Report on passage of the Act amending the Medical Care Act (MHLW)", "url": "https://www.mhlw.go.jp/content/10801000/001606327.pdf", "date": "2025-12-08", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Health data cannot go to third parties by opt-out, but certified operators and the NDB supply processed data to drug makers and other firms. In August 2026 the regulator warned about municipal claims data reaching pharma marketing and insurance underwriting.", "sources": [ { "title": "Act on the Protection of Personal Information (Act No. 57 of 2003), e-Gov law text", "url": "https://laws.e-gov.go.jp/law/415AC0000000057", "date": "undated", "publisherClass": "legal_text" }, { "title": "Material 4, 1st meeting of the review panel on use of medical information (Cabinet Office)", "url": "https://www8.cao.go.jp/iryou/studygloup/20250903/pdf/s-4.pdf", "date": "2025-09-03", "publisherClass": "official" }, { "title": "Caution on use of claims data held by local governments (PPC)", "url": "https://www.ppc.go.jp/files/pdf/260819_02_houdou.pdf", "date": "2026-08-19", "publisherClass": "official" }, { "title": "Overview of the Act amending the APPI (PPC)", "url": "https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf", "date": "2026-07-17", "publisherClass": "official" } ] }, "clinical": { "score": 52, "summary": "With consent, providers can see up to five years of claims-based treatment, surgery and medicine data, and hospitals can see it without consent in emergencies. Notes, results and images from other providers are not yet shared nationally.", "sources": [ { "title": "Provision of treatment information including surgery in online eligibility checks (MHLW)", "url": "https://www.mhlw.go.jp/content/10200000/000992343.pdf", "date": "2025-03", "publisherClass": "official" }, { "title": "Emergency medical information viewing: overview for hospitals (MHLW)", "url": "https://www.mhlw.go.jp/content/10200000/001243478.pdf", "date": "2026-06", "publisherClass": "official" }, { "title": "Reference materials, 16th meeting of the review panel on use of medical information (Cabinet Office)", "url": "https://www8.cao.go.jp/iryou/studygloup/20260911/pdf/s-2.pdf", "date": "2026-09-11", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "The NDB claims database is shared with researchers and companies without consent or opt-out, while certified operators use an opt-out. Expert review, secure cloud analysis and criminal penalties for misuse put Japan at the cap of its band.", "sources": [ { "title": "Use of the NDB claims database: third-party provision (MHLW)", "url": "https://www.mhlw.go.jp/stf/seisakunitsuite/bunya/kenkou_iryou/iryouhoken/reseputo/index.html", "date": "undated", "publisherClass": "official" }, { "title": "Act on Anonymized and Pseudonymized Medical Data for Medical R&D (Act No. 28 of 2017), e-Gov law text", "url": "https://laws.e-gov.go.jp/law/429AC0000000028", "date": "undated", "publisherClass": "legal_text" }, { "title": "Clinical Trials Act (Act No. 16 of 2017), e-Gov law text", "url": "https://laws.e-gov.go.jp/law/429AC0000000016", "date": "undated", "publisherClass": "legal_text" }, { "title": "Overview of the Act amending the APPI (PPC)", "url": "https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf", "date": "2026-07-17", "publisherClass": "official" } ] }, "ai": { "score": 60, "summary": "AI software for diagnosis or treatment is regulated as a medical device, and a change-plan route (IDATEN) has covered post-market updates since September 2020. MHLW holds the doctor responsible for AI-assisted decisions, but there is no framework for generative AI.", "sources": [ { "title": "Regulation and approval of medical AI as SaMD in Japan (Global Health & Medicine)", "url": "https://www.jstage.jst.go.jp/article/ghm/8/3/8_2026.01052/_article", "date": "2026-06-30", "publisherClass": "academic" }, { "title": "Review of medical devices using machine learning (PMDA)", "url": "https://www.pmda.go.jp/files/000265866.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Use of AI diagnostic support programs and Article 17 of the Medical Practitioners Act (MHLW notice)", "url": "https://www.pmda.go.jp/files/000227450.pdf", "date": "2018-12-19", "publisherClass": "official" }, { "title": "Full enforcement of the AI Promotion Act (Government of Japan, Highlighting Japan)", "url": "https://www.gov-online.go.jp/hlj/ja/november_2025/november_2025-08.html", "date": "2025-11", "publisherClass": "official" } ] } }, "laws": [ { "name": "Act on the Protection of Personal Information (APPI)", "level": "National", "year": "2003", "what": "Medical history is special care-required data; consent for sharing, breach reports, right to an electronic copy.", "url": "https://laws.e-gov.go.jp/law/415AC0000000057" }, { "name": "Act amending the APPI (2026)", "level": "National", "year": "2026", "what": "Consent-free sharing for statistics and AI development; profit-based surcharges; in force within two years.", "url": "https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf" }, { "name": "Act on Anonymized and Pseudonymized Medical Data for Medical R&D", "level": "National", "year": "2017", "what": "Hospitals pass data to certified operators after notice, stopping on request; re-identification prohibited.", "url": "https://laws.e-gov.go.jp/law/429AC0000000028" }, { "name": "Act amending the Medical Care Act and related laws (2025)", "level": "National", "year": "2025", "what": "Puts EHR sharing in law, targets about 100% EHR adoption by 2030, opens pseudonymised public databases.", "url": "https://www.mhlw.go.jp/content/10801000/001606327.pdf" }, { "name": "Clinical Trials Act", "level": "National", "year": "2017", "what": "Specified clinical trials need prior explanation and informed consent from participants.", "url": "https://laws.e-gov.go.jp/law/429AC0000000016" }, { "name": "AI Promotion Act", "level": "National", "year": "2025", "what": "Sets up a national AI strategy and basic plan; relies on existing law rather than binding AI rules.", "url": "https://laws.e-gov.go.jp/law/507AC0000000053" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-02-18", "headline": "Clinic says ransomware attack may have exposed up to 300,000 people's records", "paraphrase": "A clinic announced that ransomware hit its servers, possibly exposing about 300,000 patient and staff records, including contact details, medical history and checkup results. It paused new outpatient bookings and said it had consulted police.", "source": "Nikkei xTECH", "url": "https://xtech.nikkei.com/atcl/nxt/news/24/02182/", "theme": "breach", "status": "admitted" }, { "date": "2026-02-16", "headline": "Hospital confirms attackers stole patient details through a maintenance VPN", "paraphrase": "A university hospital announced that a ransomware attack, entering through a VPN device used for medical equipment maintenance, led to the theft of names, addresses, birth dates and patient IDs of about 10,000 patients.", "source": "INTERNET Watch (Impress)", "url": "https://internet.watch.impress.co.jp/docs/news/2086066.html", "theme": "breach", "status": "admitted" }, { "date": "2026-05-01", "headline": "Hospital worker suspended for reading an acquaintance's record and telling relatives", "paraphrase": "A public hospital's administrative support worker opened an acquaintance's electronic record several times with no work reason and told her own relatives what it showed. The prefectural hospital bureau suspended her for three months.", "source": "Too Nippo (東奥日報)", "url": "https://www.toonippo.co.jp/articles/-/2264492", "theme": "breach", "status": "admitted" }, { "date": "2026-06-08", "headline": "Hospital hard drives meant for shredding turned up for sale at online auction", "paraphrase": "Hard drives two public hospitals sent for destruction were listed on internet auctions, holding names, addresses, clinical notes and nursing records for up to 510,000 people. The disposal firm said destroyed and intact drives were kept in identical containers.", "source": "Hokkaido Cultural Broadcasting (UHB)", "url": "https://www.uhb.jp/news/single.html?id=59930", "theme": "breach", "status": "admitted" }, { "date": "2026-06-11", "headline": "University hospital discloses months later that a drive with 1,800 patients' details went missing", "paraphrase": "A university hospital announced that a doctor lost a USB drive holding about 1,800 patients' personal details, collected for research, on a business trip in February. It was later recovered; the hospital judged leak risk very low.", "source": "CBnews (CBnewsマネジメント)", "url": "https://www.cbnews.jp/news/entry/20260611173555", "theme": "breach", "status": "admitted" } ] }, { "iso3": "ROU", "name": "Romania", "region": "Europe", "overall": 56, "rank": "38=", "likelyRank": "20 to 48", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Romania opened a national patient portal on 1 September 2026 with 10 years of history, but the older e-health record was largely empty.", "categories": { "access": { "score": 60, "summary": "Since 1 September 2026 the CNAS portal eSanatateaMea shows insured people their medical history from the last 10 years and prescriptions from the last 5. Score sits at the bottom of the portal band because the launch is staged and the earlier record was largely empty.", "sources": [ { "title": "A fost lansat portalul eSanatateaMea (JURIDICE.ro, preluare comunicat CNAS)", "url": "https://www.juridice.ro/848816/a-fost-lansat-portalul-esanatateamea.html", "date": "2026-09-02", "publisherClass": "news" }, { "title": "CNAS finalizeaza modernizarea platformei informatice: 100 de milioane de euro (Economedia)", "url": "https://economedia.ro/cnas-finalizeaza-modernizarea-platformei-informatice-100-de-milioane-de-euro-pentru-un-sistem-care-gestioneaza-anual-sute-de-milioane-de-servicii-medicale.html", "date": "2026-09-01", "publisherClass": "news" }, { "title": "Accesul pacientului la datele medicale (Spitalul Negresti Oas)", "url": "https://spitalnegrestioas.ro/index.php/ro/pagina-pacientului/accesul-pacientului-la-datele-medicale", "date": "undated", "publisherClass": "official" }, { "title": "Tu ai obtinut acces la dosarul electronic de sanatate pana acum? (Avocatnet.ro)", "url": "https://www.avocatnet.ro/articol_68806/Tu-ai-ob%C8%9Binut-acces-la-dosarul-electronic-de-s%C4%83n%C4%83tate-pan%C4%83-acum-Tot-ce-trebuie-s%C4%83-%C8%99tii-despre-acesta-in-2025.html", "date": "2025-04-09", "publisherClass": "news" } ] }, "control": { "score": 62, "summary": "The law lets patients choose which doctors can open their e-health record, see the full history of doctor access, and refuse the record without losing care. Whether the new portal offers these controls in practice was not verified.", "sources": [ { "title": "Legea 95/2006, Titlul IX^1 Dosarul electronic de sanatate al pacientului (introdus prin Legea 45/2019), lege5.ro", "url": "https://lege5.ro/Gratuit/gmzdgmjygy2q/dupa-titlul-ix-cardul-european-si-cardul-national-de-asigurari-sociale-de-sanatate-se-introduce-un-nou-titlu-titlul-ix1-dosarul-electronic-de-sanatate-al-pacientului-continand-articolele-3461-34612-cu?dp=gi4dcmrxgaytgny", "date": "2019", "publisherClass": "legal_text" }, { "title": "Din toamna, pacientii vor avea acces online la dosarul medical prin portalul e-Sanatatea Mea (Gazarul)", "url": "https://gazarul.ro/2026/07/16/din-toamna-pacientii-vor-avea-acces-online-la-dosarul-medical-si-isi-vor-putea-face-programari-prin-portalul-e-sanatatea-mea/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "Tu ai obtinut acces la dosarul electronic de sanatate pana acum? (Avocatnet.ro)", "url": "https://www.avocatnet.ro/articol_68806/Tu-ai-ob%C8%9Binut-acces-la-dosarul-electronic-de-s%C4%83n%C4%83tate-pan%C4%83-acum-Tot-ce-trebuie-s%C4%83-%C8%99tii-despre-acesta-in-2025.html", "date": "2025-04-09", "publisherClass": "news" } ] }, "privacy": { "score": 50, "summary": "Health data is protected by the GDPR and Law 190/2018, but public bodies first get a warning and a remediation plan before any fine. In February 2024 a ransomware attack on one hospital software system took about 100 facilities offline.", "sources": [ { "title": "Legea 190/2018 privind masuri de punere in aplicare a GDPR (text publicat)", "url": "https://www.spitalleordeni.ro/doc/date%20personale/Legea%20nr.%20190%20din%202018.pdf", "date": "2018-07-18", "publisherClass": "legal_text" }, { "title": "Ransomware Attack Knocks 100 Romanian Hospitals Offline (SecurityWeek)", "url": "https://www.securityweek.com/ransomware-attack-knocks-100-romanian-hospitals-offline/", "date": "2024-02-13", "publisherClass": "news" }, { "title": "ANSPDCP sanctioneaza un centru medical (JURIDICE.ro)", "url": "https://www.juridice.ro/772254/anspdcp-sanctioneaza-un-centru-medical-2.html", "date": "2025-02-20", "publisherClass": "news" } ] }, "journey": { "score": 60, "summary": "The CNAS platform PIAS links more than 35,000 providers: family doctors, specialists, hospitals, labs and pharmacies, with e-prescriptions and digital referrals. The record itself has been thin, and the EU cross-border health services page has no Romanian patient notice yet.", "sources": [ { "title": "CNAS finalizeaza modernizarea platformei informatice: 100 de milioane de euro (Economedia)", "url": "https://economedia.ro/cnas-finalizeaza-modernizarea-platformei-informatice-100-de-milioane-de-euro-pentru-un-sistem-care-gestioneaza-anual-sute-de-milioane-de-servicii-medicale.html", "date": "2026-09-01", "publisherClass": "news" }, { "title": "Romania 2025 Digital Decade Country Report (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/factpages/romania-2025-digital-decade-country-report", "date": "2025-06-18", "publisherClass": "intergov" }, { "title": "Electronic cross-border health services (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/digital-health-and-care/electronic-cross-border-health-services_en", "date": "undated", "publisherClass": "intergov" } ] }, "commercial": { "score": 56, "summary": "Law 190/2018 says health data processed for public health cannot later be used by third parties for other purposes. The regulator has fined a clinic for emailing promotions to patients without consent, but we found no law aimed at data brokers or health apps.", "sources": [ { "title": "Legea 190/2018 privind masuri de punere in aplicare a GDPR (text publicat)", "url": "https://www.spitalleordeni.ro/doc/date%20personale/Legea%20nr.%20190%20din%202018.pdf", "date": "2018-07-18", "publisherClass": "legal_text" }, { "title": "ANSPDCP a amendat Hilmi Medical Center (ANSPDCP)", "url": "https://www.dataprotection.ro/index.jsp?lang=ro&page=ANSPDCP_a_amendat_Hilmi_Medical_Center", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 50, "summary": "By law any doctor can open the record with the patient's consent, and emergency and family doctors can see an emergency summary without it. In 2025 doctors reported the records were so empty they were of little use.", "sources": [ { "title": "Legea 95/2006, Titlul IX^1 Dosarul electronic de sanatate al pacientului (introdus prin Legea 45/2019), lege5.ro", "url": "https://lege5.ro/Gratuit/gmzdgmjygy2q/dupa-titlul-ix-cardul-european-si-cardul-national-de-asigurari-sociale-de-sanatate-se-introduce-un-nou-titlu-titlul-ix1-dosarul-electronic-de-sanatate-al-pacientului-continand-articolele-3461-34612-cu?dp=gi4dcmrxgaytgny", "date": "2019", "publisherClass": "legal_text" }, { "title": "Tu ai obtinut acces la dosarul electronic de sanatate pana acum? (Avocatnet.ro)", "url": "https://www.avocatnet.ro/articol_68806/Tu-ai-ob%C8%9Binut-acces-la-dosarul-electronic-de-s%C4%83n%C4%83tate-pan%C4%83-acum-Tot-ce-trebuie-s%C4%83-%C8%99tii-despre-acesta-in-2025.html", "date": "2025-04-09", "publisherClass": "news" }, { "title": "Seful CNAS: Dosarul electronic de sanatate va fi disponibil pentru fiecare pacient (AGERPRES)", "url": "https://agerpres.ro/sanatate/2026/03/31/seful-cnas-dosarul-electronic-de-sanatate-va-fi-disponibil-pentru-fiecare-pacient-incepand-cu-vara-a--1542731", "date": "2026-03-31", "publisherClass": "news" }, { "title": "Din toamna, pacientii vor avea acces online la dosarul medical prin portalul e-Sanatatea Mea (Gazarul)", "url": "https://gazarul.ro/2026/07/16/din-toamna-pacientii-vor-avea-acces-online-la-dosarul-medical-si-isi-vor-putea-face-programari-prin-portalul-e-sanatatea-mea/", "date": "2026-07-16", "publisherClass": "news" } ] }, "research": { "score": 44, "summary": "The e-health record law lets health authorities use anonymised data for statistics, and we found no individual opt-out from research use. Trials follow the EU Clinical Trials Regulation under the medicines agency ANMDMR.", "sources": [ { "title": "Legea 95/2006, Titlul IX^1 Dosarul electronic de sanatate al pacientului (introdus prin Legea 45/2019), lege5.ro", "url": "https://lege5.ro/Gratuit/gmzdgmjygy2q/dupa-titlul-ix-cardul-european-si-cardul-national-de-asigurari-sociale-de-sanatate-se-introduce-un-nou-titlu-titlul-ix1-dosarul-electronic-de-sanatate-al-pacientului-continand-articolele-3461-34612-cu?dp=gi4dcmrxgaytgny", "date": "2019", "publisherClass": "legal_text" }, { "title": "Regulament Studii Clinice / Sistem Informatic pentru Studii Clinice (ANMDMR)", "url": "https://www.anm.ro/regulament-studii-clinice-sistem-informatic-pentru-studii-clinice/", "date": "undated", "publisherClass": "official" }, { "title": "Ce se intampla cu datele tale medicale dupa digitalizare (EVZ)", "url": "https://evz.ro/ce-se-intampla-cu-datele-tale-medicale-dupa-digitalizare-frica-legitima-si-ce-spun-documentele-oficiale.html", "date": "2026-01-13", "publisherClass": "news" } ] }, "ai": { "score": 50, "summary": "Romania has no verified national rules for clinical AI and relies on EU law. On 24 July 2026 the regulator ANCOM said no authority can sanction breaches of the AI Act until a national law, still being drafted, takes effect.", "sources": [ { "title": "Artificial Intelligence Act in Romania: current state of the implementation framework (ANCOM)", "url": "https://www.ancom.ro/en/about-us/media-en/press-releases/artificial-intelligence-act-in-romania-current-state-of-the-implementation-framework/", "date": "2026-07-24", "publisherClass": "official" } ] } }, "laws": [ { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health is special-category data; right of access; fines up to EUR 20M or 4% of turnover.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng" }, { "name": "Law 190/2018 implementing the GDPR", "level": "National", "year": "2018", "what": "Limits health-data profiling; bans third-party reuse of public-health data; warning first for public bodies.", "url": "https://www.spitalleordeni.ro/doc/date%20personale/Legea%20nr.%20190%20din%202018.pdf" }, { "name": "Law 46/2003 on patient rights", "level": "National", "year": "2003", "what": "Patients have access to their personal medical data; confidentiality of medical information.", "url": "https://legislatie.just.ro/Public/DetaliiDocument/41483" }, { "name": "Law 95/2006 on health reform, Title IX^1 (added by Law 45/2019)", "level": "National", "year": "2019", "what": "Electronic health record: consent for doctor access, emergency summary, patient-visible access history.", "url": "https://lege5.ro/Gratuit/gmzdgmjygy2q/dupa-titlul-ix-cardul-european-si-cardul-national-de-asigurari-sociale-de-sanatate-se-introduce-un-nou-titlu-titlul-ix1-dosarul-electronic-de-sanatate-al-pacientului-continand-articolele-3461-34612-cu?dp=gi4dcmrxgaytgny" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Free access, restriction rights and opt-out from secondary use; applies from 2029.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" }, { "name": "Artificial Intelligence Act (EU) 2024/1689", "level": "Supranational", "year": "2024", "what": "Risk-based AI rules; most obligations from 2 August 2026; national sanctions law pending in Romania.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-20", "headline": "Regulator fines dental clinic after ex-employee took patient files to a rival", "paraphrase": "A former employee copied every patient's contact details and medical file and used them to invite patients to a competing clinic. The clinic then failed to answer the regulator, which fined it.", "source": "ANSPDCP (National Supervisory Authority for Personal Data Processing)", "url": "https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_02_2026", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-02-27", "headline": "Clinic fined for ignoring a patient's two requests for their own medical file", "paraphrase": "A patient asked a clinic twice for their medical data and file documents and got no answer. The regulator found no evidence of any reply, fined the clinic and ordered full responses and staff training.", "source": "ANSPDCP (National Supervisory Authority for Personal Data Processing)", "url": "https://www.dataprotection.ro/?page=Comunicat_Presa_27.02.2025&lang=ro", "theme": "access_refused", "status": "finding" }, { "date": "2025-02-20", "headline": "Clinic emailed one patient's test results to another patient, regulator finds", "paraphrase": "A clinic sent a patient's identity number, contact details and test results to another patient by unsecured email, and sent that patient's data back the other way. It told neither patient nor the regulator, which fined it.", "source": "ANSPDCP (National Supervisory Authority for Personal Data Processing)", "url": "https://www.dataprotection.ro/?page=Comunicat_Presa_20_02_2025", "theme": "breach", "status": "finding" }, { "date": "2026-02-19", "headline": "Discharge papers listed treatment sessions that never happened, insurer says", "paraphrase": "A patient complained that a private clinic kept their health insurance card. When it was returned, the discharge papers recorded treatment sessions the national insurer says were fictitious. The insurer applied a contractual penalty to the clinic.", "source": "Stiripesurse.ro", "url": "https://www.stiripesurse.ro/cadre-medicale-dintr-o-clinica-din-craiova-acuzate-de-decontari-fictive-cnas-a-amendat-unitatea-dupa-ce-unui-barbat-i-a-fost-retinut-cardul-de-sanatate_3860894", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-09-22", "headline": "Weeks after launch, patients still cannot open their online medical record", "paraphrase": "Patients trying to use the new national health record portal report waiting about two weeks for identity validation. Those who get in often see only a few prescriptions, not their full medical history.", "source": "DeFapt.ro", "url": "https://defapt.ro/eveniment/problemele-platformei-e-sanatatea-mea", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "CYP", "name": "Cyprus", "region": "Europe", "overall": 55, "rank": "40=", "likelyRank": "24 to 51", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Cyprus wrote strong patient controls into its 2019 eHealth law, but the national record those controls govern is not due until 2029.", "categories": { "access": { "score": 64, "summary": "The eHealth law and GDPR give a right to see and copy the record, and the GeSY portal shows prescriptions, referrals, diagnoses and visits. The Commission's 2025 eHealth indicator study scored Cyprus 75% for 2024, against an EU average of 83%.", "sources": [ { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" }, { "title": "2025 Digital Decade eHealth indicator study, annex: country factsheets (European Commission)", "url": "https://data.europa.eu/doi/10.2759/8383998", "date": "2025-06-16", "publisherClass": "intergov" }, { "title": "Cyprus's 2026 Digital Decade Country Report (European Commission)", "url": "https://digital-strategy.ec.europa.eu/en/factpages/cypruss-2026-digital-decade-country-report", "date": "2026-08-24", "publisherClass": "intergov" }, { "title": "GeSY on your screen: everything you need to know (Offsite, via ink.com)", "url": "https://ink.com/articles/545626/gesy-stin-othoni-soy-ola-osa-prepei-na-xereis", "date": "2023-11-04", "publisherClass": "news" } ] }, "control": { "score": 46, "summary": "The GeSY portal shows patients which health professionals viewed their history. Opt-out, data locking and per-provider permissions are in the 2019 law, but they belong to a national record bank that is not yet built.", "sources": [ { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" }, { "title": "eHealth4U: a pathway from the Cyprus eHealth law to a citizen-centred national EHR prototype (Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13133457/", "date": "2026-04-27", "publisherClass": "academic" }, { "title": "GeSY: how we stay informed about our medical data (Ygeia Press)", "url": "https://ygeia-press.com/%CE%B3%CE%B5%CF%83%CF%85%CF%80%CF%89%CF%82-%CE%B5%CE%BD%CE%B7%CE%BC%CE%B5%CF%81%CF%89%CE%BD%CF%8C%CE%BC%CE%B1%CF%83%CF%84%CE%B5-%CE%B3%CE%B9%CE%B1-%CF%84%CE%B1-%CE%B9%CE%B1%CF%84%CF%81%CE%B9%CE%BA/", "date": "2023-11-07", "publisherClass": "news" } ] }, "privacy": { "score": 58, "summary": "GDPR and Law 125(I)/2018 apply, and the regulator has acted in health. The state hospital operator OKYpY was fined 46,500 euros over 13 losses of medical files or emergency department records, but fines on public bodies are capped at 200,000 euros.", "sources": [ { "title": "Law 125(I)/2018 on the protection of natural persons with regard to personal data (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2018_1_125/full.html", "date": "2018-07-31", "publisherClass": "legal_text" }, { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" }, { "title": "Commissioner's report: spam complaints, surveillance and fines on OKYpY (Dialogos)", "url": "https://dialogos.com.cy/ekthesi-epitropoy-parapona-gia-spam-kyklomata-parakoloythisis-kai-prostima-ston-okypy/", "date": "2025-09-26", "publisherClass": "news" } ] }, "journey": { "score": 58, "summary": "GeSY's IT system links personal doctors, referrals, labs, pharmacies, hospitals and claims, and MyHealth@EU patient summaries and e-prescriptions went live in 2025. The integrated national record has a 21.1 million euro budget with full operation planned for December 2029.", "sources": [ { "title": "Launch of MyHealth@EU cross-border eHealth services (National eHealth Authority)", "url": "https://neha.org.cy/enarksi-ilektronikwn-diasinoriakwn/", "date": "2025-05-16", "publisherClass": "official" }, { "title": "GHS Information Technology System (Health Insurance Organisation)", "url": "https://www.gesy.org.cy/sites/Sites?d=Desktop&locale=el_GR&lookuphost=%2Fel-gr%2F&lookuppage=hioinformationtechnologysystemghs", "date": "undated", "publisherClass": "official" }, { "title": "eHealth4U: a pathway from the Cyprus eHealth law to a citizen-centred national EHR prototype (Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13133457/", "date": "2026-04-27", "publisherClass": "academic" }, { "title": "All your health history on one screen: when the digital record comes to Cyprus (Politis)", "url": "https://www.politis.com.cy/cyprus/igeia/1033942/telos-ston-fakelo-me-ta-khartia-olo-to-istoriko-ighias-se-mia-othoni-pote-erkhetai-o-psifiakos-fakelos-stin-kypro", "date": "2026-09-18", "publisherClass": "news" } ] }, "commercial": { "score": 54, "summary": "Genetic and biometric data cannot be used for health or life insurance, and the eHealth law needs each citizen's consent before record data goes into anonymised databases. The same law expects the state to earn revenue from sharing those databases with third parties.", "sources": [ { "title": "Law 125(I)/2018 on the protection of natural persons with regard to personal data (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2018_1_125/full.html", "date": "2018-07-31", "publisherClass": "legal_text" }, { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" } ] }, "clinical": { "score": 55, "summary": "GeSY professionals can preview a patient's GeSY history, and every view is logged. The Commission found public and private hospitals supplying data to the national access service, but a full national record is not yet built.", "sources": [ { "title": "GeSY: how we stay informed about our medical data (Ygeia Press)", "url": "https://ygeia-press.com/%CE%B3%CE%B5%CF%83%CF%85%CF%80%CF%89%CF%82-%CE%B5%CE%BD%CE%B7%CE%BC%CE%B5%CF%81%CF%89%CE%BD%CF%8C%CE%BC%CE%B1%CF%83%CF%84%CE%B5-%CE%B3%CE%B9%CE%B1-%CF%84%CE%B1-%CE%B9%CE%B1%CF%84%CF%81%CE%B9%CE%BA/", "date": "2023-11-07", "publisherClass": "news" }, { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" }, { "title": "Launch of MyHealth@EU cross-border eHealth services (National eHealth Authority)", "url": "https://neha.org.cy/enarksi-ilektronikwn-diasinoriakwn/", "date": "2025-05-16", "publisherClass": "official" }, { "title": "2025 Digital Decade eHealth indicator study, annex: country factsheets (European Commission)", "url": "https://data.europa.eu/doi/10.2759/8383998", "date": "2025-06-16", "publisherClass": "intergov" } ] }, "research": { "score": 45, "summary": "On paper, record data can enter anonymised research databases only with each citizen's consent. That rule applies to a bank not yet built, and no general research opt-out for GeSY data was verified.", "sources": [ { "title": "Electronic Health Law of 2019, 59(I)/2019, consolidated with 176(I)/2025 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html", "date": "2019-04-19", "publisherClass": "legal_text" }, { "title": "Bioethics (Establishment and Operation of National Committee) Law 150(I)/2001 (CyLaw)", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2001_1_150/full.html", "date": "2001", "publisherClass": "legal_text" }, { "title": "Reliable health data and AI the basis of a new era, e-Health Authority head says (CBN)", "url": "https://www.cbn.com.cy/article/128614/reliable-health-data-and-ai-the-basis-of-a-new-era-e-health-authority-head-says", "date": "2026-04-30", "publisherClass": "news" } ] }, "ai": { "score": 50, "summary": "Clinical AI is governed by EU device law and the EU AI Act, whose medical device duties now start 2 August 2028. Cyprus has named AI Act authorities, but no national clinical AI rules were verified.", "sources": [ { "title": "AI Act Service Desk: national resources (European Commission)", "url": "https://ai-act-service-desk.ec.europa.eu/en/national-resources", "date": "undated", "publisherClass": "intergov" }, { "title": "Digital Omnibus on AI has been published, Regulation (EU) 2026/1744 (Cuatrecasas)", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published", "date": "2026-07-24", "publisherClass": "law_firm" }, { "title": "Reliable health data and AI the basis of a new era, e-Health Authority head says (CBN)", "url": "https://www.cbn.com.cy/article/128614/reliable-health-data-and-ai-the-basis-of-a-new-era-e-health-authority-head-says", "date": "2026-04-30", "publisherClass": "news" } ] } }, "laws": [ { "name": "Electronic Health Law of 2019, 59(I)/2019 (amended 176(I)/2025)", "level": "National", "year": "2019", "what": "National eHealth Authority, single record bank, opt-out, per-provider permissions, data locking and access logging.", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2019_1_59/full.html" }, { "name": "Law 125(I)/2018 on processing of personal data", "level": "National", "year": "2018", "what": "Implements GDPR; bans genetic and biometric data use for insurance; caps public body fines at 200,000 euros.", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2018_1_125/full.html" }, { "name": "Bioethics (Establishment and Operation of National Committee) Law 150(I)/2001", "level": "National", "year": "2001", "what": "Creates the National Bioethics Committee that reviews biomedical research ethics.", "url": "http://www.cylaw.org/nomoi/enop/non-ind/2001_1_150/full.html" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient summaries and e-prescriptions exchange from March 2029; images, labs, discharge reports from March 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "EU data protection rules applying since 25 May 2018, including the right of access to personal data.", "url": "https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en" }, { "name": "EU AI Act (EU) 2024/1689, amended by (EU) 2026/1744", "level": "Supranational", "year": "2024", "what": "Risk rules for AI; obligations for AI in medical devices now apply from 2 August 2028.", "url": "https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-29", "headline": "Ombudsman's intervention recovers a patient's missing hospital file", "paraphrase": "A patient asked the ombudsman for help after a former state hospital could not locate his medical file. After the ombudsman stepped in, the file was found and he regained access to his key health data.", "source": "Επίτροπος Διοικήσεως και Προστασίας Ανθρωπίνων Δικαιωμάτων (Ετήσια Έκθεση 2024)", "url": "https://www.ombudsman.gov.cy/ombudsman/ombudsman.nsf/All/687657359C6D02BFC2258E25001A09FD/%24file/%CE%95%CF%84%CE%AE%CF%83%CE%B9%CE%B1%20%CE%88%CE%BA%CE%B8%CE%B5%CF%83%CE%B7%202024%20_new1.pdf?OpenElement", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-09", "headline": "State hospitals fined after ten patients' medical files went missing", "paraphrase": "The state hospital body reported losing ten patients' medical files and three emergency registration forms. The regulator found no safeguards against loss, fined it 46,500 euros in total and ordered it to tell seven patients.", "source": "Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)", "url": "https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf", "theme": "breach", "status": "finding" }, { "date": "2025-09", "headline": "Two doctors reprimanded for giving a patient's medical certificates to his former wife", "paraphrase": "A man complained that two doctors issued certificates about his past care to his former wife without his knowledge or consent. The regulator found they processed his health data with no legal basis and reprimanded both.", "source": "Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)", "url": "https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-09", "headline": "Doctor reprimanded for phoning a patient's next of kin to confirm an appointment", "paraphrase": "A doctor's secretary looked up a patient's GeSY account and phoned his father, listed as next of kin, to confirm a booking. The regulator ruled that number was not an alternative contact and reprimanded the doctor.", "source": "Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Ετήσια Έκθεση 2024)", "url": "https://www.gov.cy/media/sites/67/2026/02/Annual-Report-2024.pdf", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-12-11", "headline": "Specialist hospital confirms hackers stole patient and staff data and threatened publication", "paraphrase": "The hospital said attackers took personal data of patients and staff from its systems and threatened to publish it in the media and online. It reported the attack to police, the data regulator and the digital security authority.", "source": "Sigmalive", "url": "https://www.sigmalive.com/news/local/1296990/kataghghelia-apo-to-oghkologhiko-kentro-ghia-paranomi-dimosiefsi-dedomenon", "theme": "breach", "status": "admitted" } ] }, { "iso3": "SMR", "name": "San Marino", "region": "Europe", "overall": 55, "rank": "40=", "likelyRank": "23 to 50", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Over 90% of San Marino residents hold an online record from the single public health service, but rules on sharing and secondary use stay general.", "categories": { "access": { "score": 70, "summary": "Law 171/2018 gives a free right of access within one month, and the health secretariat says over 90% of citizens have an electronic health record (FSE). It shows reports, discharge letters, prescriptions and vaccinations, but full clinical notes and export were not verified.", "sources": [ { "title": "Fascicolo Sanitario Elettronico (Istituto per la Sicurezza Sociale)", "url": "https://fse.iss.sm/", "date": "undated", "publisherClass": "official" }, { "title": "Dal 1° gennaio 2026 i referti di laboratorio non arriveranno più per posta (Segreteria di Stato per la Sanità)", "url": "https://www.sanita.sm/pub1/SanitaSM/dettaglio_notizia.html?idItem=2ecf1a4e-7cfb-4ae7-9fa2-9afe9c2ca52c", "date": "2025-12-11", "publisherClass": "official" }, { "title": "Innovazione Digitale in sanità: presentata l'app del Fascicolo Sanitario (ISS)", "url": "https://www.iss.sm/on-line/home/articolo49016573.html", "date": "2024-06-04", "publisherClass": "official" }, { "title": "Legge 21 dicembre 2018 n.171, testo consolidato 2023 (Autorità Garante, unofficial consolidated text)", "url": "https://garanteprivacy.sm/pub1/dam/jcr:5bfff8ec-b3d3-4c2b-8624-3f0ccfa26e6e/L171-2018%20%5B%20testo%20consolidato%202023%5D.pdf", "date": "2023", "publisherClass": "legal_text" } ] }, "control": { "score": 55, "summary": "Patients sign a consent form to open their FSE, and the ISS says every access is logged and can be checked by the owner. We found no way to hide documents or pick clinicians, so the score sits at the top of the 40 to 55 band.", "sources": [ { "title": "Fascicolo Sanitario Elettronico (Istituto per la Sicurezza Sociale)", "url": "https://fse.iss.sm/", "date": "undated", "publisherClass": "official" }, { "title": "FSE FAQ: access to minors' records and access logging (ISS)", "url": "https://fse.iss.sm/faq", "date": "undated", "publisherClass": "official" }, { "title": "Informazioni sul trattamento dei dati personali, informativa completa (ISS)", "url": "https://www.iss.sm/on-line/home/menudestra/documento49113769.html", "date": "2019-11-04", "publisherClass": "official" } ] }, "privacy": { "score": 52, "summary": "Law 171/2018 mirrors the GDPR, with health as a special category, 72-hour breach notice and fines up to 10 million euros or 4% of turnover. We found no health-sector enforcement, and San Marino has no EU adequacy decision.", "sources": [ { "title": "Legge 21 dicembre 2018 n.171, testo consolidato 2023 (Autorità Garante, unofficial consolidated text)", "url": "https://garanteprivacy.sm/pub1/dam/jcr:5bfff8ec-b3d3-4c2b-8624-3f0ccfa26e6e/L171-2018%20%5B%20testo%20consolidato%202023%5D.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Provvedimenti, Anno 2024 (Autorità Garante per la protezione dei dati personali)", "url": "https://garanteprivacy.sm/pub1/garante/provvedimenti/anno-2024.html", "date": "undated", "publisherClass": "official" }, { "title": "Decreto Consiliare 27 settembre 2023 n.136, ratifica del Protocollo di emendamento alla Convenzione 108", "url": "https://garanteprivacy.sm/pub1/dam/jcr:cf291975-292f-42f5-a688-76e2b260623b/Decreto%20Consiliare%2027%20settembre%202023%20Ratifica%20Convenzione%20108+.pdf", "date": "2023-09-27", "publisherClass": "legal_text" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 56, "summary": "One public body, the ISS, runs the hospital, health centres and lab, and its FSE pulls their documents together. Care bought in Italy shows only as authorised referrals, and no law setting up the FSE was found.", "sources": [ { "title": "Innovazione Digitale in sanità: presentata l'app del Fascicolo Sanitario (ISS)", "url": "https://www.iss.sm/on-line/home/articolo49016573.html", "date": "2024-06-04", "publisherClass": "official" }, { "title": "Il Fascicolo Sanitario Elettronico si arricchisce di una nuova sezione dedicata alle Impegnative (ISS)", "url": "https://fse.iss.sm/implementazione-FSE", "date": "2025-12-31", "publisherClass": "official" }, { "title": "Dal 1° gennaio 2026 i referti di laboratorio non arriveranno più per posta (Segreteria di Stato per la Sanità)", "url": "https://www.sanita.sm/pub1/SanitaSM/dettaglio_notizia.html?idItem=2ecf1a4e-7cfb-4ae7-9fa2-9afe9c2ca52c", "date": "2025-12-11", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Law 171/2018 requires a legal basis for health data and lets people object to direct marketing at any time. We found no rule on health apps, data brokers or sale of de-identified data, and the ISS itself contacts patients for donations and surveys on 'legitimate interest'.", "sources": [ { "title": "Legge 21 dicembre 2018 n.171, testo consolidato 2023 (Autorità Garante, unofficial consolidated text)", "url": "https://garanteprivacy.sm/pub1/dam/jcr:5bfff8ec-b3d3-4c2b-8624-3f0ccfa26e6e/L171-2018%20%5B%20testo%20consolidato%202023%5D.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Informazioni sul trattamento dei dati personali, informativa completa (ISS)", "url": "https://www.iss.sm/on-line/home/menudestra/documento49113769.html", "date": "2019-11-04", "publisherClass": "official" } ] }, "clinical": { "score": 48, "summary": "Because ISS runs almost all public care, its clinicians likely share one system, but we found no official source on what a treating doctor can see. That key fact was not verified, so the score is in the lower half of the mixed band.", "sources": [ { "title": "Informazioni sul trattamento dei dati personali, informativa completa (ISS)", "url": "https://www.iss.sm/on-line/home/menudestra/documento49113769.html", "date": "2019-11-04", "publisherClass": "official" }, { "title": "Fascicolo Sanitario Elettronico (Istituto per la Sicurezza Sociale)", "url": "https://fse.iss.sm/", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Health research without consent is allowed when an ethics committee approves it and the data protection authority authorises it, and impact assessments must be published. There is no general opt-out.", "sources": [ { "title": "Legge 21 dicembre 2018 n.171, testo consolidato 2023 (Autorità Garante, unofficial consolidated text)", "url": "https://garanteprivacy.sm/pub1/dam/jcr:5bfff8ec-b3d3-4c2b-8624-3f0ccfa26e6e/L171-2018%20%5B%20testo%20consolidato%202023%5D.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Legge 3 marzo 2023 n.39, riforma del Comitato Sammarinese di Bioetica", "url": "https://bioetica.sm/wp-content/uploads/2025/10/Riforma20Istituzione20comitato20bioetica20San20Marino202023.pdf", "date": "2023-03-03", "publisherClass": "legal_text" }, { "title": "Legge 30 giugno 2021 n.122, buona pratica clinica nelle sperimentazioni cliniche dei medicinali", "url": "https://bioetica.sm/wp-content/uploads/2026/05/ALLEGATO-9_Legge-GCLP_30-giugno-2021-n.-122.pdf", "date": "2021-06-30", "publisherClass": "legal_text" } ] }, "ai": { "score": 40, "summary": "San Marino is outside the EU and has no AI law. Its health authority admits a legal gap on medical devices and since March 2025 runs device vigilance by circular, modelled on the EU MDR and IVDR, which is guidance rather than law.", "sources": [ { "title": "Circolare n.1/2025 sulla vigilanza dei dispositivi medici e IVD (Authority Sanitaria)", "url": "https://www.gov.sm/pub1/GovSM/dam/jcr:b6ed6e0d-8952-4928-a796-f7edb1b8c8c7/Allegato%20Prot.13868_2025_CIRCOLARE_DISPOSITIVOVIGILANZA.pdf", "date": "2025-02", "publisherClass": "official" }, { "title": "Dispositivi medici (Authority Sanitaria, GOV.SM)", "url": "https://www.gov.sm/pub2/GovSM/Authority-Sanitaria/Dispositivi-medici.html", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Legge 21 dicembre 2018 n.171 (data protection)", "level": "National", "year": "2018", "what": "GDPR-style law; health-sector title, 72-hour breach notice, fines up to 10 million euros or 4%.", "url": "https://www.consigliograndeegenerale.sm/on-line/home/scheda17161069.html" }, { "name": "Legge 30 giugno 2021 n.122 (good clinical practice)", "level": "National", "year": "2021", "what": "Adopts GCP and good clinical lab practice for drug trials, including written informed consent.", "url": "https://bioetica.sm/wp-content/uploads/2026/05/ALLEGATO-9_Legge-GCLP_30-giugno-2021-n.-122.pdf" }, { "name": "Legge 3 marzo 2023 n.39 (bioethics committee reform)", "level": "National", "year": "2023", "what": "Reforms the bioethics committee; it authorises clinical and epidemiological research, acting as the CERS.", "url": "https://bioetica.sm/wp-content/uploads/2025/10/Riforma20Istituzione20comitato20bioetica20San20Marino202023.pdf" }, { "name": "Decreto Consiliare 27 settembre 2023 n.136 (Convention 108+)", "level": "National", "year": "2023", "what": "Ratifies the protocol modernising Council of Europe Convention 108 on data protection.", "url": "https://garanteprivacy.sm/pub1/dam/jcr:cf291975-292f-42f5-a688-76e2b260623b/Decreto%20Consiliare%2027%20settembre%202023%20Ratifica%20Convenzione%20108+.pdf" }, { "name": "Circolare n.1/2025, Authority Sanitaria (device vigilance)", "level": "National", "year": "2025", "what": "Sets up medical device and IVD vigilance on the EU MDR and IVDR model, from 15 March 2025.", "url": "https://www.gov.sm/pub1/GovSM/dam/jcr:b6ed6e0d-8952-4928-a796-f7edb1b8c8c7/Allegato%20Prot.13868_2025_CIRCOLARE_DISPOSITIVOVIGILANZA.pdf" }, { "name": "EU Association Agreement with Andorra and San Marino", "level": "Supranational", "year": "2026", "what": "Internal-market association; EU Council authorised signature and provisional application in July 2026. Not yet signed.", "url": "https://www.esteri.it/it/sala_stampa/archivionotizie/comunicati/2026/07/accordo-di-associazione-ue-san-marino-litalia-accoglie-con-favore-il-via-libera-del-consiglio-dellunione-europea/" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-10", "headline": "Lab results stopped reaching patients' online health records for several days", "paraphrase": "The state health service said a technical fault outside its control blocked lab results from loading into the electronic health record for days. It mailed paper copies meanwhile, apologised, and offered help to anyone still missing results.", "source": "San Marino RTV", "url": "https://www.sanmarinortv.sm/news/comunicati-c9/fascicolo-sanitario-elettronico-ripristinata-la-disponibilita-dei-referti-di-laboratorio-a286305", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "SRB", "name": "Serbia", "region": "Europe", "overall": 55, "rank": "40=", "likelyRank": "23 to 51", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Serbs can see labs, scans and an access log in the eZdravlje portal, but the central eKarton began in 2026 and private care sits outside.", "categories": { "access": { "score": 62, "summary": "Serbian law gives a right to see and copy the medical record, and the state eZdravlje portal shows doctors' reports, lab results, radiology images and e-prescriptions. Only 1,778,802 people had registered by May 2025, and some institutions' data is missing, so the score sits low in the portal band.", "sources": [ { "title": "Zakon o pravima pacijenata (Sl. glasnik RS 45/2013, 25/2019)", "url": "https://www.paragraf.rs/propisi/zakon_o_pravima_pacijenata.html", "date": "2013", "publisherClass": "legal_text" }, { "title": "Zakon o zastiti podataka o licnosti (Sl. glasnik RS 87/2018)", "url": "https://www.paragraf.rs/propisi/zakon_o_zastiti_podataka_o_licnosti.html", "date": "2018", "publisherClass": "legal_text" }, { "title": "Brojevi koji govore: o rastu i znacaju portala eZdravlje (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/brojevi-koji-govore-o-rastu-i-znacaju-portala-ezdravlje-5", "date": "2025-05-31", "publisherClass": "official" }, { "title": "eZdravlje: Pitanja i odgovori (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/help", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 60, "summary": "Only the chosen doctor, referred specialists and emergency staff may open the eKarton by law; other clinicians need the patient's consent, and the portal logs every access. No way to block the chosen doctor was found, so the score sits at the band's bottom.", "sources": [ { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 92/2023)", "url": "https://www.paragraf.rs/propisi/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2023", "publisherClass": "legal_text" }, { "title": "Pravilnik o e-kartonu, licnom zdravstvenom broju i dostavljanju podataka na licni zahtev pacijenta (Sl. glasnik RS 45/2025)", "url": "http://demo.paragraf.rs/demo/combined/Old/t/t2025_05/SG_045_2025_007.htm", "date": "2025", "publisherClass": "legal_text" }, { "title": "Korisnicko uputstvo, platforma eZdravlje, pacijent portal (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/landing/repository/documents/user-manual-sr.pdf", "date": "2026-06-25", "publisherClass": "official" }, { "title": "U elektronske kartone uvid ce imati i drzavni i privatni lekari (N1)", "url": "https://n1info.rs/vesti/u-elektronske-kartone-uvid-ce-imati-i-drzavni-i-privatni-lekari-ali-to-ne-znaci-spajanje-dva-sistema/", "date": "2026-03-02", "publisherClass": "news" } ] }, "privacy": { "score": 46, "summary": "Health data is a special category under a GDPR-style 2018 law, but fines top out at RSD 2,000,000 and the European Commission calls penalties insufficient. In 2025 the regulator issued 101 warnings and filed 3 offence cases, and in 2026 a private clinic's patient diagnoses were leaked.", "sources": [ { "title": "Zakon o zastiti podataka o licnosti (Sl. glasnik RS 87/2018)", "url": "https://www.paragraf.rs/propisi/zakon_o_zastiti_podataka_o_licnosti.html", "date": "2018", "publisherClass": "legal_text" }, { "title": "Izvestaj Poverenika za 2025. godinu", "url": "https://poverenik.rs/h-content/uploads/2026/03/godisnji-izvestaj-2025-poverenik.pdf", "date": "2026-03-05", "publisherClass": "official" }, { "title": "Serbia Report 2025 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/6e68ce26-b95b-48e1-921a-c60c12da8f00_en?filename=serbia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Hakovani podaci vise hiljada korisnika privatne klinike u Beogradu (Radio Slobodna Evropa)", "url": "https://www.slobodnaevropa.org/a/srbija-hakerski-napad-medicinski-podaci/33723353.html", "date": "2026-04-02", "publisherClass": "news" } ] }, "journey": { "score": 64, "summary": "Public care is linked through national systems for e-prescriptions (over 690 million issued), radiology, labs, referrals and sick leave. Private providers are mostly outside: e-prescriptions there were only starting in May 2026, private labs were not yet in eLab, and the central eKarton's national rollout was not verified.", "sources": [ { "title": "Brojevi koji govore: o rastu i znacaju portala eZdravlje (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/brojevi-koji-govore-o-rastu-i-znacaju-portala-ezdravlje-5", "date": "2025-05-31", "publisherClass": "official" }, { "title": "eLab centralizovani repozitorijum u Republici Srbiji (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/elab-centralizovani-repozitorijum-u-republici-srbiji-9", "date": "2026-04-02", "publisherClass": "official" }, { "title": "eRecept i u privatnim zdravstvenim ustanovama (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/erecept-i-u-privatnim-zdravstvenim-ustanovama-42", "date": "2026-05-22", "publisherClass": "official" }, { "title": "Platforma eKarton pustena u pilot fazu u Srbiji (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/platforma-ekarton-pustena-u-pilot-fazu-u-srbiji-7", "date": "2026-03-03", "publisherClass": "official" } ] }, "commercial": { "score": 46, "summary": "Using health data for marketing or sale needs explicit consent or another legal ground under the 2018 law. No ban on selling health data was found, and the 2023 health records law lets innovative companies use registry data for research once a data-use body or ethics committee approves.", "sources": [ { "title": "Zakon o zastiti podataka o licnosti (Sl. glasnik RS 87/2018)", "url": "https://www.paragraf.rs/propisi/zakon_o_zastiti_podataka_o_licnosti.html", "date": "2018", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 92/2023)", "url": "https://www.paragraf.rs/propisi/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2023", "publisherClass": "legal_text" }, { "title": "Serbia Report 2025 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/6e68ce26-b95b-48e1-921a-c60c12da8f00_en?filename=serbia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "clinical": { "score": 55, "summary": "The chosen doctor sees the record, while specialists see lab results they ordered and radiologists see images. The central eKarton, which gathers diagnoses, allergies, labs and scans, was in a four-site pilot in March 2026; its use in all institutions was not verified.", "sources": [ { "title": "eZdravlje: Pitanja i odgovori (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/help", "date": "undated", "publisherClass": "official" }, { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 92/2023)", "url": "https://www.paragraf.rs/propisi/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2023", "publisherClass": "legal_text" }, { "title": "Platforma eKarton pustena u pilot fazu u Srbiji (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/platforma-ekarton-pustena-u-pilot-fazu-u-srbiji-7", "date": "2026-03-03", "publisherClass": "official" }, { "title": "eLab centralizovani repozitorijum u Republici Srbiji (Ministarstvo zdravlja)", "url": "https://e-zdravlje.gov.rs/news/elab-centralizovani-repozitorijum-u-republici-srbiji-9", "date": "2026-04-02", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Reusing identifiable registry data for research needs the person's consent and ethics approval, but anonymised or pseudonymised data can be reused on a data-use body's decision with no consent or opt-out. Whether that body is working was not verified.", "sources": [ { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 92/2023)", "url": "https://www.paragraf.rs/propisi/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2023", "publisherClass": "legal_text" }, { "title": "Zakon o pravima pacijenata (Sl. glasnik RS 45/2013, 25/2019)", "url": "https://www.paragraf.rs/propisi/zakon_o_pravima_pacijenata.html", "date": "2013", "publisherClass": "legal_text" }, { "title": "Serbia Report 2025 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/6e68ce26-b95b-48e1-921a-c60c12da8f00_en?filename=serbia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "ai": { "score": 40, "summary": "Software counts as a medical device under Serbia's 2017 law, but the European Commission found no progress toward EU device rules or the AI Act. Serbia's first AI law was still a draft in August 2026, with a December 2026 target.", "sources": [ { "title": "Zakon o medicinskim sredstvima (Sl. glasnik RS 105/2017)", "url": "https://www.paragraf.rs/propisi/zakon-o-medicinskim-sredstvima.html", "date": "2017", "publisherClass": "legal_text" }, { "title": "Serbia Report 2025 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/6e68ce26-b95b-48e1-921a-c60c12da8f00_en?filename=serbia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "U pripremi nacrt Zakona o vestackoj inteligenciji (Paragraf Lex)", "url": "https://www.paragraf.rs/dnevne-vesti/180826/180826-vest8.html", "date": "2026-08-18", "publisherClass": "news" } ] } }, "laws": [ { "name": "Zakon o pravima pacijenata (Sl. glasnik RS 45/2013)", "level": "National", "year": "2013", "what": "Right to see the record and get a copy at own cost; written consent for research.", "url": "https://www.paragraf.rs/propisi/zakon_o_pravima_pacijenata.html" }, { "name": "Zakon o zastiti podataka o licnosti (Sl. glasnik RS 87/2018)", "level": "National", "year": "2018", "what": "GDPR-style law; health data special category; 72-hour breach notice; fines up to RSD 2 million.", "url": "https://www.paragraf.rs/propisi/zakon_o_zastiti_podataka_o_licnosti.html" }, { "name": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 92/2023)", "level": "National", "year": "2023", "what": "Creates eKarton and genetic register, sets clinician access and consent rules for research reuse.", "url": "https://www.paragraf.rs/propisi/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html" }, { "name": "Pravilnik o e-kartonu (Sl. glasnik RS 45/2025)", "level": "National", "year": "2025", "what": "From 2026 providers send changes within 24 hours; portal must show patients the access history.", "url": "http://demo.paragraf.rs/demo/combined/Old/t/t2025_05/SG_045_2025_007.htm" }, { "name": "Zakon o medicinskim sredstvima (Sl. glasnik RS 105/2017)", "level": "National", "year": "2017", "what": "Covers software as a medical device: registration, vigilance and market surveillance by ALIMS.", "url": "https://www.paragraf.rs/propisi/zakon-o-medicinskim-sredstvima.html" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-04-03", "headline": "Thousands of patients' medical reports from a private clinic appear on the dark web", "paraphrase": "Records of about 6,500 patients of a private clinic, with names, addresses, phone numbers and doctors' reports, were posted online. The data protection commissioner opened an inspection and said the clinic had not yet reported the breach.", "source": "Danas", "url": "https://www.danas.rs/vesti/drustvo/poverenik-marinovic-od-ginekoloske-klinike-nismo-jos-dobili-odgovor-o-curenju-podataka-pacijentkinja/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "ARE", "name": "United Arab Emirates", "region": "Middle East", "overall": 55, "rank": "40=", "likelyRank": "23 to 54", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Each emirate runs its own shared record with near-universal reach, but patient copy rights and opt-outs come from emirate regulators, not federal law.", "categories": { "access": { "score": 35, "summary": "No federal law gives patients a right to a copy of their record; the right sits in Abu Dhabi and Dubai regulator standards. Three government portals show part of the record by region, which lifts the cell to the top of its band (35) and no further.", "sources": [ { "title": "DOH Standard on Patient Healthcare Data Privacy (Department of Health Abu Dhabi, hosted by Malaffi)", "url": "https://staticcdn.malaffi.ae/wpblobe9e5523f25/2021/02/2020-09-15-DOH-Standard-on-Patient-Healthcare-Data-Privacy-for-publication-2.pdf", "date": "2020-09-16", "publisherClass": "official" }, { "title": "Policy for Data and Health Information Protection and Confidentiality (Dubai Health Authority)", "url": "https://dha.gov.ae/uploads/082022/Health%20Data%20Protection%20and%20Confidentiality%20Policy_EN2022810559.pdf", "date": "2022-08-10", "publisherClass": "official" }, { "title": "Sahatna App FAQ (Department of Health Abu Dhabi)", "url": "https://sahatna-app.doh.gov.ae/en/faqs/", "date": "undated", "publisherClass": "official" }, { "title": "Smart Patient Portal (MOHAP, Internet Archive copy of 22 Jan 2026)", "url": "https://web.archive.org/web/20260122171056/https://mohap.gov.ae/en/w/smart-patient-portal", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 48, "summary": "Each emirate has a different rule: Riayati lets Northern Emirates patients opt out and promises access notices, Dubai's NABIDH takes opt-outs by signed form, and Abu Dhabi's Malaffi makes participation universal. The blend sits mid-band at 48.", "sources": [ { "title": "Riayati Healthcare Data Confidentiality and Privacy Policy RYT-PGM-POL-003 v1.2 (MOHAP, Internet Archive copy of 15 Apr 2025)", "url": "https://web.archive.org/web/20250415110215/https://mohap.gov.ae/documents/20117/590019/Riayati_Confidentiality_and_data_privacy_policy_V1.2.pdf/114cf9a6-69d8-32a1-53e7-6ef447d1a7f8", "date": "2020-06-11", "publisherClass": "official" }, { "title": "Standards for Health Information Consent and Access Control (Dubai Health Authority)", "url": "https://dha.gov.ae/uploads/012025/Standards%20for%20Consnet%20and%20Access%20Control2025129762.pdf", "date": "2025-01-02", "publisherClass": "official" }, { "title": "DOH Policy on the Abu Dhabi Health Information Exchange (Department of Health Abu Dhabi)", "url": "https://www.doh.gov.ae/-/media/A78104416DF2440E89AC90FB75F11055.ashx", "date": "2020-04-16", "publisherClass": "official" }, { "title": "DOH Standard on Patient Healthcare Data Privacy (Department of Health Abu Dhabi, hosted by Malaffi)", "url": "https://staticcdn.malaffi.ae/wpblobe9e5523f25/2021/02/2020-09-15-DOH-Standard-on-Patient-Healthcare-Data-Privacy-for-publication-2.pdf", "date": "2020-09-16", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "The 2019 health ICT law keeps health data in the UAE and fines unlawful export AED 500,000 to 700,000. But health data, and government bodies, fall outside the privacy law, the federal privacy regulator never became fully operational, and courts and health authorities can obtain records without consent.", "sources": [ { "title": "Federal Law No. 2 of 2019 on ICT in Health Fields (UAE Legislation portal, Internet Archive copy of 26 Nov 2025)", "url": "https://web.archive.org/web/20251126033721/https://uaelegislation.gov.ae/en/legislations/1209/download", "date": "2019-02-06", "publisherClass": "legal_text" }, { "title": "Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE Legislation portal, Internet Archive copy of 7 Sep 2026)", "url": "https://web.archive.org/web/20260907034008/https://www.uaelegislation.gov.ae/en/legislations/1972/download", "date": "2021-09-20", "publisherClass": "legal_text" }, { "title": "UAE Establishes Federal Authority for Artificial Intelligence and Data (Morgan Lewis)", "url": "https://www.morganlewis.com/pubs/2026/06/uae-establishes-federal-authority-for-artificial-intelligence-and-data", "date": "2026-06-15", "publisherClass": "law_firm" }, { "title": "Millions of patient records hacked in Dubai (Semafor)", "url": "https://www.semafor.com/article/06/11/2025/millions-of-dubai-patient-records-hacked", "date": "2025-06-11", "publisherClass": "news" } ] }, "journey": { "score": 80, "summary": "In June 2026 Malaffi connected 100% of Abu Dhabi hospitals and 3,144 facilities, with 4.2 billion records for 14 million patients; NABIDH links over 2,000 Dubai facilities. Riayati is the bridge, and a direct Malaffi to NABIDH link is still a plan.", "sources": [ { "title": "Malaffi Progress Report, June 2026 (Malaffi)", "url": "https://www.malaffi.ae/malaffi-progress-report/", "date": "2026-06", "publisherClass": "official" }, { "title": "Dubai Health Authority: enabling a future-ready health sector, interview (Economy Middle East)", "url": "https://economymiddleeast.com/news/dubai-health-authority-enabling-a-future-ready-health-sector-interview/", "date": "2026-02-09", "publisherClass": "news" }, { "title": "DoH's Malaffi and MOHAP announce completion of latest phase of Riayati integration (Malaffi)", "url": "https://www.malaffi.ae/dohs-malaffi-and-mohap-announce-the-completion-of-the-latest-phase-of-riayati-integration/", "date": "2023-10", "publisherClass": "official" }, { "title": "Malaffi FAQ for end users: General (Malaffi, operated by M42's Abu Dhabi Health Data Services)", "url": "https://www.malaffi.ae/faq-end-users/general/", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 56, "summary": "The health ICT law bars non-health use of patient data without written consent, and Abu Dhabi's exchange policy bans commercial or marketing use. Rules for consumer health apps and data brokers were not found, and Malaffi is run by a commercial M42 company.", "sources": [ { "title": "Federal Law No. 2 of 2019 on ICT in Health Fields (UAE Legislation portal, Internet Archive copy of 26 Nov 2025)", "url": "https://web.archive.org/web/20251126033721/https://uaelegislation.gov.ae/en/legislations/1209/download", "date": "2019-02-06", "publisherClass": "legal_text" }, { "title": "DOH Policy on the Abu Dhabi Health Information Exchange (Department of Health Abu Dhabi)", "url": "https://www.doh.gov.ae/-/media/A78104416DF2440E89AC90FB75F11055.ashx", "date": "2020-04-16", "publisherClass": "official" }, { "title": "Data protection laws (The Official Platform of the UAE Government, u.ae)", "url": "https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws", "date": "undated", "publisherClass": "official" }, { "title": "Malaffi reaches 3.5 billion clinical records (Malaffi)", "url": "https://www.malaffi.ae/malaffi-reaches-3-5-billion-clinical-records-setting-a-new-standard-for-healthcare-innovation-in-abu-dhabi/", "date": "2025-08-14", "publisherClass": "official" } ] }, "clinical": { "score": 76, "summary": "Clinicians in each emirate can open a shared record with labs, radiology images, medicines and documents, with break-the-glass access in emergencies. Cross-emirate views run through Riayati, and VIP flags, opt-outs and Dubai's consent rule limit some views.", "sources": [ { "title": "Malaffi FAQ for end users: General (Malaffi, operated by M42's Abu Dhabi Health Data Services)", "url": "https://www.malaffi.ae/faq-end-users/general/", "date": "undated", "publisherClass": "official" }, { "title": "Malaffi Media Center (Malaffi)", "url": "https://www.malaffi.ae/media-center/", "date": "undated", "publisherClass": "official" }, { "title": "Standards for Health Information Consent and Access Control (Dubai Health Authority)", "url": "https://dha.gov.ae/uploads/012025/Standards%20for%20Consnet%20and%20Access%20Control2025129762.pdf", "date": "2025-01-02", "publisherClass": "official" }, { "title": "Riayati Healthcare Data Confidentiality and Privacy Policy RYT-PGM-POL-003 v1.2 (MOHAP, Internet Archive copy of 15 Apr 2025)", "url": "https://web.archive.org/web/20250415110215/https://mohap.gov.ae/documents/20117/590019/Riayati_Confidentiality_and_data_privacy_policy_V1.2.pdf/114cf9a6-69d8-32a1-53e7-6ef447d1a7f8", "date": "2020-06-11", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "The 2019 law allows research on patient data without consent if identity is not disclosed and research ethics are followed, and no research opt-out exists. Ethics committee review and the law's statutory confidentiality duty add two safeguard classes to a base of 40.", "sources": [ { "title": "Federal Law No. 2 of 2019 on ICT in Health Fields (UAE Legislation portal, Internet Archive copy of 26 Nov 2025)", "url": "https://web.archive.org/web/20251126033721/https://uaelegislation.gov.ae/en/legislations/1209/download", "date": "2019-02-06", "publisherClass": "legal_text" }, { "title": "Riayati Healthcare Data Confidentiality and Privacy Policy RYT-PGM-POL-003 v1.2 (MOHAP, Internet Archive copy of 15 Apr 2025)", "url": "https://web.archive.org/web/20250415110215/https://mohap.gov.ae/documents/20117/590019/Riayati_Confidentiality_and_data_privacy_policy_V1.2.pdf/114cf9a6-69d8-32a1-53e7-6ef447d1a7f8", "date": "2020-06-11", "publisherClass": "official" }, { "title": "DOH Standard on Human Subject Research (Department of Health Abu Dhabi)", "url": "https://www.doh.gov.ae/-/media/C07A10ADB6504312A601E3A514D43084.ashx", "date": "2020-01", "publisherClass": "official" }, { "title": "New regulation on the use of ICT in healthcare in the UAE (Simmons & Simmons)", "url": "https://www.simmons-simmons.com/en/publications/ckcbolcc9l9s90a791x94jrz0/new-regulation-on-the-use-of-ict-in-healthcare-in-the-uae", "date": "2020-07-07", "publisherClass": "law_firm" } ] }, "ai": { "score": 64, "summary": "Decree-Law 38 of 2024 regulates AI-based products as medical devices and requires new approval after fundamental design changes. Abu Dhabi's October 2025 standard adds human oversight, disclosure to patients and an AI opt-out notice, but only for Abu Dhabi.", "sources": [ { "title": "Federal Decree-Law No. 38 of 2024 Governing Medical Products, Pharmacists and Pharmaceutical Establishments (UAE Legislation portal, Internet Archive copy of 7 Jan 2026)", "url": "https://web.archive.org/web/20260107203406/https://uaelegislation.gov.ae/en/legislations/2751/download", "date": "2024-10-01", "publisherClass": "legal_text" }, { "title": "Responsible Artificial Intelligence (AI) Standard V1 (Department of Health Abu Dhabi)", "url": "https://www.doh.gov.ae/-/media/Feature/Resources/Standards/2025/Responsible-AI-Standard-V1.ashx", "date": "2025-10", "publisherClass": "official" }, { "title": "How is AI in healthcare being regulated in the UAE? (International Bar Association)", "url": "https://www.ibanet.org/ai-healthcare-regulation-uae", "date": "2026-05-11", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Federal Law No. 2 of 2019 on the Use of ICT in Health Fields", "level": "National", "year": "2019", "what": "Confidentiality, central exchange, 25-year retention, health data kept in the UAE, fines and licence sanctions.", "url": "https://web.archive.org/web/20251126033721/https://uaelegislation.gov.ae/en/legislations/1209/download" }, { "name": "Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data", "level": "National", "year": "2021", "what": "General privacy law; excludes health data with its own law and government entities.", "url": "https://web.archive.org/web/20260907034008/https://www.uaelegislation.gov.ae/en/legislations/1972/download" }, { "name": "Federal Decree-Law No. 38 of 2024 on Medical Products", "level": "National", "year": "2024", "what": "Regulates medical devices including AI-based products; design changes need new approval.", "url": "https://web.archive.org/web/20260107203406/https://uaelegislation.gov.ae/en/legislations/2751/download" }, { "name": "DOH Standard on Patient Healthcare Data Privacy (Abu Dhabi)", "level": "State/Provincial", "year": "2020", "what": "Right to review and copy records; written consent for non-health use; 24-hour breach reporting.", "url": "https://staticcdn.malaffi.ae/wpblobe9e5523f25/2021/02/2020-09-15-DOH-Standard-on-Patient-Healthcare-Data-Privacy-for-publication-2.pdf" }, { "name": "DOH Policy on the Abu Dhabi Health Information Exchange", "level": "State/Provincial", "year": "2020", "what": "Mandatory universal participation in Malaffi; bans commercial and marketing use of exchange data.", "url": "https://www.doh.gov.ae/-/media/A78104416DF2440E89AC90FB75F11055.ashx" }, { "name": "DHA Standards for Health Information Consent and Access Control (Dubai)", "level": "State/Provincial", "year": "2025", "what": "Consent to view NABIDH, signed-form opt-out, break-the-glass rules for emergencies.", "url": "https://dha.gov.ae/uploads/012025/Standards%20for%20Consnet%20and%20Access%20Control2025129762.pdf" }, { "name": "DoH Responsible AI Standard V1 (Abu Dhabi)", "level": "State/Provincial", "year": "2025", "what": "Human oversight, disclosure to patients, AI opt-out notice, change logs for healthcare AI.", "url": "https://www.doh.gov.ae/-/media/Feature/Resources/Standards/2025/Responsible-AI-Standard-V1.ashx" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-05-09", "headline": "Regulator closes four clinics that wrote visits that never happened into medical files", "paraphrase": "The health regulator closed four facilities that sold sick leave over a messaging app, collecting ID photos and health details, then recorded visits that never happened in people's medical files and forged consent signatures.", "source": "Emarat Al Youm", "url": "https://www.emaratalyoum.com/local-section/health/2025-05-09-1.1943163", "theme": "record_wrong", "status": "finding" }, { "date": "2026-03-27", "headline": "Regulator shuts five health facilities after finding manipulated medical data", "paraphrase": "The emirate's health regulator closed five facilities and suspended staff pending referral to prosecutors. Inspections found sick notes issued without examining patients and manipulation of medical data, among other licensing violations.", "source": "Emarat Al Youm", "url": "https://www.emaratalyoum.com/local-section/health/2026-03-27-1.2029307", "theme": "record_wrong", "status": "finding" } ] }, { "iso3": "CRI", "name": "Costa Rica", "region": "Americas", "overall": 54, "rank": "44=", "likelyRank": "27 to 55", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Costa Rica runs one national digital record (EDUS) across public care; patients can view and share parts of it but cannot opt out.", "categories": { "access": { "score": 64, "summary": "Ley 8239 gives a right to a copy, and the EDUS app lets patients download an authenticated copy showing diagnoses, medicines, allergies and visits, not the full chart. App usage was not verified, so the score sits in the lower half of the portal band.", "sources": [ { "title": "Ley 8239, Derechos y deberes de las personas usuarias de los servicios de salud publicos y privados (IAFA copy)", "url": "https://iafa.go.cr/wp-content/uploads/2025/01/Derechos-y-deberes-de-las-personas-usuarias-de-los-servicios-de-salud-publicos-y-privados.pdf", "date": "2002", "publisherClass": "legal_text" }, { "title": "Reglamento del Expediente Digital Unico en Salud (CCSS, SINALEVI)", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=85915¶m2=111286¶m3=1¶m4=", "date": "2018-01-29", "publisherClass": "legal_text" }, { "title": "EDUS app, App Store Costa Rica", "url": "https://apps.apple.com/cr/app/edus/id1042094805", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "El Expediente Digital Unico en Salud de la CCSS (Conferencia Interamericana de Seguridad Social)", "url": "https://archivos.juridicas.unam.mx/www/bjv/libros/13/6338/1.pdf", "date": "2020-03", "publisherClass": "intergov" } ] }, "control": { "score": 48, "summary": "EDUS data is collected without patient consent and is visible to any CCSS user with the right access level, with no opt-out. Every action is logged, and a patient can ask their clinic for a certified access record.", "sources": [ { "title": "Reglamento del Expediente Digital Unico en Salud (CCSS, SINALEVI)", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=85915¶m2=111286¶m3=1¶m4=", "date": "2018-01-29", "publisherClass": "legal_text" }, { "title": "Como saber si alguien reviso su expediente en EDUS (CRHoy)", "url": "https://crhoy.com/nacionales/como-saber-si-alguien-reviso-su-expediente-en-edus-asi-puede-solicitar-el-registro-de-accesos/", "date": "2026-03-17", "publisherClass": "news" }, { "title": "Nueva funcion en aplicacion EDUS permite compartir expediente medico con personal de salud privado (Monumental)", "url": "https://www.monumental.co.cr/2025/08/07/nueva-funcion-en-aplicacion-edus-permite-compartir-expediente-medico-con-personal-de-salud-privado/", "date": "2025-08-07", "publisherClass": "news" } ] }, "privacy": { "score": 40, "summary": "Ley 9162 and Ley 8968 treat health data as sensitive, but fines top out at 30 base salaries. The Comptroller found 8,966 irregular EDUS access permissions in 2022, and a May 2022 cyberattack forced CCSS hospitals back to paper.", "sources": [ { "title": "Ley 9162, Expediente Digital Unico de Salud (SINALEVI)", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=75700¶m2=93998¶m3=1¶m4=", "date": "2013-08-26", "publisherClass": "legal_text" }, { "title": "Ley 8968, Proteccion de la Persona frente al tratamiento de sus datos personales (MICITT)", "url": "https://micitt.go.cr/sites/default/files/marco_juridico_legal/08.%20Ley%20n.%C2%B0%208968%20Ley%20de%20Protecci%C3%B3n%20de%20la%20Persona%20frente%20al%20tratamiento%20de%20sus%20datos%20personales..pdf", "date": "2011-07-07", "publisherClass": "legal_text" }, { "title": "Pensionados y personas fuera de planilla de la CCSS tienen acceso a datos de EDUS, revela CGR (AmeliaRueda.com)", "url": "https://ameliarueda.com/nota/pensionados-personas-fuera-planilla-tienen-acceso-edus-noticias-costa-rica", "date": "2022-04-25", "publisherClass": "news" }, { "title": "Hackeo a la CCSS obliga a pacientes a volver a centros medicos (La Teja)", "url": "https://www.lateja.cr/nacional/hackeo-a-la-ccss-obliga-a-pacientes-a-volver-a/OBKTUUCXTRHX5KOIAAFXHCUWFY/story/", "date": "2022-05-31", "publisherClass": "news" } ] }, "journey": { "score": 68, "summary": "EDUS reached all three levels of public care by September 2018, linking 1,040 primary care teams and 29 hospitals with lab, pharmacy and family records. Private hospitals and clinics are not connected beyond the patient's share code.", "sources": [ { "title": "El Expediente Digital Unico en Salud de la CCSS (Conferencia Interamericana de Seguridad Social)", "url": "https://archivos.juridicas.unam.mx/www/bjv/libros/13/6338/1.pdf", "date": "2020-03", "publisherClass": "intergov" }, { "title": "IAFA avanza en implementacion del EDUS (Ministerio de Salud)", "url": "https://www.ministeriodesalud.go.cr/index.php/prensa/67-noticias-2026/2406-iafa-avanza-en-implementacion-del-edus-para-mejorar-la-atencion-en-salud-a-nivel-nacional", "date": "2026-04-14", "publisherClass": "official" }, { "title": "Editorial: El EDUS necesita atencion urgente de la CCSS (La Nacion)", "url": "https://www.nacion.com/opinion/editorial/editorial-el-edus-necesita-atencion-urgente-de-la/IPGZZZCK4BEV5ERMQCBXCB2UJA/story/", "date": "2025-06-18", "publisherClass": "news" }, { "title": "Costa Rica lleva el EDUS a dos carceles (Infobae)", "url": "https://www.infobae.com/costa-rica/2026/09/15/costa-rica-lleva-el-expediente-digital-unico-en-salud-a-dos-carceles-y-prepara-su-expansion-a-21-centros-mas/", "date": "2026-09-15", "publisherClass": "news" } ] }, "commercial": { "score": 52, "summary": "Ley 8968 makes collecting or transmitting sensitive data by private parties its most serious offence, and the EDUS rules require explicit patient authorisation before sensitive data goes to private organisations. No enforcement record on health data sales was found.", "sources": [ { "title": "Ley 8968, Proteccion de la Persona frente al tratamiento de sus datos personales (MICITT)", "url": "https://micitt.go.cr/sites/default/files/marco_juridico_legal/08.%20Ley%20n.%C2%B0%208968%20Ley%20de%20Protecci%C3%B3n%20de%20la%20Persona%20frente%20al%20tratamiento%20de%20sus%20datos%20personales..pdf", "date": "2011-07-07", "publisherClass": "legal_text" }, { "title": "Reglamento del Expediente Digital Unico en Salud (CCSS, SINALEVI)", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=85915¶m2=111286¶m3=1¶m4=", "date": "2018-01-29", "publisherClass": "legal_text" } ] }, "clinical": { "score": 65, "summary": "The EDUS regulation makes care data automatically available to every CCSS clinician by access level, across all public facilities. Private clinicians see only a summary when the patient shares a code.", "sources": [ { "title": "Reglamento del Expediente Digital Unico en Salud (CCSS, SINALEVI)", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=85915¶m2=111286¶m3=1¶m4=", "date": "2018-01-29", "publisherClass": "legal_text" }, { "title": "IAFA avanza en implementacion del EDUS (Ministerio de Salud)", "url": "https://www.ministeriodesalud.go.cr/index.php/prensa/67-noticias-2026/2406-iafa-avanza-en-implementacion-del-edus-para-mejorar-la-atencion-en-salud-a-nivel-nacional", "date": "2026-04-14", "publisherClass": "official" }, { "title": "EDUS ya le permite compartir su expediente con su medico privado (La Nacion)", "url": "https://www.nacion.com/el-pais/edus-ya-le-permite-compartir-su-expediente-con-su/LOHIOEVWN5DYPGT4YT6KKDWLBM/story/", "date": "2025-08-06", "publisherClass": "news" } ] }, "research": { "score": 45, "summary": "Ley 9234 requires express, written, signed consent for biomedical research, overseen by ethics committees and the national council CONIS. Ethics committees can waive consent for observational studies, and no general opt-out from research use of EDUS data was found.", "sources": [ { "title": "Ley Reguladora de Investigacion Biomedica N 9234 (text copy)", "url": "https://clsanagustin.com/wp-content/uploads/2017/09/Ley-Investigacion-Biomedica-No9234.pdf", "date": "2014-04-22", "publisherClass": "legal_text" }, { "title": "Ley 8239, Derechos y deberes de las personas usuarias de los servicios de salud publicos y privados (IAFA copy)", "url": "https://iafa.go.cr/wp-content/uploads/2025/01/Derechos-y-deberes-de-las-personas-usuarias-de-los-servicios-de-salud-publicos-y-privados.pdf", "date": "2002", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Medical device registration (Decreto 34482-S) covers software inside devices, but there is no AI-specific clinical rule, and three general AI bills await a plenary vote. The CCSS uses AI on EDUS data with human validation as internal policy.", "sources": [ { "title": "Decreto 34482-S, Reglamento para registro, clasificacion, importacion y control de equipo y material biomedico (La Gaceta)", "url": "https://www.imprentanacional.go.cr/pub/2008/04/25/ALCA19_25_04_2008.html", "date": "2008-04-25", "publisherClass": "legal_text" }, { "title": "Legislacion de IA en Costa Rica (Observatorio IA)", "url": "https://www.observatorioia.org/es/legislacion/", "date": "2026-08", "publisherClass": "blog_vendor" }, { "title": "CCSS incorpora inteligencia artificial para depuracion de listas de espera (Infobae)", "url": "https://www.infobae.com/costa-rica/2026/05/08/caja-costarricense-de-seguro-social-incorpora-inteligencia-artificial-para-depuracion-de-listas-de-espera/", "date": "2026-05-07", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley 8239 (derechos y deberes de las personas usuarias de los servicios de salud)", "level": "National", "year": "2002", "what": "Right to access and copy one's clinical record, confidentiality, and to refuse research.", "url": "https://iafa.go.cr/wp-content/uploads/2025/01/Derechos-y-deberes-de-las-personas-usuarias-de-los-servicios-de-salud-publicos-y-privados.pdf" }, { "name": "Ley 8968 (proteccion de la persona frente al tratamiento de sus datos personales)", "level": "National", "year": "2011", "what": "General data law; health data sensitive; creates PRODHAB; fines up to 30 base salaries.", "url": "https://micitt.go.cr/sites/default/files/marco_juridico_legal/08.%20Ley%20n.%C2%B0%208968%20Ley%20de%20Protecci%C3%B3n%20de%20la%20Persona%20frente%20al%20tratamiento%20de%20sus%20datos%20personales..pdf" }, { "name": "Ley 9162 (expediente digital unico de salud)", "level": "National", "year": "2013", "what": "Mandates one national digital health record run by the CCSS; all its data private and sensitive.", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=75700¶m2=93998¶m3=1¶m4=" }, { "name": "Reglamento del Expediente Digital Unico en Salud (CCSS)", "level": "National", "year": "2018", "what": "Patient app copies, access log, no consent for collection, explicit consent for private transfer.", "url": "https://sinalevi.go.cr/ResultadosNormativa/Informacion?param1=85915¶m2=111286¶m3=1¶m4=" }, { "name": "Ley 9234 (reguladora de investigacion biomedica)", "level": "National", "year": "2014", "what": "Written informed consent, ethics committees and CONIS oversight for human health research.", "url": "https://clsanagustin.com/wp-content/uploads/2017/09/Ley-Investigacion-Biomedica-No9234.pdf" }, { "name": "Decreto 34482-S (equipo y material biomedico)", "level": "National", "year": "2008", "what": "Registration and control of medical devices, including embedded software.", "url": "https://www.imprentanacional.go.cr/pub/2008/04/25/ALCA19_25_04_2008.html" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-05-28", "headline": "Constitutional court says TV channels breached privacy by airing a person's prescriptions", "paraphrase": "Two television channels broadcast images of a public official's medical prescriptions taken from a confidential case file. The constitutional court ruled this violated his privacy, ordered every image removed and made the channels liable for damages.", "source": "La Nación", "url": "https://www.nacion.com/sucesos/sala-iv-condeno-a-opa-y-trivision-por-difundir/6IR4BIEW4VF4VLQEKAEU4RNGTQ/story/", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-11-28", "headline": "Public insurer admits staff typing error put a stranger's appointment in a patient's record", "paraphrase": "A patient found a specialist appointment he never requested in his digital health record. The public insurer said a clerk mistyped an ID number, cancelled the appointment and said it has no statistics on similar errors.", "source": "La Nación", "url": "https://www.nacion.com/el-pais/ccss-atribuye-a-error-humano-aislado-cita-en-edus/QE2CEM3GKBFATCIBXONZC7GQV4/story/", "theme": "record_wrong", "status": "admitted" }, { "date": "2025-03-20", "headline": "National digital record system outage left patients unable to see records or appointments", "paraphrase": "A data centre failure took the public insurer's digital health record and app offline for hours. Users could not view their records or appointments, and the insurer told clinics to contact affected patients and rebook them.", "source": "La Nación", "url": "https://www.nacion.com/el-pais/ccss-restablece-servicios-de-edus-tras-falla/5BLRWA5MIFCA5GB5ARJHMJX2YU/story/", "theme": "access_delay_or_cost", "status": "admitted" }, { "date": "2025-09-19", "headline": "Patient says digital record lists medicines he never received, complaint still unanswered", "paraphrase": "A patient found entries in his digital health record showing medicines given in a hospital department he says he never visited. He complained to the hospital, says no clear answer came, and went public. Officials say it is being investigated.", "source": "El Observador", "url": "https://observador.cr/paciente-del-hospital-mexico-denuncia-registro-falso-de-fentanilo-en-su-expediente/", "theme": "record_wrong", "status": "alleged" }, { "date": "2025-06-15", "headline": "Patient says years of paper history never reached the national digital record", "paraphrase": "A patient advocate said her earlier care history stayed on paper and was never moved into the national digital record. She also said she cannot easily give a private doctor access to her own record.", "source": "La Nación", "url": "https://www.nacion.com/el-pais/sirve-el-edus-si-se-cae-a-cada-rato-medicos-y/L4NIDJ6EZVBCDLGOVSRVF2BJSM/story/", "theme": "lost_between_providers", "status": "self_reported" } ] }, { "iso3": "CHE", "name": "Switzerland", "region": "Europe", "overall": 54, "rank": "44=", "likelyRank": "28 to 57", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Swiss patients have a free right to their whole record, but the optional e-dossier reached only 136,076 people, so Parliament is building an opt-out replacement.", "categories": { "access": { "score": 55, "summary": "The data protection act gives a free copy of the whole record, normally within 30 days, and an official national portal exists. Most people still ask each doctor or hospital, because the portal (the e-dossier, EPD) is optional: only 136,076 were open by end of April 2026.", "sources": [ { "title": "Bundesgesetz über den Datenschutz (DSG), SR 235.1, Stand 7. Juli 2025", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/de/html/fedlex-data-admin-ch-eli-cc-2022-491-20250707-de-html-1.html", "date": "2025-07-07", "publisherClass": "legal_text" }, { "title": "Recht auf Einsicht in das Patientendossier (BAG)", "url": "https://www.bag.admin.ch/de/recht-auf-einsicht-in-das-patientendossier", "date": "undated", "publisherClass": "official" }, { "title": "Aktueller Stand des EPD in der Schweiz (eHealth Suisse)", "url": "https://www.e-health-suisse.ch/koordination/elektronisches-patientendossier/aktueller-stand", "date": "undated", "publisherClass": "official" }, { "title": "Einsicht, Aufbewahrung und Löschung von Patientendaten (EDÖB)", "url": "https://www.edoeb.admin.ch/de/einsicht-aufbewahrung-und-loeschung-von-patientendaten", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 60, "summary": "Inside the EPD the patient opens it by explicit consent, picks which professionals see what, can block named providers and reads an access log. Few people hold one, so for most patients control rests on doctors' professional secrecy.", "sources": [ { "title": "Bundesgesetz über das elektronische Patientendossier (EPDG), SR 816.1, Stand 1. Oktober 2024", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2017/203/20241001/de/html/fedlex-data-admin-ch-eli-cc-2017-203-20241001-de-html-2.html", "date": "2024-10-01", "publisherClass": "legal_text" }, { "title": "Verordnung über das elektronische Patientendossier (EPDV), SR 816.11, Stand 1. Oktober 2024", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2017/204/20241001/de/html/fedlex-data-admin-ch-eli-cc-2017-204-20241001-de-html-2.html", "date": "2024-10-01", "publisherClass": "legal_text" }, { "title": "Schweizerisches Strafgesetzbuch (StGB), SR 311.0, Art. 321, Stand 1. Oktober 2026", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/54/757_781_799/20261001/de/html/fedlex-data-admin-ch-eli-cc-54-757_781_799-20261001-de-html.html", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Aktueller Stand des EPD in der Schweiz (eHealth Suisse)", "url": "https://www.e-health-suisse.ch/koordination/elektronisches-patientendossier/aktueller-stand", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 60, "summary": "Health data is sensitive data, breaches must be reported to the regulator, and doctors face criminal secrecy rules. The regulator (FDPIC) cannot fine; cantons prosecute individuals for fines up to CHF 250,000, and a radiology network was hacked twice in 2025 and 2026.", "sources": [ { "title": "Bundesgesetz über den Datenschutz (DSG), SR 235.1, Stand 7. Juli 2025", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/de/html/fedlex-data-admin-ch-eli-cc-2022-491-20250707-de-html-1.html", "date": "2025-07-07", "publisherClass": "legal_text" }, { "title": "33. Tätigkeitsbericht 2025/2026 (EDÖB)", "url": "https://www.edoeb.admin.ch/dam/de/sd-web/ZgZZm5CLxIFF/33_T%C3%A4tigkeitsbericht%202025-2026%20DE_Web.pdf", "date": "2026-06-30", "publisherClass": "official" }, { "title": "Update: Westschweizer Radiologienetzwerk bestätigt Datendiebstahl nach Cyberangriff (SwissCybersecurity.net)", "url": "https://www.swisscybersecurity.net/news/2026-05-07/cyberangriff-legt-westschweizer-radiologie-netzwerk-erneut-lahm", "date": "2026-05-07", "publisherClass": "news" } ] }, "journey": { "score": 40, "summary": "About 96 percent of hospitals are connected to the EPD, but only about 10 percent of outpatient doctors and 13 percent of pharmacies were in September 2025. Mandatory e-prescription and the opt-out E-GD are still passing through Parliament.", "sources": [ { "title": "Faktenblatt: Das elektronische Patientendossier in Zahlen (BAG)", "url": "https://www.bag.admin.ch/dam/de/sd-web/KMR8cp6wryyN/Faktenblatt%20EPD%20in%20Zahlen%20(Stand%20Oktober%202025).pdf", "date": "2025-11-05", "publisherClass": "official" }, { "title": "Ende 2026 ist Schluss mit der EPD-Plattform der Post (Netzwoche)", "url": "https://www.netzwoche.ch/news/2026-06-25/ende-2026-ist-schluss-mit-der-epd-plattform-der-post", "date": "2026-06-25", "publisherClass": "news" }, { "title": "Bundesrat beschliesst Neuausrichtung: Elektronisches Gesundheitsdossier E-GD löst EPD ab (EDI)", "url": "https://www.edi.admin.ch/de/bundesrat-beschliesst-neuausrichtung-elektronisches-gesundheitsdossier-e-gd-loest-epd-ab", "date": "2025-11-05", "publisherClass": "official" }, { "title": "Pflicht für elektronische Arztrezepte nimmt erste Hürde (Parlamentsdienste)", "url": "https://www.parlament.ch/de/services/news/Seiten/2026/20260312115534601194158159026_bsd085.aspx", "date": "2026-03-12", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "Passing health data to third parties counts as a breach of personality rights unless justified, and health professionals face criminal secrecy rules. No Swiss ban on selling health data or on health data brokers was found, and consumer apps rely on general law.", "sources": [ { "title": "Bundesgesetz über den Datenschutz (DSG), SR 235.1, Stand 7. Juli 2025", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/de/html/fedlex-data-admin-ch-eli-cc-2022-491-20250707-de-html-1.html", "date": "2025-07-07", "publisherClass": "legal_text" }, { "title": "Schweizerisches Strafgesetzbuch (StGB), SR 311.0, Art. 321, Stand 1. Oktober 2026", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/54/757_781_799/20261001/de/html/fedlex-data-admin-ch-eli-cc-54-757_781_799-20261001-de-html.html", "date": "2026-10-01", "publisherClass": "legal_text" }, { "title": "Le PFPDT alerte sur les risques des objets connectés (ICTjournal)", "url": "https://www.ictjournal.ch/news/2026-04-21/le-pfpdt-alerte-sur-les-risques-des-objets-connectes", "date": "2026-04-21", "publisherClass": "news" }, { "title": "European Health Data Space Regulation (EHDS) (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 38, "summary": "A clinician sees another provider's documents only if the patient holds an EPD and grants access, or in an emergency unless the patient excluded it. With few dossiers and about 10 percent of outpatient doctors connected, this is rare.", "sources": [ { "title": "Verordnung über das elektronische Patientendossier (EPDV), SR 816.11, Stand 1. Oktober 2024", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2017/204/20241001/de/html/fedlex-data-admin-ch-eli-cc-2017-204-20241001-de-html-2.html", "date": "2024-10-01", "publisherClass": "legal_text" }, { "title": "Bundesgesetz über das elektronische Patientendossier (EPDG), SR 816.1, Stand 1. Oktober 2024", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2017/203/20241001/de/html/fedlex-data-admin-ch-eli-cc-2017-203-20241001-de-html-2.html", "date": "2024-10-01", "publisherClass": "legal_text" }, { "title": "Faktenblatt: Das elektronische Patientendossier in Zahlen (BAG)", "url": "https://www.bag.admin.ch/dam/de/sd-web/KMR8cp6wryyN/Faktenblatt%20EPD%20in%20Zahlen%20(Stand%20Oktober%202025).pdf", "date": "2025-11-05", "publisherClass": "official" }, { "title": "Aktueller Stand des EPD in der Schweiz (eHealth Suisse)", "url": "https://www.e-health-suisse.ch/koordination/elektronisches-patientendossier/aktueller-stand", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 66, "summary": "The Human Research Act requires consent to reuse identifiable data and genetic data, while coded non-genetic data may be reused after information unless the person objects. Cancer registration has its own right to object since 2020.", "sources": [ { "title": "Bundesgesetz über die Forschung am Menschen (HFG), SR 810.30, Stand 1. September 2023", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2013/617/20230901/de/html/fedlex-data-admin-ch-eli-cc-2013-617-20230901-de-html-10.html", "date": "2023-09-01", "publisherClass": "legal_text" }, { "title": "Bundesgesetz über die Registrierung von Krebserkrankungen (KRG), SR 818.33, Stand 1. September 2023", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2018/289/20230901/de/html/fedlex-data-admin-ch-eli-cc-2018-289-20230901-de-html-9.html", "date": "2023-09-01", "publisherClass": "legal_text" }, { "title": "Generalkonsent (swissethics)", "url": "https://swissethics.ch/documents/generalkonsent", "date": "undated", "publisherClass": "official" }, { "title": "Revision des Humanforschungsgesetzes und des Stammzellenforschungsgesetzes (BAG)", "url": "https://www.bag.admin.ch/de/humanforschung-revision-hfg-stfg", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 56, "summary": "Medical software, including AI, is regulated under the Medical Devices Ordinance, which uses EU MDR classification and requires post-market surveillance and incident reporting. Switzerland has no AI law yet and chose in February 2025 to ratify the Council of Europe AI convention.", "sources": [ { "title": "Medizinprodukteverordnung (MepV), SR 812.213, Stand 1. Juli 2026", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2020/552/20260701/de/html/fedlex-data-admin-ch-eli-cc-2020-552-20260701-de-html-2.html", "date": "2026-07-01", "publisherClass": "legal_text" }, { "title": "Rahmenbedingungen für KI in Arzneimittelentwicklung und regulatorischem Prozess (Swissmedic)", "url": "https://www.swissmedic.ch/swissmedic/de/home/humanarzneimittel/authorisations/artificiel-intelligence.html", "date": "undated", "publisherClass": "official" }, { "title": "Bundesrat will KI-Konvention des Europarats ratifizieren (Bundesrat)", "url": "https://www.admin.ch/gov/de/start/dokumentation/medienmitteilungen.msg-id-104110.html", "date": "2025-02-12", "publisherClass": "official" } ] } }, "laws": [ { "name": "Bundesgesetz über den Datenschutz (DSG)", "level": "National", "year": "2020", "what": "In force 1 Sept 2023. Health is sensitive data; free access within 30 days; breach reports; fines to CHF 250,000.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2022/491/20250707/de/html/fedlex-data-admin-ch-eli-cc-2022-491-20250707-de-html-1.html" }, { "name": "Bundesgesetz über das elektronische Patientendossier (EPDG)", "level": "National", "year": "2015", "what": "Opt-in EPD; patient sets access rights, can exclude providers; all access logged; emergency access unless excluded.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2017/203/20241001/de/html/fedlex-data-admin-ch-eli-cc-2017-203-20241001-de-html-2.html" }, { "name": "Bundesgesetz über das elektronische Gesundheitsdossier (EGDG), bill", "level": "National", "year": "2025", "what": "Opt-out E-GD for every resident, central federal system, mandatory outpatient use. Passed National Council September 2026.", "url": "https://www.edi.admin.ch/de/bundesrat-beschliesst-neuausrichtung-elektronisches-gesundheitsdossier-e-gd-loest-epd-ab" }, { "name": "Strafgesetzbuch (StGB), Art. 321", "level": "National", "year": "1937", "what": "Professional secrecy: health professionals who disclose patient secrets without consent face up to three years in prison.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/54/757_781_799/20261001/de/html/fedlex-data-admin-ch-eli-cc-54-757_781_799-20261001-de-html.html" }, { "name": "Bundesgesetz über die Forschung am Menschen (HFG)", "level": "National", "year": "2011", "what": "Consent for reuse of identifiable and genetic data; coded non-genetic data reusable unless the person objects.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2013/617/20230901/de/html/fedlex-data-admin-ch-eli-cc-2013-617-20230901-de-html-10.html" }, { "name": "Krebsregistrierungsgesetz (KRG)", "level": "National", "year": "2016", "what": "National cancer registration (in force 2020); data registered only if the informed patient does not object.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2018/289/20230901/de/html/fedlex-data-admin-ch-eli-cc-2018-289-20230901-de-html-9.html" }, { "name": "Medizinprodukteverordnung (MepV)", "level": "National", "year": "2020", "what": "Software as medical device; EU MDR classification; post-market surveillance and incident reports to Swissmedic.", "url": "https://fedlex.data.admin.ch/filestore/fedlex.data.admin.ch/eli/cc/2020/552/20260701/de/html/fedlex-data-admin-ch-eli-cc-2020-552-20260701-de-html-2.html" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-07-06", "headline": "Practitioner rebuilt a patient file after the fact, leaving out treatments; conviction upheld", "paraphrase": "Patients asked a practitioner for their records and did not get them. Before police questioning he created a new electronic file showing one treatment where the original showed three. The court upheld his forgery conviction.", "source": "Swiss Federal Supreme Court (Bundesgericht), 6B_310/2025", "url": "https://entscheidsuche.ch/docs/CH_BGer/CH_BGer_006_6B-310-2025_2026-07-06.html", "theme": "record_wrong", "status": "finding" }, { "date": "2025-09-09", "headline": "Family refused a deceased relative's hospital record; top court upholds secrecy after death", "paraphrase": "After a patient died in hospital, his widow and child sought access to his record. Cantonal authorities refused to release the doctor from secrecy, and the federal court agreed, saying confidentiality outlasts death and applies to relatives too.", "source": "Swiss Federal Supreme Court (Bundesgericht), 2C_567/2024", "url": "https://entscheidsuche.ch/docs/CH_BGer/CH_BGer_002_2C-567-2024_2025-09-09.html", "theme": "access_refused", "status": "finding" }, { "date": "2026-05-08", "headline": "Radiology network hit by a second cyberattack a year after patient data was stolen", "paraphrase": "A radiology network operating in seven cantons was attacked again in April 2026 and postponed some examinations. It could not yet say whether data was taken. In an attack a year earlier, patient data was stolen and a ransom demanded.", "source": "Medinside", "url": "https://www.medinside.ch/de/ein-jahr-danach-neue-cyberattacke-auf-radiologie-netwerk-20260507", "theme": "breach", "status": "alleged" }, { "date": "2025-01-09", "headline": "After a cyberattack, over 100 doctors could not open patient files for a month", "paraphrase": "A cyberattack on a medical group left more than 100 affiliated doctors without access to patient files, schedules and billing for over a month. Its medical director said doctors had to rebuild files and no data had appeared online.", "source": "RTS", "url": "https://www.rts.ch/info/regions/vaud/2025/article/cyberattaque-a-lausanne-medecins-sans-acces-aux-dossiers-patients-28750319.html", "theme": "other", "status": "admitted" } ] }, { "iso3": "SAU", "name": "Saudi Arabia", "region": "Middle East", "overall": 53, "rank": "46", "likelyRank": "30 to 57", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "A national record links over 30 million people and Sehhaty shows much of it, but patients have no working say over sharing.", "categories": { "access": { "score": 64, "summary": "The PDPL gives a right to a copy in a common electronic format within 30 days, and Sehhaty passed 31 million users in 2025. How much of the full chart it displays was not verified, so the cell sits low in its band.", "sources": [ { "title": "Personal Data Protection Law, Royal Decree M/19 as amended by M/148 (SDAIA Data Governance Platform, Arabic)", "url": "https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL", "date": "undated", "publisherClass": "legal_text" }, { "title": "Implementing Regulation of the Personal Data Protection Law (Umm Al-Qura official gazette, Arabic)", "url": "https://www.uqn.gov.sa/details?p=23595", "date": "2023-09-07", "publisherClass": "legal_text" }, { "title": "Sehhaty Privacy Policy, issue 3.26 (Sehhaty platform, Ministry of Health)", "url": "https://sehhaty.sa/pages/privacy-policy-en.html", "date": "2025-07-23", "publisherClass": "official" }, { "title": "Health Sector Transformation Program 2025 report highlights (Ministry of Health news, Arabic)", "url": "https://www.moh.gov.sa/ministry/mediacenter/news/pages/news-2026-06-20-001.aspx", "date": "2026-06-20", "publisherClass": "official" } ] }, "control": { "score": 32, "summary": "Data flows into the national record by default and no live opt-out was found, so a 2015 policy's opt-out earns nothing. The cell sits at 32, above Egypt's 25, because the PDPL regulation gives that policy force and consent-withdrawal rights exist on paper.", "sources": [ { "title": "IS0303 Saudi Health Information Exchange Policies v1.0 (Ministry of Health, National eHealth Strategy and Change Management Office)", "url": "https://www.moh.gov.sa/en/Ministry/ehealthstd/Documents/eHealth%20Standards%20Files/Policies/IS0303%20Saudi%20Health%20Information%20Exchange%20Policies%20v1.0.pdf", "date": "2015-02-22", "publisherClass": "official" }, { "title": "Sehhaty Privacy Policy, issue 3.26 (Sehhaty platform, Ministry of Health)", "url": "https://sehhaty.sa/pages/privacy-policy-en.html", "date": "2025-07-23", "publisherClass": "official" }, { "title": "Implementing Regulation of the Personal Data Protection Law (Umm Al-Qura official gazette, Arabic)", "url": "https://www.uqn.gov.sa/details?p=23595", "date": "2023-09-07", "publisherClass": "legal_text" } ] }, "privacy": { "score": 50, "summary": "The PDPL treats health data as sensitive, demands 72-hour breach notice and allows prison for harmful disclosure. But the regulator reports to the Prime Minister, administrative fines reach only private bodies, and no health-sector enforcement decision was found.", "sources": [ { "title": "Personal Data Protection Law, Royal Decree M/19 as amended by M/148 (SDAIA Data Governance Platform, Arabic)", "url": "https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL", "date": "undated", "publisherClass": "legal_text" }, { "title": "SDAIA: penalties on entities that violated the Personal Data Protection Law (Okaz, Arabic)", "url": "https://www.okaz.com.sa/local/na/2254837", "date": "2026-06-30", "publisherClass": "news" }, { "title": "About SDAIA (Saudi Data and AI Authority, Arabic)", "url": "https://sdaia.gov.sa/ar/SDAIA/about/Pages/About.aspx", "date": "undated", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 70, "summary": "The Ministry of Health reported over 30 million people linked to the nphies unified record in 2024 and 40 million e-prescriptions through Wasfaty. The Saudi Health Council reported 33 million and 1.1 billion data exchanges in 2025, but completeness by facility was not verified.", "sources": [ { "title": "Health system achievements in 2024 (Ministry of Health news, Arabic)", "url": "https://www.moh.gov.sa/ministry/mediacenter/news/pages/news-2025-01-26-001.aspx", "date": "2025-01-26", "publisherClass": "official" }, { "title": "nphies home page with platform phases (nphies, Internet Archive copy of 10 Jul 2025, Arabic)", "url": "https://web.archive.org/web/20250710005755/https://nphies.sa/", "date": "undated", "publisherClass": "official" }, { "title": "1.1 billion transactions support health transformation: Saudi Health Council 2025 report (Al Watan, Arabic)", "url": "https://www.alwatan.com.sa/article/1183044", "date": "2026-07-15", "publisherClass": "news" }, { "title": "Health Sector Transformation Program 2025 report highlights (Ministry of Health news, Arabic)", "url": "https://www.moh.gov.sa/ministry/mediacenter/news/pages/news-2026-06-20-001.aspx", "date": "2026-06-20", "publisherClass": "official" } ] }, "commercial": { "score": 54, "summary": "The PDPL bars using sensitive data, including health data, for marketing, and SDAIA fined firms in 2026 for marketing without consent. Sehhaty may share data with partners and use masked data for innovation, and no rule on selling de-identified data was found.", "sources": [ { "title": "Personal Data Protection Law, Royal Decree M/19 as amended by M/148 (SDAIA Data Governance Platform, Arabic)", "url": "https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL", "date": "undated", "publisherClass": "legal_text" }, { "title": "IS0303 Saudi Health Information Exchange Policies v1.0 (Ministry of Health, National eHealth Strategy and Change Management Office)", "url": "https://www.moh.gov.sa/en/Ministry/ehealthstd/Documents/eHealth%20Standards%20Files/Policies/IS0303%20Saudi%20Health%20Information%20Exchange%20Policies%20v1.0.pdf", "date": "2015-02-22", "publisherClass": "official" }, { "title": "SDAIA: penalties on entities that violated the Personal Data Protection Law (Okaz, Arabic)", "url": "https://www.okaz.com.sa/local/na/2254837", "date": "2026-06-30", "publisherClass": "news" }, { "title": "Sehhaty Privacy Policy, issue 3.26 (Sehhaty platform, Ministry of Health)", "url": "https://sehhaty.sa/pages/privacy-policy-en.html", "date": "2025-07-23", "publisherClass": "official" } ] }, "clinical": { "score": 54, "summary": "Clinicians with a treatment relationship can open the unified record, with role-based limits and break-the-glass access, and nphies offers a provider portal and image viewer. No figures on point-of-care use were found, so the cell stays in the mixed band.", "sources": [ { "title": "IS0303 Saudi Health Information Exchange Policies v1.0 (Ministry of Health, National eHealth Strategy and Change Management Office)", "url": "https://www.moh.gov.sa/en/Ministry/ehealthstd/Documents/eHealth%20Standards%20Files/Policies/IS0303%20Saudi%20Health%20Information%20Exchange%20Policies%20v1.0.pdf", "date": "2015-02-22", "publisherClass": "official" }, { "title": "Sehhaty Privacy Policy, issue 3.26 (Sehhaty platform, Ministry of Health)", "url": "https://sehhaty.sa/pages/privacy-policy-en.html", "date": "2025-07-23", "publisherClass": "official" }, { "title": "nphies home page with platform phases (nphies, Internet Archive copy of 10 Jul 2025, Arabic)", "url": "https://web.archive.org/web/20250710005755/https://nphies.sa/", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Research may use health data without consent only if identity is removed, and ethics committees approve uses of exchange data case by case. There is no research opt-out and no public register, so two safeguards (ethics review, penalties for misuse) lift a base of 40.", "sources": [ { "title": "Personal Data Protection Law, Royal Decree M/19 as amended by M/148 (SDAIA Data Governance Platform, Arabic)", "url": "https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL", "date": "undated", "publisherClass": "legal_text" }, { "title": "IS0303 Saudi Health Information Exchange Policies v1.0 (Ministry of Health, National eHealth Strategy and Change Management Office)", "url": "https://www.moh.gov.sa/en/Ministry/ehealthstd/Documents/eHealth%20Standards%20Files/Policies/IS0303%20Saudi%20Health%20Information%20Exchange%20Policies%20v1.0.pdf", "date": "2015-02-22", "publisherClass": "official" }, { "title": "Implementing Regulation of the Law of Ethics of Research on Living Creatures, 3rd edition (National Committee of Bioethics; copy hosted by Prince Sattam bin Abdulaziz University, Arabic)", "url": "https://www.psau.edu.sa/drgs//sitesuploads/drgs/2025-10/%D8%A7%D9%84%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%A7%D9%84%D8%AA%D9%86%D9%81%D9%8A%D8%B0%D9%8A%D8%A9%20%D9%84%D9%86%D8%B8%D8%A7%D9%85%20%D8%A3%D8%AE%D9%84%D8%A7%D9%82%D9%8A%D8%A7%D8%AA%20%D8%A7%D9%84%D8%A8%D8%AD%D9%88%D8%AB%20%D8%B9%D9%84%D9%89%20%D8%A7%D9%84%D9%85%D8%AE%D9%84%D9%88%D9%82%D8%A7%D8%AA%20%D8%A7%D9%84%D8%AD%D9%8A%D8%A9.pdf", "date": "2022", "publisherClass": "legal_text" }, { "title": "Sehhaty Privacy Policy, issue 3.26 (Sehhaty platform, Ministry of Health)", "url": "https://sehhaty.sa/pages/privacy-policy-en.html", "date": "2025-07-23", "publisherClass": "official" } ] }, "ai": { "score": 58, "summary": "SFDA treats AI software as a medical device and its MDS-G010 guidance requires clinical validation, post-market monitoring and change notice. G010 is guidance, the binding change rule was seen only as quoted in it, and SDAIA's AI ethics rules carry no penalties.", "sources": [ { "title": "MDS-G010 Guidance on AI and Machine Learning based Medical Devices (Saudi Food and Drug Authority)", "url": "https://www.sfda.gov.sa/sites/default/files/2023-01/MDS-G010ML.pdf", "date": "2022-11-29", "publisherClass": "official" }, { "title": "MDS-G27 Guidance on Digital Health Products (Saudi Food and Drug Authority)", "url": "https://sfda.gov.sa/sites/default/files/2026-08/MDS-G027_0.pdf", "date": "2025-08-10", "publisherClass": "official" }, { "title": "SFDA grants marketing authorization for AI-powered medical app (Arab News, via SPA)", "url": "https://www.arabnews.com/node/2648143/saudi-arabia", "date": "2026-06-22", "publisherClass": "news" }, { "title": "AI Ethics Principles (SDAIA)", "url": "https://sdaia.gov.sa/en/SDAIA/about/Documents/ai-principles.pdf", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Personal Data Protection Law (Royal Decree M/19, amended by M/148)", "level": "National", "year": "2021", "what": "Health data is sensitive; access and copy rights; marketing ban for sensitive data; prison and fines.", "url": "https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL" }, { "name": "Implementing Regulation of the Personal Data Protection Law", "level": "National", "year": "2023", "what": "30-day request deadline, electronic copies, 72-hour breach notice, extra health data controls.", "url": "https://www.uqn.gov.sa/details?p=23595" }, { "name": "IS0303 Saudi Health Information Exchange Policies", "level": "National", "year": "2015", "what": "Opt-out sharing model, disclosure reports, break-the-glass, ethics approval for research, bans market studies.", "url": "https://www.moh.gov.sa/en/Ministry/ehealthstd/Documents/eHealth%20Standards%20Files/Policies/IS0303%20Saudi%20Health%20Information%20Exchange%20Policies%20v1.0.pdf" }, { "name": "Implementing Regulation of the Law of Ethics of Research on Living Creatures (3rd edition)", "level": "National", "year": "2022", "what": "Informed consent, local ethics committees, exemptions for non-identifiable data, penalties committee.", "url": "https://www.psau.edu.sa/drgs//sitesuploads/drgs/2025-10/%D8%A7%D9%84%D9%84%D8%A7%D8%A6%D8%AD%D8%A9%20%D8%A7%D9%84%D8%AA%D9%86%D9%81%D9%8A%D8%B0%D9%8A%D8%A9%20%D9%84%D9%86%D8%B8%D8%A7%D9%85%20%D8%A3%D8%AE%D9%84%D8%A7%D9%82%D9%8A%D8%A7%D8%AA%20%D8%A7%D9%84%D8%A8%D8%AD%D9%88%D8%AB%20%D8%B9%D9%84%D9%89%20%D8%A7%D9%84%D9%85%D8%AE%D9%84%D9%88%D9%82%D8%A7%D8%AA%20%D8%A7%D9%84%D8%AD%D9%8A%D8%A9.pdf" }, { "name": "SFDA MDS-G010 Guidance on AI/ML based Medical Devices", "level": "National", "year": "2022", "what": "Clinical validation, post-market monitoring and change notification for AI medical devices.", "url": "https://www.sfda.gov.sa/sites/default/files/2023-01/MDS-G010ML.pdf" }, { "name": "SFDA MDS-G27 Guidance on Digital Health Products", "level": "National", "year": "2025", "what": "Defines when apps, telemedicine, wearables and AI tools are regulated medical devices.", "url": "https://sfda.gov.sa/sites/default/files/2026-08/MDS-G027_0.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-09-18", "headline": "Ministry penalised practitioners who filmed patients during care and posted the clips", "paraphrase": "The paper reported cases documented by the health ministry in which practitioners photographed patients during care and published the images online. In one case the ministry cancelled a licence and imposed a fine.", "source": "Al Watan (Saudi Arabia)", "url": "https://www.alwatan.com.sa/article/1185817", "theme": "breach", "status": "finding" }, { "date": "2024-11-10", "headline": "Health ministry refers practitioners who posted improper clips, including one with an inpatient", "paraphrase": "The ministry said it found practitioners posting improper videos on social platforms, one showing a practitioner with a hospital inpatient, and referred them for legal action. It noted rules bar photographing patients outside narrow exceptions.", "source": "Okaz", "url": "https://www.okaz.com.sa/news/local/2173683", "theme": "breach", "status": "alleged" }, { "date": "2026-05-07", "headline": "Patients say hospital call centres abroad asked for their full personal details", "paraphrase": "Callers told the paper that hospital booking lines, staffed from outside the kingdom, asked for ID numbers, birth dates and full patient details before sending them to an app. Security specialists warned of leak and misuse risks.", "source": "Al Watan", "url": "https://www.alwatan.com.sa/article/1180355", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "BRA", "name": "Brazil", "region": "Americas", "overall": 52, "rank": "47=", "likelyRank": "33 to 61", "band": "Mixed", "keysModel": "State", "confidence": "high", "headline": "Brazil's national network holds over 5 billion health records and patients can see part of theirs, but the state decides who else sees them.", "categories": { "access": { "score": 62, "summary": "LGPD gives a free right of access with a 15-day deadline, and the national Meu SUS Digital app shows vaccines, exam results, medicines and visit records. It is a partial record: no export was found and patients cannot correct entries themselves.", "sources": [ { "title": "Meu SUS Digital: perguntas e respostas, cidadão (Ministério da Saúde)", "url": "https://www.gov.br/saude/pt-br/composicao/seidigi/meususdigital/perguntas-e-respostas/cidadao", "date": "undated", "publisherClass": "official" }, { "title": "Lei 13.709/2018, Lei Geral de Proteção de Dados (texto compilado, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm", "date": "2018-08-14", "publisherClass": "legal_text" }, { "title": "Código de Ética Médica, Resolução CFM 2.217/2018 (CFM)", "url": "https://portal.cfm.org.br/images/PDF/cem2019.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Ministério da Saúde inicia jornada para a Nuvem Soberana do SUS (Ministério da Saúde)", "url": "https://www.gov.br/saude/pt-br/assuntos/noticias-ms/2026/agosto/ministerio-da-saude-inicia-jornada-para-a-nuvem-soberana-do-sus", "date": "2026-08-11", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "Decree 12,560/2025 puts the Ministry of Health in charge of the RNDS and limits clinician access to the care context, but sets no patient consent switch. A published notice offering an opt-out from clinician viewing could not be verified as working today.", "sources": [ { "title": "Decreto nº 12.560, de 23 de julho de 2025 (RNDS e Plataformas SUS Digital, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12560.htm", "date": "2025-07-23", "publisherClass": "legal_text" }, { "title": "Implementação de requisitos de privacidade da LGPD e ISO no Conecte SUS (UnB, trabalho de conclusão, reproduz a Nota Informativa)", "url": "https://bdm.unb.br/bitstream/10483/39153/1/2023_LucasLopesXavier_tcc.pdf", "date": "2023", "publisherClass": "academic" }, { "title": "Dimensões da privacidade das informações em saúde no Brasil (Direitos Fundamentais & Justiça, n. 47)", "url": "https://dfj.emnuvens.com.br/dfj/article/download/1203/1096/5184", "date": "2022-12", "publisherClass": "academic" }, { "title": "Rede Nacional de Dados em Saúde (Ministério da Saúde)", "url": "https://www.gov.br/saude/pt-br/composicao/seidigi/rnds", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 58, "summary": "LGPD treats health data as sensitive and fines private firms up to R$50 million per violation, but public bodies cannot be fined. The ANPD upheld warnings against the Ministry of Health in December 2025 and opened a case over a 500,000-patient breach in July 2026.", "sources": [ { "title": "ANPD instaura processo de sanção contra OS por falha na proteção de dados de 500 mil pacientes (ANPD)", "url": "https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-instaura-processo-de-sancao-contra-organizacao-social-por-falha-na-protecao-de-dados-de-500-mil-pacientes-de-unidades-publicas-de-saude", "date": "2026-07-08", "publisherClass": "official" }, { "title": "Processo 00261.001882/2022-73, votos do Conselho Diretor sobre recurso do Ministério da Saúde (ANPD, CD 37/2025)", "url": "https://www.gov.br/anpd/pt-br/assuntos/deliberacoes-do-conselho-diretor/circuitos-deliberativos-ano-2025/cd-37-2025-votos.pdf/@@display-file/file", "date": "2025-12-24", "publisherClass": "official" }, { "title": "Lei 13.709/2018, Lei Geral de Proteção de Dados (texto compilado, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm", "date": "2018-08-14", "publisherClass": "legal_text" }, { "title": "Data protection adequacy for non-EU countries (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 55, "summary": "The RNDS is the legal national exchange for public and private care and grew to 4.3 billion records by January 2026, over 5 billion by August. Coverage is uneven: hospital, private lab and health plan data are still being added.", "sources": [ { "title": "Decreto nº 12.560, de 23 de julho de 2025 (RNDS e Plataformas SUS Digital, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12560.htm", "date": "2025-07-23", "publisherClass": "legal_text" }, { "title": "Resumo executivo, 1ª Reunião Ordinária da Comissão Intergestores Tripartite 2026 (Ministério da Saúde, Conass, Conasems)", "url": "https://www.gov.br/saude/pt-br/acesso-a-informacao/gestao-do-sus/articulacao-interfederativa/cit/pautas-de-reunioes-e-resumos/2026/janeiro/resumo-executivo-1a-reuniao-ordinaria-cit.pdf", "date": "2026-01-29", "publisherClass": "official" }, { "title": "Ministério da Saúde inicia jornada para a Nuvem Soberana do SUS (Ministério da Saúde)", "url": "https://www.gov.br/saude/pt-br/assuntos/noticias-ms/2026/agosto/ministerio-da-saude-inicia-jornada-para-a-nuvem-soberana-do-sus", "date": "2026-08-11", "publisherClass": "official" }, { "title": "Saúde digital no SUS avança com aumento de telessaúde e registros na RNDS (Futuro da Saúde)", "url": "https://futurodasaude.com.br/saude-digital-no-sus-telessaude-rnds/", "date": "2026-01-30", "publisherClass": "news" } ] }, "commercial": { "score": 55, "summary": "LGPD bans sharing health data between controllers for economic advantage and bans health plans from using it to select risks. Enforcement is uneven: the ANPD closed a pharmacy data case, while a June 2026 ruling ordered Drogasil to pay R$10 million in collective damages over CPF-for-discount practices.", "sources": [ { "title": "Lei 13.709/2018, Lei Geral de Proteção de Dados (texto compilado, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm", "date": "2018-08-14", "publisherClass": "legal_text" }, { "title": "Decreto nº 12.560, de 23 de julho de 2025 (RNDS e Plataformas SUS Digital, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12560.htm", "date": "2025-07-23", "publisherClass": "legal_text" }, { "title": "Compartilhamento de Dados Pessoais (Ministério da Saúde, LGPD)", "url": "https://www.gov.br/saude/pt-br/acesso-a-informacao/lgpd/compartilhamento-de-dados-pessoais", "date": "undated", "publisherClass": "official" }, { "title": "Juiz proíbe Drogasil de exigir CPF de clientes para dar descontos (Conjur)", "url": "https://conjur.com.br/2026-jun-02/farmacias-nao-podem-exigir-dados-pessoais-de-clientes-na-oferta-de-descontos/", "date": "2026-06-02", "publisherClass": "news" } ] }, "clinical": { "score": 50, "summary": "SUS Digital Profissional, announced in July 2024, lets clinicians open a patient's RNDS history during care anywhere in the country, limited by decree to the care context. The view covers encounters, medicines, vaccines and exams, not full clinical notes.", "sources": [ { "title": "Decreto nº 12.560, de 23 de julho de 2025 (RNDS e Plataformas SUS Digital, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12560.htm", "date": "2025-07-23", "publisherClass": "legal_text" }, { "title": "Profissionais do SUS terão acesso a prontuário unificado de pacientes (Agência Brasil)", "url": "https://agenciabrasil.ebc.com.br/saude/noticia/2024-07/profissionais-do-sus-terao-acesso-a-prontuario-unificado-de-pacientes", "date": "2024-07-16", "publisherClass": "news" }, { "title": "Resumo executivo, 1ª Reunião Ordinária da Comissão Intergestores Tripartite 2026 (Ministério da Saúde, Conass, Conasems)", "url": "https://www.gov.br/saude/pt-br/acesso-a-informacao/gestao-do-sus/articulacao-interfederativa/cit/pautas-de-reunioes-e-resumos/2026/janeiro/resumo-executivo-1a-reuniao-ordinaria-cit.pdf", "date": "2026-01-29", "publisherClass": "official" }, { "title": "SUS Digital recebeu da saúde suplementar 2 bilhões de dados (Mobile Time)", "url": "https://www.mobiletime.com.br/noticias/28/01/2026/saude-sus-dados-enviados/", "date": "2026-01-28", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Research bodies may use RNDS and other health data without individual consent under LGPD Article 13, with no general opt-out. Safeguards are real: ethics committees under Law 14,874/2024, secure environments, a ban on transfer to third parties and a public register of Ministry data sharing.", "sources": [ { "title": "Lei 13.709/2018, Lei Geral de Proteção de Dados (texto compilado, Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm", "date": "2018-08-14", "publisherClass": "legal_text" }, { "title": "Lei nº 14.874, de 28 de maio de 2024, pesquisa com seres humanos (Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2024/lei/L14874.htm", "date": "2024-05-28", "publisherClass": "legal_text" }, { "title": "Decreto nº 12.651, de 7 de outubro de 2025, regulamenta a Lei 14.874 (Planalto)", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12651.htm", "date": "2025-10-07", "publisherClass": "legal_text" }, { "title": "Compartilhamento de Dados Pessoais (Ministério da Saúde, LGPD)", "url": "https://www.gov.br/saude/pt-br/acesso-a-informacao/lgpd/compartilhamento-de-dados-pessoais", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 57, "summary": "Anvisa regulates AI software as a medical device under RDC 657/2022, requiring disclosure of training data and prior approval of significant algorithm changes. CFM Resolution 2,454/2026, in force since August 2026, requires human final decisions and telling patients when AI is used.", "sources": [ { "title": "Software como Dispositivo Médico: perguntas e respostas sobre a RDC 657/2022 (Anvisa)", "url": "https://www.gov.br/anvisa/pt-br/centraisdeconteudo/publicacoes/produtos-para-a-saude/manuais/software-como-dispositivo-medico-perguntas-e-respostas/@@download/file", "date": "2022-09-01", "publisherClass": "official" }, { "title": "Resolução CFM nº 2.454/2026, normatiza o uso da inteligência artificial na medicina (CFM)", "url": "https://sistemas.cfm.org.br/normas/arquivos/resolucoes/BR/2026/2454_2026.pdf", "date": "2026-02-27", "publisherClass": "official" }, { "title": "Norma de IA do CFM chega cercada de dúvidas e desafios de implementação (Futuro da Saúde)", "url": "https://futurodasaude.com.br/resolucao-cfm-inteligencia-artificial/", "date": "2026-08-19", "publisherClass": "news" }, { "title": "UE avança na regulação de IA enquanto projeto brasileiro segue parado na Câmara (*desinformante)", "url": "https://desinformante.com.br/ue-avanca-regulacao-ia-projeto-brasileiro-parado/", "date": "2026-08-12", "publisherClass": "news" } ] } }, "laws": [ { "name": "Lei Geral de Proteção de Dados (Lei 13.709)", "level": "National", "year": "2018", "what": "Health data is sensitive; free access rights; bans sharing for economic advantage and plan risk selection.", "url": "https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709compilado.htm" }, { "name": "Decreto 12.560 (RNDS and SUS Digital platforms)", "level": "National", "year": "2025", "what": "Makes the RNDS the national health data exchange; limits uses; restricts clinician access to care context.", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/decreto/D12560.htm" }, { "name": "Lei 13.787 (digital patient records)", "level": "National", "year": "2018", "what": "Rules for digitising records; keep at least 20 years; records may be returned to the patient.", "url": "http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13787.htm" }, { "name": "Lei 14.874 (research with human beings)", "level": "National", "year": "2024", "what": "National research ethics system; written informed consent; withdrawal at any time.", "url": "https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2024/lei/L14874.htm" }, { "name": "Anvisa RDC 657/2022 (software as a medical device)", "level": "National", "year": "2022", "what": "Regulates medical software including AI; significant algorithm changes need approval before market.", "url": "https://www.gov.br/anvisa/pt-br/centraisdeconteudo/publicacoes/produtos-para-a-saude/manuais/software-como-dispositivo-medico-perguntas-e-respostas/@@download/file" }, { "name": "Resolução CFM 2.454 (AI in medicine)", "level": "National", "year": "2026", "what": "Doctors keep final decisions, record AI use, inform patients; institutions classify AI risk.", "url": "https://sistemas.cfm.org.br/normas/arquivos/resolucoes/BR/2026/2454_2026.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-07-08", "headline": "Regulator opens case after attack on health operator affecting 500,000 patients' records", "paraphrase": "A ransomware attack on an organisation running public health units in several states affected records of about 500,000 patients. The data authority opened a sanction case, citing poor notice to those affected. The operator denies any data leaked.", "source": "CNN Brasil", "url": "https://www.cnnbrasil.com.br/nacional/brasil/anpd-investiga-ataque-cibernetico-que-vazou-dados-de-500-mil-pacientes/", "theme": "breach", "status": "alleged" }, { "date": "2026-05-28", "headline": "Court upholds damages after a patient's test details appeared in internet search", "paraphrase": "Data about a woman's medical test could be opened directly from a major search engine, with no password. A Santa Catarina court found two clinics failed to protect it and upheld R$5,000 in damages, ordering the data removed.", "source": "Consultor Jurídico (ConJur)", "url": "https://conjur.com.br/2026-mai-28/tj-sc-manda-clinica-indenizar-paciente-por-exposicao-de-dados-sensiveis/", "theme": "breach", "status": "finding" }, { "date": "2024-12-16", "headline": "Pharmacy chain fined R$8.4 million for demanding customers' tax ID at checkout", "paraphrase": "Minas Gerais consumer authority Procon fined a pharmacy chain over stores requiring customers' CPF at the counter. The decision warned hidden profiling of purchases could expose medicine records, for example to insurers refusing cover.", "source": "Hoje em Dia", "url": "https://www.hojeemdia.com.br/minas/droga-raia-e-multada-em-r-8-4-milh-es-por-exigir-cpf-de-cliente-na-hora-da-compra-em-bh-1.1044784", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-12-18", "headline": "Nurse technician fired for opening a colleague's medical record 18 times", "paraphrase": "A hospital nursing technician opened the record of her former husband's wife 18 times, though she was not caring for her, over personal disputes. A labour court in Rio Grande do Sul upheld her dismissal for cause.", "source": "Tribunal Regional do Trabalho da 4ª Região (Rio Grande do Sul)", "url": "https://www.trt4.jus.br/portais/trt4/modulos/noticias/50725782", "theme": "breach", "status": "finding" } ] }, { "iso3": "CAN", "name": "Canada", "region": "Americas", "overall": 52, "rank": "47=", "likelyRank": "33 to 60", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Provinces grant record access and Quebec and Ontario allow blocking, but records stop at provincial borders and only 13% see core records online.", "categories": { "access": { "score": 50, "summary": "Provincial laws give a right to a copy, and the largest provinces run portals with labs and medications. But in 2025 only 13% of adults could see test results, vaccines and medication history online, and Quebec holds results back 30 days.", "sources": [ { "title": "Personal Health Information Protection Act, 2004 (Ontario e-Laws)", "url": "https://www.ontario.ca/laws/statute/04p03", "date": "undated", "publisherClass": "legal_text" }, { "title": "Comment les Canadiens accèdent-ils aux services de santé numériques? (How Canadians access digital health services, CIHI)", "url": "https://www.cihi.ca/fr/information-numerique-sur-la-sante-au-canada-mesure-de-lacces-et-de-lutilisation/le-point-de-vue-des-canadiens", "date": "2026-07-23", "publisherClass": "official" }, { "title": "Health Gateway (Government of British Columbia)", "url": "https://www2.gov.bc.ca/gov/content/health/managing-your-health/health-gateway", "date": "undated", "publisherClass": "official" }, { "title": "Québec poursuivi pour son Carnet santé (Quebec sued over its Carnet santé, La Presse)", "url": "https://www.lapresse.ca/actualites/2026-03-02/quebec-poursuivi-pour-son-carnet-sante.php", "date": "2026-03-02", "publisherClass": "news" } ] }, "control": { "score": 55, "summary": "Control depends on the province. Quebec lets patients block named providers or categories from chosen items and shows an access log in Carnet santé, while Ontario cut its EHR blocks to whole repositories in February 2026 and gives logs only on request.", "sources": [ { "title": "Limiter l'accès aux renseignements de santé et de services sociaux (Limiting access to health information, Gouvernement du Québec)", "url": "https://www.quebec.ca/sante/vos-informations-de-sante/loi-renseignements-sante-services-sociaux", "date": "2024-07-01", "publisherClass": "official" }, { "title": "Carnet santé Québec (Gouvernement du Québec)", "url": "https://www.quebec.ca/sante/vos-informations-de-sante/carnet-sante-quebec", "date": "2026-01-28", "publisherClass": "official" }, { "title": "Memo: Important Changes to Consent Management in the Electronic Health Record (Ontario Health)", "url": "https://www.ontariohealth.ca/news/memo-changes-consent-management-electronic-health-record.html", "date": "2026-02-25", "publisherClass": "official" }, { "title": "Electronic Health Record Request for Access to Personal Health Information policy (Ontario Health)", "url": "https://ontariohealth.ca/about/privacy/resources/ehr-request-access-phi.html", "date": "2026-08-10", "publisherClass": "official" } ] }, "privacy": { "score": 58, "summary": "Health data has dedicated provincial laws, and Ontario's regulator now fines snoopers. But Ontario logged 785 health breaches in 2025, and the federal commissioner still cannot order compliance; reform with fines up to 3% of global revenue sits at first reading.", "sources": [ { "title": "2025 Annual Report: Statistics (IPC Ontario)", "url": "https://www.ipc.on.ca/en/2025-annual-report/statistics", "date": "2026", "publisherClass": "official" }, { "title": "IPC issues third administrative monetary penalty under Ontario's health privacy law (IPC Ontario)", "url": "https://www.ipc.on.ca/en/decisions/ipc-issues-third-administrative-monetary-penalty-under-ontarios-health-privacy-law", "date": "2026-08-26", "publisherClass": "official" }, { "title": "Third Time's the Charm? Canada's Latest Approach to Reform the Federal Private-Sector Privacy Framework (Blakes)", "url": "https://www.blakes.com/insights/third-time-s-the-charm-canada-s-latest-approach-to-reform-the-federal-private-sector-privacy-framew/", "date": "2026-09-25", "publisherClass": "law_firm" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 50, "summary": "Each province links labs, drugs and hospital reports in its own system, but records do not cross provincial lines. In 2024 only 52% of providers shared patient data electronically outside their workplace, from 72% in Alberta to 36% in Quebec.", "sources": [ { "title": "Enquête sur l'utilisation des technologies numériques par les fournisseurs de soins de santé, 2025 (Survey on health providers' use of digital technology, Statistics Canada)", "url": "https://www150.statcan.gc.ca/n1/daily-quotidien/260330/dq260330b-fra.htm", "date": "2026-03-30", "publisherClass": "official" }, { "title": "Patient Access to Digital Health Services (Ontario Health)", "url": "https://ontariohealth.ca/digital/programs-services/patient-access-digital-health.html", "date": "2026-06-04", "publisherClass": "official" }, { "title": "Le point de vue des dispensateurs de soins de santé (The providers' perspective, CIHI)", "url": "https://www.cihi.ca/fr/information-numerique-sur-la-sante-au-canada-mesure-de-lacces-et-de-lutilisation/le-point-de-vue-des-dispensateurs-de-soins-de-sante", "date": "2026-07-23", "publisherClass": "official" }, { "title": "S-5 (45-1), Connected Care for Canadians Act, LEGISinfo (Parliament of Canada)", "url": "https://www.parl.ca/legisinfo/en/bill/45-1/s-5", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Ontario's PHIPA bars use of health data for marketing without express consent. Yet a 2025 study found clinic chains and data brokers turning primary care records into products for drug makers, and the federal regulator cannot fine.", "sources": [ { "title": "Personal Health Information Protection Act, 2004 (Ontario e-Laws)", "url": "https://www.ontario.ca/laws/statute/04p03", "date": "undated", "publisherClass": "legal_text" }, { "title": "Millions of Canadians' health data available for sale to pharmaceutical industry, study shows (CBC News)", "url": "https://www.cbc.ca/news/health/health-data-records-pharmaceutical-private-clinics-1.7529955", "date": "2025-05-09", "publisherClass": "news" }, { "title": "The quiet commercialization of primary care records (Healthy Debate)", "url": "https://healthydebate.ca/2026/01/topic/the-quiet-commercialization-of-primary-care-records/", "date": "2026-01-20", "publisherClass": "news" }, { "title": "Résumé de l'enquête conjointe sur l'atteinte chez 23andMe (Joint 23andMe breach investigation summary, OPC)", "url": "https://www.priv.gc.ca/fr/nouvelles-du-commissariat/nouvelles-et-annonces/2025/info_23andme_250617/", "date": "2025-06-17", "publisherClass": "official" } ] }, "clinical": { "score": 55, "summary": "Clinicians in most provinces can open a provincial viewer with labs, drugs and hospital reports. But 17% of providers said in 2025 that barriers stop them using outside records, and nothing follows a patient across provinces.", "sources": [ { "title": "What's an EHR? (eHealth Ontario / Ontario Health)", "url": "https://ehealthontario.on.ca/en/patients-and-families/ehrs-explained", "date": "undated", "publisherClass": "official" }, { "title": "Enquête sur l'utilisation des technologies numériques par les fournisseurs de soins de santé, 2025 (Survey on health providers' use of digital technology, Statistics Canada)", "url": "https://www150.statcan.gc.ca/n1/daily-quotidien/260330/dq260330b-fra.htm", "date": "2026-03-30", "publisherClass": "official" }, { "title": "Le point de vue des dispensateurs de soins de santé (The providers' perspective, CIHI)", "url": "https://www.cihi.ca/fr/information-numerique-sur-la-sante-au-canada-mesure-de-lacces-et-de-lutilisation/le-point-de-vue-des-dispensateurs-de-soins-de-sante", "date": "2026-07-23", "publisherClass": "official" }, { "title": "Dossier santé numérique: un départ chaotique lundi matin (Digital health record: a chaotic Monday start, La Presse)", "url": "https://www.lapresse.ca/actualites/sante/2026-05-11/dossier-sante-numerique/un-depart-chaotique-lundi-matin.php", "date": "2026-05-11", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Identifiable health data can be used for research without consent once an ethics board or Quebec's access centre approves. There is no general opt-out; ethics review, statutory penalties and a Quebec right to refuse research contact lift the cell to 49.", "sources": [ { "title": "Personal Health Information Protection Act, 2004 (Ontario e-Laws)", "url": "https://www.ontario.ca/laws/statute/04p03", "date": "undated", "publisherClass": "legal_text" }, { "title": "EPTC 2 (2022), chapitre 5: Vie privée et confidentialité (TCPS 2 Chapter 5, Panel on Research Ethics)", "url": "https://ethics.gc.ca/fra/tcps2-eptc2_2022_chapter5-chapitre5.html", "date": "2022", "publisherClass": "official" }, { "title": "Accès aux renseignements de santé et de services sociaux par les chercheurs (Researcher access to health information, Gouvernement du Québec)", "url": "https://www.quebec.ca/sante/professionnels/encadrement-recherche-participants-humains/acces-renseignements-sante-services-sociaux-chercheurs-recherche", "date": "2026-01-27", "publisherClass": "official" }, { "title": "Limiter l'accès aux renseignements de santé et de services sociaux (Limiting access to health information, Gouvernement du Québec)", "url": "https://www.quebec.ca/sante/vos-informations-de-sante/loi-renseignements-sante-services-sociaux", "date": "2024-07-01", "publisherClass": "official" } ] }, "ai": { "score": 56, "summary": "Health Canada licenses machine learning medical devices and lets makers pre-authorize planned changes through change control plans. Canada has no AI statute: Bill C-36 has no stand-alone AI rules, and Ontario's 2024 digital trust law has no AI regulation in force.", "sources": [ { "title": "Pre-market guidance for machine learning-enabled medical devices (Health Canada)", "url": "https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/pre-market-guidance-machine-learning-enabled-medical-devices.html", "date": "2026-04-01", "publisherClass": "official" }, { "title": "Bill C-36: A Third Attempt at Federal Private-Sector Privacy Reform (Fasken)", "url": "https://www.fasken.com/en/knowledge/2026/06/bill-c-36", "date": "2026-06-18", "publisherClass": "law_firm" }, { "title": "Enhancing Digital Security and Trust Act (Government of Ontario)", "url": "http://www.ontario.ca/page/enhancing-digital-security-and-trust-act", "date": "2026-05-07", "publisherClass": "official" }, { "title": "IPC releases new guidance on AI scribes to help protect patient privacy (IPC Ontario)", "url": "https://www.ipc.on.ca/en/media-centre/news-releases/ipc-releases-new-guidance-ai-scribes-help-protect-patient-privacy", "date": "2026-01-28", "publisherClass": "official" } ] } }, "laws": [ { "name": "Personal Information Protection and Electronic Documents Act (PIPEDA)", "level": "National", "year": "2000", "what": "Consent-based private-sector privacy law; four provinces have health laws deemed substantially similar.", "url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/" }, { "name": "Personal Health Information Protection Act (PHIPA), Ontario", "level": "State/Provincial", "year": "2004", "what": "Access within 30 days at cost recovery, marketing needs express consent, EHR access logging, fines up to $1 million.", "url": "https://www.ontario.ca/laws/statute/04p03" }, { "name": "Loi sur les renseignements de santé et de services sociaux (LRSSS), Quebec", "level": "State/Provincial", "year": "2023", "what": "Right to restrict named providers, know who accessed records, and controlled researcher access.", "url": "https://www.legisquebec.gouv.qc.ca/fr/document/lc/R-22.1" }, { "name": "Bill S-5, Connected Care for Canadians Act", "level": "National", "year": "2026", "what": "Would mandate interoperability standards and ban vendor data blocking. Passed Senate; not yet law.", "url": "https://www.parl.ca/legisinfo/en/bill/45-1/s-5" }, { "name": "Bill C-36, Protecting Privacy and Consumer Data Act", "level": "National", "year": "2026", "what": "Would replace PIPEDA's privacy part, define health data as sensitive, add penalties. First reading only.", "url": "https://www.parl.ca/documentviewer/fr/45-1/projet-loi/C-36/premiere-lecture" }, { "name": "Pre-market guidance for machine learning-enabled medical devices (Health Canada)", "level": "National", "year": "2026", "what": "Licensing expectations for ML devices, including predetermined change control plans and transparency.", "url": "https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/pre-market-guidance-machine-learning-enabled-medical-devices.html" }, { "name": "Enhancing Digital Security and Trust Act, 2024 (Ontario)", "level": "State/Provincial", "year": "2024", "what": "Public sector cyber rules, including hospitals, in force July 2026; AI rules not yet made.", "url": "http://www.ontario.ca/page/enhancing-digital-security-and-trust-act" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-03-19", "headline": "Doctor did not answer a patient's request for their own health record", "paraphrase": "A patient in Ontario asked their doctor for access to their health information and got no reply within the legal time limit. The commissioner treated the silence as a refusal and ordered the doctor to respond.", "source": "Information and Privacy Commissioner of Ontario (PHIPA Decision 332)", "url": "https://www.ipc.on.ca/en/decisions/latest-decisions/phipa-decision-332", "theme": "access_refused", "status": "finding" }, { "date": "2026-02-06", "headline": "Health authority ordered to release withheld lines from a patient's own hospital record", "paraphrase": "A patient in British Columbia asked for her own hospital records. The health authority released them but blacked out three sentences. The commissioner found no good reason to withhold them and ordered them disclosed.", "source": "Office of the Information and Privacy Commissioner for British Columbia (Order F26-09)", "url": "https://www.oipc.bc.ca/documents/orders/3088", "theme": "access_refused", "status": "finding" }, { "date": "2025-03-31", "headline": "Health worker looked into 70 people's records; patients not properly told", "paraphrase": "An employee opened the electronic health records of 70 people in Saskatchewan 210 times without a work reason. The commissioner found the health authority did not contain the breach properly or tell those affected enough.", "source": "Office of the Saskatchewan Information and Privacy Commissioner (Investigation Report 266-2024, 031-2025)", "url": "https://oipc.sk.ca/assets/hipa-investigation_266-2024-031-2025.pdf", "theme": "breach", "status": "finding" }, { "date": "2026-04-29", "headline": "Hospital network kept failing to stop staff opening patients' records, watchdog finds", "paraphrase": "Ontario's privacy commissioner found several workers at an Ontario hospital network opened patient records without authority between 2023 and 2025. In one breach up to 326 patients were affected, and some were not told for ten months.", "source": "CBC News", "url": "https://www.cbc.ca/news/canada/toronto/lakeridge-health-failed-to-protect-patients-medical-records-9.7182011", "theme": "breach", "status": "finding" }, { "date": "2026-05-21", "headline": "Unions say every Quebec health worker in one region can open any patient's record", "paraphrase": "Health unions in a Quebec region said the new digital health record lets workers of every job type, including those not giving care, open the records of all patients in the region, and asked for the rollout to pause.", "source": "Radio-Canada", "url": "https://ici.radio-canada.ca/nouvelle/2255476/preoccupations-syndicales-dsn-donnees-personnelles", "theme": "other", "status": "alleged" } ] }, { "iso3": "THA", "name": "Thailand", "region": "Asia", "overall": 52, "rank": "47=", "likelyRank": "36 to 64", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "Thais can choose which hospitals share their records through Health Link, but sign-up is optional and ministry data flows without a choice.", "categories": { "access": { "score": 50, "summary": "The PDPA gives a right to a copy within 30 days, and Health Link on the Paotang and Tang Rat apps lets opted-in users see treatment and claims history. Only about 30,129 people had viewed records on Tang Rat by April 2026, and hospitals charge for copies.", "sources": [ { "title": "Personal Data Protection Act B.E. 2562 (2019), unofficial translation (Ministry of Digital Economy and Society)", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-", "date": "2019-05-27", "publisherClass": "legal_text" }, { "title": "BDI, NHSO and DGA sign MOU to upgrade Health Link nationwide (Thansettakij)", "url": "https://www.thansettakij.com/health-wellness/657666", "date": "2026-04-27", "publisherClass": "news" }, { "title": "BDI says Tang Rat and Health Link only display data and never edit it (Thansettakij)", "url": "https://www.thansettakij.com/health-wellness/665340", "date": "2026-07-31", "publisherClass": "news" }, { "title": "Requesting copies of medical records and service fees (Ramathibodi Hospital, Mahidol University)", "url": "https://www.rama.mahidol.ac.th/medicalrecord/th/prepare_doc_for_copy", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 50, "summary": "Health Link is opt-in: a person chooses which hospitals may share, some hospitals ask for consent each time, and consent can be withdrawn at any time. Ministry of Public Health data flows to its cloud without a verified choice, and no patient-visible access log was verified.", "sources": [ { "title": "Health Link: Thailand's health data linking system (Government Public Relations Department)", "url": "https://itcenter.prd.go.th/th/content/article/detail/id/8/iid/335512", "date": "2024-10-29", "publisherClass": "official" }, { "title": "Health Link: getting to know the health data link on Paotang (Government Public Relations Department)", "url": "https://www.prd.go.th/th/content/category/detail/id/31/iid/505311", "date": "2026-05-21", "publisherClass": "official" }, { "title": "Personal Data Protection Act B.E. 2562 (2019), unofficial translation (Ministry of Digital Economy and Society)", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-", "date": "2019-05-27", "publisherClass": "legal_text" }, { "title": "Mor Prom revived: from vaccine app to national health Super App (Thai PBS Policy Watch)", "url": "https://policywatch.thaipbs.or.th/article/life-243", "date": "2026-01-11", "publisherClass": "news" } ] }, "privacy": { "score": 55, "summary": "The PDPA makes health data sensitive, requires breach notice within 72 hours and allows fines up to 5 million baht. The regulator fined a private hospital 1.21 million baht in 2025 after over 1,000 medical records leaked.", "sources": [ { "title": "Personal Data Protection Act B.E. 2562 (2019), unofficial translation (Ministry of Digital Economy and Society)", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-", "date": "2019-05-27", "publisherClass": "legal_text" }, { "title": "PDPC fines a large private hospital 1.2 million baht over leaked medical records (Thai PBS)", "url": "https://www.thaipbs.or.th/news/content/354970", "date": "2025-08-01", "publisherClass": "news" }, { "title": "Key takeaways from Thailand's Data Privacy Day 2026 (Tilleke & Gibbins)", "url": "https://www.tilleke.com/insights/key-takeaways-from-thailands-data-privacy-day-2026/", "date": "2026-01-30", "publisherClass": "law_firm" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 57, "summary": "Health Link and the health ministry's Mor Prom and cloud systems together aim to link about 15,000 to 20,000 facilities, including clinics and pharmacies. The two systems are still being joined, and a Digital Health Act is only in drafting.", "sources": [ { "title": "Health Link: Thailand's health data linking system (Government Public Relations Department)", "url": "https://itcenter.prd.go.th/th/content/article/detail/id/8/iid/335512", "date": "2024-10-29", "publisherClass": "official" }, { "title": "BDI puts Health Link, linking about 20,000 facilities, on the Tang Rat app (MGR Online)", "url": "https://mgronline.com/cyberbiz/detail/9690000039578", "date": "2026-04-27", "publisherClass": "news" }, { "title": "Mor Prom revived: from vaccine app to national health Super App (Thai PBS Policy Watch)", "url": "https://policywatch.thaipbs.or.th/article/life-243", "date": "2026-01-11", "publisherClass": "news" }, { "title": "NHCO briefs parliament on health data, Section 7 and digital health governance (National Health Commission Office)", "url": "https://www.nationalhealth.or.th/public/index.php/NHCO/367", "date": "2026-09-24", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Health data needs explicit consent and cannot be reused beyond its purpose, and people can object to direct marketing. No specific ban on selling de-identified health data was found, and the health ministry plans to draw value from linked data with tech partners.", "sources": [ { "title": "Personal Data Protection Act B.E. 2562 (2019), unofficial translation (Ministry of Digital Economy and Society)", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-", "date": "2019-05-27", "publisherClass": "legal_text" }, { "title": "Key takeaways from Thailand's Data Privacy Day 2026 (Tilleke & Gibbins)", "url": "https://www.tilleke.com/insights/key-takeaways-from-thailands-data-privacy-day-2026/", "date": "2026-01-30", "publisherClass": "law_firm" }, { "title": "Health ministry pushes Mor Prom as national health data hub; 18,052 record complaints (Bangkok Biz News)", "url": "https://www.bangkokbiznews.com/health/public-health/1247304", "date": "2026-08-14", "publisherClass": "news" } ] }, "clinical": { "score": 50, "summary": "With the patient's consent, doctors at linked facilities can see diagnoses, medicines and lab results from other providers through Health Link, and emergency doctors can search records of unconscious patients. Opt-in sign-up and data errors limit how complete the view is.", "sources": [ { "title": "Health Link: Thailand's health data linking system (Government Public Relations Department)", "url": "https://itcenter.prd.go.th/th/content/article/detail/id/8/iid/335512", "date": "2024-10-29", "publisherClass": "official" }, { "title": "Health Link: getting to know the health data link on Paotang (Government Public Relations Department)", "url": "https://www.prd.go.th/th/content/category/detail/id/31/iid/505311", "date": "2026-05-21", "publisherClass": "official" }, { "title": "BDI, NHSO and DGA sign MOU to upgrade Health Link nationwide (Thansettakij)", "url": "https://www.thansettakij.com/health-wellness/657666", "date": "2026-04-27", "publisherClass": "news" }, { "title": "Health ministry pushes Mor Prom as national health data hub; 18,052 record complaints (Bangkok Biz News)", "url": "https://www.bangkokbiznews.com/health/public-health/1247304", "date": "2026-08-14", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "The PDPA allows health data to be used for research without consent if safeguards set by the regulator apply, and there is no general opt-out. Trials need written consent under the National Health Act, and people may object to research use case by case.", "sources": [ { "title": "Personal Data Protection Act B.E. 2562 (2019), unofficial translation (Ministry of Digital Economy and Society)", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-", "date": "2019-05-27", "publisherClass": "legal_text" }, { "title": "National Health Act B.E. 2550 (2007), Thai text (Department of Medical Services)", "url": "https://www.dms.go.th/backend/Content/Content_File/Information_Center/Attach/25621124013609AM_17.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "PDPC Notification on safeguards for research and statistics under sections 24(1) and 26(5)(d), B.E. 2566 (text mirror, SiData)", "url": "https://pdpa.sidata.plus/reference-article-26-5", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "PDPA subordinate laws list, including the PDPC research safeguards notification (Chiang Mai University)", "url": "https://privacy.cmu.ac.th/%E0%B8%9E%E0%B8%A3%E0%B8%B0%E0%B8%A3%E0%B8%B2%E0%B8%8A%E0%B8%9A%E0%B8%B1%E0%B8%8D%E0%B8%8D%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%81%E0%B8%A5%E0%B8%B0%E0%B8%81%E0%B8%8E%E0%B8%AB%E0%B8%A1%E0%B8%B2%E0%B8%A2/", "date": "2025-06-13", "publisherClass": "academic" } ] }, "ai": { "score": 55, "summary": "Medical AI must be registered as a device, and Thai FDA guidance from 2024 says it must disclose training data and must not replace clinical judgment. Limits on continuous learning are only advice, and a general AI Act is still a draft.", "sources": [ { "title": "Guidance manual on regulating software and AI as medical devices (Thai FDA Medical Device Control Division)", "url": "https://medical.fda.moph.go.th/media.php?id=616254428592349184&name=Non-IVD_G_SMD_01_Guidance_SaMD.pdf", "date": "2024-10", "publisherClass": "official" }, { "title": "Regulation of software and AI as medical devices (Thai FDA Medical Device Control Division)", "url": "https://medical.fda.moph.go.th/samd-head", "date": "undated", "publisherClass": "official" }, { "title": "AI push for the economy; business watches new AI law (Thairath)", "url": "https://www.thairath.co.th/money/economics/thai_economics/2958310", "date": "2026-09-09", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Act B.E. 2562", "level": "National", "year": "2019", "what": "Health is sensitive data needing explicit consent; access within 30 days; 72-hour breach notice; research exception.", "url": "https://www.mdes.go.th/law/detail/3577-Personal-Data-Protection-Act-B-E--2562--2019-" }, { "name": "National Health Act B.E. 2550", "level": "National", "year": "2007", "what": "Health information is confidential (s.7); written consent before research experiments (s.9); jail or fine.", "url": "https://www.dms.go.th/backend/Content/Content_File/Information_Center/Attach/25621124013609AM_17.pdf" }, { "name": "Declaration of Patients' Rights and Duties", "level": "National", "year": "2015", "what": "Professional councils' declaration: patients may see their own medical record information on request.", "url": "https://www.pharmacycouncil.org/index.php?option=content_detail&view=detail&itemid=648&catid=1" }, { "name": "PDPC Notification on safeguards for research and statistics", "level": "National", "year": "2023", "what": "Sets security, ethics and pseudonymisation safeguards for research use of data without consent.", "url": "https://pdpa.sidata.plus/reference-article-26-5" }, { "name": "Medical Device Act B.E. 2551 (amended 2019)", "level": "National", "year": "2008", "what": "Basis for Thai FDA registration of software and AI as medical devices.", "url": "https://medical.fda.moph.go.th/media.php?id=616254428592349184&name=Non-IVD_G_SMD_01_Guidance_SaMD.pdf" }, { "name": "Digital Health Act (draft, not enacted)", "level": "National", "year": "2025", "what": "Draft central law for exchanging digital health data; framework agreed October 2025, not enacted.", "url": "https://techsauce.co/healthtech/thai-digital-health-integration-healthlink" }, { "name": "Artificial Intelligence Act (draft, not enacted)", "level": "National", "year": "2026", "what": "Draft risk-based AI law under review after public consultation as of September 2026.", "url": "https://www.thairath.co.th/money/economics/thai_economics/2958310" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-08-02", "headline": "Hospital fined after patient record pages sent for destruction leaked as snack bags", "paraphrase": "A large private hospital hired a small contractor to destroy patient records but did not oversee the work. Over 1,000 record pages leaked and were reused as snack bags. The regulator fined the hospital and the contractor.", "source": "Office of the Personal Data Protection Committee, via Government Public Relations Department", "url": "https://www.prd.go.th/th/content/category/detail/id/39/iid/411380", "theme": "breach", "status": "finding" }, { "date": "2026-08-29", "headline": "Health ministry admits staff errors put false entries in citizens' national health app records", "paraphrase": "Over 9,000 people flagged more than 24,000 entries in their national health app history as wrong. The ministry told a parliamentary committee about a quarter of checked entries were staff data-entry errors and others reflected performance targets, not care given.", "source": "The Standard", "url": "https://thestandard.co/moph-morprom-data-error/", "theme": "record_wrong", "status": "admitted" }, { "date": "2026-08-03", "headline": "People with wrong entries in national health app say claims were blocked", "paraphrase": "Affected people said their national health app history listed treatments they never had, one with 16 false entries. One said an insurance claim could not proceed. They want false entries deleted in writing and those responsible identified.", "source": "The Active (Thai PBS)", "url": "https://theactive.thaipbs.or.th/news/public-health-20260803-2", "theme": "record_wrong", "status": "alleged" }, { "date": "2025-10-28", "headline": "Patients moved after a hospital stopped public scheme care waited days for records", "paraphrase": "After a private hospital stopped public scheme outpatients, transferred patients waited up to seven days for their medical history. The national insurer said it could not reach their data because the hospital was not linked to the national records exchange.", "source": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/3127437/patients-move-over-ct-fee", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2026-07-07", "headline": "Cloud failure took patient records offline at public city hospitals, authority says", "paraphrase": "The city's medical service department announced that a cloud infrastructure failure stopped the patient database, appointment and dispensing systems at 14 of its hospitals. Hospitals stayed open and switched to paper records, but services were delayed.", "source": "Thairath", "url": "https://www.thairath.co.th/news/local/bangkok/2944586", "theme": "other", "status": "admitted" } ] }, { "iso3": "GEO", "name": "Georgia", "region": "Europe", "overall": 51, "rank": "50", "likelyRank": "36 to 65", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Georgia's ministry-owned health record lets patients hide episodes by law, but the auditor found half of selected state-programme cases missing and the data regulator abolished.", "categories": { "access": { "score": 55, "summary": "Patients may see their records and get a free copy within 10 working days. A national patient page exists, but the state auditor found low awareness and half of state-programme cases missing; portal usage is not verified.", "sources": [ { "title": "Law of Georgia on Patient Rights (2000), Arts. 17, 27, 28", "url": "https://matsne.gov.ge/ka/document/view/16978", "date": "2000-05-25", "publisherClass": "legal_text" }, { "title": "Law of Georgia on Personal Data Protection (2023, consolidated)", "url": "https://matsne.gov.ge/en/document/view/5827307", "date": "2023-07-03", "publisherClass": "legal_text" }, { "title": "Ministerial Order 01-1/n on the operation of the Electronic Health Records (EHR) system", "url": "https://www.matsne.gov.ge/ka/document/view/4390457", "date": "2019-01-04", "publisherClass": "legal_text" }, { "title": "State Audit Office: digital health performance audit report (2020-2023)", "url": "https://sao.ge/ka/%E1%83%AA%E1%83%98%E1%83%A4%E1%83%A0%E1%83%A3%E1%83%9A%E1%83%98-%E1%83%AF%E1%83%90%E1%83%9C%E1%83%93%E1%83%90%E1%83%AA%E1%83%95%E1%83%98%E1%83%A1-%E1%83%90%E1%83%A3%E1%83%93%E1%83%98%E1%83%A2%E1%83%98%E1%83%A1-%E1%83%90%E1%83%9C%E1%83%92%E1%83%9020250214051410613ka.html", "date": "2025-02-14", "publisherClass": "official" } ] }, "control": { "score": 60, "summary": "The EHR order lets patients hide or share each episode, unlock hidden data by SMS code and see processing logs. But records are shared with all authorised doctors by default, and a December 2025 law ordered a state mental health database without a consent step.", "sources": [ { "title": "Ministerial Order 01-1/n on the operation of the Electronic Health Records (EHR) system", "url": "https://www.matsne.gov.ge/ka/document/view/4390457", "date": "2019-01-04", "publisherClass": "legal_text" }, { "title": "Law amending the Law of Georgia on Mental Health (unified information database)", "url": "https://matsne.gov.ge/ka/document/view/6692485", "date": "2025-12-15", "publisherClass": "legal_text" }, { "title": "Cito clinic: rules for processing patient personal data", "url": "https://cito.ge/ka/policies/patient-data", "date": "undated", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 45, "summary": "The 2023 data law treats health data as a special category and requires 72-hour breach notice. Score sits at the floor of the general-law band because the standalone regulator was abolished on 2 March 2026 and no health enforcement case was found.", "sources": [ { "title": "Law of Georgia on Personal Data Protection (2023, consolidated)", "url": "https://matsne.gov.ge/en/document/view/5827307", "date": "2023-07-03", "publisherClass": "legal_text" }, { "title": "Parliament of Georgia: Anti-Corruption Bureau and Personal Data Protection Service to be annulled as of 2 March 2026", "url": "https://www.parliament.ge/en/media/news/antikoruftsiuli-biuro-da-personalur-monatsemta-datsvis-samsakhuri-2026-tslis-2-marts-gaukmdeba", "date": "2025-12-17", "publisherClass": "official" }, { "title": "Law amending the Law of Georgia on Mental Health (unified information database)", "url": "https://matsne.gov.ge/ka/document/view/6692485", "date": "2025-12-15", "publisherClass": "legal_text" }, { "title": "Radio Tavisupleba: law orders a database of people with mental health problems", "url": "https://www.radiotavisupleba.ge/a/33620954.html", "date": "2025-12-11", "publisherClass": "news" } ] }, "journey": { "score": 52, "summary": "One ministry-owned EHR receives hospital, outpatient, insurance case and e-prescription data, and has been mandatory for hospitals and most outpatient facilities since August 2023. The state auditor found half of state-programme cases missing, rural and family doctors excluded, and 67% of prescription medicines dispensed without an e-prescription.", "sources": [ { "title": "Ministerial Order 01-1/n on the operation of the Electronic Health Records (EHR) system", "url": "https://www.matsne.gov.ge/ka/document/view/4390457", "date": "2019-01-04", "publisherClass": "legal_text" }, { "title": "State Audit Office: digital health performance audit report (2020-2023)", "url": "https://sao.ge/ka/%E1%83%AA%E1%83%98%E1%83%A4%E1%83%A0%E1%83%A3%E1%83%9A%E1%83%98-%E1%83%AF%E1%83%90%E1%83%9C%E1%83%93%E1%83%90%E1%83%AA%E1%83%95%E1%83%98%E1%83%A1-%E1%83%90%E1%83%A3%E1%83%93%E1%83%98%E1%83%A2%E1%83%98%E1%83%A1-%E1%83%90%E1%83%9C%E1%83%92%E1%83%9020250214051410613ka.html", "date": "2025-02-14", "publisherClass": "official" }, { "title": "State Audit Office of Georgia: Digital Health PA report (EUROSAI presentation)", "url": "https://eurosai-it.org/images/public-documents/coffee_breaks/Digital_Health_Giorgi%20Kapanadze.pdf", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "No health-specific limit on selling or marketing with health data was found. The general data law requires written consent for health data and for direct marketing beyond basic contact details, with free withdrawal.", "sources": [ { "title": "Law of Georgia on Personal Data Protection (2023, consolidated)", "url": "https://matsne.gov.ge/en/document/view/5827307", "date": "2023-07-03", "publisherClass": "legal_text" }, { "title": "DLA Piper: Data protection laws in Georgia", "url": "https://www.dlapiperdataprotection.com/?t=law&c=GE", "date": "2026-03-13", "publisherClass": "law_firm" } ] }, "clinical": { "score": 52, "summary": "An authorised doctor who enters a patient's ID number and birth date can see every episode the patient has not hidden, from any facility. The state auditor says family and rural doctors have no access and 24% of active doctors are not connected.", "sources": [ { "title": "Ministerial Order 01-1/n on the operation of the Electronic Health Records (EHR) system", "url": "https://www.matsne.gov.ge/ka/document/view/4390457", "date": "2019-01-04", "publisherClass": "legal_text" }, { "title": "Ministerial Order 01-31/n on electronic prescriptions for psychotropic medicines", "url": "https://www.matsne.gov.ge/ka/document/view/5433415", "date": "2022-04-08", "publisherClass": "legal_text" }, { "title": "State Audit Office of Georgia: Digital Health PA report (EUROSAI presentation)", "url": "https://eurosai-it.org/images/public-documents/coffee_breaks/Digital_Health_Giorgi%20Kapanadze.pdf", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Research on people needs written informed consent and review by an independent commission and a medical ethics commission. De-identified records may be used for research without consent, and no opt-out or public register of uses was found.", "sources": [ { "title": "Law of Georgia on Health Care (1997), Arts. 8, 107, 109", "url": "https://matsne.gov.ge/ka/document/view/29980", "date": "1997-12-31", "publisherClass": "legal_text" }, { "title": "Law of Georgia on Patient Rights (2000), Arts. 17, 27, 28", "url": "https://matsne.gov.ge/ka/document/view/16978", "date": "2000-05-25", "publisherClass": "legal_text" }, { "title": "Law of Georgia on Personal Data Protection (2023, consolidated)", "url": "https://matsne.gov.ge/en/document/view/5827307", "date": "2023-07-03", "publisherClass": "legal_text" } ] }, "ai": { "score": 35, "summary": "Georgia has no clinical AI rules. A 2023 device-trial regulation classifies standalone software as a device, but no general device approval rule or AI change control was found, so the score sits below Armenia and Ukraine.", "sources": [ { "title": "Government Resolution: technical regulation on clinical investigation of medical devices", "url": "https://www.matsne.gov.ge/ka/document/view/5934377", "date": "2023-10-03", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law of Georgia on Patient Rights", "level": "National", "year": "2000", "what": "Right to see medical records and get a copy of any part; confidentiality and disclosure rules.", "url": "https://matsne.gov.ge/ka/document/view/16978" }, { "name": "Law of Georgia on Health Care", "level": "National", "year": "1997", "what": "Informed consent for care; written consent and ethics review for biomedical research.", "url": "https://matsne.gov.ge/ka/document/view/29980" }, { "name": "Law of Georgia on Personal Data Protection", "level": "National", "year": "2023", "what": "GDPR-style law: health as special category, 10-day access, 72-hour breach notice.", "url": "https://matsne.gov.ge/en/document/view/5827307" }, { "name": "Ministerial Order 01-1/n on the Electronic Health Records (EHR) system", "level": "National", "year": "2019", "what": "National EHR: data feeds, default sharing, patient hiding, SMS consent, access logs.", "url": "https://www.matsne.gov.ge/ka/document/view/4390457" }, { "name": "Amendment to the Law of Georgia on Mental Health (unified database)", "level": "National", "year": "2025", "what": "Creates a ministry database of people with mental health or addiction diagnoses.", "url": "https://matsne.gov.ge/ka/document/view/6692485" }, { "name": "Technical regulation on clinical investigation of medical devices", "level": "National", "year": "2023", "what": "Rules for device trials; classifies standalone software as a device.", "url": "https://www.matsne.gov.ge/ka/document/view/5934377" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-01", "headline": "Regulator rules clinic broke the law when its director posted a patient's X-ray online", "paraphrase": "The clinic's director published a patient's X-ray image on her personal social media page. On the patient's complaint, the data protection regulator found the clinic processed health data unlawfully, issued a warning and ordered the post removed.", "source": "Netgazeti", "url": "https://netgazeti.ge/news/769528/", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-02-28", "headline": "Ombudsman finds patients' medical files at an inpatient clinic nearly empty", "paraphrase": "On a monitoring visit, the Public Defender's team found the clinic's patient files held almost no entries and often lacked lab results and specialist notes. It tied the gaps to overworked doctors and staff shortages.", "source": "Public Defender (Ombudsman) of Georgia, National Preventive Mechanism", "url": "https://ombudsman.ge/res/docs/2025022818032187661.pdf", "theme": "record_wrong", "status": "finding" } ] }, { "iso3": "MNG", "name": "Mongolia", "region": "Asia", "overall": 50, "rank": "51=", "likelyRank": "41 to 71", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Mongolian law requires consent and notices when health data moves, but the national exchange is still being built and usage is unproven.", "categories": { "access": { "score": 60, "summary": "The Personal Data Protection Law gives a right to a free electronic copy of one's data, and the Ministry said in 2021 that E-Mongolia shows lab results. No full national chart was found, and how many people view lab results there was not verified.", "sources": [ { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Health (2011, as amended), Articles 8, 36 and 43", "url": "https://legalinfo.mn/mn/detail/49", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Minister: nine health services now available through E-Mongolia (Ministry of Health)", "url": "https://moh.gov.mn/news/5395", "date": "2021-12-10", "publisherClass": "official" }, { "title": "E-Mongolia adds a service to view details of care received under health insurance (Health Insurance General Office)", "url": "https://emd.gov.mn/news/363", "date": "2023-06-05", "publisherClass": "official" } ] }, "control": { "score": 47, "summary": "Health providers must get consent under the Personal Data Protection Law when they first collect data and before passing it to another provider, and patients are to be notified of transfers. Granular choices and whether health notices reach patients in practice were not verified.", "sources": [ { "title": "Government Resolution No. 100 (2024), Procedure on collecting, processing, using, storing and securing health information", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521", "date": "2024-03-06", "publisherClass": "legal_text" }, { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Transparency of Public Information (2021), Articles 18, 22 and 23", "url": "https://www.legalinfo.mn/mn/detail?lawId=16390263044601", "date": "undated", "publisherClass": "legal_text" }, { "title": "Personal data will not be used without consent: state notification system introduced (Montsame)", "url": "https://www.montsame.mn/mn/read/295069", "date": "2022-04-19", "publisherClass": "news" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive data and a personal secret under the 2021 law, with breach notice to the person and fines of up to 20,000 units for firms that unlawfully disclose it. No health-sector enforcement was found, and the regulator's April 2026 leak case ended in recommendations.", "sources": [ { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Violations (2017, as amended), Article 6.27 on breaches of the personal data law", "url": "https://legalinfo.mn/mn/detail/12695", "date": "undated", "publisherClass": "legal_text" }, { "title": "Government Resolution No. 100 (2024), Procedure on collecting, processing, using, storing and securing health information", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521", "date": "2024-03-06", "publisherClass": "legal_text" }, { "title": "NHRC finds about 2.1 million citizens' records in Democratic Party database (iKon.mn)", "url": "https://ikon.mn/n/3mu1", "date": "2026-04-16", "publisherClass": "news" } ] }, "journey": { "score": 54, "summary": "Resolution No. 100 routes health data through a national exchange system tied to the state KHUR platform, using ICD, HL7 FHIR, SNOMED CT and LOINC codes. In September 2026 the Health Development Center said FHIR was still being introduced, and providers run many different software systems.", "sources": [ { "title": "Government Resolution No. 100 (2024), Procedure on collecting, processing, using, storing and securing health information", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521", "date": "2024-03-06", "publisherClass": "legal_text" }, { "title": "1818.mn system launched for transparency of health insurance information (Montsame)", "url": "https://www.montsame.mn/mn/read/394634", "date": "2026-03-31", "publisherClass": "news" }, { "title": "Guides for writing e-prescriptions in hospital software systems (Health Development Center)", "url": "https://hdc.gov.mn/post/1579/", "date": "2024-12-02", "publisherClass": "official" }, { "title": "Training on use and security of the health information exchange system (Health Development Center)", "url": "https://hdc.gov.mn/post/1978/", "date": "2026-09-28", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Health data needs consent for most uses, and Resolution No. 100 bars health software vendors from using data beyond their contract. But de-identified data may be used for statistics and research without consent, and no law aimed at health data brokers or apps was found.", "sources": [ { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Government Resolution No. 100 (2024), Procedure on collecting, processing, using, storing and securing health information", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521", "date": "2024-03-06", "publisherClass": "legal_text" } ] }, "clinical": { "score": 47, "summary": "The exchange system and per-user access rights in Resolution No. 100 are meant to let providers share records, with consent needed before data moves between providers. Whether a treating doctor can see a patient's records from other providers in practice was not verified.", "sources": [ { "title": "Government Resolution No. 100 (2024), Procedure on collecting, processing, using, storing and securing health information", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521", "date": "2024-03-06", "publisherClass": "legal_text" }, { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Training on use and security of the health information exchange system (Health Development Center)", "url": "https://hdc.gov.mn/post/1978/", "date": "2026-09-28", "publisherClass": "official" }, { "title": "Minister reviews digitisation of family health centres and orders problems fixed (Ministry of Health)", "url": "https://moh.gov.mn/news/7338", "date": "2025-06-16", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "The Law on Health requires written consent to include a person in medical research, and a Ministry ethics committee approves studies. De-identified data can be used for scientific work without consent or an opt-out, so the score is capped at 50.", "sources": [ { "title": "Law on Health (2011, as amended), Articles 8, 36 and 43", "url": "https://legalinfo.mn/mn/detail/49", "date": "undated", "publisherClass": "legal_text" }, { "title": "Medical Ethics Review Committee under the Ministry of Health", "url": "https://moh.gov.mn/ethic", "date": "undated", "publisherClass": "official" }, { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" }, { "title": "Mongolia launches Partnership for Science and Research (WHO Mongolia joint news release)", "url": "https://www.who.int/mongolia/news/detail/17-06-2026-mongolia-launches-partnership-for-science-and-research", "date": "2026-06-17", "publisherClass": "intergov" } ] }, "ai": { "score": 30, "summary": "The Ministry of Health published a draft procedure in May 2026 requiring human final decisions, registration, clinical validation and re-assessment after updates for health AI. It was a draft open for comment; no clinical AI rule is in force, only a data-law impact assessment for automated processing.", "sources": [ { "title": "Draft Procedure on using artificial intelligence in health care open for comment (Ministry of Health)", "url": "https://moh.gov.mn/news/7561", "date": "2026-05-27", "publisherClass": "official" }, { "title": "Draft Procedure on using artificial intelligence in health care services (Ministry of Health, draft text)", "url": "https://moh.gov.mn/uploads/userfiles/files/%D0%A5%D0%B8%D0%B9%D0%BC%D1%8D%D0%BB%20%D0%BE%D1%8E%D1%83%D0%BD_%D0%97%D0%90%D0%93%D0%92%D0%90%D0%A0%20%D0%A2%D3%A8%D0%A1%D3%A8%D0%9B.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Law on Personal Data Protection (2021, in force 1 May 2022), Mongolian text with unofficial English translation", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991", "date": "undated", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law on Personal Data Protection", "level": "National", "year": "2021", "what": "Health data is sensitive; consent, free electronic copy, breach notice, Human Rights Commission oversight.", "url": "https://legalinfo.mn/mn/detail?lawId=16390288615991" }, { "name": "Law on Health", "level": "National", "year": "2011", "what": "Right to own health information and confidentiality; written consent for research; health data rules set by Government.", "url": "https://legalinfo.mn/mn/detail/49" }, { "name": "Government Resolution No. 100, Procedure on health information", "level": "National", "year": "2024", "what": "National health data exchange, coding standards, consent before transfers, patient notices, vendor reuse ban.", "url": "https://legalinfo.mn/mn/detail?lawId=17089589982521" }, { "name": "Law on Transparency of Public Information", "level": "National", "year": "2021", "what": "State exchange platform and notice when others access a person's restricted data.", "url": "https://www.legalinfo.mn/mn/detail?lawId=16390263044601" }, { "name": "Law on Violations, Article 6.27", "level": "National", "year": "2017", "what": "Fines for misusing personal data and unlawfully disclosing sensitive data, added in 2021.", "url": "https://legalinfo.mn/mn/detail/12695" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-03-31", "headline": "Rights commission finds Intermed hospital failed to protect patient data before a cyberattack", "paraphrase": "After hackers took and posted names, ID and phone numbers of about 200,000 patients, a patient complained. The commission found weak cyber security, no rules for handling personal data and no breach plan, and ordered an audit and fixes.", "source": "National Human Rights Commission of Mongolia, 24th report on human rights", "url": "https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf", "theme": "breach", "status": "finding" }, { "date": "2025-03-31", "headline": "Rights commission finds a hospital head gave a patient's health details to a reporter", "paraphrase": "A relative complained that a hospital head described a patient's health in a live interview with a news site. The commission found this broke the personal data law; the hospital head was warned and the press council asked to review.", "source": "National Human Rights Commission of Mongolia, 24th report on human rights", "url": "https://nhrcm.gov.mn/pdf/KHUNII_ERKHI_24_deh_iltgel.pdf", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-11-11", "headline": "Intermed apologises after hackers took patient data; one patient says nobody called", "paraphrase": "Hackers demanded $50,000 for data said to include patients' names, ID numbers, phone numbers and medical histories. The hospital publicly apologised for the risk of leaked data. One patient said they reported it to police; the promised call never came.", "source": "Mass.mn", "url": "https://mass.mn/n/97222", "theme": "breach", "status": "admitted" } ] }, { "iso3": "QAT", "name": "Qatar", "region": "Middle East", "overall": 50, "rank": "51=", "likelyRank": "40 to 72", "band": "Mixed", "keysModel": "Institutional", "confidence": "medium", "headline": "Qatar's privacy law gives a right to a copy and the public portal shows key results, but patients get few sharing controls.", "categories": { "access": { "score": 60, "summary": "The 2016 privacy law gives a right to a copy of personal data for a fee capped at service cost, and the free public MyHealth portal shows reports, labs, medicines and vaccines from HMC and PHCC. How many residents use it was not verified.", "sources": [ { "title": "Law No. 13 of 2016 on Personal Data Privacy Protection, Arts. 1-13 (Al Meezan)", "url": "https://www.almeezan.qa/LawView.aspx?opt&LawID=7121&language=ar", "date": "2016-12-29", "publisherClass": "legal_text" }, { "title": "Minister of Public Health Decision No. 9 of 2022 on patients' rights and duties (Al Meezan)", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=8946&language=ar", "date": "2022-07-03", "publisherClass": "legal_text" }, { "title": "MyHealth patient portal FAQs (Hamad Medical Corporation)", "url": "https://hamad.qa/AR/Patient-Information/Patient-Portal/FAQs/Pages/default.aspx", "date": "undated", "publisherClass": "official" }, { "title": "MyHealth patient portal (Primary Health Care Corporation)", "url": "https://www.phcc.gov.qa/ar-qa/patient-portal", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Decision 9 of 2022 bars anyone outside care from seeing the file without the patient's consent, except on a court or prosecution order. No sharing opt-out and no patient-visible access log were verified.", "sources": [ { "title": "Law No. 13 of 2016 on Personal Data Privacy Protection, Arts. 1-13 (Al Meezan)", "url": "https://www.almeezan.qa/LawView.aspx?opt&LawID=7121&language=ar", "date": "2016-12-29", "publisherClass": "legal_text" }, { "title": "Minister of Public Health Decision No. 9 of 2022 on patients' rights and duties (Al Meezan)", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=8946&language=ar", "date": "2022-07-03", "publisherClass": "legal_text" }, { "title": "MyHealth patient portal FAQs (Hamad Medical Corporation)", "url": "https://hamad.qa/AR/Patient-Information/Patient-Portal/FAQs/Pages/default.aspx", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 54, "summary": "Health data is special-category data that needs a permit, and breaking the special-data rules carries fines up to QAR 5 million. The regulator sits under the Prime Minister, state-security exemptions are wide, and no health-sector decision was found.", "sources": [ { "title": "Law No. 13 of 2016 on Personal Data Privacy Protection, full text (Al Meezan)", "url": "https://www.almeezan.qa/LawView.aspx?opt&LawID=7121&language=ar", "date": "2016-12-29", "publisherClass": "legal_text" }, { "title": "Amiri Decision No. 1 of 2021 establishing the National Cyber Security Agency (Al Meezan)", "url": "https://www.almeezan.qa/LawArticles.aspx?LawTreeSectionID=19462&lawId=8560&language=ar", "date": "2021-03-24", "publisherClass": "legal_text" }, { "title": "National Health Insurance data management guidance v1.0 (Ministry of Public Health)", "url": "https://www.moph.gov.qa/_layouts/download.aspx?SourceUrl=/Admin/Lists/PublicationsAttachments/Attachments/227/QNHI-DATA-MANAGEMENT-ARB.pdf", "date": "2022-12-20", "publisherClass": "official" }, { "title": "NCSA issues binding decision against sports company after data breach (The Peninsula)", "url": "https://thepeninsulaqatar.com/article/02/02/2026/national-cyber-security-agency-issues-binding-decision-against-sports-company-following-data-breach-incident", "date": "2026-02-02", "publisherClass": "news" } ] }, "journey": { "score": 57, "summary": "HMC hospitals and PHCC health centres share one electronic record, and HMC lab equipment feeds it. The national exchange that would add private providers and insurance claims was still being built, and its live status was not verified.", "sources": [ { "title": "MyHealth patient portal FAQs (Hamad Medical Corporation)", "url": "https://hamad.qa/AR/Patient-Information/Patient-Portal/FAQs/Pages/default.aspx", "date": "undated", "publisherClass": "official" }, { "title": "National Health Insurance data management guidance v1.0 (Ministry of Public Health)", "url": "https://www.moph.gov.qa/_layouts/download.aspx?SourceUrl=/Admin/Lists/PublicationsAttachments/Attachments/227/QNHI-DATA-MANAGEMENT-ARB.pdf", "date": "2022-12-20", "publisherClass": "official" }, { "title": "A national platform for health information exchange (Al Sharq)", "url": "https://al-sharq.com/article/09/04/2025/%D8%AA%D8%A3%D9%83%D9%8A%D8%AF%D8%A7%D9%8B-%D9%84%D9%85%D8%A7-%D8%A7%D9%86%D9%81%D8%B1%D8%AF%D8%AA-%D8%A8%D9%87-%D8%A7%D9%84%D8%B4%D8%B1%D9%82..-%D9%85%D9%86%D8%B5%D8%A9-%D9%88%D8%B7%D9%86%D9%8A%D8%A9-%D9%84%D8%AA%D8%A8%D8%A7%D8%AF%D9%84-%D8%A7%D9%84%D9%85%D8%B9%D9%84%D9%88%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9", "date": "2025-04-09", "publisherClass": "news" }, { "title": "Qatar accelerates digital healthcare drive with smart labs (Kuwait Times, KUNA)", "url": "https://kuwaittimes.com/article/46498/kuwait/other-news/qatar-accelerates-digital-healthcare-drive-with-smart-labs/", "date": "2026-07-14", "publisherClass": "news" } ] }, "commercial": { "score": 52, "summary": "Direct marketing needs prior consent, and the 2025 health research law bans selling research samples or genetic data. No rule on health apps or data brokers was found.", "sources": [ { "title": "Law No. 13 of 2016, Article 22 on direct marketing (Al Meezan)", "url": "https://www.almeezan.qa/LawArticles.aspx?LawTreeSectionID=17487&lawId=7121&language=ar", "date": "2016-12-29", "publisherClass": "legal_text" }, { "title": "Law No. 6 of 2025 regulating health research (Al Meezan)", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=9956&language=ar", "date": "2025-04-13", "publisherClass": "legal_text" }, { "title": "National Health Insurance data management guidance v1.0 (Ministry of Public Health)", "url": "https://www.moph.gov.qa/_layouts/download.aspx?SourceUrl=/Admin/Lists/PublicationsAttachments/Attachments/227/QNHI-DATA-MANAGEMENT-ARB.pdf", "date": "2022-12-20", "publisherClass": "official" }, { "title": "Law No. 22 of 2021 regulating healthcare services in the State (Al Meezan)", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=8761&language=ar", "date": "2021-11-04", "publisherClass": "legal_text" } ] }, "clinical": { "score": 54, "summary": "Clinicians at HMC and PHCC work from one shared record covering reports, labs and medicines. Access for private clinicians and any emergency-access rules were not verified.", "sources": [ { "title": "MyHealth patient portal (Primary Health Care Corporation)", "url": "https://www.phcc.gov.qa/ar-qa/patient-portal", "date": "undated", "publisherClass": "official" }, { "title": "MyHealth patient portal FAQs (Hamad Medical Corporation)", "url": "https://hamad.qa/AR/Patient-Information/Patient-Portal/FAQs/Pages/default.aspx", "date": "undated", "publisherClass": "official" }, { "title": "A national platform for health information exchange (Al Sharq)", "url": "https://al-sharq.com/article/09/04/2025/%D8%AA%D8%A3%D9%83%D9%8A%D8%AF%D8%A7%D9%8B-%D9%84%D9%85%D8%A7-%D8%A7%D9%86%D9%81%D8%B1%D8%AF%D8%AA-%D8%A8%D9%87-%D8%A7%D9%84%D8%B4%D8%B1%D9%82..-%D9%85%D9%86%D8%B5%D8%A9-%D9%88%D8%B7%D9%86%D9%8A%D8%A9-%D9%84%D8%AA%D8%A8%D8%A7%D8%AF%D9%84-%D8%A7%D9%84%D9%85%D8%B9%D9%84%D9%88%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9", "date": "2025-04-09", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Law No. 6 of 2025 requires written or electronic informed consent, a right to withdraw and licensed ethics committees for research on people. The privacy law still exempts public-interest research from consent and access rights, and no opt-out was found.", "sources": [ { "title": "Law No. 6 of 2025 regulating health research (Al Meezan)", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=9956&language=ar", "date": "2025-04-13", "publisherClass": "legal_text" }, { "title": "Law No. 13 of 2016, Chapter 5 exemptions (Al Meezan)", "url": "https://www.almeezan.qa/LawArticles.aspx?LawTreeSectionID=17486&lawId=7121&language=ar", "date": "2016-12-29", "publisherClass": "legal_text" }, { "title": "Executive regulation of the health research law issued (Al Sharq)", "url": "https://al-sharq.com/article/07/05/2026/%D8%B5%D8%AF%D9%88%D8%B1-%D8%A7%D9%84%D9%84%D8%A7%D8%A6%D8%AD%D8%A9-%D8%A7%D9%84%D8%AA%D9%86%D9%81%D9%8A%D8%B0%D9%8A%D8%A9-%D8%A8%D8%AA%D9%86%D8%B8%D9%8A%D9%85-%D8%A7%D9%84%D8%A8%D8%AD%D8%AB-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A", "date": "2026-05-07", "publisherClass": "news" } ] }, "ai": { "score": 40, "summary": "Qatar's healthcare AI rules are non-binding research guidelines developed with MoPH, plus general AI ethics and security guidance. No rule for AI medical devices was found.", "sources": [ { "title": "A True Lifecycle Approach towards governing healthcare AI (npj Digital Medicine)", "url": "https://www.nature.com/articles/s41746-025-01614-1", "date": "2025-06-05", "publisherClass": "academic" }, { "title": "Regulating AI in health in the Middle East: Qatar, Saudi Arabia and the UAE (Edward Elgar)", "url": "https://www.elgaronline.com/edcollchap-oa/book/9781802205657/ch19.xml", "date": "2024-07-16", "publisherClass": "academic" }, { "title": "The strategic trajectory of AI in Qatar's healthcare sector (Frontiers in AI)", "url": "https://www.frontiersin.org/journals/artificial-intelligence/articles/10.3389/frai.2026.1702242/full", "date": "2026-01-27", "publisherClass": "academic" }, { "title": "Qatar AI and technology developments (US International Trade Administration)", "url": "https://www.trade.gov/market-intelligence/qatar-artificial-intelligence-ai-and-technology-developments", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law No. 13 of 2016 on Personal Data Privacy Protection", "level": "National", "year": "2016", "what": "Access and copy rights, health as special data needing a permit, breach notice, fines up to QAR 5 million.", "url": "https://www.almeezan.qa/LawView.aspx?opt&LawID=7121&language=ar" }, { "name": "Minister of Public Health Decision No. 9 of 2022 on patients' rights", "level": "National", "year": "2022", "what": "Consent to view the medical file, choice of provider, right to a medical report on request.", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=8946&language=ar" }, { "name": "Law No. 6 of 2025 regulating health research", "level": "National", "year": "2025", "what": "Licensed research bodies, informed consent and withdrawal, data protection duties, ban on selling samples or genetic data.", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=9956&language=ar" }, { "name": "Law No. 22 of 2021 regulating healthcare services in the State", "level": "National", "year": "2021", "what": "Mandatory health insurance for expatriates and visitors; prison and fines for disclosing secrets.", "url": "https://almeezan.qa/LawView.aspx?opt&LawID=8761&language=ar" }, { "name": "Amiri Decision No. 1 of 2021 establishing the National Cyber Security Agency", "level": "National", "year": "2021", "what": "Creates the agency under the Prime Minister and tasks it with enforcing data privacy law.", "url": "https://www.almeezan.qa/LawArticles.aspx?LawTreeSectionID=19462&lawId=8560&language=ar" } ], "dti": { "grade": 79, "tier": "Silver", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-06", "headline": "Patients in Qatar pay and wait again for the same medical report", "paraphrase": "Patients told the newspaper that government offices reject medical reports older than six months, so they must request new ones, wait about 14 working days and pay 50 riyals each time, though nothing has changed.", "source": "Al-Sharq", "url": "https://al-sharq.com/article/06/08/2026/%D8%B0%D9%88%D9%88-%D8%A5%D8%B9%D8%A7%D9%82%D8%A9-%D8%AF%D8%A7%D8%A6%D9%85%D8%A9-%D9%84%D9%80-%D8%A7%D9%84%D8%B4%D8%B1%D9%82-%D8%AA%D8%AC%D8%AF%D9%8A%D8%AF-%D8%A7%D9%84%D8%AA%D9%82%D8%A7%D8%B1%D9%8A%D8%B1-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A9-%D9%85%D8%B9%D8%A7%D9%86%D8%A7%D8%A9-%D8%AF%D8%A7%D8%A6%D9%85%D8%A9-%D8%AA%D8%A8%D8%AD%D8%AB-%D8%B9%D9%86-%D8%AD%D9%84", "theme": "access_delay_or_cost", "status": "self_reported" } ] }, { "iso3": "KEN", "name": "Kenya", "region": "Africa", "overall": 49, "rank": "53=", "likelyRank": "43 to 74", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Kenya's rules promise patients a national record with alerts, logs and consent, but the live system is young, claims-driven and leaky.", "categories": { "access": { "score": 55, "summary": "The 2021 data protection rules make a copy free and due within 7 days, and the Digital Health Agency runs a national portal, Afyangu, showing visits, prescriptions and results. No official figure shows most people use it, so the cell stops at 55.", "sources": [ { "title": "Data Protection (General) Regulations 2021, Legal Notice 263 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2021/263/eng@2022-01-14", "date": "2022-01-14", "publisherClass": "legal_text" }, { "title": "Digital Health Act No. 15 of 2023 (Digital Health Agency copy)", "url": "https://nhts.dha.go.ke/api/file-download/?filename=Digital%20Health%20Act%2015%20of%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Digital Health (Health Information Management Procedures) Regulations 2025, Legal Notice 76 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "National Shared Health Record (Digital Health Agency)", "url": "https://p360-preauth-lookup.dha.go.ke/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 44, "summary": "Every visit is copied to a national Shared Health Record, but the rules require client authorisation, an alert on each look-up and an access log. A May 2026 fake entry posted with no alert shows these controls are not yet reliable.", "sources": [ { "title": "Digital Health (Data Exchange Component) Regulations 2025, Legal Notice 77 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/77/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "Digital Health (Health Information Management Procedures) Regulations 2025, Legal Notice 76 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "Afyangu app listing by the Digital Health Agency (Google Play)", "url": "https://play.google.com/store/apps/details?id=ke.go.dha.afyangu&hl=en", "date": "2026-09-09", "publisherClass": "official" }, { "title": "SHA patient data safety questioned after Nairobi man's records show treatment in Garissa (Citizen Digital)", "url": "https://citizen.digital/article/sha-patient-data-safety-questioned-after-nairobi-mans-records-show-treatment-in-garissa-n382392", "date": "2026-05-09", "publisherClass": "news" } ] }, "privacy": { "score": 55, "summary": "Health is sensitive data, the Digital Health Act adds offences up to 15 years in prison, and the Data Commissioner ordered a hospital to pay KES 525,000 in March 2026. An official posting a family's SHA claims in August 2026 shows weak internal controls.", "sources": [ { "title": "Data Protection Act No. 24 of 2019 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31", "date": "2022-12-31", "publisherClass": "legal_text" }, { "title": "ODPC determination, Merceline v St. Luke Orthopaedic and Trauma Hospital", "url": "https://www.odpc.go.ke/wp-content/uploads/2026/04/MERCELINE-VS-ST.-LUKE.pdf", "date": "2026-03-16", "publisherClass": "official" }, { "title": "Govt cleared to proceed with Kenya-US Health Cooperation Framework (Kenyans.co.ke)", "url": "https://www.kenyans.co.ke/news/123350-govt-cleared-proceed-ksh322-billion-kenya-us-health-cooperation-framework", "date": "2026-05-13", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 45, "summary": "Kenya has a live national Shared Health Record built on FHIR and, from mid-2026, requires every SHA-contracted facility to use a certified system linked to it. Volumes are still small: the Agency counts 1.2 million encounters and 4.5 million claims.", "sources": [ { "title": "Digital Health (Data Exchange Component) Regulations 2025, Legal Notice 77 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/77/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "National Shared Health Record (Digital Health Agency)", "url": "https://p360-preauth-lookup.dha.go.ke/", "date": "undated", "publisherClass": "official" }, { "title": "SHA makes accredited HMIS mandatory for all healthcare providers (Kenyans.co.ke)", "url": "https://www.kenyans.co.ke/news/124812-sha-makes-accredited-hmis-mandatory-all-healthcare-providers", "date": "2026-06-30", "publisherClass": "news" }, { "title": "SHA rolls out Taifa Care HMIS for Level 4 public hospitals (The Star)", "url": "https://www.the-star.co.ke/news/2026-07-01-sha-shifts-level-4-public-hospitals-to-taifa-care-hmis", "date": "2026-07-01", "publisherClass": "news" } ] }, "commercial": { "score": 52, "summary": "Commercial use of personal data needs express consent, sensitive data is left out of the direct-marketing permission, and disclosing health data for market research is an offence. Nothing specific covers health apps, data brokers or sale of de-identified data.", "sources": [ { "title": "Data Protection Act No. 24 of 2019 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31", "date": "2022-12-31", "publisherClass": "legal_text" }, { "title": "Data Protection (General) Regulations 2021, Legal Notice 263 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2021/263/eng@2022-01-14", "date": "2022-01-14", "publisherClass": "legal_text" }, { "title": "Digital Health (Health Information Management Procedures) Regulations 2025, Legal Notice 76 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "ODPC Guidance Note on the Processing of Health Data", "url": "https://www.odpc.go.ke/wp-content/uploads/2024/02/ODPC-Guidance-Note-on-Processing-of-Health-Data.pdf", "date": "2023-12", "publisherClass": "official" } ] }, "clinical": { "score": 42, "summary": "The rules make certified systems query and update the Shared Health Record at every encounter and allow logged emergency access, so a clinician can in principle see care from other facilities. Coverage is still small and largely claims-driven.", "sources": [ { "title": "Digital Health (Data Exchange Component) Regulations 2025, Legal Notice 77 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/77/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "Digital Health (Health Information Management Procedures) Regulations 2025, Legal Notice 76 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "Digital Health Act No. 15 of 2023 (Digital Health Agency copy)", "url": "https://nhts.dha.go.ke/api/file-download/?filename=Digital%20Health%20Act%2015%20of%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Digitising Care: How Kenya's Afya Yangu platform is shaping the road to UHC (Talk Africa)", "url": "https://www.talkafrica.co.ke/digitising-care-how-kenyas-afya-yangu-platform-is-shaping-the-road-to-universal-health-coverage/", "date": "2025-12-04", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "There is no general research opt-out, but identifiable data from the national system needs the person's written consent plus ethics board, NACOSTI licence and ministerial approval. Four safeguard classes put the cell at the 50 cap.", "sources": [ { "title": "Data Protection Act No. 24 of 2019 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31", "date": "2022-12-31", "publisherClass": "legal_text" }, { "title": "Digital Health (Health Information Management Procedures) Regulations 2025, Legal Notice 76 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11", "date": "2025-04-11", "publisherClass": "legal_text" }, { "title": "ODPC Guidance Notes: Processing for Research Purposes", "url": "https://www.odpc.go.ke/wp-content/uploads/2025/11/ODPC-%E2%80%93-GUIDANCE-NOTES-Processing-for-Research-Purpose.pdf", "date": "2025", "publisherClass": "official" } ] }, "ai": { "score": 48, "summary": "The Pharmacy and Poisons Board's February 2026 medical device software guideline sets rules for AI devices, including control of continuous learning and rollback. It is guidance, not statute, and one report calls it a draft, so it scores at the top of the guidance band.", "sources": [ { "title": "Guideline on Regulation of Medical Device Software in Kenya (Pharmacy and Poisons Board, Revision 0)", "url": "https://web.pharmacyboardkenya.org/download/guideline-on-regulation-of-medical-device-software-in-kenya-mdsw/", "date": "2026-02", "publisherClass": "official" }, { "title": "Kenya tightens oversight of medical device software (Health Business)", "url": "https://healthbusiness.co.ke/10137/kenya-tightens-oversight-of-medical-device-software/", "date": "2026-04-16", "publisherClass": "news" }, { "title": "The Artificial Intelligence Bill, Senate Bill No. 4 of 2026 (Mzalendo Bill Tracker)", "url": "https://mzalendo.com/legislative-trends/bills/senate/560/", "date": "2026-08-10", "publisherClass": "blog_vendor" }, { "title": "Data Protection Act No. 24 of 2019 (Kenya Law)", "url": "https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31", "date": "2022-12-31", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection Act No. 24 of 2019", "level": "National", "year": "2019", "what": "Health is sensitive data; access and portability rights; 72-hour breach notice; express consent for commercial use.", "url": "https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31" }, { "name": "Data Protection (General) Regulations 2021", "level": "National", "year": "2021", "what": "Free access within 7 days; no direct marketing with sensitive data; health care processing kept in Kenya.", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2021/263/eng@2022-01-14" }, { "name": "Digital Health Act No. 15 of 2023", "level": "National", "year": "2023", "what": "Creates Digital Health Agency and integrated system; right to a copy; consent withdrawal; offences up to 15 years.", "url": "https://nhts.dha.go.ke/api/file-download/?filename=Digital%20Health%20Act%2015%20of%202023.pdf" }, { "name": "Digital Health (Health Information Management Procedures) Regulations 2025", "level": "National", "year": "2025", "what": "48-hour breach notice; patient portal access; written consent for identifiable data; research approvals and fees.", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11" }, { "name": "Digital Health (Data Exchange Component) Regulations 2025", "level": "National", "year": "2025", "what": "Client registry and Shared Health Record; 24-hour upload; access alerts and logs; insurer claims links.", "url": "https://new.kenyalaw.org/akn/ke/act/ln/2025/77/eng@2025-04-11" }, { "name": "Guideline on Regulation of Medical Device Software in Kenya (PPB)", "level": "National", "year": "2026", "what": "Regulator guidance for software and AI devices, including continuous-learning controls and rollback.", "url": "https://web.pharmacyboardkenya.org/download/guideline-on-regulation-of-medical-device-software-in-kenya-mdsw/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-16", "headline": "Regulator finds hospital had no way for patients to see or correct records", "paraphrase": "An investigation the regulator opened itself found the hospital had no process for patients' access or correction requests, shared data with third parties without agreements, and was unregistered. An enforcement notice was issued.", "source": "Office of the Data Protection Commissioner (Kenya)", "url": "https://www.odpc.go.ke/wp-content/uploads/2026/01/ELDORET-HOSPITAL-2.pdf", "theme": "other", "status": "finding" }, { "date": "2024-12", "headline": "Regulator finds weak access controls at a nursing home led to data breaches", "paraphrase": "The regulator investigated on its own initiative and found no role-based checks on who received sensitive data, which led to several breaches, plus no process for access or correction requests. An enforcement notice followed.", "source": "Office of the Data Protection Commissioner (Kenya)", "url": "https://www.odpc.go.ke/wp-content/uploads/2025/01/20241218-SUO-MOTU-NALA-MATERNITY-NURSING-HOME-LIMITED.pdf", "theme": "breach", "status": "finding" }, { "date": "2026-01-18", "headline": "Hospital ordered to pay patient after using secretly filmed footage in its adverts", "paraphrase": "The regulator found a staff member recorded a patient during treatment and the hospital showed the footage on its screens as promotion. It could not prove consent, so it must pay Sh500,000 and delete the adverts.", "source": "Business Daily (reporting a Data Protection Commissioner decision)", "url": "https://www.businessdailyafrica.com/bd/corporate/companies/nairobi-hospital-to-pay-patient-sh500000-illegal-use-of-images-5329802", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-03-02", "headline": "National health insurer apologises as system failure halts approvals at hospitals", "paraphrase": "The insurer issued a notice that a critical failure at its digital platform since 1 March had stopped pre-authorisation and eligibility checks at contracted facilities nationwide. It apologised for the disruption to patient care.", "source": "The Star (Kenya)", "url": "https://www.the-star.co.ke/news/2026-03-02-health-services-hit-as-sha-platform-faces-outage", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "UKR", "name": "Ukraine", "region": "Europe", "overall": 49, "rank": "53=", "likelyRank": "43 to 77", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Ukraine's national e-health system holds records on 34.6 million people, but patients still cannot see their own medical data in the state portal.", "categories": { "access": { "score": 46, "summary": "The law gives patients a right to see their medical documents and to get their personal data within 30 days, but the national patient cabinet shows only personal data and doctor declarations. Some private apps show part of the record.", "sources": [ { "title": "Osnovy zakonodavstva Ukrainy pro okhoronu zdorovia (Fundamentals of Health Legislation), Art. 39", "url": "https://zakon.rada.gov.ua/laws/show/2801-12", "date": "2026-02-11", "publisherClass": "legal_text" }, { "title": "De ya mozhu perehlianuty svoi medychni dani v ESOZ? (Patient cabinet FAQ, NSZU)", "url": "https://pis.esoz.gov.ua/faq/de-ya-mozhu-perehlyanuty-svoyi-medychni-dani-e-napravlennya-e-retsepty-toshcho-yaki-zberihayutsya-v-esoz/", "date": "undated", "publisherClass": "official" }, { "title": "Kabinet patsiienta: podannia deklaratsii likariu onlain (eHealth)", "url": "https://ehealth.gov.ua/2026/02/11/kabinet-patsiyenta-dlya-ukrayintsiv-teper-dostupna-mozhlyvist-podannya-deklaratsiyi-likaryu-onlajn/", "date": "2026-02-11", "publisherClass": "official" }, { "title": "Zakon Ukrainy pro zakhyst personalnykh danykh (Personal Data Protection Law), Art. 8", "url": "https://zakon.rada.gov.ua/laws/show/2297-17", "date": "undated", "publisherClass": "legal_text" } ] }, "control": { "score": 50, "summary": "The law says access to a patient's e-health data needs consent, and patients approve other doctors by SMS code. But signing a family doctor declaration counts as blanket consent, and no patient-visible access log was found.", "sources": [ { "title": "Fundamentals of Health Legislation, Art. 24-2 (electronic health system)", "url": "https://zakon.rada.gov.ua/laws/show/2801-12", "date": "2026-02-11", "publisherClass": "legal_text" }, { "title": "Khto maie dostup do danykh patsiienta v ESOZ? (eHealth)", "url": "https://ehealth.gov.ua/2024/02/29/hto-maye-dostup-do-danyh-patsiyenta-v-esoz/", "date": "2024-02-29", "publisherClass": "official" }, { "title": "Medychni dani ukraintsiv: khto mozhe dyvytysia vashu istoriiu khvorob (RBC-Ukraine)", "url": "https://www.rbc.ua/rus/news/medichni-dani-ukrayintsiv-hto-mozhe-divitisya-1764940793.html", "date": "2025-12-09", "publisherClass": "news" } ] }, "privacy": { "score": 42, "summary": "Health data is a special category under a 2010 law enforced by the parliamentary human rights commissioner, not a standalone regulator. A GDPR-style replacement (bill 8153) passed first reading in November 2024 and was still not adopted at research date.", "sources": [ { "title": "Zakon Ukrainy pro zakhyst personalnykh danykh, Arts. 7, 22, 23", "url": "https://zakon.rada.gov.ua/laws/show/2297-17", "date": "undated", "publisherClass": "legal_text" }, { "title": "Bill 8153 card: Pro zakhyst personalnykh danykh (Verkhovna Rada)", "url": "https://itd.rada.gov.ua/billinfo/Bills/Card/40707", "date": "2022-10-25", "publisherClass": "official" }, { "title": "Oprylyudnyly perelik medychnykh onlain-system, yaki vidkliuchat vid ESOZ (LB.ua)", "url": "https://lb.ua/health/2026/04/23/734385_oprilyudnili_perelik_medichnih.html", "date": "2026-04-23", "publisherClass": "news" }, { "title": "Medychni dani ukraintsiv: khto mozhe dyvytysia vashu istoriiu khvorob (RBC-Ukraine)", "url": "https://www.rbc.ua/rus/news/medichni-dani-ukrayintsiv-hto-mozhe-divitisya-1764940793.html", "date": "2025-12-09", "publisherClass": "news" } ] }, "journey": { "score": 62, "summary": "One national e-health system links family doctors, e-referrals, e-prescriptions, sick notes and NSZU payments for 34.6 million registered patients. Over 111.8 million e-prescriptions have been created, but self-paid prescriptions and hospital data are less complete.", "sources": [ { "title": "Reiestr patsiientiv ESOZ nalichuie ponad 34,5 miljony aktyvnykh zapysiv (eHealth)", "url": "https://ehealth.gov.ua/2026/03/13/reyestr-patsiyentiv-esoz-nalichuye-ponad-34-5-miljony-aktyvnyh-zapysiv-yaki-mozhlyvosti-dostupni-dlya-patsiyenta/", "date": "2026-03-13", "publisherClass": "official" }, { "title": "V ESOZ stvoreno ponad 111 miljoniv e-Retseptiv (eHealth)", "url": "https://ehealth.gov.ua/2026/05/14/v-esoz-stvoreno-ponad-111-miljoniv-e-retseptiv/", "date": "2026-05-14", "publisherClass": "official" }, { "title": "Khto maie dostup do danykh patsiienta v ESOZ? (eHealth)", "url": "https://ehealth.gov.ua/2024/02/29/hto-maye-dostup-do-danyh-patsiyenta-v-esoz/", "date": "2024-02-29", "publisherClass": "official" }, { "title": "Oprylyudnyly perelik medychnykh onlain-system, yaki vidkliuchat vid ESOZ (LB.ua)", "url": "https://lb.ua/health/2026/04/23/734385_oprilyudnili_perelik_medichnih.html", "date": "2026-04-23", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Commercial use of health data needs the person's unambiguous consent, but no specific ban on selling health data was found. Private firms run the patient apps; Helsi, with about 29 million users, planned an 80 hryvnia AI subscription by end-2025.", "sources": [ { "title": "Zakon Ukrainy pro zakhyst personalnykh danykh, Art. 7", "url": "https://zakon.rada.gov.ua/laws/show/2297-17", "date": "undated", "publisherClass": "legal_text" }, { "title": "Platni funktsii Helsi: navishcho servis vvodyt pidpysku (Forbes Ukraine)", "url": "https://forbes.ua/innovations/peretvoriti-patsientiv-na-pidpisnikiv-medichniy-servis-helsi-robit-platnoyu-shi-rozshifrovku-analiziv-u-rozrobku-yakoi-vklala-400-000-yak-kompaniya-monetizue-29-mln-koristuvachiv-04072025-31016", "date": "2025-07-04", "publisherClass": "news" } ] }, "clinical": { "score": 58, "summary": "A patient's family doctor sees all records except HIV and psychiatric data, and the law allows access without consent when life is at risk. Other doctors see only what the patient approves by SMS code or what is attached to a referral.", "sources": [ { "title": "Khto maie dostup do danykh patsiienta v ESOZ? (eHealth)", "url": "https://ehealth.gov.ua/2024/02/29/hto-maye-dostup-do-danyh-patsiyenta-v-esoz/", "date": "2024-02-29", "publisherClass": "official" }, { "title": "Fundamentals of Health Legislation, Art. 24-2", "url": "https://zakon.rada.gov.ua/laws/show/2801-12", "date": "2026-02-11", "publisherClass": "legal_text" } ] }, "research": { "score": 44, "summary": "Law requires anonymity when medical secrets are used in research and free, informed consent for experiments on people, but no opt-out from secondary use was found. As a non-EU country, Ukraine is not covered by the EHDS opt-out.", "sources": [ { "title": "Fundamentals of Health Legislation, Arts. 40 and 45", "url": "https://zakon.rada.gov.ua/laws/show/2801-12", "date": "2026-02-11", "publisherClass": "legal_text" }, { "title": "Khto maie dostup do danykh patsiienta v ESOZ? (eHealth)", "url": "https://ehealth.gov.ua/2024/02/29/hto-maye-dostup-do-danyh-patsiyenta-v-esoz/", "date": "2024-02-29", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 40, "summary": "Medical devices, including software, still fall under 2013 rules based on older EU directives. New device rules were adopted in June 2026 (their EU MDR basis is not verified in the text) but take effect only from 31 December 2030, and no clinical AI law was found.", "sources": [ { "title": "Postanova KMU No. 759 vid 10.06.2026 pro zatverdzhennia Tekhnichnoho rehlamentu shchodo medychnykh vyrobiv", "url": "https://zakon.rada.gov.ua/laws/show/759-2026-%D0%BF", "date": "2026-06-10", "publisherClass": "legal_text" }, { "title": "Zatverdzhennia novykh Tekhnichnykh rehlamentiv shchodo medychnykh vyrobiv (State Service on Medicines and Drugs Control)", "url": "https://www.dls.gov.ua/for_subject/%D0%B7%D0%B0%D1%82%D0%B2%D0%B5%D1%80%D0%B4%D0%B6%D0%B5%D0%BD%D0%BD%D1%8F-%D0%BD%D0%BE%D0%B2%D0%B8%D1%85-%D1%82%D0%B5%D1%85%D0%BD%D1%96%D1%87%D0%BD%D0%B8%D1%85-%D1%80%D0%B5%D0%B3%D0%BB%D0%B0%D0%BC/", "date": "2026-06-16", "publisherClass": "official" }, { "title": "MOZ: 80,5% opytanykh medykiv uzhe vykorystovuiut ShI u roboti (7eminar)", "url": "https://7eminar.ua/news/23759-moz-805-opitanix-medikiv-uze-vikoristovuyut-si-u-roboti", "date": "2026-08-28", "publisherClass": "news" } ] } }, "laws": [ { "name": "Fundamentals of Ukrainian Health Legislation (No. 2801-XII)", "level": "National", "year": "1992", "what": "Right to review medical documents, medical secrecy, consent rules for e-health access (Art. 24-2).", "url": "https://zakon.rada.gov.ua/laws/show/2801-12" }, { "name": "Law on Personal Data Protection (No. 2297-VI)", "level": "National", "year": "2010", "what": "Health data is special category; access within 30 days; human rights commissioner oversees.", "url": "https://zakon.rada.gov.ua/laws/show/2297-17" }, { "name": "Law No. 4497-IX (State Register of Servicemen; amends Art. 24-2 of the Fundamentals)", "level": "National", "year": "2025", "what": "Lets the defence ministry receive military medical exam results from the e-health system.", "url": "https://zakon.rada.gov.ua/laws/show/4497-20" }, { "name": "Cabinet Resolution No. 759, Technical Regulation on Medical Devices", "level": "National", "year": "2026", "what": "New medical device technical regulation; applies from 31 December 2030. EU MDR basis not verified.", "url": "https://zakon.rada.gov.ua/laws/show/759-2026-%D0%BF" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-17", "headline": "Court voids military fitness ruling after commission could not produce examination records", "paraphrase": "A man said he was never examined, yet a military medical commission certified him fit for service. Asked by the court for the examination file and doctors' findings, the commission produced only the certificate, so the court annulled it.", "source": "Sudovo-yurydychna hazeta (sud.ua)", "url": "https://sud.ua/uk/news/sudova-praktyka/369460-vlk-na-paperi-cholovika-vyznaly-prydatnym-ale-ttsk-ne-nadav-sudu-dokumentiv-pro-medohliad", "theme": "record_wrong", "status": "finding" }, { "date": "2026-02-02", "headline": "National health service ends contracts with clinics that falsified patients' electronic records", "paraphrase": "The national health service said some clinics put inflated or invented entries into patients' electronic records to raise payments, and it ended contracts with several. Patients have reported finding visits in their records that never happened.", "source": "RBC-Ukraine", "url": "https://www.rbc.ua/rus/news/okremimi-likarnyami-nszu-rozirvala-dogovori-1770013744.html", "theme": "record_wrong", "status": "finding" }, { "date": "2026-03-26", "headline": "Family doctor held over 1,731 patient sign-ups allegedly made without people's knowledge", "paraphrase": "Investigators say a family doctor registered 1,731 patient declarations in the national e-health system without people's knowledge, using altered names, birth dates and addresses, to claim state payments for care never given.", "source": "StopCor", "url": "https://www.stopcor.org/ukr/section-uanews/news-medposlugi-lishe-na-paperi-likarka-otrimala-miljoni-za-fejkovi-deklaratsii-26-03-2026.html", "theme": "record_wrong", "status": "alleged" }, { "date": "2024-12-16", "headline": "Women found clinic visits they never made written into their electronic records", "paraphrase": "Prosecutors named a doctor as a suspect for entering at least 22 false appointment records over two years for women who had never met him. The women discovered the entries themselves and went to police.", "source": "KP.UA", "url": "https://kp.ua/ua/life/a702092-pju-vdoma-kavu-a-likar-pishe-shcho-ja-u-noho-na-prijomi-chim-zahrozhujut-fejkovi-zapisi-v-helsi", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "ARG", "name": "Argentina", "region": "Americas", "overall": 48, "rank": "55=", "likelyRank": "46 to 81", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "Argentine law makes patients owners of their record, and a national app lets people refuse network sharing, but the network is still young.", "categories": { "access": { "score": 60, "summary": "Ley 26.529 makes the patient the owner of the clinical record, with an authenticated copy due within 48 hours. The Mi Argentina app shows vaccines, 60 days of e-prescriptions and records from connected facilities, not the full chart; usage figures were not verified.", "sources": [ { "title": "Ley 26.529, derechos del paciente, texto actualizado (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/160000-164999/160432/texact.htm", "date": "2009-10-21", "publisherClass": "legal_text" }, { "title": "Decreto 1089/2012, reglamentacion de la Ley 26.529 (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/195000-199999/199296/norma.htm", "date": "2012-07", "publisherClass": "legal_text" }, { "title": "Preguntas frecuentes: Mi Salud en Mi Argentina (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/frecuentes", "date": "undated", "publisherClass": "official" }, { "title": "La Receta Electronica se incorpora a la app Mi Argentina (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/noticias/la-receta-electronica-se-incorpora-la-app-mi-argentina", "date": "2026-05-14", "publisherClass": "official" } ] }, "control": { "score": 48, "summary": "Official pages say facilities on the national network can see a record unless the person explicitly refuses, using privacy settings in Mi Argentina. A patient-visible access log is described only as design intent; use of the opt-out was not verified.", "sources": [ { "title": "Red Nacional de Salud Digital: configuracion de privacidad (Mi Argentina)", "url": "https://www.argentina.gob.ar/miargentina/configuracion-de-privacidad", "date": "undated", "publisherClass": "official" }, { "title": "Preguntas frecuentes: Mi Salud en Mi Argentina (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/frecuentes", "date": "undated", "publisherClass": "official" }, { "title": "Red Nacional de Salud Digital (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/digital/red", "date": "undated", "publisherClass": "official" }, { "title": "Ley 25.326, proteccion de los datos personales, texto actualizado (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/texact.htm", "date": "2000-10-04", "publisherClass": "legal_text" } ] }, "privacy": { "score": 42, "summary": "Health data is sensitive under Ley 25.326 (2000), but fines still top out at 100,000 pesos and the law itself has no breach notification article. The EU still rates the law adequate; a 2026 reform bill with 72-hour breach notice is pending.", "sources": [ { "title": "Ley 25.326, proteccion de los datos personales, texto actualizado (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/texact.htm", "date": "2000-10-04", "publisherClass": "legal_text" }, { "title": "Resolucion AAIP 126/2024, infracciones y sanciones (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/395000-399999/399750/norma.htm", "date": "2024-05-24", "publisherClass": "legal_text" }, { "title": "La AAIP inicio una investigacion de oficio ante presunta filtracion masiva de datos personales", "url": "https://www.argentina.gob.ar/noticias/la-aaip-inicio-una-investigacion-de-oficio-ante-presunta-filtracion-masiva-de-datos", "date": "2025-12-23", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 45, "summary": "E-prescription has been mandatory nationwide since January 2025, and the ministry reports more than 70 million prescriptions registered. Clinical records move through a federated network that provinces were still testing in June 2026; national coverage was not verified.", "sources": [ { "title": "Salud impulsa la interoperabilidad para consolidar un sistema de salud digital integrado (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/noticias/salud-impulsa-la-interoperabilidad-para-consolidar-un-sistema-de-salud-digital-integrado", "date": "2026-06-04", "publisherClass": "official" }, { "title": "El Ministerio de Salud completa la implementacion de la receta electronica (Resolucion 2214/2025)", "url": "https://www.argentina.gob.ar/noticias/el-ministerio-de-salud-completa-la-implementacion-de-la-receta-electronica-ahora-tambien", "date": "2025-07-21", "publisherClass": "official" }, { "title": "Integracion sanitaria digital en Tucuman impulsa la atencion federal de pacientes (Ministerio de Salud Publica de Tucuman)", "url": "https://msptucuman.gov.ar/integracion-sanitaria-digital-en-tucuman-impulsa-la-atencion-federal-de-pacientes/", "date": "2026-05-19", "publisherClass": "official" }, { "title": "La plataforma Historia de Salud Integrada ya alcanza a ocho provincias y mas de 1.600 establecimientos (Convergencia)", "url": "https://www.convergencia.com/a-diario-convergencia/la-plataforma-historia-de-salud-integrada-ya-alcanza-a-ocho-provincias-y-mas-de-1-600-establecimientos-5786/", "date": "2026-05-29", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Ley 25.326 requires prior, revocable consent to pass personal data to others and bans databases that reveal sensitive data, with anonymised research as the exception. No health-specific rule on data brokers, health apps or ad targeting was found, and fines are small.", "sources": [ { "title": "Ley 25.326, proteccion de los datos personales, texto actualizado (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/texact.htm", "date": "2000-10-04", "publisherClass": "legal_text" }, { "title": "Condiciones de uso, intercambio y confidencialidad de salud digital (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/digital/condiciones-de-uso", "date": "undated", "publisherClass": "official" }, { "title": "Resolucion AAIP 126/2024, infracciones y sanciones (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/395000-399999/399750/norma.htm", "date": "2024-05-24", "publisherClass": "legal_text" } ] }, "clinical": { "score": 42, "summary": "A clinician using a standards-based record can query a patient's history at other facilities through the national network, unless the patient has refused. Cross-province sharing was only being validated in 2026, and the share of facilities connected was not verified.", "sources": [ { "title": "Red Nacional de Salud Digital (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/digital/red", "date": "undated", "publisherClass": "official" }, { "title": "Preguntas frecuentes: Mi Salud en Mi Argentina (Ministerio de Salud)", "url": "https://www.argentina.gob.ar/salud/frecuentes", "date": "undated", "publisherClass": "official" }, { "title": "Ley 27.706, Programa Federal Unico de Informatizacion y Digitalizacion de Historias Clinicas (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/380000-384999/380710/norma.htm", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "Integracion sanitaria digital en Tucuman impulsa la atencion federal de pacientes (Ministerio de Salud Publica de Tucuman)", "url": "https://msptucuman.gov.ar/integracion-sanitaria-digital-en-tucuman-impulsa-la-atencion-federal-de-pacientes/", "date": "2026-05-19", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Studies using identifiable data need informed consent and ethics review under Resolution 1480/2011, but committees can waive consent for record or registry research, and there is no general opt-out. Score: base 40, +3 each for ethics review, a consent route and a public research registry.", "sources": [ { "title": "Resolucion 1480/2011, Guia para Investigaciones en Salud Humana, texto actualizado (Argentina.gob.ar)", "url": "https://www.argentina.gob.ar/normativa/nacional/norma-187206/actualizacion", "date": "2011-09-13", "publisherClass": "legal_text" }, { "title": "Ley 25.326, proteccion de los datos personales, texto actualizado (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/texact.htm", "date": "2000-10-04", "publisherClass": "legal_text" }, { "title": "Nueva normativa sobre Buenas Practicas Clinicas para estudios de farmacologia clinica (ANMAT)", "url": "https://www.argentina.gob.ar/noticias/nueva-normativa-sobre-buenas-practicas-clinicas-para-estudios-de-farmacologia-clinica", "date": "2025-10-09", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "ANMAT treats software that diagnoses, prevents or treats disease as a medical device needing registration under Disposition 64/2025, with post-market vigilance. No AI-specific change control or human oversight rule exists, so the score sits low in the guidance band, near Mexico (38).", "sources": [ { "title": "ANMAT actualiza los criterios regulatorios para software como dispositivo medico (SaMD)", "url": "https://www.argentina.gob.ar/noticias/anmat-actualiza-los-criterios-regulatorios-para-software-como-dispositivo-medico-samd", "date": "2026-09-10", "publisherClass": "official" }, { "title": "Disposicion ANMAT 64/2025, Reglamento Tecnico Mercosur de Registro de Productos Medicos (Infoleg)", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/405000-409999/408309/norma.htm", "date": "2025-01-13", "publisherClass": "legal_text" }, { "title": "Inteligencia artificial y software medico en Argentina: desafios regulatorios (Abogados.com.ar, Allende & Brea)", "url": "https://abogados.com.ar/inteligencia-artificial-y-software-medico-en-argentina-desafios-regulatorios-para-el-regimen-de-productos-medicos/40131", "date": "2026-09-24", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Ley 26.529 (derechos del paciente, historia clinica y consentimiento informado)", "level": "National", "year": "2009", "what": "Patient owns the record; authenticated copy within 48 hours; confidentiality; habeas data if refused.", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/160000-164999/160432/texact.htm" }, { "name": "Ley 25.326 (proteccion de los datos personales)", "level": "National", "year": "2000", "what": "Health is sensitive data; consent to pass data on; ten-day access right; AAIP enforces.", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/texact.htm" }, { "name": "Ley 27.706 (historias clinicas electronicas)", "level": "National", "year": "2023", "what": "Federal program for a single interoperable electronic record system; patient owns data with free access.", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/380000-384999/380710/norma.htm" }, { "name": "Ley 27.553 (recetas electronicas o digitales)", "level": "National", "year": "2020", "what": "Allows electronic prescriptions and telehealth platforms nationwide under data protection and patient rights laws.", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/340000-344999/340919/norma.htm" }, { "name": "Resolucion 1480/2011 (Guia para Investigaciones en Salud Humana)", "level": "National", "year": "2011", "what": "Consent and ethics review for research on people or their data; creates national research registry.", "url": "https://www.argentina.gob.ar/normativa/nacional/norma-187206/actualizacion" }, { "name": "Disposicion ANMAT 64/2025", "level": "National", "year": "2025", "what": "Adopts the Mercosur medical device registration rule, defining software as a medical device.", "url": "https://servicios.infoleg.gob.ar/infolegInternet/anexos/405000-409999/408309/norma.htm" }, { "name": "Ley 15.201 (Provincia de Buenos Aires, gestion digital de estudios)", "level": "State/Provincial", "year": "2020", "what": "Labs and imaging centres must send results digitally, free, in a non-proprietary format if patients opt in.", "url": "https://normas.gba.gob.ar/documentos/xAm1DYco.html" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2024-12-03", "headline": "Cyberattack locked databases at three medical testing centres, delaying patients' results", "paraphrase": "A ransomware attack encrypted the shared databases of three large testing and laboratory centres, affecting thousands of patients for ten days. The group said no patient data was taken, but labs closed and reports were handed out manually.", "source": "La Nación", "url": "https://www.lanacion.com.ar/sociedad/estamos-haciendo-el-maximo-esfuerzo-para-resolverlo-hackearon-el-servidor-de-tres-importantes-nid02122024/", "theme": "access_delay_or_cost", "status": "admitted" }, { "date": "2025-04-05", "headline": "Hackers offer 665,128 patients' test results for sale after attack on software supplier", "paraphrase": "Criminals put up for sale 665,128 medical test results with patients' personal details, taken from a company that stores imaging for about 30 clinics and hospitals in several provinces. After extortion failed, the data went on sale.", "source": "Tiempo Argentino", "url": "https://www.tiempoar.com.ar/ta_article/hackean-665-128-estudios-medicos-la-filtracion-de-datos-de-salud-mas-grande-del-pais/", "theme": "breach", "status": "alleged" }, { "date": "2026-05-15", "headline": "Lawmaker seeks answers over claimed sale of millions of Argentines' health records", "paraphrase": "Attackers claimed to be selling 700 GB from a national government health database, including clinical records and personal details of up to 52 million people. A national deputy filed requests for information. The leak was unconfirmed.", "source": "Código Baires", "url": "https://www.codigobaires.com.ar/2026-05-15/denuncian-filtracion-y-la-venta-de-historias-clinicas-y-datos-sensibles-de-52-millones-de-argentinos-248315", "theme": "breach", "status": "alleged" }, { "date": "2026-05-23", "headline": "Retirees' insurer posted members' clinical records on its public purchasing site", "paraphrase": "A fact-checking investigation found at least 40 purchase files on the insurer's public procurement search showing members' clinical histories, test results and ID copies. The insurer called it a serious anomaly, removed the files and opened internal inquiries.", "source": "Jujuygráfico", "url": "https://jujuygrafico.com.ar/pami-historias-clinicas-jubilados-jujuy-gob", "theme": "breach", "status": "admitted" } ] }, { "iso3": "AZE", "name": "Azerbaijan", "region": "Asia", "overall": 48, "rank": "55=", "likelyRank": "46 to 82", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Azerbaijanis can download labs, scans and discharge summaries on the state mygov portal, but no patient control over who sees the health record was verified.", "categories": { "access": { "score": 60, "summary": "The 1997 public health law gives a right to see medical documents and get copies on request, and the mygov portal shows lab results, scan reports, prescriptions and discharge summaries as PDFs. How many people use its health section was not verified.", "sources": [ { "title": "Law No. 360-IQ on Protection of Public Health (e-qanun.az)", "url": "https://frameworks.e-qanun.az/4/f_4078.html", "date": "1997-06-26", "publisherClass": "legal_text" }, { "title": "Law No. 998-IIIQ on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/19/f_19675.html", "date": "2010-05-11", "publisherClass": "legal_text" }, { "title": "Three more medical records added to mygov: e-prescriptions, diagnostic test results, referrals (Xeberler.az)", "url": "https://xeberler.az/new/details/daha-3-tibbi-melumat-%E2%80%9Cmygov%E2%80%9D-platformasina-inteqrasiya-olunub--35919.htm", "date": "2025-07-23", "publisherClass": "news" }, { "title": "Citizens' discharge summaries added to mygov (Xeberler.az)", "url": "https://xeberler.az/new/details/vetendaslarin-xestelik-tarixcesi-%E2%80%9Cmygov%E2%80%9Da-daxil-edilib--36102.htm", "date": "2025-08-11", "publisherClass": "news" } ] }, "control": { "score": 40, "summary": "mygov lets people grant and revoke consent for companies to pull their data and shows every request. No opt-out or patient-visible access log for the clinical record itself was verified, so the score sits at the bottom of the 40 to 55 band.", "sources": [ { "title": "mygov processes personal data only with citizens' consent and the law (IDDA)", "url": "https://idda.az/az/xeberler/mygov-platformasinda-vetendaslarin-ferdi-melumatlari-yalniz-onlarin-raziligina-ve-qanunvericiliye-esasen-emal-olunur", "date": "2025-12-27", "publisherClass": "official" }, { "title": "Law No. 998-IIIQ on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/19/f_19675.html", "date": "2010-05-11", "publisherClass": "legal_text" }, { "title": "Cabinet Decision No. 143: Rules for the Electronic Health Card system (e-qanun.az)", "url": "https://frameworks.e-qanun.az/12/f_12294.html", "date": "2006-06-12", "publisherClass": "legal_text" } ] }, "privacy": { "score": 40, "summary": "Health data is special-category data under the 2010 Law on Personal Data, but fines are 300 to 500 manat, a ministry supervises, and no breach-notice duty exists. Investigators, prosecutors and courts can obtain medical secrets without consent.", "sources": [ { "title": "Law No. 998-IIIQ on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/19/f_19675.html", "date": "2010-05-11", "publisherClass": "legal_text" }, { "title": "Law No. 360-IQ on Protection of Public Health (e-qanun.az)", "url": "https://frameworks.e-qanun.az/4/f_4078.html", "date": "1997-06-26", "publisherClass": "legal_text" }, { "title": "Code of Administrative Offences, Article 375 (e-qanun.az)", "url": "https://frameworks.e-qanun.az/0/c_c_24.html", "date": "2015-12-29", "publisherClass": "legal_text" }, { "title": "Presidential Decree No. 361 on implementing the Law on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/21/c_f_21035.html", "date": "2010-12-13", "publisherClass": "legal_text" } ] }, "journey": { "score": 60, "summary": "The Unified Health Information System has moved to the Government Cloud, e-sick leave is nationwide, and a unified discharge-summary registry feeds benefit and insurance processes. The FHIR-based Medical Digital Twin System links over 20 digital tools, but private facilities are joining in phases.", "sources": [ { "title": "Ministry of Health presents the Medical Digital Twin System (Ministry of Health)", "url": "https://sehiyye.gov.az/en/media/xeberler-ve-yenilikler/s-hiyy-nazirliyi-v-t-ndas-saglamligina-r-q-msal-qaygi-tibbi-r-q-msal-kiz-sisteminin-t-qdimatini-kecirib/", "date": "2026-06-03", "publisherClass": "official" }, { "title": "Ministry's Medical Digital Twin System expands to Baku Health Center (Xeberler.az)", "url": "https://xeberler.az/new/details/sehiyye-nazirliyinin-yaratdigi-tibbi-reqemsal-ekiz-sistemi-genislenir--39760.htm", "date": "2026-07-23", "publisherClass": "news" }, { "title": "Information on the Electronic Prescription system (Ministry of Health)", "url": "https://sehiyye.gov.az/media/xeberler-ve-yenilikler/elektron-resept-t-tbiqi-il-bagli-m-lumat/", "date": "2024-05-24", "publisherClass": "official" } ] }, "commercial": { "score": 40, "summary": "Passing health data to third parties needs written consent, and mygov blocks connected companies without it. But the data law also lets personal data in public and corporate systems be provided to third parties for a fee, and no ban on selling health data was found.", "sources": [ { "title": "Law No. 998-IIIQ on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/19/f_19675.html", "date": "2010-05-11", "publisherClass": "legal_text" }, { "title": "mygov processes personal data only with citizens' consent and the law (IDDA)", "url": "https://idda.az/az/xeberler/mygov-platformasinda-vetendaslarin-ferdi-melumatlari-yalniz-onlarin-raziligina-ve-qanunvericiliye-esasen-emal-olunur", "date": "2025-12-27", "publisherClass": "official" }, { "title": "Law No. 360-IQ on Protection of Public Health (e-qanun.az)", "url": "https://frameworks.e-qanun.az/4/f_4078.html", "date": "1997-06-26", "publisherClass": "legal_text" } ] }, "clinical": { "score": 50, "summary": "TRƏS is meant to make data from state and private facilities available to treating doctors, but only some facilities had joined by July 2026. Access is limited to staff a facility head authorises, and secrets may be shared without consent when the patient cannot speak.", "sources": [ { "title": "Ministry of Health presents the Medical Digital Twin System (Ministry of Health)", "url": "https://sehiyye.gov.az/en/media/xeberler-ve-yenilikler/s-hiyy-nazirliyi-v-t-ndas-saglamligina-r-q-msal-qaygi-tibbi-r-q-msal-kiz-sisteminin-t-qdimatini-kecirib/", "date": "2026-06-03", "publisherClass": "official" }, { "title": "Ministry's Medical Digital Twin System expands to Baku Health Center (Xeberler.az)", "url": "https://xeberler.az/new/details/sehiyye-nazirliyinin-yaratdigi-tibbi-reqemsal-ekiz-sistemi-genislenir--39760.htm", "date": "2026-07-23", "publisherClass": "news" }, { "title": "Cabinet Decision No. 143: Rules for the Electronic Health Card system (e-qanun.az)", "url": "https://frameworks.e-qanun.az/12/f_12294.html", "date": "2006-06-12", "publisherClass": "legal_text" }, { "title": "Law No. 360-IQ on Protection of Public Health (e-qanun.az)", "url": "https://frameworks.e-qanun.az/4/f_4078.html", "date": "1997-06-26", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Anonymised data may be used for science without consent, and no ethics body, register or opt-out was verified. Medical secrecy and a consent route for identifiable data add two safeguards to the base of 40, and biomedical research on people needs informed consent.", "sources": [ { "title": "Law No. 360-IQ on Protection of Public Health (e-qanun.az)", "url": "https://frameworks.e-qanun.az/4/f_4078.html", "date": "1997-06-26", "publisherClass": "legal_text" }, { "title": "Law No. 998-IIIQ on Personal Data (e-qanun.az)", "url": "https://frameworks.e-qanun.az/19/f_19675.html", "date": "2010-05-11", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Azerbaijan has an AI Strategy for 2025 to 2028 and a 2026 digital action plan, but neither is binding. No regulation of AI medical software, change control or human-oversight rule for clinical AI was verified.", "sources": [ { "title": "Artificial Intelligence Strategy of the Republic of Azerbaijan for 2025 to 2028 (president.az)", "url": "https://static.president.az/upload/Files/2025/03/19/5a0fb1886a7316cb1b95458f366c1bd6_3415396.pdf", "date": "2025-03-19", "publisherClass": "official" }, { "title": "Action Plan for Accelerating Digital Development 2026 to 2028 (president.az)", "url": "https://static.president.az/upload/Files/2026/02/27/1619d20b92c1f18cf27603a1d0dab4fe_1178651.pdf", "date": "2026-02-27", "publisherClass": "official" }, { "title": "AI regulation in Azerbaijan (AI Policy Tracker)", "url": "https://aipolicytracker.org/jurisdictions/azerbaijan", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Ministry of Health presents the Medical Digital Twin System (Ministry of Health)", "url": "https://sehiyye.gov.az/en/media/xeberler-ve-yenilikler/s-hiyy-nazirliyi-v-t-ndas-saglamligina-r-q-msal-qaygi-tibbi-r-q-msal-kiz-sisteminin-t-qdimatini-kecirib/", "date": "2026-06-03", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law No. 360-IQ on Protection of Public Health", "level": "National", "year": "1997", "what": "Right to see and copy medical documents; medical secrecy and its exceptions; consent for biomedical research.", "url": "https://frameworks.e-qanun.az/4/f_4078.html" }, { "name": "Law No. 998-IIIQ on Personal Data", "level": "National", "year": "2010", "what": "Health is special-category data; free access within 7 working days; written consent for transfers.", "url": "https://frameworks.e-qanun.az/19/f_19675.html" }, { "name": "Cabinet Decision No. 143 on the Electronic Health Card system", "level": "National", "year": "2006", "what": "Central health-card registry at the ministry; access only by staff a facility head authorises.", "url": "https://frameworks.e-qanun.az/12/f_12294.html" }, { "name": "Code of Administrative Offences, Article 375", "level": "National", "year": "2015", "what": "Fines of 300 to 500 manat for breaching personal data law.", "url": "https://frameworks.e-qanun.az/0/c_c_24.html" }, { "name": "Artificial Intelligence Strategy for 2025 to 2028", "level": "National", "year": "2025", "what": "Non-binding plan for an ethical AI legal base, data protection rules and standards.", "url": "https://static.president.az/upload/Files/2025/03/19/5a0fb1886a7316cb1b95458f366c1bd6_3415396.pdf" }, { "name": "Action Plan for Accelerating Digital Development 2026 to 2028", "level": "National", "year": "2026", "what": "All state services via mygov; AI DPIA method; AI exemptions regime for health pilots.", "url": "https://static.president.az/upload/Files/2026/02/27/1619d20b92c1f18cf27603a1d0dab4fe_1178651.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-01", "headline": "Surgery footage of a patient posted online for advertising, report says", "paraphrase": "A report says a doctor at a clinic in the capital filmed a patient's operation and posted it as an advertisement. A physician called publishing such footage without consent a breach of medical secrecy.", "source": "Baku.ws", "url": "https://baku.ws/ru/obschestvo/tancy-so-skalpelem-skandalnoe-video-operacii-radi-trendov-v-baku", "theme": "breach", "status": "alleged" }, { "date": "2025-06-04", "headline": "Doctor shared revealing images of a patient from an examination, outlet reports", "paraphrase": "An outlet reports that a doctor in the capital posted video from a procedure that showed a patient's body uncovered. The posting drew public criticism over patient confidentiality.", "source": "Bizim.Media", "url": "https://bizim.media/az/cemiyyet/253017/bakida-hekim-pasiyentin-sinesinin-goruntulerini-yayimlayib-reqs-etdi-ndash-vdeo/", "theme": "breach", "status": "alleged" }, { "date": "2025-03-06", "headline": "Private clinic laboratory issued a wrong test result to a patient, outlet reports", "paraphrase": "An outlet reports that a private clinic's laboratory gave a patient an incorrect negative test result. The Ministry of Health responded that screening results outside the specialist centre must be confirmed there.", "source": "News24.az", "url": "https://news24.az/196275-pasiyente-yanlish-diaqnoz-qoyuldu.html", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "KAZ", "name": "Kazakhstan", "region": "Asia", "overall": 48, "rank": "55=", "likelyRank": "45 to 80", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Kazakh law promises consent and an access log for health data, but the state collects records centrally and its systems are still being joined up.", "categories": { "access": { "score": 60, "summary": "Article 61 of the Health Code gives a right to see one's data in the National Electronic Health Passport, and eGov's eDensaulyq shows prescriptions, hospital stays and referrals. The Ministry said in December 2025 the passport still holds limited data; usage was not verified.", "sources": [ { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry Order KR DSM-54 (2021), Rules on access rights of digital health subjects", "url": "https://bizup.kz/ru/documents/V2100023370", "date": "2021-06-23", "publisherClass": "legal_text" }, { "title": "eDensaulyq service in the eGov mobile app (Republican Centre for Electronic Health)", "url": "https://rcez.kz/serviceedensaulyg", "date": "undated", "publisherClass": "official" }, { "title": "Kazakhs to get full access to the electronic health passport in 2026 (El.kz)", "url": "https://el.kz/ru/polnyy-dostup-k-elektronnomu-pasportu-zdorovya-poluchat-kazahstantsy-v-2026-godu_400042673/", "date": "2025-12-23", "publisherClass": "news" } ] }, "control": { "score": 46, "summary": "The Health Code says providers may access a person's medical data only with consent and gives a right to track an access log. But data must flow to the national health passport without consent, and whether patients can actually see the log was not verified.", "sources": [ { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry Order KR DSM-54 (2021), Rules on access rights of digital health subjects", "url": "https://bizup.kz/ru/documents/V2100023370", "date": "2021-06-23", "publisherClass": "legal_text" }, { "title": "Law No. 94-V On Personal Data and Their Protection (2013, as amended)", "url": "https://bizup.kz/ru/documents/Z1300000094", "date": "undated", "publisherClass": "legal_text" }, { "title": "Kazakhs to get full access to the electronic health passport in 2026 (El.kz)", "url": "https://el.kz/ru/polnyy-dostup-k-elektronnomu-pasportu-zdorovya-poluchat-kazahstantsy-v-2026-godu_400042673/", "date": "2025-12-23", "publisherClass": "news" } ] }, "privacy": { "score": 38, "summary": "Medical secrecy and the Personal Data Law protect health data and require breach notice to the regulator. But investigators, prosecutors and special state bodies can get records without consent, the regulator is a ministry, and students' medical data leaked in April 2026.", "sources": [ { "title": "Health Code No. 360-VI, Article 273 (medical secrecy)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law No. 94-V On Personal Data and Their Protection (2013, as amended)", "url": "https://bizup.kz/ru/documents/Z1300000094", "date": "undated", "publisherClass": "legal_text" }, { "title": "Fines for personal data leaks may rise for companies (Zakon.kz)", "url": "https://www.zakon.kz/obshestvo/6533131-shtrafy-za-utechku-personalnykh-dannykh-dlya-kompaniy-khotyat-povysit-v-kazakhstane.html", "date": "2026-09-29", "publisherClass": "news" }, { "title": "KazNU scandal: students' personal and medical data leaked (Zakon.kz)", "url": "https://www.zakon.kz/obshestvo/6514124-skandal-v-kaznu-v-set-utekli-personalnye-i-meditsinskie-dannye-studentov.html", "date": "2026-04-10", "publisherClass": "news" } ] }, "journey": { "score": 50, "summary": "Clinics must send data to the National Electronic Health Passport, and eDensaulyq links prescriptions, hospital stays and referrals. In February 2026 the President said over 30 health information systems were not fully integrated, and ordered one state system by 1 December 2026.", "sources": [ { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "eDensaulyq service in the eGov mobile app (Republican Centre for Electronic Health)", "url": "https://rcez.kz/serviceedensaulyg", "date": "undated", "publisherClass": "official" }, { "title": "Health Ministry launches e-Densaulyq and a single medical data repository (Pharmreviews)", "url": "https://pharmreviews.kz/novosti/novosti-kazahstana/minzdrav-kazakhstana-zapuskaet-e-densaulyq-i-edinoe-khranilishche-meditsinskikh-dannykh", "date": "2026-02-24", "publisherClass": "news" }, { "title": "Electronic health passport to appear for every Kazakh: what it means (DKNews)", "url": "https://dknews.kz/ru/dk-it/392505-elektronnyy-pasport-zdorovya-poyavitsya-u", "date": "2026-05-08", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "The Health Code allows transfer of personal medical data to third parties only with consent. In July 2026, though, registered data exchanges including MedEx began trading de-identified medical data products, and no specific limit on selling de-identified health data was found.", "sources": [ { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law No. 94-V On Personal Data and Their Protection (2013, as amended)", "url": "https://bizup.kz/ru/documents/Z1300000094", "date": "undated", "publisherClass": "legal_text" }, { "title": "A medical data market has opened in Kazakhstan (Azattyq Ruhy)", "url": "https://rus.azattyq-ruhy.kz/economics/112458-v-kazakhstane-otkrylsia-rynok-meditsinskikh-dannykh-kak-eto-izmenit-sistemu-zdravookhraneniia", "date": "2026-07-23", "publisherClass": "news" } ] }, "clinical": { "score": 48, "summary": "Emergency teams get default access to a person's medical data under Article 61 of the Health Code; other clinicians need consent. Officials say the national passport will give doctors one window on a patient's history, but that is still being built.", "sources": [ { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry Order KR DSM-54 (2021), Rules on access rights of digital health subjects", "url": "https://bizup.kz/ru/documents/V2100023370", "date": "2021-06-23", "publisherClass": "legal_text" }, { "title": "Kazakhs to get full access to the electronic health passport in 2026 (El.kz)", "url": "https://el.kz/ru/polnyy-dostup-k-elektronnomu-pasportu-zdorovya-poluchat-kazahstantsy-v-2026-godu_400042673/", "date": "2025-12-23", "publisherClass": "news" }, { "title": "Electronic health passport to appear for every Kazakh: what it means (DKNews)", "url": "https://dknews.kz/ru/dk-it/392505-elektronnyy-pasport-zdorovya-poyavitsya-u", "date": "2026-05-08", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "The Health Code requires consent to use a person's medical information in applied research, and identifiable medical secrets go to researchers only with informed consent. De-identified data is used for research without consent or an opt-out, with bioethics commissions as the main safeguard.", "sources": [ { "title": "Health Code No. 360-VI, Articles 227 and 228 (biomedical research, bioethics commissions)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Code No. 360-VI, Article 273 (medical secrecy)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Code No. 360-VI, Articles 60 and 61 (digital health, access to personal medical data)", "url": "https://zakon.uchet.kz/rus/docs/K2000000360", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 48, "summary": "Kazakhstan's Law On Artificial Intelligence, signed 17 November 2025, puts risk management, transparency and labelling duties on AI owners. A Health Ministry order on AI in care, with pilots, validation and post-market monitoring, was only a draft in May 2026.", "sources": [ { "title": "President signs the Law On Artificial Intelligence (Akorda)", "url": "https://www.akorda.kz/ru/glavoy-gosudarstva-podpisan-zakon-respubliki-kazahstan-ob-iskusstvennom-intellekte-17105536", "date": "2025-11-17", "publisherClass": "official" }, { "title": "Health Ministry drafts procedure for introducing AI in healthcare (Profit.kz)", "url": "https://profit.kz/news/73708/Razrabotan-poryadok-vnedreniya-II-v-zdravoohranenie-ot-pilota-do-masshtabirovaniya/", "date": "2026-05-06", "publisherClass": "news" } ] } }, "laws": [ { "name": "Code On Public Health and the Healthcare System (No. 360-VI)", "level": "National", "year": "2020", "what": "Patient rights, digital health chapter, consent-based access, access log right, medical secrecy, research consent.", "url": "https://zakon.uchet.kz/rus/docs/K2000000360" }, { "name": "Law On Personal Data and Their Protection (No. 94-V)", "level": "National", "year": "2013", "what": "Consent, withdrawal, breach notice to regulator, state consent service, cross-border transfer limits.", "url": "https://bizup.kz/ru/documents/Z1300000094" }, { "name": "Rules on access rights of digital health subjects (Order KR DSM-54)", "level": "National", "year": "2021", "what": "Consent form for medical data access, 3-day reply, eGov notices of data use.", "url": "https://bizup.kz/ru/documents/V2100023370" }, { "name": "Health Ministry Order No. 152 (amends telemedicine requirements and access rules)", "level": "National", "year": "2025", "what": "Telemedicine resources must give patients passport access and an access log view.", "url": "https://bizup.kz/ru/documents/V2500037480-o-vnesenii-izmeneniy-v-nekotorye-prikazy-ministra-zdravoohra" }, { "name": "Law On Artificial Intelligence (No. 230-VIII)", "level": "National", "year": "2025", "what": "AI principles, owner risk duties, banned manipulative systems, labelling of AI outputs.", "url": "https://www.akorda.kz/ru/glavoy-gosudarstva-podpisan-zakon-respubliki-kazahstan-ob-iskusstvennom-intellekte-17105536" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-03-29", "headline": "Private clinic sent a patient's test results to a stranger, then admitted the leak", "paraphrase": "A patient learned her lab results had been sent to an unknown man, apparently because of a similar phone number. The clinic apologised in writing and publicly admitted the leak, but the two sides disputed compensation.", "source": "CMN.KZ", "url": "https://cmn.kz/intimnaya-glasnost-ili-popytka-zarabotat-o-chyom-voyuet-paczientka-s-almatinskoj-klinikoj/", "theme": "breach", "status": "admitted" }, { "date": "2026-08-20", "headline": "Man finds appointments and prescriptions he never had in his national health app record", "paraphrase": "A man who rarely uses public clinics found a doctor's appointment he never booked and prescriptions in his name in his electronic health record. Other people reported seeing a stranger's test results in their own accounts.", "source": "Ulysmedia.kz", "url": "https://ulysmedia.kz/news/79090-okazyvaetsia-ia-aktivno-lechus-kazakhstanets-obnaruzhil-neozhidannuiu-zapis-v-damumed/", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-07-08", "headline": "Clinic notice about an adult patient's visit went to her mother's phone", "paraphrase": "An adult patient in a large city says an automatic discharge notice went to her mother. The health ministry said the clinic had likely never updated a parent's number added years earlier, and it is reviewing the SMS system.", "source": "Tengrinews.kz", "url": "https://tengrinews.kz/tengri-health/almatinka-zayavila-utechke-dannyih-preryivaniya-beremennosti-602773/", "theme": "breach", "status": "alleged" }, { "date": "2026-04-24", "headline": "App users report strangers' test results and false records in their health accounts", "paraphrase": "Users of the national health app reported seeing other people's test results in their accounts. One woman said a clinic told her she was recorded as dead and had been removed from its patient list.", "source": "NewTimes.kz", "url": "https://newtimes.kz/obshchestvo/218584-opasnyi-sboi-v-damumed-poiavliaiutsia-chuzhie-deti-i-analizy", "theme": "record_wrong", "status": "alleged" }, { "date": "2025-07-15", "headline": "Prime minister says leak of 16 million people's data likely came from medical organisations", "paraphrase": "Personal data of about 16.3 million people appeared online. The prime minister said preliminary findings pointed to medical organisations that had access to state databases but failed to protect them. A criminal case was opened.", "source": "Vlast.kz", "url": "https://vlast.kz/novosti/65697-utecka-dannyh-bolee-16-mln-kazahstancev-mogla-proizojti-iz-medorganizacij-bektenov.html", "theme": "breach", "status": "alleged" } ] }, { "iso3": "NZL", "name": "New Zealand", "region": "Oceania", "overall": 48, "rank": "55=", "likelyRank": "46 to 82", "band": "Mixed", "keysModel": "Shared", "confidence": "high", "headline": "New Zealanders get records free from public agencies, but the national shared record is not live and a 2025 portal hack exposed nearly 100,000 patients.", "categories": { "access": { "score": 55, "summary": "The health privacy code gives a right to your records within 20 working days, free from public agencies. The national My Health Record shows only immunisations, COVID-19 results and some identity details; fuller views sit in private GP portals.", "sources": [ { "title": "Ask for your information (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/your-rights/ask-for-your-information/", "date": "undated", "publisherClass": "official" }, { "title": "Charging for access to personal information (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/responsibilities/charging-for-access-to-personal-information/", "date": "undated", "publisherClass": "official" }, { "title": "About My Health Account (Health New Zealand)", "url": "https://www.healthnz.govt.nz/websites-and-apps/my-health-account/about-my-health-account", "date": "2026-07-22", "publisherClass": "official" }, { "title": "Manage My Health data breach: a timeline of what happened (RNZ)", "url": "https://www.rnz.co.nz/news/crime-and-justice/584053/manage-my-health-data-breach-a-timeline-of-what-happened-and-everything-we-know-so-far", "date": "2026-01-14", "publisherClass": "news" } ] }, "control": { "score": 47, "summary": "Today choices are narrow: people can restrict their national immunisation record, and some regional shared records allow opt-out. The national Shared Digital Health Record, with opt-out, item blocking and access summaries, has not started sharing.", "sources": [ { "title": "Privacy: Shared Digital Health Record (Health New Zealand)", "url": "https://www.healthnz.govt.nz/privacy/wider-sharing-of-your-health-information/privacy-shared-digital-health-record", "date": "2026-08-07", "publisherClass": "official" }, { "title": "Restricted access to records in the AIR (Health New Zealand)", "url": "https://www.healthnz.govt.nz/health-professionals/guidance-standards/topic/immunisation/aotearoa-immunisation-register-air/restricted-access-to-records-air", "date": "2026-05-21", "publisherClass": "official" }, { "title": "Shared Electronic Health Record: frequently asked questions (sehr.org.nz, operator not stated)", "url": "https://sehr.org.nz/frequently-asked-questions/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Supporting your care with shared health information (Health New Zealand)", "url": "https://www.healthnz.govt.nz/privacy/wider-sharing-of-your-health-information", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "A health-specific code and an active commissioner exist, but the December 2025 Manage My Health hack exposed nearly 100,000 people and the regulator's strongest tool was a compliance notice. Fines reach only NZ$10,000, for failing to report a breach.", "sources": [ { "title": "Privacy Commissioner releases Phase 1 Inquiry into Manage My Health cyber incident (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-finds-manage-my-health-and-health-nz-breached-privacy-act/", "date": "2026-05-27", "publisherClass": "official" }, { "title": "Privacy Commissioner issues Compliance Notices to Manage My Health and Health NZ (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/", "date": "2026-09-23", "publisherClass": "official" }, { "title": "NotifyUs: evaluate a privacy breach (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/evaluate", "date": "undated", "publisherClass": "official" }, { "title": "Calls to strengthen New Zealand's Privacy Act grow amid an increasing number of major breaches (IAPP)", "url": "https://iapp.org/news/a/calls-to-strengthen-new-zealand-s-privacy-act-grow-amid-an-increasing-number-of-major-breaches", "date": "2026-03-05", "publisherClass": "news" } ] }, "journey": { "score": 40, "summary": "National building blocks exist: an immunisation register, the ePrescription Service and a dispensing claims collection. But Health NZ says record sharing happens only in some regions, and its national connector will not share GP data until mid-2027.", "sources": [ { "title": "Shared Digital Health Record update: July 2026 (Health New Zealand)", "url": "https://www.healthnz.govt.nz/news-and-updates/shared-digital-health-record-update-july-2026", "date": "2026-07-09", "publisherClass": "official" }, { "title": "Privacy: Shared Digital Health Record (Health New Zealand)", "url": "https://www.healthnz.govt.nz/privacy/wider-sharing-of-your-health-information/privacy-shared-digital-health-record", "date": "2026-08-07", "publisherClass": "official" }, { "title": "e-Medicines programme (Health New Zealand)", "url": "https://www.healthnz.govt.nz/about-us/what-we-do/programmes-and-initiatives/e-medicines-programme", "date": "undated", "publisherClass": "official" }, { "title": "Pharmaceutical collection (Health New Zealand)", "url": "https://www.healthnz.govt.nz/about-us/health-data/data-sets-and-collections/national-collections/pharmaceutical-collection", "date": "2026-07-22", "publisherClass": "official" } ] }, "commercial": { "score": 52, "summary": "The health code covers insurers, sellers of medicines and devices, and firms that handle health information for others, and limits disclosure beyond the original purpose. But breaches carry no civil fines, and vendors acting for others escape direct liability.", "sources": [ { "title": "Health Information Privacy Code 2020 (Privacy Commissioner, consolidated website version)", "url": "https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Health-Information-Privacy-Code-2020-website-version.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Privacy Commissioner releases Phase 1 Inquiry into Manage My Health cyber incident (Office of the Privacy Commissioner)", "url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-finds-manage-my-health-and-health-nz-breached-privacy-act/", "date": "2026-05-27", "publisherClass": "official" }, { "title": "Calls to strengthen New Zealand's Privacy Act grow amid an increasing number of major breaches (IAPP)", "url": "https://iapp.org/news/a/calls-to-strengthen-new-zealand-s-privacy-act-grow-amid-an-increasing-number-of-major-breaches", "date": "2026-03-05", "publisherClass": "news" } ] }, "clinical": { "score": 40, "summary": "In regions with a shared electronic record, GPs, pharmacists, paramedics and emergency departments can view a summary. Elsewhere clinicians rely on local systems, as Health NZ's national connector has not yet begun sharing.", "sources": [ { "title": "Supporting your care with shared health information (Health New Zealand)", "url": "https://www.healthnz.govt.nz/privacy/wider-sharing-of-your-health-information", "date": "undated", "publisherClass": "official" }, { "title": "Privacy: Shared Digital Health Record (Health New Zealand)", "url": "https://www.healthnz.govt.nz/privacy/wider-sharing-of-your-health-information/privacy-shared-digital-health-record", "date": "2026-08-07", "publisherClass": "official" }, { "title": "Shared Electronic Health Record: frequently asked questions (sehr.org.nz, operator not stated)", "url": "https://sehr.org.nz/frequently-asked-questions/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Health Information Privacy Code 2020 (Privacy Commissioner, consolidated website version)", "url": "https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Health-Information-Privacy-Code-2020-website-version.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "research": { "score": 50, "summary": "Identifiable health data can be used for research without consent if an ethics committee approves a waiver, with no general opt-out. Stats NZ's Integrated Data Infrastructure applies de-identification, a closed data lab and prosecution for misuse.", "sources": [ { "title": "Health Information Privacy Code 2020 (Privacy Commissioner, consolidated website version)", "url": "https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Health-Information-Privacy-Code-2020-website-version.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "National Ethical Standards, 7. Informed consent (National Ethics Advisory Committee)", "url": "https://neac.health.govt.nz/national-ethical-standards/part-two/7-informed-consent/", "date": "2026-03-30", "publisherClass": "official" }, { "title": "How we keep integrated data safe (Stats NZ)", "url": "https://www.stats.govt.nz/integrated-data/how-we-keep-integrated-data-safe/", "date": "2022-08-23", "publisherClass": "official" }, { "title": "Restricted access to records in the AIR (Health New Zealand)", "url": "https://www.healthnz.govt.nz/health-professionals/guidance-standards/topic/immunisation/aotearoa-immunisation-register-air/restricted-access-to-records-air", "date": "2026-05-21", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "New Zealand has no approval system for medical devices, so clinical AI is not assessed before use. Health NZ's own rules bar clinical decisions by generative AI and require registration of AI projects, while a new Medical Products Bill is still being drafted.", "sources": [ { "title": "Explanation of the WAND database (Medsafe)", "url": "https://www.medsafe.govt.nz/regulatory/devicesnew/3-2Explanation.asp", "date": "2011-05-10", "publisherClass": "official" }, { "title": "Using generative AI and large language models (Health New Zealand)", "url": "https://www.healthnz.govt.nz/health-professionals/guidance-standards/topic/digital-technologies/using-generative-ai-and-large-language-models", "date": "2026-05-21", "publisherClass": "official" }, { "title": "Artificial Intelligence and Algorithm Expert Advisory Group (Health New Zealand)", "url": "https://www.healthnz.govt.nz/about-us/who-we-are/expert-groups-and-networks/expert-groups/artificial-intelligence-and-algorithm-expert-advisory-group", "date": "undated", "publisherClass": "official" }, { "title": "Medical Products Bill to introduce risk-based framework for software and AI regulation (eHealthNews.nz, HiNZ)", "url": "https://www.hinz.org.nz/news/727150/Medical-Products-Bill-to-introduce-risk-based-framework-for-software-and-AI-regulation-.htm", "date": "2026-05-12", "publisherClass": "news" } ] } }, "laws": [ { "name": "Privacy Act 2020", "level": "National", "year": "2020", "what": "General privacy law; breach notification, compliance notices, fines up to $10,000 for failing to notify.", "url": "https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/evaluate" }, { "name": "Health Information Privacy Code 2020", "level": "National", "year": "2020", "what": "Health-specific rules on collection, security, access, charges and disclosure for health agencies and insurers.", "url": "https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Health-Information-Privacy-Code-2020-website-version.pdf" }, { "name": "Health Information Privacy Code 2020 Amendment No 2", "level": "National", "year": "2026", "what": "Adds rule 3A: tell people when health data is collected from someone else. In force 1 May 2026.", "url": "https://www.privacy.org.nz/assets/Codes-of-Practice-2020/Amendment-No-2-to-Health-Information-Privacy-Code-2020.pdf" }, { "name": "Medicines Act 1981 and Medicines (Database of Medical Devices) Regulations 2003", "level": "National", "year": "1981", "what": "Devices, including software, need only WAND notification; no pre-market approval.", "url": "https://www.medsafe.govt.nz/regulatory/devicesnew/3-2Explanation.asp" }, { "name": "Data and Statistics Act 2022", "level": "National", "year": "2022", "what": "Confidentiality duties and penalties for researchers using integrated government data, including health records.", "url": "https://www.stats.govt.nz/integrated-data/how-we-keep-integrated-data-safe/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-06-16", "headline": "Agency mailed a person's health information to the wrong house", "paraphrase": "A government agency sent a person's health information to the wrong address because a staff member recorded the house number incorrectly. The agency at first denied a mistake; after the regulator stepped in, it apologised and agreed to pay compensation.", "source": "Office of the Privacy Commissioner (New Zealand), Case Note 329225 [2025] NZ Priv Cmr 1", "url": "https://www.privacy.org.nz/resources-and-learning/case-notes-and-court-decisions/case-note-329225-2025-nz-priv-cmr-1-individual-complains-that-government-agency-sent-their-health-information-to-an-incorrect-address/", "theme": "breach", "status": "admitted" }, { "date": "2026-09-23", "headline": "Portal and Health NZ ordered to fix security after 99,416 patients' data exposed", "paraphrase": "After a cyberattack exposed health documents belonging to 99,416 people, a review found gaps in protection, weak oversight of tech suppliers and late notice to those affected. The portal operator and Health NZ were ordered to strengthen safeguards.", "source": "Stuff", "url": "https://www.stuff.co.nz/nz-news/361037084/nearly-100000-patients-had-health-data-exposed-now-two-agencies-have-been-ordered-fix-security", "theme": "breach", "status": "finding" }, { "date": "2026-01-09", "headline": "Patients told their health records were stolen could not get answers", "paraphrase": "After a ransomware attack on a patient portal, a woman told her records were affected could not log in, and the helpline cut her off. Another was told both that her data was and was not affected.", "source": "RNZ", "url": "https://www.rnz.co.nz/news/business/583637/manage-my-health-patients-draw-blanks-in-quest-for-information-on-cybersecurity-breach", "theme": "breach", "status": "admitted" }, { "date": "2026-03-29", "headline": "Health NZ says two people can be wrongly linked to one patient number", "paraphrase": "Health NZ acknowledged that two people with near-identical details can be linked to one National Health Index number, and that some may have received the wrong care as a result. It said it keeps no central record of such cases.", "source": "RNZ", "url": "https://www.rnz.co.nz/news/health/590930/concerns-patients-receiving-incorrect-treatment-due-to-mistaken-identity", "theme": "record_wrong", "status": "admitted" }, { "date": "2026-02-25", "headline": "Health worker used a colleague's login to open her ex-partner's records", "paraphrase": "An audit a man and his new partner requested showed his former partner, a health worker, had opened both their medical records using a colleague's login. She lost her job, and a court found her guilty.", "source": "RNZ", "url": "https://www.rnz.co.nz/news/regions_wellington/587931/health-worker-guilty-of-illegally-accessing-ex-partner-s-medical-records", "theme": "breach", "status": "finding" } ] }, { "iso3": "USA", "name": "United States", "region": "Americas", "overall": 48, "rank": "55=", "likelyRank": "45 to 80", "band": "Mixed", "keysModel": "Institutional", "confidence": "high", "headline": "Americans have an enforced legal right to copies of their records, but providers and insurers decide most sharing, and health apps sit outside HIPAA.", "categories": { "access": { "score": 50, "summary": "HIPAA gives a right to the whole designated record set within 30 days at a cost-based fee, and OCR has brought 55 right of access enforcement actions. There is no national record: 65% used a portal in 2024, and 59% had more than one.", "sources": [ { "title": "45 CFR 164.524 Access of individuals to protected health information (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524", "date": "undated", "publisherClass": "legal_text" }, { "title": "HHS OCR settles HIPAA Right of Access investigation with Azul Vision (HHS)", "url": "https://www.hhs.gov/press-room/hhs-ocr-settles-hipaa-investigation-with-azul-vision.html", "date": "2026-08-27", "publisherClass": "official" }, { "title": "Individuals' Access and Use of Patient Portals and Smartphone Health Apps, 2024, Data Brief 77 (ASTP/ONC)", "url": "https://healthit.gov/data/data-briefs/individuals-access-and-use-patient-portals-and-smartphone-health-apps-2024/", "date": "2025-07", "publisherClass": "official" }, { "title": "OCR Director Says Carry On: July sees news of Security delay, surprise access reg (HCCA via JD Supra)", "url": "https://www.jdsupra.com/legalnews/ocr-director-says-carry-on-usually-6479185/", "date": "2026-08-06", "publisherClass": "news" } ] }, "control": { "score": 35, "summary": "HIPAA lets providers and plans share records for treatment, payment and operations without consent, and they may refuse restriction requests. A block on items paid in full and a six-year disclosure log that omits routine sharing put the cell at the top of its band.", "sources": [ { "title": "45 CFR 164.506 Uses and disclosures to carry out treatment, payment, or health care operations (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506", "date": "undated", "publisherClass": "legal_text" }, { "title": "45 CFR 164.522 Rights to request privacy protection (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.522", "date": "undated", "publisherClass": "legal_text" }, { "title": "45 CFR 164.528 Accounting of disclosures (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.528", "date": "undated", "publisherClass": "legal_text" }, { "title": "Confidentiality of Substance Use Disorder Patient Records, final rule (Federal Register)", "url": "https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-ud-patient-records", "date": "2024-02-16", "publisherClass": "legal_text" } ] }, "privacy": { "score": 50, "summary": "HIPAA is enforced, with breach reporting and fines, but breaches are vast: 397 large breaches exposed 33.77 million people in the first half of 2026. The Security Rule overhaul proposed in January 2025 now has a July 2027 target.", "sources": [ { "title": "H1 2026 Healthcare Data Breach Report (HIPAA Journal)", "url": "https://www.hipaajournal.com/h1-2026-healthcare-data-breach-report/", "date": "2026-09-30", "publisherClass": "news" }, { "title": "Unified Agenda: HIPAA Security Rule, RIN 0945-AA22 (OIRA, reginfo.gov)", "url": "https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22", "date": "undated", "publisherClass": "official" }, { "title": "HIPAA and Reproductive Health (HHS OCR)", "url": "https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html", "date": "2025-06-27", "publisherClass": "official" }, { "title": "Texas SB 1188, enrolled text (Texas Legislature)", "url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm", "date": "2025", "publisherClass": "legal_text" } ] }, "journey": { "score": 60, "summary": "Exchange is growing: 76% of hospitals did all four exchange tasks in 2025, and TEFCA went from 10 million to over 1 billion records in under a year. There is still no national record, and payer APIs are due in 2027.", "sources": [ { "title": "HHS expands secure access to health records through TEFCA, one billion records exchanged (HHS)", "url": "https://www.hhs.gov/press-room/onc-strengthens-tefca-one-billion-health-records-exchanged.html", "date": "2026-06-26", "publisherClass": "official" }, { "title": "Electronic Health Information Exchange by Hospitals, Quick Stat (ASTP/ONC)", "url": "https://healthit.gov/data/quickstats/electronic-health-information-exchange-hospitals/", "date": "2026-02", "publisherClass": "official" }, { "title": "Electronic Public Health Reporting Among Non-Federal Acute Care Hospitals, 2024, Data Brief 78 (ASTP/ONC)", "url": "https://healthit.gov/data/data-briefs/electronic-public-health-reporting-among-non-federal-acute-care-hospitals-2024/", "date": "2025-07", "publisherClass": "official" }, { "title": "CMS Interoperability and Prior Authorization Final Rule CMS-0057-F (CMS)", "url": "https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f", "date": "2024-01-17", "publisherClass": "official" } ] }, "commercial": { "score": 38, "summary": "Inside HIPAA, marketing and any sale of patient data need written authorization. But de-identified data falls outside the law, and health apps answer mainly to an FTC breach-notice rule and a few state laws such as Washington's.", "sources": [ { "title": "45 CFR 164.508 Uses and disclosures for which an authorization is required (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508", "date": "undated", "publisherClass": "legal_text" }, { "title": "45 CFR 164.514 De-identification of protected health information (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514", "date": "undated", "publisherClass": "legal_text" }, { "title": "FTC Finalizes Changes to the Health Breach Notification Rule (FTC)", "url": "https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule", "date": "2024-04-26", "publisherClass": "official" }, { "title": "RCW 19.373.070 Valid authorization to sell consumer health data (Washington Legislature)", "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 55, "summary": "HIPAA allows sharing for treatment without consent, so the limits are technical. In 2023, 71% of hospitals had routine access to outside records at the point of care, but only 42% said clinicians routinely used them.", "sources": [ { "title": "Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023, Data Brief 71 (ASTP/ONC)", "url": "https://healthit.gov/data/data-briefs/interoperable-exchange-patient-health-information-among-us-hospitals-2023/", "date": "2024-05", "publisherClass": "official" }, { "title": "A Decade of Data Examined: The Evolution of Electronic Prescribing (ASTP/ONC)", "url": "https://healthit.gov/blog/health-data/a-decade-of-data-examined-the-evolution-of-electronic-prescribing/", "date": "2024-07-15", "publisherClass": "official" }, { "title": "HHS Announces Crackdown on Health Data Blocking (HHS)", "url": "https://www.hhs.gov/press-room/hhs-crackdown-health-data-blocking.html", "date": "2025-09-03", "publisherClass": "official" }, { "title": "The Wait Is Over: Information Blocking Enforcement Is Officially Here (Holland & Knight)", "url": "https://www.hklaw.com/en/insights/publications/2026/02/the-wait-is-over-information-blocking-enforcement-is-officially-here", "date": "2026-02", "publisherClass": "law_firm" } ] }, "research": { "score": 49, "summary": "An IRB or privacy board can waive the patient's authorization when risk is minimal, and de-identified data needs no consent, so there is no general opt-out. Three safeguards lift the cell: board review, Certificates of Confidentiality and a broad-consent route.", "sources": [ { "title": "45 CFR 164.512 Uses and disclosures for which authorization is not required (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.512", "date": "undated", "publisherClass": "legal_text" }, { "title": "45 CFR 164.514 De-identification of protected health information (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514", "date": "undated", "publisherClass": "legal_text" }, { "title": "45 CFR 46.116 General requirements for informed consent (eCFR)", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-46/subpart-A/section-46.116", "date": "undated", "publisherClass": "legal_text" }, { "title": "Certificates of Confidentiality (NIH)", "url": "https://grants.nih.gov/policy-and-compliance/policy-topics/human-subjects/coc", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 56, "summary": "FDA regulates AI devices, listing about 1,600, and has final guidance on change control plans. But HHS proposed removing the only federal AI transparency rule for certified EHRs, and January 2026 guidance took more decision support software out of oversight.", "sources": [ { "title": "Artificial Intelligence-Enabled Medical Devices (FDA)", "url": "https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices", "date": "2026-09-04", "publisherClass": "official" }, { "title": "Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions (FDA)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "date": "2025-08", "publisherClass": "official" }, { "title": "HTI-5 proposed rule: ASTP/ONC deregulatory actions (Federal Register)", "url": "https://www.federalregister.gov/documents/2025/12/29/2025-23896/health-data-technology-and-interoperability-astponc-deregulatory-actions-to-unleash-prosperity", "date": "2025-12-29", "publisherClass": "legal_text" }, { "title": "California AB 3030, health care services: artificial intelligence (California Legislature)", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB3030", "date": "2024", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "HIPAA Privacy Rule, right of access (45 CFR 164.524)", "level": "National", "year": "2000", "what": "Right to the designated record set within 30 days, cost-based fee, electronic format if readily producible.", "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524" }, { "name": "42 CFR Part 2, substance use disorder records final rule", "level": "National", "year": "2024", "what": "Single revocable consent for future treatment, payment and operations uses; compliance from February 16, 2026.", "url": "https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-ud-patient-records" }, { "name": "FTC Health Breach Notification Rule (2024 update)", "level": "National", "year": "2024", "what": "Breach notice duties for health apps and similar technologies not covered by HIPAA.", "url": "https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-changes-health-breach-notification-rule" }, { "name": "CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)", "level": "National", "year": "2024", "what": "Payer FHIR APIs for patients, providers and payer-to-payer exchange, mostly by January 1, 2027.", "url": "https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f" }, { "name": "Washington My Health My Data Act (RCW 19.373)", "level": "State/Provincial", "year": "2023", "what": "Consent to collect or share consumer health data outside HIPAA; signed authorization to sell it.", "url": "https://app.leg.wa.gov/RCW/default.aspx?cite=19.373.070" }, { "name": "Texas SB 1188", "level": "State/Provincial", "year": "2025", "what": "Health records stored in the US from 2026; practitioners review AI records and disclose diagnostic AI use.", "url": "https://capitol.texas.gov/tlodocs/89R/billtext/html/SB01188F.htm" }, { "name": "California AB 3030", "level": "State/Provincial", "year": "2024", "what": "Disclaimer and human contact route on generative AI patient messages not reviewed by a clinician.", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240AB3030" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-12-16", "headline": "Six requests and more than a year before a patient got his records", "paraphrase": "A patient made six requests for his health information and waited more than a year to receive it. The regulator proposed a penalty; the provider settled before a hearing and paid $112,500.", "source": "U.S. Department of Health and Human Services, Office for Civil Rights", "url": "https://www.hhs.gov/press-room/ocr-settles-with-concentra.html", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-09-30", "headline": "Care provider posted patient stories online without written permission", "paraphrase": "A complaint said a group of care facilities put a patient's name, photo and care details on its website as a success story. The regulator found the same had happened to 150 patients without valid written authorization.", "source": "U.S. Department of Health and Human Services, Office for Civil Rights", "url": "https://www.hhs.gov/press-room/ocr-settles-hipaa-with-cadia-healthcare-facilities.html", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-01-15", "headline": "Patient asked by mail, phone and portal, then waited about nine months", "paraphrase": "A patient asked a health system for his medical records by mail, telephone and its patient portal. He received them about nine months later, only after the regulator opened an investigation. The system paid $60,000.", "source": "U.S. Department of Health and Human Services, Office for Civil Rights", "url": "https://www.hhs.gov/about/news/2025/01/15/hhs-office-civil-rights-settles-hipaa-case-against-memorial-healthcare-system-over-patient-access-records.html", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-01-24", "headline": "Insurer confirms health data of about 190 million Americans hit in one attack", "paraphrase": "A ransomware attack on a claims-processing company exposed names, ID numbers, insurance details and medical information such as test results and medications. Its parent company raised the count to about 190 million people. Attackers used a stolen credential.", "source": "TechCrunch", "url": "https://techcrunch.com/2025/01/24/unitedhealth-confirms-190-million-americans-affected-by-change-healthcare-data-breach/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "BHR", "name": "Bahrain", "region": "Middle East", "overall": 47, "rank": "60=", "likelyRank": "47 to 85", "band": "Mixed", "keysModel": "Institutional", "confidence": "medium", "headline": "Bahrain's privacy regulator now fines clinics for leaking health data, but patients get reports, not their chart, and have no say in record sharing.", "categories": { "access": { "score": 50, "summary": "The data protection law gives a free right to be told, within 15 working days, all personal data a controller holds. In practice the Sehati app offers medical reports, certificates and vaccination records, not the full chart.", "sources": [ { "title": "Law No. (30) of 2018 with Respect to Personal Data Protection (Personal Data Protection Authority)", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf", "date": "2018-07-12", "publisherClass": "legal_text" }, { "title": "NHRA Code of Professional Conduct 2020 V2 (National Health Regulatory Authority)", "url": "https://www.nhra.bh/Departments/HCP/MediaHandler/GenericHandler/documents/departments/HCP/Policies/Code%20of%20Professional%20Conduct%202020%20V2.pdf", "date": "2020", "publisherClass": "official" }, { "title": "Sehati app (Bahrain National Portal, iGA)", "url": "https://services.bahrain.bh/wps/portal/en/BSP/GSX-UI-AllApps/GSX-UI-AppDetails?appID=16", "date": "undated", "publisherClass": "official" }, { "title": "Sehati app listing, developer eGovernment Authority Bahrain (Apple App Store)", "url": "https://apps.apple.com/us/app/sehati/id1271662173", "date": "2025-06-23", "publisherClass": "blog_vendor" } ] }, "control": { "score": 30, "summary": "Health ministry rules limit reading a record to staff directly involved in care or quality checks, and others need written authorization. No opt-out from record sharing and no patient-visible access log were found.", "sources": [ { "title": "Patient Rights and Duties in Primary Health Care (Ministry of Health)", "url": "https://www.moh.gov.bh/Services/RightsandDutiesinPrimaryHealthCare?lang=en", "date": "undated", "publisherClass": "official" }, { "title": "Law No. (30) of 2018 with Respect to Personal Data Protection (Personal Data Protection Authority)", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf", "date": "2018-07-12", "publisherClass": "legal_text" }, { "title": "Sehati app (Bahrain National Portal, iGA)", "url": "https://services.bahrain.bh/wps/portal/en/BSP/GSX-UI-AllApps/GSX-UI-AppDetails?appID=16", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 56, "summary": "Health data is sensitive data under Law No. 30 of 2018, with jail of up to one year and fines up to BD20,000 for unlawful processing. In September 2026 the regulator fined a medical centre BD1,000 for emailing a patient's medical examination details to his employer.", "sources": [ { "title": "Law No. (30) of 2018 with Respect to Personal Data Protection (Personal Data Protection Authority)", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf", "date": "2018-07-12", "publisherClass": "legal_text" }, { "title": "Data protection laws in Bahrain (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=BH", "date": "2026-02-02", "publisherClass": "law_firm" }, { "title": "Medical Centre Fined BD1,000 for Sharing Patient Health Data (News of Bahrain)", "url": "https://www.newsofbahrain.com/bahrain/141478.html", "date": "2026-09-20", "publisherClass": "news" } ] }, "journey": { "score": 50, "summary": "Public clinics and hospitals share the I-SEHA electronic record, which a January 2025 agreement will replace in phases, starting with primary care. The planned national record linking private providers and insurers was not verified as live.", "sources": [ { "title": "National Health Information System (I-SEHA program) (Bahrain National Portal)", "url": "https://www.bahrain.bh/wps/portal/BNP/SiteMap/!ut/p/z1/jVJLU8IwEP4reOBosg2l0mOBkYci2hakuTBpyUCkTQMNIv560_HglKe5ZHf29X3fLqZ4hqlkn2LJtMglS40fUWduDZrQb3UA3NB1wCHEs0nQa8AY8Hs1wQonAG_TgeePH7sW2Bam_6mHC8-DW_VTTDEt9DEOt_nUAWcQ2C_NYWi1yG-f4-Ztn7QbAL3ghMfpIHod5jkelQE3eAyrCa9dmxgdXd9pjywY9RrlJsTHZkM9TJNcav6l8SyWas62dWBxvtM1veK1tZDLRZ7VgW92LBX68GcZiLQ65MyybtGkV3UcExwZHR4uJXjPBAdlD5aU94WjvSqQyrc65bpAqZDrMlj-TCmxwFGSZ0jEGdorxBaZkGjFU2MqhfY8NUGOijwR5k5VNpnIgxD3NHb8_nfII-_uBwf9WYw!/?1dmy&page=Content.Details.Page&urile=wcm%3Apath%3A%2Fbnp_en%2Fabout%2Bthe%2Bkingdom%2Fonce-only%2Bprinciple%2Bdata%2Frelated%2Btopics%2Fnational%2Bhealth%2Binformation%2Bsystem%2B%2528i-seha%2Bprogram%2529", "date": "undated", "publisherClass": "official" }, { "title": "Bahrain Signs Agreement to Implement Unified Health Information System (News of Bahrain)", "url": "https://www.newsofbahrain.com/bahrain/107279.html", "date": "2025-01-13", "publisherClass": "news" }, { "title": "Bahrain moves to digitize government hospital records in partnership with stc bahrain (Dharab)", "url": "https://dharab.com/bahrain-moves-to-digitize-government-hospital-records-in-partnership-with-stc-bahrain/", "date": "2026-09-23", "publisherClass": "news" }, { "title": "The National Health Information Systems (HIKMA) (Supreme Council of Health)", "url": "https://www.sch.org.bh/en/projects/the-national-health-information-systems-hekma.html", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Health data cannot be processed without consent outside listed exceptions, and people can object free of charge to direct marketing. No specific ban on selling health data or rules for consumer health apps were found.", "sources": [ { "title": "Law No. (30) of 2018 with Respect to Personal Data Protection (Personal Data Protection Authority)", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf", "date": "2018-07-12", "publisherClass": "legal_text" }, { "title": "Data protection laws in Bahrain (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=BH", "date": "2026-02-02", "publisherClass": "law_firm" }, { "title": "Law No. (23) of 2018 Promulgating the Health Insurance Law (Bahrain Business Laws, unofficial English text)", "url": "https://bahrainbusinesslaws.com/laws/health-insurance-law", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 52, "summary": "Doctors in government facilities can see a patient's case history, treatment history and family history in I-SEHA. Access across private hospitals and clinics was not verified.", "sources": [ { "title": "National Health Information System (I-SEHA program) (Bahrain National Portal)", "url": "https://www.bahrain.bh/wps/portal/BNP/SiteMap/!ut/p/z1/jVJLU8IwEP4reOBosg2l0mOBkYci2hakuTBpyUCkTQMNIv560_HglKe5ZHf29X3fLqZ4hqlkn2LJtMglS40fUWduDZrQb3UA3NB1wCHEs0nQa8AY8Hs1wQonAG_TgeePH7sW2Bam_6mHC8-DW_VTTDEt9DEOt_nUAWcQ2C_NYWi1yG-f4-Ztn7QbAL3ghMfpIHod5jkelQE3eAyrCa9dmxgdXd9pjywY9RrlJsTHZkM9TJNcav6l8SyWas62dWBxvtM1veK1tZDLRZ7VgW92LBX68GcZiLQ65MyybtGkV3UcExwZHR4uJXjPBAdlD5aU94WjvSqQyrc65bpAqZDrMlj-TCmxwFGSZ0jEGdorxBaZkGjFU2MqhfY8NUGOijwR5k5VNpnIgxD3NHb8_nfII-_uBwf9WYw!/?1dmy&page=Content.Details.Page&urile=wcm%3Apath%3A%2Fbnp_en%2Fabout%2Bthe%2Bkingdom%2Fonce-only%2Bprinciple%2Bdata%2Frelated%2Btopics%2Fnational%2Bhealth%2Binformation%2Bsystem%2B%2528i-seha%2Bprogram%2529", "date": "undated", "publisherClass": "official" }, { "title": "SMC steps up push for digital transformation (Gulf Daily News)", "url": "https://www.gdnonline.com/Details/1403059/SMC-steps-up-push-for-digital-transformation", "date": "2026-08-11", "publisherClass": "news" }, { "title": "The National Health Information Systems (HIKMA) (Supreme Council of Health)", "url": "https://www.sch.org.bh/en/projects/the-national-health-information-systems-hekma.html", "date": "undated", "publisherClass": "official" }, { "title": "Bahrain moves to digitize government hospital records in partnership with stc bahrain (Dharab)", "url": "https://dharab.com/bahrain-moves-to-digitize-government-hospital-records-in-partnership-with-stc-bahrain/", "date": "2026-09-23", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Ministry of Health research committees review studies and require written consent that participants can withdraw. The National Genome Program enrols by opt-in consent, with online withdrawal.", "sources": [ { "title": "Health Research Proposal FAQs (Ministry of Health Research Office)", "url": "https://research.moh.gov.bh/Help/Faqs", "date": "undated", "publisherClass": "official" }, { "title": "National Genome Program Consent Forms (Ministry of Health)", "url": "https://www.moh.gov.bh/GenomeConsentForms?lang=en", "date": "undated", "publisherClass": "official" }, { "title": "Law No. (30) of 2018 with Respect to Personal Data Protection (Personal Data Protection Authority)", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf", "date": "2018-07-12", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "Software used as a medical device is registered with the regulator like other devices, and each new version needs approval. No binding rule on human oversight of clinical AI was verified.", "sources": [ { "title": "Medical Devices Registration Guideline, July 2024 (NHRA)", "url": "https://www.nhra.bh/Departments/MDR/MediaHandler/GenericHandler/documents/departments/MDR/guidelines/Ver%209_MDR_Guideline_Medical%20Device%20Registration.pdf", "date": "2024-07", "publisherClass": "official" }, { "title": "Bahrain Launches National AI Policy and Adopts GCC Ethics Manual (iGA)", "url": "https://www.iga.gov.bh/en/article/bahrain-launches-national-ai-policy-and-adopts-gcc-ethics-manual", "date": "2025-07-27", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law No. (30) of 2018 with Respect to Personal Data Protection", "level": "National", "year": "2018", "what": "Health data is sensitive; consent rules, access and objection rights, criminal penalties.", "url": "https://www.pdp.gov.bh/en/assets/pdf/regulations.pdf" }, { "name": "Decree No. (78) of 2019", "level": "National", "year": "2019", "what": "Gives the data protection Authority's powers to the Ministry of Justice on a temporary basis.", "url": "https://www.dlapiperdataprotection.com/?t=law&c=BH" }, { "name": "Law No. (23) of 2018 Promulgating the Health Insurance Law", "level": "National", "year": "2018", "what": "National health insurance, health database, and a unified electronic medical record for every beneficiary.", "url": "https://bahrainbusinesslaws.com/laws/health-insurance-law" }, { "name": "NHRA Code of Professional Conduct 2020", "level": "National", "year": "2020", "what": "Duty of confidentiality and the patient's right to obtain a medical report.", "url": "https://www.nhra.bh/Departments/HCP/MediaHandler/GenericHandler/documents/departments/HCP/Policies/Code%20of%20Professional%20Conduct%202020%20V2.pdf" }, { "name": "NHRA Medical Devices Registration Guideline (Version 9)", "level": "National", "year": "2024", "what": "Registers software as a medical device; each new software version needs a variation.", "url": "https://www.nhra.bh/Departments/MDR/MediaHandler/GenericHandler/documents/departments/MDR/guidelines/Ver%209_MDR_Guideline_Medical%20Device%20Registration.pdf" }, { "name": "National Policy for the Use of Artificial Intelligence", "level": "National", "year": "2025", "what": "Framework for AI use by government bodies, tied to the data protection law.", "url": "https://www.iga.gov.bh/en/article/bahrain-launches-national-ai-policy-and-adopts-gcc-ethics-manual" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-21", "headline": "Data protection authority fines medical centre for emailing patient test results to employer", "paraphrase": "After a citizen complained, the Personal Data Protection Authority found a medical centre had emailed information and a document about his medical tests to his employer without valid prior consent or legal basis, and fined it 1,000 dinars.", "source": "Akhbar Al Khaleej", "url": "https://akhbar-alkhaleej.com/news/article/1451221", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-03-15", "headline": "Ransomware group claims it stole 110 GB of data from a private hospital", "paraphrase": "A ransomware group listed a private hospital on its leak site, claimed to hold 110 GB of its data, posted images of systems it said it had accessed, and threatened to publish the data unless paid.", "source": "Security Affairs", "url": "https://securityaffairs.com/189467/cyber-crime/payload-ransomware-claims-the-hack-of-royal-bahrain-hospital.html", "theme": "breach", "status": "alleged" } ] }, { "iso3": "SLV", "name": "El Salvador", "region": "Americas", "overall": 47, "rank": "60=", "likelyRank": "47 to 82", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "El Salvador gave patients new data rights in 2024 and a state AI telemedicine app in 2025, but public records are shared without individual choice.", "categories": { "access": { "score": 50, "summary": "The 2024 data law gives free access within 20 working days, and a 2026 ministry rule adds copies, summaries and export of the electronic record. No national portal shows the public record; the DoctorSV app shows only its own visits.", "sources": [ { "title": "Decreto 144, Ley para la Proteccion de Datos Personales (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "Norma tecnica del expediente clinico, con reforma (Ministerio de Salud)", "url": "https://asp.salud.gob.sv/regulacion/pdf/norma/normatecnicadelexpedienteclinico-Acuerdo-Ejecutivo-1616-30052024_v1-reforma1.pdf", "date": "2026-03-19", "publisherClass": "official" }, { "title": "Decreto 307, Ley de Deberes y Derechos de los Pacientes y Prestadores de Servicios de Salud (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/171117_073651293_archivo_documento_legislativo.pdf", "date": "2016-04-08", "publisherClass": "legal_text" }, { "title": "Como funciona DoctorSV (El Diario de Hoy)", "url": "https://www.elsalvador.com/noticias/nacional/medicina-salud-inteligencia-artificial-el-salvador/1250980/2025/", "date": "2025-11-13", "publisherClass": "news" } ] }, "control": { "score": 45, "summary": "Health data may be used for care without consent, and each person's digital record is open to all public providers, with no opt-out. Every access must be logged and the data law lets patients learn who consulted their data, but practice was not verified.", "sources": [ { "title": "Decreto 144, Ley para la Proteccion de Datos Personales (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "Norma tecnica del expediente clinico, con reforma (Ministerio de Salud)", "url": "https://asp.salud.gob.sv/regulacion/pdf/norma/normatecnicadelexpedienteclinico-Acuerdo-Ejecutivo-1616-30052024_v1-reforma1.pdf", "date": "2026-03-19", "publisherClass": "official" }, { "title": "DoctorSV usara datos personales y de salud para investigaciones cientificas (Diario El Mundo)", "url": "https://diario.elmundo.sv/nacionales/doctorsv-compartira-datos-de-salud-para-investigaciones-cientificas", "date": "2025-11-18", "publisherClass": "news" } ] }, "privacy": { "score": 42, "summary": "Health data is sensitive under the 2024 law, with 72-hour breach notice and fines up to 40 monthly minimum wages. The regulator's director is appointed and removable by the President, public security is excluded, and the sanction procedure only took effect in August 2026.", "sources": [ { "title": "Decreto 144, Ley para la Proteccion de Datos Personales (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "Decreto 143, Ley de Ciberseguridad y Seguridad de la Informacion (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/5BD19CFF-F658-4770-8391-8493916A3129.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "UNESCO insta a mejorar proteccion de datos ante uso de IA en El Salvador (La Prensa Grafica)", "url": "https://www.laprensagrafica.com/elsalvador/unesco-insta-a-mejorar-proteccion-de-datos-ante-uso-de-ia-en-el-salvador-20260611-0128.html", "date": "2026-06-11", "publisherClass": "news" }, { "title": "Filtracion masiva de datos en El Salvador (IPANDETEC)", "url": "https://ipandetec.org/el-salvador/filtracion-masiva-de-datos-en-el-salvador-y-la-necesidad-de-contar-medidas-de-ciberseguridad-y-regulacion-sobre-proteccion-de-datos-personales/", "date": "2024-09-17", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 52, "summary": "The Ministry's Integrated Health System (SIS) links public hospitals and clinics in one digital record, and since 2025 sits inside the social security record. Current coverage was not verified from a ministry source, and private providers connect only through DoctorSV orders.", "sources": [ { "title": "Modernizacion del sistema publico de salud se fortalece al integrar servicios (Presidencia)", "url": "https://www.presidencia.gob.sv/modernizacion-del-sistema-publico-de-salud-se-fortalece-al-integrar-servicios-en-hospitales-y-unidades-de-salud/", "date": "2022-07-09", "publisherClass": "official" }, { "title": "Norma tecnica del expediente clinico, con reforma (Ministerio de Salud)", "url": "https://asp.salud.gob.sv/regulacion/pdf/norma/normatecnicadelexpedienteclinico-Acuerdo-Ejecutivo-1616-30052024_v1-reforma1.pdf", "date": "2026-03-19", "publisherClass": "official" }, { "title": "Plataforma digital MINSAL ya se integro al expediente electronico ISSS (La Prensa Grafica)", "url": "https://www.laprensagrafica.com/elsalvador/Plataforma-digital-MINSAL-ya-se-integro-al-expediente-electronico-ISSS-20250627-0096.html", "date": "2025-06-27", "publisherClass": "news" }, { "title": "Nationwide implementation of AI-assisted telemedicine in El Salvador (Lancet Regional Health Americas, PMC13404066)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13404066/", "date": "2026-02-18", "publisherClass": "academic" } ] }, "commercial": { "score": 48, "summary": "Selling personal data without consent, or reversing pseudonymisation, is a very serious offence under the 2024 law, and people may object to marketing profiling. There is no enforcement record, and DoctorSV's contracts with private partners have not been disclosed.", "sources": [ { "title": "Decreto 144, Ley para la Proteccion de Datos Personales (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "Evaluaran impacto y rendimiento de la inteligencia artificial en aplicacion DoctorSV (La Prensa Grafica)", "url": "https://www.laprensagrafica.com/elsalvador/evaluaran-impacto-y-rendimiento-de-la-inteligencia-artificial-en-aplicacion-doctorsv-20260427-0100.html", "date": "2026-04-27", "publisherClass": "news" } ] }, "clinical": { "score": 55, "summary": "Public clinicians are meant to see a patient's SIS history, including vaccines, results, diagnoses and medicines, in any Ministry facility. Social security doctors see SIS as an extra tab, and private clinicians get only summaries on official request.", "sources": [ { "title": "Norma tecnica del expediente clinico, con reforma (Ministerio de Salud)", "url": "https://asp.salud.gob.sv/regulacion/pdf/norma/normatecnicadelexpedienteclinico-Acuerdo-Ejecutivo-1616-30052024_v1-reforma1.pdf", "date": "2026-03-19", "publisherClass": "official" }, { "title": "Digitalizacion del sistema de salud permite consultar expediente en linea (Diario El Salvador)", "url": "https://diarioelsalvador.com/depais/digitalizacion-del-sistema-de-salud-permite-consultar-expediente-en-linea/349756", "date": "2023-04-14", "publisherClass": "news" }, { "title": "Plataforma digital MINSAL ya se integro al expediente electronico ISSS (La Prensa Grafica)", "url": "https://www.laprensagrafica.com/elsalvador/Plataforma-digital-MINSAL-ya-se-integro-al-expediente-electronico-ISSS-20250627-0096.html", "date": "2025-06-27", "publisherClass": "news" }, { "title": "Decreto 302, Ley del Sistema Nacional Integrado de Salud (vLex)", "url": "https://sv.vlex.com/vid/decreto-no-302-ley-923561073", "date": "2019", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Medical research needs written informed consent under the 2016 patients' law, and trials need ethics committee and regulator approval. Pseudonymised health data can be used for research without consent and with no opt-out.", "sources": [ { "title": "Decreto 307, Ley de Deberes y Derechos de los Pacientes y Prestadores de Servicios de Salud (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/171117_073651293_archivo_documento_legislativo.pdf", "date": "2016-04-08", "publisherClass": "legal_text" }, { "title": "Decreto 144, Ley para la Proteccion de Datos Personales (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf", "date": "2024-11-15", "publisherClass": "legal_text" }, { "title": "RTS 11.03.02:21 Dispositivos medicos, requisitos para la regulacion sanitaria (OSARTEC)", "url": "https://osartec.gob.sv/wp-content/uploads/download-manager-files/RTS%20RS-DM_CPNyNI%2018-11-21.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "DoctorSV usara datos personales y de salud para investigaciones cientificas (Diario El Mundo)", "url": "https://diario.elmundo.sv/nacionales/doctorsv-compartira-datos-de-salud-para-investigaciones-cientificas", "date": "2025-11-18", "publisherClass": "news" } ] }, "ai": { "score": 35, "summary": "Device rules cover software and require reporting of post-registration changes, but no clinical AI rule exists, the same footing as Paraguay and Panama. A 2025 AI law created a national AI agency, but no risk framework issued under it was found.", "sources": [ { "title": "RTS 11.03.02:21 Dispositivos medicos, requisitos para la regulacion sanitaria (OSARTEC)", "url": "https://osartec.gob.sv/wp-content/uploads/download-manager-files/RTS%20RS-DM_CPNyNI%2018-11-21.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Ley de Fomento a Inteligencia Artificial y Tecnologias (Asamblea Legislativa)", "url": "https://www.asamblea.gob.sv/leyes-y-decretos/view/6137", "date": "2025-02-26", "publisherClass": "legal_text" }, { "title": "Nationwide implementation of AI-assisted telemedicine in El Salvador (Lancet Regional Health Americas, PMC13404066)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13404066/", "date": "2026-02-18", "publisherClass": "academic" }, { "title": "El Salvador avanza hacia una inteligencia artificial centrada en las personas (UNESCO)", "url": "https://www.unesco.org/es/articles/el-salvador-avanza-hacia-una-inteligencia-artificial-centrada-en-las-personas", "date": "2026-06-18", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Decreto 307, Ley de Deberes y Derechos de los Pacientes y Prestadores de Servicios de Salud", "level": "National", "year": "2016", "what": "Right to information, confidentiality of the record, and written consent for medical research.", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/171117_073651293_archivo_documento_legislativo.pdf" }, { "name": "Decreto 302, Ley del Sistema Nacional Integrado de Salud", "level": "National", "year": "2019", "what": "Creates a single health information system and one digital record per user across public providers.", "url": "https://sv.vlex.com/vid/decreto-no-302-ley-923561073" }, { "name": "Decreto 144, Ley para la Proteccion de Datos Personales", "level": "National", "year": "2024", "what": "Health data sensitive; free access; 72-hour breach notice; fines up to 40 minimum wages.", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/7A4FBD85-7E1B-46BE-9408-6FC549E53E00.pdf" }, { "name": "Decreto 143, Ley de Ciberseguridad y Seguridad de la Informacion", "level": "National", "year": "2024", "what": "Creates the State Cybersecurity Agency (ACE), also the data protection authority; directors named by the President.", "url": "https://www.asamblea.gob.sv/sites/default/files/documents/decretos/5BD19CFF-F658-4770-8391-8493916A3129.pdf" }, { "name": "Norma tecnica del expediente clinico (Ministerio de Salud)", "level": "National", "year": "2024", "what": "Record custody, access logs, and since 2026 patient copies, summaries and electronic export.", "url": "https://asp.salud.gob.sv/regulacion/pdf/norma/normatecnicadelexpedienteclinico-Acuerdo-Ejecutivo-1616-30052024_v1-reforma1.pdf" }, { "name": "Decreto 234, Ley de Fomento a Inteligencia Artificial y Tecnologias", "level": "National", "year": "2025", "what": "Promotes AI, creates the ANIA agency and a risk framework for systems using personal data.", "url": "https://www.asamblea.gob.sv/leyes-y-decretos/view/6137" }, { "name": "RTS 11.03.02:21 Dispositivos medicos, requisitos para la regulacion sanitaria", "level": "National", "year": "2021", "what": "Medical device registration, including software; change reporting; ethics approval for device trials.", "url": "https://osartec.gob.sv/wp-content/uploads/download-manager-files/RTS%20RS-DM_CPNyNI%2018-11-21.pdf" } ], "dti": { "grade": 80, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-26", "headline": "Doctors' union says social security computer failures are slowing electronic records and care", "paraphrase": "A health workers' union reported a week of slowdowns and failures in the social security institute's computer system, affecting electronic records, prescriptions and lab orders and delaying patients. The institute had not responded.", "source": "Diario El Mundo", "url": "https://diario.elmundo.sv/nacionales/simetrisss-denuncia-fallas-en-sistema-informatico-del-isss-y-retrasos-en-atencion-a-pacientes", "theme": "other", "status": "alleged" }, { "date": "2026-07-20", "headline": "Family refused a relative's medical record on privacy grounds while she could not consent", "paraphrase": "A family asked the health authority for an adult relative's record of diagnosis and treatment. It refused, citing confidentiality and the data law, although the patient was held in custody and not allowed to sign an authorisation.", "source": "Revista Factum", "url": "https://www.revistafactum.com/gobierno-oculta-ruthlopez/", "theme": "access_refused", "status": "alleged" }, { "date": "2026-06-26", "headline": "Health coalition says paper records from a rebuilt public hospital cannot be found", "paraphrase": "A health rights coalition said the paper records of patients treated before a national hospital was rebuilt and moved to a new hospital network have disappeared, so earlier test results are unavailable and some studies may need repeating.", "source": "Diario Co Latino", "url": "https://www.diariocolatino.com/conadesa-denuncia-desaparicion-de-expedientes-clinicos-del-hospital-rosales/", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2026-04-23", "headline": "Unclear terms for a tech firm's use of patient data in state health app", "paraphrase": "Reporting on the state's AI telemedicine app found no public agreement setting out how the cloud technology partner may use patients' data. The company said the data belong to the client and did not say whether it is paid.", "source": "BBC News Mundo", "url": "https://www.bbc.com/mundo/articles/cd0r82jg7d2o", "theme": "other", "status": "alleged" }, { "date": "2025-07-04", "headline": "Doctors report failures as ministry and social security merge patient records", "paraphrase": "As the health ministry's new information system was joined to the social security institute's electronic record, a doctors' union said the rollout came without training or coordination and the new system had shown multiple failures.", "source": "El Diario de Hoy (elsalvador.com)", "url": "https://www.elsalvador.com/h-noticias/h-nacional/ministerio-de-salud-isss-centros-comision-/1228840/2025/", "theme": "other", "status": "alleged" } ] }, { "iso3": "GRL", "name": "Greenland", "region": "Europe", "overall": 47, "rank": "60=", "likelyRank": "46 to 85", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Greenlanders have a legal right to their record in one national system, but copies cost a fee, and no online record view was found.", "categories": { "access": { "score": 30, "summary": "A 2001 ordinance gives patients a right to see and copy their records, but a 2006 order makes them pay a fee for copies and the right covers only records from 1995 on. No national portal showing the record was found.", "sources": [ { "title": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da", "date": "2001-05-31", "publisherClass": "legal_text" }, { "title": "Hjemmestyrets bekendtgørelse nr. 5 af 15. februar 2006 om ydelser og brugerbetaling i sundhedsvæsenet (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2006/bkg-05-2006?sc_lang=da", "date": "2006-02-15", "publisherClass": "legal_text" }, { "title": "Inatsisartutlov nr. 50 af 25. november 2024 om patienters klage- og erstatningsadgang (Nalunaarutit)", "url": "https://nalunaarutit.gl/Groenlandsk-lovgivning/2024/Inatsisartutlov-nr-50-af-25_11_2024?sc_lang=da", "date": "2024-11-25", "publisherClass": "legal_text" } ] }, "control": { "score": 44, "summary": "The 2001 ordinance lets a patient refuse at any time that their data be passed to other health staff during a treatment course. How to use that right in the national record, and any patient-visible access log, were not verified.", "sources": [ { "title": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da", "date": "2001-05-31", "publisherClass": "legal_text" }, { "title": "Fødsler i Grønland 2022 (Landslægeembedet)", "url": "https://dia-multisite.euwest01.umbraco.io/media/o3ee2g0d/da_foedsler_i_groenland_2022.pdf", "date": "2023-10-10", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "Greenland runs on the Danish Personal Data Act of 2000, put in force for Greenland by royal decree in 2016, not the GDPR. No health-sector rulings or health breaches were found, so we score the general law, which has a registration scheme and no breach notification duty found.", "sources": [ { "title": "Lovgivning (Datatilsynet i Grønland)", "url": "https://da.datatilsynet.gl/regler-og-vejledning/lovgivning", "date": "undated", "publisherClass": "official" }, { "title": "Vejledning om persondataloven for Grønland (Datatilsynet)", "url": "https://da.datatilsynet.gl/Media/639165204745836077/Vejledning%20om%20persondataloven%20for%20Gr%C3%B8nland.pdf", "date": "2016", "publisherClass": "official" }, { "title": "Datatilsynet åbner satellitkontor i Nuuk (Datatilsynet)", "url": "https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/aug/datatilsynet-aabner-satellitkontor-i-nuuk", "date": "2026-08-27", "publisherClass": "official" }, { "title": "Greenland (European Commission, International Partnerships)", "url": "https://international-partnerships.ec.europa.eu/countries/greenland_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 64, "summary": "One electronic record, Cosmic, is used across Greenland's single public health service, and the Chief Medical Officer draws national birth data from it. But Tasiilaq still records births in another system, and no electronic link to Danish hospitals was verified.", "sources": [ { "title": "Fødsler i Grønland 2022 (Landslægeembedet)", "url": "https://dia-multisite.euwest01.umbraco.io/media/o3ee2g0d/da_foedsler_i_groenland_2022.pdf", "date": "2023-10-10", "publisherClass": "official" }, { "title": "823 blev født i Grønland i 2018 (Sermitsiaq)", "url": "https://www.sermitsiaq.ag/samfund/823-blev-fodt-i-gronland-i-2018/663708", "date": "2020-02-02", "publisherClass": "news" }, { "title": "Aftale om behandling af grønlandske patienter i Danmark (Sundheds- og Kirkeministeriet og Naalakkersuisut, ism.dk)", "url": "https://www.ism.dk/Media/639240975998441088/Aftaletekst_DK.pdf", "date": "2026-09-03", "publisherClass": "official" } ] }, "commercial": { "score": 55, "summary": "Health staff may pass record data for non-treatment purposes only with written consent, which lapses after one year, or under narrow legal grounds. No Greenland ban on selling health data or using it for marketing beyond the general data law was found.", "sources": [ { "title": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da", "date": "2001-05-31", "publisherClass": "legal_text" }, { "title": "Vejledning om persondataloven for Grønland (Datatilsynet)", "url": "https://da.datatilsynet.gl/Media/639165204745836077/Vejledning%20om%20persondataloven%20for%20Gr%C3%B8nland.pdf", "date": "2016", "publisherClass": "official" } ] }, "clinical": { "score": 66, "summary": "Treating staff across Greenland work in the same national record, and the 2001 ordinance lets them share data for current treatment without consent. Whether Danish hospital clinicians can see the Greenland record when a patient is sent there was not verified.", "sources": [ { "title": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da", "date": "2001-05-31", "publisherClass": "legal_text" }, { "title": "Fødsler i Grønland 2022 (Landslægeembedet)", "url": "https://dia-multisite.euwest01.umbraco.io/media/o3ee2g0d/da_foedsler_i_groenland_2022.pdf", "date": "2023-10-10", "publisherClass": "official" }, { "title": "823 blev født i Grønland i 2018 (Sermitsiaq)", "url": "https://www.sermitsiaq.ag/samfund/823-blev-fodt-i-gronland-i-2018/663708", "date": "2020-02-02", "publisherClass": "news" }, { "title": "Aftale om behandling af grønlandske patienter i Danmark (Sundheds- og Kirkeministeriet og Naalakkersuisut, ism.dk)", "url": "https://www.ism.dk/Media/639240975998441088/Aftaletekst_DK.pdf", "date": "2026-09-03", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Record data can go to biomedical researchers without consent if a Greenland research commission approves, with use limited to research and fines for misuse. There is no general opt-out; in 2024 the health service refused researchers unlimited access to all records.", "sources": [ { "title": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling (Nalunaarutit)", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da", "date": "2001-05-31", "publisherClass": "legal_text" }, { "title": "Forskeres adgang til materiale fra det grønlandske sundhedsvæsen (Naalakkersuisut)", "url": "https://naalakkersuisut.gl/Nyheder/2024/07/2507_forskeres_adgang?sc_lang=da", "date": "2024-07-25", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "The Danish Medical Devices Act does not apply to Greenland, and Greenland is outside the EU, so neither the EU device rules nor the AI Act govern clinical AI there. We found no Greenland rules on AI or medical devices in care.", "sources": [ { "title": "Udkast til lovforslag, Sundhedsministeriet (høringsportalen), bemærkninger til § 6", "url": "https://prodstoragehoeringspo.blob.core.windows.net/7a61ff95-7713-4c73-8e70-f0af07d1cb40/Lovforslag.pdf", "date": "2022-01-12", "publisherClass": "official" }, { "title": "Greenland (European Commission, International Partnerships)", "url": "https://international-partnerships.ec.europa.eu/countries/greenland_en", "date": "undated", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Landstingsforordning nr. 6 af 31. maj 2001 om patienters retsstilling", "level": "National", "year": "2001", "what": "Patient consent, right of access to records, confidentiality, disclosure rules, research release with approval, fines.", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2001/ltf-06-2001?sc_lang=da" }, { "name": "Anordning nr. 1238 af 14. oktober 2016 (Personal Data Act for Greenland)", "level": "National", "year": "2016", "what": "Puts the Danish Personal Data Act of 2000 in force for Greenland; health data sensitive.", "url": "https://da.datatilsynet.gl/media/7643/anordning_pdl_for_groenlandf.pdf" }, { "name": "Hjemmestyrets bekendtgørelse nr. 5 af 15. februar 2006 om ydelser og brugerbetaling", "level": "National", "year": "2006", "what": "Sets user payments in health care, including a fee for copies of patient records.", "url": "https://nalunaarutit.gl/groenlandsk-lovgivning/2006/bkg-05-2006?sc_lang=da" }, { "name": "Inatsisartutlov nr. 50 af 25. november 2024 om patienters klage- og erstatningsadgang", "level": "National", "year": "2024", "what": "Sends patient rights complaints, including on record access, to the Danish Patient Complaints Agency.", "url": "https://nalunaarutit.gl/Groenlandsk-lovgivning/2024/Inatsisartutlov-nr-50-af-25_11_2024?sc_lang=da" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-07-29", "headline": "National patient record outage stops bookings and prescription renewals across Greenland", "paraphrase": "The health service said its electronic patient record was down. While it lasted, patients could not book consultations, make appointments or have prescriptions renewed, and the service said it was working on a fix.", "source": "Sermitsiaq", "url": "https://www.sermitsiaq.ag/samfund/sundhedsvaesenet-oplever-nedbrud/2410211", "theme": "access_delay_or_cost", "status": "admitted" }, { "date": "2026-02-03", "headline": "Compensation decisions delayed while officials travel the country searching for old patient records", "paraphrase": "Decisions in a government compensation scheme for care given without consent were postponed. The responsible minister said officials must travel around the country to find records, and that records were not always correctly kept.", "source": "KNR", "url": "https://knr.gl/da/nyheder/flere-kvinder-end-forventet-har-soegt-om-godtgoerelse-ufrivillig-praevention-i-nyere-tid", "theme": "record_wrong", "status": "admitted" } ] }, { "iso3": "IDN", "name": "Indonesia", "region": "Asia", "overall": 47, "rank": "60=", "likelyRank": "48 to 84", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Indonesia's laws give patients rights to their records, but the ministry holds the data by default and the privacy regulator still does not exist.", "categories": { "access": { "score": 55, "summary": "The Health Law and the PDP Law give patients a right to their record data, with access due within 3 x 24 hours. SATUSEHAT Mobile shows a medical summary, not the full chart, and how widely it works was not verified.", "sources": [ { "title": "Undang-Undang 17 Tahun 2023 tentang Kesehatan, annotated text (Mahkamah Konstitusi, Anotasi 2025)", "url": "https://s.mkri.id/public/content/infoumum/undang/pdf/Anotasi_180_ANOTASI%20UU%2017%20TAHUN%202023.pdf", "date": "2025", "publisherClass": "legal_text" }, { "title": "Undang-Undang 27 Tahun 2022 tentang Pelindungan Data Pribadi (BPK JDIH)", "url": "https://peraturan.bpk.go.id/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf", "date": "2022-10-17", "publisherClass": "legal_text" }, { "title": "Kemenkes Luncurkan SATUSEHAT RME, Rekam Medis Pasien Terintegrasi Secara Nasional", "url": "https://www.kemkes.go.id/id/kemenkes-luncurkan-satusehat-rme-rekam-medis-pasien-terintegrasi-secara-nasional", "date": "2026-09-01", "publisherClass": "official" }, { "title": "Kemenkes Pastikan SatuSehat RME Bisa Diakses dalam Kondisi Darurat (Beritasatu)", "url": "https://www.beritasatu.com/lifestyle/3023896/kemenkes-pastikan-satusehat-rme-bisa-diakses-dalam-kondisi-darurat", "date": "2026-09-02", "publisherClass": "news" } ] }, "control": { "score": 42, "summary": "Every facility must open its electronic records to the health ministry, with no patient choice. A 6-digit consent code and a patient-visible access history arrived with SATUSEHAT RME, which is starting in stages at a few named facilities.", "sources": [ { "title": "Peraturan Menteri Kesehatan 24 Tahun 2022 tentang Rekam Medis", "url": "https://keslan.kemkes.go.id/unduhan/fileunduhan_1662611251_882318.pdf", "date": "2022", "publisherClass": "legal_text" }, { "title": "Kemenkes Luncurkan SATUSEHAT RME, Rekam Medis Pasien Terintegrasi Secara Nasional", "url": "https://www.kemkes.go.id/id/kemenkes-luncurkan-satusehat-rme-rekam-medis-pasien-terintegrasi-secara-nasional", "date": "2026-09-01", "publisherClass": "official" }, { "title": "Undang-Undang 27 Tahun 2022 tentang Pelindungan Data Pribadi (BPK JDIH)", "url": "https://peraturan.bpk.go.id/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf", "date": "2022-10-17", "publisherClass": "legal_text" }, { "title": "Peraturan Pemerintah 28 Tahun 2024, pelaksanaan UU Kesehatan (JDIH Kemenkes)", "url": "https://jdih.kemkes.go.id/storage/documents/pdfs/2024pp028.pdf", "date": "2024-07-26", "publisherClass": "legal_text" } ] }, "privacy": { "score": 38, "summary": "Health data is specific personal data with 3 x 24 hour breach notice and fines up to 2% of revenue. But the data protection agency still does not exist nearly four years after the law, and the implementing regulation starts only in January 2027.", "sources": [ { "title": "Undang-Undang 27 Tahun 2022 tentang Pelindungan Data Pribadi (BPK JDIH)", "url": "https://peraturan.bpk.go.id/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf", "date": "2022-10-17", "publisherClass": "legal_text" }, { "title": "Dua Tahun UU PDP Tanpa Lembaga Pengawas, Pemerintah Bantah Ada Kekosongan Hukum (Hukumonline)", "url": "https://www.hukumonline.com/berita/a/dua-tahun-uu-pdp-tanpa-lembaga-pengawas--pemerintah-bantah-ada-kekosongan-hukum-lt6a69d92f6fce4/", "date": "2026-07-29", "publisherClass": "news" }, { "title": "Ministry to issue decision on BPJS data leak soon (ANTARA)", "url": "https://en.antaranews.com/news/195925/ministry-to-issue-decision-on-bpjs-data-leak-soon", "date": "2021", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 57, "summary": "By 31 July 2026, 42,337 health facilities were integrated with SATUSEHAT, the national interoperability platform. Many hospitals still send incomplete data, and the person-based record and the claims link are only starting.", "sources": [ { "title": "Kemenkes RI Raih Penghargaan Nasional dan Global Sekaligus untuk SATUSEHAT", "url": "https://kemkes.go.id/id/kemenkes-ri-raih-penghargaan-nasional-dan-global-sekaligus-untuk-satusehat", "date": "2026-09-24", "publisherClass": "official" }, { "title": "Wajib Integrasi Satu Sehat, Kemenkes Desak Percepatan RME di Fasyankes (BKPK Kemenkes)", "url": "https://www.badankebijakan.kemkes.go.id/wajib-integrasi-satu-sehat-kemenkes-desak-percepatan-rme-di-fasyankes/", "date": "2025-10-28", "publisherClass": "official" }, { "title": "Dukcapil Perkuat Validasi Identitas, Dukung Integrasi Rekam Medis Elektronik dengan SATUSEHAT", "url": "https://dukcapil.kemendagri.go.id/blog/read/dukcapil-perkuat-validasi-identitas-dukung-integrasi-rekam-medis-elektronik-dengan-satusehat", "date": "2026-08-01", "publisherClass": "official" }, { "title": "Peraturan Pemerintah 28 Tahun 2024, pelaksanaan UU Kesehatan (JDIH Kemenkes)", "url": "https://jdih.kemkes.go.id/storage/documents/pdfs/2024pp028.pdf", "date": "2024-07-26", "publisherClass": "legal_text" } ] }, "commercial": { "score": 42, "summary": "Health data needs explicit consent or another legal basis, and the Health Law limits national health system data to care, public health, development and policy. No specific ban on selling health data was found, and no regulator enforces the PDP Law yet.", "sources": [ { "title": "Undang-Undang 17 Tahun 2023 tentang Kesehatan, annotated text (Mahkamah Konstitusi, Anotasi 2025)", "url": "https://s.mkri.id/public/content/infoumum/undang/pdf/Anotasi_180_ANOTASI%20UU%2017%20TAHUN%202023.pdf", "date": "2025", "publisherClass": "legal_text" }, { "title": "Undang-Undang 27 Tahun 2022 tentang Pelindungan Data Pribadi (BPK JDIH)", "url": "https://peraturan.bpk.go.id/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf", "date": "2022-10-17", "publisherClass": "legal_text" }, { "title": "Dua Tahun UU PDP Tanpa Lembaga Pengawas, Pemerintah Bantah Ada Kekosongan Hukum (Hukumonline)", "url": "https://www.hukumonline.com/berita/a/dua-tahun-uu-pdp-tanpa-lembaga-pengawas--pemerintah-bantah-ada-kekosongan-hukum-lt6a69d92f6fce4/", "date": "2026-07-29", "publisherClass": "news" } ] }, "clinical": { "score": 40, "summary": "Under SATUSEHAT RME, launched 1 September 2026, a clinician can open a patient's cross-facility record with the patient's code, but rollout is staged and only two hospitals were named. Elsewhere data moves between facilities through referral transfers on the national platform.", "sources": [ { "title": "Kemenkes Luncurkan SATUSEHAT RME, Rekam Medis Pasien Terintegrasi Secara Nasional", "url": "https://www.kemkes.go.id/id/kemenkes-luncurkan-satusehat-rme-rekam-medis-pasien-terintegrasi-secara-nasional", "date": "2026-09-01", "publisherClass": "official" }, { "title": "Kemenkes Pastikan SatuSehat RME Bisa Diakses dalam Kondisi Darurat (Beritasatu)", "url": "https://www.beritasatu.com/lifestyle/3023896/kemenkes-pastikan-satusehat-rme-bisa-diakses-dalam-kondisi-darurat", "date": "2026-09-02", "publisherClass": "news" }, { "title": "Peraturan Menteri Kesehatan 24 Tahun 2022 tentang Rekam Medis", "url": "https://keslan.kemkes.go.id/unduhan/fileunduhan_1662611251_882318.pdf", "date": "2022", "publisherClass": "legal_text" } ] }, "research": { "score": 49, "summary": "Records can be opened for research without consent if identity is withheld and the Minister approves, and there is no general opt-out. Ethics committee approval is required, and biomedical specimens and linked data need donor consent.", "sources": [ { "title": "Peraturan Menteri Kesehatan 24 Tahun 2022 tentang Rekam Medis", "url": "https://keslan.kemkes.go.id/unduhan/fileunduhan_1662611251_882318.pdf", "date": "2022", "publisherClass": "legal_text" }, { "title": "Undang-Undang 17 Tahun 2023 tentang Kesehatan, annotated text (Mahkamah Konstitusi, Anotasi 2025)", "url": "https://s.mkri.id/public/content/infoumum/undang/pdf/Anotasi_180_ANOTASI%20UU%2017%20TAHUN%202023.pdf", "date": "2025", "publisherClass": "legal_text" }, { "title": "Komite Etik Penelitian dan Pengembangan Kesehatan Nasional (KEPPKN, Kemenkes)", "url": "https://kepkn.kemkes.go.id/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 56, "summary": "A health ministry decree in force since 7 September 2026 covers AI medical devices, requiring change control for self-learning models, rollback, hallucination controls for generative models and local validation. It is new, and human oversight is a documentation item, not a mandate.", "sources": [ { "title": "Keputusan Menteri Kesehatan HK.01.07/MENKES/951/2026, Pedoman Izin Edar Alat Kesehatan Berbasis Perangkat Lunak", "url": "https://jdih.kemkes.go.id/storage/documents/pdfs/2026kepmenkes951.pdf", "date": "2026-09-07", "publisherClass": "legal_text" }, { "title": "Kemenkes Dorong Pengembangan Ekosistem AI Kesehatan yang Aman, Adil, dan Bertanggung Jawab", "url": "https://keslan.kemkes.go.id/read/3798/kemenkes-dorong-pengembangan-ekosistem-ai-kesehatan-yang-aman-adil-dan-bertanggung-jawab", "date": "2026-06", "publisherClass": "official" }, { "title": "AFTECH Akui Masih Tunggu Dua Perpres AI untuk Perkuat Tata Kelola Digital (Investortrust)", "url": "https://investortrust.id/national/109712/aftech-akui-masih-tunggu-dua-perpres-ai-untuk-perkuat-tata-kelola-digital", "date": "2026-07-16", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 17/2023 on Health", "level": "National", "year": "2023", "what": "Patient access to record information; consent for health data processing; data portability; local processing of health data.", "url": "https://s.mkri.id/public/content/infoumum/undang/pdf/Anotasi_180_ANOTASI%20UU%2017%20TAHUN%202023.pdf" }, { "name": "Law 27/2022 on Personal Data Protection", "level": "National", "year": "2022", "what": "Health is specific data; access within 3 x 24 hours; breach notice; fines up to 2% of revenue.", "url": "https://peraturan.bpk.go.id/Download/224884/UU%20Nomor%2027%20Tahun%202022.pdf" }, { "name": "Government Regulation 28/2024 (Health Law implementing rules)", "level": "National", "year": "2024", "what": "Electronic records mandatory and integrated nationally; rules for opening records with and without consent.", "url": "https://jdih.kemkes.go.id/storage/documents/pdfs/2024pp028.pdf" }, { "name": "Government Regulation 33/2026 (PDP Law implementing rules)", "level": "National", "year": "2026", "what": "Detailed consent, correction and research exemption rules; enacted 16 July 2026, in force January 2027.", "url": "https://static.banyumaskab.go.id/website/file/peraturan_pemerintah_no._33_tahun_2026_100926115902.pdf" }, { "name": "Minister of Health Regulation 24/2022 on Medical Records", "level": "National", "year": "2022", "what": "Record content belongs to patient; facilities must open records to ministry; referral transfers via national platform.", "url": "https://keslan.kemkes.go.id/unduhan/fileunduhan_1662611251_882318.pdf" }, { "name": "Minister of Health Decree HK.01.07/MENKES/951/2026", "level": "National", "year": "2026", "what": "Marketing authorization for software and AI medical devices, including change control and local validation.", "url": "https://jdih.kemkes.go.id/storage/documents/pdfs/2026kepmenkes951.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-09-24", "headline": "Patient's lawyer says a public hospital gave only partial copies of her records", "paraphrase": "A woman asked a regional public hospital in Banten for copies of her medical records through her lawyer. The lawyer says only incomplete copies came, a legal notice went unanswered, and a Health Ministry complaint would follow.", "source": "MediaBanten.com", "url": "https://mediabanten.com/salinan-rekam-medis-tak-diberikan-rs-drajat-akan-dilaporkan-ke-kemenkes/", "theme": "access_refused", "status": "alleged" }, { "date": "2026-09-26", "headline": "Patient says referral records sent to a hospital abroad were incomplete", "paraphrase": "A patient in East Kalimantan alleges that the procedure video a public hospital sent with his referral abroad had cuts at crucial moments, and that the referral letter described his condition as good when it was not.", "source": "Swarakaltim.com", "url": "https://swarakaltim.com/2026/09/26/diduga-alami-malapraktik-kawat-tertinggal-di-jantung-pasien-rsud-aws-layangkan-somasi-dan-tuntut-kompensasi-rp5-miliar/", "theme": "lost_between_providers", "status": "alleged" } ] }, { "iso3": "IRL", "name": "Ireland", "region": "Europe", "overall": 47, "rank": "60=", "likelyRank": "48 to 87", "band": "Mixed", "keysModel": "State", "confidence": "high", "headline": "Irish records are still largely paper, but a national Shared Care Record went live for clinicians in 2026; patient controls are legislated, not in force.", "categories": { "access": { "score": 55, "summary": "Patients have a free GDPR and FOI right to their whole record, but get it by writing to each hospital or service. The HSE Health App shows only part of the record (appointments, waiting lists, vaccines) and had about 125,000 registered users in January 2026.", "sources": [ { "title": "Access to medical records in the public healthcare system (Citizens Information)", "url": "https://www.citizensinformation.ie/en/health/legal-matters-and-health/access-to-medical-records/", "date": "undated", "publisherClass": "official" }, { "title": "Minister for Health welcomes increase in HSE Health app usage as registrations pass 125,000 (Department of Health)", "url": "https://www.gov.ie/en/department-of-health/press-releases/minister-for-health-welcomes-increase-in-hse-health-app-usage-as-registrations-pass-125000/", "date": "2026-01-05", "publisherClass": "official" }, { "title": "Ireland confirmed as one of the EU's strongest digital performers (Department of Enterprise, Tourism and Employment)", "url": "https://enterprise.gov.ie/en/news-and-events/department-news/2026/august/ireland-confirmed-as-one-of-the-eus-strongest-digital-performers.html", "date": "2026-08-06", "publisherClass": "official" }, { "title": "2026 Digital Decade eHealth Indicator Study, executive summary (European Commission)", "url": "https://data.europa.eu/doi/10.2759/8560168", "date": "2026-06", "publisherClass": "intergov" } ] }, "control": { "score": 30, "summary": "The new Shared Care Record shares data by default on a public interest basis, with no opt-out found and no patient-readable access log. Rights to restrict access and to be told who looked are in the Health Information Act 2026 but not commenced.", "sources": [ { "title": "Data Protection Impact Assessment summary: Shared Care Record (HSE)", "url": "https://about.hse.ie/publications/national-shared-care-record-dpia/", "date": "2026-03", "publisherClass": "official" }, { "title": "HSE Privacy Notice for patients and service users (HSE)", "url": "https://about.hse.ie/publications/hse-privacy-notice-service-users/", "date": "2024-12", "publisherClass": "official" }, { "title": "Health Information Act 2026, No. 10 of 2026 (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/2026/act/10/enacted/en/index.html", "date": "2026-04-30", "publisherClass": "legal_text" }, { "title": "Health Information Act 2026: commencement table (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/isbc/2026_10.html", "date": "undated", "publisherClass": "legal_text" } ] }, "privacy": { "score": 56, "summary": "The Data Protection Commission fined the HSE twice in 2026 (300,000 and 645,000 euros) for health record failures and reprimanded Children's Health Ireland. Fines on public bodies are capped at 1 million euros, and one case took over seven years.", "sources": [ { "title": "DPC announces final decision following inquiry into the HSE (paper records storage)", "url": "https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-following-inquiry-health-service-executive-hse", "date": "2026-09-02", "publisherClass": "official" }, { "title": "Inquiry into Midlands Regional Hospital Tullamore (Data Protection Commission decision)", "url": "https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-midlands-regional-hospital-tullamore", "date": "2026-06-10", "publisherClass": "official" }, { "title": "DPC publishes final decision following inquiry into Children's Health Ireland", "url": "https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-publishes-final-decision-following-inquiry-childrens-health-ireland-chi", "date": "2026-10-01", "publisherClass": "official" }, { "title": "Data Protection Act 2018, section 141 (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/2018/act/7/section/141/enacted/en/html", "date": "2018", "publisherClass": "legal_text" } ] }, "journey": { "score": 38, "summary": "A national Shared Care Record released nationally in early 2026 now pulls medicines, GP labs and radiology, discharge summaries and vaccines into one read-only view. But the Department of Health says records remain 'fragmented and largely paper-based', and a national EHR is only in procurement.", "sources": [ { "title": "HSE Shared Care Record (HSE)", "url": "https://about.hse.ie/our-work/technology/shared-care-record/", "date": "undated", "publisherClass": "official" }, { "title": "Shared Care Record continues to grow with expanded datasets and nationwide rollout (HSE)", "url": "https://about.hse.ie/news/national-shared-care-record-nscr-continues-to-grow-with-expanded-datasets-and-nationwide-rollout/", "date": "2026-06-19", "publisherClass": "official" }, { "title": "Minister announces Government approval to commence procurement for a National Electronic Health Record (Department of Health)", "url": "https://www.gov.ie/en/department-of-health/press-releases/minister-announces-government-approval-to-commence-procurement-for-a-national-electronic-health-record/", "date": "2026-02-05", "publisherClass": "official" }, { "title": "HSE Laboratory Information System (MedLIS) (HSE)", "url": "https://about.hse.ie/our-work/technology/national-laboratory-information-system-medlis/", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 58, "summary": "Research use of personal health data, including commercial research, needs explicit consent unless a national committee grants a declaration. We found no Irish ban on selling health data or on its use for advertising.", "sources": [ { "title": "Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, S.I. No. 314 of 2018 (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/2018/si/314/made/en/print", "date": "2018", "publisherClass": "legal_text" }, { "title": "Who we are (Health Research Consent Declaration Committee)", "url": "https://hrcdc.ie/who-we-are/", "date": "undated", "publisherClass": "official" }, { "title": "Health Information Act 2026, No. 10 of 2026 (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/2026/act/10/enacted/en/index.html", "date": "2026-04-30", "publisherClass": "legal_text" }, { "title": "Health Information Act 2026: commencement table (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/isbc/2026_10.html", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 36, "summary": "Over 2,500 HSE staff use the Shared Care Record to see a patient's medicines, results and discharge summaries from other services. It is read-only, not a complete record, and open only to HSE staff on the HSE network.", "sources": [ { "title": "HSE Shared Care Record (HSE)", "url": "https://about.hse.ie/our-work/technology/shared-care-record/", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Impact Assessment summary: Shared Care Record (HSE)", "url": "https://about.hse.ie/publications/national-shared-care-record-dpia/", "date": "2026-03", "publisherClass": "official" }, { "title": "Almost 100k patient record requests amid lack of online system (RTÉ)", "url": "https://www.rte.ie/news/2026/0513/1573052-hse-medical-records/", "date": "2026-05-13", "publisherClass": "news" }, { "title": "Health Information Act 2026: commencement table (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/isbc/2026_10.html", "date": "undated", "publisherClass": "legal_text" } ] }, "research": { "score": 70, "summary": "Explicit consent is the default for using personal data in health research, and a national committee can waive it only where the public interest significantly outweighs consent. The committee publishes an application log and meeting minutes.", "sources": [ { "title": "Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, S.I. No. 314 of 2018 (Irish Statute Book)", "url": "https://www.irishstatutebook.ie/eli/2018/si/314/made/en/print", "date": "2018", "publisherClass": "legal_text" }, { "title": "Who we are (Health Research Consent Declaration Committee)", "url": "https://hrcdc.ie/who-we-are/", "date": "undated", "publisherClass": "official" }, { "title": "Decisions: public application log and meeting minutes (HRCDC)", "url": "https://hrcdc.ie/decisions/", "date": "undated", "publisherClass": "official" }, { "title": "HealthData@IE: national project implementing EHDS (Department of Health)", "url": "https://www.gov.ie/en/department-of-health/collections/healthdataie-national-project-implementing-ehds/", "date": "2026-09-09", "publisherClass": "official" } ] }, "ai": { "score": 50, "summary": "Clinical AI falls under EU device law and the EU AI Act. Ireland's Regulation of Artificial Intelligence Act 2026 sets up an AI Office but, by the government's own account, adds no obligations, and HIQA's July 2026 AI guidance is good-practice guidance.", "sources": [ { "title": "AI Office of Ireland established under the Regulation of Artificial Intelligence Act 2026 (DETE)", "url": "https://www.gov.ie/en/department-of-enterprise-tourism-and-employment/press-releases/ai-office-of-ireland-established-under-the-ai-regulation-bill-2026-paul-byrne-appointed-as-ceo/", "date": "2026-07-30", "publisherClass": "official" }, { "title": "HIQA publishes first National Guidance on Responsible and Safe Use of AI in Health and Social Care (HIQA)", "url": "https://www.hiqa.ie/hiqa-news-updates/hiqa-publishes-first-national-guidance-responsible-and-safe-use-ai-health-and", "date": "2026-07-29", "publisherClass": "official" } ] } }, "laws": [ { "name": "Health Information Act 2026 (No. 10 of 2026)", "level": "National", "year": "2026", "what": "National EHR for every patient, duty to share, restriction and access-notice rights; key sections not commenced.", "url": "https://www.irishstatutebook.ie/eli/2026/act/10/enacted/en/index.html" }, { "name": "Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. 314/2018)", "level": "National", "year": "2018", "what": "Explicit consent is a required safeguard for health research, unless the HRCDC grants a declaration.", "url": "https://www.irishstatutebook.ie/eli/2018/si/314/made/en/print" }, { "name": "Data Protection Act 2018", "level": "National", "year": "2018", "what": "Irish GDPR law; fines on public bodies capped at 1 million euros (s. 141).", "url": "https://www.irishstatutebook.ie/eli/2018/act/7/section/141/enacted/en/html" }, { "name": "Freedom of Information Act 2014", "level": "National", "year": "2014", "what": "Right of access to personal records held by the HSE, voluntary hospitals and GP records of medical card holders.", "url": "https://www.citizensinformation.ie/en/health/legal-matters-and-health/access-to-medical-records/" }, { "name": "General Data Protection Regulation (EU) 2016/679", "level": "Supranational", "year": "2016", "what": "Health data is a special category; access within one month, first copy free.", "url": "https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_en" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Patient access, restriction and access logs, cross-border exchange and secondary-use permits, phased 2029 to 2031.", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en" }, { "name": "Regulation of Artificial Intelligence Act 2026", "level": "National", "year": "2026", "what": "Creates the AI Office of Ireland to coordinate EU AI Act enforcement; adds no new obligations.", "url": "https://www.gov.ie/en/department-of-enterprise-tourism-and-employment/press-releases/ai-office-of-ireland-established-under-the-ai-regulation-bill-2026-paul-byrne-appointed-as-ceo/" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-06-30", "headline": "Patient's request to correct GP record went unanswered until the regulator asked", "paraphrase": "A patient asked a former GP surgery to correct entries they believed were wrong and heard nothing. After the regulator stepped in, the surgery apologised, kept the entries as clinical opinion, and offered to add the patient's disagreement.", "source": "Data Protection Commission (Annual Report 2025 case studies)", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-06/DPC-Case-Studies-Booklet-2025-Final.pdf", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2026-06-30", "headline": "GP surgery emailed a patient's details unencrypted to the wrong person", "paraphrase": "A small GP surgery recorded a mistyped email address without checking it, then sent the patient's personal data, unencrypted, from a free email account to a stranger. After the regulator engaged, it moved to secure email and a patient portal.", "source": "Data Protection Commission (Annual Report 2025 case studies)", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2026-06/DPC-Case-Studies-Booklet-2025-Final.pdf", "theme": "breach", "status": "finding" }, { "date": "2025-06", "headline": "Hospital released a patient's records only after the regulator stepped in", "paraphrase": "A patient asked a public hospital for all the personal data it held. More than a month later there was still no answer, though the matter was urgent. The records were provided only after the regulator contacted the hospital group.", "source": "Data Protection Commission (Annual Report 2024 case studies)", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-06", "headline": "Medical facility sent a worker's full consultation notes to their employer", "paraphrase": "A worker was sent by their employer to a medical facility. The facility gave the employer, including the HR department, full consultation notes with past medical history, assuming consent. The regulator found the disclosure unlawful.", "source": "Data Protection Commission (Annual Report 2024 case studies)", "url": "https://www.dataprotection.ie/sites/default/files/uploads/2025-08/DPC_Cases_Studies_EN_Low_Res.pdf", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "KGZ", "name": "Kyrgyzstan", "region": "Asia", "overall": 47, "rank": "60=", "likelyRank": "47 to 84", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Kyrgyz patients see visits, hospital stays and lab results in the Tunduk app, but clinics must send data to the state with no opt-out found.", "categories": { "access": { "score": 60, "summary": "Since February 2026 the Digital Code gives access to all a person's digital data within 7 working days, a copy only if the holder chooses. The Tunduk app shows visits, hospital stays and lab results, but private care is missing and usage was not verified.", "sources": [ { "title": "Digital Code of the Kyrgyz Republic No. 178, Article 73 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" }, { "title": "Law No. 14 on Health Protection of Citizens, Article 68 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/4-5260/edition/23422/ru", "date": "2024-01-12", "publisherClass": "legal_text" }, { "title": "Digital health profile: how to see all your medical information (24.kg)", "url": "https://24.kg/obschestvo/291005_tsifrovoy_profil_zdorovya_kak_uznat_vsyu_meditsinskuyu_informatsiyu_osebe/", "date": "2025-10-20", "publisherClass": "news" } ] }, "control": { "score": 35, "summary": "The Health Law ties consent for electronic records to consent to treatment, and clinics must send data to the state system. We found no opt-out and no access log patients can see, though only the family doctor can open the digital card.", "sources": [ { "title": "Law No. 14 on Health Protection of Citizens, Article 45 Digital health (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/4-5260/edition/23422/ru", "date": "2024-01-12", "publisherClass": "legal_text" }, { "title": "Digital Code of the Kyrgyz Republic No. 178, Article 73 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" }, { "title": "Digital health profile: how to see all your medical information (24.kg)", "url": "https://24.kg/obschestvo/291005_tsifrovoy_profil_zdorovya_kak_uznat_vsyu_meditsinskuyu_informatsiyu_osebe/", "date": "2025-10-20", "publisherClass": "news" } ] }, "privacy": { "score": 42, "summary": "Health data is a special category under the 2025 Digital Code, and incidents must be reported to the regulator within 72 hours. Fines approved by parliament in September 2026 top out at 140,000 som, and investigators, prosecutors and courts can obtain medical secrets without consent.", "sources": [ { "title": "Digital Code of the Kyrgyz Republic No. 178, Articles 63, 80 and 90 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" }, { "title": "Kyrgyzstan adopts WHO standards to strengthen data protection in health care (State Agency for Personal Data Protection)", "url": "https://dpa.gov.kg/Home/GetNewsContent?id=5a89780e1d3447e79fefffe8da25008b", "date": "2026-07-06", "publisherClass": "official" }, { "title": "Parliament approves fines of up to 140,000 som for personal data leaks (Kaktus.media)", "url": "https://kaktus.media/doc/553364_parlament_odobril_vvedenie_shtrafov_do_140_tys._somov_za_ytechky_personalnyh_dannyh.html", "date": "2026-09-16", "publisherClass": "news" }, { "title": "State agency: there is no full guarantee against personal data leaks (24.kg)", "url": "https://24.kg/vlast/366112_gosagentstvo_polnoy_garantii_otnbsputechek_personalnyih_dannyih_nenbspsuschestvuet/", "date": "2026-03-16", "publisherClass": "news" } ] }, "journey": { "score": 55, "summary": "A Cabinet-approved unified medical information system links digital outpatient and hospital cards, labs, immunisation and disease surveillance. The Sanarip Clinic system covers every public primary care facility and over half of hospitals, but private providers sit outside and systems still exchange data poorly.", "sources": [ { "title": "Regulation on the unified medical information system, Cabinet Decree No. 640 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/7-34550/edition/20096/ru", "date": "2024-10-24", "publisherClass": "legal_text" }, { "title": "Medicine in digital: results of healthcare digitalisation in Kyrgyzstan for 2025 (Open.kg)", "url": "https://open.kg/en/news/health/86381-medicina-v-cifre-itogi-cifrovizacii-zdravoohranenija-v-kyrgyzstane-za-2025-god.html", "date": "2026-03-30", "publisherClass": "news" }, { "title": "Over 400,000 electronic prescriptions for subsidised medicines in three months of 2024 (Mandatory Health Insurance Fund)", "url": "https://foms.kg/ru/blog/270-Bolieie-400-tysiach-eliektronnykh-rietsieptov-na-lghotnyie-liekarstva-vypisano-ghrazhdanam-za-tri-miesiatsa-2024-ghoda.html", "date": "2024-04-18", "publisherClass": "official" }, { "title": "Health care needs its own Tunduk: why medical digital systems still do not understand each other (AKIpress opinion)", "url": "https://mnenie.akipress.org/unews/un_post:46903/", "date": "2026-05-02", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "The Digital Code bans processing health data outside listed cases and says bundled or unclear consent is void. Health app providers may pass data on only with a legal basis, and only de-identified when relying on legitimate interest, but no ban on selling health data was found.", "sources": [ { "title": "Digital Code of the Kyrgyz Republic No. 178, Articles 79, 80 and 124 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" } ] }, "clinical": { "score": 40, "summary": "The digital patient card is visible only to the patient's family doctor, according to the Health Ministry, and system access is set by each user's role. Specialists and private doctors cannot see a full history across providers.", "sources": [ { "title": "Regulation on the unified medical information system, Cabinet Decree No. 640 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/7-34550/edition/20096/ru", "date": "2024-10-24", "publisherClass": "legal_text" }, { "title": "Law No. 14 on Health Protection of Citizens, Article 169 Medical secrecy (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/4-5260/edition/23422/ru", "date": "2024-01-12", "publisherClass": "legal_text" }, { "title": "Digital health profile: how to see all your medical information (24.kg)", "url": "https://24.kg/obschestvo/291005_tsifrovoy_profil_zdorovya_kak_uznat_vsyu_meditsinskuyu_informatsiyu_osebe/", "date": "2025-10-20", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "The Health Law requires written consent to take part in research or to use a person's medical information for science, plus a positive ethics review. Data for analysis and research is otherwise used in de-identified form, without consent or an opt-out.", "sources": [ { "title": "Law No. 14 on Health Protection of Citizens, Articles 44 and 45 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/4-5260/edition/23422/ru", "date": "2024-01-12", "publisherClass": "legal_text" }, { "title": "Digital Code of the Kyrgyz Republic No. 178, Article 80 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" } ] }, "ai": { "score": 55, "summary": "The Digital Code makes owners assess every AI system's risk at design and after any change, and users of high-risk AI must keep effective human control. Whether the Cabinet has issued the detailed high-risk requirements was not verified.", "sources": [ { "title": "Digital Code of the Kyrgyz Republic No. 178, Articles 126 and 193 to 196 (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru", "date": "2025-07-31", "publisherClass": "legal_text" }, { "title": "Law No. 216 on Circulation of Medical Devices (Ministry of Justice database)", "url": "https://cbd.minjust.gov.kg/4-5241/edition/40637/ru", "date": "2023-12-29", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law No. 14 on Health Protection of Citizens", "level": "National", "year": "2024", "what": "Patient right to health information, consent for e-records, research consent, medical secrecy and its exceptions.", "url": "https://cbd.minjust.gov.kg/4-5260/edition/23422/ru" }, { "name": "Digital Code of the Kyrgyz Republic (No. 178)", "level": "National", "year": "2025", "what": "Personal data rules, health as special category, 72-hour incident notice, high-risk AI duties.", "url": "https://cbd.minjust.gov.kg/3-48/edition/35412/ru" }, { "name": "Law No. 179 on Bringing the Digital Code into Force", "level": "National", "year": "2025", "what": "Starts the Digital Code six months after publication and repeals the 2008 personal information law.", "url": "https://cbd.minjust.gov.kg/4-5604/edition/35394/ru" }, { "name": "Cabinet Decree No. 640 on the Unified Medical Information System", "level": "National", "year": "2024", "what": "Sets up the national health system of patient cards, labs, immunisation and epidemiology, with role-based access.", "url": "https://cbd.minjust.gov.kg/7-34550/edition/20096/ru" }, { "name": "Law No. 216 on Circulation of Medical Devices", "level": "National", "year": "2023", "what": "Registration and risk classes for medical devices, including special software; manufacturers report changes.", "url": "https://cbd.minjust.gov.kg/4-5241/edition/40637/ru" }, { "name": "Cabinet Decree No. 609 on the Unified State Digital Platform for Medicines and Medical Devices", "level": "National", "year": "2026", "what": "Creates a national digital platform for centralised supply of medicines, run by Kyrgyzpharmacia.", "url": "https://base.spinform.ru/show_doc.fwx?rgn=177980" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-06-17", "headline": "Data regulator finds private labs and clinics failing to protect patient data", "paraphrase": "The state data protection agency inspected 17 private labs and diagnostic centres. It found no access limits, unclear retention, unrecorded patient consent to sharing, and weak IT security, and ordered fixes.", "source": "Economist.kg", "url": "https://economist.kg/novosti/2025/06/17/miedtsientry-i-laboratorii-kr-ulichili-v-narushienii-zakona-o-piersonalnykh-dannykh/", "theme": "other", "status": "finding" }, { "date": "2026-08-20", "headline": "Bishkek patients told to take paper records home or risk losing them", "paraphrase": "Readers said clinics urged them to collect paper outpatient records quickly or they might not be found in the archive. The health ministry confirmed it, saying uncollected cards stay archived and can be signed out.", "source": "24.kg", "url": "https://24.kg/obschestvo/385945_esche_prigodyatsya_vpoliklinikah_bishkeka_patsientov_prosyat_zabrat_medkartyi/", "theme": "other", "status": "admitted" } ] }, { "iso3": "VNM", "name": "Vietnam", "region": "Asia", "overall": 47, "rank": "60=", "likelyRank": "46 to 83", "band": "Mixed", "keysModel": "State", "confidence": "high", "headline": "Vietnamese patients can download visit records in their ID app, but every facility must feed a national database with no opt-out.", "categories": { "access": { "score": 60, "summary": "Law 15/2023 lets patients read and copy their record on written request, and Decree 356 sets a 10-day deadline. VNeID shows visit summaries, labs and drugs as downloadable PDFs, but only 34 million people had one in September 2026, short of most residents.", "sources": [ { "title": "Luật Khám bệnh, chữa bệnh số 15/2023/QH15, toàn văn (Xây dựng chính sách, Cổng TTĐT Chính phủ)", "url": "https://xaydungchinhsach.chinhphu.vn/toan-van-luat-15-2023-qh15-kham-benh-chua-benh-119231127164453959.htm", "date": "2023-11-27", "publisherClass": "legal_text" }, { "title": "Nghị định 356/2025/NĐ-CP quy định chi tiết Luật Bảo vệ dữ liệu cá nhân (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/nghi-dinh-356-2025-nd-cp-quy-dinh-chi-tiet-luat-bao-ve-du-lieu-ca-nhan-422896-d1.html", "date": "2025-12-31", "publisherClass": "legal_text" }, { "title": "Sổ sức khỏe điện tử trên VNeID có thể thay sổ giấy (Báo Điện tử Chính phủ)", "url": "https://baochinhphu.vn/so-suc-khoe-dien-tu-tren-vneid-co-the-thay-so-giay-102260108162952758.htm", "date": "2026-01-08", "publisherClass": "official" }, { "title": "Hơn 34 triệu người đã có Sổ sức khỏe điện tử trên VNeID (VOV)", "url": "https://vov.gov.vn/hon-34-trieu-nguoi-da-co-so-suc-khoe-dien-tu-tren-vneid-mobiledtnew-1165910", "date": "2026-09-21", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Decree 102/2025 makes every facility push records to the national health database and VNeID, with no article letting a patient opt out. Agency heads may release health data without consent for public interest, and no patient-visible access log was found.", "sources": [ { "title": "Decree 102/2025/ND-CP on health data management, English text (LuatVietnam)", "url": "https://english.luatvietnam.vn/y-te/decree-102-2025-nd-cp-health-data-management-400071-d1.html", "date": "2025-05-13", "publisherClass": "legal_text" }, { "title": "Luật Bảo vệ dữ liệu cá nhân 2025, số 91/2025/QH15 (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/luat-bao-ve-du-lieu-ca-nhan-2025-so-91-2025-qh15-405135-d1.html", "date": "2025-06-26", "publisherClass": "legal_text" }, { "title": "Nghị định 356/2025/NĐ-CP quy định chi tiết Luật Bảo vệ dữ liệu cá nhân (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/nghi-dinh-356-2025-nd-cp-quy-dinh-chi-tiet-luat-bao-ve-du-lieu-ca-nhan-422896-d1.html", "date": "2025-12-31", "publisherClass": "legal_text" } ] }, "privacy": { "score": 42, "summary": "Health is sensitive data under the 2025 PDP Law, with 72-hour breach notice, fines up to VND 3 billion (5% of revenue for cross-border breaches) and an August 2026 sanctions decree. But the regulator is the police ministry, state uses are exempt from consent, and hospital hacks continue.", "sources": [ { "title": "Luật Bảo vệ dữ liệu cá nhân 2025, số 91/2025/QH15 (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/luat-bao-ve-du-lieu-ca-nhan-2025-so-91-2025-qh15-405135-d1.html", "date": "2025-06-26", "publisherClass": "legal_text" }, { "title": "Nghị định 356/2025/NĐ-CP quy định chi tiết Luật Bảo vệ dữ liệu cá nhân (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/nghi-dinh-356-2025-nd-cp-quy-dinh-chi-tiet-luat-bao-ve-du-lieu-ca-nhan-422896-d1.html", "date": "2025-12-31", "publisherClass": "legal_text" }, { "title": "Mức xử phạt vi phạm hành chính đối với hành vi vi phạm về bảo vệ dữ liệu cá nhân (Báo Điện tử Chính phủ)", "url": "https://baochinhphu.vn/muc-xu-phat-vi-pham-hanh-chinh-doi-voi-hanh-vi-vi-pham-ve-bao-ve-du-lieu-ca-nhan-102260822154959691.htm", "date": "2026-08-22", "publisherClass": "official" }, { "title": "Cảnh báo rò rỉ dữ liệu y tế do hacker (Thanh Niên)", "url": "https://thanhnien.vn/canh-bao-ro-ri-du-lieu-y-te-do-hacker-185260524204547959.htm", "date": "2026-05-25", "publisherClass": "news" } ] }, "journey": { "score": 55, "summary": "By 19 September 2026, 1,268 of 1,650 hospitals had electronic records and 99.5% of facilities linked to the social insurance claims system. The ministry admits many hospitals still run paper in parallel, and lab and pharmacy links are still being built.", "sources": [ { "title": "Số cơ sở y tế tham gia bệnh án điện tử tiếp tục tăng (Sức khỏe & Đời sống, Bộ Y tế)", "url": "https://suckhoedoisong.vn/so-co-so-y-te-tham-gia-benh-an-dien-tu-tiep-tuc-tang-169260919154315649.htm", "date": "2026-09-19", "publisherClass": "official" }, { "title": "Cổng thông tin Bệnh án điện tử, danh sách cơ sở tham gia (Bộ Y tế)", "url": "https://benhandientu.moh.gov.vn/", "date": "undated", "publisherClass": "official" }, { "title": "Hơn 75% bệnh viện triển khai bệnh án điện tử, tiến tới bỏ bệnh án giấy từ năm 2027 (Báo Đầu tư)", "url": "https://baodautu.vn/hon-75-benh-vien-trien-khai-benh-an-dien-tu-tien-toi-bo-benh-an-giay-tu-nam-2027-d701953.html", "date": "2026-09-14", "publisherClass": "news" }, { "title": "Cơ sở bán buôn, bán lẻ thuốc phải liên thông dữ liệu từ 01/01/2026 lên Hệ thống Cơ sở dữ liệu về dược (LuatVietnam)", "url": "https://luatvietnam.vn/tin-van-ban-moi/co-so-ban-buon-ban-le-thuoc-phai-lien-thong-du-lieu-tu-01-01-2026-len-he-thong-co-so-du-lieu-ve-duoc-186-111475-article.html", "date": "2026-08-14", "publisherClass": "law_firm" } ] }, "commercial": { "score": 55, "summary": "The PDP Law bans buying and selling personal data, with fines up to 10 times the revenue gained, and bars health bodies from giving data to insurers without the person's written request. De-identified data falls outside the law.", "sources": [ { "title": "Luật Bảo vệ dữ liệu cá nhân 2025, số 91/2025/QH15 (LuatVietnam)", "url": "https://luatvietnam.vn/dan-su/luat-bao-ve-du-lieu-ca-nhan-2025-so-91-2025-qh15-405135-d1.html", "date": "2025-06-26", "publisherClass": "legal_text" }, { "title": "Những quy định đáng chú ý trong Luật Bảo vệ dữ liệu cá nhân 2025 (Xây dựng chính sách, Cổng TTĐT Chính phủ)", "url": "https://xaydungchinhsach.chinhphu.vn/nhung-quy-dinh-dang-chu-y-trong-luat-bao-ve-du-lieu-ca-nhan-2025-119251225084154179.htm", "date": "2025-12-25", "publisherClass": "official" }, { "title": "Công an TP Hà Nội khởi tố 3 người điều hành sàn mua bán dữ liệu cá nhân (VietNamNet)", "url": "https://vietnamnet.vn/cong-an-tp-ha-noi-khoi-to-3-nguoi-dieu-hanh-san-mua-ban-du-lieu-ca-nhan-2534474.html", "date": "2026-07-10", "publisherClass": "news" } ] }, "clinical": { "score": 44, "summary": "Treating doctors may open a patient's VNeID health book, which carries visit summaries, test values and drugs from other facilities. The full chart from another hospital needs that hospital's consent, and cross-facility reuse of test results is still a draft.", "sources": [ { "title": "Luật Khám bệnh, chữa bệnh số 15/2023/QH15, toàn văn (Xây dựng chính sách, Cổng TTĐT Chính phủ)", "url": "https://xaydungchinhsach.chinhphu.vn/toan-van-luat-15-2023-qh15-kham-benh-chua-benh-119231127164453959.htm", "date": "2023-11-27", "publisherClass": "legal_text" }, { "title": "Giảm xét nghiệm trùng lặp, đưa dịch vụ đến gần người dân (Báo Đầu tư)", "url": "https://baodautu.vn/giam-xet-nghiem-trung-lap-dua-dich-vu-den-gan-nguoi-dan-d710899.html", "date": "2026-10-01", "publisherClass": "news" }, { "title": "Bộ Y tế đề xuất hơn 400 xét nghiệm, điện quang có thể dùng lại khi chuyển viện khám, chữa bệnh BHYT (Bảo hiểm xã hội Việt Nam)", "url": "https://baohiemxahoi.gov.vn/tintuc/Pages/cai-cach-thu-tuc-hanh-chinh.aspx?CateID=0&ItemID=27035", "date": "2026-08-25", "publisherClass": "official" }, { "title": "Sổ sức khỏe điện tử trên VNeID có thể thay sổ giấy (Báo Điện tử Chính phủ)", "url": "https://baochinhphu.vn/so-suc-khoe-dien-tu-tren-vneid-co-the-thay-so-giay-102260108162952758.htm", "date": "2026-01-08", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Patients may refuse biomedical research and trials need written consent and ethics approval. Archived records can be lent to researchers with only the hospital's approval, with no opt-out, so the score is capped at 50.", "sources": [ { "title": "Luật Khám bệnh, chữa bệnh số 15/2023/QH15, toàn văn (Xây dựng chính sách, Cổng TTĐT Chính phủ)", "url": "https://xaydungchinhsach.chinhphu.vn/toan-van-luat-15-2023-qh15-kham-benh-chua-benh-119231127164453959.htm", "date": "2023-11-27", "publisherClass": "legal_text" }, { "title": "Thông tư 50/2025/TT-BYT quy định về thử thuốc trên lâm sàng (LuatVietnam)", "url": "https://luatvietnam.vn/y-te/thong-tu-50-2025-tt-byt-quy-dinh-thu-thuoc-tren-lam-sang-hieu-luc-tu-27-02-2026-422988-d1.html", "date": "2025-12-31", "publisherClass": "legal_text" }, { "title": "Decree 102/2025/ND-CP on health data management, English text (LuatVietnam)", "url": "https://english.luatvietnam.vn/y-te/decree-102-2025-nd-cp-health-data-management-400071-d1.html", "date": "2025-05-13", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "The AI Law in force since 1 March 2026 requires human oversight and risk review on significant changes for high-risk systems. But health AI already in use has until 1 September 2027, and a summary of the high-risk list shows only robotic surgery for health.", "sources": [ { "title": "Luật Trí tuệ nhân tạo 2025, số 134/2025/QH15 (LuatVietnam)", "url": "https://luatvietnam.vn/khoa-hoc/luat-tri-tue-nhan-tao-2025-so-134-2025-qh15-422299-d1.html", "date": "2025-12-10", "publisherClass": "legal_text" }, { "title": "Các điểm mới quan trọng của nghị định hướng dẫn Luật Trí tuệ nhân tạo (Atsumi & Sakai)", "url": "https://www.aplawjapan.com/en/newsletter/20260528-2", "date": "2026-05-28", "publisherClass": "law_firm" }, { "title": "Danh mục hệ thống trí tuệ nhân tạo có rủi ro cao từ 15/8/2026 (LuatVietnam)", "url": "https://luatvietnam.vn/tin-van-ban-moi/danh-muc-he-thong-tri-tue-nhan-tao-co-rui-ro-cao-tu-15-8-2026-186-110045-article.html", "date": "2026-07-02", "publisherClass": "law_firm" }, { "title": "Bộ Y tế chuẩn bị ban hành quy định về AI trong y tế (Người Lao Động)", "url": "https://tuoitre.vn/nld/bo-y-te-chuan-bi-ban-hanh-quy-dinh-ve-ai-trong-y-te-196251211145240185.htm", "date": "2025-12-11", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law on Medical Examination and Treatment (15/2023/QH15)", "level": "National", "year": "2023", "what": "Right to read and copy archived records; right to refuse research; confidentiality of records.", "url": "https://xaydungchinhsach.chinhphu.vn/toan-van-luat-15-2023-qh15-kham-benh-chua-benh-119231127164453959.htm" }, { "name": "Law on Personal Data Protection (91/2025/QH15)", "level": "National", "year": "2025", "what": "Health data needs consent; data trading banned; 72-hour breach notice; in force 1 January 2026.", "url": "https://luatvietnam.vn/dan-su/luat-bao-ve-du-lieu-ca-nhan-2025-so-91-2025-qh15-405135-d1.html" }, { "name": "Decree 356/2025/ND-CP", "level": "National", "year": "2025", "what": "Lists health as sensitive data; sets 10-day deadline to provide personal data.", "url": "https://luatvietnam.vn/dan-su/nghi-dinh-356-2025-nd-cp-quy-dinh-chi-tiet-luat-bao-ve-du-lieu-ca-nhan-422896-d1.html" }, { "name": "Decree 102/2025/ND-CP on health data management", "level": "National", "year": "2025", "what": "Creates National Health Database; facilities must link data to VNeID; state may override consent.", "url": "https://english.luatvietnam.vn/y-te/decree-102-2025-nd-cp-health-data-management-400071-d1.html" }, { "name": "Decree 330/2026/ND-CP", "level": "National", "year": "2026", "what": "Administrative penalties for cybersecurity and personal data protection violations.", "url": "https://vanban.chinhphu.vn/?pageid=27160&docid=219266&classid=1&typegroupid=4" }, { "name": "Law on Artificial Intelligence (134/2025/QH15)", "level": "National", "year": "2025", "what": "Risk-based AI rules with human oversight; health AI already operating has until 1 September 2027.", "url": "https://luatvietnam.vn/khoa-hoc/luat-tri-tue-nhan-tao-2025-so-134-2025-qh15-422299-d1.html" }, { "name": "Circular 50/2025/TT-BYT on clinical drug trials", "level": "National", "year": "2025", "what": "Written voluntary consent and ethics council approval for drug trials; in force 27 February 2026.", "url": "https://luatvietnam.vn/y-te/thong-tu-50-2025-tt-byt-quy-dinh-thu-thuoc-tren-lam-sang-hieu-luc-tu-27-02-2026-422988-d1.html" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-10-05", "headline": "Hospital systems hit by attackers; patient data offered for sale on hacker forums", "paraphrase": "The report lists several attacks on major hospitals, including encrypted servers, ransom demands and patient and staff records advertised for sale on cybercrime forums. It reports no statement from the hospitals and no penalty.", "source": "VietNamNet", "url": "https://vietnamnet.vn/en/major-hospitals-hit-by-cyberattacks-patient-data-sold-on-hacker-forums-2449058.html", "theme": "breach", "status": "alleged" }, { "date": "2026-05-23", "headline": "Police cybersecurity unit warns of two attacks on hospital data in one month", "paraphrase": "A police cybersecurity official said attackers hit hospital or health ministry data twice in one month, threatening to expose details of thousands of doctors and patients, including diagnostic imaging, and warned that health sector security is weak.", "source": "Tuoi Tre", "url": "https://tuoitre.vn/canh-bao-tinh-trang-tin-tac-tan-cong-du-lieu-so-cua-benh-vien-lo-thong-tin-bac-si-va-nguoi-benh-2026052321424194.htm", "theme": "breach", "status": "alleged" }, { "date": "2025-08-20", "headline": "Patients get sales calls after hospital visits as their data is sold online", "paraphrase": "Patients described being phoned with sales offers soon after hospital discharge. A security expert found patient names, phone numbers and medical history sold cheaply on a messaging app. Some hospitals stayed silent about attacks, the report says.", "source": "VietTimes", "url": "https://viettimes.vn/lo-hong-so-hoa-benh-vien-khi-du-lieu-benh-nhan-bi-bien-thanh-mon-hang-post188681.html", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2025-06-10", "headline": "Patients say doctors posted their consultations and procedures online without clear consent", "paraphrase": "Two adult patients said clinics posted images or livestreamed their consultations for promotion without clear consent; one learned colleagues had seen the video. A city health department head condemned the practice, citing confidentiality rules.", "source": "Sai Gon Giai Phong", "url": "https://www.sggp.org.vn/dang-tai-hinh-anh-nguoi-benh-len-mang-xa-hoi-vi-pham-quyen-ca-nhan-va-bi-mat-doi-tu-post798808.html", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-10-01", "headline": "Provincial health department finds recurring errors and gaps in hospital medical records", "paraphrase": "A provincial health department official reported common record faults found across facilities: diagnoses not updated, test results not assessed, sections that contradict each other and orders with no clear link to the patient's condition. No facility was named.", "source": "Bao Dong Nai", "url": "https://baodongnai.com.vn/xa-hoi/202610/chan-chinh-chi-dinh-can-lam-sang-ke-don-thuoc-va-chat-luong-ho-so-benh-an-7fb1fc2/", "theme": "record_wrong", "status": "finding" } ] }, { "iso3": "BLR", "name": "Belarus", "region": "Europe", "overall": 46, "rank": "67=", "likelyRank": "49 to 88", "band": "Mixed", "keysModel": "State", "confidence": "high", "headline": "Belarusians can keep their records out of the new state health system, but police and security bodies can obtain medical secrets without consent.", "categories": { "access": { "score": 50, "summary": "The Health Care Law lets patients read their records and get free extracts within 5 days, but not a copy of the whole record. A national patient portal opened in test mode in June 2026, and just over 2.2 million electronic cards existed in April.", "sources": [ { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" }, { "title": "Procedure 7.9: issuing an extract from medical documents (Mogilev City Polyclinic No. 8)", "url": "https://mogcp.by/one-window/ap-clinic8/item/341-procedure7-9?tmpl=component&print=1", "date": "undated", "publisherClass": "official" }, { "title": "Centralized Health Information System (Ministry of Health)", "url": "https://minzdrav.gov.by/ru/dlya-spetsialistov/elektronnoe-zdravookhranenie/tsentralizovannaya-informatsionnaya-sistema-zdravookhraneniya/", "date": "undated", "publisherClass": "official" }, { "title": "Belarus launches medical portal with personal patient cabinet (dev.by)", "url": "https://devby.io/news/v-belarusi-zapustili-medportal-s-lichnym-kabinetom-patsientov", "date": "2026-06-25", "publisherClass": "news" } ] }, "control": { "score": 45, "summary": "Patients have a legal right to refuse having medical secrets entered into the central health system, made on a written form at their clinic. Otherwise records flow without consent, and no access log that patients can view was found.", "sources": [ { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry Resolution No. 74 of 7 June 2021 on consent and refusal forms", "url": "https://minzdrav.gov.by/upload/lcfiles/%D0%BF%D0%BE%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5_%D0%9C%D0%97_2021_74.pdf", "date": "2021-06-07", "publisherClass": "official" }, { "title": "How patients and doctors can protect their data in electronic medical cards (BelTA)", "url": "https://belta.by/society/view/kak-patsientu-i-vrachu-obezopasit-svoi-dannye-pri-rabote-s-elektronnymi-medkartami-rasskazala-790108-2026/", "date": "2026-07-07", "publisherClass": "news" } ] }, "privacy": { "score": 35, "summary": "Health data is a special category under the 2021 Personal Data Law, and breaches must be reported within 3 working days. The regulator was founded by the President's Operational-Analytical Center, and police, courts and operational-search bodies can get medical secrets without consent.", "sources": [ { "title": "Law No. 99-Z on Personal Data Protection (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=H12100099", "date": "undated", "publisherClass": "legal_text" }, { "title": "About the Center (National Personal Data Protection Center)", "url": "https://cpd.by/o-centre/", "date": "undated", "publisherClass": "official" }, { "title": "Typical violations in processing personal data in health care (ilex)", "url": "https://ilex.by/news/tipichnye-narusheniya-pri-obrabotke-personalnyh-dannyh-v-sfere-zdravoohraneniya/", "date": "2026-03-02", "publisherClass": "law_firm" }, { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 55, "summary": "One state system, CISZ, is meant to link every clinic and pharmacy, and e-prescriptions have been national since 2020, with almost 13 million written in 2025. In April 2026 only 456 health organisations could use the integrated electronic card.", "sources": [ { "title": "On the start of trial operation of the Centralized Health Information System (Ministry of Health)", "url": "https://minzdrav.gov.by/ru/sobytiya/o-nachale-opytnoy-ekspluatatsii-tsentralizovannoy-informatsionnoy-sistemy-zdravookhraneniya/", "date": "2025-11-12", "publisherClass": "official" }, { "title": "Centralized Health Information System (Digital Transformation Agency)", "url": "https://agdt.by/zdravoohranenie/", "date": "undated", "publisherClass": "official" }, { "title": "The e-prescription system: how it is being rolled out (BelTA)", "url": "https://belta.by/society/view/sistema-elektronnyh-retseptov-kak-segodnja-ona-vnedrjaetsja-i-pokazyvaet-sebja-775465-2026/", "date": "2026-04-14", "publisherClass": "news" }, { "title": "Belarus to get electronic prescriptions and sick notes (DW)", "url": "https://www.dw.com/ru/v-belarusi-zapustat-sistemu-elektronnogo-zdravoohranenia/a-72018910", "date": "2025-03-24", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Using health data outside care generally needs the person's consent under Law 99-Z, and the regulator says the de-identified data basis cannot be used for advertising. No specific ban on selling health data and no published health-data enforcement case were found.", "sources": [ { "title": "Law No. 99-Z on Personal Data Protection (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=H12100099", "date": "undated", "publisherClass": "legal_text" }, { "title": "Legal bases for processing (National Personal Data Protection Center)", "url": "https://cpd.by/zachita-personalnyh-dannyh/operatoru/pravovye-osnovanija-obrabotki/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 50, "summary": "The law lets medical workers process CISZ records without consent, and the ministry says one integrated card will be visible to any treating clinic. By April 2026 just over 2.2 million cards existed and older history was digitised for about 7% of residents.", "sources": [ { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" }, { "title": "On the start of trial operation of the Centralized Health Information System (Ministry of Health)", "url": "https://minzdrav.gov.by/ru/sobytiya/o-nachale-opytnoy-ekspluatatsii-tsentralizovannoy-informatsionnoy-sistemy-zdravookhraneniya/", "date": "2025-11-12", "publisherClass": "official" }, { "title": "More than 2.2 million electronic medical cards formed in Belarus (BelTA)", "url": "https://belta.by/society/view/v-belarusi-sformirovano-bolee-22-mln-elektronnyh-meditsinskih-kart-775373-2026/", "date": "2026-04-14", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Trial participants must give written consent and can stop at any time, and using a patient's health information in scientific literature needs consent. De-identified CISZ data can be used without consent, and a refusal does not stop it.", "sources": [ { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law No. 99-Z on Personal Data Protection (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=H12100099", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry Resolution No. 74 of 7 June 2021 on consent and refusal forms", "url": "https://minzdrav.gov.by/upload/lcfiles/%D0%BF%D0%BE%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5_%D0%9C%D0%97_2021_74.pdf", "date": "2021-06-07", "publisherClass": "official" }, { "title": "Mobile 'doctor call' service and AI in polyclinics (News.by)", "url": "https://news.by/news/tekhnologii/mobilniy-servis-vyzov-vracha-ii-v-rabote-poliklinik-kak-tekhnologii-vliyayut-na-rabotu-medikov", "date": "2026-08-12", "publisherClass": "news" } ] }, "ai": { "score": 40, "summary": "The Health Care Law counts special software as part of a medical device, but Belarus has no law that directly regulates AI. An AI decision-support tool is in test use in Minsk polyclinics, with the doctor making the final decision.", "sources": [ { "title": "Law No. 2435-XII on Health Care, consolidated text (National Legal Internet Portal)", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435", "date": "undated", "publisherClass": "legal_text" }, { "title": "Belarusian scientists work on AI regulation (National Legal Internet Portal)", "url": "https://pravo.by/novosti/obshchestvenno-politicheskie-i-v-oblasti-prava/2026/94223/", "date": "2026-07-15", "publisherClass": "official" }, { "title": "Mobile 'doctor call' service and AI in polyclinics (News.by)", "url": "https://news.by/news/tekhnologii/mobilniy-servis-vyzov-vracha-ii-v-rabote-poliklinik-kak-tekhnologii-vliyayut-na-rabotu-medikov", "date": "2026-08-12", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law No. 2435-XII on Health Care", "level": "National", "year": "1993", "what": "Right to read records and get extracts; medical secrecy and exceptions; CISZ and the right to refuse entry.", "url": "https://pravo.by/webnpa/text.asp?RN=v19302435" }, { "name": "Law No. 99-Z on Personal Data Protection", "level": "National", "year": "2021", "what": "Health data is special; consent needed except listed cases; breaches reported to regulator within 3 working days.", "url": "https://pravo.by/webnpa/text.asp?RN=H12100099" }, { "name": "Presidential Decree No. 422 on improving personal data protection", "level": "National", "year": "2021", "what": "Creates the National Personal Data Protection Center with inspection and order powers.", "url": "https://president.gov.by/ru/documents/ukaz-no-422-ot-28-oktyabrya-2021-g" }, { "name": "Health Ministry Resolution No. 74 on consent and refusal forms", "level": "National", "year": "2021", "what": "Forms for consent, withdrawal and refusal of entry into electronic records and CISZ.", "url": "https://minzdrav.gov.by/upload/lcfiles/%D0%BF%D0%BE%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5_%D0%9C%D0%97_2021_74.pdf" }, { "name": "Criminal Code Article 203-1 (unlawful acts with personal data)", "level": "National", "year": "2021", "what": "Criminal liability for unlawful collection or sharing of personal data causing substantial harm.", "url": "https://pravo.by/novosti/novosti-pravo-by/2021/june/65098/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-07", "headline": "Private clinic sent a patient a wrong test report, regulator and court confirmed", "paraphrase": "A clinic emailed a patient a lab report with a serious finding that was false. The city health committee confirmed a template error and reprimanded the doctor; the clinic apologised and a court awarded damages.", "source": "Onliner (people.onliner.by)", "url": "https://people.onliner.by/2025/04/07/diagnoz-no-ne-tot", "theme": "record_wrong", "status": "finding" }, { "date": "2025-11-13", "headline": "Patient suing a private clinic says it would not hand over her records", "paraphrase": "A patient in a damages case says a private clinic refused her copies of her medical and anaesthesia records. A video of the procedure turned out to be deleted, and its documents gave conflicting figures.", "source": "Onliner (people.onliner.by)", "url": "https://people.onliner.by/2025/11/13/sud-po-plasticheskoj-operacii", "theme": "access_refused", "status": "alleged" }, { "date": "2026-02-23", "headline": "Released prisoner sent home without any discharge summary or medical papers", "paraphrase": "A prisoner freed from a prison hospital came home with no discharge summary or extract from his records. His spouse said this made it hard to arrange prompt follow-up care.", "source": "Current Time (Nastoyashchee Vremya)", "url": "https://www.currenttime.tv/a/belarus-statkevich/33685224.html", "theme": "lost_between_providers", "status": "alleged" } ] }, { "iso3": "OMN", "name": "Oman", "region": "Middle East", "overall": 46, "rank": "67=", "likelyRank": "49 to 89", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Oman links every Ministry of Health record by civil number and shows it in the Shifa app, but patients get no opt-out.", "categories": { "access": { "score": 45, "summary": "The Ministry of Health's Shifa app shows medical records, history, medicines, tests and vaccinations from all ministry facilities. The data law's free copy right may not reach state hospitals (not verified), and an official report costs 3 to 5 rials.", "sources": [ { "title": "تطبيق شفاء (وزارة الصحة)", "url": "https://www.moh.gov.om/ar/%D8%A3%D8%AE%D8%B1%D9%89/%D8%AA%D8%B7%D8%A8%D9%8A%D9%82-%D8%B4%D9%81%D8%A7%D8%A1/", "date": "undated", "publisherClass": "official" }, { "title": "172.2 ألف مسجل في تطبيق شفاء يستفيدون من 16 خدمة (الرؤية)", "url": "https://alroya.om/post/321167/", "date": "2023-04-30", "publisherClass": "news" }, { "title": "Royal Decree 6/2022 Issuing the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2022/rd20220006/", "date": "2022-02-09", "publisherClass": "legal_text" }, { "title": "Get Medical Report (Gov.om, Ministry of Health)", "url": "https://gov.om/en/w/get-a-medical-report", "date": "2026-09-13", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Al Shifa links every ministry record to the civil number by default, and we found no opt-out and no patient-visible access log. The data law requires explicit consent, but state bodies acting within their legal powers are exempt.", "sources": [ { "title": "NEHR Linked All Patient's Files in All Different Health Institutions (Ministry of Health)", "url": "https://moh.gov.om/en/media-center/news/nehr-linked-all-patient-s-files-in-all-different-health-institutions/", "date": "2015-05-11", "publisherClass": "official" }, { "title": "Royal Decree 6/2022 Issuing the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2022/rd20220006/", "date": "2022-02-09", "publisherClass": "legal_text" }, { "title": "Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2026/rd20260068/", "date": "2026-09-03", "publisherClass": "legal_text" }, { "title": "تطبيق شفاء (وزارة الصحة)", "url": "https://www.moh.gov.om/ar/%D8%A3%D8%AE%D8%B1%D9%89/%D8%AA%D8%B7%D8%A8%D9%8A%D9%82-%D8%B4%D9%81%D8%A7%D8%A1/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "Health data may be processed only with a ministry permit, breaches must be reported within 72 hours, and fines reach 20,000 rials. The regulator is a ministry, state bodies are exempt, and no health-sector enforcement was found.", "sources": [ { "title": "Royal Decree 6/2022 Issuing the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2022/rd20220006/", "date": "2022-02-09", "publisherClass": "legal_text" }, { "title": "Executive Regulations on the Oman Personal Data Protection Law (Dentons)", "url": "https://www.dentons.com/en/insights/articles/2024/march/20/executive-regulations-on-the-oman-personal-data-protection-law", "date": "2024-03-20", "publisherClass": "law_firm" }, { "title": "Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2026/rd20260068/", "date": "2026-09-03", "publisherClass": "legal_text" } ] }, "journey": { "score": 58, "summary": "Al Shifa connects every Ministry of Health hospital and clinic through the civil number, and in 2025 the ministry reported work to link 65 percent of facilities to imaging or Shifa systems. Private and university hospitals are only starting to join.", "sources": [ { "title": "NEHR Linked All Patient's Files in All Different Health Institutions (Ministry of Health)", "url": "https://moh.gov.om/en/media-center/news/nehr-linked-all-patient-s-files-in-all-different-health-institutions/", "date": "2015-05-11", "publisherClass": "official" }, { "title": "الصحة: التوسع في أتمتة الخدمات وإطلاق عيادات افتراضية جديدة (جريدة عمان)", "url": "https://www.omandaily.om/%D8%B9%D9%85%D8%A7%D9%86-%D8%A7%D9%84%D9%8A%D9%88%D9%85/na/%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%AA%D9%88%D8%B3%D8%B9-%D9%81%D9%8A-%D8%A3%D8%AA%D9%85%D8%AA%D8%A9-%D8%A7%D9%84%D8%AE%D8%AF%D9%85%D8%A7%D8%AA-%D9%88%D8%A5%D8%B7%D9%84%D8%A7%D9%82-%D8%B9%D9%8A%D8%A7%D8%AF%D8%A7%D8%AA-%D8%A7%D9%81%D8%AA%D8%B1%D8%A7%D8%B6%D9%8A%D8%A9-%D8%AC%D8%AF%D9%8A%D8%AF%D8%A9", "date": "2026-03-14", "publisherClass": "news" }, { "title": "Shifa app to be integrated with the private sector (Oman Observer)", "url": "https://www.omanobserver.om/article/1188565/oman/health/shifa-app-to-be-integrated-with-the-private-sector", "date": "2026-04-26", "publisherClass": "news" }, { "title": "منصة ضماني تنجز أكثر من 11.2 مليون معاملة إلكترونية (وكالة الأنباء العمانية)", "url": "https://www.omannews.gov.om/topics/ar/7/show/467294", "date": "2026-05-06", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "The data law requires explicit consent before any marketing message and a permit before anyone processes health data. No rule on selling de-identified health data, data brokers or consumer health apps was found.", "sources": [ { "title": "Royal Decree 6/2022 Issuing the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2022/rd20220006/", "date": "2022-02-09", "publisherClass": "legal_text" }, { "title": "Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2026/rd20260068/", "date": "2026-09-03", "publisherClass": "legal_text" }, { "title": "Executive Regulations on the Oman Personal Data Protection Law (Dentons)", "url": "https://www.dentons.com/en/insights/articles/2024/march/20/executive-regulations-on-the-oman-personal-data-protection-law", "date": "2024-03-20", "publisherClass": "law_firm" } ] }, "clinical": { "score": 56, "summary": "Clinicians can view patient data and follow cases across any Ministry of Health facility through Shifa. Records held by private hospitals and the university hospital were not yet linked as of April 2026.", "sources": [ { "title": "تطبيق شفاء.. منصة لتسهيل الوصول للخدمات الصحية (Gov.om)", "url": "https://gov.om/w/shifa-app-a-platform-to-facilitate-access-to-healthcare-services", "date": "2025-02-23", "publisherClass": "official" }, { "title": "Shifa app to be integrated with the private sector (Oman Observer)", "url": "https://www.omanobserver.om/article/1188565/oman/health/shifa-app-to-be-integrated-with-the-private-sector", "date": "2026-04-26", "publisherClass": "news" }, { "title": "NEHR Linked All Patient's Files in All Different Health Institutions (Ministry of Health)", "url": "https://moh.gov.om/en/media-center/news/nehr-linked-all-patient-s-files-in-all-different-health-institutions/", "date": "2015-05-11", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Researchers may use personal data without consent if published results cannot identify anyone, and ministry studies need approval from a central research committee. Patients may refuse to join a study, but there is no opt-out from secondary use.", "sources": [ { "title": "Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2026/rd20260068/", "date": "2026-09-03", "publisherClass": "legal_text" }, { "title": "National Center for Health Research (Ministry of Health)", "url": "https://moh.gov.om/en/hospitals-directorates/directorates-and-centers-at-hq/national-center-for-health-research/", "date": "2026-06-03", "publisherClass": "official" }, { "title": "National Document of Patient Rights and Responsibilities (Ministry of Health)", "url": "https://moh.gov.om/media/hjxfqpoj/d8b62e21-161e-03b9-0517-6e57c065b8c1.pdf", "date": "2018-11", "publisherClass": "official" }, { "title": "Royal Decree 6/2022 Issuing the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2022/rd20220006/", "date": "2022-02-09", "publisherClass": "legal_text" } ] }, "ai": { "score": 42, "summary": "Oman has a general national AI policy from 2025 and, since September 2026, a legal right to object to automated decisions with human review. We found no rules for AI medical devices or for AI used in care.", "sources": [ { "title": "السياسة العامة للاستخدام الآمن والأخلاقي لأنظمة الذكاء الاصطناعي (وزارة النقل والاتصالات وتقنية المعلومات)", "url": "https://mtcit.gov.om/ar/3/8/73/291", "date": "2025-04-01", "publisherClass": "official" }, { "title": "Royal Decree 68/2026 Amending Some Provisions of the Personal Data Protection Law (Decree translation)", "url": "https://decree.om/2026/rd20260068/", "date": "2026-09-03", "publisherClass": "legal_text" }, { "title": "Cir.No.161 of 2025, Registration of High Risk Medical Devices (MOH Drug Safety Center)", "url": "https://moh.gov.om/en/ministry/drug-safety-center-circulars/cirno161-of-2025-regarding-commencement-of-registration-of-high-risk-medical-devices-supplies-manufacturers-their-products/", "date": "2025-07-06", "publisherClass": "official" }, { "title": "Oman MOH Medical Device Registration: Circular 161/2025 (Elendi Labs)", "url": "https://elendilabs.com/en/articles/omn-moh-high-risk-medical-device-registration-circular-161-2025", "date": "undated", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Personal Data Protection Law (Royal Decree 6/2022)", "level": "National", "year": "2022", "what": "Explicit consent, rights to a copy and erasure, ministry permit for health data, breach notice, fines.", "url": "https://decree.om/2022/rd20220006/" }, { "name": "Executive Regulation of the PDPL (Ministerial Decision 34/2024)", "level": "National", "year": "2024", "what": "Free requests answered within 45 days, 72-hour breach notice, permit procedure, transfer conditions.", "url": "https://www.dentons.com/en/insights/articles/2024/march/20/executive-regulations-on-the-oman-personal-data-protection-law" }, { "name": "PDPL amendments (Royal Decree 68/2026)", "level": "National", "year": "2026", "what": "Wider health data definition, right to object to automated decisions, erasure duty, new consent exceptions.", "url": "https://decree.om/2026/rd20260068/" }, { "name": "MOH Drug Safety Center Circular 161/2025", "level": "National", "year": "2025", "what": "Starts mandatory registration of high-risk medical device manufacturers and products.", "url": "https://moh.gov.om/en/ministry/drug-safety-center-circulars/cirno161-of-2025-regarding-commencement-of-registration-of-high-risk-medical-devices-supplies-manufacturers-their-products/" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "TON", "name": "Tonga", "region": "Oceania", "overall": 46, "rank": "67=", "likelyRank": "50 to 89", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Tonga runs one national health record in every facility and passed a health privacy law in 2025, but the Ministry enforces it on itself.", "categories": { "access": { "score": 45, "summary": "Section 57 of the Personal Health Information Protection Act 2025 gives a right to see and copy one's record, including in electronic form, with a reply due within 30 days. There is no patient portal, and custodians may charge cost-recovery fees.", "sources": [ { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Fakamatala ki he Mo'uilelei Fakafo'ituitui (Tonga NHIS, Ministry of Health)", "url": "https://www.tonga-nhis.org/fakamatala-ki-he-mouilelei-fakafoituitui/", "date": "2021-11-05", "publisherClass": "official" } ] }, "control": { "score": 42, "summary": "The 2025 Act lets patients revoke consent, tell custodians not to share, and flag sensitive information, but sharing for care runs on implied consent inside the Ministry's NHIS. Access is logged, yet no right for patients to see the log was found.", "sources": [ { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "NHIS Frequently Asked Questions (Tonga NHIS, Ministry of Health)", "url": "https://www.tonga-nhis.org/wp-content/uploads/2022/01/FAQ-Eng-final.pdf", "date": "2022-01", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "The health privacy Act sets breach notice and fines up to T$200,000 or 7 years in prison, but complaints go to the Ministry's own chief executive. The general Privacy Act 2025 awaits commencement, and a June 2025 ransomware attack shut the national health system.", "sources": [ { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Privacy Act 2025 (Act 34 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Tonga's Privacy Act 2025: What It Means for You (Semper Fidelis Pacific Law & Advisory)", "url": "https://semperfidelis.legal/articles/tonga-s-privacy-act-2025-what-it-means-for-you", "date": "2026-08-21", "publisherClass": "law_firm" }, { "title": "Health ministry's information system hit by ransomware attack (Talanoa o Tonga)", "url": "https://talanoaotonga.to/health-ministrys-information-system-hit-by-ransomware-attack/", "date": "2025-06-19", "publisherClass": "news" } ] }, "journey": { "score": 58, "summary": "The government's FY2027 budget says the National Health Information System now runs in all health facilities. It links hospital, health centre, pharmacy, laboratory and radiology systems, though a ransomware attack took it offline for about a month in 2025.", "sources": [ { "title": "Budget Statement Financial Year 2027 (Ministry of Finance)", "url": "https://finance.gov.to/sites/default/files/2026-07/Budget%20Statement%20FY2027_Final_Website.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "Tonga's experience in implementing national digital health (Pacific Community, PHIN)", "url": "https://php.spc.int/sites/default/files/p-related-files/2023-03/2023%20PHIN%20Agenda%2013%20ID%203.3%20Tonga%20experience%20in%20implementing%20national%20digital%20health%20intervention%2028%20April%202023.pdf", "date": "2023-04-28", "publisherClass": "intergov" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Tonga's health system 'fully restored' after cyber attack with Australia's help (RNZ)", "url": "https://www.rnz.co.nz/news/pacific/567275/tonga-s-health-system-fully-restored-after-cyber-attack-with-australia-s-help", "date": "2025-07-18", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Section 35 of the 2025 health Act bans using health records for marketing or market research without express consent. The ban covers health custodians only; health apps and other firms wait on the Privacy Act, which is not yet in force.", "sources": [ { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Privacy Act 2025 (Act 34 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" } ] }, "clinical": { "score": 60, "summary": "Because NHIS is one central record reached from every public facility, a treating clinician can open the same chart in any island hospital or health centre. Access is role based and limited to the time of care.", "sources": [ { "title": "Tonga's experience in implementing national digital health (Pacific Community, PHIN)", "url": "https://php.spc.int/sites/default/files/p-related-files/2023-03/2023%20PHIN%20Agenda%2013%20ID%203.3%20Tonga%20experience%20in%20implementing%20national%20digital%20health%20intervention%2028%20April%202023.pdf", "date": "2023-04-28", "publisherClass": "intergov" }, { "title": "NHIS Frequently Asked Questions (Tonga NHIS, Ministry of Health)", "url": "https://www.tonga-nhis.org/wp-content/uploads/2022/01/FAQ-Eng-final.pdf", "date": "2022-01", "publisherClass": "official" }, { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Custodians may release identifiable records to researchers without consent once the National Health Ethics Committee approves a plan and the researcher signs an agreement. There is no opt-out, but re-identifying de-identified data is an offence.", "sources": [ { "title": "Personal Health Information Protection Act 2025 (Act 31 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Garvan research team explores genetic health collaboration for Tonga (Talanoa o Tonga)", "url": "https://talanoaotonga.to/garvan-research-team-explores-genetic-health-collaboration-for-tonga/", "date": "2026-09-15", "publisherClass": "news" } ] }, "ai": { "score": 20, "summary": "No rules for clinical AI or AI medical devices were found. The Privacy Act 2025 adds a right not to face decisions made solely by automated processing, but it is not yet in force.", "sources": [ { "title": "Privacy Act 2025 (Act 34 of 2025), Attorney General's Office", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdf", "date": "2025-12-16", "publisherClass": "legal_text" }, { "title": "Artificial Intelligence Conference: The Role of Parliament in Shaping the Future of AI (Legislative Assembly of Tonga)", "url": "https://parliament.gov.to/en/media-centre/latest-news/artificial-intelligence-conference-the-role-of-parliament-in-shaping-the-future-of-ai-kuala-lumpu-malaysia-28-30-november-2025", "date": "2025-12-01", "publisherClass": "official" } ] } }, "laws": [ { "name": "Personal Health Information Protection Act 2025 (Act 31 of 2025)", "level": "National", "year": "2025", "what": "Consent, access within 30 days, audit logs, breach notice, marketing ban, research rules and NHIS governance.", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0046/PersonalHealthInformationProtectionAct2025_1.pdf" }, { "name": "Privacy Act 2025 (Act 34 of 2025)", "level": "National", "year": "2025", "what": "General data protection law and Privacy Commission; health is sensitive data; awaits Cabinet commencement proclamation.", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0052/PrivacyAct2025_1.pdf" }, { "name": "Civil Registration and Digital Identification Act 2025 (Act 33 of 2025)", "level": "National", "year": "2025", "what": "Upgraded civil registration, a digital ID database and unique identifier numbers; births notified to the Ministry of Health.", "url": "https://ago.gov.to/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0051/CivilRegistrationandDigitalIdentificationAct2025_1.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-06-20", "headline": "Health ministry says ransomware locked the system holding every patient's history", "paraphrase": "The health minister said a ransomware attack took down the national health information system, which holds patients' medical records and prescriptions. The ministry told people to bring their prescription cards because doctors could not open records.", "source": "The Record from Recorded Future News", "url": "https://therecord.media/tonga-ministry-of-health-hit-with-cyberattack", "theme": "breach", "status": "admitted" }, { "date": "2025-06-26", "headline": "Patients asked to bring their own records after national health records breach", "paraphrase": "The outlet reports growing concern about illegal access to health records after hackers breached the national system, while patients were told to bring any medical records they hold to hospital because staff were working from manual data.", "source": "RNZ", "url": "https://www.rnz.co.nz/news/pacific/565178/tonga-s-government-mum-on-health-cyber-breach", "theme": "breach", "status": "alleged" }, { "date": "2025-06-27", "headline": "Ransomware group posts sample files taken from Tonga's national health records", "paraphrase": "The outlet reports that a ransomware group listed the health system as a victim on its leak site and published four sample documents, including a letter about a family member's visa and an intensive care chart.", "source": "Cyber Daily", "url": "https://www.cyberdaily.au/security/12300-exclusive-inc-ransom-takes-responsibility-for-devastating-attack-on-tonga-s-ministry-of-health", "theme": "breach", "status": "alleged" }, { "date": "2025-06-28", "headline": "Minister says lapsed security licences and skipped backups exposed health records system", "paraphrase": "Another government minister told the outlet that protective software licences on the health records system had expired and backup procedures were not followed properly before hackers broke in, leaving the records exposed.", "source": "Tonga Independent News", "url": "https://tongaindependent.com/nae-iai-nai-ha-taetokanga-o-hoko-ai-a-e-huu-kau-faihia-ki-he-sisitemi-a-e-potungaue-moui/", "theme": "breach", "status": "alleged" }, { "date": "2025-07-01", "headline": "Confidential health information copied and leaked by hackers, outlet reports", "paraphrase": "The outlet reports that confidential information from the national health system was copied and leaked by the criminals who encrypted it and demanded a ransom, which the government refused to pay.", "source": "Matangi Tonga", "url": "https://matangitonga.to/2025/07/01/cyber-criminals-leak-confidential-health-information", "theme": "breach", "status": "alleged" } ] }, { "iso3": "UZB", "name": "Uzbekistan", "region": "Asia", "overall": 46, "rank": "67=", "likelyRank": "51 to 92", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Uzbeks can open their e-medical card in the state DMED app, but the law promises only extracts and records flow without patient choice.", "categories": { "access": { "score": 60, "summary": "The 1996 health law gives a right to information and to extracts from medical records, not a full copy. Since April 2026 a Health Ministry order lets patients view and download their e-medical card, case history and e-prescriptions in the state DMED app.", "sources": [ { "title": "Law 265-I On Protection of Citizens' Health, current text (Lex.uz)", "url": "https://lex.uz/ru/docs/41329", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry order, reg. No. 3758: instruction on e-polyclinic, e-hospital, e-medical card and e-prescription modules (Lex.uz)", "url": "https://lex.uz/docs/8007015", "date": "2026-01-19", "publisherClass": "legal_text" }, { "title": "DMED, single digital health operator: platform figures", "url": "https://dmed.uz/uz", "date": "undated", "publisherClass": "official" }, { "title": "DMED app listing, Google Play (UZINFOCOM)", "url": "https://play.google.com/store/apps/details?id=uz.uzinfocom.dmed&hl=en", "date": "undated", "publisherClass": "blog_vendor" } ] }, "control": { "score": 30, "summary": "Health data moves between clinics through the state e-health system with no patient opt-out found. A December 2025 amendment added the social protection agency to the bodies that can get medical-secret data without consent.", "sources": [ { "title": "Law ZRU-547 On Personal Data, current text (Lex.uz, Ministry of Justice)", "url": "https://lex.uz/ru/docs/4396428", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law 265-I On Protection of Citizens' Health, current text (Lex.uz)", "url": "https://lex.uz/ru/docs/41329", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry order, reg. No. 3758: instruction on e-polyclinic, e-hospital, e-medical card and e-prescription modules (Lex.uz)", "url": "https://lex.uz/docs/8007015", "date": "2026-01-19", "publisherClass": "legal_text" } ] }, "privacy": { "score": 38, "summary": "Health data is special category data, but the regulator sits under the Cabinet of Ministers and the fine for an official is 50 base calculation units. A January 2026 attack on three state bodies leaked data, and its scale is disputed.", "sources": [ { "title": "Law ZRU-547 On Personal Data, current text (Lex.uz, Ministry of Justice)", "url": "https://lex.uz/ru/docs/4396428", "date": "undated", "publisherClass": "legal_text" }, { "title": "Code of Administrative Responsibility, Article 46-2 (Lex.uz)", "url": "https://lex.uz/ru/docs/97661", "date": "undated", "publisherClass": "legal_text" }, { "title": "'We moved too fast': cybersecurity approach to tighten after data leak (Gazeta.uz)", "url": "https://www.gazeta.uz/ru/2026/02/19/cybersecurity/", "date": "2026-02-19", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 55, "summary": "Cabinet Resolution 570 makes real-time connection to the Health Ministry e-health system a licence condition for all medical and pharmacy organisations, starting in Tashkent and 15 districts on 10 December 2025 and nationwide by end 2026. Rollout is still under way.", "sources": [ { "title": "Cabinet of Ministers Resolution No. 570 on accelerating digitalisation of health care (Lex.uz)", "url": "https://lex.uz/uz/docs/7723519", "date": "2025-09-08", "publisherClass": "legal_text" }, { "title": "Health Ministry order, reg. No. 3758: instruction on e-polyclinic, e-hospital, e-medical card and e-prescription modules (Lex.uz)", "url": "https://lex.uz/docs/8007015", "date": "2026-01-19", "publisherClass": "legal_text" }, { "title": "DMED, single digital health operator: platform figures", "url": "https://dmed.uz/uz", "date": "undated", "publisherClass": "official" }, { "title": "E-prescription system is not being cancelled, it will expand (Gazeta.uz)", "url": "https://www.gazeta.uz/ru/2026/05/01/e-receipt/", "date": "2026-05-01", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Selling or marketing with health data needs the person's written consent under the Personal Data Law, and third-party transfers must be notified within three days. We found no specific rule on health data brokers, de-identified data sales or health apps.", "sources": [ { "title": "Law ZRU-547 On Personal Data, current text (Lex.uz, Ministry of Justice)", "url": "https://lex.uz/ru/docs/4396428", "date": "undated", "publisherClass": "legal_text" }, { "title": "Personal data leak in Uzbekistan: which state sites were hacked (Spot.uz)", "url": "https://www.spot.uz/ru/2026/02/10/data-leak/", "date": "2026-02-10", "publisherClass": "news" } ] }, "clinical": { "score": 52, "summary": "Doctors, nurses and pharmacists in connected facilities can open a patient's data in the national e-medical card module, which collects records from other providers. Coverage is still growing toward all regions by end 2026.", "sources": [ { "title": "Health Ministry order, reg. No. 3758: instruction on e-polyclinic, e-hospital, e-medical card and e-prescription modules (Lex.uz)", "url": "https://lex.uz/docs/8007015", "date": "2026-01-19", "publisherClass": "legal_text" }, { "title": "Cabinet of Ministers Resolution No. 570 on accelerating digitalisation of health care (Lex.uz)", "url": "https://lex.uz/uz/docs/7723519", "date": "2025-09-08", "publisherClass": "legal_text" }, { "title": "DMED, single digital health operator: platform figures", "url": "https://dmed.uz/uz", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Drug trials need written participant consent and approval from a Health Ministry ethics committee under a regulation in force since 26 February 2026. Secondary use of health data for statistics needs no consent if de-identified, and no opt-out was found.", "sources": [ { "title": "Health Ministry order, reg. No. 3745: regulation on clinical trials of medicines (Lex.uz)", "url": "https://lex.uz/uz/docs/-7974648", "date": "2026-01-06", "publisherClass": "legal_text" }, { "title": "Law ZRU-547 On Personal Data, current text (Lex.uz, Ministry of Justice)", "url": "https://lex.uz/ru/docs/4396428", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law 265-I On Protection of Citizens' Health, current text (Lex.uz)", "url": "https://lex.uz/ru/docs/41329", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 45, "summary": "Binding ethics rules in force since 17 June 2026 bar relying only on AI for diagnosis, treatment choice or medical image analysis. We found no AI-specific medical device rules with change control, so this sits in the guidance band.", "sources": [ { "title": "Law ZRU-1115 amending laws to regulate the use of artificial intelligence (Lex.uz)", "url": "https://lex.uz/ru/docs/8011377", "date": "2026-01-21", "publisherClass": "legal_text" }, { "title": "Digital Technologies Ministry order, reg. No. 3787: ethics rules for AI-based solutions (Lex.uz)", "url": "https://lex.uz/uz/docs/-8083233", "date": "2026-03-14", "publisherClass": "legal_text" }, { "title": "Use of AI in economic sectors and the social sphere will expand (President of Uzbekistan)", "url": "https://president.uz/ru/lists/view/8721", "date": "2025-12-01", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law ZRU-547 On Personal Data", "level": "National", "year": "2019", "what": "Health data is special data; written consent, Cabinet-run regulator, localisation of biometric and genetic data.", "url": "https://lex.uz/ru/docs/4396428" }, { "name": "Law 265-I On Protection of Citizens' Health", "level": "National", "year": "1996", "what": "Patient rights, right to health information and record extracts, medical secrecy and its exceptions.", "url": "https://lex.uz/ru/docs/41329" }, { "name": "Cabinet of Ministers Resolution No. 570 on digitalisation of health care", "level": "National", "year": "2025", "what": "Mandatory real-time e-health connection for all medical and pharmacy organisations; e-prescription rules.", "url": "https://lex.uz/uz/docs/7723519" }, { "name": "Health Ministry instruction on e-health modules (reg. No. 3758)", "level": "National", "year": "2026", "what": "Rules for e-polyclinic, e-hospital, e-medical card, e-prescription; patient view and download via DMED.", "url": "https://lex.uz/docs/8007015" }, { "name": "Health Ministry regulation on clinical trials (reg. No. 3745)", "level": "National", "year": "2026", "what": "Written consent of trial subjects and mandatory ethics committee review before any trial.", "url": "https://lex.uz/uz/docs/-7974648" }, { "name": "Law ZRU-1115 on artificial intelligence", "level": "National", "year": "2026", "what": "AI must not harm health; no rights decisions solely on AI; fines for unlawful AI data processing.", "url": "https://lex.uz/ru/docs/8011377" }, { "name": "Ethics rules for AI-based solutions (reg. No. 3787)", "level": "National", "year": "2026", "what": "Health decisions such as diagnosis and treatment must not rely only on AI conclusions.", "url": "https://lex.uz/uz/docs/-8083233" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-05", "headline": "Patients report clinic visits that never happened in their electronic health records", "paraphrase": "Users of the national digital health platform reported phantom visits, duplicate profiles and missing diagnoses. The health ministry said a mistyped ID can put entries in another person's record, and only a clinic commission can correct them.", "source": "Daryo", "url": "https://daryo.uz/ru/2026/08/05/dmed-lozhnye-dannye-dubli-akkauntov-ocheredi-onlajn-zapis/", "theme": "record_wrong", "status": "alleged" }, { "date": "2025-12-04", "headline": "Residents find themselves assigned to clinics in other districts or cities", "paraphrase": "Residents reported discovering that the health database had registered them with clinics in another district or city, not where they live. The outlet said the error could hamper getting care and described ways to request a correction.", "source": "UPL.UZ", "url": "https://upl.uz/obshestvo/58472-news.html", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-02-03", "headline": "Hackers claim state systems holding citizens' medical data were breached", "paraphrase": "Hackers claimed a breach of the national login server exposed data on millions, including a state system holding citizens' medical data. Reporters said sample files included sick-leave certificates. Officials said checks were under way.", "source": "Daryo", "url": "https://daryo.uz/ru/omkV3-Hvg/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "IND", "name": "India", "region": "Asia", "overall": 45, "rank": "71=", "likelyRank": "52 to 95", "band": "Mixed", "keysModel": "Shared", "confidence": "medium", "headline": "India built an opt-in consent exchange linking 110 crore records, but the records are thin and its privacy law and regulator are not yet working.", "categories": { "access": { "score": 55, "summary": "A binding medical ethics regulation makes doctors issue records within 72 hours, and 96.43 crore ABHA accounts can view 110 crore linked records (August 2026). Linked records average about one per account, and the DPDP access right only gives a summary and starts in May 2027.", "sources": [ { "title": "Code of Medical Ethics Regulations, 2002 (NMC)", "url": "https://nmc.org.in/page/rules-regulations-rules-regulations-of-erstwhile-mci-code-of-medical-ethics-regulations-2002", "date": "2002", "publisherClass": "legal_text" }, { "title": "The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)", "url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf", "date": "2023-08-11", "publisherClass": "legal_text" }, { "title": "G.S.R. 843(E): commencement dates of the DPDP Act (MeitY)", "url": "https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf", "date": "2025-11-13", "publisherClass": "legal_text" }, { "title": "Affordable and Accessible Healthcare for All (PIB fact sheet)", "url": "https://www.pib.gov.in/FactsheetDetails.aspx?id=150834&ModuleId=16®=%203&lang=1", "date": "2026-08-12", "publisherClass": "official" } ] }, "control": { "score": 50, "summary": "ABDM shares records between providers only on the patient's revocable, time-bound consent, an opt-in choice that is live nationwide. Policy lets patients see their consents, but a log of each access was not verified, so the cell sits mid-band (40 to 55), level with Thailand.", "sources": [ { "title": "Ayushman Bharat Digital Mission: India's Digital Health Backbone (PIB)", "url": "https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/jul/doc202676912801.pdf", "date": "2026-07-06", "publisherClass": "official" }, { "title": "National Digital Health Mission: Health Data Management Policy (archived copy of abdm.gov.in PDF)", "url": "https://web.archive.org/web/2025id_/https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf", "date": "undated", "publisherClass": "official" }, { "title": "ABHA ID now mandatory for OPD, emergency registration (Times of India)", "url": "https://timesofindia.indiatimes.com/city/jaipur/abha-id-now-mandatory-for-opd-emergency-registration/articleshow/127727998.cms", "date": "2026-01-29", "publisherClass": "news" }, { "title": "G.S.R. 843(E): commencement dates of the DPDP Act (MeitY)", "url": "https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf", "date": "2025-11-13", "publisherClass": "legal_text" } ] }, "privacy": { "score": 35, "summary": "India's new data law does not make health data a special category, and its duties and penalties of up to Rs 250 crore start only in May 2027. The Data Protection Board had no chair or members in September 2026, while hospital leaks continued.", "sources": [ { "title": "IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011", "url": "https://prsindia.org/files/bills_acts/bills_parliament/2011/IT_Rules_2011.pdf", "date": "2011-04-11", "publisherClass": "legal_text" }, { "title": "The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)", "url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf", "date": "2023-08-11", "publisherClass": "legal_text" }, { "title": "Hackers target Ernakulam hospital, steal 800GB data (New Indian Express)", "url": "https://www.newindianexpress.com/states/kerala/2026/Jun/10/hackers-target-ernakulam-hospital-steal-800gb-data", "date": "2026-06-10", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 45, "summary": "ABDM gives India national registries, a consent exchange and a claims exchange, with 5.47 lakh facilities registered and 110 crore records linked by August 2026. Hospitals lead, while labs and pharmacies trail far behind, and records are linked rather than merged.", "sources": [ { "title": "100 crore health records linked with ABHA under ABDM (PIB)", "url": "https://www.pib.gov.in/PressReleasePage.aspx?PRID=2264241®=3&lang=1", "date": "2026-05-22", "publisherClass": "official" }, { "title": "Ayushman Bharat Digital Mission: India's Digital Health Backbone (PIB)", "url": "https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/jul/doc202676912801.pdf", "date": "2026-07-06", "publisherClass": "official" }, { "title": "Affordable and Accessible Healthcare for All (PIB fact sheet)", "url": "https://www.pib.gov.in/FactsheetDetails.aspx?id=150834&ModuleId=16®=%203&lang=1", "date": "2026-08-12", "publisherClass": "official" } ] }, "commercial": { "score": 35, "summary": "No Indian law bans selling health data or using it for advertising. Private bodies need prior permission to disclose medical records under 2011 rules, and the DPDP ban on targeted ads at children starts only in May 2027.", "sources": [ { "title": "IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011", "url": "https://prsindia.org/files/bills_acts/bills_parliament/2011/IT_Rules_2011.pdf", "date": "2011-04-11", "publisherClass": "legal_text" }, { "title": "The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)", "url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf", "date": "2023-08-11", "publisherClass": "legal_text" }, { "title": "National Digital Health Mission: Health Data Management Policy (archived copy of abdm.gov.in PDF)", "url": "https://web.archive.org/web/2025id_/https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf", "date": "undated", "publisherClass": "official" }, { "title": "STAR Hospitals alleges patient data was leaked, FIR registered (The South First)", "url": "https://thesouthfirst.com/health/hyderabads-star-hospitals-alleges-confidential-patient-data-was-leaked-published-online-fir-registered/", "date": "2026-08-03", "publisherClass": "news" } ] }, "clinical": { "score": 35, "summary": "A treating doctor can pull earlier ABHA-linked records only after the patient consents to each request. With about one linked record per account and no verified break-glass access, most clinicians still rely on what the patient brings.", "sources": [ { "title": "Ayushman Bharat Digital Mission: India's Digital Health Backbone (PIB)", "url": "https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/jul/doc202676912801.pdf", "date": "2026-07-06", "publisherClass": "official" }, { "title": "National Digital Health Mission: Health Data Management Policy (archived copy of abdm.gov.in PDF)", "url": "https://web.archive.org/web/2025id_/https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Affordable and Accessible Healthcare for All (PIB fact sheet)", "url": "https://www.pib.gov.in/FactsheetDetails.aspx?id=150834&ModuleId=16®=%203&lang=1", "date": "2026-08-12", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Research on anonymised or registry data can proceed without individual consent and there is no general opt-out, but an ethics committee must approve any consent waiver. Clinical trials need written informed consent, with video recording for vulnerable participants.", "sources": [ { "title": "The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY)", "url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf", "date": "2023-08-11", "publisherClass": "legal_text" }, { "title": "ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017", "url": "https://ethics.ncdirindia.org/asset/pdf/ICMR_National_Ethical_Guidelines.pdf", "date": "2017", "publisherClass": "official" }, { "title": "New Drugs and Clinical Trials Rules, 2019 (CDSCO)", "url": "https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2022/new_DC_rules/NEW%20DRUGS%20ANDctrS%20RULE,%202019.pdf", "date": "2019-03-19", "publisherClass": "legal_text" }, { "title": "Ayushman Bharat Digital Mission: India's Digital Health Backbone (PIB)", "url": "https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/jul/doc202676912801.pdf", "date": "2026-07-06", "publisherClass": "official" } ] }, "ai": { "score": 55, "summary": "AI medical software is a device under the binding Medical Devices Rules, 2017, and CDSCO's final July 2026 guidance adds change approval and drift monitoring. A binding human oversight rule was not verified, so the cell sits at the band floor.", "sources": [ { "title": "Guidance Document on Medical Device Software, CDSCO/MD/GD/MDSW/01/2026", "url": "https://cdsco.gov.in/opencms/export/sites/CDSCO_WEB/Pdf-documents/Guidance-document-on-Medical-Device-Software-under-MDR-2017.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "CDSCO releases final guidance document on Medical Device Software (Pharmabiz)", "url": "https://www.pharmabiz.com/NewsDetails.aspx?aid=187330&sid=1", "date": "2026-07-23", "publisherClass": "news" }, { "title": "Ayushman Bharat Digital Mission: India's Digital Health Backbone (PIB)", "url": "https://static.pib.gov.in/WriteReadData/specificdocs/documents/2026/jul/doc202676912801.pdf", "date": "2026-07-06", "publisherClass": "official" } ] } }, "laws": [ { "name": "Digital Personal Data Protection Act, 2023", "level": "National", "year": "2023", "what": "General data law: consent, summary access, breach notice, Rs 250 crore penalties; main duties start May 2027.", "url": "https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf" }, { "name": "Digital Personal Data Protection Rules, 2025", "level": "National", "year": "2025", "what": "Notified 13 Nov 2025; consent managers from Nov 2026, most duties from May 2027; research exemption standards.", "url": "https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf" }, { "name": "IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011", "level": "National", "year": "2011", "what": "Medical records are sensitive data; prior permission for disclosure; binds companies until May 2027.", "url": "https://prsindia.org/files/bills_acts/bills_parliament/2011/IT_Rules_2011.pdf" }, { "name": "Code of Medical Ethics Regulations, 2002", "level": "National", "year": "2002", "what": "Doctors must issue medical records within 72 hours of a patient request.", "url": "https://nmc.org.in/page/rules-regulations-rules-regulations-of-erstwhile-mci-code-of-medical-ethics-regulations-2002" }, { "name": "New Drugs and Clinical Trials Rules, 2019", "level": "National", "year": "2019", "what": "Written informed consent for all trials; audio-video consent recording for vulnerable subjects.", "url": "https://cdsco.gov.in/opencms/resources/UploadCDSCOWeb/2022/new_DC_rules/NEW%20DRUGS%20ANDctrS%20RULE,%202019.pdf" }, { "name": "Medical Devices Rules, 2017 (CDSCO software guidance, 2026)", "level": "National", "year": "2017", "what": "Software and AI/ML medical devices licensed by risk class; change approval and drift monitoring.", "url": "https://cdsco.gov.in/opencms/export/sites/CDSCO_WEB/Pdf-documents/Guidance-document-on-Medical-Device-Software-under-MDR-2017.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2024-10-11", "headline": "Health insurer confirms illegal access to customer records offered through chatbots", "paraphrase": "Records of more than 30 million customers, including ID images and claim documents, were offered through chatbots and later a website. The insurer acknowledged unauthorized and illegal access to certain data and obtained a court injunction.", "source": "The Register", "url": "https://www.theregister.com/2024/10/11/star_health_breach/", "theme": "breach", "status": "admitted" }, { "date": "2025-12-20", "headline": "Consumer commission orders hospital to hand over a senior citizen's discharge papers", "paraphrase": "A private hospital did not give a retired patient the discharge summary, case papers and receipts, so the insurance claim could not be filed. A district consumer commission ordered compensation and the papers supplied within one month.", "source": "Medical Dialogues", "url": "https://medicaldialogues.in/news/health/medico-legal/consumer-court-slaps-rs-60k-compensation-on-hospital-for-withholding-discharge-summary-from-covid-patient-161066", "theme": "access_refused", "status": "finding" }, { "date": "2026-08-03", "headline": "Hospital group tells police patient records were posted online without authorization", "paraphrase": "A hospital group's chief executive told police that patients' personal details and medical records, with staff data and internal documents, were posted on an outside website. The state cyber bureau registered a case and is investigating.", "source": "NewsMeter", "url": "https://newsmeter.in/hyderabad/healthcare-data-breach-tgcsb-registers-case-after-star-hospitals-patients-records-leaked-online-772895", "theme": "breach", "status": "alleged" }, { "date": "2025-04-07", "headline": "Researchers say a hospital chain left patient records and ID documents exposed online", "paraphrase": "Security researchers reported finding a file on a subsidiary website holding patient records, vaccination reports and identity documents. They told national cyber agencies; more than 60 days later the report saw no meaningful response and the chain had not replied.", "source": "Decode (BOOM)", "url": "https://www.decodeinternet.in/decode/hackers-may-have-stolen-patient-data-from-indias-largest-hospital-chain-28228", "theme": "breach", "status": "alleged" }, { "date": "2026-04-10", "headline": "Consumer commission orders hospitals to release a patient's complete records within 45 days", "paraphrase": "Two linked hospitals did not give a patient's family the complete medical records despite repeated requests. A district consumer commission ordered the full records, including consent forms and procedure details, within 45 days, with interest if late.", "source": "DT Next", "url": "https://www.dtnext.in/amp/story/news/chennai/consumer-panel-holds-hospital-group-liable-for-negligence-awards-rs-7-lakh-compensation", "theme": "access_refused", "status": "finding" } ] }, { "iso3": "KWT", "name": "Kuwait", "region": "Middle East", "overall": 45, "rank": "71=", "likelyRank": "53 to 94", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Kuwait's Salem app shows public-hospital results and prescriptions, but there is no general privacy law, no data regulator and no patient control over sharing.", "categories": { "access": { "score": 60, "summary": "Law 70 of 2020 gives patients a right to a medical report and copies of results, and the ministry's Salem app shows records, prescriptions, lab and radiology results from public hospitals. How many people use Salem was not verified.", "sources": [ { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Law No. 20 of 2014 Concerning Electronic Transactions, English text (KDIPA)", "url": "https://kdipa.gov.kw/wp-content/uploads/2022/08/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9-20-%D9%84%D8%B3%D9%86%D8%A9-2014-%D9%85%D8%AA%D8%B1%D8%AC%D9%85-%D8%A8%D8%A7%D9%84%D9%84%D8%BA%D8%A9-%D8%A7%D9%84%D8%A7%D9%86%D8%AC%D9%84%D9%8A%D8%B2%D9%8A%D8%A9.pdf", "date": "2022-08", "publisherClass": "legal_text" }, { "title": "Health ministry unveils 'Salem', a new app to replace 'Q8seha' (Kuwait Times)", "url": "https://kuwaittimes.com/article/36022/kuwait/other-news/health-ministry-unveils-salem-a-new-app-to-replace-q8seha/", "date": "2025-11-20", "publisherClass": "news" }, { "title": "MoH launches 'Salem' app to expand secure access to healthcare services (Arab Times)", "url": "https://www.arabtimesonline.com/news/moh-launches-salem-app-to-expand-secure-access-to-healthcare-services/", "date": "2025-11-20", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Law 70 lets the care team, facility administration and family share patient information as needed without asking, and no opt-out or patient-visible access log was found. The 2014 e-transactions law requires consent for disclosure, with many exceptions.", "sources": [ { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Law No. 20 of 2014 Concerning Electronic Transactions, English text (KDIPA)", "url": "https://kdipa.gov.kw/wp-content/uploads/2022/08/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9-20-%D9%84%D8%B3%D9%86%D8%A9-2014-%D9%85%D8%AA%D8%B1%D8%AC%D9%85-%D8%A8%D8%A7%D9%84%D9%84%D8%BA%D8%A9-%D8%A7%D9%84%D8%A7%D9%86%D8%AC%D9%84%D9%8A%D8%B2%D9%8A%D8%A9.pdf", "date": "2022-08", "publisherClass": "legal_text" } ] }, "privacy": { "score": 42, "summary": "Patient secrecy is a crime to breach under Law 70, with up to five years in prison and fines up to KWD 10,000. Kuwait has no general data protection law and no data protection authority, and the 2024 privacy regulation covers only telecom licensees.", "sources": [ { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Law No. 20 of 2014 Concerning Electronic Transactions, English text (KDIPA)", "url": "https://kdipa.gov.kw/wp-content/uploads/2022/08/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9-20-%D9%84%D8%B3%D9%86%D8%A9-2014-%D9%85%D8%AA%D8%B1%D8%AC%D9%85-%D8%A8%D8%A7%D9%84%D9%84%D8%BA%D8%A9-%D8%A7%D9%84%D8%A7%D9%86%D8%AC%D9%84%D9%8A%D8%B2%D9%8A%D8%A9.pdf", "date": "2022-08", "publisherClass": "legal_text" }, { "title": "Data protection laws in Kuwait (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=KW", "date": "2025-02-04", "publisherClass": "law_firm" }, { "title": "Data Protection and Privacy 2026: Kuwait (Chambers and Partners)", "url": "https://practiceguides.chambers.com/practice-guides/comparison/1129/18510/29027-29028-29029-29030-29031", "date": "2026-03-10", "publisherClass": "law_firm" } ] }, "journey": { "score": 50, "summary": "Salem brings more than 30 ministry systems and over 100 million records into one app, and primary care has used a national electronic record since 2000. Most public hospitals were not fully digital in 2024, and private-sector links were not verified.", "sources": [ { "title": "Physicians' use of and satisfaction with EHRs in Kuwait's public health care (JMIR Medical Informatics)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9587489/", "date": "2022-10-07", "publisherClass": "academic" }, { "title": "Kuwait Healthcare Sector Digital Transformation (US International Trade Administration)", "url": "https://www.trade.gov/market-intelligence/kuwait-healthcare-sector-digital-transformation", "date": "2024-09-20", "publisherClass": "official" }, { "title": "Health ministry unveils 'Salem', a new app to replace 'Q8seha' (Kuwait Times)", "url": "https://kuwaittimes.com/article/36022/kuwait/other-news/health-ministry-unveils-salem-a-new-app-to-replace-q8seha/", "date": "2025-11-20", "publisherClass": "news" }, { "title": "Al-Amiri Hospital reaches HIMSS EMRAM stage 6 (Al Jarida)", "url": "https://www.aljarida.com/article/146207/amp", "date": "2026-10-01", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "The e-transactions law bans using personal data beyond its collection purpose, but only criminal prosecution enforces it, with no data regulator. No rules on health data brokers, consumer health apps or sale of de-identified data were found.", "sources": [ { "title": "Law No. 20 of 2014 Concerning Electronic Transactions, English text (KDIPA)", "url": "https://kdipa.gov.kw/wp-content/uploads/2022/08/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9-20-%D9%84%D8%B3%D9%86%D8%A9-2014-%D9%85%D8%AA%D8%B1%D8%AC%D9%85-%D8%A8%D8%A7%D9%84%D9%84%D8%BA%D8%A9-%D8%A7%D9%84%D8%A7%D9%86%D8%AC%D9%84%D9%8A%D8%B2%D9%8A%D8%A9.pdf", "date": "2022-08", "publisherClass": "legal_text" }, { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Data protection laws in Kuwait (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=KW", "date": "2025-02-04", "publisherClass": "law_firm" } ] }, "clinical": { "score": 45, "summary": "Law 70 allows information exchange inside the treating team, and ministry facilities share national primary care and hospital systems. Whether a clinician can open a patient's full record from other hospitals or private clinics was not verified.", "sources": [ { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Kuwait Healthcare Sector Digital Transformation (US International Trade Administration)", "url": "https://www.trade.gov/market-intelligence/kuwait-healthcare-sector-digital-transformation", "date": "2024-09-20", "publisherClass": "official" }, { "title": "MoH launches 'Salem' app to expand secure access to healthcare services (Arab Times)", "url": "https://www.arabtimesonline.com/news/moh-launches-salem-app-to-expand-secure-access-to-healthcare-services/", "date": "2025-11-20", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Research on people needs prior written consent and a licence from a ministry-designated body under Law 70, backed by statutory secrecy and criminal penalties. Rules for research on existing records without consent were not verified, and there is no public register.", "sources": [ { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" }, { "title": "Data Protection and Privacy 2026: Kuwait (Chambers and Partners)", "url": "https://practiceguides.chambers.com/practice-guides/comparison/1129/18510/29027-29028-29029-29030-29031", "date": "2026-03-10", "publisherClass": "law_firm" } ] }, "ai": { "score": 42, "summary": "An August 2026 ministry guide bans relying only on AI for diagnosis, treatment or dosing, and bans entering patient data into unapproved AI tools. It is guidance for ministry staff, and no AI medical device rules with change control were verified.", "sources": [ { "title": "Administrative Decision 6189 of 2026 adopting the practical guide to AI language tools in health practice (Ministry of Health, via AMR)", "url": "https://www.amr.gov.kw/uploads/topics/17888485867775.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "MoH issues guide regulating AI use in healthcare (Kuwait Times)", "url": "https://kuwaittimes.com/article/47977/kuwait/other-news/moh-issues-guide-regulating-ai-use-in-healthcare/", "date": "2026-08-11", "publisherClass": "news" }, { "title": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights (Authority for Medical Responsibility)", "url": "https://www.amr.gov.kw/law70-2020", "date": "2020", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law No. 70 of 2020 on the Practice of Medicine and Patient Rights", "level": "National", "year": "2020", "what": "Patient file, right to reports and result copies, secrecy, research consent, AI use under ministry rules.", "url": "https://www.amr.gov.kw/law70-2020" }, { "name": "Law No. 20 of 2014 on Electronic Transactions", "level": "National", "year": "2014", "what": "Consent, purpose limits, access and correction for electronic personal data, including health status.", "url": "https://kdipa.gov.kw/wp-content/uploads/2022/08/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9-20-%D9%84%D8%B3%D9%86%D8%A9-2014-%D9%85%D8%AA%D8%B1%D8%AC%D9%85-%D8%A8%D8%A7%D9%84%D9%84%D8%BA%D8%A9-%D8%A7%D9%84%D8%A7%D9%86%D8%AC%D9%84%D9%8A%D8%B2%D9%8A%D8%A9.pdf" }, { "name": "CITRA Decision No. 26 of 2024 (Data Privacy Protection Regulation)", "level": "National", "year": "2024", "what": "Consent, breach notice and transfer disclosure duties for CITRA-licensed service providers only.", "url": "https://www.citra.gov.kw/sites/ar/Pages/DecisionsDetails.aspx?id=6" }, { "name": "Law No. 63 of 2015 on Combating Cyber Crimes", "level": "National", "year": "2015", "what": "Penalties for illegal access to or disclosure of personal or government data.", "url": "https://www.dlapiperdataprotection.com/?t=law&c=KW" }, { "name": "Ministry of Health Administrative Decision No. 6189 of 2026", "level": "National", "year": "2026", "what": "Guide for AI language tools in health practice; bans AI-only clinical decisions and unapproved tools.", "url": "https://www.amr.gov.kw/uploads/topics/17888485867775.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-10", "headline": "Appeals court fines a doctor for posting a patient's photo without consent", "paraphrase": "A doctor published a patient's photograph, linked to a procedure she had, on social media and advertising platforms without her consent. The Court of Appeals found this disclosed confidential medical information and imposed a fine.", "source": "Arab Times (Kuwait), citing Al-Seyassah", "url": "https://www.arabtimesonline.com/news/doctor-penalized-for-posting-patients-photo-without-consent-in-kuwait/", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-02-13", "headline": "Top court rules on a doctor publishing a patient's photos in a hospital magazine", "paraphrase": "A patient sought damages after a doctor published before-and-after photos in a hospital magazine. The appeal court found a confidentiality breach; the Court of Cassation held that patient consent, including implied consent, can lift the duty of secrecy.", "source": "Al-Jarida", "url": "https://www.aljarida.com/article/90133", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "MKD", "name": "North Macedonia", "region": "Europe", "overall": 45, "rank": "71=", "likelyRank": "52 to 93", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "North Macedonia has run one national e-health system since 2013, but the state controls it, patients see only part, and auditors found weak security.", "categories": { "access": { "score": 60, "summary": "Patients have a legal right to see their medical file, and the national Moe Zdravje app shows referrals, prescriptions and vaccinations. Copies cost the real price, usage was not verified, and the minister says full record access comes with an upgrade planned for 2028 to 2029.", "sources": [ { "title": "Закон за заштита на правата на пациентите, редакциски пречистен текст (LKM copy)", "url": "https://www.lkm.org.mk/upload/documents/stari/2012/zakon%20za%20zastita%20na%20pravata%20na%20pacientite.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Мое здравје: Вашиот дигитален партнер за здравствени услуги (Управа за електронско здравство)", "url": "https://e-health.gov.mk/moe-zdravje/", "date": "undated", "publisherClass": "official" }, { "title": "Moe Zdravje, App Store listing (seller: Ministry of Health)", "url": "https://apps.apple.com/us/app/moe-zdravje/id1585980981", "date": "undated", "publisherClass": "official" }, { "title": "Промовирана Стратегијата за дигитално здравство (Точка)", "url": "https://tocka.com.mk/vesti/571557/pacientite-nema-da-setaat-po-salteri-site-snimki-pregledi-i-terapii-na-uvid-kaj-lekarot-promovirana-strategijata-za-digitalno-zdravstvo", "date": "2026-09-21", "publisherClass": "news" } ] }, "control": { "score": 28, "summary": "The national record opens to any doctor during an exam, with no patient opt-out and no access history the patient can see. The Ministry and the Health Insurance Fund manage the data, and the 2026 strategy only plans a consent tool and access log.", "sources": [ { "title": "Закон за изменување и дополнување на Законот за евиденциите во областа на здравството, Службен весник 164/2013", "url": "https://portal.mdt.gov.mk/post-body-files/zakoni-zdravstvo-file-2qaz.pdf", "date": "2013-11-27", "publisherClass": "legal_text" }, { "title": "Мој Термин, Национален систем за електронски евиденции во здравството (Управа за електронско здравство)", "url": "https://e-health.gov.mk/moj-termin/", "date": "undated", "publisherClass": "official" }, { "title": "Промовирана Стратегијата за дигитално здравство (Точка)", "url": "https://tocka.com.mk/vesti/571557/pacientite-nema-da-setaat-po-salteri-site-snimki-pregledi-i-terapii-na-uvid-kaj-lekarot-promovirana-strategijata-za-digitalno-zdravstvo", "date": "2026-09-21", "publisherClass": "news" }, { "title": "„Мој Термин“ без континуирано одржување речиси 38% од времето, соопштение (Државен завод за ревизија)", "url": "https://dzr.mk/mk/260930-moj-termin-bez-kontinuirano-odrzhuvane-rechisi-38-od-vremeto-so-seriozni-rizici-za", "date": "2026-10-01", "publisherClass": "official" } ] }, "privacy": { "score": 42, "summary": "The 2020 law requires breach notice within 72 hours and allows fines up to 4% of turnover, but enforcement is weak. In October 2026 state auditors found no controls on user access in the national health system, and the EU says breaches are rising.", "sources": [ { "title": "Закон за заштита на личните податоци, консолидиран текст мај 2025 (Општина Гази Баба copy)", "url": "https://gazibaba.gov.mk/wp-content/uploads/2025/05/zakon-za-zastita-na-lichnite-podatoci-_-konsolidirana-verzija-maj-2025.pdf", "date": "2025-05", "publisherClass": "legal_text" }, { "title": "North Macedonia 2025 Report, SWD(2025) 753 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/267b368e-6b55-4a42-bb72-6395593de4da_en?filename=north-macedonia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "„Мој Термин“ без континуирано одржување речиси 38% од времето, соопштение (Државен завод за ревизија)", "url": "https://dzr.mk/mk/260930-moj-termin-bez-kontinuirano-odrzhuvane-rechisi-38-od-vremeto-so-seriozni-rizici-za", "date": "2026-10-01", "publisherClass": "official" } ] }, "journey": { "score": 52, "summary": "Moj Termin has linked e-referrals, e-prescriptions and appointments across all levels of care for more than ten years. The EU and the minister both say it does not exchange data with the Health Insurance Fund or public health registers.", "sources": [ { "title": "Закон за изменување и дополнување на Законот за евиденциите во областа на здравството, Службен весник 164/2013", "url": "https://portal.mdt.gov.mk/post-body-files/zakoni-zdravstvo-file-2qaz.pdf", "date": "2013-11-27", "publisherClass": "legal_text" }, { "title": "Мој Термин, Национален систем за електронски евиденции во здравството (Управа за електронско здравство)", "url": "https://e-health.gov.mk/moj-termin/", "date": "undated", "publisherClass": "official" }, { "title": "North Macedonia 2025 Report, SWD(2025) 753 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/267b368e-6b55-4a42-bb72-6395593de4da_en?filename=north-macedonia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Промовирана Стратегијата за дигитално здравство (Точка)", "url": "https://tocka.com.mk/vesti/571557/pacientite-nema-da-setaat-po-salteri-site-snimki-pregledi-i-terapii-na-uvid-kaj-lekarot-promovirana-strategijata-za-digitalno-zdravstvo", "date": "2026-09-21", "publisherClass": "news" } ] }, "commercial": { "score": 48, "summary": "Any direct marketing, including profiling, needs the person's prior explicit consent under the 2020 data protection law. No ban on selling health data was found, and auditors flagged private patient portals with look-alike names working outside the national system.", "sources": [ { "title": "Закон за заштита на личните податоци, консолидиран текст мај 2025 (Општина Гази Баба copy)", "url": "https://gazibaba.gov.mk/wp-content/uploads/2025/05/zakon-za-zastita-na-lichnite-podatoci-_-konsolidirana-verzija-maj-2025.pdf", "date": "2025-05", "publisherClass": "legal_text" }, { "title": "„Мој Термин“ без континуирано одржување речиси 38% од времето, соопштение (Државен завод за ревизија)", "url": "https://dzr.mk/mk/260930-moj-termin-bez-kontinuirano-odrzhuvane-rechisi-38-od-vremeto-so-seriozni-rizici-za", "date": "2026-10-01", "publisherClass": "official" } ] }, "clinical": { "score": 50, "summary": "Any treating doctor can open the national electronic record during an exam. The minister says private lab results, imaging from other hospitals and some prescriptions are often missing when the doctor decides, so the view is partial.", "sources": [ { "title": "Мој Термин, Национален систем за електронски евиденции во здравството (Управа за електронско здравство)", "url": "https://e-health.gov.mk/moj-termin/", "date": "undated", "publisherClass": "official" }, { "title": "Промовирана Стратегијата за дигитално здравство (Точка)", "url": "https://tocka.com.mk/vesti/571557/pacientite-nema-da-setaat-po-salteri-site-snimki-pregledi-i-terapii-na-uvid-kaj-lekarot-promovirana-strategijata-za-digitalno-zdravstvo", "date": "2026-09-21", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health data can be disclosed for research only if the patient cannot be identified, with no consent or opt-out for that reuse. Two safeguard classes count, statutory secrecy and fines, and research on patients needs written consent and ethics approval.", "sources": [ { "title": "Закон за заштита на правата на пациентите, редакциски пречистен текст (LKM copy)", "url": "https://www.lkm.org.mk/upload/documents/stari/2012/zakon%20za%20zastita%20na%20pravata%20na%20pacientite.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Закон за заштита на личните податоци, консолидиран текст мај 2025 (Општина Гази Баба copy)", "url": "https://gazibaba.gov.mk/wp-content/uploads/2025/05/zakon-za-zastita-na-lichnite-podatoci-_-konsolidirana-verzija-maj-2025.pdf", "date": "2025-05", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No rules for clinical AI were found, and the European Commission says medical device law is only partly aligned with EU rules. A national AI strategy is promised by the end of 2026, with a law on AI use under consideration.", "sources": [ { "title": "North Macedonia 2025 Report, SWD(2025) 753 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/267b368e-6b55-4a42-bb72-6395593de4da_en?filename=north-macedonia-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Андоновски: До крајот на годината очекуваме национална стратегија за вештачка интелигенција (Нова Македонија)", "url": "https://novamakedonija.com.mk/makedonija/andonovski-do-krajot-na-godinata-ochekuvame-nacionalna-strategija-za-veshtachka-inteligencija/", "date": "2026-09-17", "publisherClass": "news" }, { "title": "Здравство што го враќа пациентот во центарот на вниманието, колумна на Азир Алиу (Плусинфо)", "url": "https://plusinfo.mk/zdravstvo-shto-go-vra-a-pacientot-vo-centarot-na-vnimanieto/", "date": "2026-06-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law on Protection of Patients' Rights", "level": "National", "year": "2008", "what": "Right to inspect the medical file and buy copies; confidentiality; written consent and ethics approval for research.", "url": "https://www.lkm.org.mk/upload/documents/stari/2012/zakon%20za%20zastita%20na%20pravata%20na%20pacientite.pdf" }, { "name": "Law on Personal Data Protection (42/2020)", "level": "National", "year": "2020", "what": "GDPR-style law: health as special category, 72-hour breach notice, fines up to 4% of income.", "url": "https://gazibaba.gov.mk/wp-content/uploads/2025/05/zakon-za-zastita-na-lichnite-podatoci-_-konsolidirana-verzija-maj-2025.pdf" }, { "name": "Law amending the Law on Records in Health (164/2013)", "level": "National", "year": "2013", "what": "Creates the national electronic health records system, managed by the Ministry and Health Insurance Fund.", "url": "https://portal.mdt.gov.mk/post-body-files/zakoni-zdravstvo-file-2qaz.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-29", "headline": "Hospital fined after another person's health details were put in a patient's record", "paraphrase": "A referral was issued in a patient's name on a day she received no care, carrying someone else's health data. Further referrals and reports followed. The regulator fined the hospital, its director and the doctor; a court upheld it.", "source": "Агенција за заштита на личните податоци (AZLP), North Macedonia", "url": "https://azlp.mk/%d1%83%d0%bf%d1%80%d0%b0%d0%b2%d0%bd%d0%b8%d0%be%d1%82-%d1%81%d1%83%d0%b4-%d1%98%d0%b0-%d0%bf%d0%be%d1%82%d0%b2%d1%80%d0%b4%d0%b8-%d0%be%d0%b4%d0%bb%d1%83%d0%ba%d0%b0%d1%82%d0%b0-%d0%b7%d0%b0-%d0%b8/", "theme": "record_wrong", "status": "finding" }, { "date": "2025-05-07", "headline": "Patient refused care after a clinician read their electronic health record", "paraphrase": "A patient seeking urgent treatment saw a clinician who looked in the national electronic record, learned of a sensitive entry and refused even a basic exam. The patient has sued for discrimination; advocates say any doctor can see everything.", "source": "Призма (BIRN North Macedonia)", "url": "https://prizma.mk/dijagnoza-na-tsel-glas-koga-se-krshi-privatnosta-na-patsientite/", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-04-01", "headline": "Regulator finds public health body unprepared when ransomware locked patient data", "paraphrase": "A ransomware attack encrypted personal data held by a public health institution. On inspection the data protection regulator found the institution lacked proper technical and organisational safeguards and was poorly prepared to handle security incidents.", "source": "Агенција за заштита на личните податоци (AZLP), Annual Report 2025", "url": "https://azlp.mk/wp-content/uploads/2026/04/AZLP-Godisen-izvestaj-2025-%D0%9C%D0%9A.pdf", "theme": "breach", "status": "finding" } ] }, { "iso3": "PER", "name": "Peru", "region": "Americas", "overall": 45, "rank": "71=", "likelyRank": "53 to 96", "band": "Mixed", "keysModel": "Institutional", "confidence": "medium", "headline": "Peruvian law makes patients authorise who sees their electronic record and bans its commercial use, but the national record network is still fragmented.", "categories": { "access": { "score": 45, "summary": "Patients may request a complete copy of their record within five working days, but they pay for it. The social insurer's app shows past visits, prescriptions and tests to its members only, and no national patient portal was verified.", "sources": [ { "title": "Reglamento de la Ley 29414, Decreto Supremo 027-2015-SA (copy hosted by Pacifico Seguros)", "url": "https://www.pacifico.com.pe/documents/28730/100877/derechos+personas+usuarias+servicios+salud+reglamento+ley+29414.pdf/5f9f54f1-55cb-f91c-2e81-e3c1584e7166", "date": "2015", "publisherClass": "legal_text" }, { "title": "Solicitar copia de historia clinica en el Hospital Regional de Lambayeque (gob.pe)", "url": "https://www.gob.pe/63657-solicitar-copia-de-historia-clinica-en-el-hospital-regional-de-lambayeque", "date": "2024-05-15", "publisherClass": "official" }, { "title": "Consultar mis citas medicas, recetas y examenes pendientes a traves de EsSalud Mi Consulta (gob.pe)", "url": "https://www.gob.pe/66366-consultar-mis-citas-medicas-recetas-y-examenes-pendientes-a-traves-de-essalud-mi-consulta", "date": "2024-06-20", "publisherClass": "official" }, { "title": "Ley 31750, modifica los articulos 2 y 4 de la Ley 30024 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2180595-1", "date": "2023-05-24", "publisherClass": "legal_text" } ] }, "control": { "score": 44, "summary": "Ley 31750 says only professionals the patient has authorised may reach their record through the national register, and patients may flag sensitive data to restrict it. Whether these controls work in practice was not verified, and no patient-visible access log was found.", "sources": [ { "title": "Ley 31750, modifica los articulos 2 y 4 de la Ley 30024 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2180595-1", "date": "2023-05-24", "publisherClass": "legal_text" }, { "title": "Directiva Administrativa 373-MINSA/OGTI-2025, aprobada por RM 164-2025-MINSA (copy hosted by LP Derecho)", "url": "https://img.lpderecho.pe/wp-content/uploads/2025/03/Directiva-Administrativa-373-MINSA-OGTI-2025-LPDerecho.pdf", "date": "2025-03-11", "publisherClass": "legal_text" }, { "title": "Resolucion Ministerial 164-2025-MINSA (gob.pe)", "url": "https://www.gob.pe/institucion/minsa/normas-legales/6551375-164-2025-minsa", "date": "2025-03-11", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "Health data is sensitive under Ley 29733, and a 2024 regulation requires breach notice within 48 hours. The data authority sits inside the Justice Ministry with fines capped at 100 UIT, though the health regulator has fined a private clinic 125 UIT for a leak.", "sources": [ { "title": "Ley 29733, Ley de Proteccion de Datos Personales (gob.pe)", "url": "https://cdn.www.gob.pe/uploads/document/file/272360/Ley%20N%C2%BA%2029733.pdf.pdf?v=1618338779", "date": "2011-07-03", "publisherClass": "legal_text" }, { "title": "Decreto Supremo 016-2024-JUS, Reglamento de la Ley 29733 (copy hosted by LP Derecho)", "url": "https://img.lpderecho.pe/wp-content/uploads/2024/11/Decreto-Supremo-016-2024-JUS-LPDerecho.pdf", "date": "2024-11-30", "publisherClass": "legal_text" }, { "title": "Caso Shakira: SUSALUD impone multa de 125 UIT a la Clinica Delgado", "url": "https://www.gob.pe/institucion/susalud/noticias/1202063-caso-shakira-susalud-impone-multa-de-125-uit-a-la-clinica-delgado", "date": "2025-07-02", "publisherClass": "official" }, { "title": "Sancionan a la Clinica Delgado por entregar la historia clinica de Nadine Heredia a la fiscal", "url": "https://www.infobae.com/peru/2026/08/27/sancionan-a-la-clinica-delgado-por-entregar-la-historia-clinica-de-nadine-heredia-a-la-fiscal-geovana-mori/", "date": "2026-08-27", "publisherClass": "news" } ] }, "journey": { "score": 35, "summary": "In July 2026 the Health Ministry dropped its rule making its own record system mandatory in primary care, citing regional systems and gaps in equipment and connectivity. Linking systems now depends on accreditation to the national register, whose deadlines were extended 12 months in March 2026.", "sources": [ { "title": "Resolucion Ministerial 647-2026-MINSA (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2538183-1", "date": "2026-07-26", "publisherClass": "legal_text" }, { "title": "Minsa dispone uso obligatorio de historias clinicas electronicas en centros de salud de primer nivel de atencion (gob.pe)", "url": "https://www.gob.pe/institucion/minsa/noticias/1236934-minsa-dispone-uso-obligatorio-de-historias-clinicas-electronicas-en-centros-de-salud-de-primer-nivel-de-atencion", "date": "2025-08-30", "publisherClass": "official" }, { "title": "Resolucion Ministerial 188-2026-MINSA (gob.pe)", "url": "https://www.gob.pe/institucion/minsa/normas-legales/7845808-188-2026-minsa", "date": "2026-03-10", "publisherClass": "official" }, { "title": "Minsa da inicio a implementacion de la receta electronica nacional (gob.pe)", "url": "https://www.gob.pe/institucion/minsa/noticias/585503-minsa-da-inicio-a-implementacion-de-la-receta-electronica-nacional", "date": "2022-02-22", "publisherClass": "official" } ] }, "commercial": { "score": 55, "summary": "Article 3 of Ley 31750 bars public and private bodies from using electronic record information for commercial, financial or economic purposes. No rule on health apps, data brokers or health-based advertising outside the record was found.", "sources": [ { "title": "Ley 31750, modifica los articulos 2 y 4 de la Ley 30024 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2180595-1", "date": "2023-05-24", "publisherClass": "legal_text" }, { "title": "Minsa: Investigacion cientifica respetara derechos personales (El Peruano)", "url": "https://www.elperuano.pe/noticia/284038-minsa-investigacion-cientifica-respetara-derechos-personales", "date": "2025-11-30", "publisherClass": "news" }, { "title": "Decreto Supremo 016-2024-JUS, Reglamento de la Ley 29733 (copy hosted by LP Derecho)", "url": "https://img.lpderecho.pe/wp-content/uploads/2024/11/Decreto-Supremo-016-2024-JUS-LPDerecho.pdf", "date": "2024-11-30", "publisherClass": "legal_text" } ] }, "clinical": { "score": 34, "summary": "The law lets patient-authorised professionals see records from other facilities through the national register, with emergency access to basic data. National reach was not verified, and accreditation of record systems was pushed back in 2026.", "sources": [ { "title": "Ley 31750, modifica los articulos 2 y 4 de la Ley 30024 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2180595-1", "date": "2023-05-24", "publisherClass": "legal_text" }, { "title": "Directiva Administrativa 373-MINSA/OGTI-2025, aprobada por RM 164-2025-MINSA (copy hosted by LP Derecho)", "url": "https://img.lpderecho.pe/wp-content/uploads/2025/03/Directiva-Administrativa-373-MINSA-OGTI-2025-LPDerecho.pdf", "date": "2025-03-11", "publisherClass": "legal_text" }, { "title": "Resolucion Ministerial 647-2026-MINSA (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2538183-1", "date": "2026-07-26", "publisherClass": "legal_text" }, { "title": "EsSalud implementa historia clinica digital para atencion de asegurados", "url": "https://www.essalud.gob.pe/essalud-implementa-historia-clinica-digital-para-atencion-de-asegurados/", "date": "2019-03-19", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Academic researchers can obtain de-identified register data without patient consent, but only with a protocol approved by an INS-accredited ethics committee. The Ministry keeps the re-identification key and bans commercial use, and no opt-out was found.", "sources": [ { "title": "Minsa: Investigacion cientifica respetara derechos personales (El Peruano)", "url": "https://www.elperuano.pe/noticia/284038-minsa-investigacion-cientifica-respetara-derechos-personales", "date": "2025-11-30", "publisherClass": "news" }, { "title": "Ley 31750, modifica los articulos 2 y 4 de la Ley 30024 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2180595-1", "date": "2023-05-24", "publisherClass": "legal_text" }, { "title": "Reglamento de Ensayos Clinicos, Decreto Supremo 021-2017-SA (INS)", "url": "https://ensayosclinicos-repec.ins.gob.pe/images/Reglamento_de_EC.pdf", "date": "2017", "publisherClass": "legal_text" }, { "title": "Decreto Supremo 020-2025-SA, modifica el Reglamento de la Ley 30024 (gob.pe, scanned text)", "url": "https://www.gob.pe/institucion/minsa/normas-legales/7479922-020-2025-sa", "date": "2025-12-05", "publisherClass": "official" } ] }, "ai": { "score": 56, "summary": "The 2025 AI regulation classes AI that guides screening, diagnosis or treatment, or reads electronic health records, as high risk, requiring transparency and human oversight. Standalone software is a regulated medical device, but AI-specific change control was not verified.", "sources": [ { "title": "Decreto Supremo 115-2025-PCM, Reglamento de la Ley 31814 (El Peruano)", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2436426-1", "date": "2025-09-09", "publisherClass": "legal_text" }, { "title": "Decreto Supremo 003-2020-SA, dispositivos medicos (Actualidad Civil)", "url": "https://actualidadcivil.pe/normas-legales/decreto-supremo-003-2020-sa/0d159023-c38e-4ab7-84f4-5a1c45aa390d", "date": "2020-02-06", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Ley 29733, Ley de Proteccion de Datos Personales", "level": "National", "year": "2011", "what": "Health data sensitive; Justice Ministry is the authority; fines up to 100 UIT.", "url": "https://cdn.www.gob.pe/uploads/document/file/272360/Ley%20N%C2%BA%2029733.pdf.pdf?v=1618338779" }, { "name": "Decreto Supremo 016-2024-JUS (Reglamento de la Ley 29733)", "level": "National", "year": "2024", "what": "Written consent for sensitive data; breach notice to authority and person within 48 hours.", "url": "https://img.lpderecho.pe/wp-content/uploads/2024/11/Decreto-Supremo-016-2024-JUS-LPDerecho.pdf" }, { "name": "Ley 30024, Registro Nacional de Historias Clinicas Electronicas, as amended by Ley 31750", "level": "National", "year": "2013", "what": "National record register; patient-authorised access; de-identified research use; ban on commercial use.", "url": "https://www.gob.pe/institucion/minsa/normas-legales/240527-30024" }, { "name": "Decreto Supremo 027-2015-SA (Reglamento de la Ley 29414, derechos de usuarios de salud)", "level": "National", "year": "2015", "what": "Right to a complete record copy within five working days, at the patient's cost.", "url": "https://www.pacifico.com.pe/documents/28730/100877/derechos+personas+usuarias+servicios+salud+reglamento+ley+29414.pdf/5f9f54f1-55cb-f91c-2e81-e3c1584e7166" }, { "name": "Directiva Administrativa 373-MINSA/OGTI-2025 (RM 164-2025-MINSA)", "level": "National", "year": "2025", "what": "Accreditation of record systems to the register; patient consent and sensitive-data flags.", "url": "https://www.gob.pe/institucion/minsa/normas-legales/6551375-164-2025-minsa" }, { "name": "Decreto Supremo 115-2025-PCM (Reglamento de la Ley 31814, inteligencia artificial)", "level": "National", "year": "2025", "what": "Classes clinical and health-record AI as high risk; transparency and human oversight duties.", "url": "https://busquedas.elperuano.pe/dispositivo/NL/2436426-1" }, { "name": "Decreto Supremo 021-2017-SA (Reglamento de Ensayos Clinicos)", "level": "National", "year": "2017", "what": "Informed consent for trial participants; INS registry of trials and research centres.", "url": "https://ensayosclinicos-repec.ins.gob.pe/images/Reglamento_de_EC.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-27", "headline": "Regulator fines clinic for sending a patient's full record to prosecutors without consent", "paraphrase": "A clinic emailed a patient's complete record, covering about fifteen years, to prosecutors without her consent, her representative's approval or a court order. The national health regulator found this broke health law and fined the clinic.", "source": "La República", "url": "https://larepublica.pe/politica/2026/08/26/nadine-heredia-susalud-sanciona-a-clinica-delgado-por-entregar-historial-clinico-de-exprimera-dama-sin-autorizacion-a-fiscalia-hnews-499746", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-07-03", "headline": "Clinic fined after staff leaked an image of a patient's record online", "paraphrase": "A photo of a computer screen showing a hospitalised patient's record spread online. The national health regulator ruled the disclosure a grave breach of confidentiality and fined the clinic more than 668,000 soles; the clinic said it would appeal.", "source": "RPP Noticias", "url": "https://rpp.pe/economia/economia/te-aviso-te-anuncio-susalud-multa-a-clinica-delgado-por-filtrar-informacion-medica-de-shakira-noticia-1644481", "theme": "breach", "status": "finding" }, { "date": "2026-05-29", "headline": "Social security health service opens audit after a patient's record reached television", "paraphrase": "Details from a patient's record were broadcast on a television programme. The public health insurer issued a statement rejecting the leak and opened an internal audit to identify the people who breached its system and supplied the information.", "source": "La República", "url": "https://larepublica.pe/politica/2026/05/29/pedro-castillo-essalud-inicia-auditoria-por-filtracion-de-historia-clinica-del-expresidente-hnews-877540", "theme": "breach", "status": "admitted" }, { "date": "2025-09-28", "headline": "Investigation finds clinics and insurers using patients' health data without consent", "paraphrase": "Reporters found private clinics and health insurers collecting sensitive health and personal data without consent and using it beyond care. Misuse led to one patient's suspension from work and to marketing harassment; regulators fined the sector over four million soles.", "source": "OjoPúblico", "url": "https://ojo-publico.com/5923/clinicas-y-aseguradoras-recogen-datos-sin-consentimiento-pacientes", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "RUS", "name": "Russia", "region": "Europe", "overall": 45, "rank": "71=", "likelyRank": "54 to 97", "band": "Mixed", "keysModel": "State", "confidence": "medium", "headline": "Russians can see 32 types of medical documents on the state portal, but the state system decides how records flow and police access is broad.", "categories": { "access": { "score": 60, "summary": "Federal Law 323-FZ gives patients the right to see their records and get copies, including electronically. The Gosuslugi portal shows 32 types of electronic documents, but how many people use it and how complete it is were not verified.", "sources": [ { "title": "Article 22. Information about state of health, Federal Law 323-FZ (ConsultantPlus)", "url": "https://www.consultant.ru/document/cons_doc_LAW_121895/d2872d82b3b26ca307971f590ce02dd37f71cafc/", "date": "undated", "publisherClass": "legal_text" }, { "title": "32 types of electronic medical documents now shown on Gosuslugi (Kholmsk Central District Hospital)", "url": "https://kholmskcrb.gosuslugi.ru/novosti/vyvedeny-32-vida-elektronnyh-meditsinskih-dokumentov.html", "date": "2025-12-25", "publisherClass": "official" }, { "title": "New procedure and deadlines for providing medical documents approved (ConsultantPlus)", "url": "https://www.consultant.ru/law/hotdocs/64775.html", "date": "2020-09-25", "publisherClass": "legal_text" }, { "title": "Health Ministry prepares new procedure for keeping medical documentation (Medvestnik)", "url": "https://medvestnik.ru/content/news/minzdrav-rf-podgotovil-proekt-novogo-poryadka-vedeniya-medicinskoi-dokumentacii.html", "date": "2026-02-19", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Law 323-FZ lets clinics exchange records through state information systems for care without the patient's consent. The health regulator has said a patient's written refusal to send health data to the state system should be honoured, but no patient-visible access log was found.", "sources": [ { "title": "Article 13. Medical secrecy, Federal Law 323-FZ (SudAct)", "url": "https://sudact.ru/law/federalnyi-zakon-ot-21112011-n-323-fz-ob/glava-2/statia-13/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Is it legal to take a patient's refusal to send data to EGISZ? Roszdravnadzor's answer (Medrate)", "url": "https://medrate.ru/posts/zakonno-li-brat-s-pacienta-otkaz-ot-peredachi-dannyh-v-egisz-otvet-roszdravnadzora.html", "date": "2025-06-03", "publisherClass": "blog_vendor" }, { "title": "How to limit transfer of paid doctor visit data to EGISZ (Klerk)", "url": "https://www.klerk.ru/buh/news/696717/", "date": "2026-06-23", "publisherClass": "news" } ] }, "privacy": { "score": 34, "summary": "Health data is a special category, and since May 2025 leaking it can cost a firm 10 to 15 million rubles. The regulator is a government service, investigators can demand records without consent, and over a million medical records leaked in several 2026 months.", "sources": [ { "title": "Article 10. Special categories of personal data, Federal Law 152-FZ (Klerk legal database)", "url": "https://www.klerk.ru/cdoc/view/3b8e926083fc0bd01959f782189eeea9/stata-10-specialnye-kategorii-personalnyh-dannyh/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Personal data: new fines from 30 May 2025 (ConsultantPlus)", "url": "https://www.consultant.ru/legalnews/28492/", "date": "2025-05-30", "publisherClass": "legal_text" }, { "title": "Article 13. Medical secrecy, Federal Law 323-FZ (SudAct)", "url": "https://sudact.ru/law/federalnyi-zakon-ot-21112011-n-323-fz-ob/glava-2/statia-13/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Fraudsters keep publishing leaked medical data (CNews)", "url": "https://safe.cnews.ru/news/line/2026-07-03_perspektivnyj_monitoring", "date": "2026-07-03", "publisherClass": "news" } ] }, "journey": { "score": 55, "summary": "A single state system, EGISZ, has 18 subsystems including a federal electronic medical card and a register of electronic documents, and it exchanges data with compulsory insurance. Private clinics barely take part and e-prescriptions still stop at regional borders.", "sources": [ { "title": "Government Decree No. 140 of 9 February 2022 on EGISZ (Rossiyskaya Gazeta)", "url": "https://rg.ru/documents/2022/02/15/pravitelstvo-post140-site-dok.html", "date": "2022-02-15", "publisherClass": "legal_text" }, { "title": "Health Ministry prepares new procedure for keeping medical documentation (Medvestnik)", "url": "https://medvestnik.ru/content/news/minzdrav-rf-podgotovil-proekt-novogo-poryadka-vedeniya-medicinskoi-dokumentacii.html", "date": "2026-02-19", "publisherClass": "news" }, { "title": "Health Ministry proposes experiment on central accounting of e-prescriptions (Vademecum)", "url": "https://www.vademec.ru/news/2026/07/27/minzdrav-predlozhil-eksperiment-po-tsentralizovannomu-uchetu-elektronnykh-retseptov/", "date": "2026-07-27", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Commercial use of health data needs consent under the Personal Data Law, and the 2025 de-identified data rule excludes information restricted by law. Leaked clinic databases are sold, and drug makers sought access to state records in September 2026.", "sources": [ { "title": "Article 10. Special categories of personal data, Federal Law 152-FZ (Klerk legal database)", "url": "https://www.klerk.ru/cdoc/view/3b8e926083fc0bd01959f782189eeea9/stata-10-specialnye-kategorii-personalnyh-dannyh/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law 233-FZ and new de-identification rules from 1 September 2025 (Anti-Malware)", "url": "https://www.anti-malware.ru/analytics/Technology_Analysis/Depersonalization-of-personal-data-in-Russia-2025", "date": "2025-06-02", "publisherClass": "blog_vendor" }, { "title": "Pharma business proposes using Russians' de-identified medical data for new drugs (GxP News)", "url": "https://gxpnews.net/2026/09/farmbiznes-predlozhil-ispolzovat-obezlichennye-meddannye-rossiyan-radi-novyh-lekarstv/", "date": "2026-09-09", "publisherClass": "news" }, { "title": "Fraudsters keep publishing leaked medical data (CNews)", "url": "https://safe.cnews.ru/news/line/2026-07-03_perspektivnyj_monitoring", "date": "2026-07-03", "publisherClass": "news" } ] }, "clinical": { "score": 45, "summary": "The law lets clinics share records through information systems for care without consent, and a federal electronic medical card exists. Whether a treating doctor in practice sees records from other providers, especially private ones, was not verified.", "sources": [ { "title": "Article 13. Medical secrecy, Federal Law 323-FZ (SudAct)", "url": "https://sudact.ru/law/federalnyi-zakon-ot-21112011-n-323-fz-ob/glava-2/statia-13/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Government Decree No. 140 of 9 February 2022 on EGISZ (Rossiyskaya Gazeta)", "url": "https://rg.ru/documents/2022/02/15/pravitelstvo-post140-site-dok.html", "date": "2022-02-15", "publisherClass": "legal_text" } ] }, "research": { "score": 42, "summary": "Drug trial participants must sign written consent and can leave at any stage under Law 61-FZ. De-identified datasets from the federal electronic medical card have been offered to accredited AI developers since 2022 with no individual consent or opt-out found.", "sources": [ { "title": "Article 43. Rights of patients in clinical trials, Federal Law 61-FZ (ConsultantPlus)", "url": "https://www.consultant.ru/document/cons_doc_LAW_99350/9570de6d7195a78722b0b5efdcf4fa9a90c54557/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Ministry opens AI developers' access to datasets from electronic medical records (Medvestnik)", "url": "https://medvestnik.ru/content/news/Minzdrav-otkryl-razrabotchikam-iskusstvennogo-intellekta-dostup-k-datasetam-iz-elektronnyh-medkart.html", "date": "2022-11-25", "publisherClass": "news" } ] }, "ai": { "score": 55, "summary": "AI software in care is registered as a medical device in the highest risk class, and registered AI products must automatically report usage data to the regulator. Roszdravnadzor counted 59 domestic AI devices in August 2026; formal change control was not verified.", "sources": [ { "title": "AI law 243-FZ signed (ConsultantPlus)", "url": "https://www.consultant.ru/law/hotdocs/95007.html", "date": "2026-07-27", "publisherClass": "legal_text" }, { "title": "Developer of AI medical devices asks not to class them automatically as risk class 3 (ComNews)", "url": "https://www.comnews.ru/content/247569/2026-09-28/2026-w40/1007/razrabotchik-medizdeliy-iskusstvennym-intellektom-poprosil-ne-prichislyat-ikh-avtomaticheski-k-tretemu-klassu-riska", "date": "2026-09-28", "publisherClass": "news" }, { "title": "Procedure approved for automatic transfer of AI medical device data to Roszdravnadzor (Meditex)", "url": "https://meditex.ru/news_all/UtverzhdenporyadokavtomaticheskoyperedachidannykhomedizdeliyakhsIIvinformatsionnuyusistemuRoszdravna/", "date": "2025-10-23", "publisherClass": "blog_vendor" }, { "title": "Russia has registered 59 AI medical devices (Vedomosti)", "url": "https://www.vedomosti.ru/technology/news/2026/08/18/1221917-rossii-zaregistrirovali", "date": "2026-08-18", "publisherClass": "news" } ] } }, "laws": [ { "name": "Federal Law 323-FZ on the Basics of Protecting Citizens' Health", "level": "National", "year": "2011", "what": "Right to read records and get copies; medical secrecy with 11 listed exceptions, including police requests.", "url": "https://www.consultant.ru/document/cons_doc_LAW_121895/d2872d82b3b26ca307971f590ce02dd37f71cafc/" }, { "name": "Federal Law 152-FZ on Personal Data", "level": "National", "year": "2006", "what": "Health data is a special category; processing banned except listed cases such as medical care.", "url": "https://www.klerk.ru/cdoc/view/3b8e926083fc0bd01959f782189eeea9/stata-10-specialnye-kategorii-personalnyh-dannyh/" }, { "name": "Government Decree 140 on the Unified State Health Information System (EGISZ)", "level": "National", "year": "2022", "what": "Sets up EGISZ with 18 subsystems, including the federal electronic medical card and document register.", "url": "https://rg.ru/documents/2022/02/15/pravitelstvo-post140-site-dok.html" }, { "name": "Federal Law 61-FZ on Circulation of Medicines (Article 43)", "level": "National", "year": "2010", "what": "Voluntary, signed consent for drug trials and the right to withdraw at any stage.", "url": "https://www.consultant.ru/document/cons_doc_LAW_99350/9570de6d7195a78722b0b5efdcf4fa9a90c54557/" }, { "name": "Administrative Code amendments on personal data fines (Law 420-FZ)", "level": "National", "year": "2024", "what": "From 30 May 2025, fines up to 15 million rubles for health data leaks, turnover fines for repeats.", "url": "https://www.consultant.ru/legalnews/28492/" }, { "name": "Federal Law 243-FZ on Support for AI Technologies", "level": "National", "year": "2026", "what": "Defines sovereign and national AI models, state powers over AI and labelling of AI content, mostly from 1 September 2026.", "url": "https://www.consultant.ru/law/hotdocs/95007.html" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-17", "headline": "Hospital worker opened a patient's electronic record without cause, health ministry confirmed", "paraphrase": "A patient in the Bashkortostan region learned her former employer knew details from her medical file. The regional health ministry confirmed a worker at another hospital had accessed it unlawfully and dismissed him, but refused her the inspection file.", "source": "Пруфы", "url": "https://prufy.ru/news/society/188845-skandal_s_utechkoy_dannykh_v_pravitelstvennoy_bolnitse_ufy_doshel_do_sledstviya/", "theme": "breach", "status": "finding" }, { "date": "2026-04-22", "headline": "Inspection finds ambulance service head passed patients' data to outside parties", "paraphrase": "An unplanned inspection by the Vologda regional health ministry found that the head of an ambulance service had passed data on patients it carried to third parties. He was dismissed and the material was sent to oversight bodies.", "source": "Медвестник", "url": "https://medvestnik.ru/content/news/glavvracha-skoroi-pomoshi-vologdy-uvolili-za-utechku-dannyh-pacientov.html", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-08-21", "headline": "Court rules a patient cannot claim damages for false entries in his record", "paraphrase": "A man in the Astrakhan region found his record held a relative's history, entered when the relative was treated under his documents. Another hospital refused him care. The cassation court overturned his damages award, finding the error his own.", "source": "РАПСИ", "url": "https://rapsinews.ru/judicial_news/20250821/311095872.html", "theme": "record_wrong", "status": "finding" }, { "date": "2025-05-14", "headline": "Court upholds damages after a clinic lost a patient's record during a merger", "paraphrase": "In a review of court practice, a clinic could not produce a patient's record for expert review because it was not transferred when two clinics merged. Courts held the successor clinic responsible for keeping it and ordered compensation.", "source": "КонсультантПлюс", "url": "https://www.consultant.ru/legalnews/28446/", "theme": "lost_between_providers", "status": "finding" }, { "date": "2025-07-30", "headline": "Clinic network confirms hacker attack disrupted services; says no leak confirmed", "paraphrase": "Hackers broke into a private clinic network owned by an insurer, the company confirmed, alongside attacks on two pharmacy chains. Services were disrupted; the clinic said patient data leakage had not been confirmed.", "source": "Коммерсантъ", "url": "https://www.kommersant.ru/doc/7925020", "theme": "breach", "status": "admitted" } ] }, { "iso3": "BIH", "name": "Bosnia and Herzegovina", "region": "Europe", "overall": 44, "rank": "76=", "likelyRank": "56 to 99", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Bosnians gained GDPR-style data rights in October 2025, but health records are split between two entities, ten cantons and Brcko, with no countrywide e-health.", "categories": { "access": { "score": 50, "summary": "The 2025 data law gives a free first copy within 30 days, but Republika Srpska's health law still charges for copies. Official portals exist only in RS and Tuzla Canton, with user numbers not verified, so the score is 45, +5 free copy, +5 portals, -5 fee.", "sources": [ { "title": "Zakon o zastiti licnih podataka (Sl. glasnik BiH 12/25), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html", "date": "2025-02-28", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj zastiti Republike Srpske (Sl. glasnik RS 57/22, 62/25, 59/26), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-zastiti.html", "date": "2022", "publisherClass": "legal_text" }, { "title": "Aplikacija Moje zdravstvo omogucava uvid u zdravstveni karton i troskove lijecenja (FZO RS)", "url": "https://zdravstvo-srpske.org/2026/06/30/aplikacija-moje-zdravstvo-omogucava-uvid-u-zdravstveni-karton-i-troskove-lijecenja/", "date": "2026-06-30", "publisherClass": "official" }, { "title": "Pristupi svom zdravstvenom elektronskom kartonu (ZZO Tuzlanskog kantona)", "url": "https://zzotk.ba/pristupi-svom-zdravstvenom-elektronskom-kartonu/", "date": "2024-12-10", "publisherClass": "official" } ] }, "control": { "score": 32, "summary": "Records stay with institutions and, in Republika Srpska, IZIS limits access to staff treating the patient, which puts the score just above Albania's 30. No opt-out and no access log that patients can see was found in either entity.", "sources": [ { "title": "Zakon o zastiti licnih podataka (Sl. glasnik BiH 12/25), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html", "date": "2025-02-28", "publisherClass": "legal_text" }, { "title": "Zakon o pravima, obavezama i odgovornostima pacijenata (Sl. novine FBiH 40/10), Federal Ministry of Health copy", "url": "https://fmoh.gov.ba/uploads/files/Zakon_o_pravima_obavezama_i_odg_pacijenata_40-10.pdf", "date": "2010", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 57/22), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2022", "publisherClass": "legal_text" }, { "title": "Sta je IZIS? (FZO RS)", "url": "https://zdravstvo-srpske.org/izis/sta-je-izis/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 52, "summary": "The 2025 law is GDPR-based, with 72-hour breach notice and fines up to KM 40 million or 4% of turnover, and the agency has acted on health data. But public bodies cannot be fined, only their officials, and the EU says agency independence needs strengthening.", "sources": [ { "title": "Zakon o zastiti licnih podataka (Sl. glasnik BiH 12/25), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html", "date": "2025-02-28", "publisherClass": "legal_text" }, { "title": "AZLP rjesenje UP1 03-1-37-2-275-4/25: health findings given to a third party", "url": "https://azlp.ba/rjesenja/?id=4910", "date": "2025-10-03", "publisherClass": "official" }, { "title": "Bosnia and Herzegovina 2025 Report, SWD(2025) 751 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/5d8fc547-f8f8-456f-84e3-b38998acfafd_en?filename=bosnia-and-herzegovina-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "journey": { "score": 45, "summary": "Republika Srpska links contracted providers through IZIS, with e-referrals, e-prescriptions and one electronic record. The Federation runs separate cantonal systems, and the EU found no countrywide health information strategy and no e-health progress in 2025.", "sources": [ { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 57/22), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2022", "publisherClass": "legal_text" }, { "title": "Sta je IZIS? (FZO RS)", "url": "https://zdravstvo-srpske.org/izis/sta-je-izis/", "date": "undated", "publisherClass": "official" }, { "title": "E uputnica i e recept (FZO RS)", "url": "https://zdravstvo-srpske.org/izis/sta-je-izis/e-uputnica-i-e-recept/", "date": "undated", "publisherClass": "official" }, { "title": "Bosnia and Herzegovina 2025 Report, SWD(2025) 751 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/5d8fc547-f8f8-456f-84e3-b38998acfafd_en?filename=bosnia-and-herzegovina-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "commercial": { "score": 50, "summary": "Using health data needs explicit consent unless a legal ground applies, and people can object to direct marketing at any time. No specific ban on selling health data or rule for health apps was found.", "sources": [ { "title": "Zakon o zastiti licnih podataka (Sl. glasnik BiH 12/25), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html", "date": "2025-02-28", "publisherClass": "legal_text" }, { "title": "Zakon o pravima, obavezama i odgovornostima pacijenata (Sl. novine FBiH 40/10), Federal Ministry of Health copy", "url": "https://fmoh.gov.ba/uploads/files/Zakon_o_pravima_obavezama_i_odg_pacijenata_40-10.pdf", "date": "2010", "publisherClass": "legal_text" }, { "title": "Bosnia and Herzegovina 2025 Report, SWD(2025) 751 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/5d8fc547-f8f8-456f-84e3-b38998acfafd_en?filename=bosnia-and-herzegovina-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] }, "clinical": { "score": 42, "summary": "In Republika Srpska, doctors at any level, including emergency and hospital staff, can see the shared electronic record within their access rights. In the Federation, sharing depends on the canton, and no link between the entities was found.", "sources": [ { "title": "Elektronski zdravstveni karton (FZO RS)", "url": "https://zdravstvo-srpske.org/izis/sta-je-izis/elektronski-zdravstveni-karton/", "date": "undated", "publisherClass": "official" }, { "title": "Zakon o zdravstvenoj zastiti Republike Srpske (Sl. glasnik RS 57/22, 62/25, 59/26), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-zastiti.html", "date": "2022", "publisherClass": "legal_text" }, { "title": "Zakon o pravima, obavezama i odgovornostima pacijenata (Sl. novine FBiH 40/10), Federal Ministry of Health copy", "url": "https://fmoh.gov.ba/uploads/files/Zakon_o_pravima_obavezama_i_odg_pacijenata_40-10.pdf", "date": "2010", "publisherClass": "legal_text" } ] }, "research": { "score": 49, "summary": "The 2025 data law allows research use of health data under a special law with safeguards, with no general opt-out. Three safeguard classes count (statutory secrecy, fines up to KM 40 million, a Federation consent route), so the score is 40 plus 9.", "sources": [ { "title": "Zakon o zastiti licnih podataka (Sl. glasnik BiH 12/25), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html", "date": "2025-02-28", "publisherClass": "legal_text" }, { "title": "Zakon o pravima, obavezama i odgovornostima pacijenata (Sl. novine FBiH 40/10), Federal Ministry of Health copy", "url": "https://fmoh.gov.ba/uploads/files/Zakon_o_pravima_obavezama_i_odg_pacijenata_40-10.pdf", "date": "2010", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj dokumentaciji i evidencijama u oblasti zdravstva (Sl. glasnik RS 57/22), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html", "date": "2022", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj zastiti Republike Srpske (Sl. glasnik RS 57/22, 62/25, 59/26), Paragraf copy", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-zastiti.html", "date": "2022", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No clinical AI rules or guidance were found. The 2008 medicines and devices law covers software as a medical device, but the EU found no progress on aligning device rules and asked Bosnia to align with the AI Act.", "sources": [ { "title": "Zakon o lijekovima i medicinskim sredstvima (Sl. glasnik BiH 58/08), Paragraf copy", "url": "https://www.paragraf.ba/propisi/bih/zakon-o-lijekovima-i-medicinskim-sredstvima.html", "date": "2008", "publisherClass": "legal_text" }, { "title": "Bosnia and Herzegovina 2025 Report, SWD(2025) 751 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/5d8fc547-f8f8-456f-84e3-b38998acfafd_en?filename=bosnia-and-herzegovina-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Simpozij u Mostaru: Umjetna inteligencija treba ostati alat, a lijecnici kljucni donositelji odluka (HIP)", "url": "https://hip.ba/2026/04/10/simpozij-u-mostaru-umjetna-inteligencija-treba-ostati-alat-a-lijecnici-kljucni-donositelji-odluka/", "date": "2026-04-10", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law on Personal Data Protection (Official Gazette of BiH 12/25)", "level": "National", "year": "2025", "what": "GDPR-based law: health as special data, free access in 30 days, 72-hour breach notice, high fines.", "url": "https://www.paragraf.ba/propisi/bih/novi-zakon-o-zastiti-licnih-podataka.html" }, { "name": "Law on Rights, Obligations and Responsibilities of Patients (FBiH 40/10)", "level": "State/Provincial", "year": "2010", "what": "Federation patients' rights: record access and transcript, confidentiality, consent for research and trials.", "url": "https://fmoh.gov.ba/uploads/files/Zakon_o_pravima_obavezama_i_odg_pacijenata_40-10.pdf" }, { "name": "Health Care Law of Republika Srpska (57/22)", "level": "State/Provincial", "year": "2022", "what": "RS patient rights including record access, copies at patient cost, online record access; referrals via IZIS.", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-zastiti.html" }, { "name": "Law on Health Documentation and Records in Health Care (RS 57/22)", "level": "State/Provincial", "year": "2022", "what": "Sets up IZIS: electronic record, medical summary, e-prescription, e-referral; providers must connect.", "url": "https://www.paragraf.ba/propisi/republika-srpska/zakon-o-zdravstvenoj-dokumentaciji-i-evidencijama-u-oblasti-zdravstva.html" }, { "name": "Law on Medicines and Medical Devices (Official Gazette of BiH 58/08)", "level": "National", "year": "2008", "what": "Regulates medicines and medical devices, including software, through the national medicines agency.", "url": "https://www.paragraf.ba/propisi/bih/zakon-o-lijekovima-i-medicinskim-sredstvima.html" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-08-11", "headline": "Ombudsman tells health centre to answer a request to correct a record", "paraphrase": "A patient asked a public health centre to amend her health record and heard nothing for two years. The ombudsman found no formal decision had been made and told the centre to decide at once.", "source": "Institucija ombudsmena za ljudska prava Bosne i Hercegovine", "url": "https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3633&lang=BS", "theme": "record_wrong", "status": "finding" }, { "date": "2025-03-17", "headline": "Patient asking to move a health file is told months later none exists", "paraphrase": "A patient asked a public health centre to transfer his file to another clinic. Two months later he was told he had no file there. The ombudsman told the centre to open one and explain his options.", "source": "Institucija ombudsmena za ljudska prava Bosne i Hercegovine", "url": "https://www.ombudsmen.gov.ba/Novost.aspx?newsid=3412&lang=BS", "theme": "lost_between_providers", "status": "finding" }, { "date": "2025-11-07", "headline": "Private clinic closes without notice, leaving patients unable to move their care", "paraphrase": "A private clinic shut without telling patients. Health inspectors reported faults in how it kept patient files, and a patient trying to move to another clinic was refused because no one was left to sign the paperwork.", "source": "Radio Slobodna Evropa", "url": "https://www.slobodnaevropa.org/a/klinika-sarajevo-zatvaranje-vantjelesna-oplodnja-embriji/33583274.html", "theme": "lost_between_providers", "status": "finding" } ] }, { "iso3": "MNE", "name": "Montenegro", "region": "Europe", "overall": 44, "rank": "76=", "likelyRank": "56 to 99", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Montenegrins see prescriptions and lab results online, but the 2026 central record still awaits the agency meant to run it, and patients cannot limit sharing.", "categories": { "access": { "score": 60, "summary": "The 2010 patient rights law gives a right to see and copy the record, at the patient's cost and with no deadline. The eZdravlje portal shows prescriptions and primary care lab results but not hospital letters, so the score sits at the bottom of its band.", "sources": [ { "title": "Zakon o pravima pacijenata (Sl. list CG 40/10, 40/11), Paragraf Lex", "url": "https://www.paragraf.me/propisi-crnegore/zakon-o-pravima-pacijenata.html", "date": "2010", "publisherClass": "legal_text" }, { "title": "Portal eZdravlje (Fond za zdravstveno osiguranje Crne Gore)", "url": "https://www.ezdravlje.me/home/", "date": "undated", "publisherClass": "official" }, { "title": "FZO: Digitalna platforma eZdravlje ima 318 675 registrovanih korisnika (Facebook)", "url": "https://www.facebook.com/fzocg/videos/-digitalna-platforma-ezdravlje-koju-je-fzo-razvio-za-gra%C4%91ane-danas-ima-318-675-r/580374520692718/", "date": "undated", "publisherClass": "official" }, { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" } ] }, "control": { "score": 28, "summary": "By law, record data flows automatically into a central record held by the Ministry of Health, and treating clinicians may open it. No opt-out, no patient restriction tool and no access log visible to patients was found.", "sources": [ { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" }, { "title": "Zakon o zastiti podataka o licnosti, preciscen tekst (AZLP)", "url": "https://www.azlp.me/storage/docs/zajednicka/zakoni/Zakon%20o%20zastiti%20podataka%20o%20licnosti%20-2024.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Zakon o pravima pacijenata (Sl. list CG 40/10, 40/11), Paragraf Lex", "url": "https://www.paragraf.me/propisi-crnegore/zakon-o-pravima-pacijenata.html", "date": "2010", "publisherClass": "legal_text" } ] }, "privacy": { "score": 40, "summary": "The 2008 data protection law, which the European Commission says is not EU-aligned, caps fines at EUR 20,000. In 2025 the Ombudsman found the main hospital leaked a journalist's medical report and its system could not show who printed it.", "sources": [ { "title": "Zakon o zastiti podataka o licnosti, preciscen tekst (AZLP)", "url": "https://www.azlp.me/storage/docs/zajednicka/zakoni/Zakon%20o%20zastiti%20podataka%20o%20licnosti%20-2024.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Montenegro Report 2025, SWD(2025) 754 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/9ae69ea7-81d6-4d6a-a204-bd32a379d51d_en?filename=montenegro-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Misljenje i preporuke Zastitnika ljudskih prava, br. 01-253/25 (Klinicki centar Crne Gore)", "url": "https://www.ombudsman.co.me/docs/1749984500_270525_preporuka_kccg.pdf", "date": "2025-05-27", "publisherClass": "official" }, { "title": "Predlog Zakona o zastiti podataka o licnosti (Vlada Crne Gore)", "url": "https://wapi.gov.me/download/e260f5f6-b6d3-4c50-9e87-54135a8ea986?version=1.0", "date": "2026-08-10", "publisherClass": "legal_text" } ] }, "journey": { "score": 50, "summary": "An insurer-run system links health centres, pharmacies, general hospitals and the public health institute, and paper prescriptions are no longer used. The main hospital is only partly linked, and the central record and IZIS duties in the 2025 and 2026 laws are still being phased in.", "sources": [ { "title": "Strategija razvoja zdravstva za period 2023-2027 (Ministarstvo zdravlja)", "url": "https://wapi.gov.me/download/2414cd07-7fce-41bd-9df1-11eeaba307e7?version=1.0", "date": "2023", "publisherClass": "official" }, { "title": "Izvjestaj IV o realizaciji preporuka, revizija IZIS (Drzavna revizorska institucija)", "url": "https://www.dri.co.me/doc/Izvje%C5%A1taj%20o%20realizaciji%20preporuka%20datih%20u%20Izvje%C5%A1taju%20o%20reviziji%20Integralnog%20zdravstvenog%20informacionog%20sistema(IZIS)%20-%20Zakazivanje%20ljekarskih%20pregleda%20kroz%20zdravstveni%20sistem%20-%20Izvje%C5%A1taj%20IV.pdf", "date": "2026-06-11", "publisherClass": "official" }, { "title": "Zakon o zdravstvenoj zastiti 2025 (KCCG copy)", "url": "https://www.kccg.me/wp-content/uploads/2025/08/Zakon-o-zdravstvenon-zastiti-2025.pdf", "date": "2025-08-01", "publisherClass": "legal_text" }, { "title": "Vlada osniva Agenciju za digitalno zdravlje (CdM)", "url": "https://www.cdm.me/drustvo/vlada-osniva-agenciju-za-digitalno-zdravlje-koje-ce-poslove-obavljati/", "date": "2026-09-11", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Using health data for direct marketing needs the person's consent, but fines top out at EUR 20,000. The 2026 digital health law lets third parties use pseudonymised health data for development and AI work without consent, and no ban on selling health data was found.", "sources": [ { "title": "Zakon o zastiti podataka o licnosti, preciscen tekst (AZLP)", "url": "https://www.azlp.me/storage/docs/zajednicka/zakoni/Zakon%20o%20zastiti%20podataka%20o%20licnosti%20-2024.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" } ] }, "clinical": { "score": 42, "summary": "Family doctors now receive the main hospital's discharge letters, but some specialist reports still fail to arrive. The 2026 law gives treating clinicians access to a central record, yet the agency meant to run it was only proposed in September 2026.", "sources": [ { "title": "Izvjestaj IV o realizaciji preporuka, revizija IZIS (Drzavna revizorska institucija)", "url": "https://www.dri.co.me/doc/Izvje%C5%A1taj%20o%20realizaciji%20preporuka%20datih%20u%20Izvje%C5%A1taju%20o%20reviziji%20Integralnog%20zdravstvenog%20informacionog%20sistema(IZIS)%20-%20Zakazivanje%20ljekarskih%20pregleda%20kroz%20zdravstveni%20sistem%20-%20Izvje%C5%A1taj%20IV.pdf", "date": "2026-06-11", "publisherClass": "official" }, { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" }, { "title": "Vlada osniva Agenciju za digitalno zdravlje (CdM)", "url": "https://www.cdm.me/drustvo/vlada-osniva-agenciju-za-digitalno-zdravlje-koje-ce-poslove-obavljati/", "date": "2026-09-11", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "The 2026 law allows research use of pseudonymised or anonymised health data without consent and without an opt-out. Three safeguards count: an ethics committee opinion, a consent route for identifiable data, and statutory professional secrecy.", "sources": [ { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" }, { "title": "Zakon o zdravstvenoj zastiti 2025 (KCCG copy)", "url": "https://www.kccg.me/wp-content/uploads/2025/08/Zakon-o-zdravstvenon-zastiti-2025.pdf", "date": "2025-08-01", "publisherClass": "legal_text" }, { "title": "Zakon o pravima pacijenata (Sl. list CG 40/10, 40/11), Paragraf Lex", "url": "https://www.paragraf.me/propisi-crnegore/zakon-o-pravima-pacijenata.html", "date": "2010", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "The 2026 digital health law binds health AI to be safe, reliable and unbiased, and the 2019 device law covers software. That binding principle puts it at the top of the guidance band; AI change control and human oversight rules were not verified.", "sources": [ { "title": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026), Skupstina Crne Gore", "url": "https://zakoni.skupstina.me/zakoni/web/dokumenta/zakoni-i-drugi-akti/832/3998-23744-28-2-26-2-4.pdf", "date": "2026-03-02", "publisherClass": "legal_text" }, { "title": "Zakon o medicinskim sredstvima (Sl. list CG 24/19), FZO copy", "url": "https://fzocg.me/wp-content/uploads/2023/04/3.Zakon-o-medicinskim-sredstvima.pdf", "date": "2019-04-22", "publisherClass": "legal_text" }, { "title": "Montenegro Report 2025, SWD(2025) 754 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/9ae69ea7-81d6-4d6a-a204-bd32a379d51d_en?filename=montenegro-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Zakon o upravljanju podacima u oblasti zdravstva i digitalnom zdravlju (Sl. list CG 31/2026)", "level": "National", "year": "2026", "what": "Creates central EZK, IZIS duties, Digital Health Agency, pseudonymised secondary use and health AI principles.", "url": "https://www.sluzbenilist.me/propisi/391488" }, { "name": "Zakon o pravima pacijenata (Sl. list CG 40/10, 40/11)", "level": "National", "year": "2010", "what": "Right to view and copy records at own cost; written, revocable consent for research.", "url": "https://www.gov.me/clanak/zakon-o-pravima-pacijenata" }, { "name": "Zakon o zdravstvenoj zastiti (2025)", "level": "National", "year": "2025", "what": "Electronic records in IZIS, professional secrecy; IZIS articles apply two years after entry into force.", "url": "https://www.kccg.me/wp-content/uploads/2025/08/Zakon-o-zdravstvenon-zastiti-2025.pdf" }, { "name": "Zakon o zastiti podataka o licnosti (Sl. list CG 79/08, as amended to 77/24)", "level": "National", "year": "2008", "what": "Health is special-category data; consent for marketing; fines EUR 500 to 20,000.", "url": "https://www.azlp.me/storage/docs/zajednicka/zakoni/Zakon%20o%20zastiti%20podataka%20o%20licnosti%20-2024.pdf" }, { "name": "Zakon o zastiti podataka o licnosti (adopted September 2026)", "level": "National", "year": "2026", "what": "GDPR-aligned replacement; applies six months after entry into force; final text not verified.", "url": "https://wapi.gov.me/download/e260f5f6-b6d3-4c50-9e87-54135a8ea986?version=1.0" }, { "name": "Zakon o medicinskim sredstvima (Sl. list CG 24/19)", "level": "National", "year": "2019", "what": "Software counts as a medical device; registration, change notice and vigilance.", "url": "https://fzocg.me/wp-content/uploads/2023/04/3.Zakon-o-medicinskim-sredstvima.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-10-31", "headline": "Ombudsman holds hospital responsible after a patient's medical report surfaced in court", "paraphrase": "A specialist's report on a patient was printed from the hospital system using an absent doctor's login and read aloud in a public trial. The ombudsman found the hospital responsible for failing to protect the data.", "source": "Portal ETV (from Pobjeda)", "url": "https://etv.me/drustvo/kccg-uveo-ugovore-o-tajnosti-advokatu-micovicu-odgovornost-ne-traze", "theme": "breach", "status": "finding" }, { "date": "2026-09-24", "headline": "Regulator orders hospital to stop filming patients in waiting areas and delete footage", "paraphrase": "After an anonymous complaint, the data protection agency inspected a hospital and found cameras covering areas where patients wait. It ordered one camera redirected or masked and the unlawful recordings deleted; the hospital reported compliance.", "source": "CdM", "url": "https://www.cdm.me/drustvo/agencija-utvrdila-nepravilnosti-u-kbc-berane-zbog-video-nadzora/", "theme": "other", "status": "finding" }, { "date": "2026-07-06", "headline": "National health record system down for days, patients unable to view results online", "paraphrase": "Patients reported that the national health information system and the eHealth portal were unavailable for several days, so results could not be checked online and prescriptions were issued on paper. The ministry confirmed temporary technical problems.", "source": "Portal 24kroz7 (from Dan)", "url": "https://24kroz7.com/drustvo/krah-zdravstvenog-sistema-crna-gora-danima-bila-bez-elektronskih-recepata-i-uputa/", "theme": "access_delay_or_cost", "status": "admitted" }, { "date": "2026-04-27", "headline": "Patient says a third party learned details of her treatment from a clinic", "paraphrase": "A patient complained that an outsider obtained exact details of her care from a public health centre. The data protection agency could not confirm a leak because staff denied it; she received no sign of an internal inquiry.", "source": "Standard (from Pobjeda)", "url": "https://standard.co.me/drustvo/tisina-koja-kosta-pola-miliona-zastarjeli-zakoni-ne-prate-razvoj-tehnologija", "theme": "breach", "status": "alleged" }, { "date": "2025-10-25", "headline": "Hospital says no staff disciplined over patient data leaks, adds confidentiality contracts", "paraphrase": "Asked by a newspaper, the hospital said no employee had been held responsible for recent leaks of patients' health information. It said all staff must now sign confidentiality contracts to stop disclosures to third parties.", "source": "Vijesti", "url": "https://www.vijesti.me/vijesti/drustvo/780421/klinicki-bez-flastera-za-curenje-podataka-do-javnosti-stizu-dijagnoze-ali-broj-disciplinskih-postupaka-zanemarljiv", "theme": "breach", "status": "admitted" } ] }, { "iso3": "PAN", "name": "Panama", "region": "Americas", "overall": 44, "rank": "76=", "likelyRank": "55 to 98", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Panama's laws give patients free, fast access to their data, but records stay split between the Health Ministry, the Social Security Fund and private providers.", "categories": { "access": { "score": 50, "summary": "Ley 68 gives patients the right to know all information about their health, and Ley 81 makes data requests free with a 10 business day deadline. There is no national portal; the Social Security Fund shows only 12 months of lab results online.", "sources": [ { "title": "Ley 68 de 2003, derechos y obligaciones de los pacientes (Hospital Santo Tomas copy)", "url": "https://www.hospitalsantotomas.gob.pa/download/transparencia/otros_documentos_y_normas/9.6.0-LEY-68-DERECHOS-PACIENTE.pdf", "date": "2003-11-25", "publisherClass": "legal_text" }, { "title": "Ley 81 de 2019, sobre proteccion de datos personales (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf", "date": "2019-03-29", "publisherClass": "legal_text" }, { "title": "Decreto Ejecutivo 285 de 2021, reglamenta la Ley 81 (SIJUSA copy)", "url": "https://www.sijusa.com/wp-content/uploads/2022/04/DE_285_2021.pdf", "date": "2021-05-28", "publisherClass": "legal_text" }, { "title": "Mi Caja Digital: asegurados podran ver resultados de laboratorio en linea (TVN)", "url": "https://www.tvn-2.com/nacionales/caja-digital-ahora-puedes-ver-laboratorios-en-linea_1_2233213.html", "date": "2026-03-24", "publisherClass": "news" } ] }, "control": { "score": 32, "summary": "Ley 68 says nobody may see a person's health data without authorisation unless the law allows it, but the same law opens the record to every clinician treating the patient at that centre. No opt-out from record sharing and no patient-visible access log was found.", "sources": [ { "title": "Ley 68 de 2003, derechos y obligaciones de los pacientes (Hospital Santo Tomas copy)", "url": "https://www.hospitalsantotomas.gob.pa/download/transparencia/otros_documentos_y_normas/9.6.0-LEY-68-DERECHOS-PACIENTE.pdf", "date": "2003-11-25", "publisherClass": "legal_text" }, { "title": "Ley 81 de 2019, sobre proteccion de datos personales (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf", "date": "2019-03-29", "publisherClass": "legal_text" }, { "title": "Decreto Ejecutivo 285 de 2021, reglamenta la Ley 81 (SIJUSA copy)", "url": "https://www.sijusa.com/wp-content/uploads/2022/04/DE_285_2021.pdf", "date": "2021-05-28", "publisherClass": "legal_text" } ] }, "privacy": { "score": 48, "summary": "Ley 81 treats health data as sensitive and requires breach notice within 72 hours, but fines run only from B/.1,000 to B/.10,000. The regulator ANTAI fined a plastic surgery clinic B/.8,000 in 2023 for posting a patient's photos without consent.", "sources": [ { "title": "Ley 81 de 2019, sobre proteccion de datos personales (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf", "date": "2019-03-29", "publisherClass": "legal_text" }, { "title": "Comunicado: ANTAI sanciona a clinica de cirugia plastica (ANTAI)", "url": "https://antai.gob.pa/comunicado-7/", "date": "2023-07-17", "publisherClass": "official" }, { "title": "Comunicado sobre acceso no autorizado al SIMEPLANS (Ministerio de Salud)", "url": "https://www.minsa.gob.pa/noticia/comunicado-153", "date": "2025-09-25", "publisherClass": "official" }, { "title": "Caja de Seguro Social desmiente hackeo y denuncia campana de desinformacion (TVN)", "url": "https://www.tvn-2.com/nacionales/caja-seguro-social-desmiente-hackeo-denuncia-campana-de-desinformacion_1_2250093.html", "date": "2026-07-08", "publisherClass": "news" } ] }, "journey": { "score": 45, "summary": "MINSA's electronic record (SEIS) ran in 195 facilities with 3 million patients enrolled by January 2024, while the CSS runs its own system. A merger of the two networks, including one shared record, began in 2026 and is planned to take about two years.", "sources": [ { "title": "Expediente electronico SEIS y digitalizacion de sistemas de salud (Ministerio de Salud)", "url": "https://www.minsa.gob.pa/noticia/expediente-electronico-seis-y-digitalizacion-de-sistemas-de-salud-para-mejorar-la-cobertura", "date": "2024-01-18", "publisherClass": "official" }, { "title": "El plan de integracion Minsa-CSS en atencion esta trazado y tomara dos anos (La Prensa)", "url": "https://www.prensa.com/sociedad/el-plan-de-integracion-minsa-css-en-atencion-esta-trazado-y-tomara-dos-anos/", "date": "2025-12-16", "publisherClass": "news" }, { "title": "CSS: Nuevo Expediente Clinico Electronico busca agilizar citas (Telemetro)", "url": "https://www.telemetro.com/nacionales/css-nuevo-expediente-clinico-electronico-busca-agilizar-citas-y-mejorar-la-atencion-n6082426", "date": "2026-06-17", "publisherClass": "news" }, { "title": "CSS suma 250 medicos privados a Mi Receta Digital (Telemetro)", "url": "https://www.telemetro.com/nacionales/css-suma-250-medicos-privados-mi-receta-digital-n6079698", "date": "2026-05-19", "publisherClass": "news" } ] }, "commercial": { "score": 52, "summary": "Health data needs express consent under Ley 81 and cannot be transferred without explicit authorisation, and ANTAI has punished a clinic for using patient photos in advertising. No specific rule on health data sales, data brokers or de-identified data markets was found.", "sources": [ { "title": "Ley 81 de 2019, sobre proteccion de datos personales (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf", "date": "2019-03-29", "publisherClass": "legal_text" }, { "title": "Comunicado: ANTAI sanciona a clinica de cirugia plastica (ANTAI)", "url": "https://antai.gob.pa/comunicado-7/", "date": "2023-07-17", "publisherClass": "official" }, { "title": "Decreto Ejecutivo 285 de 2021, reglamenta la Ley 81 (SIJUSA copy)", "url": "https://www.sijusa.com/wp-content/uploads/2022/04/DE_285_2021.pdf", "date": "2021-05-28", "publisherClass": "legal_text" } ] }, "clinical": { "score": 45, "summary": "Ley 68 requires every centre to give treating clinicians access to the record at all times, and SEIS lets MINSA clinicians open a patient's record at any facility using it. A MINSA clinician still cannot see the CSS record, or the reverse.", "sources": [ { "title": "Sistema Electronico de Informacion de Salud (SEIS), programa (Ministerio de Salud)", "url": "https://www.minsa.gob.pa/programa/sistema-electronico-de-informacion-de-salud-seis", "date": "undated", "publisherClass": "official" }, { "title": "Ley 68 de 2003, derechos y obligaciones de los pacientes (Hospital Santo Tomas copy)", "url": "https://www.hospitalsantotomas.gob.pa/download/transparencia/otros_documentos_y_normas/9.6.0-LEY-68-DERECHOS-PACIENTE.pdf", "date": "2003-11-25", "publisherClass": "legal_text" }, { "title": "Integracion entre la Caja de Seguro y el Minsa: expediente clinico unico (TVN)", "url": "https://www.tvn-2.com/nacionales/integracion-caja-de-seguro-social-minsa-expediente-clinico-unico-compras-insumos-conjuntas-salud-en-panama_1_2244088.html", "date": "2026-06-03", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Ley 81 allows research on anonymised data without consent, and there is no general opt-out. Accredited ethics committees, the MINSA research register RESEGIS with public quarterly reports, and a statutory duty of confidentiality earn the score.", "sources": [ { "title": "Regulacion de Investigacion para la Salud (Ministerio de Salud)", "url": "https://www.minsa.gob.pa/informacion-salud/regulacion-de-investigacion-para-la-salud", "date": "undated", "publisherClass": "official" }, { "title": "Ley 81 de 2019, sobre proteccion de datos personales (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf", "date": "2019-03-29", "publisherClass": "legal_text" }, { "title": "Aspectos regulatorios de la recoleccion y uso de muestras y datos (CNBI)", "url": "https://cnbi.senacyt.gob.pa/wp-content/uploads/2023/10/2023-0927-JCandanedo-Aspectos-regulatorios-.pdf", "date": "2023-09-27", "publisherClass": "official" }, { "title": "Decreto 21 de Panama: nuevas reglas de investigacion clinica (BioAccess)", "url": "https://bioaccessla.com/blog/decreto-21-de-2026-panama-nuevas-reglas-investigacion-clinica-patrocinadores", "date": "2026-05-20", "publisherClass": "blog_vendor" } ] }, "ai": { "score": 35, "summary": "Ley 90 of 2017 defines medical devices to include software, so clinical software needs registration, but no AI-specific change control or human oversight rule was found. A national AI strategy launched in July 2026, and an AI governance bill is still before the Assembly.", "sources": [ { "title": "Ley 90 de 2017, sobre dispositivos medicos y productos afines (Asamblea Nacional, Legispan)", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2017/LEY/Administrador%20Legispan_28433-B_2017_12_27_ASAMBLEA%20NACIONAL_90.pdf", "date": "2017-12-27", "publisherClass": "legal_text" }, { "title": "Panama lanza la Agenda Nacional de Tecnologias Avanzadas (Senacyt)", "url": "https://www.senacyt.gob.pa/panama-lanza-la-agenda-nacional-de-tecnologias-avanzadas-en-presencia-del-presidente-mulino/", "date": "2026-07-30", "publisherClass": "official" }, { "title": "Panama avanza en ruta de implementacion de la Estrategia Nacional de IA (La Web de la Salud)", "url": "https://lawebdelasalud.com/panama-avanza-en-ruta-de-implementacion-de-la-estrategia-nacional-de-inteligencia-artificial/", "date": "2026-09-22", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley 68 de 2003 (derechos y obligaciones de los pacientes)", "level": "National", "year": "2003", "what": "Right to health information, confidentiality, informed consent, clinical record rules and logging of record access.", "url": "https://www.hospitalsantotomas.gob.pa/download/transparencia/otros_documentos_y_normas/9.6.0-LEY-68-DERECHOS-PACIENTE.pdf" }, { "name": "Ley 81 de 2019 (proteccion de datos personales)", "level": "National", "year": "2019", "what": "Health data sensitive; express consent; access within 10 business days; ANTAI fines B/.1,000 to 10,000.", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2019/LEY/Administrador%20Legispan_28743-A_2019_3_29_ASAMBLEA%20NACIONAL_81.pdf" }, { "name": "Decreto Ejecutivo 285 de 2021 (reglamento de la Ley 81)", "level": "National", "year": "2021", "what": "Free exercise of data rights, easy consent withdrawal, breach notice within 72 hours.", "url": "https://www.sijusa.com/wp-content/uploads/2022/04/DE_285_2021.pdf" }, { "name": "Ley 84 de 2019 (investigacion para la salud)", "level": "National", "year": "2019", "what": "Governs health research, bioethics committees and the national research register.", "url": "https://www.minsa.gob.pa/informacion-salud/regulacion-de-investigacion-para-la-salud" }, { "name": "Decreto Ejecutivo 21 de 2026 (reglamento de los Titulos III y IV de la Ley 84)", "level": "National", "year": "2026", "what": "Regulates research ethics committees and the RESEGIS research register.", "url": "https://www.minsa.gob.pa/informacion-salud/regulacion-de-investigacion-para-la-salud" }, { "name": "Ley 90 de 2017 (dispositivos medicos y productos afines)", "level": "National", "year": "2017", "what": "Medical device registration and control; device definition includes software.", "url": "https://s3-legispan.asamblea.gob.pa/legispan/NORMAS/2010/2017/LEY/Administrador%20Legispan_28433-B_2017_12_27_ASAMBLEA%20NACIONAL_90.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-04-17", "headline": "Newspaper finds insured people's medical histories and signatures posted online after a hack", "paraphrase": "Reporters said they could search and download insured people's medical histories, signatures and phone numbers from a site run by hackers who offered the data for sale. Security experts said they had warned the institution for weeks.", "source": "La Estrella de Panamá", "url": "https://www.laestrella.com.pa/panama/nacional/hackeo-masivo-en-la-css-expone-nombres-firmas-e-historial-medico-de-asegurados-PC21679565", "theme": "breach", "status": "alleged" }, { "date": "2026-05-06", "headline": "State digital agency admits security gaps as leaked medical histories circulate", "paraphrase": "After public systems were hacked, the government's digital agency acknowledged known vulnerabilities. The report says medical histories were already circulating on the dark web while institutions avoided saying whose data was exposed, despite a legal duty to notify.", "source": "La Estrella de Panamá", "url": "https://www.laestrella.com.pa/economia/aig-admite-vulnerabilidades-estatales-ante-crisis-de-ciberataques-CG22176501", "theme": "breach", "status": "alleged" } ] }, { "iso3": "RWA", "name": "Rwanda", "region": "Africa", "overall": 44, "rank": "76=", "likelyRank": "55 to 98", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Rwanda's 2025 health law gives patients their file within five working days, but the state record is still rolling out with no sharing controls.", "categories": { "access": { "score": 50, "summary": "Law 026/2025 gives patients the right to consult their file and get a copy within five working days of a written request. A national patient app is planned, and whether patients can see their own records online today is not verified.", "sources": [ { "title": "Law n° 026/2025 of 17/09/2025 regulating healthcare services (Official Gazette n° Special of 18/09/2025, Ministry of Justice)", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Law n° 058/2021 relating to the protection of personal data and privacy (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15", "date": "2021-10-15", "publisherClass": "legal_text" }, { "title": "Health Sector Strategic Plan V, July 2024 to June 2029 (Ministry of Health)", "url": "https://www.moh.gov.rw/index.php?eID=dumpFile&t=f&f=117507&token=f2a527e089201f73bec29f8ce6d6c4dc55ed241e", "date": "2024", "publisherClass": "official" }, { "title": "Five Years On, Rwanda Is Leading the Edge of Digital Health in Africa (KT Press)", "url": "https://www.ktpress.rw/2026/09/five-years-on-rwanda-is-leading-the-edge-of-digital-health-in-africa/", "date": "2026-09-30", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "The law requires consent or another legal ground, but health processing for care and public health needs no separate consent, and records are linked to the national ID. We found no opt-out and no access log patients can see.", "sources": [ { "title": "Law n° 058/2021 relating to the protection of personal data and privacy (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15", "date": "2021-10-15", "publisherClass": "legal_text" }, { "title": "Law n° 026/2025 of 17/09/2025 regulating healthcare services (Official Gazette n° Special of 18/09/2025, Ministry of Justice)", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Rwanda Health Information Exchange (RHIE): achievements over the last three years, full report (CIIC-HIN, implementing partner)", "url": "https://ciichin.org/wp-content/uploads/2025/01/Rwanda-Health-Information-System-Ecosystem-RHIE-Achievement-over-last-Three-years-Full-Report.pdf", "date": "2025-01", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 52, "summary": "Health status and medical records are sensitive data, breaches go to the regulator within 48 hours, and the 2025 health law requires encryption of patient data. The regulator sits inside the national cyber security authority, and we found no published health-sector fine.", "sources": [ { "title": "Law n° 058/2021 relating to the protection of personal data and privacy (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15", "date": "2021-10-15", "publisherClass": "legal_text" }, { "title": "Law n° 026/2025 of 17/09/2025 regulating healthcare services (Official Gazette n° Special of 18/09/2025, Ministry of Justice)", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "What to do after you register with NCSA (Data Protection and Privacy Office)", "url": "https://dpo.gov.rw/news-and-updates/news/article/what-to-do-after-you-register-with-ncsa", "date": "2026-01-26", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 46, "summary": "Insurance claims and public health data are digital and national, but the Ministry's own plan put facilities with a fully working electronic record at 12% at baseline. The goal of a paper-free public system by end-2025 is not verified as met.", "sources": [ { "title": "Health Sector Strategic Plan V, July 2024 to June 2029 (Ministry of Health)", "url": "https://www.moh.gov.rw/index.php?eID=dumpFile&t=f&f=117507&token=f2a527e089201f73bec29f8ce6d6c4dc55ed241e", "date": "2024", "publisherClass": "official" }, { "title": "Ikoranabuhanga rya E-Ubuzima riratangira gukoreshwa hose bitarenze 2025 (Voice of Africa)", "url": "https://voiceofafrica.rw/2025/05/08/ikoranabuhanga-rya-e-ubuzima-riratangira-gukoreshwa-hose-bitarenze-2025/", "date": "2025-05-08", "publisherClass": "news" }, { "title": "CBHI / Mutuelle de Santé scheme page (Rwanda Social Security Board)", "url": "https://rssb.rw/schemes/cbhi-scheme", "date": "undated", "publisherClass": "official" }, { "title": "New Health Intelligence Center to drive real-time, evidence-based decisions (Ministry of Health)", "url": "https://www.moh.gov.rw/news-detail/new-health-intelligence-center-to-drive-real-time-evidence-based-decisions", "date": "2025-04-03", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Selling personal data against the law carries five to seven years in prison, re-identifying de-identified data is a crime, and the 2025 health law bans advertising of health services. We found no rules for health apps, data brokers or de-identified data sales.", "sources": [ { "title": "Law n° 058/2021 relating to the protection of personal data and privacy (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15", "date": "2021-10-15", "publisherClass": "legal_text" }, { "title": "Law n° 026/2025 of 17/09/2025 regulating healthcare services (Official Gazette n° Special of 18/09/2025, Ministry of Justice)", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e", "date": "2025-09-18", "publisherClass": "legal_text" } ] }, "clinical": { "score": 34, "summary": "A shared health record and national patient ID exist, but an implementing partner reported that clinicians were not yet trained to view data from other facilities. We found no source showing cross-facility viewing in use, so the cell sits below Tanzania's working referral view.", "sources": [ { "title": "Rwanda Health Information Exchange (RHIE): achievements over the last three years, full report (CIIC-HIN, implementing partner)", "url": "https://ciichin.org/wp-content/uploads/2025/01/Rwanda-Health-Information-System-Ecosystem-RHIE-Achievement-over-last-Three-years-Full-Report.pdf", "date": "2025-01", "publisherClass": "blog_vendor" }, { "title": "Rwanda: Bill Gates in Rwanda to Explore Health, AI Progress (The New Times via allAfrica)", "url": "https://allafrica.com/stories/202607210078.html", "date": "2026-07-20", "publisherClass": "news" }, { "title": "Health Sector Strategic Plan V, July 2024 to June 2029 (Ministry of Health)", "url": "https://www.moh.gov.rw/index.php?eID=dumpFile&t=f&f=117507&token=f2a527e089201f73bec29f8ce6d6c4dc55ed241e", "date": "2024", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Research on people needs ethics approval and written consent, reuse of research data needs the participant's permission again, and re-identification is a crime. Routine data still flows to a national analytics centre with no individual opt-out we could find.", "sources": [ { "title": "Law n° 015/2022 relating to research on a human being (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2022/15/eng@2022-08-12", "date": "2022-08-12", "publisherClass": "legal_text" }, { "title": "Law n° 026/2025 of 17/09/2025 regulating healthcare services (Official Gazette n° Special of 18/09/2025, Ministry of Justice)", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Law n° 058/2021 relating to the protection of personal data and privacy (RwandaLII)", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15", "date": "2021-10-15", "publisherClass": "legal_text" }, { "title": "New Health Intelligence Center to drive real-time, evidence-based decisions (Ministry of Health)", "url": "https://www.moh.gov.rw/news-detail/new-health-intelligence-center-to-drive-real-time-evidence-based-decisions", "date": "2025-04-03", "publisherClass": "official" } ] }, "ai": { "score": 55, "summary": "Rwanda FDA guidelines in effect since December 2025 cover AI software as a medical device, including adaptive models, data provenance, algorithm changes and post-market drift. Human oversight appears only in the foreword, not as a binding requirement, so the cell sits at the bottom of the band.", "sources": [ { "title": "Guidelines for Review and Approval of Software as Medical Devices (SaMD), Version 1 (Rwanda FDA; Internet Archive copy of 7 Jan 2026, live link returned 404 on 2 Oct 2026)", "url": "https://web.archive.org/web/20260107064605/https://rwandafda.gov.rw/monitoring-tool/documents-management/uploads/1/Guidelines/1767694227_Guidelines%20for%20Review%20and%20Approval%20of%20Software%20as%20Medical%20Devices%20(SaMD)_December%202025.pdf", "date": "2025-06-11", "publisherClass": "official" }, { "title": "Stakeholders documents: Guidelines for review and approval of software as medical devices (SaMD), listed 17/12/2025 (Rwanda FDA)", "url": "https://monitoring.rwandafda.gov.rw/stakeholders/", "date": "2025-12-17", "publisherClass": "official" }, { "title": "The National AI Policy (Ministry of ICT and Innovation)", "url": "https://www.minict.gov.rw/fileadmin/user_upload/minict_user_upload/Documents/Policies/Artificial_Intelligence_Policy.pdf", "date": "2022", "publisherClass": "official" }, { "title": "Rwanda: Bill Gates in Rwanda to Explore Health, AI Progress (The New Times via allAfrica)", "url": "https://allafrica.com/stories/202607210078.html", "date": "2026-07-20", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law n° 058/2021 relating to the protection of personal data and privacy", "level": "National", "year": "2021", "what": "Health is sensitive data; copy right; 48-hour breach notice; storage in Rwanda; prison for selling data.", "url": "https://rwandalii.org/akn/rw/act/law/2021/58/eng@2021-10-15" }, { "name": "Law n° 026/2025 regulating healthcare services", "level": "National", "year": "2025", "what": "Patient file copy in five working days; confidentiality; encryption of patient data; ten-year retention.", "url": "https://www.minijust.gov.rw/index.php?eID=dumpFile&f=144155&t=f&token=75e63fc504481c93e1ed017130c13b4c35f3935e" }, { "name": "Law n° 015/2022 relating to research on a human being", "level": "National", "year": "2022", "what": "Ethics committee approval; written, revocable consent; reuse of research data needs fresh permission.", "url": "https://rwandalii.org/akn/rw/act/law/2022/15/eng@2022-08-12" }, { "name": "Rwanda FDA Guidelines for Review and Approval of Software as Medical Devices (SaMD)", "level": "National", "year": "2025", "what": "Registration rules for AI software, covering adaptive models, provenance, changes and post-market drift.", "url": "https://monitoring.rwandafda.gov.rw/stakeholders/" }, { "name": "National Artificial Intelligence Policy", "level": "National", "year": "2022", "what": "Names healthcare a priority AI sector; RURA to promote national ethical AI guidelines.", "url": "https://www.minict.gov.rw/fileadmin/user_upload/minict_user_upload/Documents/Policies/Artificial_Intelligence_Policy.pdf" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [] }, { "iso3": "BRN", "name": "Brunei", "region": "Asia", "overall": 43, "rank": "80=", "likelyRank": "60 to 109", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Brunei keeps one public health record for nearly everyone, but its new privacy law does not cover the Ministry of Health that holds it.", "categories": { "access": { "score": 35, "summary": "Brunei's 2025 data protection order gives a right of access only against private providers, not the Ministry of Health, which holds most records. BruHealth shows lab and imaging results (63% of residents logged in weekly in 2022), so this sits at the band's top.", "sources": [ { "title": "Personal Data Protection Order, 2025 (Gazette S 1/2025)", "url": "https://pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf", "date": "2025-01-08", "publisherClass": "legal_text" }, { "title": "BruHealth Privacy Statement (Ministry of Health)", "url": "https://www.healthinfo.gov.bn/user-center-app/#/user/privacy-clause", "date": "2025-01-01", "publisherClass": "official" }, { "title": "Development and implementation of a national mobile health application (Journal of Global Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9767305/", "date": "2022-12-21", "publisherClass": "academic" }, { "title": "Accessing Medical Health Records (Jerudong Park Medical Centre)", "url": "https://jpmcbrunei.com/accessing-medical-health-records/", "date": "undated", "publisherClass": "blog_vendor" } ] }, "control": { "score": 30, "summary": "Bru-HIMS runs on a 'One Patient, One Record' model across government facilities, and no opt-out or patient-visible access log was found. BruHealth users can manage app permissions, but the ministry says some health data cannot be deleted.", "sources": [ { "title": "BruHealth Privacy Statement (Ministry of Health)", "url": "https://www.healthinfo.gov.bn/user-center-app/#/user/privacy-clause", "date": "2025-01-01", "publisherClass": "official" }, { "title": "Bru-HIMS upgrade will make patient records available to both gov't and private healthcare facilities (The Scoop)", "url": "https://thescoop.co/2023/09/27/bru-hims-upgrade-will-make-patient-records-available-to-both-govt-and-private-healthcare-facilities/", "date": "2023-09-27", "publisherClass": "news" }, { "title": "PDPO overview for individuals (AITI)", "url": "https://pdp.aiti.gov.bn/overview/individuals/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 40, "summary": "The 2025 order brings 3-day breach notice and fines up to B$1 million or 10% of turnover, but only for private organisations. The Ministry of Health, which holds the national record, sits outside it, so this is scored below the general-law band.", "sources": [ { "title": "Personal Data Protection Order, 2025 (Gazette S 1/2025)", "url": "https://pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf", "date": "2025-01-08", "publisherClass": "legal_text" }, { "title": "Data protection laws in Brunei (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=BN", "date": "2026-03-18", "publisherClass": "law_firm" }, { "title": "BruHealth listing and data safety label (Google Play, E-Government National Centre)", "url": "https://play.google.com/store/apps/details?id=egnc.moh.bruhealth&hl=en", "date": "2026-09-17", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 65, "summary": "Bru-HIMS has linked government hospitals and health centres in one record since 2012, covering over 95% of residents (2022). Private hospitals are not connected, and the upgrade to add them, due April 2025, only pilots at RIPAS Hospital from October 2026.", "sources": [ { "title": "Bru-HIMS upgrade will make patient records available to both gov't and private healthcare facilities (The Scoop)", "url": "https://thescoop.co/2023/09/27/bru-hims-upgrade-will-make-patient-records-available-to-both-govt-and-private-healthcare-facilities/", "date": "2023-09-27", "publisherClass": "news" }, { "title": "Tender KK/30/2026/HTD: support trainers for Bru-HIMS 2.0 end user training (Ministry of Health)", "url": "https://moh.gov.bn/wp-content/uploads/2026/02/KK-30-2026-HTD.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "MoH proposes B$646M budget to boost sustainable healthcare (The Scoop)", "url": "https://thescoop.co/2026/03/17/moh-proposes-b646m-budget-to-boost-sustainable-healthcare/", "date": "2026-03-17", "publisherClass": "news" }, { "title": "Development and implementation of a national mobile health application (Journal of Global Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9767305/", "date": "2022-12-21", "publisherClass": "academic" } ] }, "commercial": { "score": 40, "summary": "Private firms need consent to use personal data and to send marketing messages under the 2025 order, with no extra rule for health data. BruHealth's terms let the ministry use de-identified data 'for any purpose' and share aggregated data with third parties.", "sources": [ { "title": "Personal Data Protection Order, 2025 (Gazette S 1/2025)", "url": "https://pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf", "date": "2025-01-08", "publisherClass": "legal_text" }, { "title": "BruHealth Privacy Statement (Ministry of Health)", "url": "https://www.healthinfo.gov.bn/user-center-app/#/user/privacy-clause", "date": "2025-01-01", "publisherClass": "official" }, { "title": "What Brunei's innovations can teach us about data-driven health systems (World Economic Forum)", "url": "https://www.weforum.org/stories/health-and-healthcare-systems/what-bruneis-innovations-teach-data-driven-health-systems/", "date": "2026-01", "publisherClass": "news" } ] }, "clinical": { "score": 62, "summary": "Clinicians in any government hospital or health centre work in the same Bru-HIMS record. Doctors at private hospitals cannot see it until Bru-HIMS 2.0 rolls out, and no consent or emergency-access rules were found.", "sources": [ { "title": "Bru-HIMS upgrade will make patient records available to both gov't and private healthcare facilities (The Scoop)", "url": "https://thescoop.co/2023/09/27/bru-hims-upgrade-will-make-patient-records-available-to-both-govt-and-private-healthcare-facilities/", "date": "2023-09-27", "publisherClass": "news" }, { "title": "Tender KK/30/2026/HTD: support trainers for Bru-HIMS 2.0 end user training (Ministry of Health)", "url": "https://moh.gov.bn/wp-content/uploads/2026/02/KK-30-2026-HTD.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Development and implementation of a national mobile health application (Journal of Global Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9767305/", "date": "2022-12-21", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "Records research needs ethics approval, but de-identified data is used without consent or opt-out, and BruHealth shares it with research investigators. Two safeguard classes count, the ministry ethics committee and a re-identification offence, giving 46.", "sources": [ { "title": "Biomedical Research & Ethics Unit (Ministry of Health)", "url": "https://moh.gov.bn/about-us/biomedical-research-ethics-unit/", "date": "undated", "publisherClass": "official" }, { "title": "MHREC Submission Criteria and Review Process (Ministry of Health)", "url": "http://moh.gov.bn/wp-content/uploads/2024/11/MHREC-Submission-Criteria-and-review-process-June-24.pdf", "date": "2024-06", "publisherClass": "official" }, { "title": "BruHealth Privacy Statement (Ministry of Health)", "url": "https://www.healthinfo.gov.bn/user-center-app/#/user/privacy-clause", "date": "2025-01-01", "publisherClass": "official" }, { "title": "Personal Data Protection Order, 2025 (Gazette S 1/2025)", "url": "https://pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf", "date": "2025-01-08", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Brunei has no rules for clinical AI, and no device regulation covering software was found. AITI's 2025 AI Governance and Ethics guide is guidance, not law, and covers all sectors, which keeps this at the top of the lowest band.", "sources": [ { "title": "Guide on Artificial Intelligence Governance and Ethics for Brunei Darussalam (AITI)", "url": "https://www.aiti.gov.bn/news/2025/guide-on-artificial-intelligence-governance-and-ethics-for-brunei-darussalam/", "date": "2025-04-11", "publisherClass": "official" }, { "title": "Guide on AI Governance and Ethics for Brunei Darussalam (OECD.AI Policy Navigator)", "url": "https://oecd.ai/en/dashboards/policy-initiatives/guide-on-artificial-intelligence-ai-governance-and-ethics-for-brunei-darussalam", "date": "2026-04-29", "publisherClass": "intergov" }, { "title": "Pharmacy Services (Ministry of Health)", "url": "https://moh.gov.bn/services/pharmary-services/", "date": "undated", "publisherClass": "official" }, { "title": "What Brunei's innovations can teach us about data-driven health systems (World Economic Forum)", "url": "https://www.weforum.org/stories/health-and-healthcare-systems/what-bruneis-innovations-teach-data-driven-health-systems/", "date": "2026-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Order, 2025", "level": "National", "year": "2025", "what": "Private-sector privacy law: access, consent, 3-day breach notice, fines up to 10%; excludes public agencies.", "url": "https://pdp.aiti.gov.bn/media/tndpduml/s-1_2025-e.pdf" }, { "name": "Medicines Order, 2007", "level": "National", "year": "2007", "what": "Regulates medicinal products through the Medicines Control Authority; no software or AI device rules found.", "url": "https://moh.gov.bn/services/pharmary-services/" }, { "name": "Guide on AI Governance and Ethics for Brunei Darussalam", "level": "National", "year": "2025", "what": "Non-statutory, sector-agnostic AI principles, including transparency, human oversight and accountability.", "url": "https://www.aiti.gov.bn/news/2025/guide-on-artificial-intelligence-governance-and-ethics-for-brunei-darussalam/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-01-16", "headline": "Network fault cut a public health centre off from patient records", "paraphrase": "An internet fault left a government health centre unable to reach the national Bru-HIMS record system. Test result reviews, sample collection and medicine pickups stopped there, and patients were sent to other centres. The ministry apologised.", "source": "Borneo Bulletin", "url": "https://borneobulletin.com.bn/internet-disruption-affects-sungai-liang-health-centre/", "theme": "access_delay_or_cost", "status": "admitted" }, { "date": "2026-03-26", "headline": "Record system outage halted services at a national health screening centre", "paraphrase": "A network failure made the Bru-HIMS record system unavailable at a government screening centre. Worker screening, vaccination and occupational health services were affected and people with appointments were told to reschedule. The ministry apologised.", "source": "The Star (Borneo Bulletin/ANN)", "url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/03/26/brunei-health-services-disrupted-due-to-technical-issues", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "CHN", "name": "China", "region": "Asia", "overall": 43, "rank": "80=", "likelyRank": "59 to 106", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Over 9,000 public hospitals feed provincial data platforms, but patients can copy only listed parts of their chart and cannot see who looked.", "categories": { "access": { "score": 35, "summary": "The Civil Code lets patients read and copy listed record types, and the 2013 rules list what hospitals may copy, leaving out progress notes, with a fee and no fixed deadline. Public health files are opening to residents county by county, a target for 2026.", "sources": [ { "title": "Civil Code of the People's Republic of China (Xinhua text on Ministry of National Defense site)", "url": "http://www.mod.gov.cn/gfbw/qwfb/yw_214049/4866121.html", "date": "2020-06-02", "publisherClass": "legal_text" }, { "title": "Medical Record Management Rules for Medical Institutions (2013), full text (Tongji University School of Medicine)", "url": "https://med.tongji.edu.cn/info/1607/11324.htm", "date": "undated", "publisherClass": "legal_text" }, { "title": "Notice on 2026 basic public health services (NHC and three agencies, Shenzhen Health Commission copy)", "url": "https://wjw.sz.gov.cn/xxgk/zcfggfxwj/mybh_5/content/post_12991931.html", "date": "2026-07-28", "publisherClass": "official" }, { "title": "Personal Information Protection Law of the People's Republic of China (Cyberspace Administration of China)", "url": "https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm", "date": "2021-08-20", "publisherClass": "legal_text" } ] }, "control": { "score": 30, "summary": "PIPL needs separate consent for health data and lets people withdraw it, but statutory duties and public health emergencies need no consent. Hospitals feed provincial platforms by default, with no national opt-out and no patient-visible access log found.", "sources": [ { "title": "Personal Information Protection Law of the People's Republic of China (Cyberspace Administration of China)", "url": "https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm", "date": "2021-08-20", "publisherClass": "legal_text" }, { "title": "Shenzhen Health Data Management Measures (Shenzhen Health Commission)", "url": "https://wjw.sz.gov.cn/xxgk/zcfggfxwj/mybh_5/content/post_11009298.html", "date": "2023-11-16", "publisherClass": "official" }, { "title": "China's health services: digital intelligence (Health News, reposted by WFCMS)", "url": "https://www.wfcms.org/show/22/8567.html", "date": "2026-05-21", "publisherClass": "news" }, { "title": "Measures on Data Security and Personal Information Protection in Medical and Health Institutions (Trial), full text (Digital Elite reprint)", "url": "https://www.digitalelite.cn/h-nd-10024.html", "date": "2026-04-21", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "A February 2026 measure by the NHC, police and cyberspace agencies (Yicai) sets health-sector data rules, and an April 2026 campaign targets hospitals that let strangers look up records. Oversight sits with government departments, not an independent authority, and state access is broad.", "sources": [ { "title": "Measures on Data Security and Personal Information Protection in Medical and Health Institutions (Trial), full text (Digital Elite reprint)", "url": "https://www.digitalelite.cn/h-nd-10024.html", "date": "2026-04-21", "publisherClass": "legal_text" }, { "title": "CAC, MIIT and MPS announcement on the 2026 personal information protection campaigns", "url": "https://www.cac.gov.cn/2026-04/02/c_1776867645836849.htm", "date": "2026-04-02", "publisherClass": "official" }, { "title": "Supreme People's Court typical cases on crimes infringing citizens' personal information (Xinhua)", "url": "https://www.news.cn/legal/20260508/6d75070dddf44834adfbe5734b20af3e/c.html", "date": "2026-05-08", "publisherClass": "news" }, { "title": "Medical data security enters a year of special governance (Yicai)", "url": "https://www.yicai.com/news/103232118.html", "date": "2026-06-16", "publisherClass": "news" } ] }, "journey": { "score": 60, "summary": "Health News reported 9,125 public hospitals linked to regional platforms and 8,069 sharing test results across institutions in 2026. One national insurance platform covers 1.36 billion people, but the record is joined by province, not as one national chart.", "sources": [ { "title": "Hubei Medical Insurance Bureau notice on regulating externally dispensed insurance prescriptions (Wuhan Medical Insurance Bureau copy)", "url": "https://ybj.wuhan.gov.cn/zwgk_52/zcfgyjd/qtzdgkwj/202502/t20250225_2539139.shtml", "date": "2024-12-03", "publisherClass": "official" }, { "title": "China's health services: digital intelligence (Health News, reposted by WFCMS)", "url": "https://www.wfcms.org/show/22/8567.html", "date": "2026-05-21", "publisherClass": "news" }, { "title": "National unified medical insurance information platform fully built, covering 1.36 billion insured (Xinhua)", "url": "http://www.news.cn/2022-05/16/c_1128655718.htm", "date": "2022-05-16", "publisherClass": "news" }, { "title": "NHC director: 98% of prefecture cities recognise over 300 test results (Beijing News via Tencent)", "url": "https://news.qq.com/rain/a/20260914A08U5D00", "date": "2026-09-14", "publisherClass": "news" } ] }, "commercial": { "score": 38, "summary": "PIPL needs separate consent before data goes to another company, and selling personal data is a crime. Yet Shanghai now opens anonymised hospital data to insurers for product design without individual consent, and national policy pushes clinical data authorised operation.", "sources": [ { "title": "Personal Information Protection Law of the People's Republic of China (Cyberspace Administration of China)", "url": "https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm", "date": "2021-08-20", "publisherClass": "legal_text" }, { "title": "Shanghai opens hospital data for 'pre-existing condition' insurance products (Yicai via Tencent News)", "url": "https://news.qq.com/rain/a/20260920A0C4MZ00", "date": "2026-09-20", "publisherClass": "news" }, { "title": "Medical data security enters a year of special governance (Yicai)", "url": "https://www.yicai.com/news/103232118.html", "date": "2026-06-16", "publisherClass": "news" }, { "title": "Implementation opinion on promoting and regulating AI plus healthcare, Guo Wei Ban Gui Hua Fa [2025] No. 30 (MOFCOM law database)", "url": "https://policy.mofcom.gov.cn/claw/clawContent.shtml?id=104035", "date": "2025-10-20", "publisherClass": "official" } ] }, "clinical": { "score": 50, "summary": "Doctors in 8,069 public hospitals can retrieve test results from other institutions, and the national goal is cross-region result sharing. Full cross-provider charts are visible to clinicians only in some regions, such as Chongqing.", "sources": [ { "title": "Implementation opinion on promoting and regulating AI plus healthcare, Guo Wei Ban Gui Hua Fa [2025] No. 30 (MOFCOM law database)", "url": "https://policy.mofcom.gov.cn/claw/clawContent.shtml?id=104035", "date": "2025-10-20", "publisherClass": "official" }, { "title": "Shenzhen Health Data Management Measures (Shenzhen Health Commission)", "url": "https://wjw.sz.gov.cn/xxgk/zcfggfxwj/mybh_5/content/post_11009298.html", "date": "2023-11-16", "publisherClass": "official" }, { "title": "China's health services: digital intelligence (Health News, reposted by WFCMS)", "url": "https://www.wfcms.org/show/22/8567.html", "date": "2026-05-21", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Research on identifiable people needs informed consent and ethics review, but anonymised data is exempt from review and Shanghai waived individual consent for insurer use. Credit goes to ethics committees, a secure processing zone and criminal penalties.", "sources": [ { "title": "Measures for Ethical Review of Life Science and Medical Research Involving Humans, Guo Wei Ke Jiao Fa [2023] No. 4 (Peking University Health Science Center copy)", "url": "https://research.bjmu.edu.cn/llwyh/llwyh_fgwj/98685712020c4ae1a670bfe0adbfa905.htm", "date": "2023-02-18", "publisherClass": "legal_text" }, { "title": "Shanghai opens hospital data for 'pre-existing condition' insurance products (Yicai via Tencent News)", "url": "https://news.qq.com/rain/a/20260920A0C4MZ00", "date": "2026-09-20", "publisherClass": "news" }, { "title": "Medical data security enters a year of special governance (Yicai)", "url": "https://www.yicai.com/news/103232118.html", "date": "2026-06-16", "publisherClass": "news" }, { "title": "Supreme People's Court typical cases on crimes infringing citizens' personal information (Xinhua)", "url": "https://www.news.cn/legal/20260508/6d75070dddf44834adfbe5734b20af3e/c.html", "date": "2026-05-08", "publisherClass": "news" } ] }, "ai": { "score": 62, "summary": "AI medical devices are registered under the NMPA's AI device guideline that locks algorithms and needs re-registration for updates that affect safety or effectiveness. Internet hospitals may not let AI write prescriptions or stand in for the doctor.", "sources": [ { "title": "Consultation on the AI Medical Device Registration Review Guideline (2026 revision draft) (CMDE Yangtze River Delta branch)", "url": "https://www.ydcmdei.org.cn/article/975", "date": "2026-09-14", "publisherClass": "official" }, { "title": "Internet diagnosis and treatment supervision rules issued (Health News, Ankang Health Commission)", "url": "https://wjw.ankang.gov.cn/Content-2416375.html", "date": "2022-06-17", "publisherClass": "official" }, { "title": "Implementation opinion on promoting and regulating AI plus healthcare, Guo Wei Ban Gui Hua Fa [2025] No. 30 (MOFCOM law database)", "url": "https://policy.mofcom.gov.cn/claw/clawContent.shtml?id=104035", "date": "2025-10-20", "publisherClass": "official" }, { "title": "Sandbox regulation for autonomous surgical robots: China vs abroad (China Pharmaceutical News)", "url": "https://bk.cnpharm.com/zgyyb/2026/04/30/app_324606.html", "date": "2026-04-30", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Information Protection Law", "level": "National", "year": "2021", "what": "Health data is sensitive and needs separate consent; no consent needed for statutory duties.", "url": "https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm" }, { "name": "Civil Code (Articles 1034, 1225, 1226)", "level": "National", "year": "2020", "what": "Patients may read and copy listed records; hospitals must keep patient information confidential.", "url": "http://www.mod.gov.cn/gfbw/qwfb/yw_214049/4866121.html" }, { "name": "Medical Record Management Rules for Medical Institutions", "level": "National", "year": "2013", "what": "Lists copyable record parts, allows a cost fee, sets 15 and 30 year retention.", "url": "https://med.tongji.edu.cn/info/1607/11324.htm" }, { "name": "Measures on Data Security and Personal Information Protection in Medical and Health Institutions (Trial)", "level": "National", "year": "2026", "what": "Health-sector rules on data grading, record lookup authorisation, local storage and penalties.", "url": "https://www.digitalelite.cn/h-nd-10024.html" }, { "name": "Measures for Ethical Review of Life Science and Medical Research Involving Humans", "level": "National", "year": "2023", "what": "Informed consent and ethics review; anonymised data research exempt from review.", "url": "https://research.bjmu.edu.cn/llwyh/llwyh_fgwj/98685712020c4ae1a670bfe0adbfa905.htm" }, { "name": "Internet Diagnosis and Treatment Supervision Rules (Trial)", "level": "National", "year": "2022", "what": "Bans AI-generated prescriptions and AI replacing the doctor in online care.", "url": "https://wjw.ankang.gov.cn/Content-2416375.html" }, { "name": "Shenzhen Health Data Management Measures", "level": "Regional", "year": "2023", "what": "Other institutions may view a person's record only with separate, revocable consent.", "url": "https://wjw.sz.gov.cn/xxgk/zcfggfxwj/mybh_5/content/post_11009298.html" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-05-08", "headline": "Hospital booking contractor secretly copied millions of patients' details, court rules", "paraphrase": "A software firm that ran a hospital's online appointment system copied registration details of about 2.88 million patients into its own database over several years. A court convicted the firm and its managers, with fines and prison terms.", "source": "Supreme People's Court of China (typical cases)", "url": "https://www.court.gov.cn/zixun/xiangqing/499271.html", "theme": "breach", "status": "finding" }, { "date": "2024-11-18", "headline": "Court finds hospital rewrote a patient's electronic record after discharge; hospital pays in full", "paraphrase": "A court found that key parts of a patient's electronic record had been modified several times and created after discharge. Because the altered record blocked a fair assessment, the court presumed the hospital at fault and ordered full compensation.", "source": "Health China (健康界)", "url": "https://www.cn-healthcare.com/articlewm/20241118/wap-content-1642040.html", "theme": "record_wrong", "status": "finding" }, { "date": "2026-02-16", "headline": "Appeal court orders hospital to correct what a patient's record said they reported", "paraphrase": "A patient said their discharge record overstated how long they had noticed a symptom, harming an insurance claim, and the hospital refused to change it. The appeal court found the hospital could not prove the entry and ordered it corrected.", "source": "Health China (健康界)", "url": "https://www.cn-healthcare.com/articlewm/20260215/content-1666830.html", "theme": "record_wrong", "status": "finding" }, { "date": "2025-04-28", "headline": "Shanghai regulator penalises online medical firms after patient data was stolen and left unencrypted", "paraphrase": "Shanghai's cyberspace regulator penalised several online medical service firms. One had unpatched flaws and suspicious foreign access that led to data theft; another stored over 6.5 million patient records, including conditions and prescriptions, without encryption.", "source": "The Paper (澎湃新闻)", "url": "https://www.thepaper.cn/newsDetail_forward_30736580", "theme": "breach", "status": "finding" }, { "date": "2026-06-03", "headline": "National notice lists health apps that shared users' data with third parties without consent", "paraphrase": "A national cybersecurity notice listed 71 apps breaking personal data rules, including several medical and health apps. Violations included giving personal data to third parties without separate consent, no way to withdraw consent, and missing encryption.", "source": "21st Century Business Herald (21经济网)", "url": "https://www.21jingji.com/article/20260603/herald/fba2d42a4d84eabb6a46c30e8f5d3855.html", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-10-28", "headline": "Hospital apps let an ex-spouse download a patient's records with just name and ID", "paraphrase": "Several large hospitals' online services released test reports and records to anyone with a patient's name and ID number. A woman's former husband used this for two years to obtain and circulate her records. Some hospitals then added identity checks.", "source": "China Women's News (via Tencent News)", "url": "https://news.qq.com/rain/a/20251028A03EDO00", "theme": "breach", "status": "admitted" }, { "date": "2025-05-06", "headline": "Investigation finds hospital staff selling patients' contact details for about 50 yuan each", "paraphrase": "Reporters found some hospital staff and outside contractors selling patients' names, addresses and phone numbers to private companies, about 50 yuan per record. A patient described being contacted by a company that already knew her private details.", "source": "Legal Daily (via Hunan Daily / voc.com.cn)", "url": "https://m.voc.com.cn/xhn/news/202505/29345447.html", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "COL", "name": "Colombia", "region": "Americas", "overall": 43, "rank": "80=", "likelyRank": "58 to 103", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Colombia's law says patients own their electronic record and must consent to sharing, but the new national exchange is built for providers, not patients.", "categories": { "access": { "score": 45, "summary": "Ley 1751 and Ley 2015 give patients a free, complete electronic copy of their record. No national patient portal was found; the new national summaries are viewed by providers, so access still runs provider by provider.", "sources": [ { "title": "Ley Estatutaria 1751 de 2015, articulo 10 (Secretaria del Senado)", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1751_2015.html", "date": "2015", "publisherClass": "legal_text" }, { "title": "Ley 2015 de 2020, historia clinica electronica interoperable (Funcion Publica)", "url": "https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=105472", "date": "2020-01-31", "publisherClass": "legal_text" }, { "title": "Resolucion 1995 de 1999, manejo de la historia clinica (Minsalud)", "url": "https://www.minsalud.gov.co/Normatividad_Nuevo/RESOLUCI%C3%93N%201995%20DE%201999.pdf", "date": "1999", "publisherClass": "legal_text" }, { "title": "Resumen Digitales de Atencion (RDA), micrositio IHCE (Minsalud)", "url": "https://www.minsalud.gov.co/ihce/Paginas/resumen-digitales-de-atencion.aspx", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 27, "summary": "Ley 2015 says providers may access the electronic record only with the person's prior, express consent. The rollout rules describe automatic sharing with any authorised professional and no patient-facing consent switch or access log.", "sources": [ { "title": "Ley 2015 de 2020, historia clinica electronica interoperable (Funcion Publica)", "url": "https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=105472", "date": "2020-01-31", "publisherClass": "legal_text" }, { "title": "Resolucion 1888 de 2025, Resumen Digital de Atencion en Salud (Minsalud)", "url": "https://www.minsalud.gov.co/Normatividad_Nuevo/Resolucion%20No%201888%20de%202025.pdf", "date": "2025-09-15", "publisherClass": "legal_text" }, { "title": "Informe especial: implementacion de la interoperabilidad de la historia clinica electronica (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/OT/informe-especial-ihce.pdf", "date": "2026-08", "publisherClass": "official" } ] }, "privacy": { "score": 50, "summary": "Ley 1581 treats health data as sensitive and the SIC has sanctioned health insurers, including EPS SOS for sharing an HIV patient's record. Fines reach 2,000 monthly minimum wages but apply only to private entities, and the health superintendency itself was breached in March 2026.", "sources": [ { "title": "Ley 1581 de 2012, proteccion de datos personales (Secretaria del Senado)", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1581_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "Sanciones proteccion de datos personales 2025 (SIC)", "url": "https://www.sic.gov.co/sanciones-proteccion-datos-personales-2025", "date": "undated", "publisherClass": "official" }, { "title": "SIC sanciona a EPS SOS por divulgar historia clinica de paciente con VIH", "url": "https://consultorsalud.com/sic-sanciona-eps-sos-historia-clinica-vih/", "date": "2025-08-25", "publisherClass": "news" }, { "title": "Supersalud confirma filtracion masiva de datos sensibles de su archivo documental", "url": "https://www.eltiempo.com/datos/supersalud-confirma-filtracion-masiva-de-datos-sensibles-de-su-archivo-documental-en-ciberataque-3544641", "date": "2026-04-01", "publisherClass": "news" } ] }, "journey": { "score": 50, "summary": "A national exchange run by the Ministry of Health went live on 15 April 2026. By 4 August 2026 it held 21.5 million care summaries for 6.9 million patients from 1,430 providers, but labs, imaging and claims are not yet included.", "sources": [ { "title": "Informe especial: implementacion de la interoperabilidad de la historia clinica electronica (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/OT/informe-especial-ihce.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "Resolucion 1888 de 2025, Resumen Digital de Atencion en Salud (Minsalud)", "url": "https://www.minsalud.gov.co/Normatividad_Nuevo/Resolucion%20No%201888%20de%202025.pdf", "date": "2025-09-15", "publisherClass": "legal_text" }, { "title": "Resolucion 1799 de 2026, RDA de dispensacion de medicamentos (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/DIJ/resolucion-1799-de-2026.pdf", "date": "2026-08-05", "publisherClass": "legal_text" }, { "title": "Ley 2015 de 2020, historia clinica electronica interoperable (Funcion Publica)", "url": "https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=105472", "date": "2020-01-31", "publisherClass": "legal_text" } ] }, "commercial": { "score": 50, "summary": "Health data cannot be processed without explicit authorisation under Ley 1581, and Ley 2015 bars insurers and providers from disclosing record data without express consent. No specific rule on health-data brokers, ad targeting or de-identified data sales was found.", "sources": [ { "title": "Ley 1581 de 2012, proteccion de datos personales (Secretaria del Senado)", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1581_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "Ley 2015 de 2020, historia clinica electronica interoperable (Funcion Publica)", "url": "https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=105472", "date": "2020-01-31", "publisherClass": "legal_text" }, { "title": "Sanciones proteccion de datos personales 2025 (SIC)", "url": "https://www.sic.gov.co/sanciones-proteccion-datos-personales-2025", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 50, "summary": "Any authenticated professional at a connected provider can search a patient's national care summaries in real time from their own system. Coverage is limited to care since each provider joined in 2026, about 13 percent of residents by August.", "sources": [ { "title": "Resolucion 1888 de 2025, Resumen Digital de Atencion en Salud (Minsalud)", "url": "https://www.minsalud.gov.co/Normatividad_Nuevo/Resolucion%20No%201888%20de%202025.pdf", "date": "2025-09-15", "publisherClass": "legal_text" }, { "title": "Informe especial: implementacion de la interoperabilidad de la historia clinica electronica (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/OT/informe-especial-ihce.pdf", "date": "2026-08", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "Research on people needs written informed consent reviewed by an ethics committee under Resolution 8430, but the committee may waive consent for no-risk studies such as record review. No general opt-out or public register of data uses was found.", "sources": [ { "title": "Resolucion 8430 de 1993, normas para la investigacion en salud (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/DIJ/RESOLUCION-8430-DE-1993.PDF", "date": "1993", "publisherClass": "legal_text" }, { "title": "Ley 1581 de 2012, proteccion de datos personales (Secretaria del Senado)", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1581_2012.html", "date": "2012", "publisherClass": "legal_text" } ] }, "ai": { "score": 35, "summary": "Decreto 4725 of 2005 treats medical software as a device needing INVIMA registration, but no AI-specific change control or oversight rule was found. A health AI strategy is still being drafted and the AI bill filed in July 2026 is pending.", "sources": [ { "title": "Decreto 4725 de 2005, dispositivos medicos (normograma INVIMA)", "url": "https://normograma.invima.gov.co/compilacion/docs/decreto_4725_2005.htm", "date": "2005", "publisherClass": "legal_text" }, { "title": "CONPES 4144: hoja de ruta de Colombia en inteligencia artificial (DNP)", "url": "https://www.dnp.gov.co/publicaciones/Planeacion/Paginas/conpes-4144-hoja-de-ruta-colombia-inteligencia-artificial-retos-actuales-transformacion-futura.aspx", "date": "2025-05-16", "publisherClass": "official" }, { "title": "Informe especial: implementacion de la interoperabilidad de la historia clinica electronica (Minsalud)", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/OT/informe-especial-ihce.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "Proyecto de Ley 025 de 2026 Camara, regula la inteligencia artificial", "url": "https://www.camara.gov.co/wp-content/uploads/2026/07/proyectos-ley/documentos/proyecto-36127/P.L.025-2026SC-INTELIGENCIA-ARTIFICIAL.pdf", "date": "2026-07-21", "publisherClass": "official" } ] } }, "laws": [ { "name": "Ley Estatutaria 1751 de 2015 (derecho fundamental a la salud)", "level": "National", "year": "2015", "what": "Right to consult the whole clinical record free, get a copy, and confidentiality.", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1751_2015.html" }, { "name": "Ley 2015 de 2020 (historia clinica electronica interoperable)", "level": "National", "year": "2020", "what": "Patient owns the electronic record; consent for access; free electronic copy; national interoperability.", "url": "https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=105472" }, { "name": "Ley 1581 de 2012 (proteccion de datos personales)", "level": "National", "year": "2012", "what": "Health data sensitive; explicit authorisation; breach reporting; SIC fines up to 2,000 minimum wages.", "url": "http://www.secretariasenado.gov.co/senado/basedoc/ley_1581_2012.html" }, { "name": "Resolucion 1888 de 2025 (Resumen Digital de Atencion en Salud)", "level": "National", "year": "2025", "what": "Adopts national care summaries, FHIR exchange, access logging; providers to connect by April 2026.", "url": "https://www.minsalud.gov.co/Normatividad_Nuevo/Resolucion%20No%201888%20de%202025.pdf" }, { "name": "Resolucion 1799 de 2026 (RDA de dispensacion de medicamentos)", "level": "National", "year": "2026", "what": "Adds medicine dispensing to the national summaries; six months from 1 September 2026.", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/DIJ/resolucion-1799-de-2026.pdf" }, { "name": "Resolucion 8430 de 1993 (investigacion en salud)", "level": "National", "year": "1993", "what": "Written informed consent and ethics committee review; waiver possible for no-risk research.", "url": "https://www.minsalud.gov.co/sites/rid/Lists/BibliotecaDigital/RIDE/DE/DIJ/RESOLUCION-8430-DE-1993.PDF" }, { "name": "Decreto 4725 de 2005 (dispositivos medicos)", "level": "National", "year": "2005", "what": "Medical device rules covering software; INVIMA registration by risk class.", "url": "https://normograma.invima.gov.co/compilacion/docs/decreto_4725_2005.htm" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-04-13", "headline": "Regulator orders hospital and insurer to fix data handling after a patient's record leaked", "paraphrase": "Sensitive details from a woman's health record reached community leaders without her consent. The data protection regulator found the hospital and her health insurer at fault and ordered five corrective measures, including staff training and stronger confidentiality.", "source": "La FM", "url": "https://www.lafm.com.co/economia/sin-sanciona-a-eps-por-revelar-datos-personales-de-paciente-que-interrumpe-su-embarazo-396092", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-08-23", "headline": "Insurer sanctioned for sending a patient's full record to the patient's employer", "paraphrase": "During a workplace illness review, a health insurer sent a patient's complete record, including sensitive test results, to four managers at the patient's employer. The data protection regulator sanctioned the insurer, saying the disclosure had no necessity or relevance.", "source": "El Tiempo", "url": "https://www.eltiempo.com/salud/sic-sanciona-a-sos-eps-por-divulgar-sin-autorizacion-la-historia-clinica-de-paciente-con-vih-3484039", "theme": "sold_or_shared", "status": "finding" }, { "date": "2024-10-17", "headline": "Court orders clinic to apologise after staff passed patient data to an outside group", "paraphrase": "Clinic staff shared a woman's personal and medical details with an outside organisation, which then called and messaged her. The Constitutional Court ruled her privacy was violated and ordered the clinic to apologise publicly and investigate its staff.", "source": "El Colombiano", "url": "https://www.elcolombiano.com/colombia/salud/aborto-clinica-que-filtro-datos-de-mujer-que-pidio-ive-a-fundacion-tendra-que-investigar-a-su-personal-FC25637332", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-04-02", "headline": "Cyberattack on the national health regulator exposed patient records and complaints", "paraphrase": "The national health regulator confirmed unauthorised access to its document system. Reports say files downloaded included medical histories and patients' petitions and complaints, about 1.6 percent of its document store.", "source": "Pulzo", "url": "https://www.pulzo.com/nacion/crece-alerta-por-ataque-supersalud-por-que-filtraron-datos-pacientes-PP5122633", "theme": "breach", "status": "admitted" } ] }, { "iso3": "ECU", "name": "Ecuador", "region": "Americas", "overall": 43, "rank": "80=", "likelyRank": "61 to 106", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Ecuadorian law gives free data access and a record copy within 48 hours, but Health Ministry records are shared by default and still fragmented.", "categories": { "access": { "score": 50, "summary": "The data protection law gives free access within 15 days, and the health records rule requires a certified copy within 48 hours. No national patient portal showing the record was found, so access runs facility by facility.", "sources": [ { "title": "Ley Organica de Proteccion de Datos Personales, Registro Oficial Suplemento 459", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf", "date": "2021-05-26", "publisherClass": "legal_text" }, { "title": "Acuerdo Ministerial 5216, Reglamento de informacion confidencial en el Sistema Nacional de Salud (MSP)", "url": "https://www.salud.gob.ec/wp-content/uploads/2022/09/A.M.-5216-Reglamento-de-informacion-confidencial-en-SNS.pdf", "date": "2015-01-29", "publisherClass": "legal_text" }, { "title": "HealthBird anuncia su salida de Ecuador (El Comercio)", "url": "https://www.elcomercio.com/actualidad/ecuador/healthbird-contrato-iess-permanencia-ecuador/", "date": "2025-12-08", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "The LOPDP lets health providers process health data without consent for diagnosis, treatment and running health services. Ministry records go into one central database, with no opt-out and no access log patients can see.", "sources": [ { "title": "Ley Organica de Proteccion de Datos Personales, articulos 30 y 31", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf", "date": "2021-05-26", "publisherClass": "legal_text" }, { "title": "Acuerdo Ministerial 5216, Reglamento de informacion confidencial en el Sistema Nacional de Salud (MSP)", "url": "https://www.salud.gob.ec/wp-content/uploads/2022/09/A.M.-5216-Reglamento-de-informacion-confidencial-en-SNS.pdf", "date": "2015-01-29", "publisherClass": "legal_text" }, { "title": "La Historia Clinica Electronica ya funciona en 1.922 unidades de salud del MSP (Edicion Medica)", "url": "https://www.edicionmedica.ec/secciones/gestion/la-historia-clinica-electronica-ya-funciona-en-1-922-unidades-de-salud-del-msp-101601", "date": "2024-02-01", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "The LOPDP makes health data a special category with breach notice within five days, and the regulator issued its first fines in December 2025. No health-sector sanction was found, and an unconfirmed 20-million-record Health Ministry database went up for sale in August 2026.", "sources": [ { "title": "Ley Organica de Proteccion de Datos Personales, articulos 25, 43 y 72", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf", "date": "2021-05-26", "publisherClass": "legal_text" }, { "title": "SPDP emite sus primeras sanciones por infracciones graves (SPDP prensa)", "url": "https://spdp.gob.ec/prensa/", "date": "2025-12-01", "publisherClass": "official" }, { "title": "Sanciones, resoluciones SPDP", "url": "https://spdp.gob.ec/sanciones/", "date": "undated", "publisherClass": "official" }, { "title": "Base de datos del Ministerio de Salud, con 20 millones de registros, se ofreceria por $900 (Expreso)", "url": "https://www.expreso.ec/ciencia-y-tecnologia/base-datos-ministerio-salud-20-millones-registros-ofreceria-900-292978.html", "date": "2026-08-19", "publisherClass": "news" } ] }, "journey": { "score": 40, "summary": "The Ministry's IT director reported in early 2024 that 1,922 of its units shared outpatient summaries. In September 2026 the minister still called the system fragmented and signed a USD 240 million, seven-year contract to connect 1,742 facilities.", "sources": [ { "title": "Agenda Digital de Salud 2023-2027 (MSP)", "url": "https://www.salud.gob.ec/wp-content/uploads/2023/06/Manual_Agenda_Digital_2023_Seg.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "La Historia Clinica Electronica ya funciona en 1.922 unidades de salud del MSP (Edicion Medica)", "url": "https://www.edicionmedica.ec/secciones/gestion/la-historia-clinica-electronica-ya-funciona-en-1-922-unidades-de-salud-del-msp-101601", "date": "2024-02-01", "publisherClass": "news" }, { "title": "Ministerio de Salud adjudica a CNT la plataforma para gestion de hospitales publicos por USD 240 millones (Primicias)", "url": "https://www.primicias.ec/sociedad/contrato-gestion-hospitales-ecuador-cnt-dedalus-compras-publicas-132175/", "date": "2026-09-09", "publisherClass": "news" } ] }, "commercial": { "score": 52, "summary": "Sensitive data needs explicit consent, and any processing of anonymised health data needs prior SPDP authorisation backed by a Health Ministry report. No enforcement against health data sales or health-based advertising was found.", "sources": [ { "title": "Ley Organica de Proteccion de Datos Personales, articulos 16, 26 y 31", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf", "date": "2021-05-26", "publisherClass": "legal_text" }, { "title": "Que implica el trato entre CNT, el IESS y HealthBird? (Ecuador Chequea)", "url": "https://ecuadorchequea.com/que-implica-el-trato-entre-cnt-el-iess-y-healthbird/", "date": "2025-12-04", "publisherClass": "news" } ] }, "clinical": { "score": 40, "summary": "Clinicians in Health Ministry units can see a shared summary of earlier outpatient visits, diagnoses and treatments. Social security, military, police and private providers were not connected, and in 2026 the minister called public health information scattered and fragmented.", "sources": [ { "title": "Acuerdo Ministerial 5216, Reglamento de informacion confidencial en el Sistema Nacional de Salud (MSP)", "url": "https://www.salud.gob.ec/wp-content/uploads/2022/09/A.M.-5216-Reglamento-de-informacion-confidencial-en-SNS.pdf", "date": "2015-01-29", "publisherClass": "legal_text" }, { "title": "La Historia Clinica Electronica ya funciona en 1.922 unidades de salud del MSP (Edicion Medica)", "url": "https://www.edicionmedica.ec/secciones/gestion/la-historia-clinica-electronica-ya-funciona-en-1-922-unidades-de-salud-del-msp-101601", "date": "2024-02-01", "publisherClass": "news" }, { "title": "Ministerio de Salud adjudica a CNT la plataforma para gestion de hospitales publicos por USD 240 millones (Primicias)", "url": "https://www.primicias.ec/sociedad/contrato-gestion-hospitales-ecuador-cnt-dedalus-compras-publicas-132175/", "date": "2026-09-09", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Safeguards include an SPDP permit plus ethics committees, a statutory confidentiality duty, and patient authorisation for research use of records. Anonymised data still needs SPDP authorisation but no individual consent, and no general opt-out exists.", "sources": [ { "title": "Ley Organica de Proteccion de Datos Personales, articulos 30 a 32", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf", "date": "2021-05-26", "publisherClass": "legal_text" }, { "title": "Nuevo reglamento para comites de etica esta vigente (MSP)", "url": "https://www.salud.gob.ec/nuevo-reglamento-para-comites-de-etica-esta-vigente/", "date": "2022-08-09", "publisherClass": "official" }, { "title": "Reglamento del Comite de Etica de Investigacion en Seres Humanos CEISH-INSPI", "url": "https://www.investigacionsalud.gob.ec/wp-content/uploads/2025/08/Reglamento_CEISHINSPI-signed.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Acuerdo Ministerial 5216, Reglamento de informacion confidencial en el Sistema Nacional de Salud (MSP)", "url": "https://www.salud.gob.ec/wp-content/uploads/2022/09/A.M.-5216-Reglamento-de-informacion-confidencial-en-SNS.pdf", "date": "2015-01-29", "publisherClass": "legal_text" } ] }, "ai": { "score": 45, "summary": "Since October 2025 any AI tool in health services needs bioethics committee review, and a 2026 SPDP rule requires impact assessments and audits for AI using personal data. ARCSA's rule naming machine-learning devices only takes effect around January 2027, with no AI-specific change control.", "sources": [ { "title": "Norma Tecnica de Telesalud, Acuerdo Ministerial 00044-2025, Registro Oficial Segundo Suplemento 153", "url": "http://www.acess.gob.ec/wp-content/uploads/2025/11/Norma-Tecnica-de-Telesalud.pdf", "date": "2025-10-28", "publisherClass": "legal_text" }, { "title": "Resolucion SPDP-SPD-2026-0009-R, Norma general de proteccion de datos en sistemas de inteligencia artificial", "url": "https://www.bolsadevaloresguayaquil.com/normativas/legal/archivos/285_PROTECCIONDEDATOSPERSONALESPARAUSODEINTELIGENCIAARTIFICIAL.PDF", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "Resolucion ARCSA-DE-2026-003-DASP, dispositivos medicos de uso humano (ARCSA)", "url": "https://www.controlsanitario.gob.ec/wp-content/uploads/downloads/2026/04/Resolucion-No.-ARCSA-DE-2026-003-DASP-Normativa-Tecnica-Sanitaria-Sustitutiva-para-la-obtencion-del-registro-sanitario-control-y-vigilancia-de-dispositivos-medicos-de-uso-humano.pdf", "date": "2026-04-28", "publisherClass": "legal_text" }, { "title": "Ley de Inteligencia Artificial: Comision de Educacion recomienda archivar el proyecto (El Universo)", "url": "https://www.eluniverso.com/noticias/politica/proyecto-de-ley-inteligencia-artificial-recomiendan-su-archivo-en-la-asamblea-nota/", "date": "2026-08-31", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley Organica de Proteccion de Datos Personales (LOPDP)", "level": "National", "year": "2021", "what": "Health data special category; free access in 15 days; portability; five-day breach notice; turnover-based fines.", "url": "https://www.finanzaspopulares.gob.ec/wp-content/uploads/2021/07/ley_organica_de_proteccion_de_datos_personales.pdf" }, { "name": "Acuerdo Ministerial 5216 (informacion confidencial en el Sistema Nacional de Salud)", "level": "National", "year": "2015", "what": "Record confidentiality; certified copy within 48 hours; patient authorises non-care uses.", "url": "https://www.salud.gob.ec/wp-content/uploads/2022/09/A.M.-5216-Reglamento-de-informacion-confidencial-en-SNS.pdf" }, { "name": "Acuerdo Ministerial 00005-2022 (comites de etica de investigacion CEISH y CEAS)", "level": "National", "year": "2022", "what": "Approval and oversight of research ethics committees for public and private institutions.", "url": "https://www.salud.gob.ec/nuevo-reglamento-para-comites-de-etica-esta-vigente/" }, { "name": "Acuerdo Ministerial 00044-2025 (Norma Tecnica de Telesalud)", "level": "National", "year": "2025", "what": "Binding telehealth rules; e-prescriptions; bioethics committee review of AI tools in health services.", "url": "http://www.acess.gob.ec/wp-content/uploads/2025/11/Norma-Tecnica-de-Telesalud.pdf" }, { "name": "Resolucion SPDP-SPD-2026-0009-R (datos personales en sistemas de inteligencia artificial)", "level": "National", "year": "2026", "what": "AI using personal data needs transparency, risk management, impact assessment and audits.", "url": "https://www.bolsadevaloresguayaquil.com/normativas/legal/archivos/285_PROTECCIONDEDATOSPERSONALESPARAUSODEINTELIGENCIAARTIFICIAL.PDF" }, { "name": "Resolucion ARCSA-DE-2026-003-DASP (dispositivos medicos de uso humano)", "level": "National", "year": "2026", "what": "Defines software and machine-learning medical devices; IMDRF risk classes; in force nine months after signing.", "url": "https://www.controlsanitario.gob.ec/wp-content/uploads/downloads/2026/04/Resolucion-No.-ARCSA-DE-2026-003-DASP-Normativa-Tecnica-Sanitaria-Sustitutiva-para-la-obtencion-del-registro-sanitario-control-y-vigilancia-de-dispositivos-medicos-de-uso-humano.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-21", "headline": "Court finds clinic ignored order to hand a patient copies of her own record", "paraphrase": "A patient won a data access case ordering a dental clinic to give her certified copies of her record. The clinic did not comply. The Constitutional Court found it in breach, ordered delivery, a public apology and possible fines.", "source": "Corte Constitucional del Ecuador", "url": "https://www.corteconstitucional.gob.ec/incumplimiento-de-la-sentencia-de-habeas-data-por-parte-de-un-centro-odontologico/", "theme": "access_refused", "status": "finding" }, { "date": "2026-08-20", "headline": "Database said to hold millions of health and social security records offered for sale", "paraphrase": "A seller online offered a database of more than 20 million records, said to include names, addresses and health and social security data, for 900 dollars. The report says the source had not confirmed or denied the leak.", "source": "Edición Médica", "url": "https://www.edicionmedica.ec/secciones/profesionales/presunta-filtracion-de-datos-del-msp-ponen-en-riesgo-20-millones-de-registros--105256", "theme": "breach", "status": "alleged" }, { "date": "2026-06-13", "headline": "Report says millions of public health records, including clinical histories, were taken", "paraphrase": "A newspaper reports that an attacker allegedly took 14.8 million records and 10.6 million photos from the public health system in 2025, including clinical histories and emergency forms, later passed off as civil registry data.", "source": "Extra", "url": "https://www.extra.ec/noticia/premium/robo-datos-ecuador-sistemas-siguen-siendo-vulnerables-155958.html", "theme": "breach", "status": "alleged" } ] }, { "iso3": "SWZ", "name": "Eswatini", "region": "Africa", "overall": 43, "rank": "80=", "likelyRank": "59 to 106", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Most public clinics share one national electronic record, but patients get no portal, no sharing choices, and health data rules are still in draft.", "categories": { "access": { "score": 40, "summary": "Section 19 of the Data Protection Act 2022 gives a right to a copy of your data, including who has had access to it, but at a prescribed fee. We found no patient portal, so requests go facility by facility.", "sources": [ { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" }, { "title": "Eswatini Data Protection Authority: Regulatory Frameworks and data protection rights", "url": "https://www.edpa.org.sz/RegulatoryFrameworks.html", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "Health data may be processed without consent for treatment and facility administration, and the national CMIS record is shared across public clinics with no opt-out we could find. A right to learn who accessed your data exists in law, not verified in practice.", "sources": [ { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" }, { "title": "Rural health monitors wield digital handheld devices to help close Eswatini's immunisation gap (Gavi VaccinesWork)", "url": "https://www.gavi.org/vaccineswork/rural-health-monitors-wield-digital-handheld-devices-help-close-eswatinis", "date": "2026-07-20", "publisherClass": "news" } ] }, "privacy": { "score": 55, "summary": "Health is sensitive data under the 2022 Act, with criminal fines up to E100 million or 5% of turnover. The regulator has decided one health-sector complaint and is drafting health data guidelines, but it has published only three enforcement notices.", "sources": [ { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" }, { "title": "Eswatini Data Protection Authority: Enforcement Decisions Register", "url": "https://www.edpa.org.sz/enforcement.html", "date": "undated", "publisherClass": "official" }, { "title": "Eswatini Data Protection Authority (home page)", "url": "https://www.edpa.org.sz/", "date": "undated", "publisherClass": "official" }, { "title": "Health data guidelines enter validation stage (Times of Eswatini)", "url": "https://times.co.sz/39805/news/health-data-guidelines-enter-validation-stage/", "date": "2026-07-28", "publisherClass": "news" } ] }, "journey": { "score": 50, "summary": "The Ministry of Health's 2024 plan says 71% of health facilities have electronic records in the national CMIS, targeting 95%, and a community system now feeds it. Lab links and hospital modules are still being built, and private care is not shown as linked.", "sources": [ { "title": "National Health Sector Strategic Plan 2024/25 - 2027/28 (Ministry of Health)", "url": "https://www.ccm.org.sz/strategic-plans/docs/Eswatini_NATIONAL_HEALTH_SECTOR_STRATEGIC_PLAN_2024_compressed.pdf", "date": "2024-08", "publisherClass": "official" }, { "title": "Restructuring Paper, Health System Strengthening for Human Capital Development in Eswatini (P168564), World Bank", "url": "https://documents1.worldbank.org/curated/en/099020825065511939/pdf/P168564-b672e385-ca87-4088-9535-b4f0dd21f07d.pdf", "date": "2025-02", "publisherClass": "intergov" }, { "title": "From Paper to Pixels: Driving the Digital Transformation of Community Health Services in Eswatini (World Bank)", "url": "https://www.worldbank.org/en/news/feature/2026/02/23/from-paper-to-pixels-driving-the-digital-transformation-of-community-health-services-in-eswatini", "date": "2026-02-23", "publisherClass": "intergov" } ] }, "commercial": { "score": 42, "summary": "People can stop direct marketing at any time, and health data needs consent or a listed exemption. De-identified data falls outside the Act, and we found no rules on selling health data, brokers or health apps.", "sources": [ { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" } ] }, "clinical": { "score": 45, "summary": "In public facilities on CMIS, clinicians can open a patient's record held in the central database, and Gavi reports vaccination records showing at any public clinic. Coverage stops at about 71% of facilities and does not reach private care.", "sources": [ { "title": "Rural health monitors wield digital handheld devices to help close Eswatini's immunisation gap (Gavi VaccinesWork)", "url": "https://www.gavi.org/vaccineswork/rural-health-monitors-wield-digital-handheld-devices-help-close-eswatinis", "date": "2026-07-20", "publisherClass": "news" }, { "title": "Restructuring Paper, Health System Strengthening for Human Capital Development in Eswatini (P168564), World Bank", "url": "https://documents1.worldbank.org/curated/en/099020825065511939/pdf/P168564-b672e385-ca87-4088-9535-b4f0dd21f07d.pdf", "date": "2025-02", "publisherClass": "intergov" }, { "title": "National Health Sector Strategic Plan 2024/25 - 2027/28 (Ministry of Health)", "url": "https://www.ccm.org.sz/strategic-plans/docs/Eswatini_NATIONAL_HEALTH_SECTOR_STRATEGIC_PLAN_2024_compressed.pdf", "date": "2024-08", "publisherClass": "official" }, { "title": "Fighting the HIV/AIDS Battle in Eswatini (FEI Systems)", "url": "https://feisystems.com/news/fighting-the-hiv-aids-battle-in-eswatini/", "date": "undated", "publisherClass": "blog_vendor" } ] }, "research": { "score": 46, "summary": "Research use of personal data is exempt from most of the 2022 Act's principles without consent, though security and de-identification rules still apply. An ethics board reviews over 100 applications a year, and trials need regulator approval.", "sources": [ { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" }, { "title": "Medicines and Related Substances Control Act, 2016 (Act 9 of 2016)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_Medicines-and-Related-Substances-Control-Act_1965.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "Minister unveils 2026-2028 Health and Human Research Review Board (Eswatini Positive News)", "url": "https://eswatinipositivenews.online/minister-unveils-2026-2028-health-and-human-research-review-board/", "date": "2026-01-19", "publisherClass": "news" } ] }, "ai": { "score": 25, "summary": "Eswatini has no AI law and no rules for clinical AI. The 2016 Medicines Act regulates medical devices but does not mention software, and its regulator only got a board in January 2026.", "sources": [ { "title": "Medicines and Related Substances Control Act, 2016 (Act 9 of 2016)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_Medicines-and-Related-Substances-Control-Act_1965.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "Data Protection Act, 2022 (Act No. 5 of 2022), Government Gazette Extraordinary Vol. LX No. 41", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf", "date": "2022-03-04", "publisherClass": "legal_text" }, { "title": "How the absence of a drug-testing facility is gambling with the lives of emaSwati (Inhlase)", "url": "https://inhlase.com/how-the-absence-of-a-drug-testing-facility-is-gambling-with-the-lives-of-emaswati/", "date": "2026-08-06", "publisherClass": "news" }, { "title": "PM urges AI rules to protect children, uphold human dignity (Times of Eswatini)", "url": "https://times.co.sz/34851/news/pm-urges-ai-rules-to-protect-children-uphold-human-dignity/", "date": "2026-07-06", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2022 (Act No. 5 of 2022)", "level": "National", "year": "2022", "what": "Health is sensitive data; access, correction and marketing objection rights; breach notice; fines up to E100 million.", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf" }, { "name": "Medicines and Related Substances Control Act, 2016 (Act 9 of 2016)", "level": "National", "year": "2016", "what": "Creates the Medicines Regulatory Authority; registers medicines and devices; trials need approval and good clinical practice.", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_Medicines-and-Related-Substances-Control-Act_1965.pdf" }, { "name": "Eswatini Communications Commission Act, 2013", "level": "National", "year": "2013", "what": "Sets up the Commission that the Data Protection Act names as the data protection authority.", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/SWZ_Eswatini_The-Data-Protection-Act_2022.pdf" }, { "name": "Draft advisory guidelines on processing personal health data", "level": "National", "year": "2026", "what": "Draft regulator guidance on collecting, sharing, securing health data and breach notice; in validation July 2026.", "url": "https://times.co.sz/39805/news/health-data-guidelines-enter-validation-stage/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-08", "headline": "Deaf patients say hospitals without interpreters force them to share health details with others", "paraphrase": "Deaf patients told investigative reporters that public hospitals rarely provide sign language interpreters, so relatives or strangers relay what clinicians say. They said this strips them of privacy and risks errors in what they are told.", "source": "Inhlase Centre for Investigative Journalism", "url": "https://inhlase.com/deaf-patients-left-in-dangerous-silence-in-eswatinis-hospitals/", "theme": "other", "status": "self_reported" }, { "date": "2026-08-19", "headline": "Eswatini signs US health funding deal amid concern over sharing health data", "paraphrase": "Eswatini signed a US health funding agreement that, under the wider scheme, trades funding for access to pathogen samples and surveillance data. Critics warned the deal could expose the country's health data to abuse.", "source": "APAnews (African Press Agency)", "url": "https://apanews.net/eswatini-signs-195m-us-health-deal-amid-data-sharing-concerns/", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "MYS", "name": "Malaysia", "region": "Asia", "overall": 43, "rank": "80=", "likelyRank": "60 to 107", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Malaysia is digitising public care toward one record per person, but its data law exempts the government hospitals most patients use.", "categories": { "access": { "score": 40, "summary": "The PDPA right to a copy in 21 days (fee up to RM30) binds only private providers; government facilities issue a medical report, not the record. MySejahtera shows parts (base 45, minus 5 fee, minus 5 scope, plus 5 portal).", "sources": [ { "title": "Personal Data Protection Act 2010 (Act 709), bilingual text (Department of Personal Data Protection)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDANG-MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Garis Panduan Pengendalian dan Pengurusan Rekod Perubatan Pesakit di Fasiliti KKM (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/Garis%20Panduan%20Pengendalian%20dan%20Pengurusan%20Rekod%20Perubatan%20Pesakit%20di%20Fasiliti%20KKM.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Code of Practice for Private Hospitals in the Healthcare Industry, under PDPA s.23 (APHM, published by the PDP Department)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/COP_KOD-AMALAN-UNTUK-HOSPITAL-SWASTA-DALAM-INDUSTRI-JAGAAN-KESIHATAN-APHM.pdf", "date": "undated", "publisherClass": "official" }, { "title": "MySejahtera Application (Official Malaysia Government Website)", "url": "https://www.malaysia.gov.my/en/categories/health/health-facilities-and-amenities/mysejahtera-application", "date": "2026-03-16", "publisherClass": "official" } ] }, "control": { "score": 45, "summary": "Since August 2026 a ministry guideline lets patients withdraw consent, by written notice, for sharing their data with other health workers. Consent for care is implied, records are shared across government facilities, and a log patients can see was not verified.", "sources": [ { "title": "Surat Pekeliling KPK Bil. 21/2026: Garis Panduan Persetujuan Pemprosesan Data Kesihatan (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/SURAT%20PEKELILING%20KPK%20BIL.%2021_2026_PELAKSANAAN%20GARIS%20PANDUAN%20PERSETUJUAN%20PEMPROSESAN%20DATA%20KESIHATAN.pdf", "date": "2026-08-10", "publisherClass": "official" }, { "title": "App will enable patients to control sharing of medical info (The Star)", "url": "https://www.thestar.com.my/news/nation/2026/06/27/app-will-enable-patients-to-control-sharing-of-medical-info", "date": "2026-06-27", "publisherClass": "news" }, { "title": "Garis Panduan Pengendalian dan Pengurusan Rekod Perubatan Pesakit di Fasiliti KKM (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/Garis%20Panduan%20Pengendalian%20dan%20Pengurusan%20Rekod%20Perubatan%20Pesakit%20di%20Fasiliti%20KKM.pdf", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive personal data under the PDPA, and 2024 amendments added breach notification and fines up to RM1 million. But the law does not cover federal or state government, which runs most hospitals, and no health-sector enforcement case was found.", "sources": [ { "title": "Personal Data Protection Act 2010 (Act 709), bilingual text (Department of Personal Data Protection)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDANG-MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Personal Data Protection (Amendment) Act 2024 [Act A1727] (Department of Personal Data Protection)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Akta-A1727-bm.pdf", "date": "2024-10-17", "publisherClass": "legal_text" }, { "title": "P.U. (B) 522: Appointment of date of coming into operation, PDP (Amendment) Act 2024", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/12/PENETAPAN-TARIKH-PERMULAAN-KUAT-KUASA.pdf", "date": "2024-12-24", "publisherClass": "legal_text" }, { "title": "No leakage of sensitive data in website hack, says health ministry (FMT)", "url": "https://www.freemalaysiatoday.com/category/nation/2026/06/30/no-leakage-of-sensitive-data-in-website-hack-says-health-ministry", "date": "2026-06-30", "publisherClass": "news" } ] }, "journey": { "score": 38, "summary": "By end-2025, 412 government clinics ran cloud EMR, but only 23 public hospitals had hospital information systems, with all due by 2029. MySejahtera holds 7 million prescription records, and the level of public and private integration was not verified.", "sources": [ { "title": "MOH to integrate 90,000 medical imaging records into MySejahtera (CodeBlue)", "url": "https://codeblue.galencentre.org/2026/02/moh-to-integrate-90000-medical-imaging-records-into-mysejahtera-dzulkefly/", "date": "2026-02-27", "publisherClass": "news" }, { "title": "Pelan Strategik Pendigitalan KKM 2026-2030 (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pelan-strategik/DokumenPSPKKM20262030_version-1.pdf", "date": "2026", "publisherClass": "official" }, { "title": "Rekod perubatan elektronik di hospital, klinik awam menjelang 2029 (Astro Awani)", "url": "https://www.astroawani.com/berita-malaysia/rekod-perubatan-elektronik-di-hospital-klinik-awam-menjelang-2029-547729", "date": "2025-11-15", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "Private providers need explicit consent to process health data and must stop direct marketing on request. A 2026 ministry guideline says a device company wanting EMR data must get each patient's explicit consent, but no ban on selling de-identified data was found.", "sources": [ { "title": "Personal Data Protection Act 2010 (Act 709), bilingual text (Department of Personal Data Protection)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDANG-MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Code of Practice for Private Hospitals in the Healthcare Industry, under PDPA s.23 (APHM, published by the PDP Department)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/COP_KOD-AMALAN-UNTUK-HOSPITAL-SWASTA-DALAM-INDUSTRI-JAGAAN-KESIHATAN-APHM.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Surat Pekeliling KPK Bil. 21/2026: Garis Panduan Persetujuan Pemprosesan Data Kesihatan (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/SURAT%20PEKELILING%20KPK%20BIL.%2021_2026_PELAKSANAAN%20GARIS%20PANDUAN%20PERSETUJUAN%20PEMPROSESAN%20DATA%20KESIHATAN.pdf", "date": "2026-08-10", "publisherClass": "official" } ] }, "clinical": { "score": 32, "summary": "Doctors can see records from other government facilities that use the ministry's systems, but private providers are not linked and most public hospitals still lack an EMR. How often clinicians open cross-facility records was not verified.", "sources": [ { "title": "App will enable patients to control sharing of medical info (The Star)", "url": "https://www.thestar.com.my/news/nation/2026/06/27/app-will-enable-patients-to-control-sharing-of-medical-info", "date": "2026-06-27", "publisherClass": "news" }, { "title": "Surat Pekeliling KPK Bil. 21/2026: Garis Panduan Persetujuan Pemprosesan Data Kesihatan (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/SURAT%20PEKELILING%20KPK%20BIL.%2021_2026_PELAKSANAAN%20GARIS%20PANDUAN%20PERSETUJUAN%20PEMPROSESAN%20DATA%20KESIHATAN.pdf", "date": "2026-08-10", "publisherClass": "official" }, { "title": "MOH to integrate 90,000 medical imaging records into MySejahtera (CodeBlue)", "url": "https://codeblue.galencentre.org/2026/02/moh-to-integrate-90000-medical-imaging-records-into-mysejahtera-dzulkefly/", "date": "2026-02-27", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Research use of patient data needs separate consent under the 2026 ministry guideline, but the ministry's ethics committee can waive it when no identifiers are collected. Base 40, plus 3 for the ethics body and 3 for the consent route; no general opt-out exists.", "sources": [ { "title": "Surat Pekeliling KPK Bil. 21/2026: Garis Panduan Persetujuan Pemprosesan Data Kesihatan (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/SURAT%20PEKELILING%20KPK%20BIL.%2021_2026_PELAKSANAAN%20GARIS%20PANDUAN%20PERSETUJUAN%20PEMPROSESAN%20DATA%20KESIHATAN.pdf", "date": "2026-08-10", "publisherClass": "official" }, { "title": "Personal Data Protection Act 2010 (Act 709), bilingual text (Department of Personal Data Protection)", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDANG-MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Pelan Strategik Pendigitalan KKM 2026-2030 (Ministry of Health)", "url": "https://www.moh.gov.my/images/04-penerbitan/pelan-strategik/DokumenPSPKKM20262030_version-1.pdf", "date": "2026", "publisherClass": "official" } ] }, "ai": { "score": 45, "summary": "Software is a medical device under Act 737 and registered devices follow change notification rules, but no AI-specific device rules were found. The national AI ethics guidelines are voluntary, and the AI Governance Bill was still awaiting Cabinet in September 2026.", "sources": [ { "title": "Definition of a medical device under section 2 of Act 737 (Medical Device Authority)", "url": "https://www.mda.gov.my/index.php/component/content/article/1768-appendix-1-definition-of-a-medical-device-as-outlined-under-section-2-of-act-737?catid=170:professional&Itemid=277", "date": "undated", "publisherClass": "official" }, { "title": "Publication of first edition guidance document MDA/GD/0072 Change Management for Registered Medical Devices (MDA)", "url": "https://www.mda.gov.my/index.php/announcement/1799-publication-of-first-edition-guidance-document-change-management-for-registered-medical-devices", "date": "undated", "publisherClass": "official" }, { "title": "National Guidelines on Artificial Intelligence Governance and Ethics (AIGE) (Official Malaysia Government Website)", "url": "https://www.malaysia.gov.my/en/my-initiative/perkhidmatan-digital-keseluruhan-kerajaan/tadbir-urus/national-guidelines-on-artificial-intelligence-governance-and-ethics-aige", "date": "2025-10-12", "publisherClass": "official" }, { "title": "Digital minister says Malaysia's draft AI Governance Bill complete, hopes to table it by Q1 2027 (Malay Mail)", "url": "https://www.malaymail.com/news/malaysia/2026/09/10/digital-minister-says-malaysias-draft-ai-governance-bill-complete-hopes-to-table-it-by-q1-2027/234656", "date": "2026-09-10", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Act 2010 (Act 709)", "level": "National", "year": "2010", "what": "Health is sensitive data needing explicit consent; access right; does not apply to federal or state government.", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/UNDANG-UNDANG-MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf" }, { "name": "Personal Data Protection (Amendment) Act 2024 (Act A1727)", "level": "National", "year": "2024", "what": "Adds breach notification, data protection officers, data portability and fines up to RM1 million; phased in 2025.", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Akta-A1727-bm.pdf" }, { "name": "Private Healthcare Facilities and Services Act 1998 (Act 586)", "level": "National", "year": "1998", "what": "Licenses private hospitals; the private hospital PDPA code of practice applies to them.", "url": "https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/COP_KOD-AMALAN-UNTUK-HOSPITAL-SWASTA-DALAM-INDUSTRI-JAGAAN-KESIHATAN-APHM.pdf" }, { "name": "Medical Device Act 2012 (Act 737)", "level": "National", "year": "2012", "what": "Covers software as a medical device; registration with the Medical Device Authority required.", "url": "https://www.mda.gov.my/index.php/component/content/article/1768-appendix-1-definition-of-a-medical-device-as-outlined-under-section-2-of-act-737?catid=170:professional&Itemid=277" }, { "name": "Cyber Security Act 2024 (Act 854)", "level": "National", "year": "2024", "what": "Health is a critical information infrastructure sector, with the Ministry of Health as sector lead.", "url": "https://www.moh.gov.my/images/04-penerbitan/pelan-strategik/DokumenPSPKKM20262030_version-1.pdf" }, { "name": "Guideline on Consent for Processing Health Data (KPK Circular 21/2026)", "level": "National", "year": "2026", "what": "Implied consent for care, explicit for other uses; limited withdrawal right in ministry facilities.", "url": "https://www.moh.gov.my/images/04-penerbitan/pekeliling/SURAT%20PEKELILING%20KPK%20BIL.%2021_2026_PELAKSANAAN%20GARIS%20PANDUAN%20PERSETUJUAN%20PEMPROSESAN%20DATA%20KESIHATAN.pdf" }, { "name": "Digital Health Act (planned)", "level": "National", "year": "2030", "what": "Planned health data law; the ministry plan targets a Cabinet paper by 2027 and gazettement by 2030.", "url": "https://www.moh.gov.my/images/04-penerbitan/pelan-strategik/DokumenPSPKKM20262030_version-1.pdf" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-18", "headline": "Medical council suspends doctor who posted a patient's details on a clinic Facebook page", "paraphrase": "The Malaysian Medical Council found a doctor guilty of posting a complainant's personal information on a clinic's Facebook page without written consent, failing to protect patient confidentiality, and suspended the doctor for two years.", "source": "Malaysian Medical Council", "url": "https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-04-18", "headline": "Doctor reprimanded for posting a patient's confidential information on social media", "paraphrase": "The Malaysian Medical Council found a doctor guilty of posting a patient's personal and medical information on a social media account without written consent, against a promise not to reveal it, and issued a reprimand.", "source": "Malaysian Medical Council", "url": "https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf", "theme": "sold_or_shared", "status": "finding" }, { "date": "2025-04-18", "headline": "Doctor reprimanded after a requested medical report took about ten months to arrive", "paraphrase": "The Malaysian Medical Council found that a doctor supplied a requested medical report roughly ten months after the request, failing to provide it within a reasonable time, and reprimanded the doctor along with a separate charge.", "source": "Malaysian Medical Council", "url": "https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2025-04-18", "headline": "Doctor reprimanded for filing a patient's assessment report in court without consent", "paraphrase": "The Malaysian Medical Council found a doctor guilty of disclosing a complainant's specialist assessment report, without consent, in an affidavit filed in a custody case against the complainant, and issued a reprimand.", "source": "Malaysian Medical Council", "url": "https://mmc.gov.my/wp-content/uploads/2025/04/DISCIPLINARY-PUNISHMENT-MEDICAL-ACT-1971-AMENDED-2012-2024.pdf", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "MCO", "name": "Monaco", "region": "Europe", "overall": 43, "rank": "80=", "likelyRank": "57 to 102", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Monaco gives a firm legal right to the full record and a new GDPR-style law, but there is no shared national record linking providers.", "categories": { "access": { "score": 50, "summary": "Law 1.454 of 2017 gives a right to all health information held by any provider, within 15 days. There is no national record portal, but the main public hospital runs a patient portal, so the score sits at the anchor base plus 5.", "sources": [ { "title": "Loi n° 1.454 du 30 octobre 2017 relative au consentement et à l'information en matière médicale (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2017/10-30-1.454", "date": "2017-10-30", "publisherClass": "legal_text" }, { "title": "Protection des données personnelles du patient (CHPG)", "url": "https://www.chpg.mc/protection-donnees-personnelles-du-patient/", "date": "undated", "publisherClass": "official" }, { "title": "Un nouveau portail en ligne pour les patients du CHPG (Monaco Hebdo)", "url": "https://monaco-hebdo.com/actualites/sante/un-nouveau-portail-en-ligne-pour-les-patiens-du-chpg/", "date": "2023-05-05", "publisherClass": "news" }, { "title": "Conditions générales d'utilisation du Portail MonacoSanté", "url": "https://www.monacosante.mc/e-venue/fr/conditions-d-utilisation-5-101.html", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "Each provider holds and controls its own file, and there is no shared record. Patients can object to outside hosting for a legitimate reason and files pass to a successor doctor only with consent, but there is no opt-out or patient-visible access log.", "sources": [ { "title": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé (Legimonaco)", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337", "date": "2020-11-05", "publisherClass": "legal_text" }, { "title": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565", "date": "2024-12-03", "publisherClass": "legal_text" } ] }, "privacy": { "score": 58, "summary": "Law 1.565 of 2024 follows the GDPR, with 72-hour breach notice and fines up to 10 million euros or 4% of turnover, but fines cannot hit the State. Health hosts need a cyber agency qualification; no health-sector fine was found.", "sources": [ { "title": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565", "date": "2024-12-03", "publisherClass": "legal_text" }, { "title": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé (Legimonaco)", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337", "date": "2020-11-05", "publisherClass": "legal_text" }, { "title": "L'APDP rappelle l'obligation de lui notifier les violations de données dans les meilleurs délais (APDP)", "url": "https://apdp.mc/lapdp-rappelle-lobligation-de-lui-notifier-les-violations-de-donnees-dans-les-meilleurs-delais/", "date": "2026-07-16", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 32, "summary": "Monaco has no national shared record, and links between providers rest on discharge letters and a government secure messaging service. National e-prescription and claims links were not verified, so the score sits in the weak band.", "sources": [ { "title": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé (Legimonaco)", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337", "date": "2020-11-05", "publisherClass": "legal_text" }, { "title": "Conditions générales d'utilisation du Portail MonacoSanté", "url": "https://www.monacosante.mc/e-venue/fr/conditions-d-utilisation-5-101.html", "date": "undated", "publisherClass": "official" }, { "title": "Post on 2024 results and 2025 plans (Centre Hospitalier Princesse Grace, LinkedIn)", "url": "https://fr.linkedin.com/posts/centre-hospitalier-princesse-grace_monaco-chpg-innovation-activity-7285626430363738112-Z29S", "date": "2025-01-16", "publisherClass": "official" }, { "title": "European Health Data Space Regulation (European Commission)", "url": "https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space-regulation-ehds_en", "date": "undated", "publisherClass": "intergov" } ] }, "commercial": { "score": 52, "summary": "Qualified hosts may not use or pass on the health data they store, and anyone can refuse marketing use of their data. No Monaco ban on selling health data or on data brokers was verified, so the score stays low in the mixed band.", "sources": [ { "title": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé (Legimonaco)", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337", "date": "2020-11-05", "publisherClass": "legal_text" }, { "title": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565", "date": "2024-12-03", "publisherClass": "legal_text" }, { "title": "Présentation aux acteurs monégasques de l'Assurance de leurs nouvelles obligations (APDP)", "url": "https://apdp.mc/presentation-aux-acteurs-monegasques-de-lassurance-de-leurs-nouvelles-obligations/", "date": "2026-03-12", "publisherClass": "official" } ] }, "clinical": { "score": 35, "summary": "A treating clinician sees another provider's notes only when a letter or secure message is sent. Clinicians inside the main public hospital share one digital file, but no cross-provider record or emergency access rule was found.", "sources": [ { "title": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé (Legimonaco)", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337", "date": "2020-11-05", "publisherClass": "legal_text" }, { "title": "Conditions générales d'utilisation du Portail MonacoSanté", "url": "https://www.monacosante.mc/e-venue/fr/conditions-d-utilisation-5-101.html", "date": "undated", "publisherClass": "official" }, { "title": "Post on 2024 results and 2025 plans (Centre Hospitalier Princesse Grace, LinkedIn)", "url": "https://fr.linkedin.com/posts/centre-hospitalier-princesse-grace_monaco-chpg-innovation-activity-7285626430363738112-Z29S", "date": "2025-01-16", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Trials need written consent and an ethics committee opinion, and health research using personal data needs a reasoned opinion from the data regulator. There is no general opt-out from secondary use, so the score is the anchor base plus two safeguards.", "sources": [ { "title": "Loi n° 1.265 du 23 décembre 2002 relative à la protection des personnes dans la recherche biomédicale (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2002/12-23-1.265", "date": "2002-12-23", "publisherClass": "legal_text" }, { "title": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565", "date": "2024-12-03", "publisherClass": "legal_text" } ] }, "ai": { "score": 38, "summary": "Monaco's 2002 medical devices law covers software and requires a conformity certificate, but it predates AI and has no change-control rules for learning systems. No AI law or clinical AI guidance was found, and EU AI Act rules do not apply.", "sources": [ { "title": "Loi n° 1.267 du 23 décembre 2002 relative aux dispositifs médicaux (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2002/12-23-1.267", "date": "2002-12-23", "publisherClass": "legal_text" }, { "title": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles (Legimonaco)", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565", "date": "2024-12-03", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Loi n° 1.454 du 30 octobre 2017 relative au consentement et à l'information en matière médicale", "level": "National", "year": "2017", "what": "Right to all health information held by providers within 15 days, or two months if older than five years.", "url": "https://legimonaco.mc/tnc/loi/2017/10-30-1.454" }, { "name": "Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnelles", "level": "National", "year": "2024", "what": "GDPR-style law; creates the APDP, 72-hour breach notice, fines up to 10 million euros or 4%.", "url": "https://legimonaco.mc/tnc/loi/2024/12-03-1.565" }, { "name": "Ordonnance Souveraine n° 8.337 du 5 novembre 2020 relative aux données de santé", "level": "National", "year": "2020", "what": "Medical file contents, 20-year retention, discharge letters, qualified health data hosts, incident reporting.", "url": "https://legimonaco.mc/tnc/ordonnance/2020/11-05-8.337" }, { "name": "Loi n° 1.265 du 23 décembre 2002 relative à la protection des personnes dans la recherche biomédicale", "level": "National", "year": "2002", "what": "Written, informed consent for biomedical research; ethics committee opinion; right to withdraw.", "url": "https://legimonaco.mc/tnc/loi/2002/12-23-1.265" }, { "name": "Loi n° 1.267 du 23 décembre 2002 relative aux dispositifs médicaux", "level": "National", "year": "2002", "what": "Medical devices, including their software, need a certificate of conformity before sale or use.", "url": "https://legimonaco.mc/tnc/loi/2002/12-23-1.267" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-10", "headline": "Monaco hospital apologises after exposing hundreds of blood donors' email addresses", "paraphrase": "A mass email inviting donors to a blood drive showed every recipient's address. Hundreds of donors were affected. The hospital apologised the next day and said no health or donation history was shared.", "source": "La Gazette de Monaco", "url": "https://lagazettedemonaco.com/actualites/societe/le-chpg-presente-ses-excuses-apres-une-fuite-de-donnees", "theme": "breach", "status": "admitted" } ] }, { "iso3": "SYC", "name": "Seychelles", "region": "Africa", "overall": 43, "rank": "80=", "likelyRank": "58 to 105", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Seychelles has a 2023 data law and one state electronic health system, but its regulator says the law risks going largely unenforced.", "categories": { "access": { "score": 40, "summary": "Section 27 of the Data Protection Act 2023 gives a free right to your data but sets no reply deadline, and the regulator says the Act risks going largely unenforced. There is no national patient portal, so patients ask the health service directly.", "sources": [ { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" }, { "title": "2026 Budget: Assumptions and Objectives of the 2026 Budget (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2026/02/2026-Budget-Assumptions-and-Objectives-of-the-2026-budget.pdf", "date": "2026-02", "publisherClass": "official" } ] }, "control": { "score": 42, "summary": "Health data may be used without consent for care and running health services, and eHIS records are open to all authorised providers. The law gives a right to a list of who accessed your data in the last 6 months, but we found no opt-out.", "sources": [ { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" }, { "title": "2026 Budget: Assumptions and Objectives of the 2026 Budget (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2026/02/2026-Budget-Assumptions-and-Objectives-of-the-2026-budget.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Professional Practice Guidelines: Good Medical and Dental Practice (Seychelles Medical and Dental Council)", "url": "https://smdcseychelles.org/wp-content/uploads/Good-Medical-and-Dental-Practice.pdf", "date": "2025-10-29", "publisherClass": "official" }, { "title": "Indian-funded digitisation of Seychelles' public health system nearing its completion (Trendsnafrica)", "url": "https://trendsnafrica.com/indian-funded-digitisation-of-seychelles-public-health-system-nearing-its-completion/", "date": "2023-06-22", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "The 2023 Act treats health data as sensitive and requires breach notice within 72 hours. But the Information Commission says the Act 'remains at risk of being largely unenforced', with its one data protection post still unfilled.", "sources": [ { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" }, { "title": "Annual Report 2025 (Information Commission)", "url": "https://www.infocom.sc/wp-content/uploads/Annual-Report-2025.pdf", "date": "2025-12", "publisherClass": "official" }, { "title": "Data Protection (Information Commission)", "url": "https://www.infocom.sc/data-protection/", "date": "undated", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 52, "summary": "The 2026 Budget says the state eHIS is deployed on all three main islands, with clinical use fully implemented and lab, pharmacy and imaging linked. These are government claims: usage figures and private clinic links were not verified.", "sources": [ { "title": "2026 Budget: Assumptions and Objectives of the 2026 Budget (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2026/02/2026-Budget-Assumptions-and-Objectives-of-the-2026-budget.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Strategic Direction Six: Improve Data for Impact (Ministry of Health)", "url": "https://www.health.gov.sc/national-health-strategic-plan-2022-2026-2/strategic-direction-six-improve-data-for-impact/", "date": "undated", "publisherClass": "official" }, { "title": "Seychelles National Development Strategy 2024-2028 (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2025/08/Seychelles-National-Development-Strategy-2024-2028.pdf", "date": "2025-08", "publisherClass": "official" }, { "title": "WHO and the European Union launch collaboration to advance digitized health systems in sub-Saharan Africa (WHO)", "url": "https://www.who.int/news/item/14-10-2025-who-and-the-european-union-launch-collaboration-to-advance-digitized-health-systems-in-sub-saharan-africa", "date": "2025-10-14", "publisherClass": "intergov" } ] }, "commercial": { "score": 40, "summary": "Health data needs explicit consent for uses outside care, research and other listed grounds, and offering to sell unlawfully disclosed data is a crime. We found no rule on direct marketing, health apps, data brokers or de-identified data.", "sources": [ { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" } ] }, "clinical": { "score": 50, "summary": "In the public system, eHIS is meant to let any authorised clinician on any island open the patient's record, with lab results online. We did not verify this in daily use or find any link to private clinics.", "sources": [ { "title": "2026 Budget: Assumptions and Objectives of the 2026 Budget (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2026/02/2026-Budget-Assumptions-and-Objectives-of-the-2026-budget.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Indian-funded digitisation of Seychelles' public health system nearing its completion (Trendsnafrica)", "url": "https://trendsnafrica.com/indian-funded-digitisation-of-seychelles-public-health-system-nearing-its-completion/", "date": "2023-06-22", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health data may be processed for research without consent under section 22 of the Data Protection Act, with no opt-out. A Ministry Health Research Ethics Committee reviews health research, but we found no clinical trials law.", "sources": [ { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" }, { "title": "Regulation & Registration Section (Ministry of Health)", "url": "https://www.health.gov.sc/regulation-registration-section/", "date": "undated", "publisherClass": "official" }, { "title": "Strategic Direction Six: Improve Data for Impact (Ministry of Health)", "url": "https://www.health.gov.sc/national-health-strategic-plan-2022-2026-2/strategic-direction-six-improve-data-for-impact/", "date": "undated", "publisherClass": "official" }, { "title": "Seychelles: Regulatory Authority (AMRH, AUDA-NEPAD)", "url": "https://amrh.nepad.org/amrh-countries/seychelles", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 20, "summary": "We found no rules for AI used in care: no medical device regulation and no health-AI guidance. The 2026 Budget only says government 'can now explore' AI with governance and data protection.", "sources": [ { "title": "2026 Budget: Assumptions and Objectives of the 2026 Budget (Ministry of Finance)", "url": "https://www.finance.gov.sc/wp-content/uploads/2026/02/2026-Budget-Assumptions-and-Objectives-of-the-2026-budget.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "Seychelles: Regulatory Authority (AMRH, AUDA-NEPAD)", "url": "https://amrh.nepad.org/amrh-countries/seychelles", "date": "undated", "publisherClass": "intergov" }, { "title": "Data Protection Act, 2023 (Act 24 of 2023), Official Gazette", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf", "date": "2023-12-22", "publisherClass": "legal_text" }, { "title": "Cabinet backs national artificial intelligence framework for education (Seychelles Nation)", "url": "https://www.nation.sc/articles/31810/cabinet-backs-national-artificial-intelligence-framework-for-education", "date": "2026-08-07", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2023 (Act 24 of 2023)", "level": "National", "year": "2023", "what": "Health is sensitive data; free access and portability; recipient list on request; 72-hour breach notice.", "url": "https://www.gazette.sc/sites/default/files/2023-12/Act%2024%20-%202023%20-%20Data%20Protection%20Act%202023.pdf" }, { "name": "Access to Information Act, 2018", "level": "National", "year": "2018", "what": "Sets up the Information Commission, which also enforces the Data Protection Act 2023.", "url": "https://www.infocom.sc/wp-content/uploads/Annual-Report-2025.pdf" }, { "name": "Health Care Agency (Repeal) Bill, 2026 (passed March 2026)", "level": "National", "year": "2026", "what": "Dissolves the Health Care Agency; its records and databases pass to the Ministry, with confidentiality duties kept.", "url": "https://www.gazette.sc/sites/default/files/2026-02/Bill%20No.%203%20-%20Health%20Care%20Agency%20%28Repeal%29%20Bill%202026.pdf" }, { "name": "Good Medical and Dental Practice guidelines (Seychelles Medical and Dental Council)", "level": "National", "year": "2025", "what": "Doctors must keep records confidential and share them only with consent or when legally required.", "url": "https://smdcseychelles.org/wp-content/uploads/Good-Medical-and-Dental-Practice.pdf" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ZAF", "name": "South Africa", "region": "Africa", "overall": 43, "rank": "80=", "likelyRank": "57 to 102", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "South African patients have strong paper rights under POPIA and the National Health Act, but records stay in each provider's or province's own system.", "categories": { "access": { "score": 40, "summary": "POPIA section 23 and PAIA give a right to your record within 30 days, but providers may charge a prescribed fee and no national patient portal was found. Scored as statutory right (45) minus 5 for the fee.", "sources": [ { "title": "Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf", "date": "2013-11-26", "publisherClass": "legal_text" }, { "title": "Promotion of Access to Information Act 2 of 2000 (Department of Justice consolidated copy)", "url": "https://www.justice.gov.za/legislation/acts/2000-002.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "HPCSA Guidelines on the Keeping of Patient Records, Booklet 9 (mirror copy)", "url": "https://www.hpcsa-blogs.co.za/wp-content/uploads/2022/08/Booklet-9-Guidelines-on-Patient-Records.pdf", "date": "2016-09", "publisherClass": "blog_vendor" }, { "title": "NHI Chief Directorate: Health Systems Digital Information (National Department of Health)", "url": "https://www.health.gov.za/nhi-cd-hs/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 42, "summary": "The National Health Act needs written consent to disclose records outside care, and POPIA lets you ask which third parties saw your data. But providers share for care without asking, and no system shows patients who opened their record.", "sources": [ { "title": "National Health Act 61 of 2003 (Government Gazette 26595)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/a61-03.pdf", "date": "2004-07-23", "publisherClass": "legal_text" }, { "title": "Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf", "date": "2013-11-26", "publisherClass": "legal_text" }, { "title": "Discovery Health: Permission to make certain information available to a third party (HealthID consent form)", "url": "https://discoveryhealthmedicalscheme.co.za/wcm/discoverycoza/assets/medical-aid/application-forms/2024/permission-to-make-certain-information-available-to-a-third-party.pdf", "date": "2024-10-01", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 60, "summary": "POPIA makes health special personal information, with fines up to R10 million and new 2026 health rules for insurers, schemes and employers. Breach notice has no fixed deadline, and no health-sector fine was found.", "sources": [ { "title": "Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf", "date": "2013-11-26", "publisherClass": "legal_text" }, { "title": "Regulations relating to the Processing of Data Subjects' Health Information by Certain Responsible Parties, 2026 (Gazette 54268, Notice 7198)", "url": "https://www.gov.za/sites/default/files/gcis_document/202603/54268gon7198.pdf", "date": "2026-03-06", "publisherClass": "legal_text" }, { "title": "Information Regulator: Enforcement notice issued to Dis-Chem due to contravention of POPIA", "url": "https://inforegulator.org.za/wp-content/uploads/2020/07/FINAL-MEDIA-STATEMENT-ENFORCEMENT-NOTICE-ISSUED-TO-DISCHEM-PHARMACIES-LTD.pdf", "date": "2023-09-01", "publisherClass": "official" }, { "title": "Information Regulator refers National Department of Health to the Enforcement Committee over COVID-19 data", "url": "https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Statement_Information-Regulator-Refers-NDOH-to-the-Enforcement-Committee.pdf", "date": "2023-02-20", "publisherClass": "official" } ] }, "journey": { "score": 33, "summary": "Public clinics share a patient registration number (HPRS, in 3,265 facilities), but hospital records sit in separate provincial systems and four provinces have none. A national clinic EMR is only starting a 3,200-facility rollout.", "sources": [ { "title": "National Department of Health Annual Report 2024/25", "url": "https://www.health.gov.za/wp-content/uploads/2025/11/NDoH-2024-25-Annual-Report-_-19-September-2025.pdf", "date": "2025-09-19", "publisherClass": "official" }, { "title": "Minister of Health reply to question NW2014 on hospital and PHC electronic records (PMG)", "url": "https://pmg.org.za/committee-question/37900/", "date": "2026-05-28", "publisherClass": "official" }, { "title": "Minister of Health reply to question NW4495 on EHR use in public hospitals and clinics (PMG)", "url": "https://pmg.org.za/committee-question/31734/", "date": "2025-08-01", "publisherClass": "official" }, { "title": "The 2024 CMS Industry Report is now available (Council for Medical Schemes)", "url": "https://www.medicalschemes.co.za/the-2024-cms-industry-report-is-now-available/", "date": "2025-12-04", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "POPIA requires opt-in consent for electronic direct marketing and treats health as special information, and the National Health Act bars disclosure without written consent. Insurers may still use health data for risk unless you object, and consumer health apps fall into gaps.", "sources": [ { "title": "Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf", "date": "2013-11-26", "publisherClass": "legal_text" }, { "title": "National Health Act 61 of 2003 (Government Gazette 26595)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/a61-03.pdf", "date": "2004-07-23", "publisherClass": "legal_text" }, { "title": "Regulatory challenges of digital health: mental health applications and personal data in South Africa (Frontiers in Pharmacology)", "url": "https://www.frontiersin.org/journals/pharmacology/articles/10.3389/fphar.2025.1498600/full", "date": "2025-04-30", "publisherClass": "academic" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 32, "summary": "Clinicians can see public lab results across facilities through the NHLS, which serves over 80 percent of South Africans, but no shared record exists across hospitals or between public and private care.", "sources": [ { "title": "National Health Act 61 of 2003 (Government Gazette 26595)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/a61-03.pdf", "date": "2004-07-23", "publisherClass": "legal_text" }, { "title": "About the National Health Laboratory Service", "url": "https://www.nhls.ac.za/about-us/", "date": "undated", "publisherClass": "official" }, { "title": "NHLS TrakCare Lab WebView results viewer", "url": "https://trakcarelabwebview.nhls.ac.za/trakcarelab/RDdefault.htm", "date": "undated", "publisherClass": "official" }, { "title": "Discovery Health: Permission to make certain information available to a third party (HealthID consent form)", "url": "https://discoveryhealthmedicalscheme.co.za/wcm/discoverycoza/assets/medical-aid/application-forms/2024/permission-to-make-certain-information-available-to-a-third-party.pdf", "date": "2024-10-01", "publisherClass": "blog_vendor" } ] }, "research": { "score": 50, "summary": "Identifiable records need the patient's, facility head's and an ethics committee's authorisation, but de-identified use needs none and POPIA allows research without consent where asking is disproportionate. There is no opt-out and no public register of uses.", "sources": [ { "title": "National Health Act 61 of 2003 (Government Gazette 26595)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/a61-03.pdf", "date": "2004-07-23", "publisherClass": "legal_text" }, { "title": "Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf", "date": "2013-11-26", "publisherClass": "legal_text" }, { "title": "South African Ethics in Health Research Guidelines, 3rd edition v3.2 (NHREC, National Department of Health)", "url": "https://knowledgehub.health.gov.za/system/files/elibdownloads/2026-08/NDoH-2024-v3.2-master-signed.pdf", "date": "2024", "publisherClass": "official" }, { "title": "ASSAf POPIA Compliance Framework for Researchers and Research Institutions", "url": "https://www.univen.ac.za/wp-content/uploads/2026/09/2025_ASSAf_POPIACompliance-Framework.pdf", "date": "2025-05-01", "publisherClass": "academic" } ] }, "ai": { "score": 48, "summary": "SAHPRA's September 2025 communication MD08 sets AI device expectations, including local validation, human oversight and change control plans. SAHPRA has not started product registration of medical devices, so this is guidance, scored near the top of the 35 to 50 band.", "sources": [ { "title": "SAHPRA Communication to Stakeholders MD08-2025/2026: Regulatory requirements of AI/ML-enabled medical devices", "url": "https://www.sahpra.org.za/wp-content/uploads/2025/09/MD08-20252026_-SAHPRA-Communication-to-Industry-AI-Medical-devices_Acknowledgements.pdf", "date": "2025-09-26", "publisherClass": "official" }, { "title": "Cabinet approves withdrawal of AI policy (SAnews)", "url": "https://www.sanews.gov.za/south-africa/cabinet-approves-withdrawal-ai-policy", "date": "2026-06-05", "publisherClass": "official" }, { "title": "Minister of Health reply to question NW3043 on AI and digital health (PMG)", "url": "https://pmg.org.za/committee-question/39322/", "date": "2026-07-09", "publisherClass": "official" } ] } }, "laws": [ { "name": "Protection of Personal Information Act 4 of 2013 (POPIA)", "level": "National", "year": "2013", "what": "Health is special personal information; access right; opt-in electronic marketing; breach notice; fines up to R10 million.", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdf" }, { "name": "Promotion of Access to Information Act 2 of 2000 (PAIA)", "level": "National", "year": "2000", "what": "Access to records held by public and private bodies, 30-day deadline, special rules for health records.", "url": "https://www.justice.gov.za/legislation/acts/2000-002.pdf" }, { "name": "National Health Act 61 of 2003", "level": "National", "year": "2003", "what": "Record keeping, confidentiality, written consent for disclosure, research authorisation, offences for record misuse.", "url": "https://www.gov.za/sites/default/files/gcis_document/201409/a61-03.pdf" }, { "name": "National Health Insurance Act 20 of 2023", "level": "National", "year": "2023", "what": "National fund with user registration; written approval for disclosure. Proclamation of sections delayed pending court judgment.", "url": "https://www.gov.za/sites/default/files/gcis_document/202405/50664nathealthinsuranceact202023.pdf" }, { "name": "Regulations relating to the Processing of Data Subjects' Health Information by Certain Responsible Parties, 2026", "level": "National", "year": "2026", "what": "Safeguards and transfer limits for insurers, schemes, administrators, pension funds and employers handling health data.", "url": "https://www.gov.za/sites/default/files/gcis_document/202603/54268gon7198.pdf" }, { "name": "National 2021 Normative Standards Framework for Interoperability in Digital Health (Notice 2667)", "level": "National", "year": "2022", "what": "National interoperability standards for digital health systems, issued under the National Health Act.", "url": "https://www.gov.za/documents/notices/national-health-act-national-2021-normative-standards-framework-interoperability" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-11-26", "headline": "Pathology lab fined after failing to tell patients their data was exposed", "paraphrase": "The regulator found the lab had suffered breaches and not notified affected people within a reasonable time. It ordered better security and notification processes, then fined the lab R100,000 for not complying. The lab paid.", "source": "Juta MedicalBrief (reporting an Information Regulator decision)", "url": "https://www.medicalbrief.co.za/lancet-labs-fined-for-data-breach/", "theme": "breach", "status": "finding" }, { "date": "2025-07-22", "headline": "Provincial health department says lost and misplaced files have harmed patients' care", "paraphrase": "Launching a records digitisation drive, the provincial health MEC said patients' care had been interrupted by misplaced records, delayed care and lost files, compromising patient safety and exposing the department to legal claims.", "source": "SABC News", "url": "https://www.sabcnews.com/sabcnews/gauteng-based-public-hospitals-patients-records-going-digital/", "theme": "other", "status": "admitted" } ] }, { "iso3": "MEX", "name": "Mexico", "region": "Americas", "overall": 42, "rank": "89=", "likelyRank": "63 to 110", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Mexican law gives patients a free copy of their data, but records stay inside each institution until cross-institution sharing, decreed in April 2026, begins.", "categories": { "access": { "score": 55, "summary": "Both data laws make access free with a 20-day answer deadline, and the IMSS app shows 36 months of visits, prescriptions and labs. Score: base 45, +5 free with a deadline, +5 official portal; only 493,144 of 54 million eligible had enrolled by October 2025.", "sources": [ { "title": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "NOM-004-SSA3-2012, Del expediente clinico (DOF)", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5272787&fecha=15/10/2012", "date": "2012-10-15", "publisherClass": "legal_text" }, { "title": "IMSS Boletin 542/2025: Cedula Digital de Salud", "url": "https://www.imss.gob.mx/sites/all/statics/i2f_news/IMSS.%20Boletin.%20542.pdf", "date": "2025-10-24", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "Mexico's public-sector law lets providers use health data for care without consent, and the private-sector law lets them share it for treatment without consent. No opt-out or patient-visible log exists; scored at the band top because no cross-institution sharing is live.", "sources": [ { "title": "Decreto por el que se crea el Servicio Universal de Salud (DOF, 17 abril 2026)", "url": "https://sidof.segob.gob.mx/notas/5785257", "date": "2026-04-17", "publisherClass": "legal_text" }, { "title": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "NOM-024-SSA3-2012, Sistemas de informacion de registro electronico para la salud (DOF)", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5280847&fecha=30/11/2012", "date": "2012-11-30", "publisherClass": "legal_text" } ] }, "privacy": { "score": 40, "summary": "Health data are sensitive under both 2025 laws, with breach notice and fines, but the independent INAI was abolished and oversight moved to a ministry. A leak of 20 million IMSS pensioner records with medical conditions surfaced in September 2025, Infobae reported.", "sources": [ { "title": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Filtracion de 20 millones de datos de pensionados del IMSS (Infobae)", "url": "https://www.infobae.com/mexico/2025/10/08/filtracion-de-20-millones-de-datos-de-pensionados-del-imss-primer-gran-reto-de-la-nueva-unidad-de-proteccion-de-datos/", "date": "2025-10-08", "publisherClass": "news" }, { "title": "Ciberataque a SAT, IMSS y Morena expone datos de 36 millones (El Universal via Yahoo)", "url": "https://es-us.finanzas.yahoo.com/noticias/ciberataque-sat-imss-morena-expone-201520425.html", "date": "2026-02-10", "publisherClass": "news" } ] }, "journey": { "score": 38, "summary": "IMSS keeps an electronic record for 54 million people, but each public institution runs its own system and no national exchange is live. The April 2026 decree orders a shared record; service sharing starts in January 2027, with labs and imaging from July 2027.", "sources": [ { "title": "Decreto por el que se crea el Servicio Universal de Salud (DOF, 17 abril 2026)", "url": "https://sidof.segob.gob.mx/notas/5785257", "date": "2026-04-17", "publisherClass": "legal_text" }, { "title": "Ley General de Salud, texto vigente con reforma de salud digital del 15 enero 2026 (Camara de Diputados)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGS.pdf", "date": "2026-01-15", "publisherClass": "legal_text" }, { "title": "NOM-024-SSA3-2012, Sistemas de informacion de registro electronico para la salud (DOF)", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5280847&fecha=30/11/2012", "date": "2012-11-30", "publisherClass": "legal_text" }, { "title": "Salud e IMSS firman convenio para la interoperabilidad del expediente clinico electronico (ConsultorSalud)", "url": "https://consultorsalud.com.mx/expediente-clinico-electronico-salud-imss/", "date": "2026-08-10", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Private use of health data needs express written consent, and misuse of sensitive data for profit carries doubled prison terms. No health-specific ban on selling data or ad targeting was found.", "sources": [ { "title": "Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Primeros criterios publicos de la SABG tras el caso FAN ID (Ritch Mueller)", "url": "https://www.ritch.com.mx/prensa/alerta-para-clientes-primeros-criterios-publicos-de-la-sabg-en-materia-de-proteccion-de-datos-personales-tras-la-resolucion-del-caso-fan-id", "date": "2026-07-29", "publisherClass": "law_firm" } ] }, "clinical": { "score": 35, "summary": "Today a doctor at one public institution cannot open a patient's record from another. The April 2026 decree already authorises staff of all public institutions to view history, diagnoses, labs, imaging and vaccines, but the exchange is not built; phases start in 2027.", "sources": [ { "title": "Decreto por el que se crea el Servicio Universal de Salud (DOF, 17 abril 2026)", "url": "https://sidof.segob.gob.mx/notas/5785257", "date": "2026-04-17", "publisherClass": "legal_text" }, { "title": "Salud e IMSS firman convenio para la interoperabilidad del expediente clinico electronico (ConsultorSalud)", "url": "https://consultorsalud.com.mx/expediente-clinico-electronico-salud-imss/", "date": "2026-08-10", "publisherClass": "news" }, { "title": "El IMSS planea IA en su expediente clinico e interoperabilidad con ISSSTE e IMSS-Bienestar para 2027 (El Imparcial)", "url": "https://www.elimparcial.com/mexico/2026/06/04/el-imss-planea-aplicar-inteligencia-artificial-en-su-expediente-clinico-electronico-mientras-desarrolla-la-interoperabilidad-total-de-datos-de-salud-con-el-issste-e-imss-bienestar-para-inicios-de-2027/", "date": "2026-06-04", "publisherClass": "news" }, { "title": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf", "date": "2025-03-20", "publisherClass": "legal_text" } ] }, "research": { "score": 50, "summary": "Research on people needs written informed consent and ethics committee approval, and record review is classed as no-risk research, not consent-free. De-identified data can be used without consent, with no opt-out or public register.", "sources": [ { "title": "Ley General de Salud, texto vigente con reforma de salud digital del 15 enero 2026 (Camara de Diputados)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGS.pdf", "date": "2026-01-15", "publisherClass": "legal_text" }, { "title": "Reglamento de la Ley General de Salud en Materia de Investigacion para la Salud (Camara de Diputados)", "url": "https://www.diputados.gob.mx/LeyesBiblio/regley/Reg_LGS_MIS.pdf", "date": "2014-04-02", "publisherClass": "legal_text" }, { "title": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados (Camara de Diputados, texto vigente)", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "NOM-004-SSA3-2012, Del expediente clinico (DOF)", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5272787&fecha=15/10/2012", "date": "2012-10-15", "publisherClass": "legal_text" } ] }, "ai": { "score": 38, "summary": "COFEPRIS registers software as a medical device with lifecycle, clinical evidence and cybersecurity files, but its own guide says the General Health Law does not yet recognise such software. No AI-specific change control rule or AI law exists.", "sources": [ { "title": "COFEPRIS: Guia para la obtencion del Registro Sanitario de Dispositivos Medicos", "url": "https://www.gob.mx/cofepris/documentos/guia-para-la-obtencion-del-registro-sanitario-de-dispositivos-medicos", "date": "2023-12-12", "publisherClass": "official" }, { "title": "Mexico regula la inteligencia artificial por sectores mientras aplaza la ley general (El Economista)", "url": "https://www.eleconomista.com.mx/tecnologia/mexico-regula-inteligencia-artificial-sectores-aplaza-ley-general-20260723-824716.html", "date": "2026-07-23", "publisherClass": "news" }, { "title": "El IMSS planea IA en su expediente clinico e interoperabilidad con ISSSTE e IMSS-Bienestar para 2027 (El Imparcial)", "url": "https://www.elimparcial.com/mexico/2026/06/04/el-imss-planea-aplicar-inteligencia-artificial-en-su-expediente-clinico-electronico-mientras-desarrolla-la-interoperabilidad-total-de-datos-de-salud-con-el-issste-e-imss-bienestar-para-inicios-de-2027/", "date": "2026-06-04", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley General de Proteccion de Datos Personales en Posesion de Sujetos Obligados", "level": "National", "year": "2025", "what": "Public bodies: health data sensitive, free access in 20 days, care exempt from consent; INAI replaced by a ministry.", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf" }, { "name": "Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares", "level": "National", "year": "2025", "what": "Private sector: express written consent for health data, fines can double and prison for sensitive data misuse.", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf" }, { "name": "Ley General de Salud (reforma de salud digital)", "level": "National", "year": "2026", "what": "Adds digital health and telehealth chapter; research needs written informed consent; record interoperability rules.", "url": "https://www.diputados.gob.mx/LeyesBiblio/pdf/LGS.pdf" }, { "name": "Decreto por el que se crea el Servicio Universal de Salud", "level": "National", "year": "2026", "what": "CURP-linked health credential and shared electronic record across public institutions, phased from January 2027.", "url": "https://sidof.segob.gob.mx/notas/5785257" }, { "name": "NOM-004-SSA3-2012, Del expediente clinico", "level": "National", "year": "2012", "what": "Record content and five-year retention; institution owns the record, patient holds rights over the information.", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5272787&fecha=15/10/2012" }, { "name": "NOM-024-SSA3-2012, Sistemas de informacion de registro electronico para la salud", "level": "National", "year": "2012", "what": "Standards, audit records, export and consent controls for certified electronic health record systems.", "url": "https://dof.gob.mx/nota_detalle.php?codigo=5280847&fecha=30/11/2012" }, { "name": "Ley de Proteccion de Datos Personales en Posesion de Sujetos Obligados de la Ciudad de Mexico", "level": "State/Provincial", "year": "2026", "what": "Mexico City public-body data law; health data sensitive; oversight under the city comptroller's office.", "url": "https://iecm.mx/www/marconormativo/docs/Ley_proteccion_DDPP_2026.pdf" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-01-27", "headline": "Public insurer answered late and incompletely when a patient asked for scans", "paraphrase": "A person asked a public health insurer for copies of their imaging studies and the reports on them. The insurer missed the legal deadline and only found the files after a complaint. The regulator ordered delivery free of charge.", "source": "Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI/013/2025)", "url": "https://home.inai.org.mx/wp-content/documentos/SalaDePrensa/Comunicados/Nota%20INAI-013-25.pdf", "theme": "access_delay_or_cost", "status": "finding" }, { "date": "2024-10-03", "headline": "Asked for a late father's record, a person was given someone else's", "paraphrase": "A person paid a public insurer for certified copies of their deceased father's record but was handed a relative's record instead. After a complaint, the insurer found the father's file. The regulator ordered free certified copies.", "source": "Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI/142/2024)", "url": "https://home.inai.org.mx/wp-content/documentos/SalaDePrensa/Comunicados/Nota%20INAI-142-24.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2026-08-26", "headline": "Court says judges can act at once when a clinic withholds a patient's record", "paraphrase": "A federal appeals court ruled that when a person says a health institution is denying access to their clinical record, judges may grant immediate protection, treating record access as part of the right to health.", "source": "La Silla Rota", "url": "https://lasillarota.com/nacion/2026/8/26/el-hospital-o-doctor-te-niegan-acceso-a-tu-expediente-clinico-esto-dice-la-justicia-526020.html", "theme": "access_refused", "status": "finding" }, { "date": "2025-07-03", "headline": "Records of a private hospital group's patients offered for sale online", "paraphrase": "A seller claimed to offer 400,000 lines of data from a private hospital group: patients' names, national ID and tax numbers, phones, emails, insurance policies, diagnoses and medical notes. The report carried no response from the hospital.", "source": "Publimetro México", "url": "https://www.publimetro.com.mx/noticias/2025/07/03/hacker-vende-400-mil-datos-sensibles-de-pacientes-del-hospital-espanol-de-mexico/", "theme": "breach", "status": "alleged" }, { "date": "2026-02-09", "headline": "Patient details from a public hospital in Jalisco reportedly sold after cyberattack", "paraphrase": "A report says a cyberattack exposed patients' names, addresses, phones, emails and diagnoses, later offered for sale. The hospital filed a criminal complaint; earlier it said only part of a website was hit and patient records were safe.", "source": "N+ (Nmas)", "url": "https://www.nmas.com.mx/seguridad/hackeo-hospital-civil-guadalajara-datos-medicos-expuestos-se-vendian-foros-clandestinos/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "NRU", "name": "Nauru", "region": "Oceania", "overall": 42, "rank": "89=", "likelyRank": "60 to 113", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Nauru keeps every public clinic visit in one electronic record, but patients get only a practitioner's report, and no data protection law exists.", "categories": { "access": { "score": 28, "summary": "The Health and Medical Services Act 2025 gives the patient only a special report prepared by a health practitioner, not a copy of the record. No patient portal was found, and an access to information law is still being drafted.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "National report submitted for the Universal Periodic Review: Nauru (A/HRC/WG.6/51/NRU/1, advance version)", "url": "https://www.ohchr.org/sites/default/files/documents/hrbodies/upr/sessions/session51/nru/a-hrc-wg-6-51-nru-1-nauru-av-e.pdf", "date": "2025-11-27", "publisherClass": "intergov" } ] }, "control": { "score": 35, "summary": "The 2025 Act requires the patient's written consent before health information goes to anyone outside listed exceptions, but treating staff see the shared record by default. No opt-out, granular choice or patient-visible access log was found.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "All smiles as Nauru completes world-first EMR achievement (Beyond Essential Systems)", "url": "https://www.bes.au/all-smiles-as-nauru-completes-world-first-emr-achievement/", "date": "2024-03-25", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 38, "summary": "Health records are confidential by statute, and unauthorised copying or disclosure carries fines up to $20,000 or 5 years in prison. But Nauru has no general data protection law, no regulator and no breach notification duty.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "Nauru's Constitution of 1968 with amendments through 2015 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Nauru_2015?lang=en", "date": "1968", "publisherClass": "legal_text" }, { "title": "Nauru: Law, Gaps and Status (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-nauru", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Concern over civil liberties in Nauru as new officers given powers to restrain, search and monitor anyone (ABC Pacific Beat)", "url": "https://www.abc.net.au/pacific/programs/pacificbeat/nauru-cmos/106952808", "date": "2026-07-24", "publisherClass": "news" } ] }, "journey": { "score": 65, "summary": "A 2025 study found an electronic record in all 4 of Nauru's health facilities (100%), all on one system, Tamanu. Pharmacy links, claims and research use were not verified, and the data date from 2024.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Why Nauru's healthcare workers are embracing digital records (Beyond Essential Systems)", "url": "https://www.bes.au/why-naurus-healthcare-workers-are-embracing-digital-records/", "date": "2023-12-20", "publisherClass": "blog_vendor" }, { "title": "All smiles as Nauru completes world-first EMR achievement (Beyond Essential Systems)", "url": "https://www.bes.au/all-smiles-as-nauru-completes-world-first-emr-achievement/", "date": "2024-03-25", "publisherClass": "blog_vendor" }, { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" } ] }, "commercial": { "score": 40, "summary": "The 2025 Act covers public and private facilities and bars disclosure of patient records without written consent, backed by criminal penalties. Nothing covers health apps, data brokers or data held outside facilities, because there is no data protection law.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "Nauru: Law (Statelessness Encyclopedia Asia Pacific)", "url": "https://seap.nationalityforall.org/law/nauru-law-2/", "date": "undated", "publisherClass": "academic" }, { "title": "Nauru: Law, Gaps and Status (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-nauru", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 68, "summary": "Section 37 of the 2025 Act lets any treating practitioner review and add to a patient's record, and the vendor says staff at every facility see the full history in Tamanu. That claim was not verified by the Ministry.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "All smiles as Nauru completes world-first EMR achievement (Beyond Essential Systems)", "url": "https://www.bes.au/all-smiles-as-nauru-completes-world-first-emr-achievement/", "date": "2024-03-25", "publisherClass": "blog_vendor" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" } ] }, "research": { "score": 50, "summary": "The 2025 Act allows only de-identified records to be used without consent, for administration, outbreak surveys or service improvement; other disclosure needs written consent. A 2025 regional review found Nauru has one ethics committee but no research ethics law.", "sources": [ { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" }, { "title": "The Pacific Way: advancing ethical research governance in the Pacific islands (Lancet Regional Health Western Pacific, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12756169/", "date": "2025-12-11", "publisherClass": "academic" } ] }, "ai": { "score": 20, "summary": "A June 2026 review found no AI law, strategy or regulator in Nauru, and the National Digital Transformation Strategy 2025-2030 does not mention AI. No rules for AI as a medical device or human oversight were found.", "sources": [ { "title": "Nauru: Law, Gaps and Status (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-nauru", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Health and Medical Services Act 2025 (RONLAW, Republic of Nauru)", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf", "date": "2025-08-29", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Health and Medical Services Act 2025 (No 35 of 2025)", "level": "National", "year": "2025", "what": "Confidential health records, written consent for disclosure, patient gets special report only, $20,000 fines for misuse.", "url": "https://ronlaw.gov.nr/assets/docs/acts/2025/Health%20and%20Medical%20Services_serv4.pdf" }, { "name": "Constitution of Nauru 1968, Articles 3 and 9", "level": "National", "year": "1968", "what": "Recognises respect for private and family life; protects against search of person or property without consent.", "url": "https://www.constituteproject.org/constitution/Nauru_2015?lang=en" }, { "name": "Cybercrime Act 2015", "level": "National", "year": "2015", "what": "Criminalises illegal access to protected computers, interception and data interference; up to 7 years in prison.", "url": "https://database.cyberpolicyportal.org/api/files/16642787139392y0vgo0brzb.pdf" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ALB", "name": "Albania", "region": "Europe", "overall": 41, "rank": "91=", "likelyRank": "67 to 117", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Albania has a new EU-aligned data protection law, but patients have no national record to view and hospitals were still going digital in 2026.", "categories": { "access": { "score": 50, "summary": "The 2024 data protection law gives a free right of access within 30 days, but no national portal shows the medical record. Only pieces are online, such as a person's own e-prescriptions on e-Albania, so the score sits at 50.", "sources": [ { "title": "Ligji nr. 124/2024 Për mbrojtjen e të dhënave personale (IDP copy)", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf", "date": "2024-12-19", "publisherClass": "legal_text" }, { "title": "Ligji nr. 10 107, datë 30.3.2009 Për kujdesin shëndetësor në Republikën e Shqipërisë (ISHP copy)", "url": "https://www.ishp.gov.al/wp-content/uploads/2015/ligjet/Per-kujdesin-shendetesor-ne-Republiken-e-Shqiperise.pdf", "date": "2009-03-30", "publisherClass": "legal_text" }, { "title": "Gjendja e sistemit spitalor, PD kërkon interpelancë urgjente me Ministren Sala (RTSH)", "url": "https://rtsh.al/gjendja-e-sistemit-spitalor-pd-kerkon-interpelance-urgjente-me-ministren-sala/", "date": "2026-06-15", "publisherClass": "news" }, { "title": "Receta ime elektronike (e-Albania service 6088)", "url": "https://e-albania.al/ServiceDetails/6088", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data is a special category, but the law lets providers process it for care without consent, and no opt-out or patient-visible access log was found. Records sit with institutions, and the ministry has a legal right of access.", "sources": [ { "title": "Ligji nr. 124/2024 Për mbrojtjen e të dhënave personale (IDP copy)", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf", "date": "2024-12-19", "publisherClass": "legal_text" }, { "title": "Ligji nr. 10 107, datë 30.3.2009 Për kujdesin shëndetësor në Republikën e Shqipërisë (ISHP copy)", "url": "https://www.ishp.gov.al/wp-content/uploads/2015/ligjet/Per-kujdesin-shendetesor-ne-Republiken-e-Shqiperise.pdf", "date": "2009-03-30", "publisherClass": "legal_text" } ] }, "privacy": { "score": 55, "summary": "No health-sector enforcement evidence was found, so this is scored on the general law. Law 124/2024 is fully aligned with EU rules per the European Commission, with 72-hour breach notice and fines up to ALL 2 billion or 4% of turnover.", "sources": [ { "title": "Ligji nr. 124/2024 Për mbrojtjen e të dhënave personale (IDP copy)", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf", "date": "2024-12-19", "publisherClass": "legal_text" }, { "title": "Albania 2025 Report, SWD(2025) (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/fe9138b7-90fe-4277-a12c-3a03f6d1957f_en?filename=albania-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "900 ankesa për cenim të të dhënave personale, ligji i ri ka shtrënguar masat (RTSH)", "url": "https://rtsh.al/900-ankesa-per-cenim-te-te-dhenave-personale-ligji-i-ri-ka-shtrenguar-masat/", "date": "2026-06-28", "publisherClass": "news" } ] }, "journey": { "score": 34, "summary": "National systems exist for parts of the journey, including a health information system, a citizen register and e-prescriptions. The European Commission reports a system for collecting and reporting health data, but the government's plan for electronic public hospitals from August 2026 was not verified as done.", "sources": [ { "title": "Albania 2025 Report, SWD(2025) (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/fe9138b7-90fe-4277-a12c-3a03f6d1957f_en?filename=albania-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Nënshkrimi elektronik, një tjetër element dhe standard i rëndësishëm i Shëndetësisë Elektronike (FSDKSH)", "url": "https://fsdksh.gov.al/nenshkrimi-elektronik-nje-tjeter-element-dhe-standard-i-rendesishem-i-shendetesise-elektronike/", "date": "2019-01-08", "publisherClass": "official" }, { "title": "Sala: Nis konsultimi publik për krijimin e Institutit Onkologjik Kombëtar. Nga 1 gushti, spitalet publike funksionojnë elektronikisht (RTSH)", "url": "https://rtsh.al/sala-nis-konsultimi-publik-per-krijimin-e-institutit-onkologjik-kombetar-nga-1-gushti-spitalet-publike-funksionojne-elektronikisht/", "date": "2026-06-15", "publisherClass": "news" }, { "title": "Gjendja e sistemit spitalor, PD kërkon interpelancë urgjente me Ministren Sala (RTSH)", "url": "https://rtsh.al/gjendja-e-sistemit-spitalor-pd-kerkon-interpelance-urgjente-me-ministren-sala/", "date": "2026-06-15", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "Using health data for direct marketing needs the person's explicit consent under Law 124/2024, and people can object at any time. No specific ban on selling health data or rule on health apps was found.", "sources": [ { "title": "Ligji nr. 124/2024 Për mbrojtjen e të dhënave personale (IDP copy)", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf", "date": "2024-12-19", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "No shared record that lets a treating clinician see care from other providers was found. The health law leaves documentation with each institution or the patient, and opposition MPs said in June 2026 that hospitals still lack electronic records.", "sources": [ { "title": "Ligji nr. 10 107, datë 30.3.2009 Për kujdesin shëndetësor në Republikën e Shqipërisë (ISHP copy)", "url": "https://www.ishp.gov.al/wp-content/uploads/2015/ligjet/Per-kujdesin-shendetesor-ne-Republiken-e-Shqiperise.pdf", "date": "2009-03-30", "publisherClass": "legal_text" }, { "title": "Gjendja e sistemit spitalor, PD kërkon interpelancë urgjente me Ministren Sala (RTSH)", "url": "https://rtsh.al/gjendja-e-sistemit-spitalor-pd-kerkon-interpelance-urgjente-me-ministren-sala/", "date": "2026-06-15", "publisherClass": "news" }, { "title": "Sala: Nis konsultimi publik për krijimin e Institutit Onkologjik Kombëtar. Nga 1 gushti, spitalet publike funksionojnë elektronikisht (RTSH)", "url": "https://rtsh.al/sala-nis-konsultimi-publik-per-krijimin-e-institutit-onkologjik-kombetar-nga-1-gushti-spitalet-publike-funksionojne-elektronikisht/", "date": "2026-06-15", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "Law 124/2024 treats research use of health data as a legitimate interest without consent, with no general opt-out. One safeguard class counts: fines up to 4% of turnover for misuse, including using research data for decisions about the person.", "sources": [ { "title": "Ligji nr. 124/2024 Për mbrojtjen e të dhënave personale (IDP copy)", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf", "date": "2024-12-19", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No clinical AI rules or guidance were found, only a medical device law the European Commission calls partly aligned with EU rules. The Commission says Albania should fully align with the AI Act.", "sources": [ { "title": "Albania 2025 Report, SWD(2025) (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/fe9138b7-90fe-4277-a12c-3a03f6d1957f_en?filename=albania-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Projektligji i ri përcakton rregulla të rrepta për pajisjet mjekësore diagnostikuese in vitro (RTSH)", "url": "https://rtsh.al/projektligji-i-ri-percakton-rregulla-te-rrepta-per-pajisjet-mjekesore-diagnostikuese-in-vitro/", "date": "2026-07-20", "publisherClass": "news" }, { "title": "Rama: 1 mld euro për Shëndetësinë... 2026, viti i AI në mjekësi (RTSH)", "url": "https://rtsh.al/rama-1-mld-euro-per-shendetesine-15-mln-euro-ekstra-per-pacientet-e-onkologjikut-2026-viti-i-ai-ne-mjekesi/", "date": "2025-11-08", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law No. 124/2024 On personal data protection", "level": "National", "year": "2024", "what": "EU-aligned data protection law: health as sensitive data, access in 30 days, 72-hour breach notice, high fines.", "url": "https://idp.al/wp-content/uploads/2025/07/ligj-2024-12-19-124.pdf" }, { "name": "Law No. 10107/2009 On health care in the Republic of Albania", "level": "National", "year": "2009", "what": "Organises health care; creates a single health information system; institutions keep records confidential.", "url": "https://www.ishp.gov.al/wp-content/uploads/2015/ligjet/Per-kujdesin-shendetesor-ne-Republiken-e-Shqiperise.pdf" }, { "name": "Law No. 9288/2004 ratifying Council of Europe Convention 108", "level": "National", "year": "2004", "what": "Ratifies the Council of Europe convention on automatic processing of personal data.", "url": "https://idp.al/wp-content/uploads/2024/01/ligji_9288_koventa-1.pdf" }, { "name": "Law No. 49/2022 ratifying the Protocol amending Convention 108", "level": "National", "year": "2022", "what": "Ratifies the protocol that modernises Convention 108.", "url": "https://idp.al/wp-content/uploads/2024/01/ligji-49-2022.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-08-24", "headline": "Regulator steps in after clinic ignores a patient's request for their file", "paraphrase": "A patient asked a private clinic for all the records it held on them and got no reply. After a complaint, inspectors visited, the clinic produced the file and undertook to supply it, and the regulator ordered fixes.", "source": "Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP)", "url": "https://idp.al/wp-content/uploads/2026/09/Rekomandim-Nr.-55-Viti-2026-DPM.pdf", "theme": "access_refused", "status": "finding" }, { "date": "2026-02-26", "headline": "Medical laboratory fined for weak safeguards on patient data", "paraphrase": "Months after a regulator recommendation, a medical laboratory still had no data protection terms with firms handling patient data for it and an incomplete security system. The regulator fined it ALL 2.8 million.", "source": "Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP)", "url": "https://idp.al/wp-content/uploads/2026/03/Vendim-Nr.-8-Viti-2026-DPM.pdf", "theme": "other", "status": "finding" }, { "date": "2024-11-21", "headline": "Ransomware locks a public hospital's data and halts scans and lab tests", "paraphrase": "Ransomware encrypted all of a regional public hospital's data, stopping imaging and blood testing until services returned within 72 hours. The report says some patient data was deleted. The hospital confirmed the attack.", "source": "Faktoje.al", "url": "https://faktoje.al/terrorizmi-kibernetik-i-korese-se-veriut-ndaj-spitalit-memorial-te-fierit-dhe-rreziku-i-ekspozimit-te-spitaleve-publike-ndaj-ketyre-sulmeve/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "JOR", "name": "Jordan", "region": "Middle East", "overall": 41, "rank": "91=", "likelyRank": "67 to 117", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Jordan's public hospitals and clinics share one electronic record, but patients see only part of it and have no say over sharing.", "categories": { "access": { "score": 50, "summary": "The 2023 data law gives a free right to access and obtain one's data. The Hakeemi app shows public patients labs, radiology reports and medicines, but not notes or diagnoses; a reported World Bank count of 1 million users is not verified at source.", "sources": [ { "title": "Personal Data Protection Law No. 24 of 2023 (official English version, Ministry of Digital Economy)", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Health computing company: ongoing updates to Hakeemi and study of showing fuller medical history (Addustour)", "url": "https://www.addustour.com/articles/1588406-%D8%A7%D9%84%D8%AD%D9%88%D8%B3%D8%A8%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9-%D8%AA%D8%AD%D8%AF%D9%8A%D8%AB%D8%A7%D8%AA-%D9%85%D8%AA%D9%88%D8%A7%D8%B5%D9%84%D8%A9-%D8%B9%D9%84%D9%89-%D8%AD%D9%83%D9%8A%D9%85%D9%8A-%D9%88%D8%AF%D8%B1%D8%A7%D8%B3%D8%A9-%D8%A5%D8%AA%D8%A7%D8%AD%D8%A9-%D8%A7%D9%84%D8%B3%D9%8A%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D8%B1%D8%B6%D9%8A%D8%A9-%D8%A8%D8%A7%D9%84%D8%AA%D8%B9%D8%A7%D9%88%D9%86-%D9%85%D8%B9-%D9%88%D8%B2%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9", "date": "2026-09-05", "publisherClass": "news" }, { "title": "World Bank: over one million users of digital health services in Jordan (Al Mamlaka)", "url": "https://almamlakatv.com/news/207311", "date": "2026-08-16", "publisherClass": "news" }, { "title": "Cabinet approves Data Subject Rights Regulation 2025 (Jordan government portal)", "url": "https://jordan.gov.jo/AR//NewsDetails/%D9%85%D8%AC%D9%84%D8%B3_%D8%A7%D9%84%D9%88%D8%B2%D8%B1%D8%A7%D8%A1_%D9%8A%D9%82%D8%B1_%D9%86%D8%B8%D8%A7%D9%85_%D8%AA%D9%86%D8%B8%D9%8A%D9%85_%D8%AD%D9%82%D9%88%D9%82_%D8%A7%D9%84%D8%B4%D8%AE%D8%B5_%D8%A7%D9%84%D9%85%D8%B9%D9%86%D9%8A_2025_%D9%84%D8%AA%D8%B9%D8%B2%D9%8A%D8%B2_%D8%AD%D9%85%D8%A7%D9%8A%D8%A9_%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA_%D9%88%D8%A7%D9%84%D8%AB%D9%82%D8%A9_%D8%A8%D8%A7%D9%84%D8%A7%D9%82%D8%AA%D8%B5%D8%A7%D8%AF_%D8%A7%D9%84%D8%B1%D9%82%D9%85%D9%8A", "date": "2025", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "The data law demands explicit, written consent in general, but processing for diagnosis and care needs neither consent nor notice. Hakeem opens a patient's file at any connected site by national ID, and no opt-out or patient-visible access log was found.", "sources": [ { "title": "Personal Data Protection Law No. 24 of 2023 (official English version, Ministry of Digital Economy)", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Hakeem reaches 453 facilities and plans more than 570 in 2026 (Al Mamlaka)", "url": "https://almamlakatv.com/news/190599", "date": "2026-02-13", "publisherClass": "news" }, { "title": "Medical and Health Liability Law No. 25 of 2018 (Adaleh legal information centre)", "url": "http://www.adaleh.info/Art.aspx?Typ=2&Id=1194", "date": "2018", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive under the 2023 law, serious breaches must reach patients within 24 hours, and fines reach 3% of revenue. The regulator is a unit inside the digital economy ministry, its council includes two security agency members, and no health enforcement was found.", "sources": [ { "title": "Personal Data Protection Law No. 24 of 2023 (official English version, Ministry of Digital Economy)", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Cabinet approves regulation on the Personal Data Protection Unit 2025 (Al Mamlaka)", "url": "https://almamlakatv.com/news/184498", "date": "2025-11-30", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 45, "summary": "The Hakeem electronic record runs in 482 Ministry of Health and Royal Medical Services sites, with all government hospitals and centres due by end 2026. The government's draft strategy says there is no unified national health record and weak interoperability.", "sources": [ { "title": "Hakeem system expands to 482 health facilities (Petra, Jordan News Agency)", "url": "https://petra.gov.jo/ar/news/%D8%AA%D9%88%D8%B3%D8%B9-%D9%85%D8%B8%D9%84%D8%A9-%D9%86%D8%B8%D8%A7%D9%85-%D8%AD%D9%83%D9%8A%D9%85-%D8%A5%D9%84%D9%89-482-%D9%85%D9%86%D8%B4%D8%A3%D8%A9-%D8%B5%D8%AD%D9%8A%D8%A9", "date": "2026-07-07", "publisherClass": "news" }, { "title": "Hakeem reaches 453 facilities and plans more than 570 in 2026 (Al Mamlaka)", "url": "https://almamlakatv.com/news/190599", "date": "2026-02-13", "publisherClass": "news" }, { "title": "National Digital Health Strategy 2026-2030, public consultation draft (Tawasal government consultation portal)", "url": "https://tawasal.gov.jo/Consultations/redirect/1485", "date": "2026-06-15", "publisherClass": "official" }, { "title": "Hakeem company plans to enter the private sector next year (Al Mamlaka)", "url": "https://almamlakatv.com/news/200343", "date": "2026-05-25", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Data may not be passed to another controller for marketing unless the person consents, and sensitive data needs explicit consent. No rules on health data brokers, consumer health apps or sales of de-identified data were found.", "sources": [ { "title": "Personal Data Protection Law No. 24 of 2023 (official English version, Ministry of Digital Economy)", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "National Digital Health Strategy 2026-2030, public consultation draft (Tawasal government consultation portal)", "url": "https://tawasal.gov.jo/Consultations/redirect/1485", "date": "2026-06-15", "publisherClass": "official" } ] }, "clinical": { "score": 45, "summary": "Clinicians in Hakeem sites can open a patient's file from any connected public facility by national ID, including surgical reports, medicines and history. Private sector clinicians cannot, as no national exchange is running yet.", "sources": [ { "title": "Hakeem reaches 453 facilities and plans more than 570 in 2026 (Al Mamlaka)", "url": "https://almamlakatv.com/news/190599", "date": "2026-02-13", "publisherClass": "news" }, { "title": "Medical and Health Liability Law No. 25 of 2018 (Adaleh legal information centre)", "url": "http://www.adaleh.info/Art.aspx?Typ=2&Id=1194", "date": "2018", "publisherClass": "legal_text" }, { "title": "National Digital Health Strategy 2026-2030, public consultation draft (Tawasal government consultation portal)", "url": "https://tawasal.gov.jo/Consultations/redirect/1485", "date": "2026-06-15", "publisherClass": "official" }, { "title": "Hakeem company plans to enter the private sector next year (Al Mamlaka)", "url": "https://almamlakatv.com/news/200343", "date": "2026-05-25", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "The 2023 data law allows processing for scientific research without consent or notice, if no decision is taken about a specific person. Drug trials fall under a 2011 law with ethics committees and a JFDA Clinical Studies Committee, and inspectors check informed consent.", "sources": [ { "title": "Personal Data Protection Law No. 24 of 2023 (official English version, Ministry of Digital Economy)", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Guideline for GCP and GCLP inspection of clinical studies in Jordan (JFDA)", "url": "https://www.jfda.jo/ebv4.0/root_storage/ar/eb_list_page/guideline_for_good_clinical_practice_(gcp)_and_good_clinical_laboratory_practice_(gclp)_inspection_of_clinical_studies_in_jordan-july2026.pdf", "date": "2026-05", "publisherClass": "official" }, { "title": "National Digital Health Strategy 2026-2030, public consultation draft (Tawasal government consultation portal)", "url": "https://tawasal.gov.jo/Consultations/redirect/1485", "date": "2026-06-15", "publisherClass": "official" } ] }, "ai": { "score": 30, "summary": "No clinical AI rule from the medicines and devices regulator was found. A Cabinet-approved AI ethics charter binds government bodies to accountability, transparency and privacy, and the draft digital health strategy calls for AI in diagnosis.", "sources": [ { "title": "National Charter for AI Ethics approved by Cabinet (Ministry of Digital Economy)", "url": "https://modee.gov.jo/Ar/NewsDetails/%D8%A7%D9%84%D9%85%D9%8A%D8%AB%D8%A7%D9%82_%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A_%D9%84%D8%A7%D8%AE%D9%84%D8%A7%D9%82%D9%8A%D8%A7%D8%AA_%D8%A7%D9%84%D8%B0%D9%83%D8%A7%D8%A1_%D8%A7%D9%84%D8%A7%D8%B5%D8%B7%D9%86%D8%A7%D8%B9%D9%8A", "date": "undated", "publisherClass": "official" }, { "title": "National Digital Health Strategy 2026-2030, public consultation draft (Tawasal government consultation portal)", "url": "https://tawasal.gov.jo/Consultations/redirect/1485", "date": "2026-06-15", "publisherClass": "official" }, { "title": "Hakeem company plans to enter the private sector next year (Al Mamlaka)", "url": "https://almamlakatv.com/news/200343", "date": "2026-05-25", "publisherClass": "news" }, { "title": "Jordan JFDA medical device registration guide (MedDeviceGuide)", "url": "https://meddeviceguide.com/blog/jordan-jfda-medical-device-registration-guide", "date": "2026-05-18", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Personal Data Protection Law No. 24 of 2023", "level": "National", "year": "2023", "what": "Health is sensitive data; consent rules with care and research exceptions; 24-hour breach notice to subjects.", "url": "https://www.modee.gov.jo/EBV4.0/Root_Storage/AR/11/PDP_Law_-_English_Version1.pdf" }, { "name": "Data Subject Rights Regulation 2025", "level": "National", "year": "2025", "what": "Procedures for consent, withdrawal, objections and complaints under the data law.", "url": "https://jordan.gov.jo/AR//NewsDetails/%D9%85%D8%AC%D9%84%D8%B3_%D8%A7%D9%84%D9%88%D8%B2%D8%B1%D8%A7%D8%A1_%D9%8A%D9%82%D8%B1_%D9%86%D8%B8%D8%A7%D9%85_%D8%AA%D9%86%D8%B8%D9%8A%D9%85_%D8%AD%D9%82%D9%88%D9%82_%D8%A7%D9%84%D8%B4%D8%AE%D8%B5_%D8%A7%D9%84%D9%85%D8%B9%D9%86%D9%8A_2025_%D9%84%D8%AA%D8%B9%D8%B2%D9%8A%D8%B2_%D8%AD%D9%85%D8%A7%D9%8A%D8%A9_%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA_%D9%88%D8%A7%D9%84%D8%AB%D9%82%D8%A9_%D8%A8%D8%A7%D9%84%D8%A7%D9%82%D8%AA%D8%B5%D8%A7%D8%AF_%D8%A7%D9%84%D8%B1%D9%82%D9%85%D9%8A" }, { "name": "Personal Data Protection Unit Regulation 2025", "level": "National", "year": "2025", "what": "Sets how the ministry unit receives complaints, investigates and monitors compliance.", "url": "https://almamlakatv.com/news/184498" }, { "name": "Medical and Health Liability Law No. 25 of 2018", "level": "National", "year": "2018", "what": "Duty to document care in the patient file and keep medical secrets, with listed exceptions.", "url": "http://www.adaleh.info/Art.aspx?Typ=2&Id=1194" }, { "name": "Clinical Studies Law No. 2 of 2011", "level": "National", "year": "2011", "what": "Governs drug trials: JFDA Clinical Studies Committee, site accreditation, ethics review and inspection.", "url": "https://www.jfda.jo/ebv4.0/root_storage/ar/eb_list_page/guideline_for_good_clinical_practice_(gcp)_and_good_clinical_laboratory_practice_(gclp)_inspection_of_clinical_studies_in_jordan-july2026.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-24", "headline": "Insurers warn unauthorised claims platforms are reaching into patients' medical data", "paraphrase": "Health insurers and their industry union told insured people not to use a non-insurer claims platform, saying its access to patients' medical data breaks the personal data protection law and delays approvals for treatment.", "source": "Roya News", "url": "https://royanews.tv/news/386623", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "MUS", "name": "Mauritius", "region": "Africa", "overall": 41, "rank": "91=", "likelyRank": "70 to 119", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Mauritius has a GDPR-style data law and a free right to a copy, but its one-record e-Health system is still a regional pilot.", "categories": { "access": { "score": 50, "summary": "Section 37 of the Data Protection Act 2017 gives a free copy of your data, with a reply due within one month. No national patient portal is live yet, so patients ask each hospital or clinic.", "sources": [ { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Annual Report on Performance for Financial Year 2023-2024 (Ministry of Health and Wellness)", "url": "https://health.govmu.org/health/wp-content/uploads/2024/11/Annual-Report-on-Performance-for-Financial-Year-2023-2024.pdf", "date": "2024-11", "publisherClass": "official" }, { "title": "Maurice accélère la numérisation de son système de santé avec le projet E-Health (We Are Tech Africa)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/maurice-accelere-la-numerisation-de-son-systeme-de-sante-avec-le-projet-e-health", "date": "2025-09-05", "publisherClass": "news" } ] }, "control": { "score": 32, "summary": "Health data can be processed without consent for diagnosis, care and running health services under section 29 of the Data Protection Act. The e-Health record is built to follow the patient to every public hospital, and we found no opt-out or patient access log.", "sources": [ { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Annual Report on Performance for Financial Year 2023-2024 (Ministry of Health and Wellness)", "url": "https://health.govmu.org/health/wp-content/uploads/2024/11/Annual-Report-on-Performance-for-Financial-Year-2023-2024.pdf", "date": "2024-11", "publisherClass": "official" }, { "title": "Maurice accélère la numérisation de son système de santé avec le projet E-Health (We Are Tech Africa)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/maurice-accelere-la-numerisation-de-son-systeme-de-sante-avec-le-projet-e-health", "date": "2025-09-05", "publisherClass": "news" } ] }, "privacy": { "score": 55, "summary": "The 2017 Act treats health as a special category and requires breach notice within 72 hours. The regulator is active (95 breaches notified in 2025) but short-staffed and not financially independent, and we found no health-sector enforcement.", "sources": [ { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Data Protection Office Annual Report 2025", "url": "https://dataprotection.govmu.org/Documents/2026/2699-26-AR.pdf", "date": "2026", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 30, "summary": "The Health Ministry itself says there is no single unique record for each patient. The e-Health system had registered about 153,200 patients by July 2026, in pilot sites in the east and south, with full coverage set for end 2027.", "sources": [ { "title": "Annual Report on Performance for Financial Year 2023-2024 (Ministry of Health and Wellness)", "url": "https://health.govmu.org/health/wp-content/uploads/2024/11/Annual-Report-on-Performance-for-Financial-Year-2023-2024.pdf", "date": "2024-11", "publisherClass": "official" }, { "title": "Projet e-Health : Vers une couverture complète d'ici à fin 2027 (Le Mauricien)", "url": "https://www.lemauricien.com/actualites/societe/secteur-public-13-ans-apres-projet-e-health-vers-une-couverture-complete-dici-a-fin-2027/", "date": "2026-07-12", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "You can stop any use of your data for direct marketing, but marketing needs no prior consent. Offering to sell data is a crime only if it was disclosed unlawfully, and there are no rules for health apps, data brokers or de-identified data.", "sources": [ { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "Outside the e-Health pilot sites, a public hospital doctor works from that facility's own files. e-Health is a public-sector project, and we found no link to private clinics.", "sources": [ { "title": "Annual Report on Performance for Financial Year 2023-2024 (Ministry of Health and Wellness)", "url": "https://health.govmu.org/health/wp-content/uploads/2024/11/Annual-Report-on-Performance-for-Financial-Year-2023-2024.pdf", "date": "2024-11", "publisherClass": "official" }, { "title": "Projet e-Health : Vers une couverture complète d'ici à fin 2027 (Le Mauricien)", "url": "https://www.lemauricien.com/actualites/societe/secteur-public-13-ans-apres-projet-e-health-vers-une-couverture-complete-dici-a-fin-2027/", "date": "2026-07-12", "publisherClass": "news" }, { "title": "Private Health Institutions Bill : un nouveau projet de loi pour encadrer les cliniques privées (Defimedia)", "url": "https://defimedia.info/private-health-institutions-bill-un-nouveau-projet-de-loi-pour-encadrer-les-cliniques-privees", "date": "2025-10-08", "publisherClass": "news" }, { "title": "Maurice accélère la numérisation de son système de santé avec le projet E-Health (We Are Tech Africa)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/maurice-accelere-la-numerisation-de-son-systeme-de-sante-avec-le-projet-e-health", "date": "2025-09-05", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Research is a lawful ground for processing without consent, and research may be exempt from the Act if security measures are in place. Trials need written consent under the Clinical Trials Act 2011, and the National Ethics Committee clears human research.", "sources": [ { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Clinical Trials Act, section 20: Protection of subjects (juris)", "url": "https://juris.mu/law/clinical-trials-act/s/20/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Training, Research and Capacity Building Unit (Ministry of Health and Wellness)", "url": "https://health.govmu.org/health/?page_id=5558", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 28, "summary": "Cabinet adopted the AI for Mauritius strategy and FAIR Guidelines in February 2026, but the guidelines are non-binding and not specific to health. We found no medical device rules for AI software, so this sits in the no-rules band.", "sources": [ { "title": "Highlights of Cabinet Meeting, Friday 13 February 2026 (Prime Minister's Office)", "url": "https://pmo.govmu.org/CabinetDecision/2026/Highlights%20of%20Cabinet%20Meeting%20%20Friday%20%2013%20February%202026.pdf", "date": "2026-02-13", "publisherClass": "official" }, { "title": "Mauritius' new AI strategy sets a new bar: ethics before execution (TechCabal)", "url": "https://techcabal.com/2026/04/23/mauritius-new-ai-strategy-sets-a-new-bar-ethics-before-execution/", "date": "2026-04-23", "publisherClass": "news" }, { "title": "The Data Protection Act 2017 (Data Protection Office)", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf", "date": "undated", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection Act 2017 (Act No. 20 of 2017)", "level": "National", "year": "2017", "what": "Health is a special category; free copy within one month; 72-hour breach notice; Data Protection Commissioner.", "url": "https://dataprotection.govmu.org/Documents/DPA_2017.pdf" }, { "name": "Clinical Trials Act 2011", "level": "National", "year": "2011", "what": "Trial licences, Ethics Committee and written informed consent with a right to withdraw.", "url": "https://juris.mu/law/clinical-trials-act/" }, { "name": "Council of Europe Convention 108 (ratified by Mauritius)", "level": "Supranational", "year": "1981", "what": "Data protection treaty; Mauritius was the first African country to sign and ratify it.", "url": "https://dataprotection.govmu.org/Documents/2026/2699-26-AR.pdf" }, { "name": "Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026", "level": "National", "year": "2026", "what": "Sets duties, qualifications and position of organisations' data protection officers; in force 1 January 2027.", "url": "https://www.africadataprotection.org/actualites/Ile-Maurice-un-nouveau-reglement-encadrera-le-role-des-Data-Protection-Officers-a-compter-de-janvier-2027.html" }, { "name": "AI for Mauritius strategy and FAIR Guidelines", "level": "National", "year": "2026", "what": "National AI policy framework; non-binding guidelines meant to evolve into AI regulations.", "url": "https://pmo.govmu.org/CabinetDecision/2026/Highlights%20of%20Cabinet%20Meeting%20%20Friday%20%2013%20February%202026.pdf" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-06-20", "headline": "Health minister tells parliament patient files went missing in public hospitals", "paraphrase": "The health minister said 19 patient files had been reported missing in public hospitals since November 2024, and 349 files and 24 consultation cards were not available when needed because they sat in other departments. All were later found.", "source": "L'Express (Maurice), via allAfrica", "url": "https://fr.allafrica.com/stories/202506200487.html", "theme": "lost_between_providers", "status": "admitted" }, { "date": "2025-12-19", "headline": "Patient says a private doctor refused her report needed for a benefits board", "paraphrase": "An older patient says the doctor who treated her at a private clinic refused her a detailed report of her care. A social security doctor asked too and was refused. She needs it for a medical board.", "source": "Le Mauricien", "url": "https://www.lemauricien.com/actualites/societe/operation-contestee-une-patiente-accuse-un-medecin-de-lui-refuser-son-dossier-medical/694296/", "theme": "access_refused", "status": "alleged" }, { "date": "2026-04", "headline": "Hospital records staff say half-empty offices make patients return for their cards", "paraphrase": "Health records clerks in public hospitals say their departments run with about half the staff they should have. Some counters close, so patients must come back the next day to collect their card and learn their follow-up date.", "source": "Le Defi Media Group", "url": "https://defimedia.info/hopitaux-publics-les-health-records-clerks-bout-de-souffle", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "MDA", "name": "Moldova", "region": "Europe", "overall": 41, "rank": "91=", "likelyRank": "70 to 119", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Moldovans have a legal right to their medical files, but under 10% can see their data digitally and a national e-health record is still planned.", "categories": { "access": { "score": 40, "summary": "Law 263/2005 gives patients unlimited access to their medical data and a copy of any part, but there is no national patient portal and no fixed deadline was verified. The Ministry of Health says under 10% of citizens can access their medical data digitally.", "sources": [ { "title": "Prava pacienta (Avocatul Poporului, guide citing Law 263/2005 Art. 11)", "url": "https://ombudsman.md/wp-content/uploads/2020/01/drepturi_pacient_rus.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Nota de fundamentare, Programul National pentru Digitalizare si Inovare in Sanatate 2026-2030 (Ministerul Sanatatii, particip.gov.md)", "url": "https://particip.gov.md/ro/download_attachment/28629", "date": "undated", "publisherClass": "official" }, { "title": "Certificatul de concediu medical este 100% digital si disponibil in EVO (Agentia de Guvernare Electronica)", "url": "https://egov.md/ro/node/41059", "date": "2026-03-02", "publisherClass": "official" }, { "title": "Doar 10% dintre cetatenii R. Moldova au acces la datele medicale in format digital (Moldova 1)", "url": "https://moldova1.md/p/54965/doar-10-dintre-cetatenii-r-moldova-au-acces-la-datele-medicale-in-format-digital-autoritatile-planifica-lansarea-dosarelor-electronice-de-sanatate", "date": "2025-08-13", "publisherClass": "news" } ] }, "control": { "score": 32, "summary": "Patients have no tool to choose who sees their records or to check who looked at them. The Ministry of Health plans a digital consent mechanism only by the end of 2027.", "sources": [ { "title": "Nota de fundamentare, Programul National pentru Digitalizare si Inovare in Sanatate 2026-2030 (Ministerul Sanatatii, particip.gov.md)", "url": "https://particip.gov.md/ro/download_attachment/28629", "date": "undated", "publisherClass": "official" }, { "title": "Doar 10% dintre cetatenii R. Moldova au acces la datele medicale in format digital (Moldova 1)", "url": "https://moldova1.md/p/54965/doar-10-dintre-cetatenii-r-moldova-au-acces-la-datele-medicale-in-format-digital-autoritatile-planifica-lansarea-dosarelor-electronice-de-sanatate", "date": "2025-08-13", "publisherClass": "news" }, { "title": "Prava pacienta (Avocatul Poporului, guide citing Law 263/2005 Art. 11)", "url": "https://ombudsman.md/wp-content/uploads/2020/01/drepturi_pacient_rus.pdf", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 48, "summary": "Health data is a special category, and a GDPR-based law (195/2024) took effect on 23 August 2026 with fines up to 2% of turnover. In April 2026 the cyber security agency said an attack hit about 30% of data on a hospital medical platform.", "sources": [ { "title": "Transmiterea de catre un centru de sanatate raional a datelor privind starea de sanatate in adresa unui avocat (CNPDCP)", "url": "https://datepersonale.md/aspecte-privind-transmiterea-de-catre-un-centru-de-sanatate-raional-a-datelor-cu-caracter-personal-privind-starea-de-sanatate-a-subiectului-de-date-in-adresa-unui-avocat/", "date": "undated", "publisherClass": "official" }, { "title": "Noua lege privind protectia datelor cu caracter personal (Ministerul Justitiei)", "url": "https://justice.gov.md/ro/content/noua-lege-privind-protectia-datelor-cu-caracter-personal-reprezinta-un-pas-esential", "date": "2025-02-05", "publisherClass": "official" }, { "title": "Legal Expert Review: Noua Lege privind Protectia Datelor cu Caracter Personal (ACI Partners)", "url": "https://aci.md/legal-expert-review-noua-lege-privind-protectia-datelor-cu-caracter-personal/", "date": "2026-01-19", "publisherClass": "law_firm" }, { "title": "30% din date afectate. Sistemul medical al R. Moldova a fost supus unui atac cibernetic masiv (TVR Moldova)", "url": "https://tvrmoldova.md/article/38e53cd804217aa4/30-din-date-afectate-sistemul-medical-al-r-moldova-a-fost-supus-unui-atac-cibernetic-masiv.html", "date": "2026-04-27", "publisherClass": "news" } ] }, "journey": { "score": 45, "summary": "National systems exist for primary care (SIA AMP), hospitals (SIA AMS), public health surveillance, sick leave and e-prescriptions, but they are not interoperable. eReteta reached 900,000 patients in two years, for state-compensated medicines only.", "sources": [ { "title": "Nota de fundamentare, Programul National pentru Digitalizare si Inovare in Sanatate 2026-2030 (Ministerul Sanatatii, particip.gov.md)", "url": "https://particip.gov.md/ro/download_attachment/28629", "date": "undated", "publisherClass": "official" }, { "title": "E-Reteta, la doi ani de la lansare: circa 40% din populatie si peste 5.500 de specialisti folosesc sistemul (Moldova 1)", "url": "https://moldova1.md/p/72463", "date": "2026-03-31", "publisherClass": "news" }, { "title": "Certificatul de concediu medical este 100% digital si disponibil in EVO (Agentia de Guvernare Electronica)", "url": "https://egov.md/ro/node/41059", "date": "2026-03-02", "publisherClass": "official" }, { "title": "Ministerul Sanatatii a lansat consultarile publice pentru implementarea Dosarului electronic de sanatate", "url": "https://ms.gov.md/comunicare/ministerul-sanatatii-a-lansat-consultarile-publice-pentru-implementarea-dosarului-electronic-de-sanatate/", "date": "2026-04-10", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Commercial use of health data falls under the general data protection law, which since August 2026 follows the GDPR. No Moldovan rule aimed at selling health data, data brokers or health apps was verified.", "sources": [ { "title": "Legea nr. 195/2024 privind protectia datelor cu caracter personal: principalele prevederi (CNPDCP)", "url": "https://datepersonale.md/legea-nr-195-2024-privind-protectia-datelor-cu-caracter-personal-principalele-prevederi-si-noutati-legislative/", "date": "undated", "publisherClass": "official" }, { "title": "Transmiterea de catre un centru de sanatate raional a datelor privind starea de sanatate in adresa unui avocat (CNPDCP)", "url": "https://datepersonale.md/aspecte-privind-transmiterea-de-catre-un-centru-de-sanatate-raional-a-datelor-cu-caracter-personal-privind-starea-de-sanatate-a-subiectului-de-date-in-adresa-unui-avocat/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 35, "summary": "Family doctors see an electronic file in SIA AMP and eReteta shows prescription history, but there is no national record across providers. The Ministry says the missing record limits quick access to patient history and harms clinical safety.", "sources": [ { "title": "Nota de fundamentare, Programul National pentru Digitalizare si Inovare in Sanatate 2026-2030 (Ministerul Sanatatii, particip.gov.md)", "url": "https://particip.gov.md/ro/download_attachment/28629", "date": "undated", "publisherClass": "official" }, { "title": "Doar 10% dintre cetatenii R. Moldova au acces la datele medicale in format digital (Moldova 1)", "url": "https://moldova1.md/p/54965/doar-10-dintre-cetatenii-r-moldova-au-acces-la-datele-medicale-in-format-digital-autoritatile-planifica-lansarea-dosarelor-electronice-de-sanatate", "date": "2025-08-13", "publisherClass": "news" }, { "title": "E-Reteta, la doi ani de la lansare: circa 40% din populatie si peste 5.500 de specialisti folosesc sistemul (Moldova 1)", "url": "https://moldova1.md/p/72463", "date": "2026-03-31", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Moldova has no framework for secondary use of health data and no health data access body; the Ministry targets five anonymised datasets a year by 2029. Trials need ethics review by a national committee, and an EU-aligned trials regulation was approved in October 2025.", "sources": [ { "title": "Nota de fundamentare, Programul National pentru Digitalizare si Inovare in Sanatate 2026-2030 (Ministerul Sanatatii, particip.gov.md)", "url": "https://particip.gov.md/ro/download_attachment/28629", "date": "undated", "publisherClass": "official" }, { "title": "Guvernul a aprobat proiectul de hotarare privind studiile clinice cu medicamente de uz uman (AMDM)", "url": "https://amdm.gov.md/ro/news/guvernul-a-aprobat-proiectul-de-hot-rare-privind-studiile-clinice-cu-medicamente-de-uz-uman", "date": "2025-10-09", "publisherClass": "official" }, { "title": "Expertizarea etica a studiilor clinice se va efectua dupa standarde noi (Guvernul Republicii Moldova)", "url": "https://old.gov.md/ro/content/expertizarea-etica-studiilor-clinice-se-va-efectua-dupa-standarde-noi", "date": "2016-01-14", "publisherClass": "official" }, { "title": "Transmiterea de catre un centru de sanatate raional a datelor privind starea de sanatate in adresa unui avocat (CNPDCP)", "url": "https://datepersonale.md/aspecte-privind-transmiterea-de-catre-un-centru-de-sanatate-raional-a-datelor-cu-caracter-personal-privind-starea-de-sanatate-a-subiectului-de-date-in-adresa-unui-avocat/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "Law 102/2017 counts software as a medical device, but no rules for clinical AI were found. The economy minister said in May 2026 that an AI law is due by the end of 2026 as part of EU accession talks.", "sources": [ { "title": "Despre dispozitive medicale, Legea nr. 102/2017 (AMDM)", "url": "https://amdm.gov.md/ro/page/despre-dm", "date": "undated", "publisherClass": "official" }, { "title": "Moldova ar putea reglementa inteligenta artificiala pana la sfarsitul anului (NewsMaker)", "url": "https://newsmaker.md/ro/moldova-ar-putea-reglementa-inteligenta-artificiala-pana-la-sfarsitul-anului-ministru-ca-stat-nu-am-fost-pregatiti", "date": "2026-05-15", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 263/2005 on patient rights and responsibilities", "level": "National", "year": "2005", "what": "Unlimited patient access to own medical data; copy of any part; confidentiality of medical information.", "url": "https://ombudsman.md/wp-content/uploads/2020/01/drepturi_pacient_rus.pdf" }, { "name": "Law 195/2024 on personal data protection", "level": "National", "year": "2024", "what": "GDPR-based law in force 23 August 2026; replaced Law 133/2011; fines up to 2% of turnover.", "url": "https://datepersonale.md/legea-nr-195-2024-privind-protectia-datelor-cu-caracter-personal-principalele-prevederi-si-noutati-legislative/" }, { "name": "Law 133/2011 on personal data protection (repealed August 2026)", "level": "National", "year": "2011", "what": "Treated health data as a special category needing consent or a listed legal ground.", "url": "https://datepersonale.md/aspecte-privind-transmiterea-de-catre-un-centru-de-sanatate-raional-a-datelor-cu-caracter-personal-privind-starea-de-sanatate-a-subiectului-de-date-in-adresa-unui-avocat/" }, { "name": "Law 102/2017 on medical devices", "level": "National", "year": "2017", "what": "Defines medical devices to include software; risk classes I to III; AMDM registration.", "url": "https://amdm.gov.md/ro/page/despre-dm" }, { "name": "Government Decision 556/2025, National Digitalisation and Innovation in Health Programme 2025-2030", "level": "National", "year": "2025", "what": "Plans national e-health record, consent mechanism by 2027, telemedicine and data governance.", "url": "https://egov.md/ro/node/41059" }, { "name": "European Health Data Space Regulation (EU) 2025/327", "level": "Supranational", "year": "2025", "what": "Not binding on Moldova; the Ministry cites it as the target for access and secondary-use rules.", "url": "https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-02-14", "headline": "Regulator finds private laboratory left patients' test results open on its website", "paraphrase": "A patient found that other people's test results on a large private laboratory's website could be opened by changing digits in a link. The data protection regulator found the laboratory failed to secure them and opened an administrative case.", "source": "NewsMaker", "url": "https://newsmaker.md/ru/doc-v-moldove-protiv-laboratorii-alfa-diagnostica-vozbudili-administrativnoe-delo-iz-za-utechki-meditsinskih-dannyh", "theme": "breach", "status": "finding" }, { "date": "2026-05-20", "headline": "National health insurer confirms cyberattack that may have taken patient data", "paraphrase": "The national health insurer said attackers hit one of its information systems and technical checks pointed to a possible data exfiltration. Its director later said no leak had yet appeared online and the investigation was continuing.", "source": "Moldova 1 (Teleradio-Moldova)", "url": "https://moldova1.md/p/76505/ion-dodon-nu-exista-dovezi-ca-datele-pacientilor-au-fost-scurse-dupa-atacul-cibernetic-asupra-sistemului-de-asigurari-in-medicina", "theme": "breach", "status": "admitted" } ] }, { "iso3": "TZA", "name": "Tanzania", "region": "Africa", "overall": 41, "rank": "91=", "likelyRank": "67 to 117", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Electronic records now cover every referral hospital, but patients get only a description of their data and no say over sharing.", "categories": { "access": { "score": 35, "summary": "Section 33 of the Personal Data Protection Act gives a right to be told what data is held and why, not clearly a copy of the record. There is no deadline for answering and no national patient portal.", "sources": [ { "title": "Personal Data Protection Act, 2022 (English translation, GN 395B of 2023), ss. 3, 25, 27, 30, 33, 35, 58, 60", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf", "date": "2023-06-13", "publisherClass": "legal_text" }, { "title": "Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN 449C)", "url": "https://www.mawasiliano.go.tz/uploads/documents/sw-1691159153-GN%20NO.%20449C%20OF%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Aga Khan rolls out electronic patient records (The Citizen)", "url": "https://www.thecitizen.co.tz/tanzania/business/aga-khan-rolls-out-electronic-patient-records--5321008", "date": "2026-01-09", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "The law requires prior written consent to process health data, but it exempts processing for medical care under a health professional. Records move between referral hospitals through national systems, with no patient opt-out or access log found.", "sources": [ { "title": "Personal Data Protection Act, 2022 (English translation, GN 395B of 2023), ss. 3, 25, 27, 30, 33, 35, 58, 60", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf", "date": "2023-06-13", "publisherClass": "legal_text" }, { "title": "Ministry of Health, Annual Health Sector Performance Profile 2024, chapter 14 (ICT)", "url": "https://www.moh.go.tz/storage/app/uploads/public/698/337/ef7/698337ef72583788742967.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "Hospitals at risk as Tanzania adopts AI without proper cyber safeguards (The Citizen)", "url": "https://www.thecitizen.co.tz/tanzania/news/national/hospitals-at-risk-as-tanzania-adopts-ai-without-proper-cyber-safeguards-5389622", "date": "2026-03-13", "publisherClass": "news" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive under the 2022 Act, and full enforcement began on 9 April 2026, with court fines up to TZS 5 billion. Breaches go to the regulator only, patients need not be told, and health-sector enforcement was not found.", "sources": [ { "title": "Personal Data Protection Act, 2022 (English translation, GN 395B of 2023), ss. 3, 25, 27, 30, 33, 35, 58, 60", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf", "date": "2023-06-13", "publisherClass": "legal_text" }, { "title": "Notification obligations arising from personal data breaches in Tanzania (Clyde & Co)", "url": "https://www.clydeco.com/en/insights/2026/02/notification-obligations-arising-from-personal-dat", "date": "2026-02-09", "publisherClass": "law_firm" }, { "title": "PDPC issues final warning ahead of Data Protection compliance deadline (The Respondent)", "url": "https://www.therespondents.co.tz/2026/03/pdpc-issues-final-warning-ahead-of-data.html", "date": "2026-03-26", "publisherClass": "news" }, { "title": "European Commission, Adequacy decisions", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 48, "summary": "Ministry figures for 2024 show electronic records in all national, specialised, zonal and regional referral hospitals and 67.64% of dispensaries, with 36 systems exchanging data. Linking primary care to the referral record was still in progress.", "sources": [ { "title": "Ministry of Health, Annual Health Sector Performance Profile 2024, chapter 14 (ICT)", "url": "https://www.moh.go.tz/storage/app/uploads/public/698/337/ef7/698337ef72583788742967.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "Tanzania accelerates digital health transformation to ensure inclusive, connected healthcare system (The Guardian, by the Ministry of Health communication head)", "url": "https://ippmedia.co.tz/the-guardian/features/read/tanzania-accelerates-digital-health-transformation-to-ensure-inclusive-connected-healthcare-system-2026-05-21-140416", "date": "2026-05-21", "publisherClass": "news" }, { "title": "Tanzania seeks funding to scale up digital health services (The Respondent)", "url": "https://www.therespondents.co.tz/2026/09/tanzania-seeks-funding-to-scale-up.html", "date": "2026-09-30", "publisherClass": "news" }, { "title": "TIRA drives digital revolution in UHI (Daily News)", "url": "https://dailynews.co.tz/tira-drives-digital-revolution-in-uhi/", "date": "2026-03-02", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "A person can tell a controller to stop direct marketing, and offering unlawfully obtained data for sale is a crime. We found no specific rules for health apps, data brokers or sale of de-identified health data.", "sources": [ { "title": "Personal Data Protection Act, 2022 (English translation, GN 395B of 2023), ss. 3, 25, 27, 30, 33, 35, 58, 60", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf", "date": "2023-06-13", "publisherClass": "legal_text" }, { "title": "Data protection laws in Tanzania (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?c=TZ&t=law", "date": "2026-03-24", "publisherClass": "law_firm" } ] }, "clinical": { "score": 40, "summary": "A doctor at a referral hospital can open a referred patient's history through Health Data Universal, so paper files are no longer needed for those referrals. Most dispensaries and health centres are not yet on that shared record.", "sources": [ { "title": "Ministry of Health, Annual Health Sector Performance Profile 2024, chapter 14 (ICT)", "url": "https://www.moh.go.tz/storage/app/uploads/public/698/337/ef7/698337ef72583788742967.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "Tanzania accelerates digital health transformation to ensure inclusive, connected healthcare system (The Guardian, by the Ministry of Health communication head)", "url": "https://ippmedia.co.tz/the-guardian/features/read/tanzania-accelerates-digital-health-transformation-to-ensure-inclusive-connected-healthcare-system-2026-05-21-140416", "date": "2026-05-21", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health research needs institutional ethics approval, with national clearance for foreign collaborators. The 2022 Act lets health data be used for research without consent only under Commission guidelines, which we did not find, and there is no opt-out.", "sources": [ { "title": "NIMR, Health Research Regulations", "url": "https://nimr.or.tz/health-research-regulations/", "date": "undated", "publisherClass": "official" }, { "title": "Personal Data Protection Act, 2022 (English translation, GN 395B of 2023), ss. 3, 25, 27, 30, 33, 35, 58, 60", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf", "date": "2023-06-13", "publisherClass": "legal_text" } ] }, "ai": { "score": 58, "summary": "TMDA's 2024 device guidelines set rules for AI medical devices, including change notices, human-in-the-loop workflows and controls on continuous learning. We found no approved AI device and no health-AI regulator.", "sources": [ { "title": "TMDA, Compendium of Guidelines for Marketing Authorization of Medical Devices, Diagnostics and Laboratory Equipment, section 3 (AI-MD)", "url": "https://www.tmda.go.tz/uploads/publications/en1755088789-Compendium%20of%20Guidelines%20for%20Marketing%20Authorization%20of%20Medical%20Devices,%20Diagnostics%20and%20Laboratory%20Equipment,%20June%202024.pdf", "date": "2024-06", "publisherClass": "official" }, { "title": "e-Government Authority, Standards and Guidelines for Responsible Use of AI in Public Institutions, v1.0", "url": "https://www.ega.go.tz/uploads/standarddocuments/sw-1788520404-FINAL%20Standards%20and%20Guidelines%20for%20Artificial%20Intelligence%20(AI)%20in%20Public%20Institution_Signed%20(1).pdf", "date": "2026-08-31", "publisherClass": "official" }, { "title": "Tanzania steps up AI drive in healthcare amid data privacy push (The Citizen)", "url": "https://www.thecitizen.co.tz/tanzania/news/national/tanzania-steps-up-ai-drive-in-healthcare-amid-data-privacy-push-5542208", "date": "2026-07-31", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Act, 2022 (Cap. 44)", "level": "National", "year": "2022", "what": "Health is sensitive data; consent rules; description-level access right; breach notice to PDPC; fines to TZS 5 billion.", "url": "https://pdpc.go.tz/documents/3/PERSONAL_DATA_PROTECTION_ACT_2022.pdf" }, { "name": "Personal Data Protection (Personal Data Collection and Processing) Regulations, 2023", "level": "National", "year": "2023", "what": "Registration, procedures to block, correct and erase data, transfer permits and impact assessments.", "url": "https://www.mawasiliano.go.tz/uploads/documents/sw-1691159153-GN%20NO.%20449C%20OF%202023.pdf" }, { "name": "Universal Health Insurance Act, 2023 (Act No. 13)", "level": "National", "year": "2023", "what": "Makes health insurance universal; TIRA regulates schemes. In force 16 August 2024 per Daily News.", "url": "https://www.moh.go.tz/storage/app/uploads/public/656/de7/1aa/656de71aae4fb340630686.pdf" }, { "name": "TMDA Compendium of Guidelines for Marketing Authorization of Medical Devices", "level": "National", "year": "2024", "what": "Registration rules for medical devices, including AI devices, change notification and continuous learning controls.", "url": "https://www.tmda.go.tz/uploads/publications/en1755088789-Compendium%20of%20Guidelines%20for%20Marketing%20Authorization%20of%20Medical%20Devices,%20Diagnostics%20and%20Laboratory%20Equipment,%20June%202024.pdf" }, { "name": "eGA Standards and Guidelines for Responsible Use of AI in Public Institutions", "level": "National", "year": "2026", "what": "Public-sector AI governance: human oversight, risk assessment, prohibited uses and generative AI rules.", "url": "https://www.ega.go.tz/uploads/standarddocuments/sw-1788520404-FINAL%20Standards%20and%20Guidelines%20for%20Artificial%20Intelligence%20(AI)%20in%20Public%20Institution_Signed%20(1).pdf" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ZMB", "name": "Zambia", "region": "Africa", "overall": 41, "rank": "91=", "likelyRank": "66 to 114", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "A government-run national health record now reaches most public clinics, but patients have no portal, no opt-out and no view of who opened their file.", "categories": { "access": { "score": 45, "summary": "The Data Protection Act 2021 gives a right to a copy, which may be free for the first copy and comes in electronic format on request, but sets no deadline. We found no patient portal, so people ask each facility.", "sources": [ { "title": "Data Protection Act No. 3 of 2021 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Act%20No.%203%20The%20Data%20Protection%20Act%202021_0.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "HPCZ Guidelines for Good Practice: Generation and Management of Patient Records", "url": "https://www.hpcz.org.zm/_files/ugd/de360d_9bf34f1d792941d6b649371c3f943777.pdf", "date": "2016-03", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for care and for managing health systems, and the national SmartCare record is shared across public facilities by default. We found no patient opt-out and no patient-visible access log.", "sources": [ { "title": "Data Protection Act No. 3 of 2021 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Act%20No.%203%20The%20Data%20Protection%20Act%202021_0.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "SmartCare Pro resource site (IHM, Ministry of Health EHR contractor)", "url": "https://smartcarezambia.io/", "date": "undated", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 48, "summary": "Scored on the general law, since we found no health-sector enforcement: the 2021 Act treats health as sensitive, requires breach notice to the Commissioner within 24 hours and keeps sensitive data in Zambia. The Commissioner sits inside a ministry and only became fully operational in 2025.", "sources": [ { "title": "Data Protection Act No. 3 of 2021 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Act%20No.%203%20The%20Data%20Protection%20Act%202021_0.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Zambia Steps Up on Data Privacy, Sets up Data Protection Commissioner Office (TechTrends)", "url": "https://techtrendske.co.ke/2025/04/10/office-of-the-data-protection-commissioner-zambia/", "date": "2025-04-10", "publisherClass": "news" }, { "title": "The Cyber Security Act, 2025 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/node/12319", "date": "2025", "publisherClass": "legal_text" }, { "title": "Zambia's Cybersecurity and Cybercrimes Laws Raise Alarms for Digital Rights (CIPESA)", "url": "https://cipesa.org/2025/05/zambias-cybersecurity-and-cybercrimes-laws-raise-alarms-for-digital-rights/", "date": "2025-05-19", "publisherClass": "academic" } ] }, "journey": { "score": 45, "summary": "SmartCare Pro, the state's single national record, links to the lab system, medicine logistics, DHIS2 reporting and HIV case surveillance. Officials report about 2,000 facilities and 12 million records, figures not verified on an official page.", "sources": [ { "title": "Ministry of Health Digital Health Strategy 2022-2026", "url": "https://zambia.knowledgehub.health/attachments/download/40/Digital-Health-strategy-final.pdf", "date": "2022", "publisherClass": "official" }, { "title": "SmartCare Pro resource site (IHM, Ministry of Health EHR contractor)", "url": "https://smartcarezambia.io/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Zambia unveils AI health records for the masses (ITWeb Africa)", "url": "https://itweb.africa/article/zambia-unveils-ai-health-records-for-the-masses/WnpNgM21BR47VrGd", "date": "2026-04-15", "publisherClass": "news" }, { "title": "Zambia Targets Nationwide Health Connectivity as SmartCare 2.0 Pilot Goes Live in Ndola (TechAfrica News)", "url": "https://techafricanews.com/2026/04/28/zambia-targets-nationwide-health-connectivity-as-smartcare-2-0-pilot-goes-live-in-ndola/", "date": "2026-04-28", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Section 14 of the 2021 Act does not name marketing or sale among the grounds for using health data, but direct marketing is an opt-out right, not opt-in. In 2026 the government objected to US aid terms it said would breach citizens' data rights.", "sources": [ { "title": "Data Protection Act No. 3 of 2021 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Act%20No.%203%20The%20Data%20Protection%20Act%202021_0.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Zambia delaying US deals over minerals and data demands (Al Jazeera)", "url": "https://www.aljazeera.com/news/2026/5/4/zambia-delaying-us-deals-over-minerals-and-data-demands", "date": "2026-05-04", "publisherClass": "news" }, { "title": "Zambia is close to resolving $1.5B US health data dispute (Semafor)", "url": "https://www.semafor.com/article/09/25/2026/zambia-eyes-end-to-us-health-data-dispute", "date": "2026-09-25", "publisherClass": "news" } ] }, "clinical": { "score": 40, "summary": "In public facilities on SmartCare Pro, a clinician can open one national record with history, medicines and allergies. Private-sector coverage and offline sites are not verified, and the hospital edition is only a pilot.", "sources": [ { "title": "How Zambia is Building Health Equity, One Patient at a Time (IHM Africa)", "url": "https://www.ihmafrica.org/?p=3135", "date": "2026-02-16", "publisherClass": "blog_vendor" }, { "title": "Zambia Targets Nationwide Health Connectivity as SmartCare 2.0 Pilot Goes Live in Ndola (TechAfrica News)", "url": "https://techafricanews.com/2026/04/28/zambia-targets-nationwide-health-connectivity-as-smartcare-2-0-pilot-goes-live-in-ndola/", "date": "2026-04-28", "publisherClass": "news" }, { "title": "HPCZ Guidelines for Good Practice: Generation and Management of Patient Records", "url": "https://www.hpcz.org.zm/_files/ugd/de360d_9bf34f1d792941d6b649371c3f943777.pdf", "date": "2016-03", "publisherClass": "official" }, { "title": "Ministry of Health Digital Health Strategy 2022-2026", "url": "https://zambia.knowledgehub.health/attachments/download/40/Digital-Health-strategy-final.pdf", "date": "2022", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "The National Health Research Act 2013 requires ethics approval and consent to collect samples or information, with misconduct penalties. Routine records are exempt from most data protection duties for research, and we found no opt-out.", "sources": [ { "title": "National Health Research Act No. 2 of 2013 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Health%20%20Research%20%20Act%202013.pdf", "date": "2013-03-22", "publisherClass": "legal_text" }, { "title": "Data Protection Act No. 3 of 2021 (National Assembly of Zambia)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Act%20No.%203%20The%20Data%20Protection%20Act%202021_0.pdf", "date": "2021", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "ZAMRA regulates medical software as a device, but we found no AI-specific rules on change control or human oversight. The national AI strategy itself says no AI governance exists.", "sources": [ { "title": "Medical Devices and Allied Substances (Zambia Medicines Regulatory Authority)", "url": "https://www.zamra.co.zm/services/allied-substances/", "date": "undated", "publisherClass": "official" }, { "title": "National Artificial Intelligence Strategy 2024-2026 (Ministry of Technology and Science)", "url": "https://www.mots.gov.zm/wp-content/uploads/2025/02/Zambia-Ai-Strategy-Book-option-2.pdf", "date": "2025-02", "publisherClass": "official" } ] } }, "laws": [ { "name": "Data Protection Act No. 3 of 2021", "level": "National", "year": "2021", "what": "Health is sensitive data; access, objection and portability rights; 24-hour breach notice; local storage of sensitive data.", "url": "https://www.parliament.gov.zm/node/8853" }, { "name": "National Health Research Act No. 2 of 2013", "level": "National", "year": "2013", "what": "Ethics approval, participant consent, sample transfer rules and misconduct penalties for health research.", "url": "https://www.parliament.gov.zm/sites/default/files/documents/acts/Health%20%20Research%20%20Act%202013.pdf" }, { "name": "Cyber Security Act, 2025", "level": "National", "year": "2025", "what": "Creates a Cyber Security Agency, critical information infrastructure rules and a monitoring centre; replaces the 2021 Act.", "url": "https://www.parliament.gov.zm/node/12319" }, { "name": "Cyber Crimes Act, 2025", "level": "National", "year": "2025", "what": "Offences relating to computers and computer systems, including protection against cyber crimes.", "url": "https://www.parliament.gov.zm/node/12320" }, { "name": "HPCZ Guidelines: Generation and Management of Patient Records", "level": "National", "year": "2016", "what": "Patients may get a copy of or access to their records; third-party disclosure needs written authorisation.", "url": "https://www.hpcz.org.zm/_files/ugd/de360d_9bf34f1d792941d6b649371c3f943777.pdf" } ], "dti": { "grade": 77, "tier": "Silver", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2024-12-10", "headline": "Court finds a hospital form was corrected improperly but rules the error harmless", "paraphrase": "In a negligence case, the High Court found a nurse had shaded over an original entry on a patient's form instead of striking it out. It accepted this was human error and dismissed the claims.", "source": "High Court for Zambia (Judiciary of Zambia)", "url": "https://judiciaryzambia.com/wp-content/uploads/2026/02/2021Hp0790-James-Phillip-Mdala-Vs-Viva-Med-Limited-and-Others-%E2%80%93-2024-C.-Zulu-J-1.pdf", "theme": "record_wrong", "status": "finding" }, { "date": "2026-05", "headline": "Health ministry staff shared passwords to the national patient record system", "paraphrase": "Auditors found clinic staff with full system rights and 528 shared administrator accounts in the national electronic patient record. The ministry told Parliament that staff going on leave handed their passwords to colleagues.", "source": "National Assembly of Zambia, Public Accounts Committee (report on the Auditor General's 2024 accounts)", "url": "https://www.parliament.gov.zm/sites/default/files/documents/committee_reports/Report%20of%20the%20Public%20Accounts%20Committee%20on%20the%20Report%20of%20the%20Auditor%20General%20on%20the%20Accounts%20of%20the%20Republic%20for%20the%20Financial%20Year%20Ended%2031st%20December%2C%202024.pdf", "theme": "other", "status": "admitted" }, { "date": "2025-07", "headline": "Insurance claims rejected because members' records listed the wrong sex", "paraphrase": "Evidence summarised by a parliamentary committee said an insurance member database still held inaccurate patient records, so some hospital claims were rejected because a woman's sex was recorded as male.", "source": "National Assembly of Zambia, Committee on Health, Community Development and Social Services", "url": "https://www.parliament.gov.zm/sites/default/files/documents/committee_reports/REPORT%20OF%20THE%20COMMITTEE%20ON%20HEALTH%2C%20COMMUNITY%20DEVELOPMENTY%20AND%20SOCIAL%20SERVICES%20ON%20THE%20OPERATIONS%20OF%20THE%20NATIONAL%20HEALTH%20INSURANCE%20MANAGEMENT%20AUTHORITY%20FOR%20THE%20FOURTH%20SESSION%20OF%20THE%20THIRTEENTH%20NATIONAL%20ASSEMBLY.pdf", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "BTN", "name": "Bhutan", "region": "Asia", "overall": 40, "rank": "97=", "likelyRank": "71 to 123", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Bhutan runs one national electronic record across 300 health facilities, but patients have no statutory right to a copy and no data protection regulator.", "categories": { "access": { "score": 33, "summary": "No statute gives patients a right to a copy of their record; the right rests on a 2022 ministry manual, and copies are at the patient's expense. The ePIS app shows visit history, diagnoses and prescriptions, which keeps the score near the top of the band.", "sources": [ { "title": "Bhutan Medical Record Manual and Standard Operating Procedures, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/01/BhutanMedicalRecordManualSOP_Version1_2022.pdf", "date": "2022", "publisherClass": "official" }, { "title": "ePIS App User Manual, GovTech Agency", "url": "https://tech.gov.bt/wp-content/uploads/2024/12/ePIS-manual.pdf", "date": "2024-12", "publisherClass": "official" }, { "title": "Power and network issues affect full use of ePIS system (BBS)", "url": "https://www.bbs.bt/241390/", "date": "2026-04-22", "publisherClass": "news" }, { "title": "Need for Right to Information Bill once again raised in Parliament (BBS)", "url": "https://www.bbs.bt/230052/", "date": "2025-06-17", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Records sit in one government system with no opt-out and no patient-visible access log that we could find. Rules require written consent before release outside care, and the 2025 healthcare rules make unauthorised disclosure an offence.", "sources": [ { "title": "Healthcare Services Rules and Regulations 2025, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/03/HSRR_2025.pdf", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Bhutan Medical Record Manual and Standard Operating Procedures, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/01/BhutanMedicalRecordManualSOP_Version1_2022.pdf", "date": "2022", "publisherClass": "official" }, { "title": "Information, Communications and Media Act of Bhutan 2018", "url": "https://www.bicma.gov.bt/data/publications/act/BICM_Act_2018_English.pdf", "date": "2018", "publisherClass": "legal_text" } ] }, "privacy": { "score": 38, "summary": "Medical records are sensitive data under the 2018 ICM Act, and disclosing patient information without consent can cost a provider 120 days' minimum wage or its licence. Bhutan has no comprehensive data protection law, no regulator and no breach notification duty that we found.", "sources": [ { "title": "Information, Communications and Media Act of Bhutan 2018", "url": "https://www.bicma.gov.bt/data/publications/act/BICM_Act_2018_English.pdf", "date": "2018", "publisherClass": "legal_text" }, { "title": "Healthcare Services Rules and Regulations 2025, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/03/HSRR_2025.pdf", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "Bhutan National Data Governance Framework: Baseline Study 2024, GovTech Agency", "url": "https://tech.gov.bt/download/bhutan-national-data-governance-framework-baseline-study-2024/", "date": "2026-08-03", "publisherClass": "official" }, { "title": "Adequacy decisions, European Commission", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 58, "summary": "One national system, ePIS, runs in 300 facilities including 58 hospitals and 186 primary health centres, and about 92 percent of patients were registered through it in early 2026. Power cuts, weak networks and older lab machines still limit full use.", "sources": [ { "title": "Power and network issues affect full use of ePIS system (BBS)", "url": "https://www.bbs.bt/241390/", "date": "2026-04-22", "publisherClass": "news" }, { "title": "Rollout of Electronic patient information system, Trashigang Dzongkhag Administration", "url": "https://trashigang.gov.bt/rollout-of-electronic-patient-information-system/", "date": "2024-03-07", "publisherClass": "official" }, { "title": "Healthcare Services Rules and Regulations 2025, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/03/HSRR_2025.pdf", "date": "2025-03-12", "publisherClass": "legal_text" }, { "title": "The Constitution of the Kingdom of Bhutan", "url": "https://cms.parliament.gov.bt/uploads/Constitution_Dzongkha_n_english_1a63683445.pdf", "date": "2008", "publisherClass": "legal_text" } ] }, "commercial": { "score": 38, "summary": "The ICM Act bars passing personal data to third parties without written authorisation, but no law bans selling health data or using it for marketing. A US genetic testing firm setting up in Gelephu says its platform will connect to national patient records.", "sources": [ { "title": "Information, Communications and Media Act of Bhutan 2018", "url": "https://www.bicma.gov.bt/data/publications/act/BICM_Act_2018_English.pdf", "date": "2018", "publisherClass": "legal_text" }, { "title": "Bhutan's Gelephu Mindfulness City adopts 18 Singaporean laws and 10 Abu Dhabi financial regulations (Asia News Network)", "url": "https://asianews.network/bhutans-gelephu-mindfulness-city-adopts-18-singaporean-laws-and-10-abu-dhabi-financial-regulations/", "date": "2025-01-06", "publisherClass": "news" }, { "title": "US precision health firm Waive Diagnostics to establish regional hub in Gelephu Mindfulness City (Daily Bhutan)", "url": "https://www.dailybhutan.com/article/us-precision-health-firm-waive-diagnostics-to-establish-regional-hub-in-gelephu-mindfulness-city", "date": "2026-04-21", "publisherClass": "news" } ] }, "clinical": { "score": 50, "summary": "ePIS is built so a clinician at any connected facility can open the same patient record, but we could not verify that cross-facility viewing works in daily practice. Unstable power and weak networks still limit ePIS use in some areas.", "sources": [ { "title": "Rollout of Electronic patient information system, Trashigang Dzongkhag Administration", "url": "https://trashigang.gov.bt/rollout-of-electronic-patient-information-system/", "date": "2024-03-07", "publisherClass": "official" }, { "title": "Bhutan Medical Record Manual and Standard Operating Procedures, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/01/BhutanMedicalRecordManualSOP_Version1_2022.pdf", "date": "2022", "publisherClass": "official" }, { "title": "Power and network issues affect full use of ePIS system (BBS)", "url": "https://www.bbs.bt/241390/", "date": "2026-04-22", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "De-identified records may be used for research without consent and there is no opt-out. Three safeguards lift the score: a national ethics board, penalties for unconsented disclosure and a public research registry.", "sources": [ { "title": "Research Ethics Board of Health (REBH), Ministry of Health", "url": "https://moh.gov.bt/pages/research-ethics-board-of-health-rebh/", "date": "undated", "publisherClass": "official" }, { "title": "Proposal summary: AI-powered Classification of Bhutanese CXR images, Bhutan Health Research Portal", "url": "https://bhutanhrp.moh.gov.bt/index.php/hrp/search/viewProposal/653", "date": "undated", "publisherClass": "official" }, { "title": "Bhutan Medical Record Manual and Standard Operating Procedures, Ministry of Health", "url": "https://moh.gov.bt/wp-content/uploads/2025/01/BhutanMedicalRecordManualSOP_Version1_2022.pdf", "date": "2022", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "Standalone medical software must be registered as a device under a 2022 regulator guideline, with notice of later changes, but nothing addresses AI specifically. The 2025 National AI Strategy says Bhutan has no AI oversight, accountability or transparency mechanisms.", "sources": [ { "title": "Guideline for Registration of Medical Devices 2022, Drug Regulatory Authority", "url": "https://bfda.gov.bt/wp-content/uploads/2025/09/Guideline-for-Registration-of-Medical-Devices-2022.pdf", "date": "2022-08-22", "publisherClass": "official" }, { "title": "Public Consultation on revised Guideline for Registration of Medical Devices, BFDA", "url": "https://bfda.gov.bt/public-consultation-on-revised-guideline-for-registration-of-medical-devices/", "date": "2026-05-04", "publisherClass": "official" }, { "title": "Bhutan National AI Strategy 2025, GovTech Agency", "url": "https://tech.gov.bt/wp-content/uploads/2025/10/National-AI-Strategy-2025.pdf", "date": "2025-10", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitution of the Kingdom of Bhutan", "level": "National", "year": "2008", "what": "Article 7(19) protects privacy; Article 9(21) promises free access to basic public health services.", "url": "https://cms.parliament.gov.bt/uploads/Constitution_Dzongkha_n_english_1a63683445.pdf" }, { "name": "Information, Communications and Media Act of Bhutan", "level": "National", "year": "2018", "what": "Medical records are sensitive data; written permission needed to collect or disclose; compensation and misdemeanour penalties.", "url": "https://www.bicma.gov.bt/data/publications/act/BICM_Act_2018_English.pdf" }, { "name": "Healthcare Services Rules and Regulations 2025", "level": "National", "year": "2025", "what": "Allows a mandatory central health record system; makes unconsented disclosure of patient information an offence.", "url": "https://moh.gov.bt/wp-content/uploads/2025/03/HSRR_2025.pdf" }, { "name": "National Digital Identity Act of Bhutan", "level": "National", "year": "2023", "what": "Legal basis for the digital ID used to log in to ePIS; unconsented credential disclosure is a felony.", "url": "https://ndi-website-17-07-2023-storage-4b404e2160703-staging.s3.ap-southeast-1.amazonaws.com/public/governance-framework/National-Digital-Identity-Act-of-Bhutan-2023.pdf" }, { "name": "Guideline for Registration of Medical Devices (under the Medicines Act 2003)", "level": "National", "year": "2022", "what": "Standalone software counts as a medical device needing registration; changes must be notified.", "url": "https://bfda.gov.bt/wp-content/uploads/2025/09/Guideline-for-Registration-of-Medical-Devices-2022.pdf" }, { "name": "GMC Application of Laws Act 2024 (GMC Law No. 1)", "level": "Regional", "year": "2024", "what": "Applies 18 Singapore laws, including the Personal Data Protection Act 2012, inside Gelephu Mindfulness City.", "url": "https://asianews.network/bhutans-gelephu-mindfulness-city-adopts-18-singaporean-laws-and-10-abu-dhabi-financial-regulations/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "MWI", "name": "Malawi", "region": "Africa", "overall": 40, "rank": "97=", "likelyRank": "71 to 120", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Malawi's 2024 data law gives a 30-day right to a copy, but most patients still carry their record in a paper health passport.", "categories": { "access": { "score": 50, "summary": "Section 19 of the Data Protection Act 2024 gives a right to a copy of your data in electronic form within 30 days, free where practicable. There is no patient portal, and most people hold their own record in a paper health passport.", "sources": [ { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" }, { "title": "Malawi Data Protection Authority (home page, complaints service)", "url": "https://www.dpa.mw/", "date": "undated", "publisherClass": "official" }, { "title": "Digital health records system in pilot phase (The Nation)", "url": "https://mwnation.com/digital-health-records-system-in-pilot-phase/", "date": "2026-09-04", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for public health or the public interest, and the new shared record gives no sharing choice or access log. HIV status is the exception: providers need written consent to disclose it beyond the treating team, with narrow exceptions.", "sources": [ { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" }, { "title": "HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018)", "url": "https://policyvault.africa/wp-content/uploads/policy/MWI12.pdf", "date": "2018-02-09", "publisherClass": "legal_text" }, { "title": "U.S. and Malawi Sign Five-Year Health MOU (U.S. Embassy Lilongwe)", "url": "https://mw.usembassy.gov/u-s-and-malawi-sign-five-year-health-mou/", "date": "2026-01-16", "publisherClass": "official" }, { "title": "Malawi barters Malawians health data for US to lift visa restrictions? (Malawi24)", "url": "https://malawi24.com/2026/01/16/is-malawi-trading-health-data-for-visa-relief-with-the-us/", "date": "2026-01-16", "publisherClass": "news" } ] }, "privacy": { "score": 50, "summary": "The 2024 Act treats health as sensitive, requires breach notice within 72 hours and lets the regulator impose penalties up to K20 million. We found no health-sector enforcement, and a 2024 study reports repeated ransomware attacks on health systems, so this sits low in the general-law band.", "sources": [ { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" }, { "title": "Malawi Builds Capacity to Implement Data Protection Act (Malawi Data Protection Authority)", "url": "https://www.dpa.mw/malawi-builds-capacity-to-implement-data-protection-act/", "date": "2026-09-22", "publisherClass": "official" }, { "title": "HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018)", "url": "https://policyvault.africa/wp-content/uploads/policy/MWI12.pdf", "date": "2018-02-09", "publisherClass": "legal_text" }, { "title": "Design of a Trustworthy Cloud-Native National Digital Health Information Infrastructure for Secure Data Management and Use (Oxford Open Digital Health, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932406/", "date": "2024-11-03", "publisherClass": "academic" } ] }, "journey": { "score": 40, "summary": "A national EMR runs in 758 HIV treatment clinics and links to the lab system, and DHIS2 carries national reporting. The MaHIS record meant to link all facilities was only in pilot at one central hospital and selected health centres in September 2026.", "sources": [ { "title": "Health Information Systems in Malawi (Elizabeth Glaser Pediatric AIDS Foundation)", "url": "https://pedaids.org/resource/health-information-systems-malawi/", "date": "2024-08", "publisherClass": "blog_vendor" }, { "title": "MALAWI Health Data Ecosystem Mapping (PATH, Digital Innovation in Pandemic Control)", "url": "https://media.path.org/documents/MALAWIREPORTecosystemmapping-.pdf", "date": "2023-10", "publisherClass": "blog_vendor" }, { "title": "Malawi strengthens alignment under the health data collaborative (WHO Regional Office for Africa)", "url": "https://www.afro.who.int/countries/malawi/news/malawi-strengthens-alignment-under-health-data-collaborative", "date": "2026-05-22", "publisherClass": "intergov" }, { "title": "Digital health records system in pilot phase (The Nation)", "url": "https://mwnation.com/digital-health-records-system-in-pilot-phase/", "date": "2026-09-04", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "Anyone can object to direct marketing under section 24, and health data needs consent or another listed ground. We found no rules on selling health data, data brokers, health apps or de-identified data.", "sources": [ { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "Clinicians at HIV clinics can see a shared HIV and TB history, and the HIV Act lets them share status with the treating team. Most other patients' history travels only in the paper passport they carry, and MaHIS is still a pilot.", "sources": [ { "title": "HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018)", "url": "https://policyvault.africa/wp-content/uploads/policy/MWI12.pdf", "date": "2018-02-09", "publisherClass": "legal_text" }, { "title": "Health Information Systems in Malawi (Elizabeth Glaser Pediatric AIDS Foundation)", "url": "https://pedaids.org/resource/health-information-systems-malawi/", "date": "2024-08", "publisherClass": "blog_vendor" }, { "title": "Digital health records system in pilot phase (The Nation)", "url": "https://mwnation.com/digital-health-records-system-in-pilot-phase/", "date": "2026-09-04", "publisherClass": "news" }, { "title": "Design of a Trustworthy Cloud-Native National Digital Health Information Infrastructure for Secure Data Management and Use (Oxford Open Digital Health, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932406/", "date": "2024-11-03", "publisherClass": "academic" } ] }, "research": { "score": 49, "summary": "The 2024 Act lets health data be used for research without consent and gives no general opt-out. National ethics review, HIV confidentiality rules and criminal penalties put it at the top of the no-opt-out band.", "sources": [ { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" }, { "title": "DS-I Africa Law: Cross-Border Sharing of Data, Malawi country guide (datalaw.africa)", "url": "https://www.datalaw.africa/wp-content/uploads/2024/09/Malawi_country-guide_30-Sept.pdf", "date": "2024-07", "publisherClass": "academic" }, { "title": "HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018)", "url": "https://policyvault.africa/wp-content/uploads/policy/MWI12.pdf", "date": "2018-02-09", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "Malawi has no rules for AI in clinical care. The medicines regulator covers medical devices but lists no software or AI guidance, and an AI Bill and national AI strategy were still being drafted in August 2026.", "sources": [ { "title": "Guidelines (Pharmacy and Medicines Regulatory Authority)", "url": "https://www.pmra.mw/guidelines/", "date": "undated", "publisherClass": "official" }, { "title": "The PMRA Act, 2019 (Pharmacy and Medicines Regulatory Authority)", "url": "https://www.pmra.mw/the-act/", "date": "undated", "publisherClass": "official" }, { "title": "Malawi drafts AI bill to govern public sector tech (ITWeb Africa)", "url": "https://itweb.africa/article/malawi-drafts-ai-bill-to-govern-public-sector-tech/PmxVE7KEOnpqQY85", "date": "2026-08-06", "publisherClass": "news" }, { "title": "Data Protection Act, 2024 (Act No. 3 of 2024), Malawi Data Protection Authority download", "url": "https://www.dpa.mw/download/data-protection-act-2024/", "date": "2024-02-02", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection Act, 2024 (Act No. 3 of 2024)", "level": "National", "year": "2024", "what": "Health is sensitive data; 30-day right to a copy; 72-hour breach notice; MACRA is the regulator.", "url": "https://www.dpa.mw/download/data-protection-act-2024/" }, { "name": "HIV and AIDS (Prevention and Management) Act, 2018 (Act No. 9 of 2018)", "level": "National", "year": "2018", "what": "HIV status confidential; disclosure needs written consent except treating providers, anonymous studies, court orders.", "url": "https://policyvault.africa/wp-content/uploads/policy/MWI12.pdf" }, { "name": "Pharmacy and Medicines Regulatory Authority Act, 2019 (Act No. 9 of 2019)", "level": "National", "year": "2019", "what": "Creates the regulator for medicines and medical devices; no AI or software rules found.", "url": "https://www.pmra.mw/the-act/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-03-09", "headline": "Health minister ends group consultations that made patients share health details with strangers", "paraphrase": "After posing as a patient at a public hospital, the health minister said several patients were seen together and had to describe their health problems in front of others. She ordered public facilities to see patients individually.", "source": "Malawi24", "url": "https://malawi24.com/2026/03/09/health-minister-bans-group-consultations-in-hospitals/", "theme": "other", "status": "admitted" } ] }, { "iso3": "BHS", "name": "Bahamas", "region": "Americas", "overall": 39, "rank": "99=", "likelyRank": "80 to 133", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Bahamians can ask each provider for a copy of their record under a 2003 law, but public clinics were still moving off paper in 2026.", "categories": { "access": { "score": 45, "summary": "The 2003 Data Protection Act gives a right to a copy within 40 days, but the Minister may set a fee and no national portal with the full record was verified. NHI's patient portal for its own providers offsets the fee.", "sources": [ { "title": "Data Protection (Privacy of Personal Information) Act, 2003 (Lex Bahamas copy)", "url": "https://www.lexbahamas.com/Data%20Protection%202003.pdf", "date": "2003-04", "publisherClass": "legal_text" }, { "title": "NHIA Privacy Policy (NHI Bahamas)", "url": "https://www.nhibahamas.gov.bs/privacy/", "date": "undated", "publisherClass": "official" }, { "title": "Patient Portal and Healow App (NHI Bahamas)", "url": "https://www.nhibahamas.gov.bs/patient-portal/", "date": "undated", "publisherClass": "official" }, { "title": "The Bahamas National Health Strategy (2026 to 2030) (Ministry of Health and Wellness)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantministryofhealth/documents/BHSHealthStrategy-20260331091916.pdf", "date": "2026-03-31", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "The 2003 law has no consent rules, and no opt-out or patient-visible access log was found. NHI says a patient can consent to have their record shared with a new provider, which puts this at the top of the lowest band.", "sources": [ { "title": "Electronic Health Record (EHR) for Providers (NHI Bahamas)", "url": "https://www.nhibahamas.gov.bs/ehr/", "date": "undated", "publisherClass": "official" }, { "title": "NHIA Privacy Policy (NHI Bahamas)", "url": "https://www.nhibahamas.gov.bs/privacy/", "date": "undated", "publisherClass": "official" }, { "title": "National Health Insurance Act, 2025 (Official Gazette)", "url": "http://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0067/2025-0067.pdf", "date": "2025-08-28", "publisherClass": "legal_text" }, { "title": "Data Protection Bill, 2025 (Office of the Data Protection Commissioner)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/Data-Protection-Bill-2025-20251222135142.pdf", "date": "2025-12-22", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "No health-sector enforcement was found, so this is scored on the general law, at the bottom of the band. The 2003 Act in force has no breach notice duty and fines up to $100,000; the 2025 replacement Parliament passed was still not in force in August 2026.", "sources": [ { "title": "Data Protection (Privacy of Personal Information) Act, 2003 (Lex Bahamas copy)", "url": "https://www.lexbahamas.com/Data%20Protection%202003.pdf", "date": "2003-04", "publisherClass": "legal_text" }, { "title": "Data Protection Bill, 2025 (Office of the Data Protection Commissioner)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/Data-Protection-Bill-2025-20251222135142.pdf", "date": "2025-12-22", "publisherClass": "legal_text" }, { "title": "Data breaches underreported as public bypasses regulator (The Tribune)", "url": "https://www.tribune242.com/news/2026/aug/21/data-breaches-underreported-as-public-bypasses-regulator/", "date": "2026-08-21", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 35, "summary": "The government's own 2026 to 2030 strategy says records, portals and telehealth exist but are fragmented, public clinics often use paper, and there are no interoperability standards. NHI providers share one EHR, and a public clinic EMR was still spreading from two pilot clinics in 2026.", "sources": [ { "title": "The Bahamas National Health Strategy (2026 to 2030) (Ministry of Health and Wellness)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantministryofhealth/documents/BHSHealthStrategy-20260331091916.pdf", "date": "2026-03-31", "publisherClass": "official" }, { "title": "National Health Insurance Authority Making Steady Progress Towards Universal Health Coverage (Bahamas Information Services)", "url": "http://www.bahamas.gov.bs/news-press-release/national-health-insurance-authority-making-steady-progress-towards-universal-health-coverage", "date": "2023-10-26", "publisherClass": "official" }, { "title": "BahamasEMR+ (BEMR): One Year and Counting (ZNS Bahamas)", "url": "https://znsbahamas.com/bahamasemr-bemr-one-year-and-counting/", "date": "2026-07-02", "publisherClass": "news" }, { "title": "Prime Minister Philip Davis's Contribution to the Debate on the Compendium of Health Bills (Bahamas Information Services)", "url": "http://www.bahamas.gov.bs/news-press-release/prime-minister-philip-davis-s-contribution-to-the-debate-on-the-compendium-of-health-bills", "date": "2025-07-30", "publisherClass": "official" } ] }, "commercial": { "score": 40, "summary": "The 2003 Act bars using data in ways incompatible with the purpose it was collected for, and lets a person stop direct marketing, but needs no prior consent. Opt-in marketing consent is in the 2025 Act, not yet in force.", "sources": [ { "title": "Data Protection (Privacy of Personal Information) Act, 2003 (Lex Bahamas copy)", "url": "https://www.lexbahamas.com/Data%20Protection%202003.pdf", "date": "2003-04", "publisherClass": "legal_text" }, { "title": "Data Protection Bill, 2025 (Office of the Data Protection Commissioner)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/Data-Protection-Bill-2025-20251222135142.pdf", "date": "2025-12-22", "publisherClass": "legal_text" }, { "title": "National Health Insurance Act, 2025 (Official Gazette)", "url": "http://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0067/2025-0067.pdf", "date": "2025-08-28", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "No shared record lets a treating clinician see care from other providers across the public and private systems. Clinicians see records only inside their own network, such as NHI's EHR or the public clinics' BahamasEMR+.", "sources": [ { "title": "Electronic Health Record (EHR) for Providers (NHI Bahamas)", "url": "https://www.nhibahamas.gov.bs/ehr/", "date": "undated", "publisherClass": "official" }, { "title": "BahamasEMR+ (BEMR): One Year and Counting (ZNS Bahamas)", "url": "https://znsbahamas.com/bahamasemr-bemr-one-year-and-counting/", "date": "2026-07-02", "publisherClass": "news" }, { "title": "The Bahamas National Health Strategy (2026 to 2030) (Ministry of Health and Wellness)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantministryofhealth/documents/BHSHealthStrategy-20260331091916.pdf", "date": "2026-03-31", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Research data under the 2003 Act needs no consent and has no opt-out, and is exempt from the access right. Two safeguard classes count: an ethics committee for regenerative therapy research, and criminal penalties for disclosing NHI data.", "sources": [ { "title": "Data Protection (Privacy of Personal Information) Act, 2003 (Lex Bahamas copy)", "url": "https://www.lexbahamas.com/Data%20Protection%202003.pdf", "date": "2003-04", "publisherClass": "legal_text" }, { "title": "Longevity and Regenerative Therapies Act, 2024 (Official Gazette)", "url": "https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2024/2024-0051/2024-0051_1.pdf", "date": "2024-07-26", "publisherClass": "legal_text" }, { "title": "National Health Insurance Act, 2025 (Official Gazette)", "url": "http://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0067/2025-0067.pdf", "date": "2025-08-28", "publisherClass": "legal_text" }, { "title": "The Bahamas National Health Strategy (2026 to 2030) (Ministry of Health and Wellness)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantministryofhealth/documents/BHSHealthStrategy-20260331091916.pdf", "date": "2026-03-31", "publisherClass": "official" } ] }, "ai": { "score": 25, "summary": "No rules for AI in care, and no medical device regulation covering AI software, were found. In June 2026 the government said a national AI committee would draft the country's first AI law and a permanent AI authority.", "sources": [ { "title": "Innovation Ministry to Establish a National AI Committee to Draft the Country's First AI Legislation (Bahamas Information Services)", "url": "http://www.bahamas.gov.bs/news-press-release/innovation-ministry-to-establish-a-national-ai-committee-to-draft-the-country-s-first-ai-legislation", "date": "2026-06-16", "publisherClass": "official" }, { "title": "The Bahamas National Health Strategy (2026 to 2030) (Ministry of Health and Wellness)", "url": "https://cdn.bahamas.gov.bs/tenant/tenantministryofhealth/documents/BHSHealthStrategy-20260331091916.pdf", "date": "2026-03-31", "publisherClass": "official" }, { "title": "PAHO/WHO and The Bahamas sign first Country Cooperation Strategy (PAHO)", "url": "https://www.paho.org/en/news/17-2-2026-pahowho-and-bahamas-sign-first-country-cooperation-strategy-paho-director-meets", "date": "2026-02-17", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Data Protection (Privacy of Personal Information) Act, 2003 (Ch. 324A)", "level": "National", "year": "2003", "what": "Law in force: health is sensitive data, copy within 40 days, fines up to $100,000.", "url": "https://www.lexbahamas.com/Data%20Protection%202003.pdf" }, { "name": "Data Protection Act, 2025", "level": "National", "year": "2025", "what": "Passed replacement: consent for health data, 72-hour breach notice, marketing consent. Not yet in force.", "url": "https://cdn.bahamas.gov.bs/tenant/tenantdataprotection/documents/Data-Protection-Bill-2025-20251222135142.pdf" }, { "name": "National Health Insurance Act, 2025", "level": "National", "year": "2025", "what": "Providers must record care in NHIA's EHR; medical history shared only with consent; confidentiality offences.", "url": "http://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0067/2025-0067.pdf" }, { "name": "Longevity and Regenerative Therapies Act, 2024", "level": "National", "year": "2024", "what": "Creates a board and an ethics review committee that approves regenerative therapies and research.", "url": "https://laws.bahamas.gov.bs/cms/images/LEGISLATION/PRINCIPAL/2024/2024-0051/2024-0051_1.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-11-12", "headline": "Patient waits nearly three months for own hospital records after paying the fee", "paraphrase": "A young mother said she applied for her own hospital records and paid the fee, but nearly three months later still had not received them, stalling an official application. She alleged staff help faster if tipped.", "source": "The Tribune (Nassau)", "url": "https://www.tribune242.com/news/2025/nov/12/pmh-patients-detail-long-waits-poor-conditions/", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "BWA", "name": "Botswana", "region": "Africa", "overall": 39, "rank": "99=", "likelyRank": "74 to 128", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Botswana has a modern data law with an active regulator, but clinic and hospital systems do not share records and patients have no portal.", "categories": { "access": { "score": 45, "summary": "The Data Protection Act 2024 gives a free copy of your data within one month, and the Public Health Act lets facilities only temporarily deny record access. There is no patient portal, and we quote the published Bill because the enacted text was not verified.", "sources": [ { "title": "Data Protection Bill, 2024 (Bill No. 19 of 2024), enacted as Data Protection Act 18 of 2024", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf", "date": "2024-07-26", "publisherClass": "legal_text" }, { "title": "Public Health Act, 11 of 2013 (Botswana Laws)", "url": "https://botswanalaws.com/StatutesActpdf/2013Actpdf/PUBLIC%20HEALTH%20ACT,%2011%20OF%202013.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Botswana Data Protection Act comes into effect (Michalsons)", "url": "https://www.michalsons.com/blog/botswanas-data-protection-act-grace-period-extended/60775", "date": "2025-01-20", "publisherClass": "law_firm" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for diagnosis, treatment and health system management, and there is no shared record with sharing choices or an access log. Patients keep only general rights to object.", "sources": [ { "title": "Data Protection Bill, 2024 (Bill No. 19 of 2024), enacted as Data Protection Act 18 of 2024", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf", "date": "2024-07-26", "publisherClass": "legal_text" }, { "title": "Motshegwa acknowledges persistent shortage of medicines (Daily News, BOPA)", "url": "https://dailynews.gov.bw/news-detail/89169", "date": "2025-11-20", "publisherClass": "official" } ] }, "privacy": { "score": 58, "summary": "The 2024 Act treats health as sensitive, requires breach notice within 72 hours and allows fines up to P50 million or 4% of turnover. With no health-sector cases found, this scores the general law, which the regulator enforced against a government portal in 2026.", "sources": [ { "title": "Data Protection Bill, 2024 (Bill No. 19 of 2024), enacted as Data Protection Act 18 of 2024", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf", "date": "2024-07-26", "publisherClass": "legal_text" }, { "title": "Gov't e-payslip fails data protection compliance test (Mmegi)", "url": "https://www.mmegi.bw/news/govt-e-payslip-fails-data-protection-compliance-test/news", "date": "2026-07-28", "publisherClass": "news" }, { "title": "Public Health Act, 11 of 2013 (Botswana Laws)", "url": "https://botswanalaws.com/StatutesActpdf/2013Actpdf/PUBLIC%20HEALTH%20ACT,%2011%20OF%202013.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Botswana-U.S. health milestone celebrated (Mmegi)", "url": "https://www.mmegi.bw/news/botswana-us-health-milestone-celebrated/news", "date": "2026-09-18", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "Several electronic systems run in public facilities, but the government told Parliament in November 2025 they are not interfaced to share data. An electronic medical record was being piloted in two districts, with a health information exchange planned.", "sources": [ { "title": "Digital Health background (Botswana Health Data Collaborative, hosted by University of Botswana)", "url": "https://ehealth.ub.bw/bhdc/background.html", "date": "undated", "publisherClass": "academic" }, { "title": "Motshegwa acknowledges persistent shortage of medicines (Daily News, BOPA)", "url": "https://dailynews.gov.bw/news-detail/89169", "date": "2025-11-20", "publisherClass": "official" }, { "title": "Ministry requests P8.7bn to revitalise healthcare (Daily News, BOPA)", "url": "https://dailynews.gov.bw/news-detail/90443", "date": "2026-03-09", "publisherClass": "official" } ] }, "commercial": { "score": 48, "summary": "People can object at any time to direct marketing, and the published Bill makes selling personal data a crime (enacted wording not verified). We found no rules on de-identified health data, health apps or brokers.", "sources": [ { "title": "Data Protection Bill, 2024 (Bill No. 19 of 2024), enacted as Data Protection Act 18 of 2024", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf", "date": "2024-07-26", "publisherClass": "legal_text" }, { "title": "Data protection laws in Botswana (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=BW", "date": "2026-03-18", "publisherClass": "law_firm" } ] }, "clinical": { "score": 22, "summary": "A clinician cannot open a patient's record from another facility because systems are not interfaced. The Public Health Act requires each facility to keep a permanent record and protect it from unauthorised access.", "sources": [ { "title": "Public Health Act, 11 of 2013 (Botswana Laws)", "url": "https://botswanalaws.com/StatutesActpdf/2013Actpdf/PUBLIC%20HEALTH%20ACT,%2011%20OF%202013.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Motshegwa acknowledges persistent shortage of medicines (Daily News, BOPA)", "url": "https://dailynews.gov.bw/news-detail/89169", "date": "2025-11-20", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Research use of health records needs the patient's authorisation plus ethics committee approval under the Public Health Act, and the 2024 Act adds a right to object to research use. Safeguards earn the top of the no-opt-out band.", "sources": [ { "title": "Public Health Act, 11 of 2013 (Botswana Laws)", "url": "https://botswanalaws.com/StatutesActpdf/2013Actpdf/PUBLIC%20HEALTH%20ACT,%2011%20OF%202013.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Data Protection Bill, 2024 (Bill No. 19 of 2024), enacted as Data Protection Act 18 of 2024", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf", "date": "2024-07-26", "publisherClass": "legal_text" } ] }, "ai": { "score": 40, "summary": "BoMRA's draft 2026 medical device regulations set rules for AI and machine learning devices, including bias checks and change control plans, but they are still in draft. No AI law exists, and the national AI policy is unfinished.", "sources": [ { "title": "Medical Devices including IVDs Regulations, 2026 (draft, BoMRA)", "url": "https://www.bomra.co.bw/wp-content/uploads/wpfd/134/6a96bc92deacd.pdf", "date": "undated", "publisherClass": "official" }, { "title": "BoMRA ushers in new era of safer medical products with landmark regulatory reform", "url": "https://www.bomra.co.bw/bomra-ushers-in-new-era-of-safer-medical-products-with-landmark-regulatory-reform/", "date": "2026-08-31", "publisherClass": "official" }, { "title": "BoMRA Medical Devices including IVDs Regulatory Update", "url": "https://www.bomra.co.bw/bomra-medical-devices-including-ivds-regulatory-update/", "date": "undated", "publisherClass": "official" }, { "title": "The AI question Botswana cannot avoid (The Probe Journal)", "url": "https://theprobe.co.bw/the-ai-question-botswana-cannot-avoid/", "date": "2026-08-26", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act 18 of 2024", "level": "National", "year": "2024", "what": "Health is sensitive data; access, objection and portability rights; 72-hour breach notice; fines up to P50 million.", "url": "https://www.dataguidance.com/sites/default/files/data_protection_bill_2024.pdf" }, { "name": "Public Health Act 11 of 2013", "level": "National", "year": "2013", "what": "Permanent health records, user access, record protection offences, research use with user and ethics authorisation.", "url": "https://botswanalaws.com/StatutesActpdf/2013Actpdf/PUBLIC%20HEALTH%20ACT,%2011%20OF%202013.pdf" }, { "name": "Medicines and Related Substances Act 29 of 2025", "level": "National", "year": "2025", "what": "Continues BoMRA and widens regulation of medical devices and diagnostics; device regulations still in draft.", "url": "https://botswanalaws.com/bulletin/principal-legislation/bulletin-2025/act-29-of-2025---medicines-and-related-substances-act" }, { "name": "Electronic Communications and Transactions Act 14 of 2014", "level": "National", "year": "2014", "what": "Electronic marketing must carry an opt-out; penalties for messages sent after an opt-out.", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=BW" }, { "name": "Access to Information Act 16 of 2024", "level": "National", "year": "2024", "what": "Public right to government information, overseen by the IDPC; commencement on notice; personal data requests go under the DPA.", "url": "https://botswanalaws.com/consolidated-statutes/acts-on-notice/2024/access-to-information-act" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "CHL", "name": "Chile", "region": "Americas", "overall": 39, "rank": "99=", "likelyRank": "75 to 127", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Chilean law gives patients a free, portable copy of their record, but records stay provider by provider and the new data law may slip.", "categories": { "access": { "score": 45, "summary": "Ley 20.584 Article 13 gives patients a free, complete copy of their record in a structured, portable format, but only on request to each provider. The national Portal Paciente shows vaccines, GES guarantees and waiting lists, not the clinical record.", "sources": [ { "title": "Ley 20.584, derechos y deberes de los pacientes, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Decreto 41 de 2012, reglamento sobre fichas clinicas (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1046753", "date": "2012-12-15", "publisherClass": "legal_text" }, { "title": "Portal Paciente, Ministerio de Salud", "url": "https://portalpaciente.minsal.cl/", "date": "undated", "publisherClass": "official" }, { "title": "Avances y desafios de la Receta Electronica del Minsal (Ehealth Reporter)", "url": "https://ehealthreporter.com/avances-y-desafios-de-la-receta-electronica-del-minsal/", "date": "2025-12-10", "publisherClass": "news" } ] }, "control": { "score": 35, "summary": "The law bars staff not involved in care from the record and makes providers log who opens it, but patients have no opt-out, consent switch or visible log. Scored at the top of the lowest band because no national sharing system is live.", "sources": [ { "title": "Ley 20.584, derechos y deberes de los pacientes, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Ley 21.668, interoperabilidad de las fichas clinicas (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1203827", "date": "2024-05-28", "publisherClass": "legal_text" }, { "title": "Decreto 41 de 2012, reglamento sobre fichas clinicas (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1046753", "date": "2012-12-15", "publisherClass": "legal_text" }, { "title": "Ley 19.628, proteccion de la vida privada, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=141599", "date": "1999-08-28", "publisherClass": "legal_text" } ] }, "privacy": { "score": 40, "summary": "Health data are sensitive in law, but Chile still runs on its 1999 data law with no regulator, and a September 2026 bill would delay the new law to December 2027. Two major hospital breaches hit in the past year.", "sources": [ { "title": "Ley 19.628, proteccion de la vida privada, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=141599", "date": "1999-08-28", "publisherClass": "legal_text" }, { "title": "Ley 19.628, version que rige desde el 1 de diciembre de 2026 (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=141599&idVersion=2026-12-01", "date": "2024-12-13", "publisherClass": "legal_text" }, { "title": "Prorroga de la Ley de Datos abre un ano clave para que empresas preparen su cumplimiento (Publimetro)", "url": "https://www.publimetro.cl/tecnologia/2026/09/15/prorroga-de-la-ley-de-datos-abre-un-ano-clave-para-que-empresas-preparen-su-cumplimiento/", "date": "2026-09-15", "publisherClass": "news" }, { "title": "SERNAC oficia a Clinica Davila tras incidente de ciberseguridad", "url": "https://www.sernac.cl/portal/604/w3-article-87923.html", "date": "2025-12-24", "publisherClass": "official" } ] }, "journey": { "score": 38, "summary": "Ley 21.668 requires providers to make records interoperable, but the implementing regulation is not in force: Decreto 41 on BCN is unchanged since 2012. MINSAL calls a shared national record a goal for 2030; e-prescriptions reached about 2 million patients by September 2025.", "sources": [ { "title": "Ley 21.668, interoperabilidad de las fichas clinicas (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1203827", "date": "2024-05-28", "publisherClass": "legal_text" }, { "title": "Un portal ciudadano e historia clinica compartida: los siete proyectos de la ministra Chomali (The Clinic)", "url": "https://www.theclinic.cl/2026/09/02/un-portal-ciudadano-e-historia-clinica-compartida-los-siete-proyectos-con-los-que-la-ministra-chomali-busca-modernizar-el-sistema-de-salud-publico/", "date": "2026-09-02", "publisherClass": "news" }, { "title": "Avances y desafios de la Receta Electronica del Minsal (Ehealth Reporter)", "url": "https://ehealthreporter.com/avances-y-desafios-de-la-receta-electronica-del-minsal/", "date": "2025-12-10", "publisherClass": "news" }, { "title": "Los cambios digitales que prepara el Minsal para la atencion primaria (Meganoticias)", "url": "https://www.meganoticias.cl/nacional/532436-filas-consultorio-5-de-la-manana-cambios-digitales-minsal-atencion-primaria.html", "date": "2026-09-24", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "Current law allows sensitive data to be processed only with consent, a legal basis or for health benefits, and blocks commercial use on request. The stronger ban on health data gathered by insurers, employers and others waits for Ley 21.719.", "sources": [ { "title": "Ley 19.628, proteccion de la vida privada, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=141599", "date": "1999-08-28", "publisherClass": "legal_text" }, { "title": "Ley 20.584, derechos y deberes de los pacientes, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Ley 21.719, proteccion y tratamiento de datos personales (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1209272", "date": "2024-12-13", "publisherClass": "legal_text" }, { "title": "SERNAC oficia a Clinica Davila tras incidente de ciberseguridad", "url": "https://www.sernac.cl/portal/604/w3-article-87923.html", "date": "2025-12-24", "publisherClass": "official" } ] }, "clinical": { "score": 35, "summary": "Ley 21.668 gives treating professionals a legal right to the data essential for continuity of care, but no national exchange delivers it yet. Clinicians mostly see only their own provider's record.", "sources": [ { "title": "Ley 20.584, derechos y deberes de los pacientes, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Ley 21.668, interoperabilidad de las fichas clinicas (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1203827", "date": "2024-05-28", "publisherClass": "legal_text" }, { "title": "Minsal fija hoja de ruta 2026-2030 con foco en acceso y digitalizacion (El Periodista)", "url": "https://www.elperiodista.cl/2026/07/minsal-fija-hoja-de-ruta-2026-2030-con-foco-en-acceso-digitalizacion-y-fortalecimiento-de-red-publica/", "date": "2026-07-29", "publisherClass": "news" }, { "title": "Los cambios digitales que prepara el Minsal para la atencion primaria (Meganoticias)", "url": "https://www.meganoticias.cl/nacional/532436-filas-consultorio-5-de-la-manana-cambios-digitales-minsal-atencion-primaria.html", "date": "2026-09-24", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Research on people needs prior, written, informed consent and approval by an accredited ethics committee under Ley 20.120. Ley 21.719 will allow public-interest research on health data without consent, and record-based research rules today were not verified.", "sources": [ { "title": "Ley 20.120, investigacion cientifica en el ser humano (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=253478", "date": "2006-09-22", "publisherClass": "legal_text" }, { "title": "Decreto 114 de 2011, reglamento de la Ley 20.120 (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1032919", "date": "2011-11-19", "publisherClass": "legal_text" }, { "title": "Ley 20.584, derechos y deberes de los pacientes, texto vigente (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Ley 21.719, proteccion y tratamiento de datos personales (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1209272", "date": "2024-12-13", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Chile has no rules specific to clinical AI. A March 2026 decree brings oncology imaging software under device registration, with re-registration for major changes and a phase-in of up to 36 months, while the AI bill is still in the Senate.", "sources": [ { "title": "ISP informa sobre nueva normativa que regula 39 dispositivos medicos (Instituto de Salud Publica)", "url": "https://www.ispch.gob.cl/noticia/isp-informa-sobre-nueva-normativa-que-regula-39-dispositivos-medicos-incluidos-dispositivos-medicos-de-diagnostico-in-vitro/", "date": "2026-03-20", "publisherClass": "official" }, { "title": "MINSAL incorpora nuevos dispositivos medicos al regimen de control sanitario (Carey)", "url": "https://www.carey.cl/minsal-incorpora-nuevos-dispositivos-medicos-al-regimen-de-control-sanitario", "date": "2026-03-20", "publisherClass": "law_firm" }, { "title": "Inteligencia Artificial: especialistas debaten sobre nueva legislacion (Senado de Chile)", "url": "https://www.senado.cl/comunicaciones/noticias/inteligencia-artificial-especialistas-de-la-industria-la-academia-y-sector", "date": "2026-04-24", "publisherClass": "official" }, { "title": "Ley 21.719, proteccion y tratamiento de datos personales (BCN Ley Chile)", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1209272", "date": "2024-12-13", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Ley 20.584 (derechos y deberes de los pacientes)", "level": "National", "year": "2012", "what": "Confidential record kept 15 years; free, structured, portable copy for the patient on request.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1039348" }, { "name": "Ley 21.668 (interoperabilidad de las fichas clinicas)", "level": "National", "year": "2024", "what": "Makes providers responsible for record interoperability; treating professionals get essential data for continuity.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1203827" }, { "name": "Ley 19.628 (proteccion de la vida privada)", "level": "National", "year": "1999", "what": "Current data law; sensitive data need consent or a legal basis; enforced through the courts.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=141599" }, { "name": "Ley 21.719 (proteccion de datos personales)", "level": "National", "year": "2024", "what": "New data law, agency, breach reporting, fines to 20,000 UTM; due 1 December 2026, delay proposed.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1209272" }, { "name": "Decreto 41 de 2012 (reglamento sobre fichas clinicas)", "level": "National", "year": "2012", "what": "Record content and storage rules; providers must log who accessed each record.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=1046753" }, { "name": "Ley 20.120 (investigacion cientifica en el ser humano)", "level": "National", "year": "2006", "what": "Written informed consent and ethics committee approval for research on people.", "url": "https://www.bcn.cl/leychile/navegar?idNorma=253478" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-04-23", "headline": "Court orders clinic to give a deceased patient's record to his children", "paraphrase": "A clinic refused to give a deceased patient's record to some of his children, saying all heirs had to ask together. The appeals court called the refusal illegal and arbitrary and ordered a full copy delivered within three working days.", "source": "Poder Judicial de Chile, Corte de Apelaciones de Santiago (rol 24.909-2025)", "url": "https://www.pjud.cl/prensa-y-comunicaciones/noticias-del-poder-judicial/144388", "theme": "access_refused", "status": "finding" }, { "date": "2026-05-07", "headline": "Lookup website showed patients' diagnoses to anyone who typed in their ID number", "paraphrase": "For about 48 hours, a people-search website let anyone enter a Chilean ID number and see that person's diagnoses under the national guaranteed-care scheme, alongside address and contact details. Police and the cybersecurity agency are investigating.", "source": "BioBioChile (BBCL Investiga)", "url": "https://www.biobiochile.cl/especial/bbcl-investiga/noticias/articulos/2026/05/07/desentranando-rutify-la-plataforma-hacker-que-expuso-datos-medicos-y-hoy-es-investigada-por-la-pdi.shtml", "theme": "breach", "status": "alleged" }, { "date": "2025-12-24", "headline": "Consumer agency demands answers after 250 GB of patient records stolen from private clinic", "paraphrase": "A ransomware group reportedly took about 250 GB from a private clinic, including clinical records, test results and identity card copies. Chile's consumer agency ordered the clinic to report how many patients were affected and how they were told.", "source": "BioBioChile", "url": "https://www.biobiochile.cl/noticias/economia/negocios-y-empresas/2025/12/24/fichas-clinicas-y-hasta-resultados-de-vih-sernac-oficia-a-clinica-davila-tras-robo-con-ciberataque.shtml", "theme": "breach", "status": "alleged" }, { "date": "2025-08-19", "headline": "Cyberattack on national public health lab doubled waits for patients' confirmatory test results", "paraphrase": "After a cyberattack slowed the national public health institute's systems, confirmatory results for patients in at least seven hospitals took about 30 days instead of 12 to 15. The institute blamed a switch to a manual system.", "source": "CIPER Chile", "url": "https://www.ciperchile.cl/2025/08/19/hospitales-fueron-afectados-por-retrasos-en-entrega-de-resultados-vih-y-hepatitis-tras-el-ciberataque-al-instituto-de-salud-publica/", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "PHL", "name": "Philippines", "region": "Asia", "overall": 39, "rank": "99=", "likelyRank": "77 to 130", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Filipino patients have strong privacy rights on paper, but records stay hospital by hospital and a shared exchange is still a pilot.", "categories": { "access": { "score": 40, "summary": "The Data Privacy Act gives a right of access and a structured electronic copy, but no fixed deadline is in force and one city hospital's rules release only parts of the record. Base 45, +5 structured copy, -5 no fixed deadline, -5 limited scope = 40.", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "NPC Draft Circular on Data Subject Rights (for public consultation)", "url": "https://privacy.gov.ph/wp-content/uploads/2026/09/For-Publication-DPCJ-18Sep2026-Draft-Circular-Data-Subjects-Rights.pdf", "date": "2026-09-18", "publisherClass": "official" }, { "title": "Patients Rights and Safety: The right to the medical record (J.R. Borja General Hospital, Cagayan de Oro)", "url": "https://jrbgh.cagayandeoro.gov.ph/index.php/patients-visitors/patients-safety", "date": "undated", "publisherClass": "official" }, { "title": "Patient's Rights (Adela Serra Ty Memorial Medical Center, DOH)", "url": "https://astmmc.doh.gov.ph/patients-rights/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 40, "summary": "By law a patient can ask any provider who received their data and when it was last accessed (RA 10173 Section 16(c)), but only on request; practice was not verified. UHC Act Section 31 makes every provider send health data to PhilHealth, with no consent step.", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "DOH Administrative Order No. 2020-0030: Data Privacy Guidelines on the Processing of Health Information (UP Law copy)", "url": "https://law.upd.edu.ph/wp-content/uploads/2020/07/DOH-AO-No-2020-0030.pdf", "date": "2020-07-09", "publisherClass": "legal_text" }, { "title": "Republic Act No. 11223, Universal Health Care Act (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2019/ra_11223_2019.html", "date": "2019", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "The law is strict, with an independent regulator, 72-hour breach notice and up to 6 years in prison for misusing health data. But the 2023 PhilHealth breach exposed records of 42 million people, and in September 2026 a GenSan hospital reportedly admitted a ransomware breach (not verified).", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "Breach Reporting (National Privacy Commission)", "url": "https://privacy.gov.ph/pips-and-pics/breach-reporting/", "date": "undated", "publisherClass": "official" }, { "title": "2023 PhilHealth data breach affected 42M individuals, NPC (GMA News)", "url": "https://www.gmanetwork.com/news/topstories/nation/912661/2023-philhealth-data-breach-affected-42m-individuals-official/story/", "date": "2024-07-08", "publisherClass": "news" }, { "title": "GenSan hospital admits 'data breach' after ransomware group's claims (MindaNews)", "url": "https://mindanews.com/top-stories/2026/09/gensan-hospital-admits-data-breach-after-ransomware-groups-claims/", "date": "2026-09-25", "publisherClass": "news" } ] }, "journey": { "score": 32, "summary": "Claims and primary care data flow to PhilHealth: eClaims 3.0 became mandatory on 1 July 2026 and YAKAP clinics must use certified EMRs. A provider-to-provider exchange exists only as a pilot, with a first eReferral prototype due in January 2027.", "sources": [ { "title": "Republic Act No. 11223, Universal Health Care Act (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2019/ra_11223_2019.html", "date": "2019", "publisherClass": "legal_text" }, { "title": "PhilHealth Advisory No. 2026-0040: Final deadline to migrate to eClaims 3.0", "url": "https://www.philhealth.gov.ph/advisories/2026/PA2026-0040.pdf", "date": "2026-07-01", "publisherClass": "official" }, { "title": "PhilHealth Advisory No. 2026-0038: YAKAP digitalization requirements", "url": "https://www.philhealth.gov.ph/advisories/2026/PA2026-0038.pdf", "date": "2026-06-30", "publisherClass": "official" }, { "title": "Philippine EMR systems achieve live health data exchange at June 2026 FHIR Connectathon in Aklan (UP Manila)", "url": "https://www.upm.edu.ph/cpt_news/philippine-emr-systems-achieve-live-health-data-exchange-at-june-2026-fhir-connectathon-in-aklan/", "date": "2026-07-03", "publisherClass": "academic" } ] }, "commercial": { "score": 45, "summary": "Health data cannot be processed on legitimate interest, so marketing with it needs specific consent, and disclosing it without consent carries 3 to 5 years in prison. There is no rule on de-identified data sales or data brokers.", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "NPC Circular No. 2023-04: Guidelines on Consent", "url": "https://privacy.gov.ph/wp-content/uploads/2023/11/NPC-Circular-No.-2023-04_Guidelines-on-Consent_07Nov2023.pdf", "date": "2023-11-07", "publisherClass": "official" } ] }, "clinical": { "score": 27, "summary": "A treating doctor can use records without separate consent, but only those held in their own facility. No cross-provider clinical view was verified, and the first eReferral prototype starts in one Aklan town in January 2027.", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "DOH Administrative Order No. 2020-0030: Data Privacy Guidelines on the Processing of Health Information (UP Law copy)", "url": "https://law.upd.edu.ph/wp-content/uploads/2020/07/DOH-AO-No-2020-0030.pdf", "date": "2020-07-09", "publisherClass": "legal_text" }, { "title": "Philippine EMR systems achieve live health data exchange at June 2026 FHIR Connectathon in Aklan (UP Manila)", "url": "https://www.upm.edu.ph/cpt_news/philippine-emr-systems-achieve-live-health-data-exchange-at-june-2026-fhir-connectathon-in-aklan/", "date": "2026-07-03", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "Research data falls largely outside the Data Privacy Act with no opt-out, though it must be held under strict confidentiality and a statutory ethics board oversees 114 accredited ethics committees. Base 40, +3 ethics body, +3 statutory confidentiality = 46.", "sources": [ { "title": "Republic Act No. 10173, Data Privacy Act of 2012 (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html", "date": "2012", "publisherClass": "legal_text" }, { "title": "Republic Act No. 10532, Philippine National Health Research System Act of 2013 (Supreme Court E-Library)", "url": "https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/2/55630", "date": "2013-05-07", "publisherClass": "legal_text" }, { "title": "PHREB Accredited RECs (Philippine Health Research Ethics Board)", "url": "https://ethics-accreditation.healthresearch.ph/accredited-rec/0/0", "date": "undated", "publisherClass": "official" }, { "title": "Republic Act No. 11223, Universal Health Care Act (Lawphil)", "url": "https://lawphil.net/statutes/repacts/ra2019/ra_11223_2019.html", "date": "2019", "publisherClass": "legal_text" } ] }, "ai": { "score": 42, "summary": "Medical software falls under the FDA's 2018 device rules, but the rules written for AI software are still a draft, revised for consultation in August 2026. The privacy regulator's 2024 AI advisory requires human intervention in automated decisions.", "sources": [ { "title": "Draft for Comments: Guidelines on the Regulation of Medical Device Software (FDA Philippines)", "url": "https://www.fda.gov.ph/draft-for-comments-guidelines-on-the-regulation-of-medical-device-software-mdsw-by-the-food-and-drug-administration-fda/", "date": "2025-05-21", "publisherClass": "official" }, { "title": "Philippines new medical device software regulation draft (Asia Actual, updated after the August 2026 consultation)", "url": "https://asiaactual.com/blog/philippines-medical-device-software-regulation/", "date": "2025-05-23", "publisherClass": "blog_vendor" }, { "title": "NPC Advisory No. 2024-04: Guidelines on the application of the DPA to artificial intelligence systems processing personal data", "url": "https://privacy.gov.ph/wp-content/uploads/2025/02/Advisory-2024.12.19-Guidelines-on-Artificial-Intelligence-w-SGD.pdf", "date": "2024-12-19", "publisherClass": "official" } ] } }, "laws": [ { "name": "Data Privacy Act of 2012 (RA 10173)", "level": "National", "year": "2012", "what": "Health is sensitive data; access and portability rights; independent NPC; prison terms for misuse.", "url": "https://lawphil.net/statutes/repacts/ra2012/ra_10173_2012.html" }, { "name": "Universal Health Care Act (RA 11223)", "level": "National", "year": "2019", "what": "Mandates EHRs and e-prescription logs; all health entities must submit data to PhilHealth.", "url": "https://lawphil.net/statutes/repacts/ra2019/ra_11223_2019.html" }, { "name": "E-Governance Act (RA 12254)", "level": "National", "year": "2025", "what": "Orders a national, interoperable Philippine Digital Health System as part of government digitization.", "url": "https://lawphil.net/statutes/repacts/ra2025/ra_12254_2025.html" }, { "name": "Philippine National Health Research System Act (RA 10532)", "level": "National", "year": "2013", "what": "Gives the health research ethics board power over ethics guidelines and committees.", "url": "https://elibrary.judiciary.gov.ph/thebookshelf/showdocs/2/55630" }, { "name": "DOH Administrative Order 2020-0030", "level": "National", "year": "2020", "what": "Health data privacy rules: admission consent form, provider-only access, outbreak access for DOH.", "url": "https://law.upd.edu.ph/wp-content/uploads/2020/07/DOH-AO-No-2020-0030.pdf" }, { "name": "NPC Circular 2023-04 on Consent", "level": "National", "year": "2023", "what": "Unbundled, withdrawable consent; consent needed for high-impact direct marketing.", "url": "https://privacy.gov.ph/wp-content/uploads/2023/11/NPC-Circular-No.-2023-04_Guidelines-on-Consent_07Nov2023.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-09-12", "headline": "Ransomware group claims it stole millions of files from a private hospital", "paraphrase": "A ransomware group said it took about 2.44 terabytes of hospital data, including patient records and scans, and demanded payment. The hospital in Mindanao said its first checks found no sign of a breach and it was still investigating.", "source": "The Mindanao Sentinel", "url": "https://themindanaosentinel.com/2026/09/rhysida-claims-2-44-tb-data-theft-from-general-santos-doctors-hospital-gsdh-says-no-breach-confirmed/", "theme": "breach", "status": "alleged" }, { "date": "2025-12-09", "headline": "Insurer finds about 1,000 paid claims for patients who were never treated", "paraphrase": "The national health insurer said it was investigating about 1,000 suspected ghost patient claims in the Cordillera region, where members were recorded as treated when they were not. Members spotted them after receiving text alerts.", "source": "Philstar.com", "url": "https://www.philstar.com/nation/2025/12/09/2492899/philhealth-probes-ghost-patients-car", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "UGA", "name": "Uganda", "region": "Africa", "overall": 39, "rank": "99=", "likelyRank": "80 to 134", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "A 2019 data law bans selling personal data, but records stay locked in each hospital and the Ministry, not the patient, owns them.", "categories": { "access": { "score": 45, "summary": "The 2019 Act lets a patient confirm what a provider holds, get a description and learn who received it, within 30 days and with no listed fee. The right to a full copy rests on a 2009 Ministry charter, and there is no national portal.", "sources": [ { "title": "Data Protection and Privacy Act, 2019 (Act 9 of 2019), signed text", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Data Protection and Privacy Regulations, 2021 (S.I. No. 21 of 2021)", "url": "https://pmlawhub.com/wp-content/uploads/2025/12/Data-Protection-and-Privacy-Regulations-SI-No-21-of-2021-Uganda-1.pdf", "date": "2021-03-12", "publisherClass": "legal_text" }, { "title": "Ministry of Health, Patients' Charter", "url": "https://cphl.go.ug/uploads/library/1782711708338-1c560da2c811.pdf", "date": "2009-10", "publisherClass": "official" }, { "title": "Electronic Medical Records Rollout Transforms Patient Care and Data Management (Ministry of Health)", "url": "https://health.go.ug/electronic-medical-records-rollout-transforms-patient-care-and-data-management", "date": "2025-06-13", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "The 2019 Act requires consent but lets providers process data for medical purposes without it, and the right to object does not cover those cases. A 2025 health deal gives the US government logins to nine national health systems for seven years.", "sources": [ { "title": "Data Protection and Privacy Act, 2019 (Act 9 of 2019), signed text", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ministry of Health, Patients' Charter", "url": "https://cphl.go.ug/uploads/library/1782711708338-1c560da2c811.pdf", "date": "2009-10", "publisherClass": "official" }, { "title": "U.S. demands to access Africans' data raise privacy, sovereignty concerns (ProPublica)", "url": "https://www.propublica.org/article/trump-state-department-africa-uganda-aid-medical-data-privacy", "date": "2026-06-17", "publisherClass": "news" } ] }, "privacy": { "score": 48, "summary": "Health status and medical records are special data under the 2019 Act, selling personal data is a crime, and breaches must be reported to the regulator immediately. In April 2026 the Ministry ordered all hospitals to appoint data protection officers, a sign compliance lagged.", "sources": [ { "title": "Data Protection and Privacy Act, 2019 (Act 9 of 2019), signed text", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ugandan Regulator Finds Google in Breach of Country's Data Protection Law (CIPESA)", "url": "https://cipesa.org/2025/07/ugandan-regulator-finds-google-in-breach-of-countrys-data-protection-law-orders-local-registration/", "date": "2025-07-21", "publisherClass": "blog_vendor" }, { "title": "Uganda: Health Facilities Ordered to Comply with Data Protection Law (Africa Data Protection)", "url": "https://www.africadataprotection.org/en/actualites/Uganda-Health-Facilities-Ordered-to-Comply-with-Data-Protection-Law.html", "date": "2026-04-28", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 35, "summary": "The Ministry reports EMRs in 92 percent of targeted hospitals, but the targets are referral and general hospitals plus only seven lower-level health centres. Records stay inside each hospital, with no universal health ID or cross-provider exchange.", "sources": [ { "title": "Electronic Medical Records Rollout Transforms Patient Care and Data Management (Ministry of Health)", "url": "https://health.go.ug/electronic-medical-records-rollout-transforms-patient-care-and-data-management", "date": "2025-06-13", "publisherClass": "official" }, { "title": "Reforming Uganda's digital health data systems: a policy analysis (Digital Health, via PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12816509/", "date": "2026-01-19", "publisherClass": "academic" }, { "title": "United States Government Transfers Over $100 Million in National Digital Health Infrastructure to Uganda (U.S. Embassy Uganda)", "url": "https://ug.usembassy.gov/press-release-united-states-government-transfers-over-100-million-in-national-digital-health-infrastructure-to-uganda/", "date": "2026-03-31", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Section 37 of the 2019 Act makes selling or offering to sell anyone's personal data a crime punishable by up to ten years in prison. People can stop direct marketing, but may also agree to let a company use their data for payment.", "sources": [ { "title": "Data Protection and Privacy Act, 2019 (Act 9 of 2019), signed text", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "U.S. demands to access Africans' data raise privacy, sovereignty concerns (ProPublica)", "url": "https://www.propublica.org/article/trump-state-department-africa-uganda-aid-medical-data-privacy", "date": "2026-06-17", "publisherClass": "news" } ] }, "clinical": { "score": 25, "summary": "A treating clinician sees only the record held by their own facility. Jinja Regional Referral Hospital said in June 2026 that EMR data is restricted to the hospital and referrals to Mulago are still handled on paper.", "sources": [ { "title": "Jinja Hospital rolls out electronic medical records to end paper queues (Monitor)", "url": "https://www.monitor.co.ug/uganda/news/national/jinja-hospital-rolls-out-electronic-medical-records-to-end-paper-queues-5491432", "date": "2026-06-10", "publisherClass": "news" }, { "title": "Ministry of Health, Patients' Charter", "url": "https://cphl.go.ug/uploads/library/1782711708338-1c560da2c811.pdf", "date": "2009-10", "publisherClass": "official" }, { "title": "Electronic Medical Records Rollout Transforms Patient Care and Data Management (Ministry of Health)", "url": "https://health.go.ug/electronic-medical-records-rollout-transforms-patient-care-and-data-management", "date": "2025-06-13", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Researchers using routine patient records ask an ethics committee for a waiver of consent, and there is no general opt-out. The 2025 national guidelines require ethics review and UNCST registration, and misuse of personal data is a crime under the 2019 Act.", "sources": [ { "title": "National Guidelines for Research Involving Humans as Research Participants (UNCST)", "url": "https://www.uncst.go.ug/files/downloads/NATIONAL%20GUIDELINES%20FOR%20RESEARCH%20INVOLVING%20HUMANS%20AS%20RESEARCH%20PARTICPANTS%202025.pdf", "date": "2025-09", "publisherClass": "official" }, { "title": "Data Protection and Privacy Act, 2019 (Act 9 of 2019), signed text", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf", "date": "2019-02-25", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "Uganda has no AI law and no verified rule for clinical AI, and UNESCO noted in 2026 the absence of binding ways to monitor AI harm in health. The Health Minister said in September 2026 the government plans to bring AI into care.", "sources": [ { "title": "Uganda Convenes National Stakeholders Dialogue to Strengthen Ethical AI Governance (UNESCO)", "url": "https://www.unesco.org/en/articles/uganda-convenes-national-stakeholders-dialogue-strengthen-ethical-ai-governance", "date": "2026-06", "publisherClass": "intergov" }, { "title": "Regulation of artificial intelligence in Uganda's healthcare (Int J Equity Health, via PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12125812/", "date": "2025-05-30", "publisherClass": "academic" }, { "title": "Uganda moves to regulate digital health, protect patient data (Monitor)", "url": "https://www.monitor.co.ug/uganda/news/national/uganda-moves-to-regulate-digital-health-protect-patient-data-5143412", "date": "2025-08-04", "publisherClass": "news" }, { "title": "Govt plans to integrate AI into healthcare, Baryomunsi says (Monitor)", "url": "https://www.monitor.co.ug/uganda/news/national/govt-plans-to-integrate-ai-into-healthcare-baryomunsi-says-5580078", "date": "2026-09-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection and Privacy Act, 2019", "level": "National", "year": "2019", "what": "Health is special data; access within 30 days; immediate breach notice; sale of personal data is a crime.", "url": "https://ict.go.ug/site/documents/Data-Protection-and-Privacy-Act-2019.pdf" }, { "name": "Data Protection and Privacy Regulations, 2021", "level": "National", "year": "2021", "what": "Seven-day decision on access requests, breach notice forms, registration of controllers and fees.", "url": "https://pmlawhub.com/wp-content/uploads/2025/12/Data-Protection-and-Privacy-Regulations-SI-No-21-of-2021-Uganda-1.pdf" }, { "name": "Patients' Charter (Ministry of Health)", "level": "National", "year": "2009", "what": "Policy: right to a copy of medical records; disclosure only with consent; Ministry owns records.", "url": "https://cphl.go.ug/uploads/library/1782711708338-1c560da2c811.pdf" }, { "name": "National Guidelines for Research Involving Humans as Research Participants", "level": "National", "year": "2025", "what": "Ethics review and UNCST registration; consent waivers for record studies; in-country data storage.", "url": "https://www.uncst.go.ug/files/downloads/NATIONAL%20GUIDELINES%20FOR%20RESEARCH%20INVOLVING%20HUMANS%20AS%20RESEARCH%20PARTICPANTS%202025.pdf" }, { "name": "National Drug Policy and Authority Act", "level": "National", "year": "not verified", "what": "Creates the National Drug Authority, which licenses and registers medical devices.", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12125812/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-25", "headline": "High Court orders charity clinic to pay damages over wrong test result on file", "paraphrase": "A clinic registered a man with a positive test result his later tests did not support, and kept acting on it for years. The error surfaced when he applied for a benefit. The High Court found negligence and awarded damages.", "source": "Daily Express (Uganda)", "url": "https://dailyexpress.co.ug/2026/02/25/court-orders-taso-to-pay-shs190m-to-man-wrongly-put-on-arvs/", "theme": "record_wrong", "status": "finding" }, { "date": "2026-08-05", "headline": "Journalist says hospital gave his test results to security officers, not to him", "paraphrase": "A man brought to a hospital under guard says staff passed his blood test results to the officers holding him and never gave or explained them to him. He says the hospital recorded him under another name and will sue.", "source": "The Investigator News", "url": "https://theinvestigatornews.com/2026/08/i-was-kidnapped-and-operated-on-journalist-gideon-tugume-files-suit-over-alleged-torture-and-illegal-detention-accuses-kisubi-hospital-of-giving-his-hiv-results-to-updf-without-consent/", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "BGD", "name": "Bangladesh", "region": "Asia", "overall": 38, "rank": "104=", "likelyRank": "82 to 141", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Bangladesh's new data law treats health data as sensitive, but penalties are not yet in force and the national record exchange's reach is unverified.", "categories": { "access": { "score": 35, "summary": "The Personal Data Protection Act, 2026 gives a right to a copy of personal data, including who it was shared with. Deadlines are left to future regulations, complaints and fines are not yet in force, and no national patient portal exists.", "sources": [ { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "Personal Health Profile (SHR, DGHS)", "url": "https://en.info.shr.dghs.gov.bd/phr/", "date": "undated", "publisherClass": "official" }, { "title": "All citizens to get e-health cards by 2028: Health Minister (TBS Bangla)", "url": "https://www.tbsnews.net/bangla/bangladesh/news-details-500816", "date": "2026-06-10", "publisherClass": "news" } ] }, "control": { "score": 42, "summary": "Health data needs specific consent, consent can be withdrawn, and the national exchange retrieves past records only with the patient's explicit consent. But treatment, public health and state purposes are exempt, and the redress sections are not yet in force.", "sources": [ { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "Unique Health ID and Master Client Index (SHR, DGHS)", "url": "http://en.info.shr.dghs.gov.bd/uhidmci/", "date": "undated", "publisherClass": "official" }, { "title": "National Data Management Act, 2026 (Act No. 80 of 2026), Laws of Bangladesh", "url": "https://bdlaws.minlaw.gov.bd/act-details-1709.html", "date": "2026-04-10", "publisherClass": "legal_text" } ] }, "privacy": { "score": 42, "summary": "The 2026 Act lists health data as sensitive and caps fines at Tk 25 lakh (Tk 50 lakh for significant fiduciaries). The fine sections are not yet in force, breach notice goes only to the regulator, and the regulator answers to the Prime Minister's Office.", "sources": [ { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "National Data Management Act, 2026 (Act No. 80 of 2026), Laws of Bangladesh", "url": "https://bdlaws.minlaw.gov.bd/act-details-1709.html", "date": "2026-04-10", "publisherClass": "legal_text" } ] }, "journey": { "score": 33, "summary": "DGHS runs a Shareable Health Record exchange with a Health ID issued since 2023, linking public hospital systems and community health worker tools. How many people and records it covers could not be verified, and private providers use their own systems.", "sources": [ { "title": "Shareable Health Record (SHR) System Bangladesh (MIS, DGHS)", "url": "http://en.info.shr.dghs.gov.bd/", "date": "undated", "publisherClass": "official" }, { "title": "Hospital Management System (SHR, DGHS)", "url": "http://en.info.shr.dghs.gov.bd/hms/", "date": "undated", "publisherClass": "official" }, { "title": "Unique Health ID and Master Client Index (SHR, DGHS)", "url": "http://en.info.shr.dghs.gov.bd/uhidmci/", "date": "undated", "publisherClass": "official" }, { "title": "Govt to launch pilot 'e-Health Card' programme in five districts: PM (The Financial Express / BSS)", "url": "https://thefinancialexpress.com.bd/home/govt-to-launch-pilot-e-health-card-programme-in-five-districts-pm", "date": "2026-06-10", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "Personal data may not be disclosed for a new purpose without consent, and health data needs specific consent. There is no health-specific ban on selling health data or using it for advertising, and the fine sections are not yet in force.", "sources": [ { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" } ] }, "clinical": { "score": 28, "summary": "A clinician at a facility running a connected hospital system can pull a patient's earlier records through the Health ID with the patient's consent. Coverage was not verified, and the plan to let any doctor see a patient's history is still a 2026 to 2028 card project.", "sources": [ { "title": "Unique Health ID and Master Client Index (SHR, DGHS)", "url": "http://en.info.shr.dghs.gov.bd/uhidmci/", "date": "undated", "publisherClass": "official" }, { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "'National Health Card' coming to reduce health care inequality: ICT Minister (Sarabangla)", "url": "https://sarabangla.net/health/post-1182928/", "date": "2026-07-22", "publisherClass": "news" }, { "title": "e-Health cards for all soon (The Business Standard)", "url": "https://www.tbsnews.net/bangladesh/e-health-cards-all-soon-1377106", "date": "2026-03-04", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "The 2026 Act lets data be used for statistics and scientific research without consent, with no opt-out. A national ethics committee run by BMRC since 1979 reviews studies and requires signed consent where privacy is at risk, and device and drug trials need regulator approval.", "sources": [ { "title": "Personal Data Protection Act, 2026 (Act No. 63 of 2026), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "BMRC National Research Ethics Committee Standard Operating Procedures", "url": "https://www.bmrcbd.org/application_form/SOPs.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Drug and Cosmetics Act, 2023 (Act No. 29 of 2023), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1447.html", "date": "2023-09-18", "publisherClass": "legal_text" } ] }, "ai": { "score": 50, "summary": "DGDA approved a 2026 guideline on AI and medical robotics with risk classes A to D, mandatory human oversight for moderate and high risk, and algorithm change control. It calls itself a foundation for future rules, so its binding force is not verified.", "sources": [ { "title": "DGDA notice: Guideline on the Regulation of Artificial Intelligence and Medical Robotics in Healthcare approved", "url": "http://dgda.gov.bd/pages/notices/guideline-on-the-regulation-of-artificial-intelligence-and-medical-robotics-in-healthcare-bangladesh-%E0%A6%B6%E0%A6%BF%E0%A6%B0%E0%A7%8B%E0%A6%A8%E0%A6%BE%E0%A6%AE%E0%A7%87-%E0%A6%97%E0%A6%BE%E0%A6%87%E0%A6%A1%E0%A6%B2%E0%A6%BE%E0%A6%87%E0%A6%A8%E0%A6%9F%E0%A6%BF-%E0%A6%AF%E0%A6%A5%E0%A6%BE%E0%A6%AF%E0%A6%A5-%E0%A6%95%E0%A6%B0%E0%A7%8D%E0%A6%A4%E0%A7%83%E0%A6%AA%E0%A6%95%E0%A7%8D%E0%A6%B7-%E0%A6%95%E0%A6%B0%E0%A7%8D%E0%A6%A4%E0%A7%83%E0%A6%95-%E0%A6%85%E0%A6%A8%E0%A7%81%E0%A6%AE%E0%A7%8B%E0%A6%A6%E0%A6%BF%E0%A6%A4-%E0%A6%B9%E0%A7%9F%E0%A7%87%E0%A6%9B%E0%A7%87-aw0h6i-69e840d771e38d494d606d70", "date": "2026-04-22", "publisherClass": "official" }, { "title": "Guideline on the Regulation of Artificial Intelligence and Medical Robotics in Healthcare, Bangladesh, Version 1.0 (DGDA)", "url": "https://objectstorage.ap-dcc-gazipur-1.oraclecloud15.com/n/axvjbnqprylg/b/V2Ministry/o/office-dgda/2026/3/a13e9fd6-7d72-48e6-810e-40e02ab71ae9.pdf", "date": "2026-01", "publisherClass": "official" }, { "title": "Drug and Cosmetics Act, 2023 (Act No. 29 of 2023), Laws of Bangladesh", "url": "http://bdlaws.minlaw.gov.bd/act-details-1447.html", "date": "2023-09-18", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Personal Data Protection Act, 2026 (Act No. 63)", "level": "National", "year": "2026", "what": "Health data is sensitive; access, withdrawal and erasure rights; fines and complaints start after 18 months.", "url": "http://bdlaws.minlaw.gov.bd/act-details-1692.html" }, { "name": "National Data Management Act, 2026 (Act No. 80)", "level": "National", "year": "2026", "what": "Creates the data authority under the Prime Minister's Office and the NRDEX data exchange platform.", "url": "https://bdlaws.minlaw.gov.bd/act-details-1709.html" }, { "name": "Personal Data Protection Ordinance, 2025 (Ordinance No. 61, repealed)", "level": "National", "year": "2025", "what": "Interim government ordinance, replaced by the 2026 Act passed by parliament.", "url": "http://bdlaws.minlaw.gov.bd/act-1574.html" }, { "name": "Drug and Cosmetics Act, 2023 (Act No. 29)", "level": "National", "year": "2023", "what": "Regulates drugs and medical devices; trials need licensing authority approval.", "url": "http://bdlaws.minlaw.gov.bd/act-details-1447.html" }, { "name": "DGDA Guideline on AI and Medical Robotics in Healthcare", "level": "National", "year": "2026", "what": "Risk classes A to D, human oversight, change control and post-market review for health AI.", "url": "http://dgda.gov.bd/pages/notices/guideline-on-the-regulation-of-artificial-intelligence-and-medical-robotics-in-healthcare-bangladesh-%E0%A6%B6%E0%A6%BF%E0%A6%B0%E0%A7%8B%E0%A6%A8%E0%A6%BE%E0%A6%AE%E0%A7%87-%E0%A6%97%E0%A6%BE%E0%A6%87%E0%A6%A1%E0%A6%B2%E0%A6%BE%E0%A6%87%E0%A6%A8%E0%A6%9F%E0%A6%BF-%E0%A6%AF%E0%A6%A5%E0%A6%BE%E0%A6%AF%E0%A6%A5-%E0%A6%95%E0%A6%B0%E0%A7%8D%E0%A6%A4%E0%A7%83%E0%A6%AA%E0%A6%95%E0%A7%8D%E0%A6%B7-%E0%A6%95%E0%A6%B0%E0%A7%8D%E0%A6%A4%E0%A7%83%E0%A6%95-%E0%A6%85%E0%A6%A8%E0%A7%81%E0%A6%AE%E0%A7%8B%E0%A6%A6%E0%A6%BF%E0%A6%A4-%E0%A6%B9%E0%A7%9F%E0%A7%87%E0%A6%9B%E0%A7%87-aw0h6i-69e840d771e38d494d606d70" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-04-18", "headline": "Diagnostic centre apologises after scan report carried contradictory entries", "paraphrase": "A patient's scan report from a diagnostic centre contained entries that contradicted each other, and a doctor reading it gave alarming advice. A repeat test elsewhere found nothing wrong. The centre apologised in writing.", "source": "Sangbad Sarabela", "url": "https://www.sangbadsarabela.com/country/article/82056", "theme": "record_wrong", "status": "admitted" }, { "date": "2026-07-24", "headline": "Diagnostic centre admits an X-ray report wrongly said normal", "paraphrase": "A patient's X-ray report described the image as normal although a specialist saw clear signs of injury on the film. The diagnostic centre admitted the error, saying it happened while reports were obtained remotely by email.", "source": "Ajker Patrika", "url": "https://www.ajkerpatrika.com/bangladesh/tangail/ajphkxkolghxk", "theme": "record_wrong", "status": "admitted" }, { "date": "2025-09-13", "headline": "Health directorate bans drug company representatives from photographing patients' prescriptions", "paraphrase": "The national health directorate told government hospitals that pharmaceutical sales representatives may no longer photograph prescriptions, patient information or hospital documents, and warned of legal action against anyone who breaks the rule.", "source": "The Business Standard", "url": "https://www.tbsnews.net/bangladesh/health/pharma-reps-allowed-2-days-week-govt-hospitals-no-photographing-prescriptions-dghs", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-06-17", "headline": "Family complains that a clinic's normal scan report missed a serious problem", "paraphrase": "A patient's family filed a complaint that a clinic's scan report said normal, while three later scans at other centres found a serious problem. The clinic stood by its report; the local health officer promised an investigation.", "source": "Daily Naya Diganta", "url": "https://dailynayadiganta.com/bangladesh/country-news/r4vxfqJu6juS", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "CIV", "name": "Côte d'Ivoire", "region": "Africa", "overall": 38, "rank": "104=", "likelyRank": "84 to 140", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Côte d'Ivoire's state patient record now follows millions of people between public facilities, but patients get no portal, opt-out or access log.", "categories": { "access": { "score": 35, "summary": "Law 2019-678 lets a patient obtain the contents of the hospital file through a doctor of their choice, and Law 2013-450 gives a general right to a copy. No deadline is set, summaries can be charged for, and no patient portal shows the record.", "sources": [ { "title": "Loi n° 2019-678 du 23 juillet 2019 portant réforme hospitalière (patrimoine.gouv.ci)", "url": "https://patrimoine.gouv.ci/doc/loi/2019-678%20loi%20r%C3%A9forme%20hospitali%C3%A8re%20(1)%20(1).pdf", "date": "2019-07-23", "publisherClass": "legal_text" }, { "title": "Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (UNODC SHERLOC copy of official text)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf", "date": "2013-06-19", "publisherClass": "legal_text" }, { "title": "Mes droits & devoirs professionnels (Ordre National des Médecins de Côte d'Ivoire)", "url": "https://ordremedecins.ci/mes-droits-devoirs-professionnels/", "date": "undated", "publisherClass": "official" }, { "title": "Numérisation du système de santé, Abidjan devient la capitale africaine de l'innovation médicale (KOACI)", "url": "https://www.koaci.com/article/2026/07/10/cote-divoire/sante/cote-divoire-numerisation-du-systeme-de-sante-abidjan-devient-la-capitale-africaine-de-linnovation-medicale_198464.html", "date": "2026-07-10", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Law 2013-450 requires express prior consent, but public-interest and legal-duty exceptions cover state systems. The state record links each patient by a unique code across connected facilities, and we found no opt-out or patient-visible access log.", "sources": [ { "title": "Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (UNODC SHERLOC copy of official text)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf", "date": "2013-06-19", "publisherClass": "legal_text" }, { "title": "Côte d'Ivoire / Santé : Le dossier patient informatisé interconnecte 258 hôpitaux (Sika Finance)", "url": "https://www.sikafinance.com/marches/cote-divoire-sante-le-dossier-patient-informatise-interconnecte-258-hopitaux_64481", "date": "2026-09-24", "publisherClass": "news" }, { "title": "Présentation du Dossier Patient Informatisé (DPI) (DISD, Ministère de la Santé)", "url": "https://disd.ci/presentation-du-dossier-patient-informatise-dpi/", "date": "2024-08-19", "publisherClass": "official" } ] }, "privacy": { "score": 48, "summary": "We found no health-sector enforcement, so this scores the general law. Law 2013-450 needs ARTCI's prior approval for medical data and sets prison terms, but first-offence administrative fines are capped at 10 million CFA francs and we found no breach notification duty.", "sources": [ { "title": "Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (UNODC SHERLOC copy of official text)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf", "date": "2013-06-19", "publisherClass": "legal_text" }, { "title": "Communiqué relatif au recensement et à l'évaluation de conformité des entités traitant des données à caractère personnel (ARTCI)", "url": "https://www.autoritedeprotection.ci/communique-relatif-au-recensement-et-a-levaluation-de-conformite-des-entites-publiques-et-privees-traitant-des-donnees-a-caractere-personnel/", "date": "2026-03-02", "publisherClass": "official" }, { "title": "Côte d'Ivoire : mises en demeure de l'ARTCI à l'encontre d'applications de prêt en ligne (Africa Data Protection)", "url": "https://blog.africadataprotection.org/blog/2024/01/31/mises-en-demeure-de-lartci-a-lencontre-dapplications-de-pret-en-ligne/", "date": "2024-01-31", "publisherClass": "blog_vendor" }, { "title": "Forum Club Santé 2026 : La DISD fixe le cap de l'Intelligence Artificielle en Côte d'Ivoire (DISD)", "url": "https://disd.ci/forum-club-sante-2026-la-disd-fixe-le-cap-de-lintelligence-artificielle-en-cote-divoire/", "date": "2026-07-02", "publisherClass": "official" } ] }, "journey": { "score": 38, "summary": "A state-run hospital information system and shared patient record are spreading across public facilities, with one patient code nationwide. Official coverage figures conflict (203, 258, 405 or 541 facilities), and private-sector links are still a stated gap.", "sources": [ { "title": "La DISD dévoile l'impact national du Dossier Patient Informatisé (DPI) (DISD)", "url": "https://disd.ci/jpo-2026-les-delegations-officielles-saluent-les-performances-du-dpi/", "date": "2026-09-21", "publisherClass": "official" }, { "title": "Forum Club Santé 2026 : La DISD fixe le cap de l'Intelligence Artificielle en Côte d'Ivoire (DISD)", "url": "https://disd.ci/forum-club-sante-2026-la-disd-fixe-le-cap-de-lintelligence-artificielle-en-cote-divoire/", "date": "2026-07-02", "publisherClass": "official" }, { "title": "Numérisation du système de santé, Abidjan devient la capitale africaine de l'innovation médicale (KOACI)", "url": "https://www.koaci.com/article/2026/07/10/cote-divoire/sante/cote-divoire-numerisation-du-systeme-de-sante-abidjan-devient-la-capitale-africaine-de-linnovation-medicale_198464.html", "date": "2026-07-10", "publisherClass": "news" }, { "title": "La CNAM annonce 22,7 millions de personnes enrôlées à la CMU à la date du 02 décembre (CNAM)", "url": "https://ipscnam.ci/la-cnam-annonce-227-millions-de-personnes-enrolees-a-la-cmu-a-la-date-du-02-decembre/", "date": "2025-12-12", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Direct marketing using personal data without prior consent is a crime carrying one to five years in prison, and people can object free of charge. We found no explicit ban on selling health data or rules for consumer health apps.", "sources": [ { "title": "Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (UNODC SHERLOC copy of official text)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf", "date": "2013-06-19", "publisherClass": "legal_text" }, { "title": "Lois (Autorité de protection des données, ARTCI)", "url": "https://www.autoritedeprotection.ci/lois/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 36, "summary": "In facilities on the shared record, a clinician can open a patient's earlier visits and treatments from another equipped site. That covers public facilities in the network only, and private providers are not yet linked.", "sources": [ { "title": "Présentation du Dossier Patient Informatisé (DPI) (DISD, Ministère de la Santé)", "url": "https://disd.ci/presentation-du-dossier-patient-informatise-dpi/", "date": "2024-08-19", "publisherClass": "official" }, { "title": "Côte d'Ivoire / Santé : Le dossier patient informatisé interconnecte 258 hôpitaux (Sika Finance)", "url": "https://www.sikafinance.com/marches/cote-divoire-sante-le-dossier-patient-informatise-interconnecte-258-hopitaux_64481", "date": "2026-09-24", "publisherClass": "news" }, { "title": "Loi n° 2019-678 du 23 juillet 2019 portant réforme hospitalière (patrimoine.gouv.ci)", "url": "https://patrimoine.gouv.ci/doc/loi/2019-678%20loi%20r%C3%A9forme%20hospitali%C3%A8re%20(1)%20(1).pdf", "date": "2019-07-23", "publisherClass": "legal_text" } ] }, "research": { "score": 49, "summary": "Clinical trials need written, free and informed consent, a national ethics committee opinion and AIRP approval. Medical research data needs ARTCI authorisation, but we found no general opt-out from secondary use of records.", "sources": [ { "title": "Décret n° 2020-407 du 22 avril 2020 portant réglementation des essais cliniques (droitci.info)", "url": "https://www.droitci.info/files/810.04.20-Decret-du-22-avril-2020_Essais-cliniques--2022_09_27-06_08_23-UTC-.pdf", "date": "2020-04-22", "publisherClass": "legal_text" }, { "title": "Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (UNODC SHERLOC copy of official text)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf", "date": "2013-06-19", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "Côte d'Ivoire is building a national AI strategy with health as a priority sector, but we found no clinical AI rules. Device rules exist and count software as a medical device, with no AI-specific change control or oversight.", "sources": [ { "title": "Décret n° 2020-407 du 22 avril 2020 portant réglementation des essais cliniques (droitci.info)", "url": "https://www.droitci.info/files/810.04.20-Decret-du-22-avril-2020_Essais-cliniques--2022_09_27-06_08_23-UTC-.pdf", "date": "2020-04-22", "publisherClass": "legal_text" }, { "title": "Forum Club Santé 2026 : La DISD fixe le cap de l'Intelligence Artificielle en Côte d'Ivoire (DISD)", "url": "https://disd.ci/forum-club-sante-2026-la-disd-fixe-le-cap-de-lintelligence-artificielle-en-cote-divoire/", "date": "2026-07-02", "publisherClass": "official" }, { "title": "Impact IA 2026 : le pays accélère le passage de la vision à l'action (allAfrica)", "url": "https://fr.allafrica.com/stories/202609110364.html", "date": "2026-09-11", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law No. 2013-450 on the protection of personal data", "level": "National", "year": "2013", "what": "Express consent, ARTCI authorisation for medical data, access and objection rights, prison terms for sensitive-data misuse.", "url": "https://sherloc.unodc.org/cld/uploads/res/document/civ/loi-no-2013-450-relative-a-la-protection-des-donnees-a-caractere-personnel_html/06192013_loi_donne_es_personnelles.pdf" }, { "name": "Law No. 2019-678 on hospital reform", "level": "National", "year": "2019", "what": "Right to a medical file, access via a doctor of choice, discharge summary, hospital information system.", "url": "https://patrimoine.gouv.ci/doc/loi/2019-678%20loi%20r%C3%A9forme%20hospitali%C3%A8re%20(1)%20(1).pdf" }, { "name": "Decree No. 2020-407 regulating clinical trials", "level": "National", "year": "2020", "what": "Written informed consent, right to withdraw, ethics committee opinion and AIRP authorisation for trials.", "url": "https://www.droitci.info/files/810.04.20-Decret-du-22-avril-2020_Essais-cliniques--2022_09_27-06_08_23-UTC-.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "GHA", "name": "Ghana", "region": "Africa", "overall": 38, "rank": "104=", "likelyRank": "82 to 137", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Ghana's data law gives patients a 40-day right of access, but records sit in a state-owned hospital system rebuilt after a 2025 vendor shutdown.", "categories": { "access": { "score": 40, "summary": "Act 843 lets you ask any provider for your data, with a reply due within 40 days, but the request can carry a prescribed fee. There is no national patient portal: the official MyNHIS app covers insurance membership, not records.", "sources": [ { "title": "Data Protection Act, 2012 (Act 843), full text (WHO Compendium of Public Health Legislation copy)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "MyNHIS app listing, National Health Insurance Authority (Google Play)", "url": "https://play.google.com/store/apps/details?id=gh.gov.nhis.android.nma&hl=en", "date": "undated", "publisherClass": "official" }, { "title": "Patients' access to medical records: is it a privilege or a right? (Advances in Applied Sociology)", "url": "https://file.scirp.org/Html/1-2290290_61714.htm", "date": "2015-12", "publisherClass": "academic" } ] }, "control": { "score": 30, "summary": "On paper the Act lets you object to processing and learn who has had access, but health processing by clinicians is presumed necessary and no opt-out or patient access log works in practice (not verified). Hospital records now sit in a state-owned system by design.", "sources": [ { "title": "Data Protection Act, 2012 (Act 843), full text (WHO Compendium of Public Health Legislation copy)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "The GHS Patients Charter (Ghana Health Service, posted by Nandom Municipal Health Directorate)", "url": "https://www.nandomdistrict.gov.gh/wp-content/uploads/2026/07/Ghana-Health-Service-Patients-Charter_Nandom-MHD.pdf", "date": "undated", "publisherClass": "official" }, { "title": "GHIMS gives state ownership of Ghanaian medical records, Health Minister (Information Services Department)", "url": "https://www.isd.gov.gh/ghims-gives-state-ownership-of-ghanaian-medical-records-health-minister/", "date": "2025-10-29", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "Health is special personal data under Act 843, breaches must be reported, and selling personal data carries up to five years in prison. But the Commission runs from one office, declared 2026 a year of enforcement, and reports complaints about improper disclosure of health records.", "sources": [ { "title": "Data Protection Act, 2012 (Act 843), full text (WHO Compendium of Public Health Legislation copy)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "2026 will be a year of enforcement, Data Protection Commission warns (Ghana News Agency)", "url": "https://gna.org.gh/2026/01/2026-will-be-a-year-of-enforcement-data-protection-commission-warns/", "date": "2026-01-31", "publisherClass": "news" }, { "title": "Data Protection Commission steps up enforcement with new vehicles (Graphic Online)", "url": "https://www.graphic.com.gh/news/general-news/data-protection-commission-steps-up-enforcement-with-new-vehicles.html", "date": "2026-08-22", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 35, "summary": "Insurance claims are almost fully electronic (99.96 percent by end of 2024), but hospital records were split when the LHIMS system went down in 2025. Its state-owned replacement, GHIMS, began at teaching hospitals in November 2025; its current reach is not verified.", "sources": [ { "title": "GHIMS gives state ownership of Ghanaian medical records, Health Minister (Information Services Department)", "url": "https://www.isd.gov.gh/ghims-gives-state-ownership-of-ghanaian-medical-records-health-minister/", "date": "2025-10-29", "publisherClass": "official" }, { "title": "GHIMS rollout begins at Tamale Teaching Hospital (Tamale Teaching Hospital)", "url": "https://www.tth.gov.gh/blog/ghims-rollout-begins-at-tamale-teaching-hospital", "date": "2025-11-08", "publisherClass": "official" }, { "title": "NHIA's electronic claims system enhances efficiency in healthcare reimbursement (National Health Insurance Authority)", "url": "https://www.nhis.gov.gh/News/nhia%E2%80%99s-electronic-claims-system-enhances-efficiency-in-healthcare-reimbursement-5656", "date": "2025-02-28", "publisherClass": "official" }, { "title": "Beyond a single system: lessons from Ghana's discontinued national EHR (Ghana Medical Journal, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12877703/", "date": "2025-12", "publisherClass": "academic" } ] }, "commercial": { "score": 48, "summary": "Act 843 requires prior written consent for direct marketing and makes buying or selling personal data a crime, which the regulator restated in 2026. We found no health-specific rules for apps, brokers or de-identified data, and no published health enforcement case.", "sources": [ { "title": "Data Protection Act, 2012 (Act 843), full text (WHO Compendium of Public Health Legislation copy)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "2026 will be a year of enforcement, Data Protection Commission warns (Ghana News Agency)", "url": "https://gna.org.gh/2026/01/2026-will-be-a-year-of-enforcement-data-protection-commission-warns/", "date": "2026-01-31", "publisherClass": "news" }, { "title": "Electronic Pharmacy Policy (Pharmacy Council, Ghana)", "url": "https://pcghana.org/newwebsite/wp-content/uploads/2024/08/EPHARMACY-POLICY.pdf", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 28, "summary": "A clinician sees what is in their own facility system, and since 2025 that system may be the new state-owned GHIMS. Cross-facility viewing through the national exchange is planned but its use at the bedside is not verified.", "sources": [ { "title": "GHIMS gives state ownership of Ghanaian medical records, Health Minister (Information Services Department)", "url": "https://www.isd.gov.gh/ghims-gives-state-ownership-of-ghanaian-medical-records-health-minister/", "date": "2025-10-29", "publisherClass": "official" }, { "title": "Ghana Health Service and JICA launch National Teleconsultation Center project (Ghana Health Service)", "url": "https://ghs.gov.gh/news-and-events/ghana-health-service-and-jica-launch-national-teleconsultation-center-project-to-drive-universal-health-coverage", "date": "2026-07-24", "publisherClass": "official" }, { "title": "We don't own patient data; it belongs to the MOH, LHIMS Project Manager (MyJoyOnline)", "url": "https://www.myjoyonline.com/we-dont-own-patient-data-it-belongs-to-the-moh-lhims-project-manager/", "date": "2025-10-27", "publisherClass": "news" }, { "title": "Beyond a single system: lessons from Ghana's discontinued national EHR (Ghana Medical Journal, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12877703/", "date": "2025-12", "publisherClass": "academic" } ] }, "research": { "score": 49, "summary": "Trials need FDA approval, ethics clearance, PACTR registration and written informed consent under the Public Health Act. Record reuse for research falls under a broad Act 843 exemption with no consent or opt-out; three safeguard classes (ethics body, public trial register, Act 843 misuse offences) give 49.", "sources": [ { "title": "Public Health Act, 2012 (Act 851), full text (Ministry of Health)", "url": "https://www.moh.gov.gh/wp-content/uploads/2016/02/Public-Health-Act-851.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "Guideline for Authorization of Clinical Trials of Medicines, Food Supplements, Vaccines and Medical Devices in Ghana (Food and Drugs Authority)", "url": "https://fdaghana.gov.gh/guideline-for-authorization-of-clinical-trials-of-medicines-food-supplements-vaccines-and-medical-devices-in-ghana/", "date": "2024-01-15", "publisherClass": "official" }, { "title": "Data Protection Act, 2012 (Act 843), full text (WHO Compendium of Public Health Legislation copy)", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf", "date": "2012", "publisherClass": "legal_text" }, { "title": "The GHS Patients Charter (Ghana Health Service, posted by Nandom Municipal Health Directorate)", "url": "https://www.nandomdistrict.gov.gh/wp-content/uploads/2026/07/Ghana-Health-Service-Patients-Charter_Nandom-MHD.pdf", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "The FDA's 2017 software-as-a-medical-device guideline requires registration and approval for significant changes, including algorithm changes, but has nothing specific on AI or human oversight. A national AI-in-health policy was still being drafted in August 2026.", "sources": [ { "title": "Guideline for Registration of Software as a Medical Device, FDA/MCH/MDD/GL-RSAMD/2017/03 (Food and Drugs Authority)", "url": "https://fdaghana.gov.gh/guideline-for-registration-of-software-as-medical-device-3/", "date": "2017-12-01", "publisherClass": "official" }, { "title": "Ghana launches AI-driven health programme to strengthen systems and safeguard communities (WHO Regional Office for Africa)", "url": "https://www.afro.who.int/countries/ghana/news/ghana-launches-artificial-intelligence-driven-health-programme-strengthen-systems-and-safeguard", "date": "2026-05-17", "publisherClass": "intergov" }, { "title": "Health Ministry develops AI policy to guide safe use of artificial intelligence in Ghana's healthcare system (MyJoyOnline)", "url": "https://www.myjoyonline.com/health-ministry-develops-ai-policy-to-guide-safe-use-of-artificial-intelligence-in-ghanas-healthcare-system/", "date": "2026-08-06", "publisherClass": "news" }, { "title": "Govt to introduce new Data Protection Bill to regulate AI, cross-border data flows (Ghana News Agency)", "url": "https://gna.org.gh/2026/03/govt-to-introduce-new-data-protection-bill-to-regulate-ai-cross-border-data-flows/", "date": "2026-03-02", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2012 (Act 843)", "level": "National", "year": "2012", "what": "Health is special data; 40-day access; breach notice; written consent for marketing; selling data is a crime.", "url": "https://extranet.who.int/cpcd/sites/default/files/public_file_repository/GHA_Ghana_Data-Protection-Act_2012.pdf" }, { "name": "Public Health Act, 2012 (Act 851)", "level": "National", "year": "2012", "what": "FDA powers over medical devices; clinical trials need authorisation and written informed consent (section 158).", "url": "https://www.moh.gov.gh/wp-content/uploads/2016/02/Public-Health-Act-851.pdf" }, { "name": "FDA Guideline for Registration of Software as a Medical Device", "level": "National", "year": "2017", "what": "Registration, post-market surveillance and change approval for medical software; no AI-specific rules.", "url": "https://fdaghana.gov.gh/guideline-for-registration-of-software-as-medical-device-3/" }, { "name": "FDA Guideline for Authorization of Clinical Trials", "level": "National", "year": "2024", "what": "Ethics approval, informed consent forms and PACTR registration required before trials.", "url": "https://fdaghana.gov.gh/guideline-for-authorization-of-clinical-trials-of-medicines-food-supplements-vaccines-and-medical-devices-in-ghana/" }, { "name": "Ghana Health Service Patients Charter", "level": "National", "year": "not verified", "what": "Confidentiality without consent except by law or public interest; right to refuse research.", "url": "https://www.nandomdistrict.gov.gh/wp-content/uploads/2026/07/Ghana-Health-Service-Patients-Charter_Nandom-MHD.pdf" }, { "name": "Pharmacy Council Electronic Pharmacy Policy", "level": "National", "year": "not verified", "what": "All e-pharmacy orders through the national platform; registration with the Data Protection Commission.", "url": "https://pcghana.org/newwebsite/wp-content/uploads/2024/08/EPHARMACY-POLICY.pdf" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-10-24", "headline": "Hospitals return to paper folders after the electronic record system breaks down", "paraphrase": "Reporters found public hospitals in the Ashanti region writing patient histories in folders and exercise books for almost a week, with long queues. Some facilities said they had lost patient records dating back to 2023.", "source": "Adom Online (Multimedia Group)", "url": "https://www.adomonline.com/public-health-facilities-return-to-paper-based-system-as-lhims-shuts-down/", "theme": "access_delay_or_cost", "status": "alleged" }, { "date": "2025-10-27", "headline": "Record system vendor blames unrenewed contract for hospital disruptions", "paraphrase": "The system's project manager said the contract expired in 2024 and an extension never came, leaving the project uncertain. Hospitals reverted to manual records and patients reported longer waits; the insurer told facilities to use a phone-based workaround.", "source": "Adom Online (Multimedia Group)", "url": "https://www.adomonline.com/hospitals-return-to-manual-records-as-lhims-contract-stalls/", "theme": "other", "status": "alleged" }, { "date": "2025-10-29", "headline": "Data Protection Commission opens investigation into handling of national patient records", "paraphrase": "After a dispute over a shutdown of the national electronic records system, the regulator said it would assess how patient data is stored, retained and secured, and whether patients' rights are protected. No findings were reported.", "source": "Citi Newsroom", "url": "https://citinewsroom.com/2025/10/data-protection-commission-probes-handling-of-patient-data-managed-by-lightwave/", "theme": "other", "status": "alleged" }, { "date": "2025-10-30", "headline": "Health minister says the state lacked control over citizens' electronic medical records", "paraphrase": "The minister said a private vendor held exclusive access to patients' electronic records, refused state administrative control, and switched the system off, leaving it down for two weeks. The vendor publicly disputes his account.", "source": "Graphic Online", "url": "https://www.graphic.com.gh/news/general-news/ghana-news-health-minister-uncovers-100m-e-health-scandal-rolls-out-4-week-fix.html", "theme": "other", "status": "alleged" }, { "date": "2025-11-08", "headline": "Doctors say years of patient records became unreachable when the system shut down", "paraphrase": "A specialist told reporters that records back to 2020 were inaccessible after the national system shut down for weeks. Patients were asked to recall their own medicines, and staff logged new data in exercise books.", "source": "MyJoyOnline (JoyNews)", "url": "https://www.myjoyonline.com/e-health-records-disaster-clinicians-risk-misdiagnosing-patients-after-losing-5-years-of-medical-data/", "theme": "other", "status": "alleged" } ] }, { "iso3": "MDV", "name": "Maldives", "region": "Asia", "overall": 38, "rank": "104=", "likelyRank": "85 to 141", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Patients can get their record within 3 working days, but hospital systems do not connect and Maldives has no data protection law yet.", "categories": { "access": { "score": 45, "summary": "A 2019 regulation lets any adult get their medical record from a provider within 3 working days, at a cost-only fee. There is no national record portal; the MIHIS portal shows mainly vaccination, growth and primary care data.", "sources": [ { "title": "Medical Records Regulation 2019/R-1070, gazette text (PDF)", "url": "https://storage.googleapis.com/gazette.gov.mv/docs/gazette/5872.pdf", "date": "2019-10-17", "publisherClass": "legal_text" }, { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Launching of the Maldives Integrated Health Information System (MIHIS) portal, WHO Maldives", "url": "https://www.who.int/maldives/news/detail/25-12-2024-launching-of-the-maldives-integrated-health-information-system-(mihis)-portal", "date": "2024-12-25", "publisherClass": "intergov" }, { "title": "Maldives Digital Health Blueprint 2026-2030, Ministry of Health, Family and Welfare", "url": "https://health.gov.mv/en/publications/maldives-digital-health-blueprint-2026-2030", "date": "2026-07-11", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "The law lets providers share records with other clinicians for care without asking, and we found no opt-out and no access log patients can see. Disclosure outside care needs written consent, a court order or a legal duty.", "sources": [ { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Medical Records Regulation 2019/R-1070, gazette text (PDF)", "url": "https://storage.googleapis.com/gazette.gov.mv/docs/gazette/5872.pdf", "date": "2019-10-17", "publisherClass": "legal_text" } ] }, "privacy": { "score": 40, "summary": "Health information is confidential and privileged under the Health Services Act, and misuse of records carries fines of MVR 10,000 to 100,000 and up to a year in jail for repeat offences. There is still no general data protection law, regulator or breach notice duty.", "sources": [ { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Bill submitted to Parliament on personal data protection (SunOnline)", "url": "https://english.sun.mv/105358", "date": "2026-05-11", "publisherClass": "news" }, { "title": "Maldives Constitution 2008 (English), Constitute Project", "url": "https://www.constituteproject.org/constitution/Maldives_2008", "date": "2008", "publisherClass": "legal_text" }, { "title": "Data protection adequacy for non-EU countries, European Commission", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 40, "summary": "Aasandha's claims system runs at 730 sites countrywide, but the main hospital system, handling 75 percent of outpatient and inpatient load, does not interoperate with the national HMIS. The 2026 Blueprint says hospital systems are not linked and there is no central pharmacy system.", "sources": [ { "title": "Maldives Digital Health Blueprint 2026-2030, Ministry of Health, Family and Welfare", "url": "https://health.gov.mv/en/publications/maldives-digital-health-blueprint-2026-2030", "date": "2026-07-11", "publisherClass": "official" }, { "title": "Aasandha Scheme Overview, Aasandha Company Ltd", "url": "https://www.aasandha.mv/aasandha-scheme", "date": "undated", "publisherClass": "official" }, { "title": "Launching of the Maldives Integrated Health Information System (MIHIS) portal, WHO Maldives", "url": "https://www.who.int/maldives/news/detail/25-12-2024-launching-of-the-maldives-integrated-health-information-system-(mihis)-portal", "date": "2024-12-25", "publisherClass": "intergov" }, { "title": "Health sector to be digitalized first, no room to hide health records: President (The Edition)", "url": "https://edition.mv/news/41604", "date": "2025-06-01", "publisherClass": "news" } ] }, "commercial": { "score": 38, "summary": "Using any medical record for any purpose without permission is a crime under the Health Services Act. No law addresses selling de-identified health data, health data brokers or consumer health apps.", "sources": [ { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Medical Records Regulation 2019/R-1070, gazette text (PDF)", "url": "https://storage.googleapis.com/gazette.gov.mv/docs/gazette/5872.pdf", "date": "2019-10-17", "publisherClass": "legal_text" }, { "title": "Bill submitted to Parliament on personal data protection (SunOnline)", "url": "https://english.sun.mv/105358", "date": "2026-05-11", "publisherClass": "news" } ] }, "clinical": { "score": 28, "summary": "Hospital systems are not linked, so a clinician at one facility usually cannot see records made at another. The Blueprint says even referred patients must do extra work to get a tertiary hospital appointment.", "sources": [ { "title": "Maldives Digital Health Blueprint 2026-2030, Ministry of Health, Family and Welfare", "url": "https://health.gov.mv/en/publications/maldives-digital-health-blueprint-2026-2030", "date": "2026-07-11", "publisherClass": "official" }, { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Health sector to be digitalized first, no room to hide health records: President (The Edition)", "url": "https://edition.mv/news/41604", "date": "2025-06-01", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "The Health Services Act lets ethics-approved researchers view records without consent, and there is no general opt-out. Four safeguards put Maldives at the band cap: a national permit council, statutory secrecy, fines for misuse, and a 2019 rule requiring consent where the data source is known.", "sources": [ { "title": "Health Research Regulation 2019/R-1006, Government Gazette (PDF)", "url": "https://storage.googleapis.com/gazette.gov.mv/docs/gazette/5756.pdf", "date": "2019-03-20", "publisherClass": "legal_text" }, { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Health Research Approval, oneGov", "url": "https://one.gov.mv/support/guidelines/health-research-approval-269", "date": "2026-08-31", "publisherClass": "official" }, { "title": "Research in treatment via poetry against Health Ministry regulations (The Edition)", "url": "https://edition.mv/news/47060", "date": "2025-12-29", "publisherClass": "news" } ] }, "ai": { "score": 28, "summary": "The drug authority registers medical devices by class with CE mark or notified body evidence, but nothing addresses software or AI. The 2026 Blueprint mentions using AI without setting any rules for it.", "sources": [ { "title": "Medical Device and Medical Consumable Registration form (MFDA), Ministry of Health", "url": "https://health.gov.mv/en/downloads/medical-device-registration-form", "date": "2022-07-19", "publisherClass": "official" }, { "title": "Health Services Act (Law 29/2015), consolidated text, MV Laws", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244", "date": "2024-09-09", "publisherClass": "legal_text" }, { "title": "Maldives Digital Health Blueprint 2026-2030, Ministry of Health, Family and Welfare", "url": "https://health.gov.mv/en/publications/maldives-digital-health-blueprint-2026-2030", "date": "2026-07-11", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitution of the Republic of Maldives", "level": "National", "year": "2008", "what": "Article 24 protects private and family life, home and private communications.", "url": "https://www.constituteproject.org/constitution/Maldives_2008" }, { "name": "Health Services Act (Law 29/2015)", "level": "National", "year": "2015", "what": "Health information is confidential; sets access limits, record offences and fines up to MVR 500,000.", "url": "https://mvlaw.gov.mv/dv/legislations/48/consolidations/1244" }, { "name": "Medical Records Regulation (2019/R-1070)", "level": "National", "year": "2019", "what": "Adult patients get their record within 3 working days; cost-only fee; lifetime retention.", "url": "https://gazette.gov.mv/gazette/5609" }, { "name": "Health Research Regulation (2019/R-1006)", "level": "National", "year": "2019", "what": "All health research needs National Health Research Council approval; consent rules, withdrawal and fines.", "url": "https://gazette.gov.mv/gazette/5491" }, { "name": "Social Health Insurance Act (Law 15/2011)", "level": "National", "year": "2011", "what": "Legal basis for the national health insurance scheme run as Aasandha.", "url": "https://www.gazette.gov.mv/gazette/271" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-10-05", "headline": "Lawyers say a public hospital broke the law by publishing a patient's health details", "paraphrase": "A public hospital released a statement giving health details of a named patient. Lawyers said this broke the patient confidentiality article of the Health Services Act, which allows disclosure only with written consent, a court order or a legal duty.", "source": "The Edition", "url": "https://edition.mv/news/44816", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2025-02-05", "headline": "Health Ministry investigates hospital after a patient's X-ray and identity were leaked online", "paraphrase": "A foreign patient's X-ray and another clinical photo were reportedly leaked by a hospital nurse and shared online with identity details. The Health Ministry said it was investigating; whether anyone faced action was not disclosed.", "source": "The Edition", "url": "https://edition.mv/news/39292", "theme": "breach", "status": "alleged" } ] }, { "iso3": "ZWE", "name": "Zimbabwe", "region": "Africa", "overall": 38, "rank": "104=", "likelyRank": "84 to 140", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Zimbabwe has written health-data consent and confidentiality into law, but patients have no verified portal, no access log and a record system built for clinics.", "categories": { "access": { "score": 40, "summary": "Section 14 of the Cyber and Data Protection Act 2021 gives a right to access personal information, but sets no deadline or format. No patient portal was verified, so patients ask each provider.", "sources": [ { "title": "Cyber and Data Protection Act, Act No. 5 of 2021 (POTRAZ copy)", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Medical Services Amendment Act, Act No. 3 of 2026 (Veritas)", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf", "date": "2026-07-07", "publisherClass": "legal_text" } ] }, "control": { "score": 32, "summary": "The 2021 Act requires written, revocable consent for health data, but care under a health professional is exempt, and the 2026 amendment lets providers share records with each other in the patient's interest. No access log or opt-out was found.", "sources": [ { "title": "Cyber and Data Protection Act, Act No. 5 of 2021 (POTRAZ copy)", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Medical Services Amendment Act, Act No. 3 of 2026 (Veritas)", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf", "date": "2026-07-07", "publisherClass": "legal_text" }, { "title": "Public Health Act [Chapter 15:17], No. 11 of 2018 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/zim190656.pdf", "date": "2018-08-31", "publisherClass": "legal_text" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive under the 2021 Act, breaches go to POTRAZ within 24 hours, and the 2026 amendment criminalises unauthorised access to patient records. Enforcement only began with inspections from 1 September 2026, and no health-sector decisions were found.", "sources": [ { "title": "Cyber and Data Protection Act, Act No. 5 of 2021 (POTRAZ copy)", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "SI 155 of 2024, Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations (Veritas)", "url": "https://www.veritaszim.net/node/7187", "date": "2024-09-13", "publisherClass": "legal_text" }, { "title": "Medical Services Amendment Act, Act No. 3 of 2026 (Veritas)", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf", "date": "2026-07-07", "publisherClass": "legal_text" }, { "title": "Potraz data licence fees spark backlash over cost burden (Bulawayo24)", "url": "https://bulawayo24.com/index-id-news-sc-national-byo-266617.html", "date": "2026-07-30", "publisherClass": "news" } ] }, "journey": { "score": 32, "summary": "The Ministry's Impilo electronic record runs in hundreds of public clinics, but a 2025 study reports weak links to other software, and there is no national health insurance claims system. National coverage figures could not be verified.", "sources": [ { "title": "National Health Strategy 2021-2025 (Ministry of Health and Child Care, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/zim225019.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Integration and Interoperability of Impilo EHR with DHIS2 (DHIS2 Community)", "url": "https://community.dhis2.org/t/integration-and-interoperability-of-impilo-electronic-health-record-ehr-system-with-dhis2/64859", "date": "2025-05-06", "publisherClass": "blog_vendor" }, { "title": "Electronic Health Record Systems in Limited Resource Settings: An Evaluation of the Impilo Platform (Mugauri and Chimsimbe)", "url": "https://ideas.repec.org/a/prg/jnlaip/v2025y2025i3id265p393-407.html", "date": "2025", "publisherClass": "academic" }, { "title": "Evaluating EHR (Impilo) Coverage in Matabeleland South (IJRSI)", "url": "https://rsisinternational.org/journals/ijrsi/uploads/vol12-iss15-pg2476-2481-202511_pdf.pdf", "date": "2025-11", "publisherClass": "academic" } ] }, "commercial": { "score": 45, "summary": "The Act gives a free right to object to direct marketing and needs written consent for health data, but has no rules on health apps, data brokers or sale of de-identified data. The government rejected a US aid deal partly over commercial use of samples.", "sources": [ { "title": "Cyber and Data Protection Act, Act No. 5 of 2021 (POTRAZ copy)", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Data protection laws in Zimbabwe (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?c=ZW&t=law", "date": "2026-03-20", "publisherClass": "law_firm" }, { "title": "Zimbabwe rejects 'lopsided' US health aid deal over data concerns (BBC)", "url": "https://www.bbc.com/news/articles/cwy6nd3664no", "date": "2026-02-25", "publisherClass": "news" } ] }, "clinical": { "score": 28, "summary": "The law lets a clinician examine records for treatment with consent and share them with other providers in the patient's interest. No cross-facility record view at the point of care was verified.", "sources": [ { "title": "Medical Services Amendment Act, Act No. 3 of 2026 (Veritas)", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf", "date": "2026-07-07", "publisherClass": "legal_text" }, { "title": "Electronic Health Record Systems in Limited Resource Settings: An Evaluation of the Impilo Platform (Mugauri and Chimsimbe)", "url": "https://ideas.repec.org/a/prg/jnlaip/v2025y2025i3id265p393-407.html", "date": "2025", "publisherClass": "academic" }, { "title": "Evaluating EHR (Impilo) Coverage in Matabeleland South (IJRSI)", "url": "https://rsisinternational.org/journals/ijrsi/uploads/vol12-iss15-pg2476-2481-202511_pdf.pdf", "date": "2025-11", "publisherClass": "academic" } ] }, "research": { "score": 50, "summary": "All health research needs Medical Research Council of Zimbabwe approval, and using identifiable records needs the patient's, the institution's and an ethics committee's authorisation. De-identified data is exempt and there is no opt-out register.", "sources": [ { "title": "Public Health Act [Chapter 15:17], No. 11 of 2018 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/zim190656.pdf", "date": "2018-08-31", "publisherClass": "legal_text" }, { "title": "Medical Services Amendment Act, Act No. 3 of 2026 (Veritas)", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf", "date": "2026-07-07", "publisherClass": "legal_text" }, { "title": "MRCZ Submission Requirements (Medical Research Council of Zimbabwe)", "url": "https://mrcz.org.zw/submission-requirements/", "date": "undated", "publisherClass": "official" }, { "title": "ClinRegs: Clinical Research Regulation for Zimbabwe (US NIH/NIAID)", "url": "https://clinregs.niaid.nih.gov/country/zimbabwe", "date": "2025-11-12", "publisherClass": "official" } ] }, "ai": { "score": 28, "summary": "Zimbabwe launched a National AI Strategy 2026-2030 in March 2026 that names predictive healthcare, but no MCAZ rule for AI or software as a medical device was verified. The 2021 Act gives a right not to face solely automated decisions.", "sources": [ { "title": "Zimbabwe Unveils 2026-2030 AI Strategy (United Nations Zimbabwe)", "url": "https://zimbabwe.un.org/en/311859-zimbabwe-unveils-2026%E2%80%932030-ai-strategy-advance-inclusive-digital-transformation", "date": "2026-03-14", "publisherClass": "intergov" }, { "title": "Medical Devices Guidelines and Regulations Docs (MCAZ)", "url": "https://www.mcaz.co.zw/documents/medical-devices-docs/", "date": "undated", "publisherClass": "official" }, { "title": "Cyber and Data Protection Act, Act No. 5 of 2021 (POTRAZ copy)", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf", "date": "2021", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Cyber and Data Protection Act, No. 5 of 2021", "level": "National", "year": "2021", "what": "Health data needs written, revocable consent; access right; 24-hour breach notice; POTRAZ is the authority.", "url": "https://www.potraz.gov.zw/wp-content/uploads/2022/02/Data-Protection-Act-5-of-2021.pdf" }, { "name": "SI 155 of 2024, Licensing of Data Controllers and Appointment of DPOs Regulations", "level": "National", "year": "2024", "what": "Data controllers must be licensed by POTRAZ and appoint data protection officers.", "url": "https://www.veritaszim.net/node/7187" }, { "name": "Public Health Act [Chapter 15:17], No. 11 of 2018", "level": "National", "year": "2018", "what": "Patient information is confidential; record use for treatment or research needs authorisation.", "url": "https://faolex.fao.org/docs/pdf/zim190656.pdf" }, { "name": "Medical Services Amendment Act, No. 3 of 2026", "level": "National", "year": "2026", "what": "Informed consent, confidentiality, record protection offences, discharge reports, and Permanent Secretary sanctions.", "url": "https://www.veritaszim.net/sites/veritas_d/files/Medical%20Services%20Amendment%2C%20Act%20No.%203%20of%202026.pdf" }, { "name": "Zimbabwe National Artificial Intelligence Strategy 2026-2030", "level": "National", "year": "2026", "what": "Non-binding plan with flagship AI projects, including predictive healthcare.", "url": "https://zimbabwe.un.org/en/311859-zimbabwe-unveils-2026%E2%80%932030-ai-strategy-advance-inclusive-digital-transformation" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-06-29", "headline": "Fire at a public hospital destroys nearly two decades of patient records", "paraphrase": "A fire in a storage building at a large public hospital destroyed patient records going back almost twenty years, according to a news report published after the health minister toured the damage.", "source": "Pindula News", "url": "https://news.pindula.co.zw/2025/06/29/sally-mugabe-hospital-fire-damages-solar-power-system-destroys-20-years-of-records/", "theme": "other", "status": "alleged" } ] }, { "iso3": "BRB", "name": "Barbados", "region": "Americas", "overall": 37, "rank": "109=", "likelyRank": "85 to 142", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Barbados has a GDPR-style privacy law, but health is not legally sensitive, the main hospital charges $375 per record copy, and no portal is live.", "categories": { "access": { "score": 45, "summary": "The Data Protection Act 2019 promises a free copy within one month, in electronic form if asked electronically. In practice the Queen Elizabeth Hospital lists a $375 fee for a copy of its records, and its promised patient app was not yet live.", "sources": [ { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Medical Records Department (Queen Elizabeth Hospital)", "url": "https://www.qehconnect.com/services/medical-records-department/", "date": "undated", "publisherClass": "official" }, { "title": "QEH to introduce patient app, portal under digital health rollout (Barbados Today)", "url": "https://barbadostoday.bb/2026/07/01/qeh-to-introduce-patient-app-portal-under-digital-health-rollout/", "date": "2026-07-01", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data is not on the Act's sensitive list, and even sensitive data may be processed for care or public functions without consent. No opt-out from record sharing and no patient-visible access log were found as the hospital moves to one digital system.", "sources": [ { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Healthcare data protection in Barbados: Seminar signals shift from education to enforcement (Barbados Today)", "url": "https://barbadostoday.bb/2025/10/28/healthcare-data-protection-in-barbados-seminar-signals-shift-from-education-to-enforcement/", "date": "2025-10-28", "publisherClass": "news" }, { "title": "Medical Records Department (Queen Elizabeth Hospital)", "url": "https://www.qehconnect.com/services/medical-records-department/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 44, "summary": "The 2019 Act has 72-hour breach notice and penalties up to $500,000 or three years in prison. But health data lacks sensitive status, the Commissioner is a public officer inside a ministry, and no enforcement decision was published after the 2022 hospital cyberattack.", "sources": [ { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Data Protection Commission (Government of Barbados)", "url": "https://www.gov.bb/General/data-protection-commissioner", "date": "undated", "publisherClass": "official" }, { "title": "QEH warns of delays following cyber security incident (CBC)", "url": "https://www.cbc.bb/news/local-news/qeh-warns-of-delays-following-cyber-security-incident/", "date": "2022-12-13", "publisherClass": "news" }, { "title": "Barbados' Data Protection Watchdog Has Real Teeth on Paper. Why Hasn't It Bitten? (Niel Harper)", "url": "https://nielharper.com/2026/08/19/barbados-data-protection-watchdog-has-real-teeth-on-paper-why-hasnt-it-bitten/", "date": "2026-08-19", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 35, "summary": "Polyclinics run an electronic record and public pharmacies prescribe electronically, but a 2022 PAHO-backed assessment found limited links between the hospital, polyclinics, labs and pharmacies. QEH is rolling out a new hospital system, and a system to connect all levels is still being planned.", "sources": [ { "title": "Barbados advances information systems for health with stakeholder engagement (PAHO)", "url": "https://www.paho.org/en/news/23-7-2025-barbados-advances-information-systems-health-stakeholder-engagement", "date": "2025-07-23", "publisherClass": "intergov" }, { "title": "Barbados advances digital health transformation through Public Health Datathon (PAHO)", "url": "https://www.paho.org/en/news/7-7-2026-barbados-advances-digital-health-transformation-through-public-health-datathon", "date": "2026-07-07", "publisherClass": "intergov" }, { "title": "QEH Highlights Progress on Strategic Plan Initiatives (Queen Elizabeth Hospital)", "url": "https://www.qehconnect.com/qeh-highlights-progress-on-strategic-plan-initiatives/", "date": "2026-06-02", "publisherClass": "official" }, { "title": "Health Ministry targets gaps in health system (Barbados Today)", "url": "https://barbadostoday.bb/2026/09/06/health-ministry-targets-gaps-in-health-system/", "date": "2026-09-06", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "People can stop direct marketing with 21 days' written notice, and data must be used only for its stated purpose. Because health is not sensitive data, selling it does not need explicit consent, and no rules on health apps or data brokers were found.", "sources": [ { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Healthcare data protection in Barbados: Seminar signals shift from education to enforcement (Barbados Today)", "url": "https://barbadostoday.bb/2025/10/28/healthcare-data-protection-in-barbados-seminar-signals-shift-from-education-to-enforcement/", "date": "2025-10-28", "publisherClass": "news" } ] }, "clinical": { "score": 30, "summary": "In May 2026 the QEH chief executive said emergency staff do not yet have immediate access to patients' records. The new hospital system is rolling out, but links to polyclinics and private doctors are plans, not a working service.", "sources": [ { "title": "QEH Highlights Progress on Strategic Plan Initiatives (Queen Elizabeth Hospital)", "url": "https://www.qehconnect.com/qeh-highlights-progress-on-strategic-plan-initiatives/", "date": "2026-06-02", "publisherClass": "official" }, { "title": "QEH digital records rollout 'set for July' (Barbados Today)", "url": "https://barbadostoday.bb/2026/05/06/qeh-digital-records-rollout-set-for-july/", "date": "2026-05-06", "publisherClass": "news" }, { "title": "QEH begins transition to digital medical records (Barbados Today)", "url": "https://barbadostoday.bb/2025/10/07/qeh-begins-transition-to-digital-medical-records/", "date": "2025-10-07", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "The 2019 Act treats research use as compatible with the original purpose and exempts it from access rights when results do not identify anyone. There is no opt-out, but a joint UWI and health ministry ethics board reviews research.", "sources": [ { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "About - Research Ethics (University of the West Indies at Cave Hill)", "url": "https://www.cavehill.uwi.edu/researchethics/about/", "date": "undated", "publisherClass": "academic" }, { "title": "Barbados Medical Products Bill, 2026 (Parliament of Barbados)", "url": "https://www.barbadosparliament.com/uploads/bill_resolution/8a80652f25b3721b34f2ace09a89a9e6.pdf", "date": "2026-04-10", "publisherClass": "legal_text" } ] }, "ai": { "score": 28, "summary": "No law or guidance on clinical AI was found. Parliament passed a Medical Products Authority bill in 2026 that covers medical devices, but it does not mention software or AI and the authority is not yet operating.", "sources": [ { "title": "Barbados Medical Products Bill, 2026 (Parliament of Barbados)", "url": "https://www.barbadosparliament.com/uploads/bill_resolution/8a80652f25b3721b34f2ace09a89a9e6.pdf", "date": "2026-04-10", "publisherClass": "legal_text" }, { "title": "Barbados approves the creation of the Barbados Medical Products Authority with support of PAHO (PAHO)", "url": "https://www.paho.org/en/news/1-7-2026-barbados-approves-creation-barbados-medical-products-authority-support-paho", "date": "2026-07-01", "publisherClass": "intergov" }, { "title": "Data Protection Act, 2019-29 (Barbados), full text", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Barbados to host UN AI panel as global concern over safeguards grows (Barbados Today)", "url": "https://barbadostoday.bb/2026/09/25/barbados-to-host-un-ai-panel-as-global-concern-over-safeguards-grows/", "date": "2026-09-25", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2019-29", "level": "National", "year": "2019", "what": "Free copy within one month, 72-hour breach notice; health is not listed as sensitive data.", "url": "https://www.privacylaws.com/media/4517/data-protection-act-2019-29.pdf" }, { "name": "Barbados Medical Products Act, 2026 (passed as a bill; commencement not verified)", "level": "National", "year": "2026", "what": "Creates a Medical Products Authority, device rules, ethics clearance and a register of clinical trials.", "url": "https://www.barbadosparliament.com/uploads/bill_resolution/8a80652f25b3721b34f2ace09a89a9e6.pdf" }, { "name": "Health Services Act, Cap. 44", "level": "National", "year": "1969", "what": "Health ministry's public health powers; regulations cover surveillance and investigation of notifiable diseases.", "url": "https://www.health.gov.bb/Legislation" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "BEN", "name": "Benin", "region": "Africa", "overall": 37, "rank": "109=", "likelyRank": "89 to 148", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Benin has a strong data law and an active regulator, but patients cannot view or share records online; a digital record is only a promise.", "categories": { "access": { "score": 45, "summary": "The Digital Code gives a free right to a copy of your personal data within 60 days, which covers medical files. There is no national portal or patient app, and use of this right in health care was not verified, so the score sits at 45.", "sources": [ { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "Loi n° 2020-37 du 03 février 2021 portant protection de la santé des personnes (SGG)", "url": "https://sgg.gouv.bj/doc/loi-2020-37/", "date": "2021-02-03", "publisherClass": "legal_text" }, { "title": "Promesse de carnet de santé digital au Bénin (Santé Tribune)", "url": "https://santetribune.bj/st/2026/06/17/promesse-de-carnet-de-sante-digital-au-benin-outil-de-renforcement-de-la-qualite-des-soins/", "date": "2026-06-17", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent when needed for care under a health professional, and there is no shared record, opt-out or access log. The patient's main tool is a general right to object for legitimate reasons.", "sources": [ { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "La Loi n° 2017-20 portant code du numérique, Livre V (APDP)", "url": "https://archive.apdp.bj/lois/la-loi-n-2017-20-portant-code-du-numerique-en-republique-du-benin/", "date": "2018-05-07", "publisherClass": "official" } ] }, "privacy": { "score": 52, "summary": "The Digital Code treats health data as sensitive, requires breach notice without delay and allows fines up to 100 million CFA francs. With no health-sector cases found, this scores the general law, held back by state exemptions and a politically chosen regulator.", "sources": [ { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "Loi n° 2020-35 du 06 janvier 2021 modifiant le code du numérique (ARCEP Bénin copy)", "url": "https://arcep.bj/wp-content/uploads/2022/11/LOI-N2020-35.pdf", "date": "2021-01-06", "publisherClass": "legal_text" }, { "title": "Bilan 2025 de l'Apdp-Bénin : 782 dossiers examinés, des contrôles renforcés (La Nation)", "url": "https://lanation.bj/numerique/bilan-2025-de-lapdp-benin-782-dossiers-examines-des-controles-renforces", "date": "2026-08-12", "publisherClass": "news" }, { "title": "Protection des données personnelles : les pouvoirs de sanction de l'Apdp (La Nation)", "url": "https://lanation.bj/numerique/protection-des-donnees-personnelles-les-pouvoirs-de-sanction-de-lapdp", "date": "2026-08-11", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "Benin's health information system is mainly aggregate reporting through DHIS2, and the ARS reports that data from different sources is poorly integrated. No national EHR or exchange exists; whether any public hospital runs an electronic record was not verified.", "sources": [ { "title": "DHIS2 login, Direction des Systèmes d'Information, Ministère de la Santé", "url": "https://rep-sante.gouv.bj/", "date": "undated", "publisherClass": "official" }, { "title": "Rapport sur l'état du secteur de la santé au Bénin 2023 (ARS, published by WHO AFRO)", "url": "https://www.afro.who.int/sites/default/files/2025-11/RAPPORT%20SUR%20L%E2%80%99ETAT%20DU%20SECTEUR%20SANTE%20AU%20BENIN%202023%202%2015_09_2025.pdf", "date": "2025-09", "publisherClass": "intergov" }, { "title": "Promesse de carnet de santé digital au Bénin (Santé Tribune)", "url": "https://santetribune.bj/st/2026/06/17/promesse-de-carnet-de-sante-digital-au-benin-outil-de-renforcement-de-la-qualite-des-soins/", "date": "2026-06-17", "publisherClass": "news" }, { "title": "Projet ARCH : le Gouvernement généralise le volet assurance maladie (Gouvernement du Bénin)", "url": "https://www.gouv.bj/article/1145/projet-arch-gouvernement-generalise-volet-assurance-maladie-dans-communes-benin/", "date": "2021-01-19", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Selling or reusing health data needs explicit consent under the sensitive-data ban, and people can refuse marketing use free of charge. We found no health-specific rule on data brokers, health apps or de-identified data, and no health enforcement.", "sources": [ { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "Bilan 2025 de l'Apdp-Bénin : 782 dossiers examinés, des contrôles renforcés (La Nation)", "url": "https://lanation.bj/numerique/bilan-2025-de-lapdp-benin-782-dossiers-examines-des-controles-renforces", "date": "2026-08-12", "publisherClass": "news" } ] }, "clinical": { "score": 20, "summary": "The law lets clinicians process health data for care, but there is no shared record they can open across providers. We found no system that lets a doctor in Cotonou see notes written in Parakou.", "sources": [ { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "Rapport sur l'état du secteur de la santé au Bénin 2023 (ARS, published by WHO AFRO)", "url": "https://www.afro.who.int/sites/default/files/2025-11/RAPPORT%20SUR%20L%E2%80%99ETAT%20DU%20SECTEUR%20SANTE%20AU%20BENIN%202023%202%2015_09_2025.pdf", "date": "2025-09", "publisherClass": "intergov" }, { "title": "Promesse de carnet de santé digital au Bénin (Santé Tribune)", "url": "https://santetribune.bj/st/2026/06/17/promesse-de-carnet-de-sante-digital-au-benin-outil-de-renforcement-de-la-qualite-des-soins/", "date": "2026-06-17", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "A 2010 law requires informed consent for epidemiological research and written consent for clinical research, reviewed by the CNERS ethics committee. Consent can be waived for record reviews when people cannot be found, and no public register of uses was found, so 50, level with Nigeria.", "sources": [ { "title": "Loi n° 2010-40 du 08 décembre 2010 portant code d'éthique et de déontologie pour la recherche en santé (SGG)", "url": "https://sgg.gouv.bj/doc/loi-2010-40/", "date": "2010-12-08", "publisherClass": "legal_text" }, { "title": "Loi n° 2017-20 portant code du numérique en République du Bénin (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf", "date": "2018-04-20", "publisherClass": "legal_text" }, { "title": "Protection des données personnelles en matière de recherche en santé (APDP training, with CNERS)", "url": "https://archive.apdp.bj/wp-content/uploads/2022/10/PROTECTION-DONNEES-RECHERCHE-SANTE_fga1.pdf", "date": "2022-10", "publisherClass": "official" } ] }, "ai": { "score": 30, "summary": "Benin regulates medical devices, including software needed to run them, under a 2024 decree with change notification. There is no AI-specific rule for clinical use; the 2023-2027 AI strategy only plans an ethics text.", "sources": [ { "title": "Décret n° 2024-1298 du 06 novembre 2024 portant modalités d'homologation des dispositifs médicaux (SGG)", "url": "https://sgg.gouv.bj/doc/decret-2024-1298/", "date": "2024-11-06", "publisherClass": "legal_text" }, { "title": "Stratégie nationale d'intelligence artificielle et des mégadonnées 2023-2027 (Ministère du Numérique)", "url": "https://innovation.gouv.bj/assets/documents/strategie-nationale-d'intelligence-artificielle-et-des-megadonnees-2023-2027.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Stratégie nationale de l'IA : les raisons derrière la création d'un ministère dédié (Le Matinal)", "url": "https://lematinal.bj/strategie-nationale-de-lia-les-raisons-derriere-la-creation-dun-ministere-dedie-au-benin/", "date": "2026-05-31", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 2017-20 on the Digital Code (Book V, personal data)", "level": "National", "year": "2018", "what": "Health data is sensitive; free access within 60 days; breach notice without delay; fines up to 100 million CFA.", "url": "https://www.afapdp.org/wp-content/uploads/2018/06/Benin-Loi-2017-20-Portant-code-du-numerique-en-Republique-du-Benin.pdf" }, { "name": "Law 2020-35 amending the Digital Code", "level": "National", "year": "2021", "what": "Sets the data authority at eight members, five chosen by the National Assembly.", "url": "https://arcep.bj/wp-content/uploads/2022/11/LOI-N2020-35.pdf" }, { "name": "Law 2020-37 on protecting people's health", "level": "National", "year": "2021", "what": "Patient rights to information, privacy, confidentiality and consent to or refusal of care.", "url": "https://sgg.gouv.bj/doc/loi-2020-37/" }, { "name": "Law 2010-40 on the code of ethics for health research", "level": "National", "year": "2010", "what": "Informed consent for research, written for clinical trials; creates the national ethics committee CNERS.", "url": "https://sgg.gouv.bj/doc/loi-2010-40/" }, { "name": "Decree 2024-1298 on medical device authorisation", "level": "National", "year": "2024", "what": "ABMed authorisation of medical devices, including embedded software, with change notification.", "url": "https://sgg.gouv.bj/doc/decret-2024-1298/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ETH", "name": "Ethiopia", "region": "Africa", "overall": 37, "rank": "109=", "likelyRank": "85 to 143", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Ethiopia passed a GDPR-style data law in 2024 and plans paperless hospitals by 2030, but patients have no portal and little control today.", "categories": { "access": { "score": 40, "summary": "The 2024 data protection law gives a free right of access with no fixed deadline, but key directives were still pending in late 2025 and there is no patient portal. Score: base 45, minus 5 no deadline, plus 5 portability, minus 5 enforcement rules pending.", "sources": [ { "title": "Personal Data Protection Proclamation No. 1321/2024 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt", "date": "2024-07-24", "publisherClass": "legal_text" }, { "title": "Health Service Administration and Regulation Proclamation No. 1362/2024 (Federal Negarit Gazette No. 45)", "url": "https://www.moh.gov.et/sites/default/files/2025-05/Proc_1362_Health_Service_Administration_and_Regulation_Proclamation.pdf", "date": "2025-05-20", "publisherClass": "legal_text" }, { "title": "ECA Launches Digital Portal to Enforce Data Protection (Addis Fortune)", "url": "https://addisfortune.news/eca-launches-digital-portal-to-enforce-data-protection", "date": "2025-11", "publisherClass": "news" } ] }, "control": { "score": 28, "summary": "Article 47 of Proclamation No. 1362/2024 lets records be used and shared for care, public health, research and legal purposes without asking the patient, and there is no opt-out or patient-visible access log. Scored 28, level with Nigeria, in the 20 to 35 band.", "sources": [ { "title": "Health Service Administration and Regulation Proclamation No. 1362/2024 (Federal Negarit Gazette No. 45)", "url": "https://www.moh.gov.et/sites/default/files/2025-05/Proc_1362_Health_Service_Administration_and_Regulation_Proclamation.pdf", "date": "2025-05-20", "publisherClass": "legal_text" }, { "title": "Personal Data Protection Proclamation No. 1321/2024 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt", "date": "2024-07-24", "publisherClass": "legal_text" }, { "title": "Ethiopia advances digital health integration through multitenant EMR initiative (TechReviewAfrica)", "url": "https://techreviewafrica.com/news/5063/ethiopia-advances-digital-health-integration-through-multitenant-emr-initiative", "date": "2026-04-21", "publisherClass": "news" } ] }, "privacy": { "score": 44, "summary": "Health data is sensitive data under the 2024 law, with 72-hour breach notice and fines up to 4% of worldwide turnover. But the enforcer is the telecom regulator, directives were pending in late 2025, and we found no enforcement record.", "sources": [ { "title": "Personal Data Protection Proclamation No. 1321/2024 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt", "date": "2024-07-24", "publisherClass": "legal_text" }, { "title": "Health Service Administration and Regulation Proclamation No. 1362/2024 (Federal Negarit Gazette No. 45)", "url": "https://www.moh.gov.et/sites/default/files/2025-05/Proc_1362_Health_Service_Administration_and_Regulation_Proclamation.pdf", "date": "2025-05-20", "publisherClass": "legal_text" }, { "title": "Food, Medicine and Health Care Administration and Control Council of Ministers Regulation No. 299/2013 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/re_299_2013/en/txt", "date": "2013", "publisherClass": "legal_text" }, { "title": "Ethiopia advances digital governance with national workshop on new data protection law (TechReviewAfrica)", "url": "https://techreviewafrica.com/news/3248/ethiopia-advances-digital-governance-with-national-workshop-on-new-data-protection-law", "date": "2025-11-25", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "National reporting runs on DHIS2 and the eCHIS community app reaches over 4,000 health posts and centers, but hospital records sit in separate EMR systems. The State Minister says just over 50 facilities are fully paperless.", "sources": [ { "title": "eCHIS (Ministry of Health)", "url": "https://www.moh.gov.et/projects-3-col/echis", "date": "undated", "publisherClass": "official" }, { "title": "Our Digital Health Systems (Ministry of Health)", "url": "https://www.moh.gov.et/digital-health-systems", "date": "undated", "publisherClass": "official" }, { "title": "Ethiopia Advances Regional Medical Tourism Ambitions Through Tertiary Healthcare Expansion and AI Integration (FANA)", "url": "https://www.fanamc.com/english/ethiopia-advances-regional-medical-tourism-ambitions-through-tertiary-healthcare-expansion-and-ai-integration/", "date": "2026-06-05", "publisherClass": "news" }, { "title": "Ethiopia advances digital health integration through multitenant EMR initiative (TechReviewAfrica)", "url": "https://techreviewafrica.com/news/5063/ethiopia-advances-digital-health-integration-through-multitenant-emr-initiative", "date": "2026-04-21", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "Selling or offering to sell personal data is a crime carrying five to ten years in prison, and people can object to direct marketing. A May 2026 directive also requires written consent from anyone in a health advertisement.", "sources": [ { "title": "Personal Data Protection Proclamation No. 1321/2024 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt", "date": "2024-07-24", "publisherClass": "legal_text" }, { "title": "Ministry Bans Patient Testimonials in Health Service Advertisements (The Reporter)", "url": "https://www.thereporterethiopia.com/50740/", "date": "2026-05-16", "publisherClass": "news" } ] }, "clinical": { "score": 24, "summary": "A clinician sees their own facility's chart, and eCHIS referrals link community workers to health centers. There is no verified shared record a doctor can open across hospitals; the Ministry describes centralised records as a 2030 goal.", "sources": [ { "title": "eCHIS (Ministry of Health)", "url": "https://www.moh.gov.et/projects-3-col/echis", "date": "undated", "publisherClass": "official" }, { "title": "Ethiopia Targets Universal Hospital Digitalization by 2030: Ministry of Health (ENA)", "url": "https://www.ena.et/web/eng/w/eng_8034652", "date": "2025-12-31", "publisherClass": "news" }, { "title": "Ethiopia advances digital health integration through multitenant EMR initiative (TechReviewAfrica)", "url": "https://techreviewafrica.com/news/5063/ethiopia-advances-digital-health-integration-through-multitenant-emr-initiative", "date": "2026-04-21", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Pseudonymised data may be used for research without consent and there is no opt-out, which sets a base of 40. Three safeguard classes (ethics approval, statutory confidentiality, re-identification penalties) add 9, for 49.", "sources": [ { "title": "Personal Data Protection Proclamation No. 1321/2024 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt", "date": "2024-07-24", "publisherClass": "legal_text" }, { "title": "Health Service Administration and Regulation Proclamation No. 1362/2024 (Federal Negarit Gazette No. 45)", "url": "https://www.moh.gov.et/sites/default/files/2025-05/Proc_1362_Health_Service_Administration_and_Regulation_Proclamation.pdf", "date": "2025-05-20", "publisherClass": "legal_text" }, { "title": "Food, Medicine and Health Care Administration and Control Council of Ministers Regulation No. 299/2013 (English text)", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/re_299_2013/en/txt", "date": "2013", "publisherClass": "legal_text" } ] }, "ai": { "score": 56, "summary": "The Ethiopian Food and Drug Authority's AI medical device guideline took effect in June 2026, with change control and rollback rules for learning models. Same regime as Rwanda, but scored in the lower half because most of the text says should, not shall.", "sources": [ { "title": "EFDA Guidelines for Software as Medical Device and Artificial Intelligence Based Medical Device (EFDA/GDL/094, v002)", "url": "https://www.efda.gov.et/wp-content/uploads/2026/07/EFDA-GDL-094-Guidelines-for-Software-as-Medical-Devices.pdf", "date": "2026-06-10", "publisherClass": "official" }, { "title": "Ethiopia Advances Regional Medical Tourism Ambitions Through Tertiary Healthcare Expansion and AI Integration (FANA)", "url": "https://www.fanamc.com/english/ethiopia-advances-regional-medical-tourism-ambitions-through-tertiary-healthcare-expansion-and-ai-integration/", "date": "2026-06-05", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Proclamation No. 1321/2024", "level": "National", "year": "2024", "what": "Health is sensitive data; free access right; 72-hour breach notice; selling personal data is a crime.", "url": "https://justice.gov.et/en/law/personal-data-protection-proclamation/" }, { "name": "Health Service Administration and Regulation Proclamation No. 1362/2024", "level": "National", "year": "2025", "what": "Consent-based care, health research consent and approval, confidential health information; repeals Proclamation No. 661.", "url": "https://www.moh.gov.et/sites/default/files/2025-05/Proc_1362_Health_Service_Administration_and_Regulation_Proclamation.pdf" }, { "name": "Council of Ministers Regulation No. 299/2013 (Food, Medicine and Health Care Administration)", "level": "National", "year": "2013", "what": "Professional confidentiality and clinical trial ethics committees. Status after the 2025 proclamation not verified.", "url": "https://www.metaappz.com/References/ethiopian_laws/federal/re_299_2013/en/txt" }, { "name": "EFDA Guidelines for Software as Medical Device and AI Based Medical Device (EFDA/GDL/094 v002)", "level": "National", "year": "2026", "what": "Registration rules for medical software and AI, including continuous learning, rollback and dataset controls.", "url": "https://www.efda.gov.et/wp-content/uploads/2026/07/EFDA-GDL-094-Guidelines-for-Software-as-Medical-Devices.pdf" }, { "name": "Directive on Production and Dissemination of Health Service Advertisement No. 1134/2026", "level": "National", "year": "2026", "what": "Bans treatment testimonials in health ads; written consent needed from anyone appearing. Text not opened; per The Reporter.", "url": "https://www.thereporterethiopia.com/50740/" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "JAM", "name": "Jamaica", "region": "Americas", "overall": 37, "rank": "109=", "likelyRank": "86 to 143", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Jamaica's data law took effect in December 2023, but many public records are still paper and eCare does not yet reach every public facility.", "categories": { "access": { "score": 40, "summary": "The Data Protection Act, 2020 (section 6) gives a right to a copy within 30 days, but on payment of a prescribed fee, which one ministry agency lists as J$100 per page. There is no national patient portal.", "sources": [ { "title": "The Data Protection Act, 2020 (Houses of Parliament)", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf", "date": "2020", "publisherClass": "legal_text" }, { "title": "Data Subjects Entitled to Know How Personal Information is Used (JIS)", "url": "https://jis.gov.jm/data-subjects-entitled-to-know-how-personal-information-is-used/", "date": "2026-01-30", "publisherClass": "official" }, { "title": "Health System Rests on Clearly Defined Patient Rights and Duties, Minister (JIS)", "url": "https://jis.gov.jm/health-system-rests-on-clearly-defined-patient-rights-and-duties-minister/", "date": "2026-06-17", "publisherClass": "official" }, { "title": "Data Protection (NEPA)", "url": "https://www.nepa.gov.jm/data-protection", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent when needed for medical purposes by a health professional, and no opt-out from eCare sharing or patient-visible access log was found. The patient's main levers are general rights to object and correct.", "sources": [ { "title": "The Data Protection Act, 2020 (Houses of Parliament)", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf", "date": "2020", "publisherClass": "legal_text" }, { "title": "EHR System Has Improved Efficiency at May Pen Hospital, Senior Medical Officer (JIS)", "url": "https://jis.gov.jm/ehr-system-has-improved-efficiency-at-may-pen-hospital-senior-medical-officer/", "date": "2026-08-10", "publisherClass": "official" } ] }, "privacy": { "score": 48, "summary": "The Act requires breach reports to the Commissioner within 72 hours and allows company fines up to 4 percent of worldwide turnover. In 2026 the National Health Fund confirmed a breach, with its data posted on a third-party site.", "sources": [ { "title": "The Data Protection Act, 2020 (Houses of Parliament)", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf", "date": "2020", "publisherClass": "legal_text" }, { "title": "Data Protection Act Takes Effect Today (JIS)", "url": "https://jis.gov.jm/data-protection-act-takes-effect-today/", "date": "2023-12-01", "publisherClass": "official" }, { "title": "Update on Cybersecurity Incident at the NHF (National Health Fund)", "url": "https://www.nhf.org.jm/news/update-on-cybersecurity-incident-at-the-nhf/", "date": "2026-07-03", "publisherClass": "official" }, { "title": "Hackers claim they have Jamaicans' medical records (Jamaica Star)", "url": "https://jamaica-star.com/article/news/20260610/hackers-claim-they-have-jamaicans-medical-records", "date": "2026-06-10", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "eCare launched at May Pen Hospital in January 2024, and by August 2026 'scores' of public institutions had access. In January 2026 western hospitals were drying hurricane-soaked paper files, and a regional director called record keeping 25 to 30 years behind.", "sources": [ { "title": "Contract Approved for Electronic Health Record Management System (JIS)", "url": "https://jis.gov.jm/contract-approved-for-electronic-health-record-management-system/", "date": "2022-11-23", "publisherClass": "official" }, { "title": "EHR System Has Improved Efficiency at May Pen Hospital, Senior Medical Officer (JIS)", "url": "https://jis.gov.jm/ehr-system-has-improved-efficiency-at-may-pen-hospital-senior-medical-officer/", "date": "2026-08-10", "publisherClass": "official" }, { "title": "Building a smarter, more resilient immunization system for Jamaica (PAHO)", "url": "https://www.paho.org/en/news/17-12-2025-building-smarter-more-resilient-immunization-system-jamaica", "date": "2025-12-17", "publisherClass": "intergov" }, { "title": "Medical records mess (Jamaica Observer)", "url": "https://www.jamaicaobserver.com/2026/01/19/medical-records-mess/", "date": "2026-01-19", "publisherClass": "news" } ] }, "commercial": { "score": 50, "summary": "Direct marketing needs consent or an existing customer link with a chance to object, and sensitive health data needs written consent outside listed purposes. No rules aimed at health apps or data brokers, and no enforcement on health data sales, were found.", "sources": [ { "title": "The Data Protection Act, 2020 (Houses of Parliament)", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf", "date": "2020", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "Where eCare runs, clinicians see history, medicines and allergies on screen, as the minister described at Spanish Town Hospital, plus imaging at participating sites. Many public sites and all private providers still rely on paper or separate systems.", "sources": [ { "title": "Contract Approved for Electronic Health Record Management System (JIS)", "url": "https://jis.gov.jm/contract-approved-for-electronic-health-record-management-system/", "date": "2022-11-23", "publisherClass": "official" }, { "title": "Significant Number of Medical Facilities Now Linked to the Electronic Health Records System (JIS)", "url": "https://jis.gov.jm/significant-number-of-medical-facilities-now-linked-to-the-electronic-health-records-system/", "date": "2024-11-07", "publisherClass": "official" }, { "title": "EHR System Has Improved Efficiency at May Pen Hospital, Senior Medical Officer (JIS)", "url": "https://jis.gov.jm/ehr-system-has-improved-efficiency-at-may-pen-hospital-senior-medical-officer/", "date": "2026-08-10", "publisherClass": "official" }, { "title": "Clicking into better care, May Pen Hospital sees gains from electronic health records system (Gleaner)", "url": "http://jamaica-gleaner.com/article/news/20260810/clicking-better-care-may-pen-hospital-sees-gains-electronic-health-records", "date": "2026-08-10", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Section 37 of the Data Protection Act allows research reuse of personal data without consent if not used for decisions about individuals. Ministry guidelines add ethics panel review and patient consent for identifiable record research, but there is no opt-out or register of uses.", "sources": [ { "title": "The Data Protection Act, 2020 (Houses of Parliament)", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf", "date": "2020", "publisherClass": "legal_text" }, { "title": "Guidelines for the Conduct of Research on Human Subjects (Ministry of Health and Wellness)", "url": "https://www.moh.gov.jm/guidelines/guidelines-for-the-conduct-of-research-on-human-subjects/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 25, "summary": "Medical devices are registered under the Food and Drugs Act, 1964, with no AI-specific rules found. In February 2026 the health ministry set up an advisory AI-TECH Council of Experts, but no binding guidance has followed.", "sources": [ { "title": "Registration of Medical Devices (Jamaica Trade Information Portal)", "url": "https://www.jamaicatradeportal.gov.jm/en-gb/search-form/view/98", "date": "2019-02-15", "publisherClass": "official" }, { "title": "Health ministry launches committees on ageing policy, AI (Gleaner)", "url": "http://jamaica-gleaner.com/article/news/20260212/health-ministry-launches-committees-ageing-policy-ai", "date": "2026-02-12", "publisherClass": "news" }, { "title": "Tufton hails AI-powered imaging centre (Gleaner)", "url": "http://jamaica-gleaner.com/article/news/20260801/tufton-hails-ai-powered-imaging-centre", "date": "2026-08-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2020", "level": "National", "year": "2020", "what": "Health data sensitive; access right; 72-hour breach reports; fines up to 4 percent of turnover; in force December 2023.", "url": "https://japarliament.gov.jm/attachments/article/339/The%20Data%20Protection%20Act,%202020.pdf" }, { "name": "Data Protection Regulations, 2024", "level": "National", "year": "2024", "what": "Prescribed forms and fees for access requests, including Form 2 (text not opened).", "url": "https://jis.gov.jm/data-subjects-entitled-to-know-how-personal-information-is-used/" }, { "name": "Food and Drugs Act, 1964", "level": "National", "year": "1964", "what": "Basis for registration of drugs and medical devices by the Ministry of Health and Wellness.", "url": "https://www.jamaicatradeportal.gov.jm/en-gb/search-form/view/98" }, { "name": "Patients Charter (Ministry of Health and Wellness)", "level": "National", "year": "undated", "what": "Ministry policy charter, not statute: informed consent, confidentiality, and access to view or copy records.", "url": "https://jis.gov.jm/health-system-rests-on-clearly-defined-patient-rights-and-duties-minister/" }, { "name": "Guidelines for the Conduct of Research on Human Subjects (Ministry of Health and Wellness)", "level": "National", "year": "undated", "what": "Policy guidelines: ethics panel approval; consent for identifiable medical record research.", "url": "https://www.moh.gov.jm/guidelines/guidelines-for-the-conduct-of-research-on-human-subjects/" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-10", "headline": "Hackers claim to hold medication data on National Health Fund clients", "paraphrase": "The National Health Fund confirmed a cyber incident after a hacker group said it held clients' medication data. The fund reported it to the Information Commissioner and police investigators and said affected stakeholders were contacted.", "source": "The Gleaner", "url": "https://jamaica-gleaner.com/article/news/20260610/tufton-hackers-claim-access-nhf-client-medical-data-moca-called", "theme": "breach", "status": "admitted" } ] }, { "iso3": "XKX", "name": "Kosovo", "region": "Europe", "overall": 37, "rank": "109=", "likelyRank": "84 to 141", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Kosovo has a GDPR-style data law and a right to see the record, but care runs on unlinked systems and no patient portal was found.", "categories": { "access": { "score": 45, "summary": "Two laws give a right to a copy: the 2019 data law makes the first copy free within one month, but the patient rights law puts copies at the patient's cost. With no national portal, the free copy (+5) and the charge (-5) cancel at 45.", "sources": [ { "title": "Ligji Nr. 2004/38 për të drejtat dhe përgjegjësitë e banorëve të Kosovës në sistemin shëndetësor (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=2454", "date": "2007-06-01", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 06/L-082 për mbrojtjen e të dhënave personale (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 08/L-051 për ndryshimin dhe plotësimin e Ligjit Nr. 2004/38 (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=53141", "date": "2022-01-19", "publisherClass": "legal_text" }, { "title": "Project Information Document, KOMPAS Additional Financing, P179831 (World Bank)", "url": "https://documents.worldbank.org/curated/en/099060226110535583/pdf/P179831-216ae05d-5c28-4139-a053-f1e6433717f0.pdf", "date": "2026-06-02", "publisherClass": "intergov" } ] }, "control": { "score": 30, "summary": "Health institutions own the data they record and must report it to the national health information system, with no opt-out or patient-visible access log found. A 2004 law lets patients name who may learn of their illness, but its use in practice was not verified.", "sources": [ { "title": "Ligji Nr. 04/L-125 për shëndetësi (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=8666", "date": "2013-05-07", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 06/L-082 për mbrojtjen e të dhënave personale (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 2004/38 për të drejtat dhe përgjegjësitë e banorëve të Kosovës në sistemin shëndetësor (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=2454", "date": "2007-06-01", "publisherClass": "legal_text" } ] }, "privacy": { "score": 52, "summary": "The European Commission says Kosovo's data law is mostly aligned with the GDPR; it sets 72-hour breach notice and fines of EUR 20,000 to 40,000 or 2 to 4% of turnover. The regulator ran 41 health inspections in 2025, but no health-sector fine was verified.", "sources": [ { "title": "Ligji Nr. 06/L-082 për mbrojtjen e të dhënave personale (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Raporti Vjetor i Performancës për vitin 2025, Agjencia për Informim dhe Privatësi (not yet approved by the Assembly)", "url": "https://aip.rks-gov.net/download/raporti-vjetor-i-performances-se-agjencise-2026-sqarim-raporti-nuk-eshte-aprovuar-akoma-nga-kuvendi-i-republikes-se-kosoves/?wpdmdl=11544", "date": "2026-03", "publisherClass": "official" }, { "title": "Kosovo 2025 Report, SWD(2025) 752 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/127563ea-4c03-44a4-b56c-2d569afd86a5_en?filename=kosovo-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "United Nations Interim Administration Mission in Kosovo, Report of the Secretary-General, S/2026/264", "url": "https://documents.un.org/api/symbol/access?s=S/2026/264&l=en&t=pdf", "date": "2026-04-01", "publisherClass": "intergov" } ] }, "journey": { "score": 25, "summary": "The World Bank calls Kosovo the only Western Balkan country without a fully integrated health information system: registration, records and lab systems run in silos. At 2024 baselines, unchanged in March 2026, no hospital used its planned system and no specialist visit had an electronic referral.", "sources": [ { "title": "Project Information Document, KOMPAS Additional Financing, P179831 (World Bank)", "url": "https://documents.worldbank.org/curated/en/099060226110535583/pdf/P179831-216ae05d-5c28-4139-a053-f1e6433717f0.pdf", "date": "2026-06-02", "publisherClass": "intergov" }, { "title": "Implementation Status and Results Report No. 4, KOMPAS, P179831 (World Bank)", "url": "https://documents.worldbank.org/curated/en/099032826054039349/pdf/P179831-38f6245a-1872-4724-a536-a2961ac667e4.pdf", "date": "2026-03-28", "publisherClass": "intergov" }, { "title": "Applying the Digital Health Blueprint Toolkit in Kosovo (World Bank case study)", "url": "https://thedocs.worldbank.org/en/doc/b929829fc3d36bebdf9d93555c64f222-0140022024/related/Digital-Health-Blueprint-Toolkit-Kosovo-Case-Study.pdf", "date": "undated", "publisherClass": "intergov" }, { "title": "United Nations Interim Administration Mission in Kosovo, Report of the Secretary-General, S/2026/264", "url": "https://documents.un.org/api/symbol/access?s=S/2026/264&l=en&t=pdf", "date": "2026-04-01", "publisherClass": "intergov" } ] }, "commercial": { "score": 46, "summary": "Direct marketing may use sensitive data, including health data, only with the person's written consent, and people can object at any time. Fines for marketing breaches are EUR 4,000 to 10,000, and no ban on selling health data was found.", "sources": [ { "title": "Ligji Nr. 06/L-082 për mbrojtjen e të dhënave personale (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 10/L-028 për sigurimin e detyrueshëm të kujdesit shëndetësor (Ministria e Shëndetësisë copy)", "url": "https://msh.rks-gov.net/Documents/DownloadDocument?fileName=Ligji50366005.2673.pdf", "date": "2026-05-15", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "No shared record lets a clinician see care from other providers, and the World Bank says fragmentation blocks coordination across levels. The law only requires electronic access or a written note on referral, and data opens only where recorded.", "sources": [ { "title": "Ligji Nr. 04/L-125 për shëndetësi (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=8666", "date": "2013-05-07", "publisherClass": "legal_text" }, { "title": "MSH me strategji por Projektligji për SISH-in mbeti në pragun e Kuvendit (Dukagjini)", "url": "https://www.dukagjini.com/msh-me-strategji-por-projektligji-per-sish-in-mbeti-ne-pragun-e-kuvendit/", "date": "2025-04-20", "publisherClass": "news" }, { "title": "Project Information Document, KOMPAS Additional Financing, P179831 (World Bank)", "url": "https://documents.worldbank.org/curated/en/099060226110535583/pdf/P179831-216ae05d-5c28-4139-a053-f1e6433717f0.pdf", "date": "2026-06-02", "publisherClass": "intergov" }, { "title": "Ligji Nr. 2004/38 për të drejtat dhe përgjegjësitë e banorëve të Kosovës në sistemin shëndetësor (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=2454", "date": "2007-06-01", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "The data law allows research use of health data without consent and with no general opt-out, subject to proportionality and safeguards. Two safeguard classes count: professional secrecy where needed, and fines of EUR 20,000 to 40,000 for unlawful processing of sensitive data.", "sources": [ { "title": "Ligji Nr. 06/L-082 për mbrojtjen e të dhënave personale (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616", "date": "2019-02-25", "publisherClass": "legal_text" }, { "title": "Ligji Nr. 04/L-125 për shëndetësi (Gazeta Zyrtare)", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=8666", "date": "2013-05-07", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No rules for clinical AI were found. The European Commission invites Kosovo to align with the EU AI Act, and a readiness assessment began in 2026; the privacy regulator says the data law has no AI-specific rules.", "sources": [ { "title": "Kosovo 2025 Report, SWD(2025) 752 (European Commission)", "url": "https://enlargement.ec.europa.eu/document/download/127563ea-4c03-44a4-b56c-2d569afd86a5_en?filename=kosovo-report-2025.pdf", "date": "2025-11-04", "publisherClass": "intergov" }, { "title": "Inteligjenca Artificiale pa kontroll në Ballkanin Perëndimor (Zhurnal.mk, citing Radio Evropa e Lirë)", "url": "https://zhurnal.mk/inteligjenca-artificiale-pa-kontroll-ne-ballkanin-perendimor/", "date": "2026-07-02", "publisherClass": "news" }, { "title": "Ligji Nr. 04/L-190 për produkte dhe pajisje medicinale (Gazeta Zyrtare record)", "url": "https://gzk.rks-gov.net/ActDetail.aspx?ActID=9437", "date": "2014-04-25", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law No. 06/L-082 on Protection of Personal Data", "level": "National", "year": "2019", "what": "GDPR-style law: health as special category, access in one month, 72-hour breach notice, independent agency.", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=18616" }, { "name": "Law No. 2004/38 on the Rights and Responsibilities of Kosovo Residents in the Health Care System", "level": "National", "year": "2004", "what": "Patient rights: see and copy health documentation, correction, confidentiality, naming who may be informed.", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=2454" }, { "name": "Law No. 08/L-051 amending Law No. 2004/38", "level": "National", "year": "2022", "what": "Adds fines of EUR 500 to 15,000 on health institutions that breach patient rights.", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=53141" }, { "name": "Law No. 04/L-125 on Health", "level": "National", "year": "2013", "what": "Organises health care; requires all institutions to report data to the single health information system.", "url": "https://gzk.rks-gov.net/ActDocumentDetail.aspx?ActID=8666" }, { "name": "Law No. 10/L-028 on Compulsory Health Care Insurance", "level": "National", "year": "2026", "what": "Creates a compulsory health insurance Fund and its single register; limits sharing of insured people's data.", "url": "https://msh.rks-gov.net/Documents/DownloadDocument?fileName=Ligji50366005.2673.pdf" }, { "name": "Law No. 04/L-190 on Medicinal Products and Medical Devices", "level": "National", "year": "2014", "what": "Regulates medicines and medical devices; amended 2022.", "url": "https://gzk.rks-gov.net/ActDetail.aspx?ActID=9437" } ], "dti": { "grade": 81, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [] }, { "iso3": "TUN", "name": "Tunisia", "region": "Africa", "overall": 37, "rank": "109=", "likelyRank": "87 to 143", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Patients won a legal right to a full record copy in 2024, but records stay mostly on paper and the national portal is not live.", "categories": { "access": { "score": 40, "summary": "Law 2024-32 gives patients the right to a complete copy of their medical record, but sets no deadline or fee rule. The 2004 data law's free copy within one month does not apply to public health establishments, and no national portal is live.", "sources": [ { "title": "Loi n° 2024-32 du 19 juin 2024 relative aux droits des bénéficiaires des services de santé et à la responsabilité médicale (JORT n° 75)", "url": "https://www.jurisitetunisie.com/download_jort.php?f=L2024_0032-F2024_075.pdf", "date": "2024-06-20", "publisherClass": "legal_text" }, { "title": "Loi organique n° 2004-63 du 27 juillet 2004 sur la protection des données à caractère personnel (INS)", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf", "date": "2004-07-27", "publisherClass": "legal_text" }, { "title": "Dossier médical électronique : ce qui va changer pour les Tunisiens (La Presse)", "url": "https://www.lapresse.tn/2026/06/22/dossier-medical-electronique-ce-qui-va-changer-pour-les-tunisiens/", "date": "2026-06-22", "publisherClass": "news" }, { "title": "Numérisation de la santé : le ministère s'apprête à lancer le portail d'accès unique Sahetna.tn (La Presse)", "url": "https://www.lapresse.tn/2026/07/21/numerisation-de-la-sante-le-ministere-sapprete-a-lancer-le-portail-dacces-unique-sahetna-tn/", "date": "2026-07-21", "publisherClass": "news" } ] }, "control": { "score": 35, "summary": "Health data needs consent under the 2004 law, but the law also allows processing without consent for legal duties, public health, care and research. No opt-out, granular choice or patient-visible access log exists for the new national identifier.", "sources": [ { "title": "Loi organique n° 2004-63 du 27 juillet 2004 sur la protection des données à caractère personnel (INS)", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf", "date": "2004-07-27", "publisherClass": "legal_text" }, { "title": "Santé en Tunisie : un dossier médical unique pour chaque patient à Kébili (Tunisie Numérique)", "url": "https://www.tunisienumerique.com/sante-en-tunisie-un-dossier-medical-unique-pour-chaque-patient-a-kebili/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "Numérisation de la santé : le ministère s'apprête à lancer le portail d'accès unique Sahetna.tn (La Presse)", "url": "https://www.lapresse.tn/2026/07/21/numerisation-de-la-sante-le-ministere-sapprete-a-lancer-le-portail-dacces-unique-sahetna-tn/", "date": "2026-07-21", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health data has its own chapter in the 2004 law, with two years in prison for unlawful processing by unauthorised staff, and Tunisia joined Council of Europe Convention 108 in 2017. But the law has no breach notification duty and gives public bodies wide exemptions.", "sources": [ { "title": "Loi organique n° 2004-63 du 27 juillet 2004 sur la protection des données à caractère personnel (INS)", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf", "date": "2004-07-27", "publisherClass": "legal_text" }, { "title": "Décret présidentiel n° 2017-75 du 30 mai 2017 ratifiant l'adhésion à la Convention 108 et au Protocole 181 (Legislation-securite.tn)", "url": "https://legislation-securite.tn/latest-laws/decret-presidentiel-n-2017-75-du-30-mai-2017-portant-ratification-de-ladhesion-de-la-republique-tunisienne-a-la-convention-n-108-du-conseil-de-leurope-pour-la-protection-des-pe/", "date": "2017-05-30", "publisherClass": "legal_text" }, { "title": "Éclairages sur le projet de loi lié à la protection des données personnelles (African Manager)", "url": "https://africanmanager.com/eclairages-sur-le-projet-de-loi-lie-a-la-protection-des-donnees-personnelles/", "date": "2026-02-26", "publisherClass": "news" }, { "title": "Data protection adequacy for non-EU countries (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 30, "summary": "A World Bank review found Tunisia's health system 'largely paper-based': in emergency care only 32% of regional hospitals had a fully used electronic record, and district hospitals and primary care centres have none. A national health identifier is being rolled out to link records.", "sources": [ { "title": "Tunisia Health System Strengthening Project (P507209), Appraisal Project Information Document (World Bank)", "url": "https://documents.worldbank.org/curated/en/099040225000532312/pdf/P507209-7bb7c459-f516-4ffe-a638-bc2583cfd224.pdf", "date": "2025-04-02", "publisherClass": "intergov" }, { "title": "Implementation Status and Results Report, P507209, Seq. 2 (World Bank)", "url": "https://documents.worldbank.org/curated/en/099042826020528732/pdf/P507209-77ad182b-71d9-4e2b-95d4-0b52e0ce7070.pdf", "date": "2026-04-28", "publisherClass": "intergov" }, { "title": "Santé numérique : la Tunisie mise sur l'intelligence artificielle pour transformer son système de soins (L'Economiste Maghrébin)", "url": "https://www.leconomistemaghrebin.com/2026/07/21/sante-numerique-la-tunisie-mise-sur-lintelligence-artificielle-pour-transformer-son-systeme-de-soins/", "date": "2026-07-21", "publisherClass": "news" }, { "title": "وزارة الصحة تشرع في تركيز منظومة e-pharmacie لترشيد استهلاك الأدوية وتتبعها (Diwan FM)", "url": "https://diwanfm.net/news/%D9%88%D8%B7%D9%86%D9%8A%D8%A9/%D9%88%D8%B2%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%AA%D8%B4%D8%B1%D8%B9-%D9%81%D9%8A-%D8%AA%D8%B1%D9%83%D9%8A%D8%B2-%D9%85%D9%86%D8%B8%D9%88%D9%85%D8%A9-%22e-pharmacie%22-%D9%84%D8%AA%D8%B1%D8%B4%D9%8A%D8%AF-%D8%A7%D8%B3%D8%AA%D9%87%D9%84%D8%A7%D9%83-%D8%A7%D9%84%D8%A3%D8%AF%D9%88%D9%8A%D8%A9-%D9%88%D8%AA%D8%AA%D8%A8%D8%B9%D9%87%D8%A7", "date": "2026-03-19", "publisherClass": "news" } ] }, "commercial": { "score": 44, "summary": "The 2004 law bans using personal data for advertising without express, specific consent and lets people block transfers to third parties for advertising. It punishes passing on data for profit, but has no rules on data brokers, health apps or de-identified data sales, as in Morocco.", "sources": [ { "title": "Loi organique n° 2004-63 du 27 juillet 2004 sur la protection des données à caractère personnel (INS)", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf", "date": "2004-07-27", "publisherClass": "legal_text" }, { "title": "La protection des données personnelles comme révélateur de l'État de droit en Tunisie (Village de la Justice)", "url": "https://www.village-justice.com/articles/protection-des-donnees-personnelles-comme-revelateur-etat-droit-tunisie,56084.html", "date": "2026-02-06", "publisherClass": "law_firm" } ] }, "clinical": { "score": 28, "summary": "There is no national exchange letting a treating clinician see records from other providers. Emergency services still use paper reports that do not link to hospital records, and the identifier meant to connect files was still being rolled out in 2026.", "sources": [ { "title": "Tunisia Health System Strengthening Project (P507209), Appraisal Project Information Document (World Bank)", "url": "https://documents.worldbank.org/curated/en/099040225000532312/pdf/P507209-7bb7c459-f516-4ffe-a638-bc2583cfd224.pdf", "date": "2025-04-02", "publisherClass": "intergov" }, { "title": "Santé en Tunisie : un dossier médical unique pour chaque patient à Kébili (Tunisie Numérique)", "url": "https://www.tunisienumerique.com/sante-en-tunisie-un-dossier-medical-unique-pour-chaque-patient-a-kebili/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "Santé numérique : la Tunisie mise sur l'intelligence artificielle pour transformer son système de soins (L'Economiste Maghrébin)", "url": "https://www.leconomistemaghrebin.com/2026/07/21/sante-numerique-la-tunisie-mise-sur-lintelligence-artificielle-pour-transformer-son-systeme-de-soins/", "date": "2026-07-21", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Health data may be used for research without consent under the 2004 law, with no general opt-out. Safeguards include ethics committees for trials, secrecy and de-identification duties, and prison terms for publishing research data without consent.", "sources": [ { "title": "Loi organique n° 2004-63 du 27 juillet 2004 sur la protection des données à caractère personnel (INS)", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf", "date": "2004-07-27", "publisherClass": "legal_text" }, { "title": "Essai clinique : réglementation (Direction de la Pharmacie et du Médicament)", "url": "https://dpm.tn/essai-clinique-reglementation", "date": "2017-09-07", "publisherClass": "official" } ] }, "ai": { "score": 27, "summary": "Tunisia has no binding rules for clinical AI. A national AI strategy names digital health a priority and the ministry says doctors keep the final decision, but legal frameworks for AI are still being drafted.", "sources": [ { "title": "Tunisie : la stratégie nationale de l'IA mise sur la santé, l'agriculture et la souveraineté numérique (WMC)", "url": "https://www.webmanagercenter.com/2026/05/25/567341/tunisie-la-strategie-nationale-de-lia-mise-sur-la-sante-lagriculture-et-la-souverainete-numerique/", "date": "2026-05-25", "publisherClass": "news" }, { "title": "Santé numérique : la Tunisie mise sur l'intelligence artificielle pour transformer son système de soins (L'Economiste Maghrébin)", "url": "https://www.leconomistemaghrebin.com/2026/07/21/sante-numerique-la-tunisie-mise-sur-lintelligence-artificielle-pour-transformer-son-systeme-de-soins/", "date": "2026-07-21", "publisherClass": "news" }, { "title": "Loi n° 2023-2 du 12 juillet 2023 portant création de l'Agence nationale du médicament et des produits de santé (9anoun, JORT 2023-072)", "url": "https://9anoun.tn/fr/kb/jorts/jort-2023-072-cb77f/loi-ndeg-2023-2-du-12-juillet-2023-portant-creation-de-lagence-nationale-du-medicament-et-des-produits-de-sante-2", "date": "2023-07-12", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Loi organique n° 2004-63 sur la protection des données à caractère personnel", "level": "National", "year": "2004", "what": "Health is sensitive; processing by secrecy-bound staff; access and objection rights; INPDP regulator; criminal penalties.", "url": "https://www.ins.tn/sites/default/files/2020-04/Loi%2063-2004%20Fr.pdf" }, { "name": "Loi n° 2024-32 relative aux droits des bénéficiaires des services de santé et à la responsabilité médicale", "level": "National", "year": "2024", "what": "Informed written consent for treatment; privacy of record data; right to a complete copy of the record.", "url": "https://www.jurisitetunisie.com/download_jort.php?f=L2024_0032-F2024_075.pdf" }, { "name": "Loi organique n° 2017-42 and Décret présidentiel n° 2017-75 (Convention 108 and Protocol 181)", "level": "Supranational", "year": "2017", "what": "Tunisia joins the Council of Europe data protection convention and its supervisory authority protocol.", "url": "https://legislation-securite.tn/latest-laws/decret-presidentiel-n-2017-75-du-30-mai-2017-portant-ratification-de-ladhesion-de-la-republique-tunisienne-a-la-convention-n-108-du-conseil-de-leurope-pour-la-protection-des-pe/" }, { "name": "Décret n° 90-1401 on medical or scientific experimentation of medicines", "level": "National", "year": "1990", "what": "Rules for drug trials, with 2015 orders on protection committees and an informed consent form.", "url": "https://dpm.tn/essai-clinique-reglementation" }, { "name": "Loi n° 2023-2 portant création de l'Agence nationale du médicament et des produits de santé", "level": "National", "year": "2023", "what": "Creates ANMPS to authorise, suspend and oversee medicines and health products.", "url": "https://9anoun.tn/fr/kb/jorts/jort-2023-072-cb77f/loi-ndeg-2023-2-du-12-juillet-2023-portant-creation-de-lagence-nationale-du-medicament-et-des-produits-de-sante-2" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-01", "headline": "Official website lists disabled taxi licence holders, exposing their health status", "paraphrase": "An investigative outlet found that a regional authority published online a named list of disabled people holding taxi licences, revealing health information about each person, while the national data protection regulator remains frozen.", "source": "Nawaat", "url": "https://nawaat.org/2026/09/01/%D8%B5%D9%81%D8%AD%D8%A7%D8%AA-%D9%88%D9%85%D9%88%D8%A7%D9%82%D8%B9-%D8%B1%D8%B3%D9%85%D9%8A%D8%A9-%D8%AA%D8%B9%D8%B7%D9%8A-%D8%A7%D9%84%D9%85%D8%AB%D8%A7%D9%84-%D9%81%D9%8A-%D8%A7%D9%86%D8%AA/", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-06-25", "headline": "Former detainee says his medical file was ignored after a prison transfer", "paraphrase": "A man held in several prisons says that after he was moved to a new prison, staff ignored his medical file, and care arrangements agreed at earlier prisons were dropped.", "source": "Inkyfada", "url": "https://inkyfada.com/fr/2026/06/25/negligences-medicales-prisons-tunisiennes/", "theme": "lost_between_providers", "status": "self_reported" }, { "date": "2025-12-22", "headline": "Patients carry paper files between hospitals whose computer systems do not connect", "paraphrase": "A reporter found patients from inland regions carrying bags of scans and test results between hospitals, because regional and university hospital systems do not share data. An older patient said nothing moves unless he hands over paper in person.", "source": "Ultra Tunisia", "url": "https://ultratunisia.ultrasawt.com/%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D9%81%D9%8A-%D8%AA%D9%88%D9%86%D8%B3-%D9%85%D8%B9%D8%A7%D9%86%D8%A7%D8%A9-%D8%AD%D9%82%D9%8A%D9%82%D9%8A%D8%A9-%D9%84%D9%84%D9%85%D8%B1%D8%B6%D9%89-%D9%88%D9%85%D8%B3%D8%A7%D8%B9%D9%8D-%D9%84%D9%84%D8%B1%D9%82%D9%85%D9%86%D8%A9/%D8%A3%D8%B3%D9%85%D8%A7%D8%A1-%D8%A7%D9%84%D8%A8%D9%83%D9%88%D8%B4/%D9%85%D8%AC%D8%AA%D9%85%D8%B9/%D8%AA%D9%82%D8%A7%D8%B1%DB%8C%D8%B1", "theme": "lost_between_providers", "status": "self_reported" } ] }, { "iso3": "VAT", "name": "Vatican City", "region": "Europe", "overall": 37, "rank": "109=", "likelyRank": "85 to 142", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Vatican care runs through one polyclinic and a staff health fund; a 2024 data law sets a right of access but no fines.", "categories": { "access": { "score": 40, "summary": "Decree DCLVII of 2024 gives a right to a copy of one's data within 30 working days, with only extra copies charged. It binds only the Governatorato, a data protection complaint ends in a final order, separate court action remains available, and there is no patient portal.", "sources": [ { "title": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali, 30 aprile 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf", "date": "2024-04-30", "publisherClass": "legal_text" }, { "title": "Referti online (Direzione di Sanità e Igiene)", "url": "https://dsi.va/referti", "date": "undated", "publisherClass": "official" }, { "title": "Fruitori: chi può usufruire dell'assistenza (Direzione di Sanità e Igiene)", "url": "https://dsi.va/assistenza/fruitori", "date": "undated", "publisherClass": "official" }, { "title": "Informazioni Sportello Unico (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/informazioni-sportello-unico.html", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be used for care without consent, and the right to object gives way to public interest. We found no patient-visible access log and no shared record to opt out of.", "sources": [ { "title": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali, 30 aprile 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf", "date": "2024-04-30", "publisherClass": "legal_text" }, { "title": "Informazioni Sportello Unico (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/informazioni-sportello-unico.html", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "Decree DCLVII treats health as a special category and requires internal breach reports within 72 hours. It has no fines, its overseer is the state's General Counsellor, and it runs on a three-year trial from April 2024.", "sources": [ { "title": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali, 30 aprile 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf", "date": "2024-04-30", "publisherClass": "legal_text" }, { "title": "Protezione dati nella Chiesa, la legge privacy del Vaticano: peculiarità rispetto al GDPR (Cybersecurity360)", "url": "https://www.cybersecurity360.it/legal/privacy-dati-personali/protezione-dati-nella-chiesa-la-legge-privacy-del-vaticano-peculiarita-rispetto-al-gdpr/", "date": "2024-07-11", "publisherClass": "news" }, { "title": "The European Union and the Holy See (EEAS, EU Delegation to the Holy See)", "url": "https://www.eeas.europa.eu/un-rome/european-union-and-holy-see_en", "date": "undated", "publisherClass": "intergov" }, { "title": "Norme a tutela della dignità della persona negli accertamenti sanitari e dei dipendenti affetti da gravi patologie, Segreteria di Stato (ULSA, Bollettino 33)", "url": "https://www.ulsa.va/it/pubblicazioni/bollettini/bollettino-n-33-2025/testi-aggiornati/Norme_Privacy_gravipatologie1.html", "date": "2011-11-18", "publisherClass": "legal_text" } ] }, "journey": { "score": 30, "summary": "Care is split between the Vatican polyclinic and FAS-contracted doctors, clinics and hospitals in the Rome area. Referrals go by email and refunds on paper, with a copy of the hospital chart, and no shared electronic record was found.", "sources": [ { "title": "Informazioni Sportello Unico (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/informazioni-sportello-unico.html", "date": "undated", "publisherClass": "official" }, { "title": "Assistenza diretta (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/carta-servizi/assistenza-diretta.html", "date": "undated", "publisherClass": "official" }, { "title": "Regolamento del Fondo Assistenza Sanitaria, testo consolidato (ULSA, Bollettino 33)", "url": "https://www.ulsa.va/it/pubblicazioni/bollettini/bollettino-n-33-2025/testi-aggiornati/regolamento-del-fondo-assistenza-sanitaria11.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "Carta Servizi (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/carta-servizi.html", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 45, "summary": "Health data may be processed only on listed grounds, and people can object to direct marketing at any time. We found no Vatican rule on health apps, data brokers or sale of de-identified data.", "sources": [ { "title": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali, 30 aprile 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf", "date": "2024-04-30", "publisherClass": "legal_text" }, { "title": "The European Union and the Holy See (EEAS, EU Delegation to the Holy See)", "url": "https://www.eeas.europa.eu/un-rome/european-union-and-holy-see_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 33, "summary": "DSI doctors hold the polyclinic's own visits and lab results, but what they can see from the outside hospitals where inpatient care happens was not verified. The score stays in the lower half of the weak band.", "sources": [ { "title": "Poliambulatorio (Direzione di Sanità e Igiene)", "url": "https://dsi.va/assistenza/poliambulatorio", "date": "undated", "publisherClass": "official" }, { "title": "Assistenza diretta (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/carta-servizi/assistenza-diretta.html", "date": "undated", "publisherClass": "official" }, { "title": "Carta Servizi (Fondo Assistenza Sanitaria)", "url": "https://www.fas.va/content/fas/it/servizi-procedure/carta-servizi.html", "date": "undated", "publisherClass": "official" }, { "title": "Funzioni e competenze (Direzione di Sanità e Igiene)", "url": "https://dsi.va/direzione/funzioni-competenze", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 40, "summary": "Decree DCLVII allows health data to be used for scientific research without consent if proportionate and protected, and research use is exempt from deletion. There is no opt-out, and no Vatican ethics or permit body was found.", "sources": [ { "title": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali, 30 aprile 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf", "date": "2024-04-30", "publisherClass": "legal_text" } ] }, "ai": { "score": 48, "summary": "Decree DCCII of December 2024 binds Governatorato bodies to AI principles: DSI patients must be told when AI is used, and AI must not limit doctors' judgment. It is not device regulation, so it scores as guidance.", "sources": [ { "title": "Decreto N. DCCII, Linee Guida in materia di intelligenza artificiale, 16 dicembre 2024 (ULSA, Bollettino 32)", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/3_Linee-Guida-in-materia-di-intelligenza-artificiale.pdf", "date": "2024-12-16", "publisherClass": "legal_text" }, { "title": "Normativa generale (Governatorato dello Stato della Città del Vaticano)", "url": "https://www.vaticanstate.va/it/stato-e-governo/legislazione-e-normativa/normativa-generale.html", "date": "undated", "publisherClass": "official" }, { "title": "The European Union and the Holy See (EEAS, EU Delegation to the Holy See)", "url": "https://www.eeas.europa.eu/un-rome/european-union-and-holy-see_en", "date": "undated", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Decreto N. DCLVII, Regolamento Generale sulla protezione dei Dati personali", "level": "National", "year": "2024", "what": "GDPR-style rules for the Governatorato; access copy in 30 working days; no fines; three-year trial.", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/1_Regolamento-Generale-sulla-protezione-dei-Dati-personali.pdf" }, { "name": "Decreto N. DCCII, Linee Guida in materia di intelligenza artificiale", "level": "National", "year": "2024", "what": "AI principles for Governatorato bodies; patients told of AI in Directorate of Health and Hygiene (DSI) care; doctors keep decisions.", "url": "https://www.ulsa.va/content/dam/ulsa/documenti/bollettino_32_2024/atti-governatorato/3_Linee-Guida-in-materia-di-intelligenza-artificiale.pdf" }, { "name": "Statuto del Fondo Assistenza Sanitaria (FAS)", "level": "National", "year": "2016", "what": "Sets up the health fund for Holy See and Governatorato staff; care entrusted to the Directorate of Health and Hygiene (DSI).", "url": "https://www.ulsa.va/it/pubblicazioni/norme-e-documenti/statuto-del-fondo-assistenza-sanitaria--fas-.html" }, { "name": "Regolamento del Fondo Assistenza Sanitaria (FAS)", "level": "National", "year": "2016", "what": "Rules on enrolment, direct and indirect care, prior approval, drug supply and refunds.", "url": "https://www.ulsa.va/it/pubblicazioni/bollettini/bollettino-n-33-2025/testi-aggiornati/regolamento-del-fondo-assistenza-sanitaria11.html" }, { "name": "Norme per la tutela della dignità della persona negli accertamenti sanitari del personale (Segreteria di Stato)", "level": "National", "year": "2011", "what": "Directorate of Health and Hygiene (DSI) staff health checks: office secrecy, right to see and correct health data, copies of records.", "url": "https://www.ulsa.va/it/pubblicazioni/bollettini/bollettino-n-33-2025/testi-aggiornati/Norme_Privacy_gravipatologie1.html" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [] }, { "iso3": "CPV", "name": "Cape Verde", "region": "Africa", "overall": 36, "rank": "116=", "likelyRank": "90 to 148", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Cape Verde has a modern data law and a right to see your records, but the promised digital record is not yet open to patients.", "categories": { "access": { "score": 35, "summary": "Two laws give a right to see your records, but the data law routes health data through a doctor you choose and sets no deadline. The Nha Card e-Saúde portal books visits and tests; whether it shows your results was not verified.", "sources": [ { "title": "Lei n.º 41/VI/2004, Bases do Serviço Nacional de Saúde, Boletim Oficial I Série n.º 10 (copy with the medical code of ethics)", "url": "https://ct-luso.com/pluginfile.php/46/mod_page/content/49/Lei%20de%20base%20SNS%20e%20C%C3%B3digo%20deontol%C3%B3gico%20dos%20M%C3%A9dicos.pdf", "date": "2004-04-05", "publisherClass": "legal_text" }, { "title": "Lei n.º 121/IX/2021, second amendment and republication of the general data protection regime (Lei n.º 133/V/2001), and Lei n.º 120/IX/2021 on the CNPD, Boletim Oficial I Série n.º 28 (ARC copy)", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf", "date": "2021-03-17", "publisherClass": "legal_text" }, { "title": "Nha Card e-Saúde portal (Governo de Cabo Verde)", "url": "https://nhacard-esaude.gov.cv/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be used for care without consent when handled by a professional bound by secrecy and notified to the regulator. There is no shared record yet, so no sharing setting, opt-out or access log exists for patients.", "sources": [ { "title": "Lei n.º 121/IX/2021, second amendment and republication of the general data protection regime (Lei n.º 133/V/2001), and Lei n.º 120/IX/2021 on the CNPD, Boletim Oficial I Série n.º 28 (ARC copy)", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf", "date": "2021-03-17", "publisherClass": "legal_text" } ] }, "privacy": { "score": 50, "summary": "Health data is a special category, breaches go to the regulator within 72 hours and the CNPD is elected by a two-thirds vote in parliament. With no health-sector cases found, this scores the general law, held back by low fines and no published report since 2016.", "sources": [ { "title": "Lei n.º 121/IX/2021, second amendment and republication of the general data protection regime (Lei n.º 133/V/2001), and Lei n.º 120/IX/2021 on the CNPD, Boletim Oficial I Série n.º 28 (ARC copy)", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf", "date": "2021-03-17", "publisherClass": "legal_text" }, { "title": "Relatório de Atividades (CNPD)", "url": "https://www.cnpd.cv/relatorio-de-atividades/", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 32, "summary": "A state platform, the SIS, is meant to link facilities, and in December 2025 the minister said a unique patient code and e-prescription are coming. Its coverage is not verified, and WHO still lists a digital health strategy as work to do.", "sources": [ { "title": "Soluções e-gov: Sistema de Informação da Saúde (SIS) (NOSi)", "url": "https://nosi.cv/solu%C3%A7%C3%B5es-egov", "date": "undated", "publisherClass": "official" }, { "title": "Estratégia de Cooperação com o País 2024-2028, Cabo Verde (WHO AFRO)", "url": "https://www.afro.who.int/sites/default/files/2025-09/ECP%20Cabo%20VErde%20PT%20%26%20CSS%20Cabo%20Verde%20eng.pdf", "date": "undated", "publisherClass": "intergov" }, { "title": "Cabo Verde prepara gestão digital da saúde, incluindo listas de espera e transferências (Lusa via Saúde+ TV)", "url": "https://www.saudemais.tv/noticia/48928-cabo-verde-prepara-gestao-digital-da-saude-incluindo-listas-de-espera-e-transferencias", "date": "2024-02-08", "publisherClass": "news" }, { "title": "Ministro da Saúde aponta avanço da digitalização do Sistema Nacional de Saúde (Inforpress)", "url": "https://inforpress.cv/pt/article-6711", "date": "2025-12-18", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Selling or reusing health data for business needs express consent under the special-data ban, and people can refuse marketing use free of charge. We found no rule on health apps, data brokers or de-identified data, and no enforcement in health.", "sources": [ { "title": "Lei n.º 121/IX/2021, second amendment and republication of the general data protection regime (Lei n.º 133/V/2001), and Lei n.º 120/IX/2021 on the CNPD, Boletim Oficial I Série n.º 28 (ARC copy)", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf", "date": "2021-03-17", "publisherClass": "legal_text" } ] }, "clinical": { "score": 28, "summary": "The 2004 base law calls for confidential flow of clinical information between levels of care, but a record clinicians can open in any facility is still described as a future benefit. We could not verify cross-facility access today.", "sources": [ { "title": "Lei n.º 41/VI/2004, Bases do Serviço Nacional de Saúde, Boletim Oficial I Série n.º 10 (copy with the medical code of ethics)", "url": "https://ct-luso.com/pluginfile.php/46/mod_page/content/49/Lei%20de%20base%20SNS%20e%20C%C3%B3digo%20deontol%C3%B3gico%20dos%20M%C3%A9dicos.pdf", "date": "2004-04-05", "publisherClass": "legal_text" }, { "title": "Soluções e-gov: Sistema de Informação da Saúde (SIS) (NOSi)", "url": "https://nosi.cv/solu%C3%A7%C3%B5es-egov", "date": "undated", "publisherClass": "official" }, { "title": "Ministro da Saúde aponta avanço da digitalização do Sistema Nacional de Saúde (Inforpress)", "url": "https://inforpress.cv/pt/article-6711", "date": "2025-12-18", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Since 2007 a national ethics committee, the CNEPS, has reviewed health research protocols, and each file must include an informed consent form. There is no public register of uses of health records, and the committee lacks its own budget and secretariat, so 49.", "sources": [ { "title": "Decreto-Lei n.º 26/2007, creating the Comité Nacional de Ética em Pesquisa para a Saúde, Boletim Oficial I Série n.º 28", "url": "https://boe.incv.cv/Bulletins/Download/328", "date": "2007-07-30", "publisherClass": "legal_text" }, { "title": "Ministro da Saúde confere posse aos novos membros da Comissão Nacional de Ética em Pesquisa em Saúde (Governo de Cabo Verde)", "url": "https://www.governo.cv/ministro-da-saude-confere-posse-aos-novos-membros-da-comissao-nacional-de-etica-em-pesquisa-em-saude/", "date": "2025-03-19", "publisherClass": "official" }, { "title": "Lei n.º 121/IX/2021, second amendment and republication of the general data protection regime (Lei n.º 133/V/2001), and Lei n.º 120/IX/2021 on the CNPD, Boletim Oficial I Série n.º 28 (ARC copy)", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf", "date": "2021-03-17", "publisherClass": "legal_text" } ] }, "ai": { "score": 28, "summary": "A 2022 decree regulates medical devices, including software needed to run them, but says nothing about AI or change control. A May 2026 resolution only plans a national AI strategy, and the health minister has called for an ethical and legal framework.", "sources": [ { "title": "Decreto-Lei n.º 4/2022 on medical devices and Decreto-Lei n.º 2/2022 on prescription, Boletim Oficial I Série n.º 14 (Governo de Cabo Verde)", "url": "https://www.governo.cv/documentos/bo-conselho-de-ministros-decreto-lei-no4-2022-estabelece-o-regime-juridico-aplicavel-aos-dispositivos-medicos-dm-e-respetivos-acessorios/", "date": "2022-02-08", "publisherClass": "legal_text" }, { "title": "ERIS submete à consulta pública proposta de regime jurídico aplicável aos dispositivos médicos (ERIS)", "url": "https://www.eris.cv/index.php/noticias/831-eris-submete-a-consulta-publica-proposta-de-regime-juridico-aplicavel-aos-dispositivos-medicos", "date": "2024-11-08", "publisherClass": "official" }, { "title": "Resolução n.º 72/2026, balanço da agenda de transformação digital e orientações para a Agenda Digital 2035, Boletim Oficial I Série n.º 54", "url": "https://boe.incv.cv/Bulletins/DownloadAct?id=101313", "date": "2026-05-07", "publisherClass": "legal_text" }, { "title": "Ministro da Saúde representa Cabo Verde na Conferência Global da OMS sobre Inteligência Artificial na Saúde (Expresso das Ilhas)", "url": "https://expressodasilhas.cv/pais/2026/07/15/ministro-da-saude-representa-cabo-verde-na-conferencia-global-da-oms-sobre-inteligencia-artificial-na-saude/103656", "date": "2026-07-15", "publisherClass": "news" } ] } }, "laws": [ { "name": "Lei 133/V/2001, general data protection regime, as amended by Lei 41/VIII/2013 and Lei 121/IX/2021", "level": "National", "year": "2021", "what": "Health data is special; access copy; 72-hour breach notice; portability; fines doubled for special-data breaches.", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf" }, { "name": "Lei 120/IX/2021 amending Lei 42/VIII/2013 on the CNPD", "level": "National", "year": "2021", "what": "CNPD is an independent body of three members elected by two-thirds of deputies present.", "url": "https://www.arc.cv/arc/upload/legislacao/lesgi_63207ee2981fe5.62250708111.pdf" }, { "name": "Lei 41/VI/2004, Bases of the National Health Service", "level": "National", "year": "2004", "what": "Users' rights to privacy, secrecy, health information and access to all records about them.", "url": "https://ct-luso.com/pluginfile.php/46/mod_page/content/49/Lei%20de%20base%20SNS%20e%20C%C3%B3digo%20deontol%C3%B3gico%20dos%20M%C3%A9dicos.pdf" }, { "name": "Decree-Law 26/2007 creating the National Health Research Ethics Committee (CNEPS)", "level": "National", "year": "2007", "what": "CNEPS reviews the ethics of health research protocols; each file includes an informed consent form.", "url": "https://boe.incv.cv/Bulletins/Download/328" }, { "name": "Decree-Law 2/2022 on prescription and dispensing of medicines", "level": "National", "year": "2022", "what": "Allows paper or electronic prescriptions; electronic prescribing rules left to a ministerial order.", "url": "https://www.governo.cv/documentos/bo-conselho-de-ministros-decreto-lei-no4-2022-estabelece-o-regime-juridico-aplicavel-aos-dispositivos-medicos-dm-e-respetivos-acessorios/" }, { "name": "Decree-Law 4/2022 on medical devices", "level": "National", "year": "2022", "what": "Transitional device rules under ERIS; covers software needed for a device to work; incident vigilance.", "url": "https://www.governo.cv/documentos/bo-conselho-de-ministros-decreto-lei-no4-2022-estabelece-o-regime-juridico-aplicavel-aos-dispositivos-medicos-dm-e-respetivos-acessorios/" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-07-14", "headline": "Health regulator warns providers after complaint over patient data sent abroad", "paraphrase": "Following a complaint, the regulator learned that several health facilities sent patient samples abroad for lab work, sharing sensitive personal data. It issued an alert reminding providers that patient consent is required.", "source": "ERIS (Entidade Reguladora Independente da Saúde)", "url": "https://eris.cv/index.php/noticias/916-setor-da-saude-eris-emite-alerta-sobre-consentimento-informado-dos-utentes-previo-a-prestacao-de-cuidados-de-saude-incluindo-cuidados-transfronteiricos", "theme": "sold_or_shared", "status": "finding" } ] }, { "iso3": "GAB", "name": "Gabon", "region": "Africa", "overall": 36, "rank": "116=", "likelyRank": "89 to 149", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Gabon has a detailed 2023 data law and a regulator that fines, but patients cannot see records online and digital files stay in pilot hospitals.", "categories": { "access": { "score": 35, "summary": "Law 025/2023 gives a free written right to see your data and a copy, directly or through a doctor. No deadline is set, the provider may charge the cost of copying, and there is no patient portal, so 35.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "eGabon SIS : la digitalisation effective à l'Hôpital de la Coopération Sino-Gabonaise (Gabon Media Time)", "url": "https://gabonmediatime.com/egabon-sis-la-digitalisation-effective-a-lhopital-de-la-cooperation-sino-gabonaise/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "CNAMGS: Portail eServices", "url": "https://ecnamgs.cnamgs.ga/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for care by staff bound by secrecy, and pilot hospital records are shared on transfer with no patient setting. We found no opt-out and no access log a patient can read.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "eGabon SIS : la digitalisation effective à l'Hôpital de la Coopération Sino-Gabonaise (Gabon Media Time)", "url": "https://gabonmediatime.com/egabon-sis-la-digitalisation-effective-a-lhopital-de-la-cooperation-sino-gabonaise/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "Gabon : projets de lois et nominations au Conseil des ministres du 23 octobre 2025 (Gabonactu, communiqué text)", "url": "https://gabonactu.com/blog/2025/10/24/gabon-projets-de-lois-et-nominations-au-conseil-des-ministres-du-23-octobre-2025/", "date": "2025-10-24", "publisherClass": "news" } ] }, "privacy": { "score": 54, "summary": "Law 025/2023 treats health data as sensitive, requires breach notice to the regulator without delay and allows fines up to 300 million CFA francs for repeat breaches. The APDPVP has fined companies, but we found no health-sector decision, so this scores the general law.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "Sanctions (APDPVP)", "url": "https://www.apdpvp.ga/sanctions-2/", "date": "undated", "publisherClass": "official" }, { "title": "Fichage ethnique : Citibank Gabon écope de 90 millions CFA d'amende (Gabonreview)", "url": "https://www.gabonreview.com/fichage-ethnique-citibank-gabon-ecope-de-90-millions-damende/", "date": "2024-07-15", "publisherClass": "news" }, { "title": "Données personnelles : face aux dérives des administrations, l'APDPVP hausse le ton (Gabon Media Time)", "url": "https://gabonmediatime.com/donnees-personnelles-face-aux-derives-des-administrations-lapdpvp-hausse-le-ton/", "date": "2026-07-01", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "The World Bank's eGabon project closed in June 2026 after putting the health information system in 13 pilot hospitals. In March 2025 the Bank still counted 0% of prescriptions sent electronically, and bills for a unique patient ID and interoperability await passage.", "sources": [ { "title": "Plan national de développement sanitaire du Gabon 2024-2028 (Ministère de la Santé et des Affaires sociales, P4H copy)", "url": "https://p4h.world/app/uploads/2024/10/P4H-PNDS-2024-2028_Gabon.x23411.pdf", "date": "2023-07", "publisherClass": "official" }, { "title": "Implementation Status & Results Report, eGabon (P132824), Seq. 16 (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099052125123532941/pdf/P132824-c6a10e3c-f5f5-41bc-ab52-9252846fc3f2.pdf", "date": "2025-05-21", "publisherClass": "intergov" }, { "title": "eGabon-SIS : le Gabon tourne une page et ouvre une nouvelle phase de sa transformation numérique en santé (Gabonreview)", "url": "https://www.gabonreview.com/egabon-sis-le-gabon-tourne-une-page-et-ouvre-une-nouvelle-phase-de-sa-transformation-numerique-en-sante/", "date": "2026-06-25", "publisherClass": "news" }, { "title": "Santé numérique : le Gabon, premier pays d'Afrique francophone à déployer le DHIS2 Tracker (Gabon Media Time)", "url": "https://gabonmediatime.com/sante-numerique-le-gabon-premier-pays-dafrique-francophone-a-deployer-le-dhis2-tracker/", "date": "2026-06-18", "publisherClass": "news" } ] }, "commercial": { "score": 46, "summary": "Law 025/2023 gives a right to refuse marketing use of your data at any time and says sensitive data needs written, informed consent. We found no rules on health apps, data brokers or sales of de-identified health data, and no health-sector enforcement.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "Sanctions (APDPVP)", "url": "https://www.apdpvp.ga/sanctions-2/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 25, "summary": "Doctors in some pilot hospitals can open electronic patient files, and one director says files follow transfers to other Libreville hospitals. Nationally there is no shared record yet, and in March 2025 the World Bank found 0% of health workers regularly using one.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "Implementation Status & Results Report, eGabon (P132824), Seq. 16 (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099052125123532941/pdf/P132824-c6a10e3c-f5f5-41bc-ab52-9252846fc3f2.pdf", "date": "2025-05-21", "publisherClass": "intergov" }, { "title": "eGabon SIS : la digitalisation effective à l'Hôpital de la Coopération Sino-Gabonaise (Gabon Media Time)", "url": "https://gabonmediatime.com/egabon-sis-la-digitalisation-effective-a-lhopital-de-la-cooperation-sino-gabonaise/", "date": "2026-07-16", "publisherClass": "news" }, { "title": "Santé : le Gabon instaure un identifiant unique pour patients et professionnels de santé (Gabonreview)", "url": "https://www.gabonreview.com/sante-le-gabon-instaure-un-identifiant-unique-pour-patients-et-professionnels-de-sante/", "date": "2025-10-27", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Health research on personal data needs APDPVP authorisation after an expert committee opinion, identifying data must be coded, and staff face criminal penalties for breaking secrecy. A right to object exists in law, but we found no evidence it is used, so 50.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "Ethics Committees, Gabon: Comité National d'Ethique pour la Recherche (Health Research Web, COHRED)", "url": "https://healthresearchwebafrica.org.za/en/api/gabon/ethics_1125?keyP=marc", "date": "undated", "publisherClass": "academic" } ] }, "ai": { "score": 25, "summary": "We found no regulation of AI or software as a medical device and no clinical AI guidance. The data law gives a right to human review of automated decisions, and a national AI strategy was still being drafted in September 2026.", "sources": [ { "title": "Loi n°025/2023 du 12 juillet 2023 portant modification de la loi n°001/2011 relative à la protection des données à caractère personnel (Journal officiel n°218 bis, AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2023-07-15", "publisherClass": "legal_text" }, { "title": "ANMAPS, site officiel (Agence Nationale du Médicament et des Autres Produits de Santé)", "url": "https://anmaps.ga/", "date": "undated", "publisherClass": "official" }, { "title": "Stratégie IA : le Gabon retient 22 défis et 36 recommandations (Gabonactu)", "url": "https://gabonactu.com/blog/2026/09/30/strategie-ia-le-gabon-retient-22-defis-et-36-recommandations/", "date": "2026-09-30", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 025/2023 on personal data protection and privacy (amending Law 001/2011)", "level": "National", "year": "2023", "what": "Health data is sensitive; patient access in person or via a doctor; breach notice; fines to 300 million CFA.", "url": "https://www.afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-portant-modification-de-la-loi-001-2011-du-25-septembre-relative-a-la-protection-des-donnees-a-caractere-personnel.pdf" }, { "name": "Law 001/2011 on personal data protection", "level": "National", "year": "2011", "what": "First data protection law; created the data commission (CNPDCP) that became the APDPVP in 2023.", "url": "https://www.afapdp.org/wp-content/uploads/2012/01/Gabon-Loi-relative-%C3%A0-la-protection-des-donn%C3%A9es-personnelles-du-4-mai-20112.pdf" }, { "name": "Law 004/2022 on the orientation of the health information system", "level": "National", "year": "2022", "what": "Framework law for the health information system; legal base for the patient ID and interoperability bills. Text not opened.", "url": "https://gabonactu.com/blog/2025/10/24/gabon-projets-de-lois-et-nominations-au-conseil-des-ministres-du-23-octobre-2025/" }, { "name": "Bill instituting a unique patient and health professional identifier", "level": "National", "year": "2025", "what": "Adopted by the Council of Ministers on 23 October 2025 to link each patient's medical data. Passage not verified.", "url": "https://gabonactu.com/blog/2025/10/24/gabon-projets-de-lois-et-nominations-au-conseil-des-ministres-du-23-octobre-2025/" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "MLI", "name": "Mali", "region": "Africa", "overall": 36, "rank": "116=", "likelyRank": "94 to 155", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A 2013 law gives free access to your data, but hospital records sit in separate local systems and patients see them through a doctor.", "categories": { "access": { "score": 45, "summary": "Law 2013-015 gives a free right to all your data and a copy, granted without delay. The hospital law lets inpatients see their medical file only through a doctor of their choice, and there is no patient portal.", "sources": [ { "title": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel, Journal officiel n°26", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf", "date": "2013-06-28", "publisherClass": "legal_text" }, { "title": "Loi n°02-050 du 22 juillet 2002 portant loi hospitalière, modifiée par la loi n°2018-050 (version consolidée, SGG)", "url": "https://sgg-mali.ml/autres-textes-consolides/mali-loi-2002-50-portant-loi-hospitaliere.pdf", "date": "2019-04-20", "publisherClass": "legal_text" }, { "title": "Arrêté n°08-2716/MS-SG du 6 octobre 2008 portant charte du malade dans les établissements hospitaliers (Ordre des Médecins du Mali)", "url": "https://ordredesmedecins.ml/storage/resources/1702999047_Arrete08-2716_Chartedumalade.pdf", "date": "2008-10-06", "publisherClass": "legal_text" } ] }, "control": { "score": 27, "summary": "A doctor may open a patient's file held by another hospital only with the patient's agreement, though use in practice was not verified. There is no opt-out or access log, so 27, in the lower half of the 20 to 35 band.", "sources": [ { "title": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel, Journal officiel n°26", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf", "date": "2013-06-28", "publisherClass": "legal_text" }, { "title": "Loi n°02-050 du 22 juillet 2002 portant loi hospitalière, modifiée par la loi n°2018-050 (version consolidée, SGG)", "url": "https://sgg-mali.ml/autres-textes-consolides/mali-loi-2002-50-portant-loi-hospitaliere.pdf", "date": "2019-04-20", "publisherClass": "legal_text" }, { "title": "Arrêté n°08-2716/MS-SG du 6 octobre 2008 portant charte du malade dans les établissements hospitaliers (Ordre des Médecins du Mali)", "url": "https://ordredesmedecins.ml/storage/resources/1702999047_Arrete08-2716_Chartedumalade.pdf", "date": "2008-10-06", "publisherClass": "legal_text" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive data under Law 2013-015, and in 2025 the APDP fined a Bamako clinic 5 million CFA francs for obstructing an inspection. Fines top out at 20 million CFA francs and the law has no breach notification duty.", "sources": [ { "title": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel, Journal officiel n°26", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf", "date": "2013-06-28", "publisherClass": "legal_text" }, { "title": "Mali : une clinique médicale condamnée au paiement de 5 millions de FCFA (Mali 24)", "url": "https://mali24.info/mali-une-clinique-medicale-condamnee-au-paiement-de-5-millions-de-fcfa-pour-installation-illegale-dun-dispositif-de-videosurveillance/", "date": "2025-08-05", "publisherClass": "news" }, { "title": "Visite de l'Ordre des Médecins du Mali à l'APDP (APDP)", "url": "https://apdp.ml/posts/visite-de-lordre-des-medecins-du-mali-a-lapdp/", "date": "2025-07-11", "publisherClass": "official" }, { "title": "Plan Stratégique National de Santé Numérique du Mali (PSNSN) 2024-2028, Ministère de la Santé et du Développement Social", "url": "https://www.sante.gov.ml/article-download.php?article=153&slot=1", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 27, "summary": "The Health Ministry rates the interoperability of its information systems at level 2 of 5 (emergent), with at least four separate hospital systems in use. DHIS2 carries aggregate national reporting, and the insurer moved prior authorisations online in May 2026.", "sources": [ { "title": "Plan Stratégique National de Santé Numérique du Mali (PSNSN) 2024-2028, Ministère de la Santé et du Développement Social", "url": "https://www.sante.gov.ml/article-download.php?article=153&slot=1", "date": "undated", "publisherClass": "official" }, { "title": "Digitalisation de la Santé : l'ANTIM présente OpenClinic devant le Comité chargé de la digitalisation de l'administration (Ministère de la Santé)", "url": "https://www.sante.gov.ml/index.php?option=com_content&view=article&id=109&catid=10&Itemid=105", "date": "2025-09-24", "publisherClass": "official" }, { "title": "CANAM : la digitalisation de l'accord préalable désormais en marche (Malijet)", "url": "https://malijet.com/la_sante_au_mali/309433-canam--la-digitalisation-de-l%E2%80%99accord-prealable-desormais-en-ma.html", "date": "2026-05-07", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "People must be told before their data is first passed to third parties for marketing and can object free of charge, and changing a data use without APDP approval is punishable. We found no rules on health apps, data brokers or de-identified health data.", "sources": [ { "title": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel, Journal officiel n°26", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf", "date": "2013-06-28", "publisherClass": "legal_text" }, { "title": "APDP (Autorité de Protection des données à Caractère Personnel), text of Law 2013-015 (Primature)", "url": "https://primature.ml/apdp-autorite-de-protection-des-donnees-a-caractere-personnel/", "date": "undated", "publisherClass": "official" } ] }, "clinical": { "score": 22, "summary": "Doctors in hospitals running OpenClinic or similar software can open electronic files inside their own facility. There is no shared record across providers, and seeing another hospital's file requires the patient's agreement and a request to that hospital.", "sources": [ { "title": "Loi n°02-050 du 22 juillet 2002 portant loi hospitalière, modifiée par la loi n°2018-050 (version consolidée, SGG)", "url": "https://sgg-mali.ml/autres-textes-consolides/mali-loi-2002-50-portant-loi-hospitaliere.pdf", "date": "2019-04-20", "publisherClass": "legal_text" }, { "title": "Digitalisation de la Santé : l'ANTIM présente OpenClinic devant le Comité chargé de la digitalisation de l'administration (Ministère de la Santé)", "url": "https://www.sante.gov.ml/index.php?option=com_content&view=article&id=109&catid=10&Itemid=105", "date": "2025-09-24", "publisherClass": "official" }, { "title": "Plan Stratégique National de Santé Numérique du Mali (PSNSN) 2024-2028, Ministère de la Santé et du Développement Social", "url": "https://www.sante.gov.ml/article-download.php?article=153&slot=1", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "The patient charter lets patients refuse or withdraw from clinical research, the CNESS ethics committee reviews studies, and unlawful processing of health data for research carries fines. We found no general opt-out or public register of data uses, so 49.", "sources": [ { "title": "Décret N°02-200/P-RM du 22 avril 2002 portant création du Comité National d'Ethique pour la Santé et les Sciences de la vie (Ministère de la Santé)", "url": "https://www.sante.gov.ml/index.php?option=com_content&view=article&id=325&catid=39&Itemid=132", "date": "2002-04-22", "publisherClass": "official" }, { "title": "Arrêté n°08-2716/MS-SG du 6 octobre 2008 portant charte du malade dans les établissements hospitaliers (Ordre des Médecins du Mali)", "url": "https://ordredesmedecins.ml/storage/resources/1702999047_Arrete08-2716_Chartedumalade.pdf", "date": "2008-10-06", "publisherClass": "legal_text" }, { "title": "Mali : le Comité national d'Éthique pour la Santé annule l'autorisation d'une enquête sur les opinions relatives à l'excision à Bamako (Malikonews)", "url": "https://malikonews.com/mali-le-comite-national-dethique-pour-la-sante-annule-lautorisation-dune-enquete-sur-les-opinions-relatives-a-lexcision-a-bamako/", "date": "2026-08-27", "publisherClass": "news" }, { "title": "Evolution de l'éthique de la recherche et des soins au Mali (thèse, FMOS, USTTB)", "url": "https://bibliosante.ml/bitstream/handle/123456789/4594/21M44.pdf?sequence=1&isAllowed=y", "date": "2021-05-19", "publisherClass": "academic" } ] }, "ai": { "score": 22, "summary": "We found no rules for AI in clinical care, and a 2025 study reports medical devices in Mali are not subject to marketing authorisation. The 2013 data law bars decisions based only on automated profiling and gives a right to the reasoning behind automated results.", "sources": [ { "title": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel, Journal officiel n°26", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf", "date": "2013-06-28", "publisherClass": "legal_text" }, { "title": "Analyse du cadre légal et institutionnel des dispositifs médicaux dans les pays de l'UEMOA (Kaloga et al., vol. 4 no. 1)", "url": "https://soapgi-jatpb.org/index.php/jatpb/article/download/215/46/1300", "date": "2025-06-30", "publisherClass": "academic" }, { "title": "Plan Stratégique National de Santé Numérique du Mali (PSNSN) 2024-2028, Ministère de la Santé et du Développement Social", "url": "https://www.sante.gov.ml/article-download.php?article=153&slot=1", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Loi n°2013-015 du 21 mai 2013 portant protection des données à caractère personnel", "level": "National", "year": "2013", "what": "Free access right, health data as sensitive data, objection right, transfer rules, APDP powers and fines.", "url": "https://sgg-mali.ml/JO/2013/mali-jo-2013-26.pdf" }, { "name": "Loi n°2017-070 du 18 décembre 2017 modifiant la loi n°2013-015", "level": "National", "year": "2017", "what": "Amends APDP membership, oath of members and staff, and annual reporting.", "url": "https://app.maathis.com/droit/mali/loi/2017-070-loi-n2017-070-18-decembre-2017-portant-modification-loi-n-2013-015-21-m" }, { "name": "Loi n°02-050 du 22 juillet 2002 portant loi hospitalière (modifiée par la loi n°2018-050)", "level": "National", "year": "2002", "what": "Patient access to file through a doctor, consent for inter-hospital file access, secrecy, ten-year retention.", "url": "https://sgg-mali.ml/autres-textes-consolides/mali-loi-2002-50-portant-loi-hospitaliere.pdf" }, { "name": "Arrêté n°08-2716/MS-SG portant charte du malade", "level": "National", "year": "2008", "what": "Patient rights: information, revocable consent, confidentiality of files, free choice on clinical research.", "url": "https://ordredesmedecins.ml/storage/resources/1702999047_Arrete08-2716_Chartedumalade.pdf" }, { "name": "Décret N°02-200/P-RM portant création du Comité National d'Ethique pour la Santé et les Sciences de la vie", "level": "National", "year": "2002", "what": "Creates the national ethics committee (CNESS) that reviews health research.", "url": "https://www.sante.gov.ml/index.php?option=com_content&view=article&id=325&catid=39&Itemid=132" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "MAR", "name": "Morocco", "region": "Africa", "overall": 36, "rank": "116=", "likelyRank": "90 to 149", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Moroccans can ask each doctor for a copy of their file, but no shared record exists yet; a July 2026 bill would create one.", "categories": { "access": { "score": 40, "summary": "Law 131-13 says patients can obtain a copy of their medical file, and Law 09-08 makes access to personal data free. There is no national patient portal yet, and the law sets no fixed answer deadline.", "sources": [ { "title": "Loi n° 131-13 relative à l'exercice de la médecine (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Publications/Documents/publications/loi%20131-13%20Fr.pdf", "date": "2015-03-19", "publisherClass": "legal_text" }, { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" }, { "title": "Réunion du Comité de pilotage de la réforme du système national de santé (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Pages/actualites.aspx?idactu=755", "date": "2026-04-14", "publisherClass": "official" }, { "title": "قانون رقمنة الصحة.. عقوبات حبسية وغرامات ثقيلة تنتظر مسربي بيانات المرضى (Nichan)", "url": "https://nichan.ma/359231/", "date": "2026-08-02", "publisherClass": "news" } ] }, "control": { "score": 32, "summary": "Law 09-08 requires express consent or a legal basis to process sensitive data, but doctors need only declare health data processing to the CNDP. No national sharing system, opt-out or patient-visible access log exists yet.", "sources": [ { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" }, { "title": "قانون رقمنة الصحة.. عقوبات حبسية وغرامات ثقيلة تنتظر مسربي بيانات المرضى (Nichan)", "url": "https://nichan.ma/359231/", "date": "2026-08-02", "publisherClass": "news" }, { "title": "Secret médical et sanctions : pourquoi le projet de numérisation de la santé inquiète les médecins du privé (SNRT News)", "url": "https://snrtnews.com/article/secret-medical-et-sanctions-pourquoi-le-projet-de-numerisation-de-la-sante-inquiete-les", "date": "2026-08-19", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive data under Law 09-08, and processing it without express consent can bring three months to a year in prison and fines up to 300,000 dirhams. The law has no breach notification duty, and CNDP sanctions against health actors were not verified.", "sources": [ { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" }, { "title": "CNDP statement after cyberattacks leaked CNSS data (Maroc24, MAP)", "url": "https://www.maroc24.com/184651-%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-%D8%A7%D9%84%D9%84%D8%AC%D9%86%D8%A9-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A%D8%A9-%D9%84%D9%85%D8%B1%D8%A7%D9%82%D8%A8/", "date": "2025-04-10", "publisherClass": "news" }, { "title": "Morocco investigates major data breach allegedly by hackers from Algeria (The Record)", "url": "https://therecord.media/morocco-investigates-breach-hackers-algeria", "date": "2025-04-11", "publisherClass": "news" }, { "title": "Convergence entre la loi marocaine 09-08 et le RGPD (CNDP)", "url": "https://www.cndp.ma/convergence-entre-la-loi-marocaine-09-08-et-le-nouveau-reglement-europeen-sur-la-protection-des-donnees-personnelles-rgpd/", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 30, "summary": "A shared medical record and an electronic care sheet are built but not yet in national use; a Kenitra care sheet pilot was planned for March 2026, and its launch was not verified. Hospitals, labs and private doctors still keep separate records.", "sources": [ { "title": "Termes de référence, programmes (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Documents/2024/05/TDR%20Programmes_13001%20(1).pdf", "date": "2024-05", "publisherClass": "official" }, { "title": "Convention-cadre pour le déploiement du Dossier Médical Partagé et de la Feuille de Soins Electronique (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Pages/actualites.aspx?IDActu=590", "date": "2024-02-02", "publisherClass": "official" }, { "title": "Réunion du Comité de pilotage de la réforme du système national de santé (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Pages/actualites.aspx?idactu=755", "date": "2026-04-14", "publisherClass": "official" }, { "title": "Couverture médicale : la feuille de soins électronique amorce la fin du tout-papier (Le360, review of Al Ahdath Al Maghribia)", "url": "https://fr.le360.ma/politique/couverture-medicale-la-feuille-de-soins-electronique-amorce-la-fin-du-tout-papier_O4CCJ3MRNRHCTEZW3I2QVDM5VM/", "date": "2026-02-16", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "Law 09-08 gives a free right to refuse marketing use of personal data and bans automated direct marketing without consent. In 2024 the CNDP opened an inquiry into pharmacy software allegedly passing prescription data to drug makers; the outcome was not verified.", "sources": [ { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" }, { "title": "لجنة حماية المعطيات الشخصية تحقق في تسريبات حول أسرار المرضى (Hespress)", "url": "https://www.hespress.com/%D9%84%D8%AC%D9%86%D8%A9-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D9%85%D8%B9%D8%B7%D9%8A%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9-%D8%AA%D8%AD%D9%82%D9%82-%D9%81%D9%8A-%D8%AA%D8%B3-1356867.html", "date": "2024-04-29", "publisherClass": "news" }, { "title": "قانون رقمنة الصحة.. عقوبات حبسية وغرامات ثقيلة تنتظر مسربي بيانات المرضى (Nichan)", "url": "https://nichan.ma/359231/", "date": "2026-08-02", "publisherClass": "news" } ] }, "clinical": { "score": 26, "summary": "No national exchange lets a treating doctor see records held by other providers. The shared record was technically complete in April 2026 but its live use was not verified.", "sources": [ { "title": "Réunion du Comité de pilotage de la réforme du système national de santé (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Pages/actualites.aspx?idactu=755", "date": "2026-04-14", "publisherClass": "official" }, { "title": "قانون رقمنة الصحة.. عقوبات حبسية وغرامات ثقيلة تنتظر مسربي بيانات المرضى (Nichan)", "url": "https://nichan.ma/359231/", "date": "2026-08-02", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Law 28-13 requires free, informed, written consent for biomedical research and lets participants withdraw at any time. Observational studies on health data fall outside it and depend on Law 09-08, with CNDP authorisation and no general opt-out.", "sources": [ { "title": "Loi n° 28-13 relative à la protection des personnes participant aux recherches biomédicales (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Reglementation/REGLEMENTATIONDESPRATIQUESMEDICALES/28-13.pdf", "date": "2015-09-17", "publisherClass": "legal_text" }, { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" }, { "title": "La protection des données personnelles de santé sous les projecteurs à Tanger (CNDP)", "url": "https://www.cndp.ma/la-protection-des-donnees-personnelles-de-sante-sous-les-projecteurs-a-tanger/", "date": "2022-03-22", "publisherClass": "official" } ] }, "ai": { "score": 28, "summary": "Morocco has no AI law and no clinical AI rule. The 2013 device law covers software only as part of a device, and a March 2025 CNDP statement says Law 09-08 governs AI use of personal data, which puts it near the top of the no-rules band.", "sources": [ { "title": "Loi n° 84-12 relative aux dispositifs médicaux (Ministère de la Santé)", "url": "https://www.sante.gov.ma/Reglementation/REGLEMENTATIONAPPLICABLEAUPRODUITSDESANTE/84-12.pdf", "date": "2013-09-19", "publisherClass": "legal_text" }, { "title": "IA et protection des données à caractère personnel (CNDP communiqué)", "url": "https://www.cndp.ma/ia-et-protection-des-donnees-a-caractere-personnel/", "date": "2025-03-18", "publisherClass": "official" }, { "title": "IA et Protection des Données à caractère Personnel: auditions (CNDP)", "url": "https://www.cndp.ma/ia-pdp/", "date": "undated", "publisherClass": "official" }, { "title": "Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (CNDP)", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf", "date": "2009-03-05", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law 09-08 on the protection of personal data", "level": "National", "year": "2009", "what": "Health is sensitive data; consent or CNDP authorisation; free access right; prison and fines to 300,000 dirhams.", "url": "https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf" }, { "name": "Law 131-13 on the practice of medicine", "level": "National", "year": "2015", "what": "Patients have a right to information and to a copy of their medical file.", "url": "https://www.sante.gov.ma/Publications/Documents/publications/loi%20131-13%20Fr.pdf" }, { "name": "Law 28-13 on protection of people in biomedical research", "level": "National", "year": "2015", "what": "Written informed consent, withdrawal at any time; observational research excluded.", "url": "https://www.sante.gov.ma/Reglementation/REGLEMENTATIONDESPRATIQUESMEDICALES/28-13.pdf" }, { "name": "Law 84-12 on medical devices", "level": "National", "year": "2013", "what": "Device definition includes operating software; four risk classes; registration required.", "url": "https://www.sante.gov.ma/Reglementation/REGLEMENTATIONAPPLICABLEAUPRODUITSDESANTE/84-12.pdf" }, { "name": "Framework Law 06-22 on the national health system", "level": "National", "year": "2022", "what": "Health system reform; its fourth pillar is digitalisation of the health sector.", "url": "https://www.sante.gov.ma/Documents/2024/05/TDR%20Programmes_13001%20(1).pdf" }, { "name": "Law 54.23 (health insurance governance, Bulletin officiel 29 January 2026)", "level": "National", "year": "2026", "what": "Moves public-sector health insurance management from CNOPS to the CNSS.", "url": "https://fr.le360.ma/politique/couverture-medicale-la-feuille-de-soins-electronique-amorce-la-fin-du-tout-papier_O4CCJ3MRNRHCTEZW3I2QVDM5VM/" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "GMB", "name": "The Gambia", "region": "Africa", "overall": 36, "rank": "116=", "likelyRank": "93 to 154", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "The Gambia passed its first data protection law in 2025, but most patient records are still on paper and no shared record exists.", "categories": { "access": { "score": 45, "summary": "The 2025 Act gives a free copy of your personal data within one month, which covers medical files. Free with a deadline adds 5 to the base of 45, but the deadline can stretch to two months and the new regulator has no enforcement record, so 45.", "sources": [ { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" }, { "title": "Key features of the Gambian Personal Data Protection and Privacy Act (African Law & Business)", "url": "https://www.africanlawbusiness.com/expert-views/key-features-of-the-gambian-personal-data-protection-and-privacy-act/", "date": "2026-02-09", "publisherClass": "law_firm" }, { "title": "Edward Francis Small Teaching Hospital home page", "url": "https://efsth.gm/", "date": "undated", "publisherClass": "official" }, { "title": "Assessing the Current State of Digitalisation at the Edward Francis Small Teaching Hospital (AKSU Journal of Administration and Corporate Governance)", "url": "https://aksujacog.org.ng/articles/26/01/assessing-the-current-state-of-digitalisation-at-the-edward-francis-small-teaching-hospital-efsth-the-gambia/aksujacog_06_01_02.pdf", "date": "2026-01", "publisherClass": "academic" } ] }, "control": { "score": 30, "summary": "Where consent is used it must be specific and can be withdrawn, but health data may be processed without consent for managing health services. With no shared record there is no opt-out setting or access log for patients to use.", "sources": [ { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" }, { "title": "Key features of the Gambian Personal Data Protection and Privacy Act (African Law & Business)", "url": "https://www.africanlawbusiness.com/expert-views/key-features-of-the-gambian-personal-data-protection-and-privacy-act/", "date": "2026-02-09", "publisherClass": "law_firm" } ] }, "privacy": { "score": 48, "summary": "Health data is a special category under the 2025 Act, with 72-hour breach notice to the regulator and fines up to 5% of gross income. No health-sector cases were found, so this scores a new law with no enforcement record yet.", "sources": [ { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" }, { "title": "Key features of the Gambian Personal Data Protection and Privacy Act (African Law & Business)", "url": "https://www.africanlawbusiness.com/expert-views/key-features-of-the-gambian-personal-data-protection-and-privacy-act/", "date": "2026-02-09", "publisherClass": "law_firm" }, { "title": "Information Commission of The Republic of The Gambia", "url": "https://informationcommission.gm/", "date": "undated", "publisherClass": "official" }, { "title": "Info Commission attains full NADPA-RAPDP membership (The Point)", "url": "https://thepoint.gm/africa/gambia/headlines/info-commission-attains-full-nadpa-rapdp-membership", "date": "2026-06-11", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "Health statistics flow into a national HMIS, and health insurance now covers 69 contracted facilities, but patient records are not linked. Officials told Africa CDC in 2026 that digital health systems are fragmented.", "sources": [ { "title": "The Gambia Health Management Information System Policy 2017-2025 (Government Policy Repository)", "url": "https://policies.gov.gm/f/caa65bd5-5bad-11ec-9b31-029254d29bb1", "date": "2021-12-13", "publisherClass": "official" }, { "title": "NHIS Expands From 13 to 69 Health Facilities (NHIA)", "url": "https://nhia.gm/2025/07/14/nhis-expands-from-13-to-69-health-facilities/", "date": "2025-07-14", "publisherClass": "official" }, { "title": "Africa CDC concludes primary health care digitalisation mission in The Gambia (TechReviewAfrica)", "url": "https://techreviewafrica.com/news/5679/africa-cdc-concludes-primary-health-care-digitalisation-mission-supports-in-the-gambia", "date": "2026-05-29", "publisherClass": "news" }, { "title": "The Gambia puts its health facilities on the map (UNICEF)", "url": "https://www.unicef.org/digitalimpact/stories/gambia-puts-its-health-facilities-map", "date": "2026-09-16", "publisherClass": "intergov" } ] }, "commercial": { "score": 48, "summary": "The 2025 Act makes selling personal data, or offering it for sale, a crime with up to ten years in prison. We found no health-specific rule on health apps, data brokers or de-identified data, and no enforcement.", "sources": [ { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" }, { "title": "Key features of the Gambian Personal Data Protection and Privacy Act (African Law & Business)", "url": "https://www.africanlawbusiness.com/expert-views/key-features-of-the-gambian-personal-data-protection-and-privacy-act/", "date": "2026-02-09", "publisherClass": "law_firm" } ] }, "clinical": { "score": 18, "summary": "A treating clinician sees only the paper or local file held where the patient is treated. A 2026 study of the only teaching hospital found an ad hoc stage of digital maturity, with lost and mixed-up folders.", "sources": [ { "title": "Assessing the Current State of Digitalisation at the Edward Francis Small Teaching Hospital (AKSU Journal of Administration and Corporate Governance)", "url": "https://aksujacog.org.ng/articles/26/01/assessing-the-current-state-of-digitalisation-at-the-edward-francis-small-teaching-hospital-efsth-the-gambia/aksujacog_06_01_02.pdf", "date": "2026-01", "publisherClass": "academic" }, { "title": "The Gambia puts its health facilities on the map (UNICEF)", "url": "https://www.unicef.org/digitalimpact/stories/gambia-puts-its-health-facilities-map", "date": "2026-09-16", "publisherClass": "intergov" } ] }, "research": { "score": 46, "summary": "The 2025 Act allows research use of personal data with safeguards and no individual consent, and gives no research opt-out. Two safeguards lift the score from 40: ethics clearance and a re-identification offence.", "sources": [ { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" }, { "title": "Medicines and Related Products Act, 2014 (National Assembly)", "url": "https://assembly.gm/documents/141", "date": "2014", "publisherClass": "legal_text" }, { "title": "The Gambia Government/MRC Joint Ethics Committee (Health Research Web)", "url": "https://healthresearchwebafrica.org.za/en/gambia/research_regulation_4527", "date": "undated", "publisherClass": "academic" } ] }, "ai": { "score": 25, "summary": "The Medicines Control Agency regulates medical devices, but no rule mentions software or AI. A June 2026 review found no Gambian AI law, strategy or regulator.", "sources": [ { "title": "Medicines and Related Products Act, 2014 (National Assembly)", "url": "https://assembly.gm/documents/141", "date": "2014", "publisherClass": "legal_text" }, { "title": "AI regulation in the Gambia (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-gambia", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Personal Data Protection and Privacy Bill, 2024 (National Assembly bill text)", "url": "https://assembly.gm/bills/364/download/1", "date": "2024", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Personal Data Protection and Privacy Act, 2025", "level": "National", "year": "2025", "what": "Special category health data, free access in one month, 72-hour breach notice, ban on selling data.", "url": "https://assembly.gm/bills/364/download/1" }, { "name": "Access to Information Act, 2021", "level": "National", "year": "2021", "what": "Creates the Information Commission, which also enforces the data protection law.", "url": "https://informationcommission.gm/" }, { "name": "Medicines and Related Products Act, 2014", "level": "National", "year": "2014", "what": "Medicines Control Agency licenses medicines and devices; trials need ethics clearance and written consent.", "url": "https://assembly.gm/documents/141" }, { "name": "National Health Insurance Act, 2021", "level": "National", "year": "2021", "what": "Sets up the National Health Insurance Scheme and Authority; residents must register.", "url": "https://nhia.gm/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "DZA", "name": "Algeria", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "97 to 157", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Algeria is rolling out a national electronic record tied to the national ID, but patients get no sharing choices and no portal yet.", "categories": { "access": { "score": 40, "summary": "Law 18-07 gives a right to a copy of one's data, requested provider by provider, and the controller may ask the regulator for longer reply times. The ministry's citizen app to view the record and test results is announced, not live.", "sources": [ { "title": "Law 18-07 of 10 June 2018 on personal data protection (Journal Officiel No. 34)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf", "date": "2018-06-10", "publisherClass": "legal_text" }, { "title": "Law 18-11 of 2 July 2018 on health (Journal Officiel No. 46)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf", "date": "2018-07-29", "publisherClass": "legal_text" }, { "title": "Electronic medical record to be generalised nationally soon, 12 services for the national portal (Radio Algérienne)", "url": "http://news.radioalgerie.dz/ar/node/90382", "date": "2026-07-14", "publisherClass": "news" }, { "title": "EL HANAA app of CNAS (Google Play listing)", "url": "https://play.google.com/store/apps/details?id=dz.cnas.mobile_elhanaa&hl=fr", "date": "2025-07-17", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "The new national electronic record links each patient by national ID and lets authorised professionals anywhere in the country see it. No patient opt-out, consent setting or patient-visible access log was found.", "sources": [ { "title": "Law 18-11 of 2 July 2018 on health (Journal Officiel No. 46)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf", "date": "2018-07-29", "publisherClass": "legal_text" }, { "title": "Law 18-07 of 10 June 2018 on personal data protection (Journal Officiel No. 34)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf", "date": "2018-06-10", "publisherClass": "legal_text" }, { "title": "Law 25-11 of 24 July 2025 amending Law 18-07 (Journal Officiel No. 48, copy hosted by CNA)", "url": "https://cna.dz/wp-content/uploads/2025/07/Loi-n%C2%B025-11.pdf", "date": "2025-07-24", "publisherClass": "legal_text" }, { "title": "Algeria deploys the patient's electronic medical record (L'Algérie Aujourd'hui)", "url": "https://lalgerieaujourdhui.dz/lalgerie-deploie-le-dossier-medical-electronique-du-patient/", "date": "2026-07-27", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive data under Law 18-07, refusing access rights can bring up to two years in prison, and an independent authority sits under the Presidency. With no health-sector enforcement or general breach-notice duty verified, it sits at the floor of the general-law band.", "sources": [ { "title": "Law 18-07 of 10 June 2018 on personal data protection (Journal Officiel No. 34)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf", "date": "2018-06-10", "publisherClass": "legal_text" }, { "title": "Law 25-11 of 24 July 2025 amending Law 18-07 (Journal Officiel No. 48, copy hosted by CNA)", "url": "https://cna.dz/wp-content/uploads/2025/07/Loi-n%C2%B025-11.pdf", "date": "2025-07-24", "publisherClass": "legal_text" }, { "title": "Video surveillance and data protection: the ANPDP sets new rules (Horizons)", "url": "https://www.horizons.dz/2026/03/horizons-dz-nation-videosurveillance-et-protection-des-donnees-lanpdp-fixe-de-nouvelles-regles/", "date": "2026-03-11", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 32, "summary": "Insurance claims are linked through the CNAS Chifa smart card used by doctors, pharmacists and labs. The national electronic record started rolling out in July 2026 in 10 pilot wilayas, with a 15 November 2026 deadline for all facilities.", "sources": [ { "title": "Carte CHIFA (CNAS)", "url": "https://cnas.dz/fr/chifa/", "date": "undated", "publisherClass": "official" }, { "title": "Algeria deploys the patient's electronic medical record (L'Algérie Aujourd'hui)", "url": "https://lalgerieaujourdhui.dz/lalgerie-deploie-le-dossier-medical-electronique-du-patient/", "date": "2026-07-27", "publisherClass": "news" }, { "title": "Electronic medical record: digitisation by 15 November 2026 (Horizons)", "url": "https://www.horizons.dz/2026/09/dossier-medical-electronique-numerisation-dici-le-15-novembre-2026/", "date": "2026-09", "publisherClass": "news" }, { "title": "Ait Messaoudene on building a complete digital health system (ENTV)", "url": "http://www.entv.dz/ar/news/%D8%A2%D9%8A%D8%AA-%D9%85%D8%B3%D8%B9%D9%88%D8%AF%D8%A7%D9%86-%D9%8A%D8%A4%D9%83%D8%AF-%D8%B9%D9%84%D9%89-%D8%AA%D8%AC%D8%B3%D9%8A%D8%AF-%D8%B1%D8%A4%D9%8A%D8%A9-%D9%85%D8%AA%D9%83%D8%A7%D9%85%D9%84%D8%A9-%D9%84%D8%A8%D9%86%D8%A7%D8%A1-%D9%85%D9%86%D8%B8%D9%88%D9%85%D8%A9-%D8%B5%D8%AD%D9%8A%D8%A9-%D8%B1%D9%82%D9%85%D9%8A%D8%A9-%D8%B4%D8%A7%D9%85%D9%84%D8%A9", "date": "2026-02-17", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Automated marketing by email, phone or fax needs prior consent, people may object to commercial prospecting, and sensitive data cannot be processed without a legal ground. No rules on health data brokers or sale of de-identified data were found.", "sources": [ { "title": "Law 18-07 of 10 June 2018 on personal data protection (Journal Officiel No. 34)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf", "date": "2018-06-10", "publisherClass": "legal_text" }, { "title": "Electronic medical record to be generalised nationally soon, 12 services for the national portal (Radio Algérienne)", "url": "http://news.radioalgerie.dz/ar/node/90382", "date": "2026-07-14", "publisherClass": "news" } ] }, "clinical": { "score": 30, "summary": "The new record is designed so authorised clinicians anywhere can look up a patient by national ID or ID card. Until rollout finishes, past the 15 November 2026 deadline, most clinicians still work from separate facility records.", "sources": [ { "title": "Law 18-11 of 2 July 2018 on health (Journal Officiel No. 46)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf", "date": "2018-07-29", "publisherClass": "legal_text" }, { "title": "Algeria deploys the patient's electronic medical record (L'Algérie Aujourd'hui)", "url": "https://lalgerieaujourdhui.dz/lalgerie-deploie-le-dossier-medical-electronique-du-patient/", "date": "2026-07-27", "publisherClass": "news" }, { "title": "Electronic medical record to be generalised nationally soon, 12 services for the national portal (Radio Algérienne)", "url": "http://news.radioalgerie.dz/ar/node/90382", "date": "2026-07-14", "publisherClass": "news" }, { "title": "Electronic medical record: digitisation by 15 November 2026 (Horizons)", "url": "https://www.horizons.dz/2026/09/dossier-medical-electronique-numerisation-dici-le-15-novembre-2026/", "date": "2026-09", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health research using personal data needs ANPDP authorisation and clinical studies need written, withdrawable consent. There is no general opt-out from secondary use, and no public register of uses was found.", "sources": [ { "title": "Law 18-07 of 10 June 2018 on personal data protection (Journal Officiel No. 34)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf", "date": "2018-06-10", "publisherClass": "legal_text" }, { "title": "Law 18-11 of 2 July 2018 on health (Journal Officiel No. 46)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf", "date": "2018-07-29", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "Under the 2018 health law, software built into a medical device is covered and devices need ANPP approval, but no rules for standalone or AI software on validation, change control or oversight were found. A national AI strategy is only now being put into practice.", "sources": [ { "title": "Law 18-11 of 2 July 2018 on health (Journal Officiel No. 46)", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf", "date": "2018-07-29", "publisherClass": "legal_text" }, { "title": "Regulatory texts on medical devices (ANPP)", "url": "https://anpp.dz/fr/textes-reglementaires-dm/", "date": "undated", "publisherClass": "official" }, { "title": "AI strategy in Algeria: an interministerial commission installed (Horizons)", "url": "https://www.horizons.dz/2026/08/strategie-de-lia-en-algerie-une-commission-interministerielle-installee/", "date": "2026-08-05", "publisherClass": "news" }, { "title": "Ait Messaoudene on building a complete digital health system (ENTV)", "url": "http://www.entv.dz/ar/news/%D8%A2%D9%8A%D8%AA-%D9%85%D8%B3%D8%B9%D9%88%D8%AF%D8%A7%D9%86-%D9%8A%D8%A4%D9%83%D8%AF-%D8%B9%D9%84%D9%89-%D8%AA%D8%AC%D8%B3%D9%8A%D8%AF-%D8%B1%D8%A4%D9%8A%D8%A9-%D9%85%D8%AA%D9%83%D8%A7%D9%85%D9%84%D8%A9-%D9%84%D8%A8%D9%86%D8%A7%D8%A1-%D9%85%D9%86%D8%B8%D9%88%D9%85%D8%A9-%D8%B5%D8%AD%D9%8A%D8%A9-%D8%B1%D9%82%D9%85%D9%8A%D8%A9-%D8%B4%D8%A7%D9%85%D9%84%D8%A9", "date": "2026-02-17", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 18-07 on protection of natural persons in personal data processing", "level": "National", "year": "2018", "what": "Health is sensitive data; access, objection rights; ANPDP created; prison and fines.", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018034.pdf" }, { "name": "Law 25-11 amending Law 18-07", "level": "National", "year": "2025", "what": "Adds DPO, processing records, automated logs, pseudonymisation, and a law-enforcement data title.", "url": "https://cna.dz/wp-content/uploads/2025/07/Loi-n%C2%B025-11.pdf" }, { "name": "Law 18-11 on health", "level": "National", "year": "2018", "what": "Medical secrecy, single national medical record, national health information system, clinical study consent.", "url": "https://www.joradp.dz/FTP/jo-francais/2018/F2018046.pdf" }, { "name": "Orders on medical device approval (ANPP)", "level": "National", "year": "2021", "what": "Approval files and changes to approval decisions for medical devices.", "url": "https://anpp.dz/fr/textes-reglementaires-dm/" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-01-14", "headline": "Laboratory reported a grave illness that two later tests did not confirm", "paraphrase": "A patient told El Watan that a first laboratory's blood test reported a grave illness. Repeat tests at two other laboratories came back negative, and she concluded the first result was an error.", "source": "El Watan", "url": "https://elwatan.dz/les-analyses-medicales-la-controverse-les-resultats-peuvent-varier-dun-laboratoire-a-un-autre/", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "AGO", "name": "Angola", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "97 to 158", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Angola has a strict 2011 data law with an active regulator, but no national health record, patient portal or record-sharing choices.", "categories": { "access": { "score": 35, "summary": "Article 26 of the 2011 data law gives a free right to learn what data is held, but health data is seen only through a doctor the patient chooses. There is no fixed deadline and no national patient portal.", "sources": [ { "title": "Lei n.º 22/11, de 17 de Junho, Lei da Protecção de Dados Pessoais (Diário da República I Série n.º 114), arts. 5, 9, 13, 14, 18, 19, 24, 26-28, 30-34, 38, 44, 51, 55", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf", "date": "2011-06-17", "publisherClass": "legal_text" }, { "title": "Lei n.º 21-B/92, Lei de Bases do Sistema Nacional de Saúde, arts. 12 and 13 (Angolex)", "url": "https://angolex.com/paginas/leis/lei-de-bases-do-sistema-nacional-de-saude-21bb-92a.html", "date": "1992-08-28", "publisherClass": "legal_text" } ] }, "control": { "score": 30, "summary": "Health data needs written consent or regulator authorisation, but care, diagnosis and health service management are exempt. We found no opt-out from record sharing and no patient-visible access log.", "sources": [ { "title": "Lei n.º 22/11, de 17 de Junho, Lei da Protecção de Dados Pessoais (Diário da República I Série n.º 114), arts. 5, 9, 13, 14, 18, 19, 24, 26-28, 30-34, 38, 44, 51, 55", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf", "date": "2011-06-17", "publisherClass": "legal_text" } ] }, "privacy": { "score": 52, "summary": "No health-sector enforcement was found, so this is scored on the general law: health is sensitive data and the regulator has fined 15 firms about USD 2.5 million since 2022. The 2011 text has no breach notification duty.", "sources": [ { "title": "Lei n.º 22/11, de 17 de Junho, Lei da Protecção de Dados Pessoais (Diário da República I Série n.º 114), arts. 5, 9, 13, 14, 18, 19, 24, 26-28, 30-34, 38, 44, 51, 55", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf", "date": "2011-06-17", "publisherClass": "legal_text" }, { "title": "Agência de Protecção de Dados, home page (deliberations on contravention cases, 2026)", "url": "https://apd.ao/ao/", "date": "undated", "publisherClass": "official" }, { "title": "Agência de Protecção de Dados já aplicou multas de 2,5 milhões USD desde 2022 (Expansão)", "url": "https://expansao.co.ao/empresas/detalhe/agencia-de-proteccao-de-dados-ja-aplicou-multas-de-25-milhoes-usd-desde-2022-73575.html", "date": "2026-07-29", "publisherClass": "news" }, { "title": "European Commission, Adequacy decisions", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 22, "summary": "The health ministry runs DHIS2 as its national health data platform for aggregate reporting, plus a telemedicine network. We found no national patient record, and electronic records in public hospitals are not verified at scale.", "sources": [ { "title": "MINSA, Angola afirma-se como referência africana na aplicação da inteligência artificial e da telemedicina", "url": "https://minsa.gov.ao/web/noticias/angola-afirma-se-como-referencia-africana-na-aplicacao-da-inteligencia-artificial-e-da-telemedicina-para-transformar-a-saude", "date": "2026-07-15", "publisherClass": "official" }, { "title": "MINSA, Angola e Huawei assinam Memorando de Entendimento para o reforço da Saúde Digital", "url": "https://minsa.gov.ao/web/noticias/angola-e-huawei-assinam-memorando-de-entendimento-para-o-reforco-da-saude-digital", "date": "2026-01-26", "publisherClass": "official" }, { "title": "Desafios e perspectivas da implementação do prontuário eletrônico em hospitais públicos angolanos (Revista FT, v.30 n.160)", "url": "https://www.revistaft.com/ft/article/view/1778", "date": "2026-07-15", "publisherClass": "academic" }, { "title": "WHO Africa, Angola desenvolve Plano Estratégico do Sistema de Informação Sanitária", "url": "https://www.afro.who.int/pt/countries/angola/news/angola-desenvolve-plano-estrategico-do-sistema-de-informacao-sanitaria", "date": "2024-03-05", "publisherClass": "intergov" } ] }, "commercial": { "score": 50, "summary": "Reuse of data for incompatible purposes is banned without consent, and electronic marketing needs prior express consent. We found no rules aimed at health apps, data brokers or sale of de-identified health data.", "sources": [ { "title": "Lei n.º 22/11, de 17 de Junho, Lei da Protecção de Dados Pessoais (Diário da República I Série n.º 114), arts. 5, 9, 13, 14, 18, 19, 24, 26-28, 30-34, 38, 44, 51, 55", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf", "date": "2011-06-17", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "The 1992 health law asks care levels to share relevant clinical information confidentially, but we found no system that lets a clinician see a patient's record from other providers. Telemedicine links specialists for consultations, not record access.", "sources": [ { "title": "Lei n.º 21-B/92, Lei de Bases do Sistema Nacional de Saúde, arts. 12 and 13 (Angolex)", "url": "https://angolex.com/paginas/leis/lei-de-bases-do-sistema-nacional-de-saude-21bb-92a.html", "date": "1992-08-28", "publisherClass": "legal_text" }, { "title": "MINSA, Angola afirma-se como referência africana na aplicação da inteligência artificial e da telemedicina", "url": "https://minsa.gov.ao/web/noticias/angola-afirma-se-como-referencia-africana-na-aplicacao-da-inteligencia-artificial-e-da-telemedicina-para-transformar-a-saude", "date": "2026-07-15", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Lei 7/25 requires written informed consent and ethics approval for research on people, with trial registration. Reuse of health records still allows regulator authorisation instead of consent, and there is no opt-out.", "sources": [ { "title": "Lei n.º 7/25, Lei sobre a Investigação Biomédica e Clínica (Angolex)", "url": "https://angolex.com/paginas/leis/lei-sobre-investigacao-biomedica-e-clinica-7a-25a.html", "date": "2025-07-24", "publisherClass": "legal_text" }, { "title": "Lei n.º 22/11, de 17 de Junho, Lei da Protecção de Dados Pessoais (Diário da República I Série n.º 114), arts. 5, 9, 13, 14, 18, 19, 24, 26-28, 30-34, 38, 44, 51, 55", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf", "date": "2011-06-17", "publisherClass": "legal_text" } ] }, "ai": { "score": 28, "summary": "No clinical AI rules are in force: a draft AI law that would require registration of critical AI, including health uses, was in public consultation from September 2025. We found no device rules for AI software.", "sources": [ { "title": "Lei sobre Inteligência Artificial prevê multas de até 1.500 milhões Kz e prisão até 12 anos (Expansão)", "url": "https://expansao.co.ao/angola/detalhe/lei-sobre-inteligencia-artificial-preve-multas-de-ate-1500-milhoes-kz-e-prisao-ate-12-anos-68260.html", "date": "2025-11-19", "publisherClass": "news" }, { "title": "Agência de Protecção de Dados, Projecto de Revisão da Lei n.º 22/11 (versão consulta pública)", "url": "https://www.consultapublica.gov.ao/public/uploads/docs/Projecto%20de%20Revis%C3%A3o%20da%20Lei%20de%20Protec%C3%A7%C3%A3o%20de%20Dados%20-%20Vers%C3%A3o%20Consulta%20P%C3%BAblica.pdf", "date": "2025-03-17", "publisherClass": "official" }, { "title": "MINSA, Angola afirma-se como referência africana na aplicação da inteligência artificial e da telemedicina", "url": "https://minsa.gov.ao/web/noticias/angola-afirma-se-como-referencia-africana-na-aplicacao-da-inteligencia-artificial-e-da-telemedicina-para-transformar-a-saude", "date": "2026-07-15", "publisherClass": "official" } ] } }, "laws": [ { "name": "Lei n.º 22/11, Lei da Protecção de Dados Pessoais", "level": "National", "year": "2011", "what": "Health is sensitive data; consent or APD authorisation; access via chosen doctor; fines to USD 150,000, tripled for companies.", "url": "https://apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_dados_pessoais.pdf" }, { "name": "Lei n.º 21-B/92, Lei de Bases do Sistema Nacional de Saúde", "level": "National", "year": "1992", "what": "Patient rights to confidentiality and information; asks care levels to share clinical information confidentially.", "url": "https://angolex.com/paginas/leis/lei-de-bases-do-sistema-nacional-de-saude-21bb-92a.html" }, { "name": "Lei n.º 7/25, Lei sobre a Investigação Biomédica e Clínica", "level": "National", "year": "2025", "what": "Written informed consent, CNBIS ethics approval, ARMED trial authorisation, public trial registration.", "url": "https://angolex.com/paginas/leis/lei-sobre-investigacao-biomedica-e-clinica-7a-25a.html" }, { "name": "Nova Lei de Bases do Sistema Nacional de Saúde (approved by parliament)", "level": "National", "year": "2026", "what": "Approved 13 August 2026 with 30% co-payment; publication and data provisions not verified.", "url": "https://www.novojornal.co.ao/politica/detalhe/nova-lei-de-bases-da-saude-altera-principio-de-gratuitidade-universal-em-vigor-ha-34-anos-73941.html" }, { "name": "Projecto de Revisão da Lei n.º 22/11 (draft, not in force)", "level": "National", "year": "2025", "what": "Draft adds 72-hour breach notice, portability and AI processing rules; consultation closed April 2025.", "url": "https://www.consultapublica.gov.ao/consulta/100021" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-12-20", "headline": "Hospital chiefs say unlinked systems make patients repeat registrations and tests between hospitals", "paraphrase": "Hospital directors and the national hospitals director said there is no single health information system, so a patient may be registered several times, exams are repeated, and transfers between hospitals happen without the patient's information reaching the receiving team.", "source": "Correio da Kianda", "url": "https://correiokianda.info/ausencia-de-sistema-informatico-de-saude-coloca-em-risco-vida-dos-pacientes/", "theme": "lost_between_providers", "status": "admitted" } ] }, { "iso3": "BFA", "name": "Burkina Faso", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "98 to 159", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A 2021 data law gives patients rights, but most records sit in paper registers at each facility and the data regulator is being merged.", "categories": { "access": { "score": 35, "summary": "Article 17 of Law 001-2021 gives a right to see or copy your data, and to read your health data directly or through a health professional. The requester pays copy costs, no deadline is set, and there is no national patient portal.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" }, { "title": "Manuel de procédures de gestion de l'information sanitaire, Ministère de la Santé (avril 2025)", "url": "https://www.sante.gov.bf/fileadmin/manuel_procedure_gestion_info_sanitaire_avril_2025.pdf", "date": "2025-04", "publisherClass": "official" } ] }, "control": { "score": 32, "summary": "Health data needs express consent, but care by health professionals bound by secrecy is exempt, so patients have no say over routine sharing. There is a right to object on legitimate grounds, and no patient-visible access log was found.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive data, identifiable health data must be hosted in Burkina Faso, and fines reach 1% of turnover (5% for repeat breaches). The law has no breach notification duty that we found, and the regulator is being folded into a media regulator.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" }, { "title": "Protection des informations à caractère personnel : la CIL sensibilise les membres du cabinet du ministère de la Santé (Sidwaya)", "url": "https://www.sidwaya.info/protection-des-informations-a-caractere-personnel-la-cil-sensibilise-les-membres-du-cabinet-du-ministere-de-la-sante/", "date": "2025-10-21", "publisherClass": "news" }, { "title": "Fusion du CSC et de la CIL : l'Assemblée législative du peuple adopte la loi portant création de l'ARCOD (Lefaso.net)", "url": "https://lefaso.net/spip.php?article148369", "date": "2026-08-03", "publisherClass": "news" }, { "title": "Décision n°2026-19/CC sur la loi organique n°038-2026/ALP (ARCOD), Conseil constitutionnel", "url": "https://www.conseil-constitutionnel.gov.bf/fileadmin/user_upload/decision_n__2026-019_du_20_aout_2026.pdf", "date": "2026-08-20", "publisherClass": "official" } ] }, "journey": { "score": 25, "summary": "In 2023 only 6% of regional and university hospitals had a hospital information system, and no interoperability layer existed. A set of eight linked tools ran in four districts, and the universal insurance scheme only began paying for care in February 2026.", "sources": [ { "title": "Plan triennal glissant de la santé numérique (PSSN 2025-2029), Ministère de la Santé", "url": "https://www.sante.gov.bf/fileadmin/ptg_pssn_2025_-_2029.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Burkina/Santé numérique : les résultats de l'évaluation de l'Écosystème digital minimal restitués (Lefaso.net)", "url": "https://lefaso.net/spip.php?article148067", "date": "2026-07-22", "publisherClass": "news" }, { "title": "How do countries select and use digital global goods in emergency settings? (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11935744/", "date": "2024-05-06", "publisherClass": "academic" }, { "title": "Régime d'assurance maladie universelle : les prestations de soins débutent le 1er février 2026 (Lefaso.net)", "url": "https://lefaso.net/spip.php?article143814", "date": "2026-01-18", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Article 14 bans any direct marketing using personal data without prior consent, and people must be asked before their data goes to third parties. We found no rules on selling de-identified health data or on health apps.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "A treating clinician usually sees only the paper or local record held by their own facility. Few hospitals had an information system in 2023, and we found no shared record clinicians can open across providers.", "sources": [ { "title": "Manuel de procédures de gestion de l'information sanitaire, Ministère de la Santé (avril 2025)", "url": "https://www.sante.gov.bf/fileadmin/manuel_procedure_gestion_info_sanitaire_avril_2025.pdf", "date": "2025-04", "publisherClass": "official" }, { "title": "Plan triennal glissant de la santé numérique (PSSN 2025-2029), Ministère de la Santé", "url": "https://www.sante.gov.bf/fileadmin/ptg_pssn_2025_-_2029.pdf", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Professionals may pass health data to authorised research unless the patient objects, and each project needs CIL authorisation after a binding ethics committee opinion. The objection runs against each professional's transfer, with no general opt-out, so the score stays in the 40 to 50 band.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" }, { "title": "Sixième session ordinaire de la CIL : le Collège des Commissaires examine plusieurs dossiers (CIL)", "url": "https://cil.bf/?p=1388", "date": "2026-08-25", "publisherClass": "official" }, { "title": "ANRP, Agence nationale de régulation pharmaceutique (official site)", "url": "https://anrp.bf/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 30, "summary": "We found no rules for AI as a medical device. The 2021 data law requires disclosing the criteria behind AI processing and prior authorisation for predictive AI, and a national AI roadmap for 2026-2030 was validated in June 2026.", "sources": [ { "title": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel (full text, Académie de police)", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel", "date": "2021-03-30", "publisherClass": "legal_text" }, { "title": "ANRP, Agence nationale de régulation pharmaceutique (official site)", "url": "https://anrp.bf/", "date": "undated", "publisherClass": "official" }, { "title": "Intelligence artificielle au Burkina Faso : vers la validation d'une feuille de route nationale (Sidwaya)", "url": "https://www.sidwaya.info/intelligence-artificielle-au-burkina-faso-vers-la-validation-dune-feuille-de-route-nationale/", "date": "2026-06-17", "publisherClass": "news" }, { "title": "IA : le Burkina Faso adopte sa feuille de route pour 2026-2030 (Wayeno)", "url": "https://wayeno.net/2026/06/24/ia-le-burkina-faso-adopte-sa-feuille-de-route-pour-2026-2030/", "date": "2026-06-24", "publisherClass": "news" } ] } }, "laws": [ { "name": "Loi n°001-2021/AN portant protection des personnes à l'égard du traitement des données à caractère personnel", "level": "National", "year": "2021", "what": "Access, consent for health data, research opt-out, local hosting of health data, CIL powers and fines.", "url": "https://academiedepolice.bf/index.php/telechargement/category/43-cybercriminalite?download=201:loi-n-001-2021-an-portant-sur-la-protection-des-donnees-a-caractere-personnel" }, { "name": "Loi organique n°038-2026/ALP (ARCOD)", "level": "National", "year": "2026", "what": "Merges the CIL and the media regulator into ARCOD; cleared by the Constitutional Council 20 August 2026.", "url": "https://www.conseil-constitutionnel.gov.bf/fileadmin/user_upload/decision_n__2026-019_du_20_aout_2026.pdf" }, { "name": "Loi portant protection des personnes physiques à l'égard du traitement des données à caractère personnel (2026)", "level": "National", "year": "2026", "what": "New data protection law adopted 3 August 2026; text and promulgation not verified.", "url": "https://www.sidwaya.info/surete-aerienne-et-protection-des-donnees-a-caractere-personnel-lassemblee-legislative-du-peuple-adopte-les-projets-de-lois/" }, { "name": "Loi n°23/94/ADP portant Code de la santé publique", "level": "National", "year": "1994", "what": "Main public health law, including disease notification and transfer of TB and leprosy files.", "url": "https://faolex.fao.org/docs/pdf/bkf197387.pdf" }, { "name": "Décret n°2018-0861/PRES/PM/MINEFID/MS (ANRP)", "level": "National", "year": "2018", "what": "Creates the pharmaceutical regulator that registers health products and authorises clinical trials.", "url": "https://anrp.bf/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "BDI", "name": "Burundi", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "99 to 160", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Burundi passed its first data protection law in March 2026, but its regulator is not yet running and hospital records stay in separate systems.", "categories": { "access": { "score": 40, "summary": "Since March 2026, Law 1/03 gives a free copy of your data within one month, but medical information goes only through a doctor you name. No national patient portal was found, and the data regulator does not exist yet, so the score sits at 40.", "sources": [ { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT copy of signed text)", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT notice)", "url": "https://arct.gov.bi/2026/03/18/loi-n1-03-du-10-mars-2026-portant-protection-des-donnees-a-caractere-personnel/", "date": "2026-03-18", "publisherClass": "official" }, { "title": "SETIC: workshop on the draft decree organising the Agence de Protection des Données à Caractère Personnel (SETIC on X)", "url": "https://x.com/seticburundi/status/2066841935315095724", "date": "2026-06-16", "publisherClass": "official" }, { "title": "Politique Nationale de Gouvernance des Données Sanitaires au Burundi 2024-2027 (Ministère de la Santé Publique)", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "The 2026 law lets people object and withdraw consent, but there is no opt-out from sharing and no patient-visible access log. A February 2026 health deal commits Burundi to give the US any data access needed to audit facilities.", "sources": [ { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT copy of signed text)", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "Politique Nationale de Gouvernance des Données Sanitaires au Burundi 2024-2027 (Ministère de la Santé Publique)", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Memorandum of Understanding between the United States and Burundi on health (State Department FOIA release, Public Citizen copy)", "url": "https://www.citizen.org/wp-content/uploads/BURUNDI_FL-2026-00021_August-2026-Production_RELEASE.pdf", "date": "2026-02-06", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is a banned category under Law 1/03 unless an exception applies, with 48-hour breach notice to the regulator and fines up to BIF 20 million. The regulator was not yet set up in mid-2026 and no enforcement exists.", "sources": [ { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT copy of signed text)", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "Assemblée nationale : analyse et adoption d'une loi portant protection des données à caractère personnel (Le Renouveau)", "url": "https://lerenouveau.bi/assemblee-nationale-du-burundi-analyse-et-adoption-dune-loi-portant-protection-des-donnees-a-caractere-personnel/", "date": "2026-01-15", "publisherClass": "news" }, { "title": "SETIC: workshop on the draft decree organising the Agence de Protection des Données à Caractère Personnel (SETIC on X)", "url": "https://x.com/seticburundi/status/2066841935315095724", "date": "2026-06-16", "publisherClass": "official" } ] }, "journey": { "score": 30, "summary": "Most public hospitals run their own software, but DHIS2, SIDAinfo and OpenClinic do not talk to each other, according to April 2026 reporting. A US-funded plan sets EMR, lab and pharmacy rollouts; progress against its 2026 targets is not verified.", "sources": [ { "title": "Memorandum of Understanding between the United States and Burundi on health (State Department FOIA release, Public Citizen copy)", "url": "https://www.citizen.org/wp-content/uploads/BURUNDI_FL-2026-00021_August-2026-Production_RELEASE.pdf", "date": "2026-02-06", "publisherClass": "legal_text" }, { "title": "Santé numérique : Enabel renforce les capacités pour une intelligence artificielle responsable au Burundi (Enabel)", "url": "https://open.enabel.be/fr/BDI/2771/3677/u/sante-numerique-enabel-renforce-les-capacites-pour-une-intelligence-artificielle-responsable-au-burundi.html", "date": "2026-07-10", "publisherClass": "official" }, { "title": "E-Santé : le Burundi numérise et unifie son système médical (Afrique IT News)", "url": "https://afriqueitnews.com/tech-media/e-sante-burundi-numerise-unifie-systeme-medical-pour-finir-avec-paperasse/", "date": "2026-04-15", "publisherClass": "news" }, { "title": "Politique Nationale de Gouvernance des Données Sanitaires au Burundi 2024-2027 (Ministère de la Santé Publique)", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 40, "summary": "Anyone can refuse, free of charge, the use of their data for commercial marketing, and unlawful processing of health data carries fines of BIF 0.5 to 5 million. No rules were found on selling de-identified data or on health apps.", "sources": [ { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT copy of signed text)", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf", "date": "2026-03-10", "publisherClass": "legal_text" } ] }, "clinical": { "score": 22, "summary": "A clinician can see the record held in their own hospital's system, but there is no shared record across providers. The 2019 national e-health plan described referral links to district hospitals only as a pilot in three health centres.", "sources": [ { "title": "Politique Nationale de Gouvernance des Données Sanitaires au Burundi 2024-2027 (Ministère de la Santé Publique)", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Plan National de Développement de l'Informatique de Santé 2020-2024 (PNDIS II), Ministry of Public Health (WHO copy)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/BDI_Burundi_National-plan-development-digital-health_2020-2024.pdf", "date": "2019", "publisherClass": "official" }, { "title": "Burundi : la digitalisation du système d'information hospitalier améliore la qualité des soins (Enabel)", "url": "https://open.enabel.be/fr/BDI/1942/2078/u/burundi-la-digitalisation-du-systeme-d-information-hospitalier-ameliore-la-qualite-des-soins-et-des-services-de-sante.html", "date": "2023-02-16", "publisherClass": "official" } ] }, "research": { "score": 50, "summary": "Law 1/03 allows research on health data with the person's consent, and a national ethics committee reviews studies. But Ministry policy lets facility directors approve research sharing, Article 49 fines unjustified objection to research use, and no regulator exists yet, so the score stays at 50.", "sources": [ { "title": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (ARCT copy of signed text)", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf", "date": "2026-03-10", "publisherClass": "legal_text" }, { "title": "Décret n°100/094 du 25 juin 2019 portant nomination des membres du Comité National d'Ethique (Présidence)", "url": "http://presidence.gov.bi/decret-n100094-du-25-juin-2019-portant-nomination-des-membres-du-comite-national-dethique-pour-la-protection-des-etres-humains-sujets-de-la-recherche-biomedicale-et-comportementale/", "date": "2019-07-02", "publisherClass": "official" }, { "title": "Politique Nationale de Gouvernance des Données Sanitaires au Burundi 2024-2027 (Ministère de la Santé Publique)", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "Burundi has no rules for clinical AI. A national AI strategy validated in April 2026 plans health pilots and an AI commission, but it is a plan, not regulation.", "sources": [ { "title": "Burundi : la Stratégie nationale de l'Intelligence artificielle validée (Digital Business Africa)", "url": "https://www.digitalbusiness.africa/burundi-la-strategie-nationale-de-lintelligence-artificielle-validee-axes-et-objectifs/", "date": "2026-04-22", "publisherClass": "news" }, { "title": "Intelligence artificielle : à Séoul, le Burundi présente ses ambitions (We Are Tech)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/intelligence-artificielle-a-seoul-le-burundi-presente-ses-ambitions", "date": "2026-09-10", "publisherClass": "news" }, { "title": "ABREMA documents and regulatory texts page", "url": "http://abrema.gov.bi/information/document", "date": "undated", "publisherClass": "official" }, { "title": "Santé numérique : Enabel renforce les capacités pour une intelligence artificielle responsable au Burundi (Enabel)", "url": "https://open.enabel.be/fr/BDI/2771/3677/u/sante-numerique-enabel-renforce-les-capacites-pour-une-intelligence-artificielle-responsable-au-burundi.html", "date": "2026-07-10", "publisherClass": "official" } ] } }, "laws": [ { "name": "Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel", "level": "National", "year": "2026", "what": "First data protection law: health data sensitive, free copy in one month, 48-hour breach notice, new agency.", "url": "https://arct.gov.bi/wp-content/uploads/2026/03/Loi-n%C2%B01_03-2026-protection-des-donnees-a-caractere-personnel_compressed.pdf" }, { "name": "Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité", "level": "National", "year": "2022", "what": "Cybercrime law; the 2026 data law says its own penalties apply alongside it (Article 51).", "url": "https://arct.gov.bi/2023/08/10/loi-n1-10-du-16-mars-2022-portant-prevention-et-repression-de-la-cybercriminalite-au-burundi/" }, { "name": "Politique Nationale de Gouvernance des Données Sanitaires 2024-2027", "level": "National", "year": "2024", "what": "Ministry rules on health data confidentiality, user accounts, national hosting, 20-year retention and anonymised sharing.", "url": "https://minisante.gov.bi/wp-content/uploads/document_valide/Politique%20Nationale%20de%20Gouvernance%20des%20Donn%C3%A9es%20Sanitaires%20au%20Burundi.pdf" }, { "name": "Décret n°100/094 portant nomination des membres du Comité National d'Ethique", "level": "National", "year": "2019", "what": "Appoints the national ethics committee that protects human subjects in biomedical and behavioural research.", "url": "http://presidence.gov.bi/decret-n100094-du-25-juin-2019-portant-nomination-des-membres-du-comite-national-dethique-pour-la-protection-des-etres-humains-sujets-de-la-recherche-biomedicale-et-comportementale/" }, { "name": "Memorandum of Understanding between the United States and Burundi on health", "level": "National", "year": "2026", "what": "Five-year health deal naming national EMR, lab and pharmacy systems and granting US audit data access.", "url": "https://www.citizen.org/wp-content/uploads/BURUNDI_FL-2026-00021_August-2026-Production_RELEASE.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "CUB", "name": "Cuba", "region": "Americas", "overall": 35, "rank": "121=", "likelyRank": "96 to 158", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Cuba's new health law grants unlimited access to one's clinical record, but a national digital record is still a project and state exceptions are broad.", "categories": { "access": { "score": 45, "summary": "The Public Health Law regulation (Decreto 133/2025) lets people access their clinical record without limits, and Ley 149 sets a 5 plus 10 working day deadline for data requests. No patient portal was found, and whether copies are free was not verified.", "sources": [ { "title": "Gaceta Oficial No. 9 Ordinaria 2026: Ley 165/2023 Ley de la Salud Publica and Decreto 133/2025 Reglamento", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Gaceta Oficial No. 90 Ordinaria 2022: Ley 149/2022 De Proteccion de Datos Personales", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf", "date": "2022-08-25", "publisherClass": "legal_text" } ] }, "control": { "score": 30, "summary": "Ley 149 requires express consent for health data but exempts prevention, diagnosis and urgent care, and also anything justified by public order, defence or national security. No access log or opt-out for patients was found.", "sources": [ { "title": "Gaceta Oficial No. 90 Ordinaria 2022: Ley 149/2022 De Proteccion de Datos Personales", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf", "date": "2022-08-25", "publisherClass": "legal_text" }, { "title": "Gaceta Oficial No. 9 Ordinaria 2026: Ley 165/2023 Ley de la Salud Publica and Decreto 133/2025 Reglamento", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf", "date": "2026-01-23", "publisherClass": "legal_text" } ] }, "privacy": { "score": 33, "summary": "Ley 149 treats health data as sensitive and requires breach reporting, but the top fine is 20,000 pesos and the Ministry of Justice, not an independent regulator, oversees compliance. Security exceptions are broad, and no enforcement record was found.", "sources": [ { "title": "Gaceta Oficial No. 90 Ordinaria 2022: Ley 149/2022 De Proteccion de Datos Personales", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf", "date": "2022-08-25", "publisherClass": "legal_text" }, { "title": "Gaceta Oficial No. 9 Ordinaria 2026: Ley 165/2023 Ley de la Salud Publica and Decreto 133/2025 Reglamento", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf", "date": "2026-01-23", "publisherClass": "legal_text" } ] }, "journey": { "score": 25, "summary": "The health minister said in February 2026 that digital transformation across all levels of care 'will not be immediate' because Cuba lacks the resources and technology. In January 2026, 98 institutions had digitised modules, and a digital clinical record was still a goal.", "sources": [ { "title": "Visito Diaz-Canel otro centro de Salud inmerso en la transformacion digital (Presidencia)", "url": "https://www.presidencia.gob.cu/es/noticias/visito-diaz-canel-otro-centro-de-salud-inmerso-en-la-transformacion-digital/", "date": "2026-01-30", "publisherClass": "official" }, { "title": "Mision de la OPS en Cuba para impulsar la transformacion digital en salud (OPS/OMS)", "url": "https://www.paho.org/es/noticias/23-10-2025-mision-ops-cuba-para-impulsar-transformacion-digital-salud", "date": "2025-10-23", "publisherClass": "intergov" }, { "title": "Nueva Ley de Salud Publica en Cuba: Una apuesta a largo plazo (Cubadebate)", "url": "http://www.cubadebate.cu/especiales/2026/02/20/nueva-ley-de-salud-publica-en-cuba-una-apuesta-a-largo-plazo-para-seguir-protegiendo-la-vida/", "date": "2026-02-20", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Ley 149 requires express consent before any party processes health data, and Resolucion 58/2022 says anonymised data may be shared for research only without commercial interest. No rules on health apps or data brokers and no enforcement were found.", "sources": [ { "title": "Gaceta Oficial No. 90 Ordinaria 2022: Ley 149/2022 and Resolucion 58/2022 (Ministerio de Comunicaciones)", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf", "date": "2022-08-25", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "The law gives treating staff full access to the record, but each facility keeps its own record, and only a digital record would be unique across the system. With digital records still limited, clinicians elsewhere usually cannot see it.", "sources": [ { "title": "Gaceta Oficial No. 9 Ordinaria 2026: Ley 165/2023 Ley de la Salud Publica and Decreto 133/2025 Reglamento", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Visito Diaz-Canel otro centro de Salud inmerso en la transformacion digital (Presidencia)", "url": "https://www.presidencia.gob.cu/es/noticias/visito-diaz-canel-otro-centro-de-salud-inmerso-en-la-transformacion-digital/", "date": "2026-01-30", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "De-identified data may be used without consent and no working opt-out was found. Three safeguards lift the score: ethics committees with a national research ethics commission, Ley 149 sanctions, and express consent for identified health data.", "sources": [ { "title": "Gaceta Oficial No. 9 Ordinaria 2026: Ley 165/2023 Ley de la Salud Publica and Decreto 133/2025 Reglamento", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf", "date": "2026-01-23", "publisherClass": "legal_text" }, { "title": "Gaceta Oficial No. 90 Ordinaria 2022: Ley 149/2022 and Resolucion 58/2022", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf", "date": "2022-08-25", "publisherClass": "legal_text" } ] }, "ai": { "score": 40, "summary": "The regulator CECMED's 2025 rule E 130-25 requires registration of medical software, with risk classes and regression-tested changes, but never mentions AI. The 2024 national AI strategy promises rules, so this scores like Bhutan and Belarus at 40.", "sources": [ { "title": "CECMED Resolucion 45/2025, Regulacion E 130-25 Requisitos para el Registro Sanitario del Software de Uso Medico", "url": "https://www.cecmed.cu/file/13820/download?token=blr-FIzU", "date": "2025-05-29", "publisherClass": "legal_text" }, { "title": "Politica para la Transformacion Digital, Agenda Digital Cubana y Estrategia de Inteligencia Artificial (Fiscalia General)", "url": "https://www.fgr.gob.cu/politica-para-la-transformacion-digital-agenda-digital-cubana-y-estrategia-de-inteligencia", "date": "2024-06-13", "publisherClass": "official" }, { "title": "Avanza Cuba en el uso de la Inteligencia Artificial para enfermedades cardiovasculares (Presidencia)", "url": "https://www.presidencia.gob.cu/es/noticias/avanza-cuba-en-el-uso-de-la-inteligencia-artificial-para-la-prediccion-y-tratamiento-de-enfermedades-cardiovasculares-audio/", "date": "2026-02-03", "publisherClass": "official" } ] } }, "laws": [ { "name": "Ley 149/2022 De Proteccion de Datos Personales", "level": "National", "year": "2022", "what": "Health data sensitive; express consent with care and security exceptions; access in 5 plus 10 days; fines to 20,000 pesos.", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf" }, { "name": "Resolucion 58/2022 (Ministerio de Comunicaciones), Reglamento para la Seguridad y Proteccion de los Datos Personales en Soporte Electronico", "level": "National", "year": "2022", "what": "Electronic data security; anonymised data for research only without commercial interest.", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf" }, { "name": "Ley 165/2023 Ley de la Salud Publica", "level": "National", "year": "2023", "what": "Published January 2026; patient rights, informed consent, research ethics, trial consent, digital health mandate.", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf" }, { "name": "Decreto 133/2025 Reglamento de la Ley 165", "level": "National", "year": "2025", "what": "Clinical record rules: unlimited patient access, inviolability, record unique per facility, ethics committees.", "url": "https://www.gacetaoficial.gob.cu/sites/default/files/goc-2026-o9.pdf" }, { "name": "CECMED Resolucion 45/2025, Regulacion E 130-25 (software de uso medico)", "level": "National", "year": "2025", "what": "Registration of medical software: risk classes, cybersecurity, regression tests and change summaries.", "url": "https://www.cecmed.cu/file/13820/download?token=blr-FIzU" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-08-16", "headline": "Mother says prison clinic refused her request for her detained daughter's medical record", "paraphrase": "The outlet reports that the mother of an adult woman in prison asked the clinic director for her daughter's medical file and was refused. She fears the record lists consultations and treatments that never happened.", "source": "Martí Noticias", "url": "https://www.martinoticias.com/a/seguridad-del-estado-filma-en-la-c%C3%A1rcel-a-presa-pol%C3%ADtica-en-necesidad-de-atenci%C3%B3n-m%C3%A9dica/422980.html", "theme": "access_refused", "status": "alleged" }, { "date": "2024-12-02", "headline": "Patient says specialist institute told her that her medical record had been erased", "paraphrase": "A patient told the outlet that the national institute where she had been registered for years informed her that her record had disappeared from its system, leaving her unable to book follow-up appointments.", "source": "Martí Noticias", "url": "https://www.martinoticias.com/a/me-estan-dejando-morir-afirma-paciente-de-vih-en-cuba-ante-falta-de-medicamentos-y-otras-carencias/405280.html", "theme": "other", "status": "alleged" }, { "date": "2026-01-29", "headline": "Prisoner says he has no access to his medical record or prescriptions", "paraphrase": "An adult prisoner told the outlet that after a hospital stay he was given no medicines in prison and could not learn what the specialist had prescribed, because he had never been given access to his medical record.", "source": "CubaNet", "url": "https://www.cubanet.org/preso-politico-walfrido-rodriguez-piloto-trasladado-a-la-prision-habanera-el-pitirre/", "theme": "access_refused", "status": "alleged" }, { "date": "2025-02-07", "headline": "Journalist says specialist wrote nothing in his record after a consultation", "paraphrase": "The outlet reports an adult journalist's account that a specialist who had earlier confirmed his diagnosis later played it down and made no entry at all in his medical record after the consultation.", "source": "ADN Cuba", "url": "https://adncuba.com/derechos-humanos/periodista-independiente-denuncia-deterioro-de-su-salud-por-falta-de-atencion/", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-06-08", "headline": "Families pursuing medical harm claims say full records are hard to obtain", "paraphrase": "A reported feature on complaints about medical errors finds that patients and families struggle to get the complete record, which stays with the institution, and that access can be limited or delayed.", "source": "Árbol Invertido", "url": "https://arbolinvertido.com/sociedad/reportaje-el-laberinto-de-reclamar-los-fallos-medicos-en-cuba", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "DJI", "name": "Djibouti", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "97 to 157", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Djibouti's 2025 Digital Code gives patients strong rights on paper, but its data commission is not verified as working and records stay in separate systems.", "categories": { "access": { "score": 35, "summary": "The 2025 Digital Code gives a right to a copy within one month, directly or through a chosen doctor, but copies can cost the reproduction price. Public bodies, which run most care, have two years to comply and there is no portal, so 35.", "sources": [ { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Loi n° 019/AN/23/9ème L Portant Code Numérique (eJO notice)", "url": "https://www.journalofficiel.dj/texte-juridique/loi-n019-an-23-9eme-l-portant-code-numerique/", "date": "2025-09-18", "publisherClass": "official" }, { "title": "Djibouti fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/djibouti/", "date": "2026-01-28", "publisherClass": "law_firm" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for care by a professional bound by secrecy, and there is no shared record, opt-out or access log in use. Article 731 makes the national ID number the compulsory health identifier.", "sources": [ { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "The Digital Code bans health data processing outside listed exceptions, requires 72-hour breach notice and allows fines up to DJF 70 million or 5% of turnover. With no health cases and no regulator verified as working, this scores the general law at 45.", "sources": [ { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Loi n° 195/AN/25/9ème L portant création de l'Autorité Nationale de Cybersécurité (eJO)", "url": "https://www.journalofficiel.dj/texte-juridique/loi-n195-an-25-9eme-l-portant-creation-de-lautorite-nationale-de-cybersecurite/", "date": "2025-12-15", "publisherClass": "legal_text" }, { "title": "Djibouti fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/djibouti/", "date": "2026-01-28", "publisherClass": "law_firm" } ] }, "journey": { "score": 30, "summary": "Facilities report to DHIS2 and a pharmacy stock system runs in 32 of the 60 public facilities in a World Bank project, but there is no national electronic record. The main hospital had no patient record system in October 2025 and was still defining one.", "sources": [ { "title": "Projet de Renforcement du système de santé de Djibouti (P178033), aide-mémoire de la revue à mi-parcours, 20-30 octobre 2025 (Banque mondiale)", "url": "https://documents1.worldbank.org/curated/en/099042726083034249/pdf/P178033-3dc4b2ca-53b1-4d30-93fd-137828ff9b0c.pdf", "date": "2026-04", "publisherClass": "intergov" }, { "title": "Djibouti améliore ses services de planification familiale grâce au dossier patient électronique (ONU Djibouti)", "url": "https://djibouti.un.org/fr/294824-djibouti-am%C3%A9liore-ses-services-de-planification-familiale-gr%C3%A2ce-au-dossier-patient", "date": "2025-05-15", "publisherClass": "intergov" }, { "title": "OMS à Djibouti : une action au cœur de la transformation du système de santé (La Nation)", "url": "https://www.lanation.dj/oms-a-djibouti-une-action-au-coeur-de-la-transformation-du-systeme-de-sante/", "date": "2026-09-17", "publisherClass": "news" }, { "title": "La santé au quotidien, janvier 2024 (Ministère de la Santé)", "url": "https://sante.gouv.dj/storage/publications/February2024/46et783Seu5WePSYDLqg.pdf", "date": "2024-02-12", "publisherClass": "official" } ] }, "commercial": { "score": 50, "summary": "Article 736 bans selling health data that can identify a person, even with their consent, with up to 5 years in prison. Electronic marketing needs prior consent, but we found no rules on health apps or de-identified data, and no enforcement.", "sources": [ { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" } ] }, "clinical": { "score": 22, "summary": "A clinician can see what is in their own facility's file, but there is no shared record across providers. The main hospital was still choosing a patient record system in late 2025.", "sources": [ { "title": "La santé au quotidien, janvier 2024 (Ministère de la Santé)", "url": "https://sante.gouv.dj/storage/publications/February2024/46et783Seu5WePSYDLqg.pdf", "date": "2024-02-12", "publisherClass": "official" }, { "title": "Projet de Renforcement du système de santé de Djibouti (P178033), aide-mémoire de la revue à mi-parcours, 20-30 octobre 2025 (Banque mondiale)", "url": "https://documents1.worldbank.org/curated/en/099042726083034249/pdf/P178033-3dc4b2ca-53b1-4d30-93fd-137828ff9b0c.pdf", "date": "2026-04", "publisherClass": "intergov" }, { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" } ] }, "research": { "score": 50, "summary": "Health research on personal data needs prior authorisation from the data commission after an expert committee opinion, and each person must be told and can object. With the commission not verified as working, the opt-out cannot yet be shown to operate, so 50.", "sources": [ { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Loi n°99/AN/10/6ème L portant création de l'Institut National de Santé Publique de Djibouti (ILO NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/85881/DJI-85881.pdf", "date": "2011-01-03", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "Djibouti has no rules for AI in clinical care and no regulation of AI as a medical device. A national AI strategy was presented in September 2026, and the readiness review found no AI law.", "sources": [ { "title": "Djibouti s'engage dans l'élaboration d'une stratégie nationale en matière d'IA (UNESCO)", "url": "https://www.unesco.org/fr/articles/djibouti-sengage-dans-lelaboration-dune-strategie-nationale-en-matiere-dia-alignee-aux-directives", "date": "2026-01-30", "publisherClass": "intergov" }, { "title": "Djibouti se dote d'une stratégie d'IA sur fond de préparation encore limitée (We Are Tech Africa)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/djibouti-se-dote-d-une-strategie-d-ia-sur-fond-de-preparation-encore-limitee", "date": "2026-09-04", "publisherClass": "news" }, { "title": "Loi n°019/AN/23/9ème L portant Code du Numérique (Journal Officiel, full text PDF)", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf", "date": "2025-09-18", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law 019/AN/23/9ème L on the Digital Code (Book One, personal data; Book Seven, health data)", "level": "National", "year": "2025", "what": "Health data banned category with exceptions; access within a month; 72-hour breach notice; ban on selling identifiable health data.", "url": "https://www.journalofficiel.dj/wp-content/uploads/2025/09/code-numerique.pdf" }, { "name": "Law 18/AN/23/9ème L ratifying the African Union Malabo Convention", "level": "National", "year": "2023", "what": "Ratifies the AU convention on cybersecurity and personal data protection.", "url": "https://www.journalofficiel.dj/texte-juridique/loi-n-18-an-23-9eme-ll-portant-ratification-de-la-convention-de-lunion-africaine-sur-la-cybersecurite-et-la-protection-de-donnees-a-caractere-personnel/" }, { "name": "Law 195/AN/25/9ème L creating the National Cybersecurity Authority", "level": "National", "year": "2025", "what": "Creates the ANC, which must help protect personal data in coordination with the data commission.", "url": "https://www.journalofficiel.dj/texte-juridique/loi-n195-an-25-9eme-l-portant-creation-de-lautorite-nationale-de-cybersecurite/" }, { "name": "Law 24/AN/14/7ème L on universal health insurance (AMU)", "level": "National", "year": "2014", "what": "Sets up universal health insurance run by the CNSS, with medical advisers bound by confidentiality.", "url": "https://www.journalofficiel.dj/texte-juridique/loi-n24-an-14-7eme-l-portant-mise-en-place-dun-systeme-dassurance-maladie-universelle/" }, { "name": "Law 99/AN/10/6ème L creating the National Institute of Public Health", "level": "National", "year": "2011", "what": "Creates INSPD and an ethics committee that gives opinions on research projects.", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/85881/DJI-85881.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "LSO", "name": "Lesotho", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "96 to 157", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Lesotho's 2012 data protection law has no regulator, and only HIV and TB care runs on a shared electronic record.", "categories": { "access": { "score": 35, "summary": "Section 26 of the Data Protection Act gives a right to get your data, but at a prescribed fee and within a prescribed time, and the regulator meant to enforce it was never set up. There is no patient portal.", "sources": [ { "title": "Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Government Gazette No. 19", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf", "date": "2012-02-22", "publisherClass": "legal_text" }, { "title": "Urgent gaps in cyber security, data protection outlined (Lesotho News Agency)", "url": "https://www.lena.gov.ls/urgent-gaps-in-cyber-security-data-protection-outlined/", "date": "2026-04-21", "publisherClass": "official" }, { "title": "MCC Set to Invest in Stronger Digital Health Systems in Lesotho (Millennium Challenge Corporation)", "url": "https://www.mcc.gov/blog/entry/blog-121123-digital-health-lesotho/", "date": "2023-12-11", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Providers may process health data without consent for treatment and running the facility, and there is no sharing setting or access log a patient can use. Insurers may assess risk with health data unless the person has objected.", "sources": [ { "title": "Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Government Gazette No. 19", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf", "date": "2012-02-22", "publisherClass": "legal_text" }, { "title": "From disease specific to universal health coverage in Lesotho: successes and challenges encountered in Lesotho's digital health journey (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932418/", "date": "2024-07-11", "publisherClass": "academic" } ] }, "privacy": { "score": 45, "summary": "Health is sensitive data under the 2011 Act, which requires breach notice and allows fines up to M50,000 or five years in prison. With no regulator after 14 years and no health-sector cases found, this scores the general law at the bottom of its band.", "sources": [ { "title": "Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Government Gazette No. 19", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf", "date": "2012-02-22", "publisherClass": "legal_text" }, { "title": "Urgent gaps in cyber security, data protection outlined (Lesotho News Agency)", "url": "https://www.lena.gov.ls/urgent-gaps-in-cyber-security-data-protection-outlined/", "date": "2026-04-21", "publisherClass": "official" }, { "title": "From disease specific to universal health coverage in Lesotho: successes and challenges encountered in Lesotho's digital health journey (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932418/", "date": "2024-07-11", "publisherClass": "academic" }, { "title": "How the US bullied Lesotho into a secretive new deal (News24, Bloomberg)", "url": "https://www.news24.com/business/economy/how-the-us-bullied-lesotho-into-a-secretive-new-deal-20260522-0616", "date": "2026-05-22", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "The eRegister links HIV, TB and maternal care with labs, pharmacy and DHIS2 at 187 of 277 facilities, but other care stays on paper. The US-funded plan to extend it to all primary care ended when MCC terminated its compact.", "sources": [ { "title": "From disease specific to universal health coverage in Lesotho: successes and challenges encountered in Lesotho's digital health journey (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932418/", "date": "2024-07-11", "publisherClass": "academic" }, { "title": "MCA-Lesotho II to close officially (Lesotho News Agency)", "url": "https://www.lena.gov.ls/36868-2/", "date": "2025-12-30", "publisherClass": "official" }, { "title": "Lesotho validates its Digital Health Strategy 2025-2030 (WHO Regional Office for Africa)", "url": "https://www.afro.who.int/countries/lesotho/news/lesotho-validates-its-digital-health-strategy-2025-2030-step-towards-transforming-healthcare-through", "date": "2024-12-10", "publisherClass": "intergov" } ] }, "commercial": { "score": 40, "summary": "Anyone can tell a company to stop using their data for direct marketing, and health data is a protected class. We found no rules on selling health data, data brokers or health apps, and no regulator to enforce the marketing right.", "sources": [ { "title": "Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Government Gazette No. 19", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf", "date": "2012-02-22", "publisherClass": "legal_text" }, { "title": "Data protection laws in Lesotho (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LS", "date": "2026-03-16", "publisherClass": "law_firm" } ] }, "clinical": { "score": 30, "summary": "For HIV and TB patients, staff at most facilities can see eRegister data, and patient identity data is pooled to track visits across sites. Other patients' history travels only in the paper booklet they carry.", "sources": [ { "title": "From disease specific to universal health coverage in Lesotho: successes and challenges encountered in Lesotho's digital health journey (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC11932418/", "date": "2024-07-11", "publisherClass": "academic" }, { "title": "Insights into healthcare workers' perceptions of electronic medical record system utilization: a cross-sectional study in Mafeteng district, Lesotho (BMC Medical Informatics and Decision Making)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12070494/", "date": "2025-05-12", "publisherClass": "academic" }, { "title": "MCC Set to Invest in Stronger Digital Health Systems in Lesotho (Millennium Challenge Corporation)", "url": "https://www.mcc.gov/blog/entry/blog-121123-digital-health-lesotho/", "date": "2023-12-11", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "The Data Protection Act exempts research use from most data rules, with no consent and no opt-out, but a national ethics committee reviews studies. Confidentiality duties and criminal penalties put it at the top of the no-opt-out band.", "sources": [ { "title": "Data Protection Act, 2011 (Act No. 5 of 2012), Lesotho Government Gazette No. 19", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf", "date": "2012-02-22", "publisherClass": "legal_text" }, { "title": "National Health Research Ethics Committee Lesotho (Health Research Web Africa)", "url": "https://healthresearchwebafrica.org.za/en/lesotho/ethics_4822", "date": "undated", "publisherClass": "academic" }, { "title": "Insights into healthcare workers' perceptions of electronic medical record system utilization: a cross-sectional study in Mafeteng district, Lesotho (BMC Medical Informatics and Decision Making)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12070494/", "date": "2025-05-12", "publisherClass": "academic" } ] }, "ai": { "score": 28, "summary": "Lesotho has no AI law and no rules for clinical AI. An AI Policy published in August 2026 leaves AI regulation to sector regulators, and the new medicines and devices authority has issued no AI rules we could find.", "sources": [ { "title": "Artificial Intelligence Policy Final 17/08/2026 (Government of Lesotho)", "url": "https://www.gov.ls/download/artificial-intelligence-policy-final-17-08-2026/", "date": "2026-08-17", "publisherClass": "official" }, { "title": "Lesotho accelerate AI roadmap (ITWeb Africa)", "url": "https://itweb.africa/article/lesotho-accelerate-ai-roadmap/6GxRKqYQ1gkqb3Wj", "date": "2026-08-18", "publisherClass": "news" }, { "title": "Now in Force: Lesotho Medicines and Medical Devices Control Authority Act, 2023 (Mayet & Associates)", "url": "https://zmayetlaw.co.ls/now-in-force-lesotho-medicines-medical-devices-control-authority-act-2023/", "date": "undated", "publisherClass": "law_firm" }, { "title": "Lesotho Medicines and Medical Devices Control Authority Bill (National Assembly of Lesotho)", "url": "https://nationalassembly.parliament.ls/wp-content/uploads/2023/05/MEDICINE-CONTROL-BILL-2022-ntha-version-Autosaved-2.pdf", "date": "undated", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection Act, 2011 (Act No. 5 of 2012)", "level": "National", "year": "2012", "what": "Health is sensitive data; access, correction and marketing objection rights; breach notice; Commission never established.", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Lesotho_DPA.pdf" }, { "name": "Lesotho Medicines and Medical Devices Control Authority Act, 2023 (Act No. 6 of 2023)", "level": "National", "year": "2023", "what": "Creates a regulator for medicines and medical devices and clinical trials; in force from 1 March 2026.", "url": "https://zmayetlaw.co.ls/now-in-force-lesotho-medicines-medical-devices-control-authority-act-2023/" }, { "name": "Artificial Intelligence Policy (policy, not law)", "level": "National", "year": "2026", "what": "Notes no AI-specific regulation exists; assigns AI oversight to sector regulators through future legislation.", "url": "https://www.gov.ls/download/artificial-intelligence-policy-final-17-08-2026/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-11-05", "headline": "Former miners say missing cross-border records leave them unable to prove claims", "paraphrase": "Former mineworkers home in Lesotho say incomplete mine records and poor coordination between South African and Lesotho authorities leave them without the proof a compensation fund requires. Some say they were refused with no reason given.", "source": "Lesotho Times", "url": "https://lestimes.com/?p=88916", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2025-10-13", "headline": "Former miner says a work-related medical certification was kept from him for years", "paraphrase": "A retired mineworker says a 2022 certificate showed he had been certified with a work-related illness in 2018, when he retired, but nobody told him until four years later.", "source": "MNN Centre for Investigative Journalism", "url": "https://lescij.org/2025/10/13/the-lingering-scars-of-mining-how-south-african-mines-left-basotho-miners-to-die/", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "MRT", "name": "Mauritania", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "99 to 160", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Mauritania has a 2017 data law and a working regulator that now reviews health platforms, but patients still have no shared record or portal.", "categories": { "access": { "score": 35, "summary": "Law 2017-020 gives you a right to a copy of your data, directly or through a doctor you choose. The holder may charge reproduction costs, the law sets no deadline, and no portal shows your record, so 35.", "sources": [ { "title": "Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Banque Centrale de Mauritanie copy)", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2017-07-22", "publisherClass": "legal_text" }, { "title": "E-CNAM : la plateforme numérique qui transforme l'accès à l'assurance maladie (Emergence)", "url": "https://emergence.mr/2025/12/02/e-cnam-la-plateforme-numerique-qui-transforme-lacces-a-lassurance-maladie/", "date": "2025-12-02", "publisherClass": "news" }, { "title": "وزير الصحة يطلق نظام الملف الطبي الإلكتروني والدفع الرقمي (Taqadoumy)", "url": "https://ar.taqadoumy.mr/archives/69133", "date": "2026-02-21", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data processing needs consent, but the law lists care, public health and legal duties as exceptions, and there is no shared record, opt-out or patient-visible access log. Telemedicine is the exception: other doctors need your explicit permission.", "sources": [ { "title": "Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Banque Centrale de Mauritanie copy)", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2017-07-22", "publisherClass": "legal_text" }, { "title": "Décret fixant les conditions d'exercice de la télémédecine et les domaines de son application en Mauritanie (MTNIMA)", "url": "https://mtnima.gov.mr/sites/default/files/2024-02/D%C3%A9cret%20n%C2%B02023-118%20Fixant%20les%20conditions%20d%27exercice%20de%20la%20t%C3%A9l%C3%A9m%C3%A9decine%20et%20les%20domaines%20de%20son%20application%20en%20Mauritanie.pdf", "date": "2023-10-02", "publisherClass": "legal_text" } ] }, "privacy": { "score": 52, "summary": "Health data is a banned category unless an exception applies, and the APD regulator is active in health: it gave a formal opinion on the CNAS health fund platform in 2026. There is no breach notification duty and no health fines were found.", "sources": [ { "title": "Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Banque Centrale de Mauritanie copy)", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2017-07-22", "publisherClass": "legal_text" }, { "title": "أعضاء السلطة (APD, members)", "url": "https://www.apd.mr/%D8%A3%D8%B9%D8%B6%D8%A7%D8%A1-%D8%A7%D9%84%D8%B3%D9%84%D8%B7%D8%A9/", "date": "undated", "publisherClass": "official" }, { "title": "المداولة رقم 004/2026 بخصوص منصة اكناسي لرقمنة خدمات الصندوق الوطني للتضامن الصحي (APD)", "url": "https://www.apd.mr/%D8%A7%D9%84%D9%85%D8%AF%D8%A7%D9%88%D9%84%D8%A9-%D8%B1%D9%82%D9%85-004-2026-%D8%AA%D8%AA%D8%B6%D9%85%D9%86-%D8%B1%D8%A3%D9%8A%D8%A7-%D8%A8%D8%AE%D8%B5%D9%88%D8%B5-%D9%85%D9%82%D8%B1%D8%B1-%D9%85/", "date": "2026-05-11", "publisherClass": "official" }, { "title": "انضمام مركز الاستطباب للأم والطفل إلى برنامج بيانات - حماية (APD)", "url": "https://www.apd.mr/%D8%A7%D9%86%D8%B6%D9%85%D8%A7%D9%85-%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D8%A7%D8%B3%D8%AA%D8%B7%D8%A8%D8%A7%D8%A8-%D9%84%D9%84%D8%A3%D9%85-%D9%88%D8%A7%D9%84%D8%B7%D9%81%D9%84-%D8%A5%D9%84%D9%89/", "date": "2026-06-29", "publisherClass": "official" } ] }, "journey": { "score": 25, "summary": "Insurance claims are going digital through E-CNAM, but a national medical record is still a plan. In August 2026 the health minister said an electronic record for every patient was still needed to build a modern hospital.", "sources": [ { "title": "Digitalisation du secteur de la santé (EEAS, EU Delegation to Mauritania)", "url": "https://www.eeas.europa.eu/delegations/mauritanie/digitalisation-du-secteur-de-la-sant%C3%A9_fr", "date": "2025-08-13", "publisherClass": "official" }, { "title": "E-CNAM : la plateforme numérique qui transforme l'accès à l'assurance maladie (Emergence)", "url": "https://emergence.mr/2025/12/02/e-cnam-la-plateforme-numerique-qui-transforme-lacces-a-lassurance-maladie/", "date": "2025-12-02", "publisherClass": "news" }, { "title": "وزير الصحة من مستشفى الشيخ زايد: الرقمنة الطبية تدخل حيز التنفيذ الأسبوع المقبل (Arriyada)", "url": "https://arriyada.net/213505/", "date": "2026-02-21", "publisherClass": "news" }, { "title": "Les ministres de la Santé et de la Transformation numérique président la commission ministérielle chargée de la réforme hospitalière (AMI via Cridem)", "url": "http://w.cridem.org/C_Info.php?article=795599", "date": "2026-08-07", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Direct marketing needs your prior consent, and data may go to third parties for marketing only with your formal agreement. The telemedicine decree bars platform owners from using patients' health data, but nothing covers health apps or data brokers.", "sources": [ { "title": "Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Banque Centrale de Mauritanie copy)", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2017-07-22", "publisherClass": "legal_text" }, { "title": "Décret fixant les conditions d'exercice de la télémédecine et les domaines de son application en Mauritanie (MTNIMA)", "url": "https://mtnima.gov.mr/sites/default/files/2024-02/D%C3%A9cret%20n%C2%B02023-118%20Fixant%20les%20conditions%20d%27exercice%20de%20la%20t%C3%A9l%C3%A9m%C3%A9decine%20et%20les%20domaines%20de%20son%20application%20en%20Mauritanie.pdf", "date": "2023-10-02", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "No national record lets a treating doctor see care from other providers. The telemedicine decree says earlier remote-care data should reach the next doctor with patient consent, and that it goes into a central record whose specifications were not verified.", "sources": [ { "title": "Décret fixant les conditions d'exercice de la télémédecine et les domaines de son application en Mauritanie (MTNIMA)", "url": "https://mtnima.gov.mr/sites/default/files/2024-02/D%C3%A9cret%20n%C2%B02023-118%20Fixant%20les%20conditions%20d%27exercice%20de%20la%20t%C3%A9l%C3%A9m%C3%A9decine%20et%20les%20domaines%20de%20son%20application%20en%20Mauritanie.pdf", "date": "2023-10-02", "publisherClass": "legal_text" }, { "title": "Les ministres de la Santé et de la Transformation numérique président la commission ministérielle chargée de la réforme hospitalière (AMI via Cridem)", "url": "http://w.cridem.org/C_Info.php?article=795599", "date": "2026-08-07", "publisherClass": "news" } ] }, "research": { "score": 45, "summary": "Health research on personal data needs prior authorisation from the APD, misuse of data is a crime, and the law gives a free right to object. A national health research ethics committee and a trials consent law were not verified, which caps this at 45.", "sources": [ { "title": "Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Banque Centrale de Mauritanie copy)", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2017-07-22", "publisherClass": "legal_text" }, { "title": "Régime de l'autorisation (APD)", "url": "https://www.apd.mr/fr/formalites-prealables/regime-de-lautorisation/", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 25, "summary": "The 2025-2029 national AI strategy plans AI for medical imaging and chronic disease monitoring, but no binding rule covers clinical AI. The 2025 pharmacy law reform covers medical devices; whether it covers software was not verified.", "sources": [ { "title": "The National Artificial Intelligence Strategy of Mauritania 2025-2029 (MTNIMA)", "url": "https://mtnima.gov.mr/wp-content/uploads/2024/07/strategie-EN-Final-26-07-2024-.pdf", "date": "2024-07", "publisherClass": "official" }, { "title": "L'Assemblée nationale approuve un projet de loi modifiant la loi relative à la pharmacie (AMI)", "url": "https://ami.mr/fr/archives/281857", "date": "2025-10-28", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law 2017-020 on the protection of personal data", "level": "National", "year": "2017", "what": "Health data a banned category with exceptions; access and copy rights; APD regulator, fines and criminal penalties.", "url": "https://fintech.bcm.mr/download/Loi-2017-020-sur-la-protection-des-donnees-a-caractere-personnel.pdf" }, { "name": "Decree 2022-013 on the composition, organisation and functioning of the APD", "level": "National", "year": "2022", "what": "Sets up the nine-member data protection authority that enforces Law 2017-020.", "url": "https://www.apd.mr/fr/decrets/" }, { "name": "Decree 2023-118 on the practice of telemedicine", "level": "National", "year": "2023", "what": "Consent per act, explicit patient authorisation for sharing, data hosted in Mauritania, platform owners barred from using data.", "url": "https://mtnima.gov.mr/sites/default/files/2024-02/D%C3%A9cret%20n%C2%B02023-118%20Fixant%20les%20conditions%20d%27exercice%20de%20la%20t%C3%A9l%C3%A9m%C3%A9decine%20et%20les%20domaines%20de%20son%20application%20en%20Mauritanie.pdf" }, { "name": "Law 2010-022 on pharmacy, amended 2015 and 2025", "level": "National", "year": "2025", "what": "Medicines and medical devices; 2025 reform adds device quality controls and digital medicine registration and tracking.", "url": "https://ami.mr/fr/archives/281857" }, { "name": "Decree 2024-154 on the Khidmati digital public services portal", "level": "National", "year": "2024", "what": "Rules for government e-service platforms, including the CNAS health fund platform reviewed by the APD.", "url": "https://www.apd.mr/%D8%A7%D9%84%D9%85%D8%AF%D8%A7%D9%88%D9%84%D8%A9-%D8%B1%D9%82%D9%85-004-2026-%D8%AA%D8%AA%D8%B6%D9%85%D9%86-%D8%B1%D8%A3%D9%8A%D8%A7-%D8%A8%D8%AE%D8%B5%D9%88%D8%B5-%D9%85%D9%82%D8%B1%D8%B1-%D9%85/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "NER", "name": "Niger", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "97 to 158", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A 2022 law gives detailed health data rights, but its regulator was abolished in June 2026 and most records stay inside each facility.", "categories": { "access": { "score": 35, "summary": "Article 69 of Law 2022-59 gives a right to see your data on site or get a copy, but the copy can be charged at reproduction cost and no deadline is set. There is no national patient portal.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Stratégie Nationale E-Santé 2019-2023, Ministère de la Santé Publique du Niger (WHO country planning repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/NER_Niger_National-eHealth-Strategy_2019-2023.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Niger: Plusieurs services rattachés ou sous tutelle de la Présidence, de la Primature et du SGG supprimés (ANP)", "url": "https://anp.ne/niger-plusieurs-services-rattaches-ou-sous-tutelle-de-la-presidence-de-la-primature-et-du-secretariat-general-du-gouvernement-supprimes/", "date": "2026-06-12", "publisherClass": "news" } ] }, "control": { "score": 32, "summary": "Health professionals may process health data for care without consent, so patients have no say over routine use. The law limits sharing to what care needs and bars insurers and employers, but there is no opt-out and no access log patients can see.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" } ] }, "privacy": { "score": 42, "summary": "The 2022 law treats health data as sensitive, requires breach notice and local hosting of identifiable health data, and fines up to 100 million CFA francs. But the independent regulator was abolished in June 2026 and its duties moved to the Justice and Interior ministries.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Niger: Plusieurs services rattachés ou sous tutelle de la Présidence, de la Primature et du SGG supprimés (ANP)", "url": "https://anp.ne/niger-plusieurs-services-rattaches-ou-sous-tutelle-de-la-presidence-de-la-primature-et-du-secretariat-general-du-gouvernement-supprimes/", "date": "2026-06-12", "publisherClass": "news" }, { "title": "Niger : Le président Tiani dissout 9 organismes d'État par décret (Journal du Niger)", "url": "https://www.journalduniger.com/niger-reforme-etat-dissolution-neuf-organismes-publics-decret-tiani/", "date": "2026-06-12", "publisherClass": "news" }, { "title": "Entretien avec le président de la Haute Autorité de Protection des Données à caractère Personnel (Le Sahel)", "url": "https://www.lesahel.org/entretien-avec-le-president-de-la-haute-autorite-de-protection-des-donnees-a-caractere-personnel-hapdp/", "date": "2025-07-28", "publisherClass": "news" } ] }, "journey": { "score": 27, "summary": "DHIS2 carries national reporting, and in July 2026 the ministry showed a national interoperability layer that already feeds disease surveillance data into it. Patient records sit in separate facility systems, with OpenClinic in ten facilities in two regions.", "sources": [ { "title": "Stratégie Nationale E-Santé 2019-2023, Ministère de la Santé Publique du Niger (WHO country planning repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/NER_Niger_National-eHealth-Strategy_2019-2023.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Santé numérique : Ouverture de l'atelier de validation de la feuille de route budgétisée du Schéma directeur national de la e-Santé 2025-2029 (ANP)", "url": "https://anp.ne/sante-numerique-ouverture-de-latelier-de-validation-de-la-feuille-de-route-budgetisee-du-schema-directeur-national-de-la-e-sante-2025-2029/", "date": "2026-07-08", "publisherClass": "news" }, { "title": "La digitalisation des hôpitaux améliore les soins au Niger (Enabel)", "url": "https://open.enabel.be/en/update/id/3490", "date": "2026-01-20", "publisherClass": "official" }, { "title": "District sanitaire de Gaya : Au rythme de la digitalisation et de l'assurance maladie (Le Sahel)", "url": "https://www.lesahel.org/district-sanitaire-de-gaya-au-rythme-de-la-digitalisation-et-de-lassurance-maladie/", "date": "2026-06-05", "publisherClass": "news" } ] }, "commercial": { "score": 45, "summary": "Any direct marketing using personal data needs prior consent, and insurers and employers may not receive health data unless a law allows it. We found no rules on health apps, data brokers or sales of de-identified data, and no enforcement case.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" } ] }, "clinical": { "score": 22, "summary": "Clinicians in the few facilities running OpenClinic can open a patient's history inside that facility. We found no shared record across providers, and the law limits any sharing to what care strictly needs.", "sources": [ { "title": "La digitalisation des hôpitaux améliore les soins au Niger (Enabel)", "url": "https://open.enabel.be/en/update/id/3490", "date": "2026-01-20", "publisherClass": "official" }, { "title": "District sanitaire de Gaya : Au rythme de la digitalisation et de l'assurance maladie (Le Sahel)", "url": "https://www.lesahel.org/district-sanitaire-de-gaya-au-rythme-de-la-digitalisation-et-de-lassurance-maladie/", "date": "2026-06-05", "publisherClass": "news" }, { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" } ] }, "research": { "score": 60, "summary": "Law 2022-59 allows research on health data only with the person's consent, after a binding CNERS ethics opinion, and requires anonymisation and local hosting. We found no public register of uses, and the regulator that authorised projects was abolished in June 2026.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Décret n°2016-644/PRN/MSP du 1er décembre 2016 portant création, missions, composition et fonctionnement du CNERS", "url": "https://healthresearchwebafrica.org.za/?action=download&file=ethiccomittee.pdf", "date": "2016-12-01", "publisherClass": "legal_text" }, { "title": "Loi n°2022-34 du 11 juillet 2022 déterminant les principes fondamentaux de la santé et de l'hygiène publique (FAOLEX)", "url": "https://faolex.fao.org/docs/pdf/ner234465.pdf", "date": "2022-07-11", "publisherClass": "legal_text" }, { "title": "Niger: Plusieurs services rattachés ou sous tutelle de la Présidence, de la Primature et du SGG supprimés (ANP)", "url": "https://anp.ne/niger-plusieurs-services-rattaches-ou-sous-tutelle-de-la-presidence-de-la-primature-et-du-secretariat-general-du-gouvernement-supprimes/", "date": "2026-06-12", "publisherClass": "news" } ] }, "ai": { "score": 30, "summary": "We found no rules for AI in clinical care or AI as a medical device. The 2022 data law makes AI developers declare to the regulator and requires telling people the criteria behind AI processing, but that regulator no longer exists.", "sources": [ { "title": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel, version consolidée (HAPDP, avril 2026)", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf", "date": "2026-04", "publisherClass": "legal_text" }, { "title": "Analyse du cadre légal et institutionnel des dispositifs médicaux dans les pays de l'UEMOA (JATPB)", "url": "https://soapgi-jatpb.org/index.php/jatpb/article/download/215/46/1300", "date": "2025-06-30", "publisherClass": "academic" }, { "title": "Niger: Plusieurs services rattachés ou sous tutelle de la Présidence, de la Primature et du SGG supprimés (ANP)", "url": "https://anp.ne/niger-plusieurs-services-rattaches-ou-sous-tutelle-de-la-presidence-de-la-primature-et-du-secretariat-general-du-gouvernement-supprimes/", "date": "2026-06-12", "publisherClass": "news" } ] } }, "laws": [ { "name": "Loi n°2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnel", "level": "National", "year": "2022", "what": "Access, health data rules, research consent, local hosting, breach notice, AI declarations, fines.", "url": "https://www.hapdp.ne/uploads/files/Loi-2022-59-consolidee.pdf" }, { "name": "Loi n°2023-31 du 4 juillet 2023 modifiant la loi n°2022-59", "level": "National", "year": "2023", "what": "Attached the HAPDP to the Presidency and set its membership at eleven.", "url": "https://www.hapdp.ne/uploads/files/Loi%20N%C2%B0%202023-31%20Modifiant%20la%20Loi%20N%C2%B0%202022-59.pdf" }, { "name": "Ordonnance n°2024-29 du 24 juin 2024 modifiant la loi n°2022-59", "level": "National", "year": "2024", "what": "Cut the HAPDP to ten members, two named by the head of the military government.", "url": "https://www.hapdp.ne/uploads/files/ordonnace-2024-29-du-24-juin-2024.pdf" }, { "name": "Décret n°2026-310/PRN/PM du 8 juin 2026", "level": "National", "year": "2026", "what": "Abolished the HAPDP and moved its missions to the Justice and Interior ministries.", "url": "https://www.journalduniger.com/niger-reforme-etat-dissolution-neuf-organismes-publics-decret-tiani/" }, { "name": "Loi n°2022-34 du 11 juillet 2022 déterminant les principes fondamentaux de la santé et de l'hygiène publique", "level": "National", "year": "2022", "what": "Informed consent to care and written consent for research on people.", "url": "https://faolex.fao.org/docs/pdf/ner234465.pdf" }, { "name": "Décret n°2016-644/PRN/MSP portant création du CNERS", "level": "National", "year": "2016", "what": "Creates the national health research ethics committee that reviews and validates protocols.", "url": "https://healthresearchwebafrica.org.za/?action=download&file=ethiccomittee.pdf" }, { "name": "African Union Convention on Cyber Security and Personal Data Protection (Malabo)", "level": "Supranational", "year": "2014", "what": "AU data protection and cybersecurity treaty; Niger's ratification reported in January 2022.", "url": "https://www.ouestaf.com/cybersecurite-le-niger-ratifie-la-convention-de-lua/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "NGA", "name": "Nigeria", "region": "Africa", "overall": 35, "rank": "121=", "likelyRank": "95 to 156", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "A modern data law on paper, but records stay inside each hospital and patients have no tool to see or steer who uses them.", "categories": { "access": { "score": 40, "summary": "Section 34 of the Data Protection Act 2023 gives a right to a copy in a common electronic format, but sets no day limit and lets providers pass on unreasonable costs. There is no national patient portal, so each hospital must be asked separately.", "sources": [ { "title": "Nigeria Data Protection Act, 2023 (Official Gazette copy, NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf", "date": "2023-07-01", "publisherClass": "legal_text" }, { "title": "NDP Act General Application and Implementation Directive (GAID) 2025 (NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "National Health Act, 2014 (Official Gazette, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "Patients' Bill of Rights (Consumer Protection Council and Federal Ministry of Health; copy hosted by Infusion Lawyers)", "url": "https://infusionlawyers.com/wp-content/uploads/2018/08/Patients-Bill-of-Rights-PBoR-Long-version.pdf", "date": "2018", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "The National Health Act requires written consent to disclose health information, but section 27 lets providers pass records to other providers without asking again. Patients may ask which recipients got their data, but no working opt-out or patient-visible log exists, so control sits with each facility.", "sources": [ { "title": "National Health Act, 2014 (Official Gazette, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "Nigeria Data Protection Act, 2023 (Official Gazette copy, NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf", "date": "2023-07-01", "publisherClass": "legal_text" }, { "title": "NDP Act General Application and Implementation Directive (GAID) 2025 (NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Nigerian govt sued over deal to share citizens' health data with US (Daily Trust, from Premium Times)", "url": "https://dailytrust.com/nigerian-govt-sued-over-deal-to-share-citizens-health-data-with-us/", "date": "2026-03-20", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health status is sensitive data under the 2023 Act, with 72-hour breach notice and fines of the greater of N10 million or 2% of revenue. But we found no health-sector enforcement, and a state teaching hospital was found unregistered in 2026.", "sources": [ { "title": "Nigeria Data Protection Act, 2023 (Official Gazette copy, NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf", "date": "2023-07-01", "publisherClass": "legal_text" }, { "title": "National Health Act, 2014 (Official Gazette, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "Inside Nigeria's deal to write off $32.8 million fine against Meta (Premium Times)", "url": "https://www.premiumtimesng.com/news/headlines/873350-exclusive-inside-nigerias-deal-to-write-off-32-8-million-fine-against-meta.html", "date": "2026-04-26", "publisherClass": "news" }, { "title": "Airlines, hospitals... major data controllers not registered under NDPC (FIJ)", "url": "https://fij.ng/article/alert-airlines-hospitals-major-data-controllers-not-registered-under-ndpc/", "date": "2026-05-30", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "An assessment of 79 federal tertiary hospitals found average EMR adoption of 74.5%, but the Minister of State says donor-built systems still cannot share patient information across facilities. A national architecture was endorsed in June 2025, yet no working exchange links hospitals, labs and pharmacies.", "sources": [ { "title": "Nigeria needs N500 billion to scale digital health infrastructure over five years (Premium Times)", "url": "https://www.premiumtimesng.com/health/health-news/890930-nigeria-needs-%E2%82%A6500-billion-to-scale-digital-health-infrastructure-over-five-years-official.html", "date": "2026-06-26", "publisherClass": "news" }, { "title": "Nigeria Digital in Health Initiative (Federal Ministry of Health and Social Welfare)", "url": "https://www.digitalhealth.gov.ng/", "date": "undated", "publisherClass": "official" }, { "title": "FG records major gains in health sector renewal, approves N32.8 billion BHCPF disbursement (Federal Ministry of Information)", "url": "https://fmino.gov.ng/fg-records-major-gains-in-health-sector-renewal-approves-n32-8-billion-bhcpf-disbursement-to-states/", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Federal Govt expands electronic medical records deployment across health facilities (Leadership)", "url": "https://leadership.ng/federal-govt-expands-electronic-medical-records-deployment-across-health-facilities/", "date": "2026-06-17", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "GAID 2025 requires consent for any direct marketing and for processing sensitive data such as health data. There are no rules we found on health apps, data brokers or sale of de-identified data, and the Meta settlement softened earlier consent orders on behavioural advertising.", "sources": [ { "title": "NDP Act General Application and Implementation Directive (GAID) 2025 (NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Nigeria Data Protection Act, 2023 (Official Gazette copy, NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf", "date": "2023-07-01", "publisherClass": "legal_text" }, { "title": "Inside Nigeria's deal to write off $32.8 million fine against Meta (Premium Times)", "url": "https://www.premiumtimesng.com/news/headlines/873350-exclusive-inside-nigerias-deal-to-write-off-32-8-million-fine-against-meta.html", "date": "2026-04-26", "publisherClass": "news" }, { "title": "Review of Nigeria's Digital Health Services Bill, 2025 (Tech Hive Advisory)", "url": "https://www.techhiveadvisory.africa/insights/review-of-nigerias-digital-health-services-bill-2025", "date": "2025-11-10", "publisherClass": "law_firm" } ] }, "clinical": { "score": 22, "summary": "A clinician usually sees only their own facility's record. Section 27 of the Health Act lets providers share for treatment, but there is no national record or exchange to pull a patient's history from elsewhere.", "sources": [ { "title": "National Health Act, 2014 (Official Gazette, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "Senate advances bill to integrate e-health services in Nigeria (Vanguard)", "url": "https://www.vanguardngr.com/2026/07/senate-advances-bill-to-integrate-e-health-services-in-nigeria/", "date": "2026-07-08", "publisherClass": "news" }, { "title": "Nigerian govt unveils blueprint for secure, interoperable digital health system (Premium Times)", "url": "https://www.premiumtimesng.com/news/top-news/898831-nigerian-govt-unveils-blueprint-for-secure-interoperable-digital-health-system.html", "date": "2026-07-28", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Research use of identifiable records needs the patient's authorisation, the facility head's approval and ethics clearance under section 28 of the Health Act, the same regime as South Africa. De-identified data is exempt, and there is no public register of uses.", "sources": [ { "title": "National Health Act, 2014 (Official Gazette, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "National Code of Health Research Ethics (NHREC, Federal Ministry of Health)", "url": "https://healthresearchwebafrica.org.za/files/NCHRECurrentVersion.pdf", "date": "2007-08-13", "publisherClass": "official" }, { "title": "Nigeria Data Protection Act, 2023 (Official Gazette copy, NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf", "date": "2023-07-01", "publisherClass": "legal_text" } ] }, "ai": { "score": 38, "summary": "NAFDAC registers software as a medical device under a 2024 guideline with risk classes and clinical validation, but it has no AI-specific rules. The Health Minister asked in July 2026 whether frameworks for health AI exist.", "sources": [ { "title": "Guidelines for Registration of Software as a Medical Device (SaMD) in Nigeria, DR&R-GDL-036-00 (NAFDAC)", "url": "https://nafdac.gov.ng/wp-content/uploads/Files/Resources/Guidelines/DR_And_R_Guidelines/Guidelines-for-Registration-of-Software-as-a-Medical-Device-SaMD-in-Nigeria.pdf", "date": "2024-07-01", "publisherClass": "official" }, { "title": "NDP Act General Application and Implementation Directive (GAID) 2025 (NDPC)", "url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "date": "2025-03-20", "publisherClass": "legal_text" }, { "title": "Senate begins consideration of bill to regulate AI diagnostics, IVF and emerging health technologies (National Assembly Library Trust Fund)", "url": "https://naltf.gov.ng/senate-begins-consideration-of-landmark-bill-to-regulate-ai-diagnostics-ivf-and-emerging-health-technologies/", "date": "2026-07-24", "publisherClass": "official" }, { "title": "Nigerian govt unveils blueprint for secure, interoperable digital health system (Premium Times)", "url": "https://www.premiumtimesng.com/news/top-news/898831-nigerian-govt-unveils-blueprint-for-secure-interoperable-digital-health-system.html", "date": "2026-07-28", "publisherClass": "news" } ] } }, "laws": [ { "name": "Nigeria Data Protection Act, 2023", "level": "National", "year": "2023", "what": "Health status is sensitive data; access, objection, 72-hour breach notice, fines of greater of N10 million or 2% revenue.", "url": "https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf" }, { "name": "NDP Act General Application and Implementation Directive (GAID) 2025", "level": "National", "year": "2025", "what": "Consent for marketing and sensitive data; portability; AI deployment duties under Article 43.", "url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf" }, { "name": "National Health Act, 2014", "level": "National", "year": "2014", "what": "Record keeping, confidentiality, provider sharing, research authorisation, offences for unauthorised record access.", "url": "https://faolex.fao.org/docs/pdf/nig162642.pdf" }, { "name": "National Health Insurance Authority Act, 2022", "level": "National", "year": "2022", "what": "Makes health insurance mandatory and requires state schemes to feed data into NHIA's ICT system.", "url": "https://p4h.world/app/uploads/2024/06/Nigeria-National-Health-Insurance-Act.x23411.pdf" }, { "name": "NAFDAC Guidelines for Registration of Software as a Medical Device", "level": "National", "year": "2024", "what": "Risk classes and clinical validation for medical software; no AI-specific provisions.", "url": "https://nafdac.gov.ng/wp-content/uploads/Files/Resources/Guidelines/DR_And_R_Guidelines/Guidelines-for-Registration-of-Software-as-a-Medical-Device-SaMD-in-Nigeria.pdf" }, { "name": "National E-Health Bill, 2026 (SB. 758)", "level": "National", "year": "2026", "what": "Pending: passed Senate second reading July 2026; would regulate and integrate electronic health services.", "url": "https://www.vanguardngr.com/2026/07/senate-advances-bill-to-integrate-e-health-services-in-nigeria/" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-01-18", "headline": "Patient paid repeatedly for the same tests because records did not follow her", "paraphrase": "A patient told reporters that each new hospital, private then public, made her repeat and pay for routine tests she had already done, because results were not transferable. A records officer said each hospital keeps its own unlinked system.", "source": "Sahara Reporters (republishing a Daily Trust report)", "url": "https://saharareporters.com/2025/01/18/non-harmonisation-health-records-nigerian-hospitals-slows-down-patients-during-medical", "theme": "lost_between_providers", "status": "self_reported" }, { "date": "2026-07-23", "headline": "Teaching hospital says patient case files are still carried by hand during digitisation", "paraphrase": "Responding to reports of consultation delays and piles of paper folders, the hospital's chief medical director said electronic records cover only two departments so far and the rest will follow in phases.", "source": "Punch", "url": "https://punchng.com/lasuth-defends-digitalisation-over-patient-record-concerns/", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "TKM", "name": "Turkmenistan", "region": "Asia", "overall": 35, "rank": "121=", "likelyRank": "99 to 160", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Turkmen law promises people their personal data free within a day, but there is no patient portal, no data regulator and broad state access.", "categories": { "access": { "score": 45, "summary": "The 2017 data law makes data holders give people any of their personal data free within one working day, though the Health Law promises only information about one's health. With no patient portal found and no data regulator to enforce it, the score is 45.", "sources": [ { "title": "Law No. 223-V on Protection of the Health of Citizens, Articles 13, 60 and 61 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/ru/post/24367/zakon-turkmenistana-%3Cbr%3Eob-okhrane-zdorovya-grazhdan*", "date": "2015-06-02", "publisherClass": "legal_text" }, { "title": "Law No. 519-V on Information about Private Life and its Protection, Articles 22, 26 and 27 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" }, { "title": "Ministry of Health and Medical Industry of Turkmenistan: interactive services", "url": "https://www.saglykhm.gov.tm/ru", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "The Health Law requires patient consent to collect data for electronic health records unless another law says otherwise, and the data law lets people withdraw consent. We found no opt-out from state health systems and no access log patients can see.", "sources": [ { "title": "Law No. 223-V on Protection of the Health of Citizens, Articles 60 and 61 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/ru/post/24367/zakon-turkmenistana-%3Cbr%3Eob-okhrane-zdorovya-grazhdan*", "date": "2015-06-02", "publisherClass": "legal_text" }, { "title": "Law No. 519-V on Information about Private Life and its Protection, Articles 8, 20 and 27 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" } ] }, "privacy": { "score": 30, "summary": "Health data is a special category under the 2017 data law, and patient e-records are confidential under the Health Law. But there is no data protection regulator, no breach notification duty, and law enforcement and state bodies may access patient records.", "sources": [ { "title": "Law No. 519-V on Information about Private Life and its Protection, Articles 12, 21, 24 and 28 to 31 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" }, { "title": "Law No. 223-V on Protection of the Health of Citizens, Article 60 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/ru/post/24367/zakon-turkmenistana-%3Cbr%3Eob-okhrane-zdorovya-grazhdan*", "date": "2015-06-02", "publisherClass": "legal_text" }, { "title": "Criminal Code of Turkmenistan (new edition), Article 144 (Mejlis of Turkmenistan)", "url": "https://mejlis.gov.tm/single-code/27?lang=ru", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 30, "summary": "The Health Ministry is tasked with an electronic health system, and a 2023 journal article reports the E-Saglyk system in 165 regional facilities with e-records for 1 million people. Current national coverage, e-prescriptions and lab links were not verified.", "sources": [ { "title": "Tasks and functions of the Ministry of Health and Medical Industry", "url": "https://www.saglykhm.gov.tm/ru/tasks-and-functions-of-the-ministry", "date": "undated", "publisherClass": "official" }, { "title": "Developing a digital transformation strategy for Turkmenistan's health care (Doctor and Information Technology, via CyberLeninka)", "url": "https://cyberleninka.ru/article/n/razrabotka-strategii-tsifrovoy-transformatsii-zdravoohraneniya-turkmenistana-aktsent-na-preodolenie-hronicheskih-neinfektsionnyh", "date": "2023", "publisherClass": "academic" }, { "title": "Turkmenistan runs a project to digitise interagency exchange (Turkmenportal)", "url": "https://turkmenportal.com/ru/news/96275-v-turkmenistane-realizuetsya-proekt-po-tsifrovizatsii-mezhvedomstvennogo-vzaimodeystviya-----", "date": "2025-11-12", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "The 2017 data law allows personal data to be used to market goods and services only with the person's prior consent, and health data needs written consent. No ban on selling health data and no enforcement case were found.", "sources": [ { "title": "Law No. 519-V on Information about Private Life and its Protection, Articles 7, 14, 21 and 26 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "The Health Law limits clinicians' access to electronic patient records to providing care. Whether a doctor can see a patient's record from other facilities was not verified, and no national record viewable at the point of care was found.", "sources": [ { "title": "Law No. 223-V on Protection of the Health of Citizens, Articles 1 and 60 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/ru/post/24367/zakon-turkmenistana-%3Cbr%3Eob-okhrane-zdorovya-grazhdan*", "date": "2015-06-02", "publisherClass": "legal_text" }, { "title": "Law No. 519-V on Information about Private Life and its Protection, Article 21 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" }, { "title": "Developing a digital transformation strategy for Turkmenistan's health care (Doctor and Information Technology, via CyberLeninka)", "url": "https://cyberleninka.ru/article/n/razrabotka-strategii-tsifrovoy-transformatsii-zdravoohraneniya-turkmenistana-aktsent-na-preodolenie-hronicheskih-neinfektsionnyh", "date": "2023", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "Drug trials need the participant's written consent, a state permit and an ethics committee review. State bodies may use de-identified personal data for statistics without consent, research use is exempt from transfer notices, and no opt-out was found.", "sources": [ { "title": "Law No. 319-V on Medicines Provision, Articles 22 and 23 (Ministry of Health and Medical Industry)", "url": "https://api.saglykhm.gov.tm/uploads/document_clgyltb0v000trnp8d0rt5lom.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law No. 519-V on Information about Private Life and its Protection, Articles 9 and 20 (Turkmenistan: Golden Age, state news agency)", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite", "date": "2017-04-08", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "In January 2026 the President approved plans to write rules for AI, including liability and national standards, but no AI law was found. The medicines law defines medical devices without mentioning software, and no AI device rules were found.", "sources": [ { "title": "Turkmenistan to develop a national legal framework for artificial intelligence (Turkmenistan: Golden Age, state news agency)", "url": "https://www.turkmenistan.gov.tm/ru/post/102615/turkmenistan-", "date": "2026-01-24", "publisherClass": "official" }, { "title": "Introducing AI in Turkmenistan's education system (Institute of International Relations, MFA of Turkmenistan)", "url": "https://iirmfa.edu.tm/ru/sahypa/vnedrenie-ii-v-sistemu-obrazovaniya-turkmenistana-otkryvaet-novye-vozmoznosti_1231", "date": "2026-08-29", "publisherClass": "official" }, { "title": "Law No. 319-V on Medicines Provision, Article 1 (Ministry of Health and Medical Industry)", "url": "https://api.saglykhm.gov.tm/uploads/document_clgyltb0v000trnp8d0rt5lom.pdf", "date": "undated", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law No. 223-V on Protection of the Health of Citizens", "level": "National", "year": "2015", "what": "Patient rights to health information, consent to care, confidential e-records with state access exceptions.", "url": "https://turkmenistan.gov.tm/ru/post/24367/zakon-turkmenistana-%3Cbr%3Eob-okhrane-zdorovya-grazhdan*" }, { "name": "Law No. 519-V on Information about Private Life and its Protection", "level": "National", "year": "2017", "what": "Consent, health as special category, free access to own data within a day, prosecutor oversight, local storage.", "url": "https://turkmenistan.gov.tm/index.php/ru/post/28474/zakon-turkmenistana-%3Cbr%3Eob-informatsii-o-lichnoi-zhizni-i-ee-zaschite" }, { "name": "Law No. 319-V on Medicines Provision", "level": "National", "year": "2016", "what": "Drug and device registration; clinical trials need written consent, permit and ethics committee review.", "url": "https://api.saglykhm.gov.tm/uploads/document_clgyltb0v000trnp8d0rt5lom.pdf" }, { "name": "Criminal Code of Turkmenistan (new edition), Article 144", "level": "National", "year": "2022", "what": "Punishes unlawful collection or spreading of private or family secrets without consent.", "url": "https://mejlis.gov.tm/single-code/27?lang=ru" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-20", "headline": "Patients say state health officials demand bribes to sign final medical reports", "paraphrase": "Patients seeking approval for treatment abroad say officials asked for 5,000 dollars before signing the final medical conclusion they need, and that people who do not pay can wait years for the document.", "source": "Turkmen.news", "url": "https://turkmen.news/2026/07/20/chinovniki-turkmenskogo-minzdrava-vymogayut-vzyatki-u-tyazhelobolnyh-pacientov-i-ignoriruyut-zaprosy-bolnic/", "theme": "access_delay_or_cost", "status": "alleged" }, { "date": "2025-08-14", "headline": "Teachers say medical check certificates are sold without anyone checking results", "paraphrase": "Teachers describe paying a bribe to have their required medical record books filled in, and one says a clinic doctor took samples but issued a certificate of normal results two hours later without checking them.", "source": "Chronicles of Turkmenistan (Хроника Туркменистана)", "url": "https://www.hronikatm.com/2025/08/teachers-in-turkmenabat-receive-certificates-of-medical-examination-for-bribes/", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "BLZ", "name": "Belize", "region": "Americas", "overall": 34, "rank": "132=", "likelyRank": "100 to 166", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Belize has run one public health record (BHIS) since 2008, but its 2021 data protection law is still not in force.", "categories": { "access": { "score": 25, "summary": "The Data Protection Act 2021 promises a free copy within one month, but in September 2026 it was still not in force. No patient portal for the BHIS record was found; the only patient app shows the vaccination card.", "sources": [ { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Release of personal records at Vital Stats now requires your explicit permission (XTV Belize)", "url": "https://www.facebook.com/XTelevisiombelize/posts/1818330063229482/", "date": "2026-09-15", "publisherClass": "news" }, { "title": "MOHW Announces Launch of Health Pass Vaccination App (Government of Belize Press Office)", "url": "https://www.pressoffice.gov.bz/mohw-announces-launch-of-health-pass-vaccination-app/", "date": "2021-12-02", "publisherClass": "official" }, { "title": "Members Rights and Responsibilities (National Health Insurance)", "url": "https://www.nhi.bz/members-rights-responsibilities/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "Every patient gets one client number in BHIS, which public clinicians use to see their history wherever they are treated. No opt-out and no patient-visible access log were found, and the 2021 consent rules are not in force.", "sources": [ { "title": "PAHO and MoH unveil Clinical Data Exchange Platform (Amandala)", "url": "https://amandala.com.bz/news/paho-and-moh-unveil-clinical-data-exchange-platform/", "date": "2024-09-25", "publisherClass": "news" }, { "title": "Belize health information goes digital (Bulletin of the World Health Organization)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC2636185/", "date": "2009-02", "publisherClass": "intergov" }, { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Members Rights and Responsibilities (National Health Insurance)", "url": "https://www.nhi.bz/members-rights-responsibilities/", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 30, "summary": "With the 2021 Act not in force, no data protection regulator operates, so this sits below the general-law band. The Act would bring 72-hour breach notice and fines up to $500,000, and no health data breach was found.", "sources": [ { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Release of personal records at Vital Stats now requires your explicit permission (XTV Belize)", "url": "https://www.facebook.com/XTelevisiombelize/posts/1818330063229482/", "date": "2026-09-15", "publisherClass": "news" }, { "title": "Health Sector Support Programme Belize: Final Report (PAHO/WHO, EU)", "url": "https://www.paho.org/sites/default/files/2025-09/health-sector-support-programme-belize-final-report12x9-digital-reduced.pdf", "date": "2025-09", "publisherClass": "intergov" } ] }, "journey": { "score": 55, "summary": "All 53 health facilities in PAHO's count were connected to BHIS by August 2025, and BHIS now exchanges data with the National Health Insurance system and the civil registry. Private providers join only in part, and some rural clinics resisted leaving paper.", "sources": [ { "title": "Health Sector Support Programme Belize: Final Report (PAHO/WHO, EU)", "url": "https://www.paho.org/sites/default/files/2025-09/health-sector-support-programme-belize-final-report12x9-digital-reduced.pdf", "date": "2025-09", "publisherClass": "intergov" }, { "title": "Belize Health Sector Strategic Plan 2025-2034 (Ministry of Health and Wellness)", "url": "https://www.paho.org/sites/default/files/2025-03/blz-health-sector-strategic-plan-2025-2034_0.pdf", "date": "2025-03-21", "publisherClass": "official" }, { "title": "Launch of the Civil Registry and Vital Statistics System (Ministry of E-Governance)", "url": "https://egov.gov.bz/2026/02/26/launch-of-the-civil-registry-and-vital-statistics-system/", "date": "2026-02-26", "publisherClass": "official" }, { "title": "PAHO/WHO Belize and the Ministry of Health and Wellness advance diagnostic coding through ICD-11 (PAHO)", "url": "https://www.paho.org/en/news/17-6-2025-pahowho-belize-and-ministry-health-and-wellness-advances-diagnostic-coding-health", "date": "2025-06-17", "publisherClass": "intergov" } ] }, "commercial": { "score": 25, "summary": "No law in force limits the sale or marketing use of health data. The 2021 Act would add a right to stop direct marketing, but health is not on its sensitive-data list and the Act has not started.", "sources": [ { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "Release of personal records at Vital Stats now requires your explicit permission (XTV Belize)", "url": "https://www.facebook.com/XTelevisiombelize/posts/1818330063229482/", "date": "2026-09-15", "publisherClass": "news" } ] }, "clinical": { "score": 55, "summary": "A clinician in any Ministry facility can look up a patient's BHIS history by client number, and BHIS reached all 53 health facilities in PAHO's count by 2025. Private clinicians outside BHIS do not share this view.", "sources": [ { "title": "PAHO and MoH unveil Clinical Data Exchange Platform (Amandala)", "url": "https://amandala.com.bz/news/paho-and-moh-unveil-clinical-data-exchange-platform/", "date": "2024-09-25", "publisherClass": "news" }, { "title": "Belize health information goes digital (Bulletin of the World Health Organization)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC2636185/", "date": "2009-02", "publisherClass": "intergov" }, { "title": "Health Sector Support Programme Belize: Final Report (PAHO/WHO, EU)", "url": "https://www.paho.org/sites/default/files/2025-09/health-sector-support-programme-belize-final-report12x9-digital-reduced.pdf", "date": "2025-09", "publisherClass": "intergov" }, { "title": "Belize Health Sector Strategic Plan 2025-2034 (Ministry of Health and Wellness)", "url": "https://www.paho.org/sites/default/files/2025-03/blz-health-sector-strategic-plan-2025-2034_0.pdf", "date": "2025-03-21", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "No consent rule or opt-out governs research use of health data, since the 2021 Act is not in force. One safeguard counts: from March 2026 all public health research with human participants needs Ministry IRB approval.", "sources": [ { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" }, { "title": "MOHW press release: revised research protocol submission through the MOHW IRB (Ministry of Health and Wellness)", "url": "https://www.facebook.com/Belizehealth/posts/for-immediate-releaseministry-of-health-and-wellnessbelizefebruary-20-2026mohw-s/939328938620618/", "date": "2026-02-20", "publisherClass": "official" }, { "title": "Health Ministry Tightens Public Health Research Oversight with IRB Transition (Love FM)", "url": "https://lovefm.com/health-ministry-tightens-public-health-research-oversight-with-irb-transition/", "date": "2026-02-20", "publisherClass": "news" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found. The e-governance ministry backs \"augmented AI\" that supports rather than replaces human decisions, including in health, but has adopted no binding framework.", "sources": [ { "title": "Advancing Belize's Digital Future through Responsible AI (Ministry of E-Governance)", "url": "https://egov.gov.bz/2026/02/26/advancing-belizes-digital-future-through-responsible-ai-december-31st2025/", "date": "2025-12-31", "publisherClass": "official" }, { "title": "Belize Health Sector Strategic Plan 2025-2034 (Ministry of Health and Wellness)", "url": "https://www.paho.org/sites/default/files/2025-03/blz-health-sector-strategic-plan-2025-2034_0.pdf", "date": "2025-03-21", "publisherClass": "official" }, { "title": "Data Protection Act, 2021 (Act No. 45 of 2021)", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf", "date": "2021", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection Act, 2021 (Act No. 45 of 2021)", "level": "National", "year": "2021", "what": "Free access within one month, 72-hour breach notice; health is not sensitive data. Not yet in force.", "url": "https://egov.gov.bz/wp-content/uploads/2023/02/Act-No.-45-of-2021-Data-Protection-Act.pdf" }, { "name": "Freedom of Information Act, Cap. 13", "level": "National", "year": "1994", "what": "Right of access to documents of ministries and prescribed authorities, with review by the Ombudsman.", "url": "https://www.agm.gov.bz/uploads/laws/63976dad2084d_Cap_13_Freedom_of_Information_Act.pdf" }, { "name": "Social Security Act, Cap. 44 (National Health Insurance Part)", "level": "National", "year": "2001", "what": "Creates the National Health Insurance Scheme as the financing and purchasing mechanism for health care.", "url": "https://www.ruraltransformation.gov.bz/docs/29/Cap_44_Social_Security_Act.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-05-19", "headline": "Patient says private hospital has refused for months to release her records", "paraphrase": "A patient said a private hospital refused to release her records despite letters from her lawyer since the previous year. She wanted them to understand her past care. Her lawyer said he would go to court to obtain them.", "source": "7 News Belize", "url": "https://www.7newsbelize.com/sstory.php?nid=74278", "theme": "access_refused", "status": "alleged" }, { "date": "2025-02-05", "headline": "Patient told hospital policy bars her from seeing her own medical records", "paraphrase": "A friend acting for a patient said a private hospital denied their request for the patient's medical records, citing hospital policy, after something went wrong in the patient's care. No one from the hospital had met them to explain.", "source": "7 News Belize", "url": "https://7newsbelize.com/sstory.php?nid=73197", "theme": "access_refused", "status": "alleged" } ] }, { "iso3": "COD", "name": "Democratic Republic of the Congo", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "101 to 162", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "A 2023 Digital Code gives strong rights on paper, but the data regulator was never set up and records stay in each facility.", "categories": { "access": { "score": 40, "summary": "The 2023 Digital Code gives a right to a copy of your data within 60 days, but the health law only promises a written summary of your condition. No national patient portal works at scale, so the score is 40.", "sources": [ { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" }, { "title": "Loi n°18/035 du 13 décembre 2018 fixant les principes fondamentaux relatifs à l'organisation de la santé publique (Leganet)", "url": "https://www.leganet.be/Legislation/Droit%20Public/SANTE/Loi.18.035.13.12.2018.html", "date": "2018-12-13", "publisherClass": "legal_text" }, { "title": "Santé RDC, official ANICNS app (Google Play listing)", "url": "https://play.google.com/store/apps/details?id=com.anicns.santerdc&hl=fr", "date": "2026-04-25", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "Health data needs explicit consent unless a care, public-health or public-interest exception applies, and people can object for legitimate reasons. There is no opt-out from sharing and no patient-visible access log, so the score is 28.", "sources": [ { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" }, { "title": "U.S. Government Factsheet: Health Memorandum of Understanding (U.S. Embassy Kinshasa)", "url": "https://cd.usembassy.gov/u-s-government-factsheet-health-memorandum-of-understanding/", "date": "2026-02-27", "publisherClass": "official" }, { "title": "L'ANICNS au cœur de la transformation digitale du système de santé en RDC (ANICNS)", "url": "https://anicns.gouv.cd/news.html?id=c0345c2b", "date": "2023-10-25", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "Health data is a banned category, medical processing needs prior approval, and breaches must be reported without delay. No health-sector sanctions were found and a telecom regulator stands in for the data authority, so this scores the general law at its band floor, 45.", "sources": [ { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" }, { "title": "Décision n°039/ARPTC/CLG/2025 du 11 septembre 2025 on authorisation and declaration of personal data processing (Journal officiel, numéro spécial, 23 avril 2026)", "url": "https://www.africadataprotection.org/RDC-l-ARPTC-precise-les-procedures-d-autorisation-et-de-declaration-des-traitements-de-donnees-personnelles.pdf", "date": "2026-04-23", "publisherClass": "legal_text" }, { "title": "Régulation du numérique en RDC : l'ARPTIC investie autorité unique (Droit-Numérique.cd, Dossier n°4)", "url": "https://droitnumerique.cd/regulation-du-numerique-en-rdc-larptic-investie-autorite-unique-pour-la-regulation-du-numerique-la-certification-electronique-et-la-protection-des-donnees/", "date": "2024-08", "publisherClass": "academic" } ] }, "journey": { "score": 28, "summary": "Facilities report aggregate data through the national DHIS2 system, but patient records stay in each hospital. The health agency is building a health ID and certifying hospital software for interoperability; no live national exchange was found.", "sources": [ { "title": "Appuyer l'utilisation efficace des données de santé en RDC (DHIS2 / HISP, University of Oslo)", "url": "https://dhis2.org/fr/drc-data-use/", "date": "2022-08-23", "publisherClass": "academic" }, { "title": "Ordonnance-loi n°23/006 du 3 mars 2023 modifiant et complétant la loi n°18/035 (ANICNS copy)", "url": "https://anicns.gouv.cd/restapi/uploads/documents/loi_csu_23_006_du_03_mars_2023.pdf", "date": "2023-03-03", "publisherClass": "legal_text" }, { "title": "Couverture Santé Universelle: contribution de l'ANICNS (ANICNS)", "url": "https://anicns.gouv.cd/news.html?id=c0345c2kascouverture", "date": "2024-03-29", "publisherClass": "official" }, { "title": "Homologation des Systèmes d'Information Hospitalier (SIH) en RDC, ANICNS call AMI N° ANICNS/AMI/001/SIH/2026 (Congo Quotidien)", "url": "https://www.congoquotidien.com/2026/06/16/actualite-rdc-homologation-sih-rdc/", "date": "2026-06-16", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "People must be told before their data is passed on for commercial use and can refuse free of charge, and sharing for marketing needs consent. No rules were found on selling de-identified health data or on health apps.", "sources": [ { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "A clinician sees only the record held by their own facility, often on paper. There is no shared record across providers yet; donor projects are still buying computers to digitise patient files in district hospitals.", "sources": [ { "title": "Loi n°18/035 du 13 décembre 2018 fixant les principes fondamentaux relatifs à l'organisation de la santé publique (Leganet)", "url": "https://www.leganet.be/Legislation/Droit%20Public/SANTE/Loi.18.035.13.12.2018.html", "date": "2018-12-13", "publisherClass": "legal_text" }, { "title": "L'ANICNS au cœur de la transformation digitale du système de santé en RDC (ANICNS)", "url": "https://anicns.gouv.cd/news.html?id=c0345c2b", "date": "2023-10-25", "publisherClass": "official" }, { "title": "Homologation des Systèmes d'Information Hospitalier (SIH) en RDC, ANICNS call AMI N° ANICNS/AMI/001/SIH/2026 (Congo Quotidien)", "url": "https://www.congoquotidien.com/2026/06/16/actualite-rdc-homologation-sih-rdc/", "date": "2026-06-16", "publisherClass": "news" }, { "title": "Fourniture des équipements pour la digitalisation du dossier des malades dans 4 hôpitaux généraux de référence au Kasaï Central (Congo Quotidien)", "url": "https://www.congoquotidien.com/2026/03/13/actualite-rdc-digitalisation-dossiers-malades-kasai/", "date": "2026-03-13", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Health data can be used for research without consent, but medical research processing needs the data authority's prior approval and studies go to an ethics committee. There is no general opt-out, so the score is 49.", "sources": [ { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" }, { "title": "Loi n°18/035 du 13 décembre 2018 fixant les principes fondamentaux relatifs à l'organisation de la santé publique (Leganet)", "url": "https://www.leganet.be/Legislation/Droit%20Public/SANTE/Loi.18.035.13.12.2018.html", "date": "2018-12-13", "publisherClass": "legal_text" }, { "title": "Lignes directrices pour l'évaluation éthique de la recherche impliquant des sujets humains en RD Congo (Ministère de la Santé, NIH ClinRegs copy)", "url": "https://clinregs.niaid.nih.gov/sites/default/files/documents/DRC/G-EthicalEval.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Décision n°039/ARPTC/CLG/2025 du 11 septembre 2025 on authorisation and declaration of personal data processing (Journal officiel, numéro spécial, 23 avril 2026)", "url": "https://www.africadataprotection.org/RDC-l-ARPTC-precise-les-procedures-d-autorisation-et-de-declaration-des-traitements-de-donnees-personnelles.pdf", "date": "2026-04-23", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "The DRC has no rules for clinical AI. A national AI strategy validated in August 2026 names health as a priority sector, but it is a plan, not regulation, and the medicines regulator has no published AI device rules.", "sources": [ { "title": "La RDC se dote d'une stratégie nationale pour une intelligence artificielle éthique et inclusive (UNESCO)", "url": "https://www.unesco.org/fr/articles/la-rdc-se-dote-dune-strategie-nationale-pour-une-intelligence-artificielle-ethique-et-inclusive", "date": "2026-08-05", "publisherClass": "intergov" }, { "title": "RDC : Augustin Kibassa lance la Politique sectorielle de l'économie numérique et la Stratégie nationale de l'IA (Mediacongo)", "url": "https://www.mediacongo.net/article-actualite-166222_rdc_s_e_augustin_kibassa_lance_la_politique_sectorielle_de_l_economie_numerique_et_la_strategie_nationale_de_l_ia_pour_batir_un_congo_souverain_connec.html", "date": "2026-08-05", "publisherClass": "news" }, { "title": "Mission de l'ACOREP (Autorité Congolaise de Réglementation Pharmaceutique)", "url": "https://acorep.gouv.cd/mission_acorep/", "date": "undated", "publisherClass": "official" }, { "title": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique (Droit-Numérique.cd copy of the text)", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf", "date": "2023-03-13", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Ordonnance-loi n°23/010 du 13 mars 2023 portant Code du numérique", "level": "National", "year": "2023", "what": "Data protection: health data banned with exceptions, 60-day copy, breach notice, local hosting, APD regulator.", "url": "https://droitnumerique.cd/wp-content/uploads/2024/08/Code-du-numerique-I-RD-Congo.pdf" }, { "name": "Loi n°18/035 du 13 décembre 2018 fixant les principes fondamentaux relatifs à l'organisation de la santé publique", "level": "National", "year": "2018", "what": "Patient rights, mandatory medical file kept 10 to 20 years, professional secrecy, national bioethics committee.", "url": "https://www.leganet.be/Legislation/Droit%20Public/SANTE/Loi.18.035.13.12.2018.html" }, { "name": "Ordonnance-loi n°23/006 du 3 mars 2023 modifiant et complétant la loi n°18/035", "level": "National", "year": "2023", "what": "Writes ANICNS into the health law (Article 44 bis) to digitise universal coverage; sets the coverage information system.", "url": "https://anicns.gouv.cd/restapi/uploads/documents/loi_csu_23_006_du_03_mars_2023.pdf" }, { "name": "Décision n°039/ARPTC/CLG/2025 du 11 septembre 2025", "level": "National", "year": "2025", "what": "Regulator, acting for the APD, sets prior authorisation procedure for medical and research data processing.", "url": "https://www.africadataprotection.org/RDC-l-ARPTC-precise-les-procedures-d-autorisation-et-de-declaration-des-traitements-de-donnees-personnelles.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-27", "headline": "Congo signs US health deal amid concern over who controls health data", "paraphrase": "A Kinshasa outlet reports that Congo joined 14 African countries in US health deals that tie funding to expanded health data systems and fast reporting, while critics warn of lost control over health data and public trust.", "source": "Mbote", "url": "https://mbote.cd/actualites/la-rdc-et-14-autres-pays-africains-signent-un-accord-controverse-pour-les-donnees-de-sante-avec-les-usa/199387/", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "DOM", "name": "Dominican Republic", "region": "Americas", "overall": 34, "rank": "132=", "likelyRank": "99 to 160", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Dominican patients have a legal right to their data but no national record or portal; a single digital record is still in pilots.", "categories": { "access": { "score": 40, "summary": "Ley 172-13 gives a right to obtain one's data within five business days, but there is no national patient portal and copy fees were not verified. The health law does not name a right to a chart copy, so the score sits below the 45 base.", "sources": [ { "title": "Ley No. 172-13 sobre Proteccion de Datos Personales (Superintendencia de Bancos)", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf", "date": "2013-12-15", "publisherClass": "legal_text" }, { "title": "Ley General de Salud No. 42-01 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/dom75084.pdf", "date": "2001-03-08", "publisherClass": "legal_text" }, { "title": "La transformacion digital en salud apunta a una atencion mas justa y oportuna (Diario Libre)", "url": "https://www.diariolibre.com/actualidad/salud/2025/12/15/transformacion-digital-en-salud-apunta-a-una-atencion-mas-justa/3378335", "date": "2025-12-15", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data needs express written consent under Ley 172-13, but the law lets hospitals and clinicians process it for care without that consent. No opt-out from sharing and no patient-visible access log were found.", "sources": [ { "title": "Ley No. 172-13 sobre Proteccion de Datos Personales (Superintendencia de Bancos)", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf", "date": "2013-12-15", "publisherClass": "legal_text" }, { "title": "Ley General de Salud No. 42-01 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/dom75084.pdf", "date": "2001-03-08", "publisherClass": "legal_text" }, { "title": "SNS e INDOTEL disenan red digital que conectara todos los hospitales publicos (Acento)", "url": "https://acento.com.do/actualidad/sns-e-indotel-disenan-red-digital-que-conectara-todos-los-hospitales-publicos-9686606.html", "date": "2026-05-26", "publisherClass": "news" } ] }, "privacy": { "score": 35, "summary": "Ley 172-13 treats health data as sensitive and sets prison terms of six months to two years for violations, but it creates no data protection authority outside credit bureaus. In 2024 the Health Ministry confirmed theft of over 8,000 vaccination files.", "sources": [ { "title": "Ley No. 172-13 sobre Proteccion de Datos Personales (Superintendencia de Bancos)", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf", "date": "2013-12-15", "publisherClass": "legal_text" }, { "title": "Piratas informaticos intervienen el sistema del Ministerio de Salud Publica y roban ocho mil archivos de vacunados (INS)", "url": "https://internewsservice.com/2024/04/14/r-dominicana-piratas-informaticos-intervienen-el-sistema-del-ministerio-de-salud-publica-y-le-roban-ocho-mil-archivos-de-vacunados-contra-covid-19/", "date": "2024-04-14", "publisherClass": "news" }, { "title": "Salud y el nuevo Codigo Penal: lo que el sector debe saber en su primer dia de vigencia (Diario Salud)", "url": "https://diariosalud.do/salud-y-el-nuevo-codigo-penal-lo-que-el-sector-debe-saber-en-su-primer-dia-de-vigencia/", "date": "2026-08-03", "publisherClass": "news" }, { "title": "Ley No. 53-07 sobre Crimenes y Delitos de Alta Tecnologia (OAS copy)", "url": "https://www.oas.org/juridico/PDFs/repdom_ley5307.pdf", "date": "2007-04-23", "publisherClass": "legal_text" } ] }, "journey": { "score": 30, "summary": "The Ministry of Health's single patient record was still a pilot in December 2025, and in May 2026 records still did not travel between public hospitals. A network linking all public centres and insurers (ARS) has no published timeline.", "sources": [ { "title": "Gobierno impulsa el uso de tecnologias sanitarias con la Estrategia Nacional de Salud Digital (Ministerio de Salud Publica)", "url": "https://msp.gob.do/web/?p=18569", "date": "2024-08-07", "publisherClass": "official" }, { "title": "Cuatro hospitales participaran en piloto expediente unico (Diario Libre)", "url": "https://www.diariolibre.com/actualidad/salud/2024/08/21/cuatro-hospitales-participaran-en-piloto-expediente-unico/2825045", "date": "2024-08-21", "publisherClass": "news" }, { "title": "SNS e INDOTEL disenan red digital que conectara todos los hospitales publicos (Acento)", "url": "https://acento.com.do/actualidad/sns-e-indotel-disenan-red-digital-que-conectara-todos-los-hospitales-publicos-9686606.html", "date": "2026-05-26", "publisherClass": "news" }, { "title": "La Republica Dominicana queda entre los primeros lugares en la Conectaton Regional de Salud Digital (Presidencia)", "url": "https://presidencia.gob.do/noticias/la-republica-dominicana-queda-entre-los-primeros-lugares-en-la-conectaton-regional-de", "date": "2026-08-07", "publisherClass": "official" } ] }, "commercial": { "score": 42, "summary": "Health data cannot be processed or transferred without express written consent, and marketing lists may hold only biographical data. Profiling for advertising is allowed with consent, and no regulator or enforcement record on health data sales was found.", "sources": [ { "title": "Ley No. 172-13 sobre Proteccion de Datos Personales (Superintendencia de Bancos)", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf", "date": "2013-12-15", "publisherClass": "legal_text" } ] }, "clinical": { "score": 28, "summary": "A clinician generally cannot see what another public hospital recorded; the government's stated goal is consented, real-time access across the public network. The Expediente Electronico Unico de Salud is still being prepared.", "sources": [ { "title": "SNS e INDOTEL disenan red digital que conectara todos los hospitales publicos (Acento)", "url": "https://acento.com.do/actualidad/sns-e-indotel-disenan-red-digital-que-conectara-todos-los-hospitales-publicos-9686606.html", "date": "2026-05-26", "publisherClass": "news" }, { "title": "La Republica Dominicana queda entre los primeros lugares en la Conectaton Regional de Salud Digital (Presidencia)", "url": "https://presidencia.gob.do/noticias/la-republica-dominicana-queda-entre-los-primeros-lugares-en-la-conectaton-regional-de", "date": "2026-08-07", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Ley 172-13 waives consent for epidemiological use of dissociated health data, and no general opt-out was found. Three safeguards (CONABIOS ethics review, express consent for biomedical research under the new Penal Code, criminal penalties for misuse) put it near the 50 cap.", "sources": [ { "title": "Ley No. 172-13 sobre Proteccion de Datos Personales (Superintendencia de Bancos)", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf", "date": "2013-12-15", "publisherClass": "legal_text" }, { "title": "Conabios aprobo 787 protocolos de investigacion (CONABIOS)", "url": "https://conabios.gob.do/2024/10/24/conabios-aprobo-787-protocolos-de-investigacion/", "date": "2024-10-24", "publisherClass": "official" }, { "title": "Salud y el nuevo Codigo Penal: lo que el sector debe saber en su primer dia de vigencia (Diario Salud)", "url": "https://diariosalud.do/salud-y-el-nuevo-codigo-penal-lo-que-el-sector-debe-saber-en-su-primer-dia-de-vigencia/", "date": "2026-08-03", "publisherClass": "news" } ] }, "ai": { "score": 25, "summary": "The country has a 2023 National AI Strategy but no binding rules for clinical AI. In September 2026 a Senate committee agreed to merge two general AI bills, which are not yet law.", "sources": [ { "title": "Estrategia Nacional de Inteligencia Artificial de la Republica Dominicana (Agenda Digital)", "url": "https://agendadigital.gob.do/wp-content/uploads/2023/10/Final_ENIA-Estrategia-Nacional-de-Inteligencia-Artificial-de-la-Republica-Dominicana-.pdf", "date": "2023-10", "publisherClass": "official" }, { "title": "Comision de senadores acuerda fusionar proyectos de ley que buscan regular el uso de la Inteligencia Artificial (Senado)", "url": "https://www.senadord.gob.do/comision-de-senadores-acuerda-fusionar-proyectos-de-ley-que-buscan-regular-el-uso-de-la-inteligencia-artificial/", "date": "2026-09-15", "publisherClass": "official" }, { "title": "Registro Sanitario de Productos Sanitarios (DIGEMAPS)", "url": "https://digemaps.gob.do/servicios/registro-sanitario-de-productos-sanitarios/", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Ley 172-13 (proteccion integral de los datos personales)", "level": "National", "year": "2013", "what": "Access within five business days, health data sensitive, express written consent, prison and fines for violations.", "url": "https://www.sb.gob.do/media/4i1ploou/ley17213.pdf" }, { "name": "Ley 42-01 (Ley General de Salud)", "level": "National", "year": "2001", "what": "Patient rights: confidential file, written record of care, informed consent to treatment.", "url": "https://faolex.fao.org/docs/pdf/dom75084.pdf" }, { "name": "Ley 53-07 (crimenes y delitos de alta tecnologia)", "level": "National", "year": "2007", "what": "Criminalises unauthorised system access; higher penalties when confidential data is revealed.", "url": "https://www.oas.org/juridico/PDFs/repdom_ley5307.pdf" }, { "name": "Ley 74-25 (Codigo Penal)", "level": "National", "year": "2025", "what": "In force August 2026; punishes disclosure of professional secrets and research without express consent.", "url": "https://diariosalud.do/salud-y-el-nuevo-codigo-penal-lo-que-el-sector-debe-saber-en-su-primer-dia-de-vigencia/" }, { "name": "Decreto 246-06 (reglamento de medicamentos y productos sanitarios)", "level": "National", "year": "2006", "what": "Legal basis for DIGEMAPS registration of health products; no AI-specific rules found.", "url": "https://digemaps.gob.do/servicios/registro-sanitario-de-productos-sanitarios/" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-10-19", "headline": "Insurer added a stranger as a patient's spouse to move her policy without consent", "paraphrase": "A woman found her health insurance file listed an unknown man as her husband. The regulator fined the insurer, which moved 1,708 people onto its books without consent between 2023 and 2025 using invented family records.", "source": "Diario Libre", "url": "https://www.diariolibre.com/actualidad/salud/2025/10/19/ars-burlan-sistema-con-afiliaciones-falsas-y-sanciones-blandas/3281416", "theme": "record_wrong", "status": "finding" }, { "date": "2026-09-23", "headline": "Insured woman says her file was taken and her signature forged for fake claims", "paraphrase": "A health insurance member has sued doctors and former insurer staff, saying they pulled her file from a confidential database and forged her signature to bill for procedures she never received.", "source": "Diario Libre", "url": "https://www.diariolibre.com/actualidad/justicia/2026/09/23/afiliada-al-senasa-se-querella-contra-medicos-y-empleados-de-esa-ars/3668287", "theme": "breach", "status": "alleged" }, { "date": "2026-09-18", "headline": "Prosecutors say ex-insurer staff used members' real data to file thousands of false claims", "paraphrase": "Prosecutors say former staff of a health insurer took confidential member data and filed 4,363 authorizations for services members never sought. Interviewed members said they never requested, signed or received them.", "source": "Diario Libre", "url": "https://www.diariolibre.com/actualidad/justicia/2026/09/18/senasa-20-medicos-cobraban-servicios-que-nunca-prestaron/3663468", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "GIN", "name": "Guinea", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "102 to 162", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Guinea's 2016 data law gives patients rights, but the regulator it promised was never created and records sit with each hospital.", "categories": { "access": { "score": 40, "summary": "The 2016 law lets you ask any data holder for your data and, for computer records, a copy in a structured electronic format. There is no national portal, the law sets no deadline, and the regulator meant to enforce it does not exist, so 40.", "sources": [ { "title": "Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel (Data Protection Africa copy)", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Guinea_Cybersecurity-and-DPA.pdf", "date": "2016-07-28", "publisherClass": "legal_text" }, { "title": "Code de la santé publique, Loi L/97/021/AN (FNDC copy)", "url": "https://fndcguinee.com/wp-content/uploads/2019/05/CODE-DE-LA-SANTE-PUBLIQUE.pdf", "date": "1997-06-19", "publisherClass": "legal_text" }, { "title": "Financer la digitalisation des hôpitaux sans endetter l'État (Guinéenews)", "url": "https://guineenews.org/2026/08/13/financer-la-digitalisation-des-hopitaux-sans-endetter-letat-le-pari-reussi-dune-healthtech-guineenne-devenue-panafricaine/", "date": "2026-08-13", "publisherClass": "news" } ] }, "control": { "score": 28, "summary": "The law makes express consent the default and bans processing health data except in listed cases, but no shared record, opt-out or access log exists. In practice each hospital decides, and a private vendor runs the records in some.", "sources": [ { "title": "Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel (Data Protection Africa copy)", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Guinea_Cybersecurity-and-DPA.pdf", "date": "2016-07-28", "publisherClass": "legal_text" }, { "title": "Visa Médical : les témoignages qui racontent la révolution des hôpitaux guinéens (Africaguinee)", "url": "https://www.africaguinee.com/visa-medical-les-temoignages-qui-racontent-la-revolution-des-hopitaux-guineens/", "date": "2026-08-25", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive under the 2016 law, and unlawful processing carries 10 to 20 years in prison. With no health cases found this scores the general law at the floor of its band, 45, because the regulator it relies on still does not exist.", "sources": [ { "title": "Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel (Data Protection Africa copy)", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Guinea_Cybersecurity-and-DPA.pdf", "date": "2016-07-28", "publisherClass": "legal_text" }, { "title": "Discours de la Ministre au CNT sur le projet de loi APDP (MCENI)", "url": "https://mceni.gov.gn/discours-de-mme-la-ministre-des-postes-des-telecommunications-et-de-leconomie-numerique-au-cnt-sur-le-projet-de-loi-apdp/", "date": "2024-06-20", "publisherClass": "official" }, { "title": "IA et protection des données personnelles : la ministre Rose Pola Pricemou annonce des mesures (Africaguinee)", "url": "https://www.africaguinee.com/ia-et-protection-des-donnees-personnelles-la-ministre-rose-pola-pricemou-annonce-des-mesures/", "date": "2025-10-08", "publisherClass": "news" }, { "title": "Guinée, cadre juridique de la protection des données (Africa Data Protection)", "url": "https://www.africadataprotection.org/pays/guinee.html", "date": "undated", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 25, "summary": "DHIS2 carries national aggregate reporting and disease surveillance, but there is no national record or exchange linking care. Hospital systems are islands: CHU Donka and the Visa Medical hospitals each keep their own records.", "sources": [ { "title": "Portail des Applications, Ministère de la Santé et de l'Hygiène Publique", "url": "https://apps.sante.gov.gn/", "date": "undated", "publisherClass": "official" }, { "title": "Guinée, Stratégie Nationale pour la Santé Numérique 2021-25 (OMS Afrique)", "url": "https://www.afro.who.int/fr/countries/guinea/publication/guinee-strategie-nationale-pour-la-sante-numerique-2021-25", "date": "2021-12", "publisherClass": "intergov" }, { "title": "Implementation of DHIS2 for Disease Surveillance in Guinea: 2015-2020 (Frontiers in Public Health)", "url": "https://www.frontiersin.org/journals/public-health/articles/10.3389/fpubh.2021.761196/full", "date": "2022-01-20", "publisherClass": "academic" }, { "title": "CHU Donka : quatre ans de transformation au bénéfice des Guinéens (Guinee114, sponsored)", "url": "https://www.guinee114.com/2026/08/18/chu-donka-quatre-ans-de-transformation-au-benefice-des-guineens/", "date": "2026-08-18", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Direct marketing with personal data needs prior written consent, and people can refuse marketing use free of charge. Nothing covers health apps, data brokers or de-identified data, while a private firm runs records in public hospitals.", "sources": [ { "title": "Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel (Data Protection Africa copy)", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Guinea_Cybersecurity-and-DPA.pdf", "date": "2016-07-28", "publisherClass": "legal_text" }, { "title": "Financer la digitalisation des hôpitaux sans endetter l'État (Guinéenews)", "url": "https://guineenews.org/2026/08/13/financer-la-digitalisation-des-hopitaux-sans-endetter-letat-le-pari-reussi-dune-healthtech-guineenne-devenue-panafricaine/", "date": "2026-08-13", "publisherClass": "news" } ] }, "clinical": { "score": 22, "summary": "A doctor can see electronic notes only inside a hospital that has its own system, such as CHU Donka. Whether a Visa Medical record follows the patient between hospitals was not verified.", "sources": [ { "title": "Stratégie Nationale Santé Numérique 2021-2025, Ministère de la Santé (P4H copy)", "url": "https://p4h.world/app/uploads/2024/09/Strategie-Nationale-Sante-Numerique_2021-2025_Guinee.x68900.pdf", "date": "2021-12", "publisherClass": "official" }, { "title": "CHU Donka : quatre ans de transformation au bénéfice des Guinéens (Guinee114, sponsored)", "url": "https://www.guinee114.com/2026/08/18/chu-donka-quatre-ans-de-transformation-au-benefice-des-guineens/", "date": "2026-08-18", "publisherClass": "news" }, { "title": "Visa Médical : les témoignages qui racontent la révolution des hôpitaux guinéens (Africaguinee)", "url": "https://www.africaguinee.com/visa-medical-les-temoignages-qui-racontent-la-revolution-des-hopitaux-guineens/", "date": "2026-08-25", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "The Public Health Code requires free, informed, written consent for health research, reviewed by the CNERS ethics committee. Consent can be waived for record reviews when people cannot be found, and no public register exists, so 49.", "sources": [ { "title": "Code de la santé publique, Loi L/97/021/AN (FNDC copy)", "url": "https://fndcguinee.com/wp-content/uploads/2019/05/CODE-DE-LA-SANTE-PUBLIQUE.pdf", "date": "1997-06-19", "publisherClass": "legal_text" }, { "title": "CNERS, Procédure d'examen d'un protocole de recherche en santé, v6 (ClinRegs copy)", "url": "https://clinregs.niaid.nih.gov/sites/default/files/documents/guinea/SOP-CNERS_v6_Feb%202021%20(French).pdf", "date": "2021-02", "publisherClass": "official" }, { "title": "Clinical Research Regulation for Guinea (NIH ClinRegs)", "url": "https://clinregs.niaid.nih.gov/country/guinea", "date": "2026-01-08", "publisherClass": "official" } ] }, "ai": { "score": 28, "summary": "The 2018 medicines law counts software as a medical device and requires approval and change reporting, but there is no AI-specific rule for care. The national AI strategy is still at the assessment stage.", "sources": [ { "title": "L/2018/024/AN Loi relative aux médicaments, produits de santé et à l'exercice de la profession de pharmacien (CNT archive)", "url": "https://cnt.gov.gn/archive.assemblee/www.assemblee.gov.gn/conakry-le-20-juin-2018-l2018024an-loi-relative-aux-medicaments-produits-de-sante-et-lexercice-de.html", "date": "2018-06-20", "publisherClass": "legal_text" }, { "title": "La Guinée à l'ère de l'Intelligence Artificielle : la ministre Pricemou décline une feuille de route (Africaguinee)", "url": "https://www.africaguinee.com/la-guinee-a-lere-de-lintelligence-artificielle-la-ministre-pricemou-decline-une-feuille-de-route-claire-pour-une-strategie-nationale-dia-ethique-et-durable/", "date": "2025-10-19", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law L/2016/037/AN on cybersecurity and personal data protection", "level": "National", "year": "2016", "what": "Access and structured-copy rights, health data as sensitive, criminal penalties; data authority promised but never created.", "url": "https://dataprotection.africa/wp-content/uploads/2022/09/Guinea_Cybersecurity-and-DPA.pdf" }, { "name": "Law L/97/021/AN, Public Health Code", "level": "National", "year": "1997", "what": "Health system rules; informed written consent for research, waivable for record studies with CNERS approval.", "url": "https://fndcguinee.com/wp-content/uploads/2019/05/CODE-DE-LA-SANTE-PUBLIQUE.pdf" }, { "name": "Law L/2018/024/AN on medicines, health products and pharmacy", "level": "National", "year": "2018", "what": "Medical devices, including software, need ministerial approval; holders must report changes.", "url": "https://cnt.gov.gn/archive.assemblee/www.assemblee.gov.gn/conakry-le-20-juin-2018-l2018024an-loi-relative-aux-medicaments-produits-de-sante-et-lexercice-de.html" }, { "name": "Constitution of the Republic of Guinea", "level": "National", "year": "2025", "what": "Article 16 protects private and family life; Article 22 the right to health.", "url": "https://lexguinee.com/comprendre-le-droit/vos-droits-fondamentaux-constitution-2025" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-05-07", "headline": "Clinic abroad withheld a Guinean patient's medical file until an extra fee was paid", "paraphrase": "A Guinean patient treated at a clinic abroad was refused the medical file and follow-up paperwork until a further 3,600 euros was paid, the outlet reports. A state agency settled the bill so the file was released.", "source": "Guinéenews", "url": "https://guineenews.org/2026/05/07/evacuation-gaoussou-diaby-le-dossier-medical-debloque/", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "LBN", "name": "Lebanon", "region": "Middle East", "overall": 34, "rank": "132=", "likelyRank": "102 to 163", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Lebanese patients have a legal right to their paper file, but records stay inside each hospital, with no national record or data regulator.", "categories": { "access": { "score": 40, "summary": "Law 574 of 2004 gives patients the right to see their medical file and get copies, but at their own cost and with no deadline. There is no national portal; the health ministry app shows only a medication history.", "sources": [ { "title": "Law No. 574 of 2004 on Patients' Rights and Informed Consent (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=256595", "publisherClass": "legal_text", "date": "2004-02-13" }, { "title": "Law No. 240 of 2012 amending the Medical Ethics Law No. 288 of 1994 (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457", "publisherClass": "legal_text", "date": "2012-10-25" }, { "title": "Law No. 81 of 2018 on Electronic Transactions and Personal Data (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=278573", "publisherClass": "legal_text", "date": "2018-10-18" }, { "title": "Ministry of Public Health launches the updated version of its mobile app", "url": "https://www.moph.gov.lb/ar/view/86484/the-ministry-of-public-health-launches-the-updated-version-of-its-mobile-app", "publisherClass": "official", "date": "undated" } ] }, "control": { "score": 40, "summary": "The ethics law bars any doctor from viewing a patient's file except at the patient's request, outside emergencies. Patients have no access log or sharing settings, and insurers' doctors, health authorities and courts have carve-outs.", "sources": [ { "title": "Law No. 240 of 2012 amending the Medical Ethics Law No. 288 of 1994 (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457", "publisherClass": "legal_text", "date": "2012-10-25" }, { "title": "Law No. 574 of 2004 on Patients' Rights and Informed Consent (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=256595", "publisherClass": "legal_text", "date": "2004-02-13" }, { "title": "Law No. 81 of 2018 on Electronic Transactions and Personal Data (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=278573", "publisherClass": "legal_text", "date": "2018-10-18" } ] }, "privacy": { "score": 32, "summary": "Law 81 of 2018 bans processing health data except with consent, for care, or under a health minister licence, but public bodies are exempt from licensing. There is no data protection authority and no breach notification duty.", "sources": [ { "title": "Law No. 81 of 2018 on Electronic Transactions and Personal Data (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=278573", "publisherClass": "legal_text", "date": "2018-10-18" }, { "title": "A database of Lebanese residents sold for 20 dollars (Libnanews)", "url": "https://libnanews.com/une-base-de-donnees-des-libanais-vendue-20-dollars/", "publisherClass": "news", "date": "2026-09-30" } ] }, "journey": { "score": 25, "summary": "Lebanon has no national health record or exchange. Links exist mainly for medicines: MediTrack tracked about 140 subsidised drugs in 2023, tied to a Unique Health ID, and a 2025-2030 strategy aims to digitise the sector.", "sources": [ { "title": "National E-Health Program (Ministry of Public Health)", "url": "https://www.moph.gov.lb/ar/Pages/6/2651/national-e-health-program", "publisherClass": "official", "date": "undated" }, { "title": "How to obtain a Unique Health ID and register a medical file on the Aman program (Ministry of Public Health)", "url": "https://www.moph.gov.lb/ar/Media/view/69229/steps-to-obtain-a-unique-health-id-enter-the-medical-record-into-aman-program-and-follow-up-through-", "publisherClass": "official", "date": "2023-03-13" }, { "title": "Case Study on the Digital Transformation of Health Systems in Lebanon (MoPH National E-Health Program)", "url": "https://www.moph.gov.lb/userfiles/images/Programs%26Projects/E-Health%20National%20Program/Case%20Study%20on%20The%20Digital%20Transformation%20of%20Health%20Systems%20in%20Lebanon.pdf", "publisherClass": "official", "date": "2022-08" }, { "title": "Launch of the National Strategy for Digital Transformation in the Health Sector 2025-2030 (Ministry of Public Health)", "url": "https://www.moph.gov.lb/ar/Media/view/80335/%D8%A5%D8%B7%D9%84%D8%A7%D9%82-%D8%A7%D9%84%D8%A7%D8%B3%D8%AA%D8%B1%D8%A7%D8%AA%D9%8A%D8%AC%D9%8A%D8%A9-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A%D8%A9-%D9%84%D9%84%D8%AA%D8%AD%D9%88%D9%84-%D8%A7%D9%84%D8%B1%D9%82%D9%85%D9%8A-%D9%81%D9%8A-%D8%A7%D9%84%D9%82%D8%B7%D8%A7%D8%B9-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A-2025-2030", "publisherClass": "official", "date": "2025-09-03" } ] }, "commercial": { "score": 35, "summary": "Health data can only be processed commercially with explicit consent or a licence, and people may object to marketing use. There are no rules on data brokers, de-identified data sales or consumer health apps.", "sources": [ { "title": "Law No. 81 of 2018 on Electronic Transactions and Personal Data (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=278573", "publisherClass": "legal_text", "date": "2018-10-18" }, { "title": "Law No. 240 of 2012 amending the Medical Ethics Law No. 288 of 1994 (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457", "publisherClass": "legal_text", "date": "2012-10-25" }, { "title": "A database of Lebanese residents sold for 20 dollars (Libnanews)", "url": "https://libnanews.com/une-base-de-donnees-des-libanais-vendue-20-dollars/", "publisherClass": "news", "date": "2026-09-30" } ] }, "clinical": { "score": 25, "summary": "A treating clinician sees only the records held by their own hospital or clinic. Other doctors may view a file only at the patient's request, and no national system shares records across providers.", "sources": [ { "title": "Law No. 240 of 2012 amending the Medical Ethics Law No. 288 of 1994 (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457", "publisherClass": "legal_text", "date": "2012-10-25" }, { "title": "Case Study on the Digital Transformation of Health Systems in Lebanon (MoPH National E-Health Program)", "url": "https://www.moph.gov.lb/userfiles/images/Programs%26Projects/E-Health%20National%20Program/Case%20Study%20on%20The%20Digital%20Transformation%20of%20Health%20Systems%20in%20Lebanon.pdf", "publisherClass": "official", "date": "2022-08" }, { "title": "How to obtain a Unique Health ID and register a medical file on the Aman program (Ministry of Public Health)", "url": "https://www.moph.gov.lb/ar/Media/view/69229/steps-to-obtain-a-unique-health-id-enter-the-medical-record-into-aman-program-and-follow-up-through-", "publisherClass": "official", "date": "2023-03-13" } ] }, "research": { "score": 49, "summary": "Trials need written consent and approval by an accredited ethics committee. Records may be used for research without consent if names are not revealed, and there is no opt-out.", "sources": [ { "title": "Law No. 574 of 2004 on Patients' Rights and Informed Consent (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=256595", "publisherClass": "legal_text", "date": "2004-02-13" }, { "title": "Minister of Public Health Decision No. 2286 of 2014 on accrediting ethics committees for clinical trials and research", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=239333", "publisherClass": "legal_text", "date": "2015-01-08" }, { "title": "Law No. 240 of 2012 amending the Medical Ethics Law No. 288 of 1994 (Lebanese University Legal Informatics Center)", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457", "publisherClass": "legal_text", "date": "2012-10-25" } ] }, "ai": { "score": 20, "summary": "Lebanon has no law, device rule or binding guidance for AI in health care. A new technology and AI ministry plans AI and data protection laws, but none were in force.", "sources": [ { "title": "Ten pillars for responsible and ethical AI adoption in Lebanon's health sector (Academia Public Health)", "url": "https://doi.org/10.20935/AcadPHealth8560", "publisherClass": "academic", "date": "2026-09-30" }, { "title": "LEAP, Path to 2030 (Ministry of Technology and AI)", "url": "https://www.mitai.gov.lb/initiatives-and-achievements", "publisherClass": "official", "date": "undated" }, { "title": "Ministry of Technology and AI: digital governance or a new centre of power? (Legal Agenda)", "url": "https://legal-agenda.com/%D9%88%D8%B2%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D8%AA%D9%83%D9%86%D9%88%D9%84%D9%88%D8%AC%D9%8A%D8%A7-%D9%88%D8%A7%D9%84%D8%B0%D9%83%D8%A7%D8%A1-%D8%A7%D9%84%D8%A7%D8%B5%D8%B7%D9%86%D8%A7%D8%B9%D9%8A/", "publisherClass": "news", "date": "2026-05-19" } ] } }, "laws": [ { "name": "Law No. 574 on Patients' Rights and Informed Consent", "level": "National", "year": "2004", "what": "Right to information, consent, confidentiality and to read and copy the medical file at own cost.", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=256595" }, { "name": "Medical Ethics Law No. 288, amended by Law No. 240", "level": "National", "year": "1994/2012", "what": "Professional secrecy as public order; file copies on request; ten-year retention; research use without names.", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=246457" }, { "name": "Law No. 81 on Electronic Transactions and Personal Data", "level": "National", "year": "2018", "what": "Health data banned without consent, care need or health minister licence; access and correction rights; criminal fines.", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=278573" }, { "name": "Ministerial Decision No. 2286 on research ethics committees", "level": "National", "year": "2014", "what": "No human trial or medical research without an accredited ethics committee and informed consent.", "url": "http://77.42.251.205/LawView.aspx?opt=view&LawID=239333" }, { "name": "Ministerial Decision No. 1/227 creating the National E-Health Program", "level": "National", "year": "2013", "what": "Creates a ministry e-health program for information systems, interoperability, e-prescription and privacy rules.", "url": "https://www.moph.gov.lb/ar/Pages/6/2651/national-e-health-program" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-01-13", "headline": "Patient records from four Lebanese hospitals reportedly leaked on a dark web forum", "paraphrase": "A report citing a dark web forum post said patient files from four hospitals, from 2010 to 2021, leaked with names, birth dates, passport numbers and plain-text passwords that reportedly still opened lab results.", "source": "Cyber Press", "url": "https://cyberpress.org/breach-hits-four-lebanese/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "MDG", "name": "Madagascar", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "104 to 165", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "A 2015 data law gives patients a free right to their file, but records stay local and the regulator only started in 2025.", "categories": { "access": { "score": 40, "summary": "Article 23 of Law 2014-038 gives a free right to all your data and a copy, directly or through a doctor you choose. It must be met \"without delay\" but no number of days is set, and there is no patient portal, so 40.", "sources": [ { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" }, { "title": "Décret n° 2012-0632 portant Code de déontologie médicale (PIC Madagascar)", "url": "https://www.pic.commerce.mg/sites/default/files/2023-05/Code%20de%20D%C3%A9ontologie%20M%C3%A9dical.pdf", "date": "2012-06-13", "publisherClass": "legal_text" }, { "title": "Manuel de procédures de la CMIL du 3 décembre 2025 (Unité de Gouvernance Digitale)", "url": "https://digital.gov.mg/2025/12/03/manuel-procedures-cmil/", "date": "2025-12-03", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "Health data may be processed without consent when a health professional bound by secrecy uses it for care, so patients have no say over routine use. There is no shared record, no opt-out and no access log a patient can read.", "sources": [ { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" }, { "title": "Décret n° 2012-0632 portant Code de déontologie médicale (PIC Madagascar)", "url": "https://www.pic.commerce.mg/sites/default/files/2023-05/Code%20de%20D%C3%A9ontologie%20M%C3%A9dical.pdf", "date": "2012-06-13", "publisherClass": "legal_text" } ] }, "privacy": { "score": 48, "summary": "Health data is sensitive under Law 2014-038, misuse carries 2 to 5 years in prison and fines reach 5% of turnover. With no breach notice duty, no health-sector case found and a regulator working only since 2025, this scores the general law low in its band.", "sources": [ { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" }, { "title": "Stratégie nationale de santé digitale 2023-2027 (Ministère de la Santé Publique)", "url": "https://www.msanp.gov.mg/upload/documents/Strat%C3%A9gie_Nationale_en_Sant%C3%A9_Digitale_2023_2027_Sign%C3%A9e.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Madagascar franchit une étape clé dans le domaine de la protection des données personnelles (PREA)", "url": "https://prea.gov.mg/prea/madagascar-franchit-une-etape-cle-dans-le-domaine-de-la-protection-des-donnees-personnelles-une-avancee-strategique-pour-la-transformation-digitale/", "date": "2025-11-28", "publisherClass": "official" }, { "title": "Protection des données digitalisées : la Commission malagasy de l'informatique rassure (Newsmada)", "url": "https://newsmada.com/2026/01/30/protection-des-donnees-digitalisees-la-commission-malagasy-de-linformatique-rassure/", "date": "2026-01-30", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "DHIS2 carries national reporting, but the ministry's own strategy says clinical and hospital information systems are experimental and local, with no data exchange standard adopted. A hospital digitisation pilot began at two Antananarivo teaching hospitals in 2025.", "sources": [ { "title": "Stratégie nationale de santé digitale 2023-2027 (Ministère de la Santé Publique)", "url": "https://www.msanp.gov.mg/upload/documents/Strat%C3%A9gie_Nationale_en_Sant%C3%A9_Digitale_2023_2027_Sign%C3%A9e.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Santé publique : le processus de digitalisation des hôpitaux enclenché (Newsmada)", "url": "https://newsmada.com/2025/01/21/sante-publique-le-processus-de-digitalisation-des-hopitaux-enclenche/", "date": "2025-01-21", "publisherClass": "news" }, { "title": "Malagasy Santé, bulletin d'information janvier-mars 2026 (OMS Madagascar)", "url": "https://www.afro.who.int/sites/default/files/2026-04/Revue%20trimestrielle%20Version%207%20janv%20mars%202026.pdf", "date": "2026-03", "publisherClass": "intergov" }, { "title": "États-Unis soutient la nouvelle stratégie de Madagascar pour mieux gérer les données de santé (US Embassy)", "url": "https://mg.usembassy.gov/fr/etats-unis-soutient-la-nouvelle-strategie-de-madagascar-pour-mieux-gerer-les-donnees-de-sante/", "date": "2026-06-02", "publisherClass": "official" } ] }, "commercial": { "score": 42, "summary": "Selling or reusing health data needs express consent under the sensitive-data ban, and anyone can refuse marketing use without giving a reason. We found no rules on health apps, data brokers or de-identified data, and no health enforcement.", "sources": [ { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" } ] }, "clinical": { "score": 18, "summary": "A treating clinician sees only the file held where the patient is treated, and the ethics code says medical databases may not link to other databases. The only transfer rule we found sends tuberculosis and leprosy files to the new doctor through the district.", "sources": [ { "title": "Loi n° 2011-002 portant Code de la Santé (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/Madagascar_CodedelaSante.pdf", "date": "2011-07-15", "publisherClass": "legal_text" }, { "title": "Décret n° 2012-0632 portant Code de déontologie médicale (PIC Madagascar)", "url": "https://www.pic.commerce.mg/sites/default/files/2023-05/Code%20de%20D%C3%A9ontologie%20M%C3%A9dical.pdf", "date": "2012-06-13", "publisherClass": "legal_text" }, { "title": "Stratégie nationale de santé digitale 2023-2027 (Ministère de la Santé Publique)", "url": "https://www.msanp.gov.mg/upload/documents/Strat%C3%A9gie_Nationale_en_Sant%C3%A9_Digitale_2023_2027_Sign%C3%A9e.pdf", "date": "2023", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Patient data can be reused for public-interest health research unless the person has objected, and all biomedical research needs the national ethics committee's approval. There is no general opt-out or public register of uses, so 49, just under the band cap.", "sources": [ { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" }, { "title": "Arrêté n° 7805/2016 portant création du Comité d'Ethique de la Recherche Biomédicale (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/ARRETE%20N78052016_Biomedicale.pdf", "date": "2016-04-06", "publisherClass": "legal_text" }, { "title": "Loi n° 2011-002 portant Code de la Santé (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/Madagascar_CodedelaSante.pdf", "date": "2011-07-15", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "We found no rules for AI in clinical care and no regulation of medical software. The Health Code defines medical devices without mentioning software, and the data law only bars decisions based solely on automated profiling.", "sources": [ { "title": "Loi n° 2011-002 portant Code de la Santé (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/Madagascar_CodedelaSante.pdf", "date": "2011-07-15", "publisherClass": "legal_text" }, { "title": "Loi n° 2014-038 sur la protection des données à caractère personnel (AFAPDP copy)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf", "date": "2015-01-09", "publisherClass": "legal_text" }, { "title": "Stratégie nationale de santé digitale 2023-2027 (Ministère de la Santé Publique)", "url": "https://www.msanp.gov.mg/upload/documents/Strat%C3%A9gie_Nationale_en_Sant%C3%A9_Digitale_2023_2027_Sign%C3%A9e.pdf", "date": "2023", "publisherClass": "official" } ] } }, "laws": [ { "name": "Loi n° 2014-038 sur la protection des données à caractère personnel", "level": "National", "year": "2015", "what": "Health data is sensitive; free access and copy; care and research exceptions; CMIL regulator; prison and fines.", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Madagascar-L-2014-038-du-09-01-15-sur-la-protection-des-donnees-a-caractere-personnel.pdf" }, { "name": "Loi n° 2011-002 portant Code de la Santé", "level": "National", "year": "2011", "what": "Trial authorisation after ethics review, consent for experiments, device definition, TB and leprosy file transfer.", "url": "https://bwcimplementation.org/sites/default/files/resource/Madagascar_CodedelaSante.pdf" }, { "name": "Décret n° 2012-0632 portant Code de déontologie médicale", "level": "National", "year": "2012", "what": "Medical secrecy; computerised medical databases under a named doctor and not linked to other databases.", "url": "https://www.pic.commerce.mg/sites/default/files/2023-05/Code%20de%20D%C3%A9ontologie%20M%C3%A9dical.pdf" }, { "name": "Arrêté n° 7805/2016 sur le Comité d'Ethique de la Recherche Biomédicale", "level": "National", "year": "2016", "what": "All biomedical research involving people needs the national ethics committee's approval.", "url": "https://bwcimplementation.org/sites/default/files/resource/ARRETE%20N78052016_Biomedicale.pdf" } ], "dti": { "grade": 94, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "SEN", "name": "Senegal", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "100 to 161", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "A 2008 law gives patients a copy of their file, but files stay in each facility; a digital health law is still a draft.", "categories": { "access": { "score": 35, "summary": "Law 2008-12 gives every patient a right to a copy of their data, directly or through a doctor they name. The holder may charge up to the cost of copying, the law sets no reply deadline, and there is no national patient portal.", "sources": [ { "title": "Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (texte, AFAPDP)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf", "date": "2008-01-25", "publisherClass": "legal_text" }, { "title": "Digitalisation du système de santé : le gouvernement engage six projets phares (APS)", "url": "https://aps.sn/digitalisation-du-systeme-de-sante-le-gouvernement-engage-six-projets-phares/", "date": "2025-04-28", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Health data may be processed with consent or for care, public health and legal purposes, and people may object only on legitimate grounds. There is no sharing opt-out and no access log patients can see.", "sources": [ { "title": "Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (texte, AFAPDP)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf", "date": "2008-01-25", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is a protected category under Law 2008-12 and the regulator, the CDP, has acted in a clinic. The 2008 law has no breach notification duty and a reform bill has not been voted.", "sources": [ { "title": "Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (texte, AFAPDP)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf", "date": "2008-01-25", "publisherClass": "legal_text" }, { "title": "Collecte et traitement des données personnelles : la CDP publie son rapport du 4e trimestre 2025 (Dakaractu)", "url": "https://www.dakaractu.com/Collecte-et-traitement-des-donnees-personnelles-la-CDP-publie-son-rapport-du-4%E1%B5%89-trimestre-2025_a269095.html", "date": "2026-02-12", "publisherClass": "news" }, { "title": "Données personnelles : la législation sénégalaise doit être modernisée et adaptée aux enjeux de l'IA (APS)", "url": "https://aps.sn/donnees-personnelles-la-legislation-senegalaise-doit-etre-modernisee-et-adaptee-aux-enjeux-de-lia-expert/", "date": "2026-03-27", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "A computerised patient record ran in two hospitals, one health centre and one health post in April 2025, covering more than 127,000 patients. National data flows through DHIS2 as aggregate reports, not patient records.", "sources": [ { "title": "Plan stratégique santé digitale 2018-2023 (Ministère de la Santé et de l'Action sociale)", "url": "https://www.sante.gouv.sn/sites/default/files/Plan%20Strat%C3%A9gique%20Sant%C3%A9%20Digitale%202018%20-%202023.pdf", "date": "2018", "publisherClass": "official" }, { "title": "Digitalisation du système de santé : le gouvernement engage six projets phares (APS)", "url": "https://aps.sn/digitalisation-du-systeme-de-sante-le-gouvernement-engage-six-projets-phares/", "date": "2025-04-28", "publisherClass": "news" }, { "title": "Saint-Louis : l'hôpital régional s'engage dans la digitalisation avec le déploiement du DPI (APS)", "url": "https://aps.sn/saint-louis-lhopital-regional-sengage-dans-la-digitalisation-avec-le-deploiement-du-dpi/", "date": "2025-09-03", "publisherClass": "news" }, { "title": "The experience of CARDIO4Cities and DHIS2 in Dakar, Senegal (Discover Health Systems)", "url": "https://link.springer.com/article/10.1007/s44250-025-00240-8", "date": "2025-05-24", "publisherClass": "academic" } ] }, "commercial": { "score": 42, "summary": "Direct marketing using personal data needs prior consent, and people can refuse free of charge before data goes to third parties for marketing. There is no ban on selling health data and no health app rules.", "sources": [ { "title": "Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (texte, AFAPDP)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf", "date": "2008-01-25", "publisherClass": "legal_text" } ] }, "clinical": { "score": 22, "summary": "Clinicians can see records held inside their own facility, but we found no system that shows a patient's record across providers. The shared patient record is still a plan.", "sources": [ { "title": "Plan stratégique santé digitale 2018-2023 (Ministère de la Santé et de l'Action sociale)", "url": "https://www.sante.gouv.sn/sites/default/files/Plan%20Strat%C3%A9gique%20Sant%C3%A9%20Digitale%202018%20-%202023.pdf", "date": "2018", "publisherClass": "official" }, { "title": "Santé numérique : vers une loi pour encadrer l'usage des technologies médicales au Sénégal (RTS)", "url": "https://www.rts.sn/actualite/detail/a-la-une/sante-numerique-vers-une-loi-pour-encadrer-lusage-des-technologies-medicales-au-senegal", "date": "2025-04-22", "publisherClass": "news" }, { "title": "Digitalisation du système de santé : le gouvernement engage six projets phares (APS)", "url": "https://aps.sn/digitalisation-du-systeme-de-sante-le-gouvernement-engage-six-projets-phares/", "date": "2025-04-28", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Law 2009-17 requires free, informed, express consent for health research, with prison terms for breaches. Record reviews may skip consent when people cannot be found, and there is no public register of data uses.", "sources": [ { "title": "Loi n° 2009-17 portant Code d'éthique pour la recherche en santé (CNERS)", "url": "https://www.cners.sn/public/docs/1587390017.pdf", "date": "2009-03-09", "publisherClass": "legal_text" }, { "title": "Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (texte, AFAPDP)", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf", "date": "2008-01-25", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "Medical device rules from 2023 cover software and require it to be validated, but nothing addresses AI change control or oversight. A digital health law that would cover AI is still a draft.", "sources": [ { "title": "Décret n° 2023-2419 du 27 décembre 2023 sur les dispositifs médicaux, Journal officiel (ARP)", "url": "https://arp.sn/wp-content/uploads/2024/04/Decret-n%C2%B0-2023-2419-du-27-decembre-2023_Dispositifs-medicaux.pdf", "date": "2024-02-24", "publisherClass": "legal_text" }, { "title": "Loi n° 2023-06 du 13 juin 2023 relative aux médicaments, aux autres produits de santé et à la pharmacie (ARP)", "url": "https://arp.sn/wp-content/uploads/2024/04/Loi-n%C2%B02023-06-du-13-juin-2023-relative-aux-medicaments-aux-autres-produits-de-sante-et-a-la-pharmacie.pdf", "date": "2023-06-13", "publisherClass": "legal_text" }, { "title": "Stratégie nationale et feuille de route du Sénégal sur l'intelligence artificielle (version résumée)", "url": "https://www.africadataprotection.org/sources/Synth%C3%A8se%20de%20la%20strat%C3%A9gie%20IA%20du%20S%C3%A9n%C3%A9gal.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Santé numérique au Sénégal : la coalition Transform Health accélère le plaidoyer pour un cadre législatif (Le Quotidien)", "url": "https://lequotidien.sn/sante-numerique-au-senegal-la-coalition-transform-health-accelere-le-plaidoyer-pour-un-cadre-legislatif/", "date": "2026-02-17", "publisherClass": "news" } ] } }, "laws": [ { "name": "Loi n° 2008-12 sur la protection des données à caractère personnel", "level": "National", "year": "2008", "what": "Health data as sensitive data, right of access and copy, CDP regulator, fines up to 100 million CFA.", "url": "https://www.afapdp.org/wp-content/uploads/2018/05/Senegal-texte-de-loi-2008.pdf" }, { "name": "Loi n° 2009-17 portant Code d'éthique pour la recherche en santé", "level": "National", "year": "2009", "what": "Express informed consent for health research, CNERS ethics committee, criminal penalties.", "url": "https://www.cners.sn/public/docs/1587390017.pdf" }, { "name": "Loi n° 2023-06 relative aux médicaments, aux autres produits de santé et à la pharmacie", "level": "National", "year": "2023", "what": "Pharmacy and health products law; defines medical devices to include software.", "url": "https://arp.sn/wp-content/uploads/2024/04/Loi-n%C2%B02023-06-du-13-juin-2023-relative-aux-medicaments-aux-autres-produits-de-sante-et-a-la-pharmacie.pdf" }, { "name": "Décret n° 2023-2419 sur les dispositifs médicaux", "level": "National", "year": "2023", "what": "Registration and essential requirements for medical devices, including validation of device software.", "url": "https://arp.sn/wp-content/uploads/2024/04/Decret-n%C2%B0-2023-2419-du-27-decembre-2023_Dispositifs-medicaux.pdf" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-12", "headline": "Regulator orders a private clinic to remove cameras filming its treatment rooms", "paraphrase": "After an anonymous report and an inspection, the national data protection commission ordered the clinic to take down cameras in its treatment rooms, switch off sound recording and declare its system properly.", "source": "Commission de Protection des Données Personnelles (CDP), Avis trimestriel N°04-2025", "url": "https://sppsyrftszniuaicadvk.supabase.co/storage/v1/object/public/public_docs/avis-trimestriels/avis-trimestriel-1770976600440.pdf", "theme": "other", "status": "finding" }, { "date": "2026-04-07", "headline": "Test results of people arrested in a crackdown published in national newspapers", "paraphrase": "Reporters found that people arrested in a police crackdown were routinely tested, and their test results and names were then printed in national newspapers. Health workers said frightened patients are now staying away from clinics.", "source": "The Guardian", "url": "https://www.theguardian.com/global-development/2026/apr/07/senegal-harsh-anti-gay-law-hiv-progress", "theme": "breach", "status": "alleged" }, { "date": "2026-02-12", "headline": "Public health council warns that publicising detainees' health status breaks the law", "paraphrase": "A national public health council said wide media coverage of arrests had exposed people's health status, noted that unauthorised disclosure is punished under a 2010 law and may engage state liability, and warned people may avoid testing.", "source": "Le Quotidien", "url": "https://lequotidien.sn/sida-menace-sur-la-continuite-des-soins-circulation-du-virus-abandon-de-traitement-erreurs-judiciaires-les-inquietudes-du-cnls/", "theme": "breach", "status": "alleged" }, { "date": "2026-02-09", "headline": "Police statement on arrests quoted a doctor's certificate with a suspect's test result", "paraphrase": "BBC reported that a gendarmerie press release announcing arrests quoted a medical certificate from a test ordered by police, stating a detained man's result. The release was widely covered on television, radio and in newspapers.", "source": "BBC News Afrique", "url": "https://www.bbc.com/afrique/articles/c1mj0mnl8lro", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "SOM", "name": "Somalia", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "102 to 162", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Somalia's 2023 data law gives patients a free copy of their data, but records stay in separate clinics and the regulator has no health cases.", "categories": { "access": { "score": 40, "summary": "Article 20 of the 2023 Data Protection Act gives a free copy in a common electronic format (+5), but only for reasonable purposes and with no fixed deadline (-5 each). There is no patient portal, so base 45 lands at 40.", "sources": [ { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Somalia Data Protection Authority: home", "url": "https://dpa.gov.so/", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "Article 14 lets clinics process data for medical care without consent, and there is no shared record, opt-out or access log a patient can use. Consent can be withdrawn, but objection is limited to a few legal grounds.", "sources": [ { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Somalia expands Digital Public Infrastructure (DPI) for child immunization in Mogadishu", "url": "https://www.hiiraan.com/national4/2026/Feb/204540/somalia_expands_digital_public_infrastructure_dpi_for_child_immunization_in_mogadishu_.aspx", "date": "2026-02-27", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health is sensitive data, breaches must be reported within 72 hours and fines reach up to USD 1 million. With no health enforcement found and no formal notice after a 2025 e-visa breach, this scores the general law at 45.", "sources": [ { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Council of Ministries Approves Data Protection Act Regulations", "url": "https://dpa.gov.so/news/council-of-ministries-approves-data-protection-act-regulations/", "date": "2026-01-05", "publisherClass": "official" }, { "title": "National Health Professionals Council Act Lr.31 (full text)", "url": "https://nhpc.gov.so/documents/nhpc-act-lr31-2020.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "New Somalia e-visa security flaw puts passport details of thousands at risk", "url": "https://www.aljazeera.com/news/2025/12/18/new-somalia-evisa-security-puts-passport-details-of-thousands-at-risk", "date": "2025-12-18", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "DHIS2 is the national reporting system, and the RAAD electronic record runs in about 111 public primary care clinics. The Ministry's own plan calls the health information system fragmented, and most hospitals are private.", "sources": [ { "title": "Somalia Health Sector Strategic Plan 2022-2026 (HSSP III)", "url": "https://moh.gov.so/so/wp-content/uploads/2022/11/Health-Sector-Strategy-Plan-III.pdf", "date": "2022-11", "publisherClass": "official" }, { "title": "Ministry of Health Officially Launches the National Master Health Facility List (MHFL) in Mogadishu", "url": "https://moh.gov.so/en/ministry-of-health-officially-launches-the-national-master-health-facility-list-mhfl/", "date": "2026-08-12", "publisherClass": "official" }, { "title": "A Standards-Based Approach to DHIS2 Integration (DHIS2 Annual Conference 2026 poster abstract)", "url": "https://community.dhis2.org/t/a-standards-based-approach-to-dhis2-integration/72690", "date": "2026-05-27", "publisherClass": "academic" }, { "title": "Partnering for a Data-Driven Somali Health System", "url": "https://caafimaad-plus.org/partnering-for-a-data-driven-somali-health-system/", "date": "2026-04-14", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 35, "summary": "The Data Protection Act has no ban on selling health data and no rule on health marketing. Health data can be processed on a legitimate interests basis, and we found no enforcement, so 35.", "sources": [ { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 24, "summary": "A clinician sees what their own clinic holds, and RAAD covers only some public primary care clinics. Cross-facility lookup exists only inside pilot networks such as the immunization register.", "sources": [ { "title": "Somalia Health Sector Strategic Plan 2022-2026 (HSSP III)", "url": "https://moh.gov.so/so/wp-content/uploads/2022/11/Health-Sector-Strategy-Plan-III.pdf", "date": "2022-11", "publisherClass": "official" }, { "title": "Electronic medical record-generated data use for decision-making among healthcare managers in Somali public health facilities (Frontiers in Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13328194/", "date": "2026-06-19", "publisherClass": "academic" }, { "title": "Somalia expands Digital Public Infrastructure (DPI) for child immunization in Mogadishu", "url": "https://www.hiiraan.com/national4/2026/Feb/204540/somalia_expands_digital_public_infrastructure_dpi_for_child_immunization_in_mogadishu_.aspx", "date": "2026-02-27", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "The Act allows processing for scientific research without consent and gives no opt-out. Two safeguards count, a Ministry review board and the NHPC Act offence for disseminating patient records, so 40 plus 6.", "sources": [ { "title": "Public Health Research (National Institute of Health, Somalia)", "url": "https://nih.gov.so/public-health-research/", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Public and private health operators in Somalia 2025 (Tropical Medicine and Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12805703/", "date": "2025-12-27", "publisherClass": "academic" }, { "title": "National Health Professionals Council Act Lr.31 (full text)", "url": "https://nhpc.gov.so/documents/nhpc-act-lr31-2020.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "Somalia has no rules for AI in clinical care and no regulation of medical software. The only safeguard is Article 23 of the Data Protection Act, a right not to face decisions made solely by automated processing.", "sources": [ { "title": "About Us (National Medicines Regulatory Authority)", "url": "https://nmra.gov.so/about-us/", "date": "undated", "publisherClass": "official" }, { "title": "Update on the Medicines and Health Products Regulatory System in Somalia", "url": "https://nmra.gov.so/somalia-strengthens-medicines-and-health-products-regulation-nmra-website-and-rims-now-live/", "date": "2026-08-05", "publisherClass": "official" }, { "title": "Data Protection Act, Law No. 005 of 2023 (Ministry of Communications and Technology, full text)", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Somalia hosts Second National AI Summit to advance digital transformation and innovation", "url": "https://techreviewafrica.com/news/5985/somalia-hosts-second-national-ai-summit-to-advance-digital-transformation-and-innovation", "date": "2026-06-20", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, Law No. 005 of 2023", "level": "National", "year": "2023", "what": "Health is sensitive data; free copy, 72-hour breach notice, independent authority, penalties up to USD 1 million.", "url": "https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdf" }, { "name": "Data Protection Act Regulations", "level": "National", "year": "2026", "what": "Approved by the Council of Ministers in January 2026 to set procedures; text not available to read.", "url": "https://dpa.gov.so/news/council-of-ministries-approves-data-protection-act-regulations/" }, { "name": "National Health Professionals Council Act Lr.31", "level": "National", "year": "2020", "what": "Licenses professionals and facilities; disseminating patient records without reason is an offence.", "url": "https://nhpc.gov.so/documents/nhpc-act-lr31-2020.pdf" }, { "name": "Law No. 9 of 1989 on human medicines and medical devices", "level": "National", "year": "1989", "what": "Legal basis cited for the interim medicines regulator; no AI or software rules found.", "url": "https://nmra.gov.so/about-us/" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "TGO", "name": "Togo", "region": "Africa", "overall": 34, "rank": "132=", "likelyRank": "105 to 166", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Togo has a 2019 data law and a patient right to see the file, but records stay on paper or inside each facility.", "categories": { "access": { "score": 35, "summary": "The Public Health Code gives patients the right to see what is in their file, and the 2019 data law gives a right to a copy. A fee up to copying cost is allowed, no deadline is set and there is no portal, so 35.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" }, { "title": "Loi n° 2009-007 du 15 mai 2009 portant code de la santé publique (Ordre national des médecins du Togo copy)", "url": "https://onmt.tg/wp-content/uploads/2026/05/code-de-sante-publique.pdf", "date": "2009-05-15", "publisherClass": "legal_text" }, { "title": "L'INAM emboîte le pas à la CNSS (CNSS Togo)", "url": "https://cnss.tg/linam-emboite-le-pas-a-la-cnss/", "date": "2026-04-21", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for diagnosis and care under a health professional, and there is no shared record, opt-out or patient-visible access log. The patient's main tool is a general right to object for legitimate reasons.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive under Law 2019-014 and fines reach 100 million CFA francs, but the law has no breach notice duty. With no health cases found, this scores the general law; in 2025 the regulator had only its President appointed and logged one complaint.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" }, { "title": "Rapport annuel des activités 2025 de l'IPDCP", "url": "https://ipdcp.tg/wp-content/uploads/2026/01/IPDCP-RAPPORT-ANNUEL-2025.pdf", "date": "2026-01", "publisherClass": "official" }, { "title": "Atelier de pré-validation du guide pratique sur la protection des données dans le secteur de la santé (IPDCP)", "url": "https://ipdcp.tg/atelier-de-pre-validation-du-guide-pratique-sur-la-protection-des-donnees-a-caractere-personnel-dans-le-secteur-de-la-sante-les-travaux-lances-a-notse/", "date": "2026-07-01", "publisherClass": "official" }, { "title": "Protection des données : l'IPDCP sensibilise 33 ministères et institutions (Le Nouveau Reporter)", "url": "https://lenouveaureporter.com/protection-des-donnees-lipdcp-sensibilise-33-ministeres-et-institutions/", "date": "2026-09-16", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "DHIS2 collects aggregate health data, and since April 2026 both insurance funds process claims electronically. There is no national record or exchange; a planned interoperable insurance system was still at the design stage in May 2026.", "sources": [ { "title": "Togo country profile, DHIS2 Climate & Health (HISP / University of Oslo)", "url": "https://dhis2.org/fr/climate/country-profiles/togo/", "date": "undated", "publisherClass": "academic" }, { "title": "L'INAM emboîte le pas à la CNSS (CNSS Togo)", "url": "https://cnss.tg/linam-emboite-le-pas-a-la-cnss/", "date": "2026-04-21", "publisherClass": "official" }, { "title": "AMU : le Togo prépare un système numérique unifié pour fluidifier les soins et les remboursements (Togo First)", "url": "https://www.togofirst.com/fr/sante/1305-18956-amu-le-togo-prepare-un-systeme-numerique-unifie-pour-fluidifier-les-soins-et-les-remboursements", "date": "2026-05-13", "publisherClass": "news" }, { "title": "YULCOM choisi par le Fonds mondial pour la digitalisation de 5 hôpitaux au Togo (YULCOM)", "url": "https://yulcom-technologies.com/fr/sante-numerique-yulcom-choisi-par-le-fonds-mondial-pour-la-digitalisation-de-5-hopitaux-au-togo/", "date": "2024-12-04", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 45, "summary": "Law 2019-014 bans direct marketing without prior consent and lets people refuse, free of charge, the first transfer of their data for prospecting. We found no health-specific rule on data brokers, health apps or de-identified data, and no enforcement.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" }, { "title": "Rapport annuel des activités 2025 de l'IPDCP", "url": "https://ipdcp.tg/wp-content/uploads/2026/01/IPDCP-RAPPORT-ANNUEL-2025.pdf", "date": "2026-01", "publisherClass": "official" } ] }, "clinical": { "score": 20, "summary": "The law lets clinicians process health data for care, but there is no shared record they can open across providers. A Togolese app founder said patients buy a paper notebook on arrival at hospital and do not come back with the same one.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" }, { "title": "Loi n° 2009-007 du 15 mai 2009 portant code de la santé publique (Ordre national des médecins du Togo copy)", "url": "https://onmt.tg/wp-content/uploads/2026/05/code-de-sante-publique.pdf", "date": "2009-05-15", "publisherClass": "legal_text" }, { "title": "AMU : le Togo prépare un système numérique unifié pour fluidifier les soins et les remboursements (Togo First)", "url": "https://www.togofirst.com/fr/sante/1305-18956-amu-le-togo-prepare-un-systeme-numerique-unifie-pour-fluidifier-les-soins-et-les-remboursements", "date": "2026-05-13", "publisherClass": "news" }, { "title": "DokitaEyes : dix ans de digitalisation du parcours de soins au Togo (Togo First)", "url": "https://www.togofirst.com/fr/sante/0612-17744-dokitaeyes-dix-ans-de-digitalisation-du-parcours-de-soins-au-togo", "date": "2025-12-06", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "Health research using personal data needs IPDCP authorisation, and Law 2019-014 punishes research done without telling people their rights or despite their objection. A national ethics committee exists, but no public register of uses was found, so 50.", "sources": [ { "title": "Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel (Journal officiel)", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf", "date": "2019-10-29", "publisherClass": "legal_text" }, { "title": "Rapport annuel des activités 2025 de l'IPDCP", "url": "https://ipdcp.tg/wp-content/uploads/2026/01/IPDCP-RAPPORT-ANNUEL-2025.pdf", "date": "2026-01", "publisherClass": "official" }, { "title": "Loi n° 2009-007 du 15 mai 2009 portant code de la santé publique (Ordre national des médecins du Togo copy)", "url": "https://onmt.tg/wp-content/uploads/2026/05/code-de-sante-publique.pdf", "date": "2009-05-15", "publisherClass": "legal_text" }, { "title": "Comité de Bioéthique pour la Recherche en Santé (CBRS), Health Research Web (COHRED)", "url": "https://healthresearchwebafrica.org.za/fr/togo/ethics_1132", "date": "undated", "publisherClass": "academic" } ] }, "ai": { "score": 20, "summary": "Togo has no clinical AI rules. Medical devices are registered under a 2023 ministry service note without expert review bodies, and a national AI strategy was still being prepared in December 2025.", "sources": [ { "title": "Analyse du cadre légal et institutionnel des dispositifs médicaux dans les pays de l'UEMOA (J. Afr. Technol. Pharm. Biol.)", "url": "https://soapgi-jatpb.org/index.php/jatpb/article/download/215/46/1300", "date": "2025-06-30", "publisherClass": "academic" }, { "title": "Demande d'autorisation spéciale d'importation de produits pharmaceutiques (Service public, DPML)", "url": "https://service-public.gouv.tg/service/6799191932f04b51dcfa8bc9/licences-agrements-certificats/34s69l4y3j73", "date": "undated", "publisherClass": "official" }, { "title": "Gouvernance publique : le Togo prépare sa stratégie nationale sur l'IA (Togo First)", "url": "https://www.togofirst.com/fr/tic/0112-17689-gouvernance-publique-le-togo-prepare-sa-strategie-nationale-sur-l-ia", "date": "2025-12-01", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 2019-014 on the protection of personal data", "level": "National", "year": "2019", "what": "Health data sensitive; access and copy right; IPDCP authorisation for health research; fines up to 100 million CFA.", "url": "https://jo.gouv.tg/sites/default/files/JO/JOS_29_10_2019-64E%20ANNEE-N%C2%B026%20TER.pdf" }, { "name": "Law 2009-007 on the Public Health Code", "level": "National", "year": "2009", "what": "Patient right to information in their file; professional secrecy; ethics rules for drug trials in hospitals.", "url": "https://onmt.tg/wp-content/uploads/2026/05/code-de-sante-publique.pdf" }, { "name": "Law 2021-022 instituting universal health insurance (AMU)", "level": "National", "year": "2021", "what": "Creates universal health insurance, run by INAM and CNSS.", "url": "https://extranet.who.int/cpcd/health-legislation/loi-ndeg-2021-022-du-18-octobre-2021-instituant-lassurance-maladie-universelle" }, { "name": "UEMOA Decision 02/2022/CM/UEMOA on medical device regulation guidelines", "level": "Supranational", "year": "2022", "what": "Harmonised device rules; member states must set up a framework within 24 months.", "url": "https://soapgi-jatpb.org/index.php/jatpb/article/download/215/46/1300" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "VUT", "name": "Vanuatu", "region": "Oceania", "overall": 34, "rank": "132=", "likelyRank": "101 to 163", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Vanuatu's 2025 data protection law gives patients a free copy of their data, but records are mostly paper and no regulator was verified as appointed.", "categories": { "access": { "score": 45, "summary": "Since 2 January 2025, section 9 of the Data Protection and Privacy Act gives a free copy of personal data within one month. There is no patient portal, and the regulator who would enforce the right was not verified as appointed.", "sources": [ { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Right to Information Act No. 13 of 2016 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/van172667.pdf", "date": "2016-12-20", "publisherClass": "legal_text" }, { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" } ] }, "control": { "score": 32, "summary": "The 2024 Act lets health workers process health data for care without consent, and no opt-out from record sharing or patient-visible access log was found. A general right to object puts Vanuatu near the top of the 20 to 35 band.", "sources": [ { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "Health data is a special category under a law in force since January 2025, with fines up to VT10,000,000. No breach notification rule, health-sector enforcement or appointed regulator was verified, so the score sits at the floor of the general-law band.", "sources": [ { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Digital Safety Authority Act No. 15 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Digital_Safety_Authority_Act_No15_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" } ] }, "journey": { "score": 22, "summary": "None of Vanuatu's 151 health facilities had a national electronic health record in a 2025 regional study. The Ministry says its clinical systems run in silos, not linked to each other or to public health data.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" }, { "title": "Stronger outbreak responses in the Pacific start with locally embedded knowledge (Devpolicy Blog)", "url": "https://devpolicy.org/stronger-outbreak-responses-in-the-pacific-start-with-locally-embedded-knowledge-20260826/", "date": "2026-08-26", "publisherClass": "academic" } ] }, "commercial": { "score": 35, "summary": "Private firms need consent or another listed ground to process health data, and no commercial ground exists for special categories. There is no specific ban on selling health data or health-app marketing, and no enforcement record.", "sources": [ { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" } ] }, "clinical": { "score": 18, "summary": "A clinician usually cannot see a patient's record from another facility. The Ministry says records are created and stored at each facility on paper and are not viewable elsewhere, and data in the hospital system mostly supplements paper.", "sources": [ { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "All human health research needs written approval from the Vanuatu Health Research Ethics Committee, and misuse of personal data is an offence. The Act allows research use of health data without consent, with safeguards left to regulations not verified as made.", "sources": [ { "title": "Vanuatu Health Research Portal (Ministry of Health)", "url": "https://healthresearch.gov.vu/", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "No clinical AI rules or medical device regulation of AI were verified; the Ministry's AI governance policy is a plan in its 2025 strategy. A general right not to face solely automated decisions sits in the data protection law.", "sources": [ { "title": "Vanuatu Digital Health Strategy 2025-2030 (Ministry of Health)", "url": "https://moh.gov.vu/images/Reports/Vanuatu%20Digital%20Health%20Strategy_2025-2030.pdf", "date": "2025", "publisherClass": "official" }, { "title": "Data Protection and Privacy Act No. 13 of 2024 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Digital Transformation Act No. 42 of 2025 (Department of Communication and Digital Transformation)", "url": "https://digital.gov.vu/images/dossier%20legislation/EN%20-%20DT%20Act%20No%2042%20of%202025.pdf", "date": "2025-12-12", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Data Protection and Privacy Act No. 13 of 2024", "level": "National", "year": "2024", "what": "Health is special category data; free copy within one month; objection rights; fines up to VT10,000,000.", "url": "https://digital.gov.vu/images/legislation/Data_Protection_and_Privacy_Act_No13_of_2024-EN.pdf" }, { "name": "Digital Safety Authority Act No. 15 of 2024", "level": "National", "year": "2024", "what": "Creates the Digital Safety Authority and the Deputy Commissioner of Data Protection and Privacy.", "url": "https://digital.gov.vu/images/legislation/Digital_Safety_Authority_Act_No15_of_2024-EN.pdf" }, { "name": "Right to Information Act No. 13 of 2016", "level": "National", "year": "2016", "what": "Right to request government records, 30-day decision deadline, appeal to an Information Commissioner.", "url": "https://faolex.fao.org/docs/pdf/van172667.pdf" }, { "name": "Digital Transformation Act No. 42 of 2025", "level": "National", "year": "2025", "what": "Digital government department, ICT and AI service permits, 72-hour reporting of government cyber incidents.", "url": "https://digital.gov.vu/images/dossier%20legislation/EN%20-%20DT%20Act%20No%2042%20of%202025.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "ATG", "name": "Antigua and Barbuda", "region": "Americas", "overall": 33, "rank": "142=", "likelyRank": "106 to 166", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Antigua and Barbuda is digitising its main hospital, but patients have no portal and the privacy regulator still has no office.", "categories": { "access": { "score": 35, "summary": "The Data Protection Act 2013 gives a right to a copy within 30 days, for a prescribed fee, but defines personal data around commercial transactions. There is no patient portal, so access means a written request to each provider.", "sources": [ { "title": "Data Protection Act, 2013 (No. 10 of 2013), Laws of Antigua and Barbuda", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf", "date": "2013-11-07", "publisherClass": "legal_text" }, { "title": "Code of Ethics in the Practice of Medicine (Antigua and Barbuda Medical Council)", "url": "http://www.antiguabarbudamedicalcouncil.com/wp-content/uploads/2020/04/Medical-Council-Code-of-EthicsPDF.pdf", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "The Act requires explicit consent for health data but exempts processing for medical purposes by health professionals. No opt-out from record sharing and no patient-visible access log were found as the clinics move to one shared system.", "sources": [ { "title": "Data Protection Act, 2013 (No. 10 of 2013), Laws of Antigua and Barbuda", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf", "date": "2013-11-07", "publisherClass": "legal_text" }, { "title": "Code of Ethics in the Practice of Medicine (Antigua and Barbuda Medical Council)", "url": "http://www.antiguabarbudamedicalcouncil.com/wp-content/uploads/2020/04/Medical-Council-Code-of-EthicsPDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Health Records to Go Digital Across All Clinics, Joseph Announces (Antigua Newsroom)", "url": "https://antiguanewsroom.com/health-records-to-go-digital-across-all-clinics-joseph-announces/", "date": "2025-10-10", "publisherClass": "news" } ] }, "privacy": { "score": 42, "summary": "Health data is sensitive under the 2013 Act, and unlawful processing can bring a fine of up to EC$200,000 or three years in prison. But the Act has no breach notification duty, and the Information Commissioner appointed in 2024 still had no office in June 2026.", "sources": [ { "title": "Data Protection Act, 2013 (No. 10 of 2013), Laws of Antigua and Barbuda", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf", "date": "2013-11-07", "publisherClass": "legal_text" }, { "title": "Freedom of Information Act, 2004 (No. 19 of 2004), OAS copy", "url": "http://www.oas.org/es/sla/ddi/docs/AB2%20Freedom%20of%20Information%20Act.pdf", "date": "2004-12-23", "publisherClass": "legal_text" }, { "title": "2026 Investment Climate Statements: Antigua and Barbuda (US Department of State)", "url": "https://www.state.gov/reports/2026-investment-climate-statements/antigua-and-barbuda/", "date": "2026", "publisherClass": "official" }, { "title": "Information Commissioner Still Without Office Nearly Two Years After Appointment (Antiguan Herald)", "url": "https://antiguaherald.com/articles/2026/06/18/information-commissioner-still-without-office-nearly-two-years-after-appointment.html", "date": "2026-06-18", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "The main public hospital launched a hospital information system and began moving its emergency department to paperless records in November 2025. A shared record for public clinics was announced in October 2025 but is not yet shown to be live, and insurance claims still run on paper receipts.", "sources": [ { "title": "Digital Transformation Framework, background (Government of Antigua and Barbuda)", "url": "https://ab.gov.ag/digitaltransformation/index.php?page=8", "date": "undated", "publisherClass": "official" }, { "title": "Strengthened health information systems in Antigua and Barbuda (PAHO IS4H)", "url": "https://www.paho.org/en/ish/all-stories/strengthened-health-information-systems-antigua-and-barbuda-are-helping-combat", "date": "undated", "publisherClass": "intergov" }, { "title": "Applying for Benefits (Medical Benefits Scheme)", "url": "https://www.mbs.gov.ag/v2/applying-for-benefits/", "date": "undated", "publisherClass": "official" }, { "title": "SLBMC Emergency Department Begins Transition to Fully Digital, Paperless System (Antigua.news)", "url": "https://antigua.news/2025/11/28/slbmc-emergency-department-begins-transition-to-fully-digital-paperless-system/", "date": "2025-11-28", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "The 2013 Act bars disclosing personal data beyond its original purpose without consent and requires explicit consent for health data. No rules on health apps, data brokers or sale of de-identified data were found, and no enforcement record exists.", "sources": [ { "title": "Data Protection Act, 2013 (No. 10 of 2013), Laws of Antigua and Barbuda", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf", "date": "2013-11-07", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "Clinicians at the main hospital are moving onto one digital system, but clinic, private and hospital records are not yet linked. The minister described cross-clinic access to lab results and doctor reports as a plan, not a working service.", "sources": [ { "title": "Code of Ethics in the Practice of Medicine (Antigua and Barbuda Medical Council)", "url": "http://www.antiguabarbudamedicalcouncil.com/wp-content/uploads/2020/04/Medical-Council-Code-of-EthicsPDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Sir Lester Bird Medical Centre gets major connectivity boost (Antigua Observer)", "url": "https://antiguaobserver.com/sir-lester-bird-medical-centre-gets-major-connectivity-boost/", "date": "2026-02-20", "publisherClass": "news" }, { "title": "Health Records to Go Digital Across All Clinics, Joseph Announces (Antigua Newsroom)", "url": "https://antiguanewsroom.com/health-records-to-go-digital-across-all-clinics-joseph-announces/", "date": "2025-10-10", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "The 2013 Act exempts research and statistics from its consent rules as long as results do not identify anyone, and there is no opt-out. The Medical Council follows WMA research ethics, and the main hospital reconstituted its ethics committee in January 2025.", "sources": [ { "title": "Data Protection Act, 2013 (No. 10 of 2013), Laws of Antigua and Barbuda", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf", "date": "2013-11-07", "publisherClass": "legal_text" }, { "title": "Code of Ethics in the Practice of Medicine (Antigua and Barbuda Medical Council)", "url": "http://www.antiguabarbudamedicalcouncil.com/wp-content/uploads/2020/04/Medical-Council-Code-of-EthicsPDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Sir Lester Bird Medical Centre Reconstitutes Ethics Committee Under New Leadership (Antigua.news)", "url": "https://antigua.news/2025/01/23/sir-lester-bird-medical-centre-reconstitutes-ethics-committee-under-new-leadership/", "date": "2025-01-23", "publisherClass": "news" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found. A UNESCO-backed AI readiness report launched in June 2025, and the ICT minister called for an ethical AI framework, but none has been adopted.", "sources": [ { "title": "Antigua and Barbuda Unveils Landmark AI Readiness Assessment Report (UNESCO)", "url": "https://www.unesco.org/en/articles/antigua-and-barbuda-unveils-landmark-ai-readiness-assessment-report", "date": "2025-07-01", "publisherClass": "intergov" }, { "title": "Antigua and Barbuda Ranks 154th in Global AI Readiness as Region Lags Behind (Antiguan Herald)", "url": "https://antiguaherald.com/articles/2026/04/30/antigua-and-barbuda-ranks-154th-in-global-ai-readiness-as-region-lags-behind.html", "date": "2026-04-30", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, 2013 (No. 10 of 2013)", "level": "National", "year": "2013", "what": "Access within 30 days for a fee; health is sensitive data; explicit consent or listed exceptions; no breach notice.", "url": "https://laws.gov.ag/wp-content/uploads/2019/02/a2013-10.pdf" }, { "name": "Freedom of Information Act, 2004 (No. 19 of 2004)", "level": "National", "year": "2004", "what": "Creates the independent Information Commissioner, who also enforces the Data Protection Act.", "url": "http://www.oas.org/es/sla/ddi/docs/AB2%20Freedom%20of%20Information%20Act.pdf" }, { "name": "Antigua and Barbuda Medical Council Code of Ethics", "level": "National", "year": "undated", "what": "Doctors' confidentiality duty, patient right of access to records, and informed consent for research.", "url": "http://www.antiguabarbudamedicalcouncil.com/wp-content/uploads/2020/04/Medical-Council-Code-of-EthicsPDF.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-11-27", "headline": "Patient says private clinic never handed over her records despite repeated requests", "paraphrase": "In a High Court claim reported by the outlet, a patient alleges that she asked a private clinic several times for her medical records and never received them, even while seeking care overseas. No defence had been filed.", "source": "Antigua.news", "url": "https://antigua.news/2025/11/27/antiguan-woman-sues-dr-joey-john-after-years-of-pain-following-2020-operation/", "theme": "access_refused", "status": "alleged" }, { "date": "2025-09-02", "headline": "Family alleges state hospital staff falsified records to extend a patient's stay", "paraphrase": "A formal complaint to the Ministry of Health alleges that staff at a public hospital falsified a visiting student's records to justify keeping her longer. The Ministry opened an internal review and has not published findings.", "source": "Antigua.news", "url": "https://antigua.news/2025/09/02/investigation-launched-into-alleged-mistreatment-of-u-s-medical-student-at-clarevue/", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-04-04", "headline": "Fire at a medical building destroys years of patient records at six practices", "paraphrase": "The national medical association said a fire at a shared medical building destroyed the offices, equipment and years of patient records of six doctors' practices, a loss it called a blow to the patients who rely on them.", "source": "Antigua.news (statement of the Medical Association of Antigua and Barbuda)", "url": "https://antigua.news/2026/04/04/statement-from-the-medical-association-of-antigua-and-barbuda-inc-regarding-the-devastating-fire-affecting-local-doctors/", "theme": "other", "status": "alleged" } ] }, { "iso3": "CAF", "name": "Central African Republic", "region": "Africa", "overall": 33, "rank": "142=", "likelyRank": "111 to 170", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A 2024 law gives patients a free copy of their data, but no working regulator was found and records stay on paper or donor systems.", "categories": { "access": { "score": 40, "summary": "Law 24.001 of January 2024 gives a free copy of your data, and health data can come directly or through a doctor you choose. There is no national portal, no fixed deadline beyond 'without delay', and no verified regulator.", "sources": [ { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" }, { "title": "Politique Nationale de Santé 2019-2030 (Ministère de la Santé et de la Population)", "url": "https://www.sante.gouv.cf/sites/default/files/2024-07/Politique%20Nationale%20Sant%C3%A9_2019-2030.pdf", "date": "2019", "publisherClass": "official" }, { "title": "Review of the Central African Republic Data Protection Law (Tech Hive Advisory)", "url": "https://www.techhiveadvisory.africa/insights/review-of-the-central-african-republic-data-protection-law", "date": "2025-09-23", "publisherClass": "law_firm" } ] }, "control": { "score": 28, "summary": "The law requires express consent for health data and lets people object for a legitimate reason, but care providers may process health data without consent. There is no opt-out from record sharing and no access log a patient can see.", "sources": [ { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" }, { "title": "Politique Nationale de Santé 2019-2030 (Ministère de la Santé et de la Population)", "url": "https://www.sante.gouv.cf/sites/default/files/2024-07/Politique%20Nationale%20Sant%C3%A9_2019-2030.pdf", "date": "2019", "publisherClass": "official" } ] }, "privacy": { "score": 45, "summary": "Health data is a banned category under Law 24.001 unless an exception applies, with fines up to 5% of turnover and prison of up to 5 years. With no health-sector enforcement and no verified regulator, it sits at the bottom of the general-law band.", "sources": [ { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" }, { "title": "Lois et Ordonnances (ARCEP, list of digital laws with dates)", "url": "https://www.arcep.cf/page.php?slug=lois-ordonnances", "date": "undated", "publisherClass": "official" }, { "title": "Review of the Central African Republic Data Protection Law (Tech Hive Advisory)", "url": "https://www.techhiveadvisory.africa/insights/review-of-the-central-african-republic-data-protection-law", "date": "2025-09-23", "publisherClass": "law_firm" }, { "title": "Central African Republic data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/central-african-republic/", "date": "undated", "publisherClass": "law_firm" } ] }, "journey": { "score": 20, "summary": "The Ministry's own 2022-2026 plan says the health information system is split into sub-systems with no interconnection or interoperability. DHIS2 collects aggregate data, but how many of the 35 districts use it is not verified.", "sources": [ { "title": "Plan National de Développement Sanitaire 2022-2026 (Ministère de la Santé et de la Population, P4H copy)", "url": "https://p4h.world/app/uploads/2024/02/Plan-national-de-developpement-sanitaire-en-RCA-2022-2026-1.x23411.pdf", "date": "2022", "publisherClass": "official" }, { "title": "Digital Transformation Unit, Ministry of Health and Population (CAR)", "url": "https://www.digitaltransformationcar.org/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Digitalisation du Microplan de Vaccination en République Centrafricaine (HISP Rwanda)", "url": "https://hisprwanda.org/project/digitalisation-du-microplan-de-vaccination-en-republique-centrafricaine/", "date": "2026-03-12", "publisherClass": "blog_vendor" }, { "title": "Création de la Caisse nationale d'assurance maladie (Corbeau News Centrafrique)", "url": "https://corbeaunews-centrafrique.org/creation-de-la-caisse-nationale-dassurance-maladie-touadera-comment-peut-on-creer-une-assurance-maladie-sans-dabord-evaluer-letat-du-systeme-de-sante/", "date": "2026-01-19", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "Direct marketing by phone, SMS, email or social media needs the person's prior consent under Article 15 of Law 24.001. No rules were found on selling de-identified health data or on health apps, and no enforcement exists.", "sources": [ { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" }, { "title": "Review of the Central African Republic Data Protection Law (Tech Hive Advisory)", "url": "https://www.techhiveadvisory.africa/insights/review-of-the-central-african-republic-data-protection-law", "date": "2025-09-23", "publisherClass": "law_firm" } ] }, "clinical": { "score": 15, "summary": "There is no shared record, so a clinician sees only what the facility holds, mostly on paper. The 2019 national health policy says the system has no unified database, and MSF's telemedicine links only its own projects.", "sources": [ { "title": "Politique Nationale de Santé 2019-2030 (Ministère de la Santé et de la Population)", "url": "https://www.sante.gouv.cf/sites/default/files/2024-07/Politique%20Nationale%20Sant%C3%A9_2019-2030.pdf", "date": "2019", "publisherClass": "official" }, { "title": "Plan National de Développement Sanitaire 2022-2026 (Ministère de la Santé et de la Population, P4H copy)", "url": "https://p4h.world/app/uploads/2024/02/Plan-national-de-developpement-sanitaire-en-RCA-2022-2026-1.x23411.pdf", "date": "2022", "publisherClass": "official" }, { "title": "RCA : La télémédecine au service de l'hôpital de Carnot (MSF)", "url": "https://www.msf.fr/actualites/republique-centrafricaine-un-reseau-mondial-de-professionnels-de-la-sante-connectes-par-la-telemedecine", "date": "2026-08-07", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Law 24.001 lets patient data be reused for public-interest health research unless the person objected, and misuse of data carries prison terms. An ethics committee exists at the University of Bangui, but the 2019 health policy says clinical research has no legal framework.", "sources": [ { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" }, { "title": "Central African Republic: ethics committees (Health Research Web, COHRED)", "url": "https://healthresearchwebafrica.org.za/fr/der/central_african_republic/ethics_2116", "date": "undated", "publisherClass": "academic" }, { "title": "Politique Nationale de Santé 2019-2030 (Ministère de la Santé et de la Population)", "url": "https://www.sante.gouv.cf/sites/default/files/2024-07/Politique%20Nationale%20Sant%C3%A9_2019-2030.pdf", "date": "2019", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "We found no rules for clinical AI and no national AI law or health-AI guidance. MSF uses CAD4TB, an AI chest X-ray tool, at Batangafo hospital, where the doctor keeps the final say.", "sources": [ { "title": "Centrafrique : l'IA au service du dépistage de la tuberculose (MSF)", "url": "https://www.msf.fr/actualites/republique-centrafricaine-l-ia-au-service-du-depistage-de-la-tuberculose", "date": "2026-07-20", "publisherClass": "news" }, { "title": "Loi n°24.001 portant protection des données à caractère personnel (signed text, ARCEP copy)", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF", "date": "2024-01-25", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Loi n°24.001 portant protection des données à caractère personnel", "level": "National", "year": "2024", "what": "Health data sensitive, free access without delay, marketing opt-in, fines up to 5% of turnover, agency planned.", "url": "https://www.arcep.cf/documents/textes/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF" }, { "name": "Loi n°24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité", "level": "National", "year": "2024", "what": "Legal framework for cybersecurity and offences committed with digital technology.", "url": "https://www.arcep.cf/page.php?slug=lois-ordonnances" }, { "name": "Loi n°22.002 régissant les transactions électroniques", "level": "National", "year": "2022", "what": "Rules for electronic transactions, digital exchanges and trust services.", "url": "https://www.arcep.cf/page.php?slug=lois-ordonnances" }, { "name": "Loi n°89.003 fixant les principes généraux relatifs à la Santé Publique", "level": "National", "year": "1989", "what": "The only general health law; the Ministry calls the health legal framework outdated and incomplete.", "url": "https://www.sante.gouv.cf/sites/default/files/2024-07/Politique%20Nationale%20Sant%C3%A9_2019-2030.pdf" }, { "name": "Loi n°20.012 portant sur le médicament, les autres produits de santé et l'exercice de la pharmacie", "level": "National", "year": "2020", "what": "Regulates medicines, other health products and pharmacy practice.", "url": "https://p4h.world/app/uploads/2024/02/Plan-national-de-developpement-sanitaire-en-RCA-2022-2026-1.x23411.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-01-27", "headline": "Patients wait weeks for test and imaging results at a public hospital", "paraphrase": "A news report says lab results and scans at a public hospital pile up unread. Patients told reporters they waited ten days to two weeks without receiving the report on their own tests.", "source": "Corbeau News Centrafrique", "url": "https://corbeaunews-centrafrique.org/a-lhopital-communautaire-de-bangui-un-systeme-de-soins-en-plein-chaos/", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "TCD", "name": "Chad", "region": "Africa", "overall": 33, "rank": "142=", "likelyRank": "108 to 168", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A 2015 data law gives patients a right to their health data, but records are mostly on paper and stay inside each facility.", "categories": { "access": { "score": 40, "summary": "Articles 38, 39 and 41 of Law 007/PR/2015 give a right to see and copy your health data, directly or through a health professional. A copy can be charged at reproduction cost, a reply is due within one month, and there is no national portal.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" }, { "title": "Espace Patients / Droits et devoirs, Centre Hospitalier Universitaire de la Renaissance", "url": "http://www.hopitalrenaissance-tchad.com/Patient7", "date": "undated", "publisherClass": "official" }, { "title": "Le Tchad accélère sa transformation numérique du système de santé avec l'accompagnement technique de HISP (HISP Rwanda)", "url": "https://hisprwanda.org/le-tchad-accelere-sa-transformation-numerique-du-systeme-de-sante/", "date": "2026-04-17", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "Health data needs explicit written consent, but the law exempts care, diagnosis and health service management under a health professional's supervision. Patients have no opt-out from sharing and no access log they can see.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is sensitive data under Law 007/PR/2015, breaches must be reported without delay, and violations carry up to one year in prison. We found no published enforcement, and the regulator's 2026 reform was presented by the Public Security minister.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" }, { "title": "Des réformes adoptées pour renforcer l'ANSICE (Agence Tchadienne de Presse et d'Edition)", "url": "https://atpe.td/des-reformes-adoptees-pour-renforcer-lansice/", "date": "2026-03-13", "publisherClass": "news" }, { "title": "Tchad : promulgation de la réforme de l'ANSICE (Alwihda Info)", "url": "https://www.alwihdainfo.com/Tchad-promulgation-de-la-reforme-de-l-ANSICE_a148767.html", "date": "2026-03-23", "publisherClass": "news" }, { "title": "Tchad : le SENAT valide la gestion sécurisée des données personnelles (Journal du Tchad)", "url": "https://journaldutchad.com/tchad-le-senat-valide-la-gestion-securisee-des-donnees-personnelles/", "date": "2026-04-29", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "DHIS2 carries national aggregate reporting, with 96.4% of districts entering data directly by 2022. Patient records remain mostly paper; an electronic medical record was only presented to the ministry in April 2026.", "sources": [ { "title": "Chad transitions to DHIS2-based health information management (DHIS2)", "url": "https://dhis2.org/chad-hmis-transition/", "date": "2022-12-19", "publisherClass": "blog_vendor" }, { "title": "Le Tchad accélère sa transformation numérique du système de santé avec l'accompagnement technique de HISP (HISP Rwanda)", "url": "https://hisprwanda.org/le-tchad-accelere-sa-transformation-numerique-du-systeme-de-sante/", "date": "2026-04-17", "publisherClass": "blog_vendor" }, { "title": "Loi n°035/PR/2019 instituant la Couverture Santé Universelle au Tchad (P4H)", "url": "https://p4h.world/app/uploads/2023/03/Loi20CMU_Tchad.x80726.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "CNAS au Tchad : ce que les textes imposent désormais aux employeurs (Cabinet Thomas Dingamgoto)", "url": "https://thomasd-avocats.com/cnas-csu-tchad-obligations-employeurs/", "date": "2026-07-01", "publisherClass": "law_firm" } ] }, "commercial": { "score": 40, "summary": "People must be told before their data is first passed to third parties for marketing and can object for free. This is an opt-out, and we found no rules on health apps, data brokers or sales of de-identified data.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" } ] }, "clinical": { "score": 17, "summary": "The law lets health professionals process health data for care without consent, but we found no shared record across facilities. Clinicians see only the paper or local files of their own facility.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" }, { "title": "Espace Patients / Droits et devoirs, Centre Hospitalier Universitaire de la Renaissance", "url": "http://www.hopitalrenaissance-tchad.com/Patient7", "date": "undated", "publisherClass": "official" }, { "title": "Dossier médical électronique : le Tchad engage une transition vers la santé numérique (We Are Tech)", "url": "https://www.wearetech.africa/fr/fils/actualites/tech/dossier-medical-electronique-le-tchad-engage-une-transition-vers-la-sante-numerique", "date": "2026-04-21", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Health data can be used for scientific research without consent under conditions set by ANSICE, which must authorise health research processing in advance. Safeguards are the ANSICE permit, the national bioethics committee, professional secrecy and criminal penalties.", "sources": [ { "title": "Loi n°007/PR/2015 du 10 février 2015 portant protection des données à caractère personnel (texte officiel bilingue)", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf", "date": "2015-02-10", "publisherClass": "legal_text" }, { "title": "SNECFA Project: CNBT Dissemination Workshop in Chad (CAMBIN)", "url": "https://cambin.org/snecfa-project-cnbt-dissemination-workshop-in-chad/", "date": "2024-12-19", "publisherClass": "academic" } ] }, "ai": { "score": 22, "summary": "We found no rules for AI in clinical care or AI as a medical device. Chad created an AI directorate in October 2025 and widened the data regulator's remit to AI in 2026, but those AI rules are not verified.", "sources": [ { "title": "Tchad : création d'une Direction générale de l'Intelligence artificielle au ministère du Numérique (Tchadinfos)", "url": "https://tchadinfos.com/2025/10/21/tchad-creation-dune-direction-generale-de-lintelligence-artificielle-au-ministere-du-numerique/", "date": "2025-10-21", "publisherClass": "news" }, { "title": "Tchad : promulgation de la réforme de l'ANSICE (Alwihda Info)", "url": "https://www.alwihdainfo.com/Tchad-promulgation-de-la-reforme-de-l-ANSICE_a148767.html", "date": "2026-03-23", "publisherClass": "news" }, { "title": "L'institution, Direction Générale de la Pharmacie, du Médicament et des Laboratoires (DGPML)", "url": "https://dgpml.com/linstitution/", "date": "undated", "publisherClass": "official" }, { "title": "TCHAD : Une stratégie nationale en préparation pour la transformation digitale et l'intelligence artificielle (Droit Médias Finance)", "url": "https://www.droitmediasfinance.com/index.php/actualites/droit-tech-fintech/1375-tchad-une-strategie-nationale-en-preparation-pour-la-transformation-digitale-et-lintelligence-artiificielle", "date": "2026-08-25", "publisherClass": "news" } ] } }, "laws": [ { "name": "Loi n°007/PR/2015 portant protection des données à caractère personnel", "level": "National", "year": "2015", "what": "Access, health data consent rules, research exemption, breach notice, transfer limits, penalties; ANSICE as regulator.", "url": "https://blog.africadataprotection.org/wp-content/uploads/2024/10/loi_07.pdf" }, { "name": "Ordonnance n°001/PR/2026 portant réforme de l'ANSICE (ratified by Loi n°003/AN-SENAT/2026)", "level": "National", "year": "2026", "what": "Widens ANSICE powers to cybercrime, video surveillance, platforms and AI; strengthens investigation and sanctions.", "url": "https://www.alwihdainfo.com/Tchad-promulgation-de-la-reforme-de-l-ANSICE_a148767.html" }, { "name": "Loi n°035/PR/2019 instituant la Couverture Santé Universelle", "level": "National", "year": "2019", "what": "Creates universal health coverage based on national solidarity and pooled risk.", "url": "https://p4h.world/app/uploads/2023/03/Loi20CMU_Tchad.x80726.pdf" }, { "name": "Loi n°026/PR/2020 portant création de la Caisse Nationale d'Assurance Santé", "level": "National", "year": "2020", "what": "Creates the CNAS fund that enrols insured people and pays care under three schemes.", "url": "https://thomasd-avocats.com/cnas-csu-tchad-obligations-employeurs/" }, { "name": "Loi portant encadrement des données biométriques dans les procédures judiciaires", "level": "National", "year": "2026", "what": "Rules for collecting, using and destroying biometric data in judicial procedures; Senate adopted April 2026.", "url": "https://journaldutchad.com/tchad-le-senat-valide-la-gestion-securisee-des-donnees-personnelles/" }, { "name": "Décret n°2690/PR/PM/MTENDA/2025", "level": "National", "year": "2025", "what": "Reorganises the digital ministry and creates a Directorate General for Artificial Intelligence.", "url": "https://tchadinfos.com/2025/10/21/tchad-creation-dune-direction-generale-de-lintelligence-artificielle-au-ministere-du-numerique/" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "EGY", "name": "Egypt", "region": "Middle East", "overall": 33, "rank": "142=", "likelyRank": "107 to 167", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Egypt links records for about 6.8 million people in seven governorates, but patients get no say over sharing, and data protection enforcement starts November 2026.", "categories": { "access": { "score": 30, "summary": "Law 151 of 2020 gives a right to access only electronically processed data, with fees up to EGP 20,000, no response deadline, and enforcement from November 2026. Each gap costs 5 points from the base of 45, clamped at 30; what the patient e-portal shows is not verified.", "sources": [ { "title": "Law No. 151 of 2020, Personal Data Protection Law (English translation, Andersen Egypt)", "url": "https://eg.andersen.com/wp-content/uploads/2025/06/Law-No.-151-OF-2020.pdf", "date": "undated", "publisherClass": "law_firm" }, { "title": "Executive Regulations of the Personal Data Protection Law: a legal commentary (Masaar and EIPR, Arabic)", "url": "https://eipr.org/sites/default/files/reports/pdf/_-_hmy_lbynt-2.pdf", "date": "2026-02", "publisherClass": "academic" }, { "title": "Hospital policy on patient rights (newborns and families), Egyptian Health Council training portal (Arabic)", "url": "https://lms.ehc.gov.eg/lms/mod/book/view.php?id=457&chapterid=2491&lang=ar", "date": "undated", "publisherClass": "official" }, { "title": "Prime Minister reviews Egypt Healthcare Authority results for H1 2025/2026 (Youm7, Arabic)", "url": "https://www.youm7.com/story/2026/9/5/%D9%85%D8%AF%D8%A8%D9%88%D9%84%D9%89-%D9%8A%D8%B3%D8%AA%D8%B9%D8%B1%D8%B6-%D8%AA%D9%82%D8%B1%D9%8A%D8%B1%D9%8B%D8%A7-%D8%AD%D9%88%D9%84-%D8%A5%D9%86%D8%AC%D8%A7%D8%B2%D8%A7%D8%AA-%D8%A7%D9%84%D8%B1%D8%B9%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9-%D8%A8%D8%A7%D9%84%D9%86%D8%B5%D9%81-%D8%A7%D9%84%D8%A3%D9%88%D9%84-%D9%85%D9%86/7536515", "date": "2026-09-05", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "Records are created and shared by default inside the universal insurance system, which is compulsory for citizens living in Egypt, with no opt-out and no patient-visible access log found. Written consent for health data applies only where no law authorises the processing.", "sources": [ { "title": "Universal Health Insurance Law No. 2 of 2018, full text (Manshurat legal archive, Arabic)", "url": "https://manshurat.org/node/63712", "date": "2018", "publisherClass": "legal_text" }, { "title": "Universal Health Insurance Authority home page: registration steps (Arabic)", "url": "https://uhia.gov.eg/", "date": "undated", "publisherClass": "official" }, { "title": "Law No. 151 of 2020, Personal Data Protection Law (English translation, Andersen Egypt)", "url": "https://eg.andersen.com/wp-content/uploads/2025/06/Law-No.-151-OF-2020.pdf", "date": "undated", "publisherClass": "law_firm" }, { "title": "Hospital policy on patient rights (newborns and families), Egyptian Health Council training portal (Arabic)", "url": "https://lms.ehc.gov.eg/lms/mod/book/view.php?id=457&chapterid=2491&lang=ar", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 36, "summary": "Law 151 makes health data sensitive, with prison and fines up to EGP 5 million, and the 2025 Medical Liability Law bars disclosing patient secrets. But the ICT minister chairs the regulator, whose board seats defence, interior and intelligence, and enforcement starts only after November 2026.", "sources": [ { "title": "Law No. 151 of 2020, Personal Data Protection Law (English translation, Andersen Egypt)", "url": "https://eg.andersen.com/wp-content/uploads/2025/06/Law-No.-151-OF-2020.pdf", "date": "undated", "publisherClass": "law_firm" }, { "title": "President ratifies the Personal Data Protection Law (State Information Service, Arabic)", "url": "https://sis.gov.eg/ar/%D8%A7%D9%84%D8%B1%D8%A6%D8%A7%D8%B3%D8%A9/%D8%B4%D8%A6%D9%88%D9%86-%D8%AF%D8%A7%D8%AE%D9%84%D9%8A%D8%A9/%D8%A7%D9%84%D9%82%D8%B1%D8%A7%D8%B1%D8%A7%D8%AA-%D8%A7%D9%84%D8%B1%D8%A6%D8%A7%D8%B3%D9%8A%D8%A9/%D8%A7%D9%84%D8%B1%D8%A6%D9%8A%D8%B3-%D8%A7%D9%84%D8%B3%D9%8A%D8%B3%D9%89%D9%8A-%D9%8A-%D8%B5%D8%AF-%D9%82-%D8%B9%D9%84%D9%89-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9/", "date": "2020-07-15", "publisherClass": "official" }, { "title": "Executive Regulations of the Personal Data Protection Law: a legal commentary (Masaar and EIPR, Arabic)", "url": "https://eipr.org/sites/default/files/reports/pdf/_-_hmy_lbynt-2.pdf", "date": "2026-02", "publisherClass": "academic" }, { "title": "Law No. 13 of 2025 on Medical Liability and Patient Safety, Official Gazette No. 17 bis (Ministry of Justice, Arabic)", "url": "https://moj.gov.eg:73/Doc/001/70640132025.pdf", "date": "2025-04-28", "publisherClass": "legal_text" } ] }, "journey": { "score": 35, "summary": "Inside the universal insurance governorates, primary care runs fully digital and labs, imaging and prescriptions feed a unified record for about 6.8 million beneficiaries. Elsewhere care is not linked; a national platform was only proposed in September 2026.", "sources": [ { "title": "Health ministry: universal insurance delivered 117 million services to 6 million people (Youm7, Arabic)", "url": "https://www.youm7.com/story/2026/7/6/%D9%88%D8%B2%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%AA%D8%A3%D9%85%D9%8A%D9%86-%D8%A7%D9%84%D8%B5%D8%AD%D9%89-%D8%A7%D9%84%D8%B4%D8%A7%D9%85%D9%84-%D9%82%D8%AF%D9%85-%D8%A3%D9%83%D8%AB%D8%B1-%D9%85%D9%86-117-%D9%85%D9%84%D9%8A%D9%88%D9%86/7471635", "date": "2026-07-06", "publisherClass": "news" }, { "title": "Prime Minister reviews Egypt Healthcare Authority results for H1 2025/2026 (Youm7, Arabic)", "url": "https://www.youm7.com/story/2026/9/5/%D9%85%D8%AF%D8%A8%D9%88%D9%84%D9%89-%D9%8A%D8%B3%D8%AA%D8%B9%D8%B1%D8%B6-%D8%AA%D9%82%D8%B1%D9%8A%D8%B1%D9%8B%D8%A7-%D8%AD%D9%88%D9%84-%D8%A5%D9%86%D8%AC%D8%A7%D8%B2%D8%A7%D8%AA-%D8%A7%D9%84%D8%B1%D8%B9%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9-%D8%A8%D8%A7%D9%84%D9%86%D8%B5%D9%81-%D8%A7%D9%84%D8%A3%D9%88%D9%84-%D9%85%D9%86/7536515", "date": "2026-09-05", "publisherClass": "news" }, { "title": "National Digital Health Strategy 2025-2029 (State Information Service, Arabic)", "url": "https://sis.gov.eg/ar/%D8%A7%D9%84%D9%85%D8%B1%D9%83%D8%B2-%D8%A7%D9%84%D8%A5%D8%B9%D9%84%D8%A7%D9%85%D9%8A/%D8%A7%D8%B3%D8%AA%D8%B1%D8%A7%D8%AA%D9%8A%D8%AC%D9%8A%D8%A7%D8%AA/%D8%A7%D9%84%D8%A7%D8%B3%D8%AA%D8%B1%D8%A7%D8%AA%D9%8A%D8%AC%D9%8A%D8%A9-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A%D8%A9-%D9%84%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%B1%D9%82%D9%85%D9%8A%D8%A9-2025-2029/", "date": "2025-11-15", "publisherClass": "official" }, { "title": "Egypt plans unified digital platform to link patient records across health facilities (Daily News Egypt)", "url": "https://www.dailynewsegypt.com/2026/09/14/egypt-plans-unified-digital-platform-to-link-patient-records-across-health-facilities/", "date": "2026-09-14", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Law 151 requires prior consent and a licence for electronic direct marketing and a licence plus written consent for any health data processing. Trading in research samples is banned, but no rule on de-identified data sales or health data brokers was found, and enforcement starts November 2026.", "sources": [ { "title": "Law No. 151 of 2020, Personal Data Protection Law (English translation, Andersen Egypt)", "url": "https://eg.andersen.com/wp-content/uploads/2025/06/Law-No.-151-OF-2020.pdf", "date": "undated", "publisherClass": "law_firm" }, { "title": "Executive Regulations of the Data Protection Law and the Data Protection Centre (Soliman, Hashish & Partners)", "url": "https://www.shandpartners.com/insights/briefings/telecoms-media-technology/the-issuance-of-the-executive-regulations-of-the-data-protection-law-and-the-establishment-of-the-data-protection-centre/", "date": "2026-01-11", "publisherClass": "law_firm" }, { "title": "Law No. 214 of 2020 on Clinical Medical Research, Official Gazette No. 51 bis (f) (Arabic)", "url": "https://nrc-mrec.online/?jet_download=c70bfcea951063cca1a77b849268a5dca8fe1356", "date": "2020-12-23", "publisherClass": "legal_text" }, { "title": "Law No. 13 of 2025 on Medical Liability and Patient Safety, Official Gazette No. 17 bis (Ministry of Justice, Arabic)", "url": "https://moj.gov.eg:73/Doc/001/70640132025.pdf", "date": "2025-04-28", "publisherClass": "legal_text" } ] }, "clinical": { "score": 30, "summary": "Treating teams in universal insurance facilities can reach a patient's unified electronic record, which the Healthcare Authority says gives fast access to patient data. Most Egyptians are outside that system, and the law only requires doctors to share information when consulted.", "sources": [ { "title": "Prime Minister reviews Egypt Healthcare Authority results for H1 2025/2026 (Youm7, Arabic)", "url": "https://www.youm7.com/story/2026/9/5/%D9%85%D8%AF%D8%A8%D9%88%D9%84%D9%89-%D9%8A%D8%B3%D8%AA%D8%B9%D8%B1%D8%B6-%D8%AA%D9%82%D8%B1%D9%8A%D8%B1%D9%8B%D8%A7-%D8%AD%D9%88%D9%84-%D8%A5%D9%86%D8%AC%D8%A7%D8%B2%D8%A7%D8%AA-%D8%A7%D9%84%D8%B1%D8%B9%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%B5%D8%AD%D9%8A%D8%A9-%D8%A8%D8%A7%D9%84%D9%86%D8%B5%D9%81-%D8%A7%D9%84%D8%A3%D9%88%D9%84-%D9%85%D9%86/7536515", "date": "2026-09-05", "publisherClass": "news" }, { "title": "Hospital policy on patient rights (newborns and families), Egyptian Health Council training portal (Arabic)", "url": "https://lms.ehc.gov.eg/lms/mod/book/view.php?id=457&chapterid=2491&lang=ar", "date": "undated", "publisherClass": "official" }, { "title": "Law No. 13 of 2025 on Medical Liability and Patient Safety, Official Gazette No. 17 bis (Ministry of Justice, Arabic)", "url": "https://moj.gov.eg:73/Doc/001/70640132025.pdf", "date": "2025-04-28", "publisherClass": "legal_text" }, { "title": "Egypt plans unified digital platform to link patient records across health facilities (Daily News Egypt)", "url": "https://www.dailynewsegypt.com/2026/09/14/egypt-plans-unified-digital-platform-to-link-patient-records-across-health-facilities/", "date": "2026-09-14", "publisherClass": "news" } ] }, "research": { "score": 50, "summary": "The 2020 Clinical Research Law covers retrospective record studies and requires written informed consent, Supreme Council ethics review, identity secrecy and prison for research without consent. Those four safeguards reach the 50 cap, though data must be open to the General Intelligence Service and no opt-out exists.", "sources": [ { "title": "Law No. 214 of 2020 on Clinical Medical Research, Official Gazette No. 51 bis (f) (Arabic)", "url": "https://nrc-mrec.online/?jet_download=c70bfcea951063cca1a77b849268a5dca8fe1356", "date": "2020-12-23", "publisherClass": "legal_text" }, { "title": "Hospital policy on patient rights (newborns and families), Egyptian Health Council training portal (Arabic)", "url": "https://lms.ehc.gov.eg/lms/mod/book/view.php?id=457&chapterid=2491&lang=ar", "date": "undated", "publisherClass": "official" }, { "title": "Egypt plans to establish first national center for health data science (State Information Service)", "url": "https://sis.gov.eg/en/media-center/news/egypt-plans-to-establish-first-national-center-for-health-data-science/", "date": "2026-05-16", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "Egypt governs AI through guidance: a 2023 Responsible AI Charter requiring final human determination and 2026 national guidelines. Medical device rules cover software and changes generally, but no AI-specific medical rule was found, and the AI law is still pending.", "sources": [ { "title": "Egyptian Charter for Responsible AI (National Council for AI)", "url": "https://ai.gov.eg/SynchedFiles/en/Resources/Egyptian%20Charter%20for%20Responsible%20AI.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Egypt National Artificial Intelligence Strategy 2025-2030 (OECD.AI Policy Navigator)", "url": "https://oecd.ai/en/dashboards/policy-initiatives/egypt-national-artificial-intelligence-strategy", "date": "2026-02-10", "publisherClass": "intergov" }, { "title": "Regulatory guideline on changes to a registered medical device, version 3 (Egyptian Drug Authority)", "url": "https://www.edaegypt.gov.eg/media/jf2cxmo4/3-regulatory-guideline-of-the-procedures-and-rules-organizing-the-changes-done-to-a-registration-license-data-of-a-medical-device_gd.pdf", "date": "2025-09-01", "publisherClass": "official" }, { "title": "Four ICT bills before parliament, from AI to child protection (El Watan, Arabic)", "url": "https://www.elwatannews.com/news/details/8341286", "date": "2026-08-17", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Law No. 151 of 2020", "level": "National", "year": "2020", "what": "Health data is sensitive; licence and written consent required; fines up to EGP 5 million.", "url": "https://eg.andersen.com/wp-content/uploads/2025/06/Law-No.-151-OF-2020.pdf" }, { "name": "PDPL Executive Regulations, Ministerial Decree 816 of 2025", "level": "National", "year": "2025", "what": "Licensing, DPOs, breach steps; one-year compliance period ending 1 November 2026.", "url": "https://eipr.org/sites/default/files/reports/pdf/_-_hmy_lbynt-2.pdf" }, { "name": "Medical Liability and Patient Safety Law No. 13 of 2025", "level": "National", "year": "2025", "what": "Duty to record procedures, obtain consent and keep patient secrets; effective late October 2025.", "url": "https://moj.gov.eg:73/Doc/001/70640132025.pdf" }, { "name": "Universal Health Insurance Law No. 2 of 2018", "level": "National", "year": "2018", "what": "Compulsory family-based insurance; insurer builds a beneficiary database linked to other state databases.", "url": "https://manshurat.org/node/63712" }, { "name": "Clinical Medical Research Law No. 214 of 2020", "level": "National", "year": "2020", "what": "Written informed consent, withdrawal right, sample rules; data open to intelligence service for audit.", "url": "https://nrc-mrec.online/?jet_download=c70bfcea951063cca1a77b849268a5dca8fe1356" }, { "name": "Medical Ethics Regulations, Ministerial Resolution 238 of 2003 (text hosted by the Egyptian Health Council)", "level": "National", "year": "2003", "what": "Doctors may not disclose patient secrets except by court order, serious risk or law.", "url": "https://www.ehc.gov.eg/documents/20126/0/medicine.pdf/7dee94e8-e6ac-1495-ffdf-2f0c95d582c7?t=1693421634760&download=true" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2026-08-27", "headline": "Lawmaker asks why some hospital patients cannot get their full medical files", "paraphrase": "A member of parliament told the health minister that patients at some public hospitals leave with only a final summary, not detailed reports and test results, and some are stopped from photographing their own records.", "source": "Cairo 24", "url": "https://www.cairo24.com/2484087", "theme": "access_refused", "status": "alleged" }, { "date": "2025-01-19", "headline": "Lawmaker raises claims that some medical labs misused patients' data", "paraphrase": "In a formal request to the health minister, a member of parliament cited press reports that some laboratories had used patients' data unlawfully, and asked for regular oversight to stop misuse of patient data. No finding was reported.", "source": "Darb", "url": "https://daaarb.com/%D8%AA%D8%AD%D8%B1%D9%83-%D8%A8%D8%B1%D9%84%D9%85%D8%A7%D9%86%D9%8A-%D8%B9%D9%86-%D8%A7%D8%AD%D8%AA%D9%83%D8%A7%D8%B1-%D8%AB%D9%84%D8%A7%D8%AB-%D9%85%D8%B9%D8%A7%D9%85%D9%84-%D8%AA%D8%AD%D8%A7%D9%84/", "theme": "other", "status": "alleged" }, { "date": "2025-04-27", "headline": "Disciplinary court suspends public hospital doctor who disclosed patients' confidential medical data", "paraphrase": "A disciplinary court suspended a public hospital doctor for six months. Prosecutors found she disclosed confidential medical information about patients online without their or the hospital's permission, and used patient information to promote clinics.", "source": "Youm7", "url": "https://www.youm7.com/story/2025/4/27/11-%D9%85%D8%AE%D8%A7%D9%84%D9%81%D8%A9-%D9%82%D8%A7%D8%AF%D8%AA-%D8%B7%D8%A8%D9%8A%D8%A8%D8%A9-%D9%83%D9%81%D8%B1-%D8%A7%D9%84%D8%AF%D9%88%D8%A7%D8%B1-%D9%85%D9%86-%D8%A7%D9%84%D8%B4%D9%87%D8%B1%D8%A9-%D9%84%D9%84%D9%88%D9%82%D9%81-%D8%B9%D9%86/6967597", "theme": "breach", "status": "finding" } ] }, { "iso3": "MOZ", "name": "Mozambique", "region": "Africa", "overall": 33, "rank": "142=", "likelyRank": "106 to 166", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Mozambique has no data protection law yet, so patients rely on a 2007 charter and a 2017 e-commerce law while most records stay paper.", "categories": { "access": { "score": 35, "summary": "Article 63 of the 2017 Electronic Transactions Law lets a person learn what electronic data a controller holds, against a fee and within a 'reasonable period'. The 2007 Patient Charter says patients may know what is in their clinical file, but there is no national portal.", "sources": [ { "title": "Lei n.º 3/2017, Lei de Transacções Electrónicas, Capítulo IX (arts. 63 a 65) and arts. 67 to 68 (Boletim da República, I Série, n.º 5)", "url": "https://www.cedsif.gov.mz/cedsifportal/wp-content/uploads/2022/04/Lei-de-Transac%C3%A7%C3%B5es-Electr%C3%B3nicas.pdf", "date": "2017-01-09", "publisherClass": "legal_text" }, { "title": "Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente (Boletim da República, I Série, n.º 50, reproduced as Annex II by CIP)", "url": "https://cipmoz.org/wp-content/uploads/2018/08/361_CIP-spinformacao_2015_06_pt.pdf", "date": "2007-12-18", "publisherClass": "legal_text" }, { "title": "INTIC, Proposta de Lei de Protecção de Dados Pessoais segue para debate na Assembleia da República", "url": "https://intic.gov.mz/proposta-de-lei-de-proteccao-de-dados-pessoais-segue-para-debate-na-assembleia-da-republica/", "date": "2026-03-05", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "The Patient Charter requires consent for medical acts and HIV status may not be disclosed without consent. We found no opt-out from record sharing and no patient-visible access log.", "sources": [ { "title": "Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente (Boletim da República, I Série, n.º 50, reproduced as Annex II by CIP)", "url": "https://cipmoz.org/wp-content/uploads/2018/08/361_CIP-spinformacao_2015_06_pt.pdf", "date": "2007-12-18", "publisherClass": "legal_text" }, { "title": "Lei n.º 19/2014, Lei de Protecção da Pessoa, do Trabalhador e do Candidato a Emprego Vivendo com HIV e SIDA", "url": "https://www.wlsa.org.mz/wp-content/uploads/2014/11/NovaLeiHIV_SIDA.pdf", "date": "2014-08-27", "publisherClass": "legal_text" }, { "title": "Lei n.º 3/2017, Lei de Transacções Electrónicas, Capítulo IX (arts. 63 a 65) and arts. 67 to 68 (Boletim da República, I Série, n.º 5)", "url": "https://www.cedsif.gov.mz/cedsifportal/wp-content/uploads/2022/04/Lei-de-Transac%C3%A7%C3%B5es-Electr%C3%B3nicas.pdf", "date": "2017-01-09", "publisherClass": "legal_text" } ] }, "privacy": { "score": 38, "summary": "There is no general data protection law or independent regulator yet; the 2017 Electronic Transactions Law sets fines of 30 to 90 minimum wages for data protection breaches. HIV status has its own confidentiality penalties, and no health-sector enforcement was found.", "sources": [ { "title": "Lei n.º 3/2017, Lei de Transacções Electrónicas, Capítulo IX (arts. 63 a 65) and arts. 67 to 68 (Boletim da República, I Série, n.º 5)", "url": "https://www.cedsif.gov.mz/cedsifportal/wp-content/uploads/2022/04/Lei-de-Transac%C3%A7%C3%B5es-Electr%C3%B3nicas.pdf", "date": "2017-01-09", "publisherClass": "legal_text" }, { "title": "Lei n.º 19/2014, Lei de Protecção da Pessoa, do Trabalhador e do Candidato a Emprego Vivendo com HIV e SIDA", "url": "https://www.wlsa.org.mz/wp-content/uploads/2014/11/NovaLeiHIV_SIDA.pdf", "date": "2014-08-27", "publisherClass": "legal_text" }, { "title": "Data protection laws in Mozambique (DLA Piper), last modified 17 February 2026", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=MZ", "date": "2026-02-17", "publisherClass": "law_firm" }, { "title": "INTIC apela ao reforço da fiscalização e responsabilização na protecção de dados (Diário Económico)", "url": "https://www.diarioeconomico.co.mz/2026/08/25/desenvolvimento-2/intic-apela-ao-reforco-da-fiscalizacao-e-responsabilizacao-na-proteccao-de-dados/", "date": "2026-08-25", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "Electronic records exist mainly inside the HIV programme, with SESP reported at over 670 facilities, while the ministry admits its systems do not talk to each other. Only a few hospitals run general electronic records; the exact number is not verified.", "sources": [ { "title": "MISAU, SISMA (Sistema de Informação para Saúde em Monitoria e Avaliação) home page", "url": "https://sisma.misau.gov.mz/", "date": "undated", "publisherClass": "official" }, { "title": "C-Saúde, Health Information Systems (SIS-RME, SESP, iDMED, DISA Lab interoperability)", "url": "https://csaude.org.mz/health-information-systems/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "MISAU aponta desafios na integração digital do sistema de saúde (AIM)", "url": "https://aimnews.org/2026/04/15/misau-aponta-desafios-na-integracao-digital-do-sistema-de-saude/", "date": "2026-04-15", "publisherClass": "news" }, { "title": "Moçambique garante 40 milhões de dólares para digitalização da saúde (AIM)", "url": "https://aimnews.org/2026/04/15/mocambique-garante-40-milhoes-de-dolares-para-digitalizacao-da-saude/", "date": "2026-04-15", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "The 2017 law limits use of electronic personal data to the purpose stated at collection and makes unsolicited commercial messages an offence once a person objects. We found no rules on selling health data, data brokers or health apps.", "sources": [ { "title": "Lei n.º 3/2017, Lei de Transacções Electrónicas, Capítulo IX (arts. 63 a 65) and arts. 67 to 68 (Boletim da República, I Série, n.º 5)", "url": "https://www.cedsif.gov.mz/cedsifportal/wp-content/uploads/2022/04/Lei-de-Transac%C3%A7%C3%B5es-Electr%C3%B3nicas.pdf", "date": "2017-01-09", "publisherClass": "legal_text" }, { "title": "INTIC, Proposta de Lei de Protecção de Dados Pessoais segue para debate na Assembleia da República", "url": "https://intic.gov.mz/proposta-de-lei-de-proteccao-de-dados-pessoais-segue-para-debate-na-assembleia-da-republica/", "date": "2026-03-05", "publisherClass": "official" } ] }, "clinical": { "score": 25, "summary": "A clinician in an HIV clinic using SESP can see that programme's history and linked lab results, but no shared record spans providers. The Patient Charter expects patients to carry diagnostic documents between services.", "sources": [ { "title": "Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente (Boletim da República, I Série, n.º 50, reproduced as Annex II by CIP)", "url": "https://cipmoz.org/wp-content/uploads/2018/08/361_CIP-spinformacao_2015_06_pt.pdf", "date": "2007-12-18", "publisherClass": "legal_text" }, { "title": "C-Saúde, Health Information Systems (SIS-RME, SESP, iDMED, DISA Lab interoperability)", "url": "https://csaude.org.mz/health-information-systems/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Moçambique garante 40 milhões de dólares para digitalização da saúde (AIM)", "url": "https://aimnews.org/2026/04/15/mocambique-garante-40-milhoes-de-dolares-para-digitalizacao-da-saude/", "date": "2026-04-15", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health research needs ethics approval from a committee accredited by the national bioethics committee, CNBS, and research registration. Health system data may be reused under an approved protocol with anonymisation, without individual consent or an opt-out.", "sources": [ { "title": "Decreto n.º 53/2024, Regulamento da Lei de Investigação em Saúde Humana (Boletim da República, I Série, n.º 139)", "url": "https://faolex.fao.org/docs/pdf/moz228472.pdf", "date": "2024-07-18", "publisherClass": "legal_text" }, { "title": "Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente (Boletim da República, I Série, n.º 50, reproduced as Annex II by CIP)", "url": "https://cipmoz.org/wp-content/uploads/2018/08/361_CIP-spinformacao_2015_06_pt.pdf", "date": "2007-12-18", "publisherClass": "legal_text" } ] }, "ai": { "score": 38, "summary": "ANARME's device manual classifies medical decision software by risk, but has no AI-specific rules on change control or human oversight. A National AI Commission created in March 2026 will set ethical principles.", "sources": [ { "title": "ANARME, Manual de Autorização de Introdução no Mercado de Dispositivos Médicos e Dispositivos de Diagnóstico In-Vitro (ANARME.MAM.DVAM.002, versão 00)", "url": "https://anarme.gov.mz/download/manual-de-autorizacao-de-introducao-no-mercado-de-dispositivos-medicos-e-dispositivos-medicos-de-diagnostico-in-vitro/", "date": "2024-07", "publisherClass": "official" }, { "title": "Moçambique cria Comissão Nacional de Inteligência Artificial para orientar economia digital (Forbes África Lusófona)", "url": "https://forbesafricalusofona.com/mocambique-cria-comissao-nacional-de-inteligencia-artificial-para-orientar-economia-digital/", "date": "2026-03-13", "publisherClass": "news" } ] } }, "laws": [ { "name": "Lei n.º 3/2017, Lei de Transacções Electrónicas", "level": "National", "year": "2017", "what": "Chapter IX protects electronic personal data: purpose limits, access for a fee, fines of 30 to 90 minimum wages.", "url": "https://www.cedsif.gov.mz/cedsifportal/wp-content/uploads/2022/04/Lei-de-Transac%C3%A7%C3%B5es-Electr%C3%B3nicas.pdf" }, { "name": "Resolução n.º 73/2007, Carta dos Direitos e Deveres do Doente", "level": "National", "year": "2007", "what": "Patient rights to consent, confidentiality and to know the data in one's clinical file.", "url": "https://cipmoz.org/wp-content/uploads/2018/08/361_CIP-spinformacao_2015_06_pt.pdf" }, { "name": "Lei n.º 19/2014, protection of people living with HIV and AIDS", "level": "National", "year": "2014", "what": "Bans disclosing HIV status without consent; testing needs informed consent; fines in minimum wages.", "url": "https://www.wlsa.org.mz/wp-content/uploads/2014/11/NovaLeiHIV_SIDA.pdf" }, { "name": "Lei n.º 6/2023 and Decreto n.º 53/2024, human health research", "level": "National", "year": "2024", "what": "Ethics approval, research registration and protocol rules for reusing health system data.", "url": "https://faolex.fao.org/docs/pdf/moz228472.pdf" }, { "name": "Lei n.º 3/2026, regime jurídico do Sistema Nacional de Saúde (SINS)", "level": "National", "year": "2026", "what": "Sets the legal regime of the National Health System; gazetted 21 January 2026. Data provisions not verified.", "url": "https://www.inm.gov.mz/pt-br/content/sum%C3%A1rio-suplemento-n%C2%BA-1-de-210126-pag-34-1-17-br-n%C2%BA-13-boletim-da-rep%C3%BAblica-i-serie-p%C3%A1g-1" }, { "name": "Proposta de Lei de Protecção de Dados Pessoais (bill)", "level": "National", "year": "2026", "what": "Approved by Council of Ministers 3 March 2026; consent, access rights, breach notice. Not yet law.", "url": "https://intic.gov.mz/proposta-de-lei-de-proteccao-de-dados-pessoais-segue-para-debate-na-assembleia-da-republica/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-12-16", "headline": "Government confirms new US health deal includes sharing health data and samples", "paraphrase": "Reporting a health ministry statement, the outlet says a five-year US funding memorandum includes an agreement to share national health data and biological samples, which the government says will follow national data protection rules.", "source": "Carta de Moçambique", "url": "https://cartamz.com/destaque/48260/mocambique-e-eua-assinam-acordo-de-17-mil-milhoes-de-dolares-na-saude/", "theme": "sold_or_shared", "status": "admitted" }, { "date": "2026-09-14", "headline": "Rights activist asks whether patients' clinical data will be sent abroad under US deal", "paraphrase": "A civil society leader says the terms of the health data sharing agreement are opaque and asks the ministry to publish them, including whether data sent abroad is anonymised or individual clinical records, and how long it is kept.", "source": "MZNews", "url": "https://mznews.co.mz/adriano-nuvunga-exige-explicacoes-sobre-partilha-de-dados-de-saude-entre-mocambique-e-eua/", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "PLW", "name": "Palau", "region": "Oceania", "overall": 33, "rank": "142=", "likelyRank": "108 to 169", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Palau's national hospital keeps one electronic record, but patients lack a copy right or sharing choices, and a 2025 breach leaked medical data.", "categories": { "access": { "score": 35, "summary": "Citizens have a constitutional right to examine any government document, and the Open Government Act sets a 10-day deadline. Whether this covers a patient's own hospital file is not verified, and the Privacy Act has no access right.", "sources": [ { "title": "Constitution of the Republic of Palau 1981 (rev. 1992) (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Palau_1992", "date": "1992", "publisherClass": "legal_text" }, { "title": "Open Government Act, RPPL No. 9-32 (RTI Rating copy of the PacLII text)", "url": "https://www.rti-rating.org/wp-content/uploads/2018/09/Palau.Open-Government.2014.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "Palau: personal information protection regime (Rakuten Group cross-border transfer notice)", "url": "https://corp.rakuten.co.jp/privacy/assets/pdf/trf_palau.pdf", "date": "2026-03-25", "publisherClass": "blog_vendor" } ] }, "control": { "score": 30, "summary": "No opt-out, granular choice or patient-visible access log was found, and the government has called the Ministry the owner of medical records. The Healthcare Fund needs written consent, valid one year, to release a member's medical information.", "sources": [ { "title": "Digital Residency Program Cyber Security Regulation, quoting the Privacy Act, 6 PNCA 205-206 (Palau Government)", "url": "https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf", "date": "2023-03", "publisherClass": "official" }, { "title": "Healthcare Fund (HF) Regulations (Republic of Palau Healthcare Fund)", "url": "http://rophcf.pw/download/documents/hcf_regulations/hcf_regulations.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Gov't seeks permanent order stopping Uludong and TBN from publishing patient information (Island Times)", "url": "https://islandtimes.org/govt-seeks-permanent-order-stopping-uludong-and-tbn-from-publishing-patient-information/", "date": "2023-09-22", "publisherClass": "news" } ] }, "privacy": { "score": 32, "summary": "The Privacy Act binds only national agencies and there is no regulator. A February 2025 ransomware attack exposed hospital billing records with diagnoses, and the July 2026 Cybersecurity Act orders a breach process that must require agencies to notify victims.", "sources": [ { "title": "Digital Residency Program Cyber Security Regulation, quoting the Privacy Act, 6 PNCA 205-206 (Palau Government)", "url": "https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf", "date": "2023-03", "publisherClass": "official" }, { "title": "Palau health ministry on the mend after Qilin ransomware attack (The Record)", "url": "https://therecord.media/palau-health-ministry-ransomware-recover", "date": "2025-03-03", "publisherClass": "news" }, { "title": "RPPL No. 12-8, Palau Cybersecurity Act (Olbiil Era Kelulau, signed copy)", "url": "https://palauoek.org/wp-content/uploads/2026/07/RPPL-No.-12-8.pdf", "date": "2026-07-21", "publisherClass": "legal_text" }, { "title": "Title 41 PNCA, National Healthcare Financing Act (Palau Social Security Administration copy)", "url": "https://ropssa.pw/download/ss_laws/pnca_title_41_palau_law.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 38, "summary": "Since December 2022 Belau National Hospital has run the Tamanu record, linked to the lab by FHIR since 2024, plus pharmacy and surveillance tools. A 2025 study found an electronic record in 1 of 9 facilities, and the new national EHR's go-live is not verified.", "sources": [ { "title": "Launching digital health software in Palau (BES International)", "url": "https://www.bes.au/launching-digital-health-software-in-palau/", "date": "2023-02-03", "publisherClass": "blog_vendor" }, { "title": "Tamanu integration with SENAITE goes live in Palau using FHIR (BES International)", "url": "https://www.bes.au/tamanu-integration-with-senaite-goes-live-using-fhir/", "date": "2024-06-25", "publisherClass": "blog_vendor" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "How Palau is advancing its data modernization infrastructure and capacity through partnership (ASTHO)", "url": "https://www.astho.org/communications/blog/2026/how-palau-is-advancing-data-modernization-infrastructure-through-partnership/", "date": "2026-03-18", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 18, "summary": "No law limiting the sale of health data, its marketing use, data brokers or health apps was found. The Privacy Act and the 2026 Cybersecurity Act bind government agencies, so private clinics and app makers sit largely outside them.", "sources": [ { "title": "Digital Residency Program Cyber Security Regulation, quoting the Privacy Act, 6 PNCA 205-206 (Palau Government)", "url": "https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf", "date": "2023-03", "publisherClass": "official" }, { "title": "Palau: personal information protection regime (Rakuten Group cross-border transfer notice)", "url": "https://corp.rakuten.co.jp/privacy/assets/pdf/trf_palau.pdf", "date": "2026-03-25", "publisherClass": "blog_vendor" }, { "title": "RPPL No. 12-8, Palau Cybersecurity Act (Olbiil Era Kelulau, signed copy)", "url": "https://palauoek.org/wp-content/uploads/2026/07/RPPL-No.-12-8.pdf", "date": "2026-07-21", "publisherClass": "legal_text" } ] }, "clinical": { "score": 40, "summary": "Clinicians at Belau National Hospital see a patient's history and lab results in Tamanu at the bedside. Community health centres and private clinics were not verified as connected, and only 1 of 9 facilities had an electronic record.", "sources": [ { "title": "Launching digital health software in Palau (BES International)", "url": "https://www.bes.au/launching-digital-health-software-in-palau/", "date": "2023-02-03", "publisherClass": "blog_vendor" }, { "title": "FSM Health ICT team conducts reverse site visit to Palau Ministry of Health and Human Services (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/fsm-health-ict-team-conducts-successful-reverse-site-visit-to-palau-ministry-of-health-and-human-services/", "date": "2025-11", "publisherClass": "official" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Taiwan-Palau Smart Hospital Project enhances healthcare with AI-driven solutions (Island Times)", "url": "https://islandtimes.org/taiwan-palau-smart-hospital-project-enhances-healthcare-with-ai-driven-solutions/", "date": "2025-01-17", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "A statutory Institutional Review Board must approve research on people, informed consent is required and violations carry fines of up to $10,000. No opt-out or public register for research use of health records was found.", "sources": [ { "title": "RPPL No. 10-27, Institutional Review Board for research on human subjects, with signing statement (Office of the President)", "url": "https://www.palaugov.pw/wp-content/uploads/2018/08/RPPL-No.-10-27-re.-To-Establish-an-Institutional-Review-Board.pdf", "date": "2018-08-08", "publisherClass": "legal_text" }, { "title": "Digital Residency Program Cyber Security Regulation, quoting the Privacy Act, 6 PNCA 205-206 (Palau Government)", "url": "https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf", "date": "2023-03", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found, though Belau National Hospital uses AI software to screen for diabetic eye disease. An April 2026 executive order created a technology office whose remit the President said includes AI.", "sources": [ { "title": "Taiwan-Palau Smart Hospital Project enhances healthcare with AI-driven solutions (Island Times)", "url": "https://islandtimes.org/taiwan-palau-smart-hospital-project-enhances-healthcare-with-ai-driven-solutions/", "date": "2025-01-17", "publisherClass": "news" }, { "title": "AI Regulation in Palau (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-palau", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Palau is stepping up its digital defences (PINA)", "url": "https://pina.com.fj/2026/04/13/palau-is-stepping-up-its-digital-defences/", "date": "2026-04-13", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitution of the Republic of Palau, Article IV sections 4 and 12", "level": "National", "year": "1981", "what": "Security of person and papers against search; citizens may examine any government document.", "url": "https://www.constituteproject.org/constitution/Palau_1992" }, { "name": "Privacy Act, 6 PNCA 201-206", "level": "National", "year": "not verified", "what": "National agencies must secure personal information, limit retention and reuse; no access right or regulator.", "url": "https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf" }, { "name": "Open Government Act, RPPL No. 9-32", "level": "National", "year": "2014", "what": "Public records available within 10 days; medical files exempt where release invades privacy.", "url": "https://www.rti-rating.org/wp-content/uploads/2018/09/Palau.Open-Government.2014.pdf" }, { "name": "National Healthcare Financing Act, RPPL 8-14 (41 PNCA 960)", "level": "National", "year": "2010", "what": "Healthcare Fund; medical information released only with consent or listed exceptions; $1,000 fine for leaks.", "url": "https://ropssa.pw/download/ss_laws/pnca_title_41_palau_law.pdf" }, { "name": "RPPL No. 10-27, Institutional Review Board (34 PNC chapter 4)", "level": "National", "year": "2018", "what": "Board approval and informed consent for human subjects research; fines up to $10,000.", "url": "https://www.palaugov.pw/wp-content/uploads/2018/08/RPPL-No.-10-27-re.-To-Establish-an-Institutional-Review-Board.pdf" }, { "name": "RPPL No. 12-8, Palau Cybersecurity Act", "level": "National", "year": "2026", "what": "Bureau of Cybersecurity; breach process must require agencies to notify victims; up to $10,000 civil penalty per breach.", "url": "https://palauoek.org/wp-content/uploads/2026/07/RPPL-No.-12-8.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-03-06", "headline": "Palau health ministry says ransomware attack exposed hospital patient records", "paraphrase": "The health ministry said attackers accessed hospital patient data, including names, addresses, phone numbers, birth dates and medical details. It advised everyone in Palau to watch for fraud and phishing messages.", "source": "teiss", "url": "https://www.teiss.co.uk/news/ransomware-attack-on-palaus-health-ministry-compromised-citizens-medical-records-15450", "theme": "breach", "status": "admitted" }, { "date": "2025-02-21", "headline": "Cyberattack forced Palau hospital staff to pull patient records by hand", "paraphrase": "After a ransomware attack the ministry shut its systems, and staff retrieved patient records manually. Services were delayed, and patients were asked to bring medicine containers and written prescriptions for refills.", "source": "Island Times", "url": "https://islandtimes.org/cyberattacks-on-the-rise-in-palau-whipps-stresses-need-for-stronger-recovery-systems/", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "PRY", "name": "Paraguay", "region": "Americas", "overall": 33, "rank": "142=", "likelyRank": "106 to 166", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Paraguay passed a modern data law in 2025 that does not apply until November 2027, and its national e-record bill died in May 2026.", "categories": { "access": { "score": 33, "summary": "No law in force was found that gives patients a copy of their full clinical record; the constitution's habeas data covers official and public-character registers only. Ley 7593 adds a free access and copy right, but not until November 2027.", "sources": [ { "title": "Constitucion de la Republica del Paraguay 1992, Articulo 135 (Georgetown PDBA)", "url": "https://pdba.georgetown.edu/Parties/Paraguay/Leyes/constitucion.pdf", "date": "undated", "publisherClass": "academic" }, { "title": "Ley 7593/2025, proteccion de datos personales en la Republica del Paraguay (BaseLegal)", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722", "date": "2025-11-27", "publisherClass": "legal_text" }, { "title": "Expediente D-2375375, historia clinica electronica y su registro: archivado (SILpy)", "url": "https://silpy.congreso.gov.py/web/expediente/129698", "date": "2026-05-18", "publisherClass": "official" }, { "title": "Mi IPS (Instituto de Prevision Social)", "url": "https://portal.ips.gov.py/sistemas/ipsportal/contenido.php?c=278", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 27, "summary": "Records sit in provider systems such as the Health Ministry's HIS with no patient opt-out or patient-visible access log found. A 2026 rule logs each staff user by e-ID, but for traceability, not for patients.", "sources": [ { "title": "Avanza consolidacion del HIS como sistema unico e integral de informacion en salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/35833/avanza-consolidacion-del-his-como-sistema-unico-e-integral-de-informacion-en-salud.html", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Expediente D-2375375, historia clinica electronica y su registro: archivado (SILpy)", "url": "https://silpy.congreso.gov.py/web/expediente/129698", "date": "2026-05-18", "publisherClass": "official" }, { "title": "Ley 7593/2025, proteccion de datos personales en la Republica del Paraguay (BaseLegal)", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722", "date": "2025-11-27", "publisherClass": "legal_text" } ] }, "privacy": { "score": 35, "summary": "Until November 2027 no general data protection law covers health data, only habeas data, a 2020 credit data law and professional secrecy. A June 2026 ransomware attack disrupted electronic records at three private hospital groups.", "sources": [ { "title": "Ley 7593/2025, proteccion de datos personales en la Republica del Paraguay (BaseLegal)", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722", "date": "2025-11-27", "publisherClass": "legal_text" }, { "title": "Ley 836/80, Codigo Sanitario (MSPBS DIGIES)", "url": "https://digies.mspbs.gov.py/wp-content/uploads/Ley-N%C2%B0-836-Codigo-Sanitario.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "El ciberataque que obligo a los sanatorios a volver al papel (El Independiente)", "url": "https://independiente.com.py/el-ciberataque-que-obligo-a-los-sanatorios-a-volver-al-papel-y-reabre-el-debate-sobre-la-ciberseguridad/", "date": "2026-06-30", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 40, "summary": "The Health Ministry's HIS runs in 1,335 public facilities and holds electronic records, inpatient data, prescribing and dispensing. Social security (IPS) and private providers run separate systems, and national interoperability is still at the testing stage.", "sources": [ { "title": "Expansion sostenida: HIS llega a 1.335 establecimientos de salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/36139/expansion-sostenida-his-llega-a-1335-establecimientos-de-salud.html", "date": "2026-08-07", "publisherClass": "official" }, { "title": "Avanza consolidacion del HIS como sistema unico e integral de informacion en salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/35833/avanza-consolidacion-del-his-como-sistema-unico-e-integral-de-informacion-en-salud.html", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Paraguay impulsa avances en interoperabilidad en salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/34427/paraguay-impulsa-avances-en-interoperabilidad-en-salud.html", "date": "2025-12-02", "publisherClass": "official" }, { "title": "Expediente D-2375375, historia clinica electronica y su registro: archivado (SILpy)", "url": "https://silpy.congreso.gov.py/web/expediente/129698", "date": "2026-05-18", "publisherClass": "official" } ] }, "commercial": { "score": 30, "summary": "No rule in force limits sale of health data or health-based marketing. Ley 7593 will ban processing sensitive data without consent or a listed exception and let people stop direct marketing, but only from November 2027.", "sources": [ { "title": "Ley 7593/2025, proteccion de datos personales en la Republica del Paraguay (BaseLegal)", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722", "date": "2025-11-27", "publisherClass": "legal_text" }, { "title": "Expediente D-2162170, Ley 7593 promulgada y publicada 27/11/2025 (SILpy, Congreso Nacional)", "url": "https://silpy.congreso.gov.py/expediente/123459", "date": "2025-11-27", "publisherClass": "official" } ] }, "clinical": { "score": 33, "summary": "Clinicians in public facilities on HIS can record and consult electronic records, but whether they can see notes from other facilities, IPS or private hospitals was not verified. No national record or exchange is in force.", "sources": [ { "title": "Avanza consolidacion del HIS como sistema unico e integral de informacion en salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/35833/avanza-consolidacion-del-his-como-sistema-unico-e-integral-de-informacion-en-salud.html", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Conectaton 2026: MSPBS lanza Agenda de Salud Digital (MSPBS)", "url": "https://www.mspbs.gov.py/portal/35602/conectaton-2026-mspbs-lanza-agenda-de-salud-digital.html", "date": "2026-05-26", "publisherClass": "official" }, { "title": "Expansion sostenida: HIS llega a 1.335 establecimientos de salud (MSPBS)", "url": "https://www.mspbs.gov.py/portal/36139/expansion-sostenida-his-llega-a-1335-establecimientos-de-salud.html", "date": "2026-08-07", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Clinical trials need DINAVISA authorization under good clinical practice, informed consent content rules and accredited ethics committees. No in-force rule governs secondary use of health records and there is no opt-out; ethics bodies and statutory professional secrecy are the safeguards.", "sources": [ { "title": "Direccion de Investigacion: ensayos clinicos y comites de etica (DINAVISA)", "url": "https://dinavisa.gov.py/direccion-de-investigacion/", "date": "undated", "publisherClass": "official" }, { "title": "Ley 7593/2025, proteccion de datos personales en la Republica del Paraguay (BaseLegal)", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722", "date": "2025-11-27", "publisherClass": "legal_text" }, { "title": "Ley 836/80, Codigo Sanitario (MSPBS DIGIES)", "url": "https://digies.mspbs.gov.py/wp-content/uploads/Ley-N%C2%B0-836-Codigo-Sanitario.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "DINAVISA's 2024 device rule defines software as a medical device and covers post-authorization changes, but no AI-specific clinical rule was found. Paraguay has no AI law; two bills were before Congress in August 2026.", "sources": [ { "title": "Resolucion DINAVISA 226/2024, autorizacion de comercializacion de dispositivos medicos y modificaciones post autorizacion", "url": "https://dinavisa.gov.py/wp-content/uploads/2024/09/RESOLUCION-DINAVISA-N%C2%B0226.pdf", "date": "2024-08-27", "publisherClass": "legal_text" }, { "title": "Resoluciones (DINAVISA)", "url": "https://dinavisa.gov.py/resoluciones/", "date": "undated", "publisherClass": "official" }, { "title": "El vacio normativo: la paradoja de Paraguay ante la Inteligencia Artificial (Economia Virtual)", "url": "https://www.economiavirtual.com.py/noticia/3162/el-vacio-normativo-la-paradoja-de-paraguay-ante-la-inteligencia-artificial/", "date": "2026-08-18", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitucion Nacional, Articulo 135 (habeas data)", "level": "National", "year": "1992", "what": "Right to access and correct one's data in official or public-character registers, through a judge.", "url": "https://pdba.georgetown.edu/Parties/Paraguay/Leyes/constitucion.pdf" }, { "name": "Ley 836/80 (Codigo Sanitario)", "level": "National", "year": "1980", "what": "Health code; health workers who willfully breach professional secrecy can be suspended or deregistered.", "url": "https://digies.mspbs.gov.py/wp-content/uploads/Ley-N%C2%B0-836-Codigo-Sanitario.pdf" }, { "name": "Ley 7593/2025 (proteccion de datos personales)", "level": "National", "year": "2025", "what": "Health is sensitive data; access, portability, 72-hour breach notice, new agency. In force November 2027.", "url": "https://baselegal.com.py/docs/c0b02f3c-cc40-11f0-8c5a-525400343722" }, { "name": "Resolucion DINAVISA 226/2024", "level": "National", "year": "2024", "what": "Device marketing authorization, post-authorization changes and renewals; defines software as a medical device.", "url": "https://dinavisa.gov.py/wp-content/uploads/2024/09/RESOLUCION-DINAVISA-N%C2%B0226.pdf" }, { "name": "Resolucion DINAVISA 238/2024", "level": "National", "year": "2024", "what": "Authorization, control and inspection of clinical trials under good clinical practice.", "url": "https://dinavisa.gov.py/direccion-de-investigacion/" }, { "name": "Resolucion S.G. 318/2026 (MSPBS)", "level": "National", "year": "2026", "what": "Makes government e-ID mandatory for staff accessing HIS, so each user is identified and traceable.", "url": "https://www.mspbs.gov.py/portal/35833/avanza-consolidacion-del-his-como-sistema-unico-e-integral-de-informacion-en-salud.html" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-11", "headline": "Health regulator finds a patient's digital record was rewritten minutes after the event", "paraphrase": "An audit by the Superintendencia de Salud found that the original entry in a patient's digital clinical record at the social security hospital was deleted and replaced six minutes later with a different account. The regulator identified the user responsible.", "source": "ABC Color", "url": "https://www.abc.com.py/nacionales/2026/06/11/negligencia-en-ips-ingavi-borraron-evidencias-tras-cirugia-erronea-confirma-superintendencia-de-salud/", "theme": "record_wrong", "status": "finding" }, { "date": "2025-06-23", "headline": "Government cyber team confirms attack on Ministry of Health systems", "paraphrase": "The national incident response team CERT-PY said a cyber incident hit the Ministry of Health and was contained. A security expert warned that data taken in such attacks usually ends up exposed on dark web forums.", "source": "ABC Color", "url": "https://www.abc.com.py/politica/2025/06/23/hackean-ahora-datos-de-salud-publica-y-jem-admite-mitic/", "theme": "breach", "status": "admitted" }, { "date": "2026-06-26", "headline": "Ransomware locks electronic clinical records at several private hospitals", "paraphrase": "A reported ransomware attack on a private hospital group encrypted electronic clinical records and booking systems, forcing staff back to paper and delaying admissions, tests and appointments while attackers reportedly demanded payment.", "source": "El Nacional", "url": "https://elnacional.com.py/politica/ciberataque-paraliza-sistemas-importantes-sanatorios-privados-obliga-operar-forma-manual-n108107", "theme": "breach", "status": "alleged" } ] }, { "iso3": "COG", "name": "Republic of the Congo", "region": "Africa", "overall": 33, "rank": "142=", "likelyRank": "106 to 167", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Congo has a 2019 data law and a regulator installed in 2026, but records stay mostly on paper and patients cannot see them online.", "categories": { "access": { "score": 35, "summary": "Law 29-2019 lets a patient ask for their health data, directly or through a doctor they choose, and get a copy. The provider may charge the cost of copying, no deadline is set, and there is no patient portal, so 35.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Plan national de développement sanitaire du Congo 2023-2026, version officielle (Ministère de la Santé et de la Population)", "url": "https://sante.gouv.cg/wp-content/uploads/2024/09/PLAN-NATIONAL-DE-DEVELOPPEMENT-SANITAIRE-DU-CONGO-2023-2026_VERSION-OFFICIELLE.pdf", "date": "2024-09", "publisherClass": "official" } ] }, "control": { "score": 30, "summary": "Health data may be processed without consent for care under a health professional bound by secrecy, and there is no shared record, opt-out or access log. The patient's main tool is a right to object on legitimate grounds.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Plan national de développement sanitaire du Congo 2023-2026, version officielle (Ministère de la Santé et de la Population)", "url": "https://sante.gouv.cg/wp-content/uploads/2024/09/PLAN-NATIONAL-DE-DEVELOPPEMENT-SANITAIRE-DU-CONGO-2023-2026_VERSION-OFFICIELLE.pdf", "date": "2024-09", "publisherClass": "official" } ] }, "privacy": { "score": 48, "summary": "Law 29-2019 treats health data as sensitive, requires breach notice within 72 hours where possible and allows fines up to 100 million CFA francs. With no health-sector cases found and a regulator only installed in January 2026, this scores the general law.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Journal officiel n° 15-2025: Loi n° 5-2025 du 29 mars 2025 portant création de la CNPD (SGG)", "url": "https://www.sgg.cg/JO/2025/congo-jo-2025-15.pdf", "date": "2025-04-10", "publisherClass": "legal_text" }, { "title": "Congo-Brazzaville intros data protection commission (ITWeb Africa)", "url": "https://itweb.africa/article/congo-brazzaville-intros-data-protection-commission/nWJadvbNzxkvbjO1", "date": "2026-01-22", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "Most facilities still record care on paper and send compiled reports to districts for entry into DHIS2. The health plan counted 2 of 10 public general hospitals as digitalised, and the CAMU insurance scheme had about 27,000 members in May 2026.", "sources": [ { "title": "Plan national de développement sanitaire du Congo 2023-2026, version officielle (Ministère de la Santé et de la Population)", "url": "https://sante.gouv.cg/wp-content/uploads/2024/09/PLAN-NATIONAL-DE-DEVELOPPEMENT-SANITAIRE-DU-CONGO-2023-2026_VERSION-OFFICIELLE.pdf", "date": "2024-09", "publisherClass": "official" }, { "title": "Santé publique : le circuit logistique des médicaments au Congo va être digitalisé (Les Dépêches de Brazzaville)", "url": "https://www.adiac-congo.com/content/sante-publique-le-circuit-logistique-des-medicaments-au-congo-va-etre-digitalise-170892", "date": "2026-07-18", "publisherClass": "news" }, { "title": "La CAMU entend intégrer 480.000 assurés sociaux d'ici août 2026 (Agence congolaise d'information)", "url": "https://www.aci.cg/37256/", "date": "2026-05-30", "publisherClass": "news" }, { "title": "Revue des performances du secteur santé (OMS Bureau régional pour l'Afrique)", "url": "https://www.afro.who.int/fr/countries/congo/news/revue-des-performances-du-secteur-sante-vers-la-consolidation-de-loffre-et-de-lacces-aux-des-soins", "date": "2026-01-17", "publisherClass": "intergov" } ] }, "commercial": { "score": 45, "summary": "Direct marketing using personal data is banned without prior consent, and people must be told and offered a free refusal before their data goes to third parties for prospecting. We found no rules on health apps, data brokers or de-identified data, and no enforcement.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "The law lets clinicians process health data for care, but there is no shared record they can open across facilities. The national health plan treats an electronic medical record as a future goal, not a current tool.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Loi instituant un code de déontologie des professions de la santé et des affaires sociales, 1988 (SGG)", "url": "https://www.sgg.cg/textes-officiels/lois/1988/congo-loi-1988-09.pdf", "date": "1988", "publisherClass": "legal_text" }, { "title": "Plan national de développement sanitaire du Congo 2023-2026, version officielle (Ministère de la Santé et de la Population)", "url": "https://sante.gouv.cg/wp-content/uploads/2024/09/PLAN-NATIONAL-DE-DEVELOPPEMENT-SANITAIRE-DU-CONGO-2023-2026_VERSION-OFFICIELLE.pdf", "date": "2024-09", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Law 29-2019 allows health data to be used for scientific purposes without consent, but health research processing needs prior authorisation from the data commission and fines apply for misuse. There is no general opt-out and no research consent law was found, so 46.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Journal officiel n° 15-2025: Loi n° 5-2025 du 29 mars 2025 portant création de la CNPD (SGG)", "url": "https://www.sgg.cg/JO/2025/congo-jo-2025-15.pdf", "date": "2025-04-10", "publisherClass": "legal_text" }, { "title": "Comité d'Ethique de la Recherche en Sciences de la Santé (CERSSA), Health Research Web (COHRED)", "url": "https://healthresearchwebafrica.org.za/fr/congo/ethics_1126", "date": "undated", "publisherClass": "academic" }, { "title": "Réunion de coordination du comité d'éthique institutionnel de la FCRM, 8 au 10 août 2025 (FCRM)", "url": "https://www.fcrm-congo.com/actualites/reunion_de_coordination_du_comite_dethique_institutionnel_de_la_fcrm_du_08_au_10_aout_2025_afin_de_reviser_ses_procedures_et_son_fonctionnement", "date": "undated", "publisherClass": "academic" } ] }, "ai": { "score": 20, "summary": "We found no rules for AI in clinical care and no regulation of AI as a medical device. A national AI strategy is being drafted with UNDP support; its technical committee began work in May 2026.", "sources": [ { "title": "Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel (Journal officiel, NATLEX copy)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf", "date": "2019-11-07", "publisherClass": "legal_text" }, { "title": "Technologies : le Congo s'engage à encadrer l'utilisation de l'Intelligence artificielle (Les Dépêches de Brazzaville)", "url": "https://www.adiac-congo.com/content/technologies-le-congo-sengage-encadrer-lutilisation-de-lintelligence-artificielle-168634", "date": "2026-01-13", "publisherClass": "news" }, { "title": "Intelligence artificielle et langues nationales : le Congo lance les travaux de sa stratégie nationale (Les Dépêches de Brazzaville)", "url": "https://www.adiac-congo.com/content/intelligence-artificielle-et-langues-nationales-le-congo-lance-les-travaux-de-sa-strategie", "date": "2026-05-06", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law 29-2019 on personal data protection", "level": "National", "year": "2019", "what": "Health data is sensitive; patient access in person or via a doctor; 72-hour breach notice; fines to 100 million CFA.", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/110224/COG-110224.pdf" }, { "name": "Law 5-2025 creating the National Personal Data Protection Commission (CNPD)", "level": "National", "year": "2025", "what": "Creates an independent data authority with powers to inspect, authorise, sanction and keep a public register.", "url": "https://www.sgg.cg/JO/2025/congo-jo-2025-15.pdf" }, { "name": "Law 37-2014 on universal health insurance, amended by Law 12-2023", "level": "National", "year": "2023", "what": "Makes the universal health insurance scheme, run by CAMU, compulsory for insured workers and their dependants.", "url": "https://www.cleiss.fr/docs/regimes/regime_congo.html" }, { "name": "Code of ethics for health and social affairs professions", "level": "National", "year": "1988", "what": "Binds doctors, pharmacists, biologists and social workers to professional secrecy.", "url": "https://www.sgg.cg/textes-officiels/lois/1988/congo-loi-1988-09.pdf" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "SUR", "name": "Suriname", "region": "Americas", "overall": 33, "rank": "142=", "likelyRank": "109 to 169", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Since May 2025 the Civil Code gives Surinamese patients a right to a copy of their file, but no data protection law or regulator exists.", "categories": { "access": { "score": 40, "summary": "Article 7:456 of the Civil Code, in force since 1 May 2025, gives a right to inspect and copy the medical file, with no fixed deadline and a fee allowed for copies. The My Health app shows part of the record for patients of about 63 listed GPs.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Inwerkingtreding nieuw Burgerlijk Wetboek vindt voortgang op 1 mei 2025 (Kabinet van de President)", "url": "https://gov.sr/inwerkingtreding-nieuw-burgerlijk-wetboek-vindt-voortgang-op-1-mei-2025/", "date": "2025-04-30", "publisherClass": "official" }, { "title": "Lancering My Health-app: Surinaamse burgers krijgen digitale toegang tot eigen medische gegevens (Ministerie van Volksgezondheid)", "url": "https://gov.sr/lancering-my-health-app-surinaamse-burgers-krijgen-digitale-toegang-tot-eigen-medische-gegevens/", "date": "2025-05-21", "publisherClass": "official" }, { "title": "Patient Portal Locaties (IS4H Suriname, Ministerie van Volksgezondheid)", "url": "https://www.is4h-suriname.sr/patient_portal_locaties", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 35, "summary": "The Civil Code bars providers from sharing the file outside the treating team without consent, and patients can demand its destruction. With no opt-out from sharing and no patient access log, this sits at the top of the 20 to 35 band, like NRU and MCO.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Lancering My Health-app: Surinaamse burgers krijgen digitale toegang tot eigen medische gegevens (Ministerie van Volksgezondheid)", "url": "https://gov.sr/lancering-my-health-app-surinaamse-burgers-krijgen-digitale-toegang-tot-eigen-medische-gegevens/", "date": "2025-05-21", "publisherClass": "official" } ] }, "privacy": { "score": 30, "summary": "Suriname has no data protection law in force and no data protection authority, so this sits below the 45 to 66 general-law band. A bill with health data as a special category, 72-hour breach notice and a Commissioner is still pending before the National Assembly.", "sources": [ { "title": "Grondwet van de Republiek Suriname (1987, gewijzigd 1992)", "url": "https://verkiezingen.gov.sr/storage/pdf/Grondwet.pdf", "date": "1987", "publisherClass": "legal_text" }, { "title": "Ontwerpwet Bescherming Privacy en Persoonsgegevens (De Nationale Assemblee, in behandeling)", "url": "https://www.dna.sr/wetgeving/ontwerpwetten-bij-dna/in-behandeling/ontwerpwet-bescherming-privacy-en-persoonsgegevens/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Wet Bescherming Privacy en Persoonsgegevens, ontwerp (tekst)", "url": "https://www.dna.sr/media/2w5lbamt/wet_bescherming_privacy_en_persoonsgegevens.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" } ] }, "journey": { "score": 30, "summary": "Certified EHRs run at the state primary care service RGD and some private GPs, and Suriname passed HL7 FHIR tests for e-prescriptions in 2026. In November 2025 the health minister said little had been achieved in three years and ended the IS4H consultant's contract.", "sources": [ { "title": "Agenda for the Digital Transformation of the Health Sector in Suriname, Vision 2030 (Ministry of Health, via WHO)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/SUR_Suriname_Digital-Health-Strategy_2022.Pdf", "date": "2022", "publisherClass": "intergov" }, { "title": "IS4H, Information Systems for Health Suriname (Ministerie van Volksgezondheid)", "url": "https://www.is4h-suriname.sr/", "date": "undated", "publisherClass": "official" }, { "title": "Suriname schittert op internationaal podium: Ministerie van Volksgezondheid sleept drie Digital Health-prijzen in de wacht (gov.sr)", "url": "https://gov.sr/suriname-schittert-op-internationaal-podium-ministerie-van-volksgezondheid-sleept-drie-prestigieuze-digital-health-prijzen-in-de-wacht/", "date": "2026-08-03", "publisherClass": "official" }, { "title": "Misiekaba breekt met consultant IS4H-digitaliseringsproject (Suriname Herald)", "url": "https://www.srherald.com/suriname/2025/11/13/misiekaba-breekt-met-consultant-is4h-digitaliseringsproject/", "date": "2025-11-13", "publisherClass": "news" } ] }, "commercial": { "score": 30, "summary": "The only rule in force is the Civil Code's ban on providers releasing file contents without consent. No law covers health apps, data brokers, marketing or sales of de-identified data, and the pending privacy bill's marketing objection right is not law.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Wet Bescherming Privacy en Persoonsgegevens, ontwerp (tekst)", "url": "https://www.dna.sr/media/2w5lbamt/wet_bescherming_privacy_en_persoonsgegevens.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "Clinicians see one record only inside a single network, such as the RGD's EHR. No exchange that lets a hospital doctor open a GP or RGD record was found.", "sources": [ { "title": "Suriname schittert op internationaal podium: Ministerie van Volksgezondheid sleept drie Digital Health-prijzen in de wacht (gov.sr)", "url": "https://gov.sr/suriname-schittert-op-internationaal-podium-ministerie-van-volksgezondheid-sleept-drie-prestigieuze-digital-health-prijzen-in-de-wacht/", "date": "2026-08-03", "publisherClass": "official" }, { "title": "Agenda for the Digital Transformation of the Health Sector in Suriname, Vision 2030 (Ministry of Health, via WHO)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/SUR_Suriname_Digital-Health-Strategy_2022.Pdf", "date": "2022", "publisherClass": "intergov" }, { "title": "Misiekaba breekt met consultant IS4H-digitaliseringsproject (Suriname Herald)", "url": "https://www.srherald.com/suriname/2025/11/13/misiekaba-breekt-met-consultant-is4h-digitaliseringsproject/", "date": "2025-11-13", "publisherClass": "news" }, { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Article 7:458 lets providers release patient data for public health research without consent only when asking is impractical, and only if the patient has not objected. Counting that partial objection route and the Ministry's research ethics committee, this is 40 plus 3 plus 3.", "sources": [ { "title": "Burgerlijk Wetboek Boek 7 (S.B. 2024 no. 164), De Nationale Assemblee", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf", "date": "2024-12-05", "publisherClass": "legal_text" }, { "title": "Commissie mensgebonden Wetenschappelijk onderzoek geinstalleerd (STVS)", "url": "https://stvs.sr/nieuws/2020/05/commissie-mensgebonden-wetenschappelijk-onderzoek-geinstalleerd/", "date": "2020-05-18", "publisherClass": "news" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device route for clinical AI was found, and the Registration Commission assesses medicines only. Suriname began UNESCO's AI readiness assessment in August 2026, a diagnostic, not a rule.", "sources": [ { "title": "De RegistratieCommissie (Ministerie van Volksgezondheid)", "url": "https://gov.sr/ministeries/ministerie-van-volksgezondheid-welzijn-arbeid/de-registratie-commissie/", "date": "undated", "publisherClass": "official" }, { "title": "Suriname Advances Responsible AI Governance with UNESCO's RAM 2.0 (UNESCO)", "url": "https://www.unesco.org/en/articles/suriname-advances-responsible-ai-governance-unescos-ram-20", "date": "2026-09-02", "publisherClass": "intergov" }, { "title": "Wet Bescherming Privacy en Persoonsgegevens, ontwerp (tekst)", "url": "https://www.dna.sr/media/2w5lbamt/wet_bescherming_privacy_en_persoonsgegevens.pdf", "date": "undated", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Grondwet van de Republiek Suriname, artikel 17", "level": "National", "year": "1987", "what": "Right to respect for private life, family, home, honour and good name.", "url": "https://verkiezingen.gov.sr/storage/pdf/Grondwet.pdf" }, { "name": "Burgerlijk Wetboek Boek 7, afdeling geneeskundige behandeling (S.B. 2024 no. 164)", "level": "National", "year": "2024", "what": "In force 1 May 2025: patient file, copy right, destruction on request, consent before disclosure, research exception.", "url": "https://www.dna.sr/media/g1kjnrbj/s-b-_2024_no-_164__boek_7.pdf" }, { "name": "Ontwerpwet Bescherming Privacy en Persoonsgegevens (draft)", "level": "National", "year": "undated", "what": "Pending bill: health data special category, 72-hour breach notice, independent Commissioner, fines.", "url": "https://www.dna.sr/wetgeving/ontwerpwetten-bij-dna/in-behandeling/ontwerpwet-bescherming-privacy-en-persoonsgegevens/" } ], "dti": { "grade": 93, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "COM", "name": "Comoros", "region": "Africa", "overall": 32, "rank": "151=", "likelyRank": "113 to 172", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Comoros has had a data protection law since 2014, but no working regulator was found, and health records stay on paper or in separate systems.", "categories": { "access": { "score": 35, "summary": "Article 219 of the 2011 Public Health Code gives patients the right to the information in their file. The 2014 data law adds a copy, but for a fee, through a doctor for medical data, with no deadline and no portal, so 35.", "sources": [ { "title": "Loi N°11-001/AU portant Code de la Santé Publique (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf", "date": "2011-03-26", "publisherClass": "legal_text" }, { "title": "Loi du 26 juin 2014 portant protection des données à caractère personnel (Ministère de la Justice)", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf", "date": "2014-06-26", "publisherClass": "legal_text" }, { "title": "Les Comores renforcent leur écosystème numérique pour la vaccination, la surveillance épidémiologique et l'utilisation des données (HISP Rwanda)", "url": "https://hisprwanda.org/les-comores-renforcent-leur-ecosysteme-numerique-pour-la-vaccination-la-surveillance-epidemiologique-et-lutilisation-des-donnees/", "date": "2026-06-17", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "The 2014 law requires express consent for health data, but it exempts treatment and health research, and there is no opt-out from sharing and no access log for patients. National health data were hosted in Rwanda before a local server room opened in 2023.", "sources": [ { "title": "Loi du 26 juin 2014 portant protection des données à caractère personnel (Ministère de la Justice)", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf", "date": "2014-06-26", "publisherClass": "legal_text" }, { "title": "Des actions concrètes pour le projet VACCIN (La Gazette des Comores)", "url": "https://www.lagazettedescomores.com/sant%C3%A9/des-actions-concr%C3%A8tes-pour-le-projet-vaccin-.html", "date": "2025-12-29", "publisherClass": "news" } ] }, "privacy": { "score": 45, "summary": "Health data is a protected category, its processing needs the commission's prior approval, and offences carry 5 to 10 years in prison. With no breach notice duty and no working commission found (not verified), it sits at the floor of the general-law band, 45.", "sources": [ { "title": "Loi du 26 juin 2014 portant protection des données à caractère personnel (Ministère de la Justice)", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf", "date": "2014-06-26", "publisherClass": "legal_text" }, { "title": "Décret N°22-003/PR portant promulgation de la loi N°21-012/AU relative à la Cyber Sécurité et à la Lutte contre la Cybercriminalité (ANCS)", "url": "https://ancs.gouv.km/wp-content/uploads/2024/02/DEC-N%C2%B022-003-promul-loi-N%C2%B021-012-AU-relative-a-la-Cyber-Securite-et-a-la-Lutte-contre-la-CYbercrimunalite-en-Union-des-Comores.pdf", "date": "2022-01", "publisherClass": "legal_text" }, { "title": "Comores: loi de protection des données (Africa Data Protection)", "url": "https://www.africadataprotection.org/pays/comores.html", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Projet de Modernisation de l'Administration Publique Comorienne par le biais de l'E-Gouvernement, avis général de passation des marchés (Banque Islamique de Développement)", "url": "https://www.isdb.org/project-procurement/fr/appels-doffres/2026/gpn/projet-de-modernisation-de-ladministration-publique-comorienne-par-le-bais", "date": "2026-03-12", "publisherClass": "intergov" } ] }, "journey": { "score": 25, "summary": "DHIS2 collects national health statistics and the medicines supply system now links to it, but we found no hospital or clinic record system shared across facilities. The new national health insurance runs claims on openIMIS in a pilot covering 68 contracted facilities.", "sources": [ { "title": "Mission conjointe OMS-GAVI pour relancer le processus d'amélioration de la gestion des données du système d'information sanitaire aux Comores (WHO Africa)", "url": "https://www.afro.who.int/fr/countries/comoros/news/mission-conjointe-oms-gavi-pour-relancer-le-processus-damelioration-de-la-gestion-des-donnees-du", "date": "2019-04-30", "publisherClass": "intergov" }, { "title": "Comores : lancement de la phase pilote de l'Assurance maladie généralisée à Mohéli (AFD)", "url": "https://www.afd.fr/fr/actualites/comores-phase-pilote-assurance-maladie-generalisee", "date": "2025-12-18", "publisherClass": "official" }, { "title": "Des actions concrètes pour le projet VACCIN (La Gazette des Comores)", "url": "https://www.lagazettedescomores.com/sant%C3%A9/des-actions-concr%C3%A8tes-pour-le-projet-vaccin-.html", "date": "2025-12-29", "publisherClass": "news" }, { "title": "Assurance Maladie Généralisée : le numérique au service des hôpitaux comoriens (La Gazette des Comores)", "url": "https://lagazettedescomores.com/sant%C3%A9/assurance-maladie-g%C3%A9n%C3%A9ralis%C3%A9e-le-num%C3%A9rique-au-service-des-h%C3%B4pitaux-comoriens-.html", "date": "2025-09-02", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "People can refuse, free and without giving a reason, the use of their data for commercial marketing, and marketing messages must carry an unsubscribe link. No rules were found on selling health data, de-identified data or health apps.", "sources": [ { "title": "Loi du 26 juin 2014 portant protection des données à caractère personnel (Ministère de la Justice)", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf", "date": "2014-06-26", "publisherClass": "legal_text" }, { "title": "Décret N°22-003/PR portant promulgation de la loi N°21-012/AU relative à la Cyber Sécurité et à la Lutte contre la Cybercriminalité (ANCS)", "url": "https://ancs.gouv.km/wp-content/uploads/2024/02/DEC-N%C2%B022-003-promul-loi-N%C2%B021-012-AU-relative-a-la-Cyber-Securite-et-a-la-Lutte-contre-la-CYbercrimunalite-en-Union-des-Comores.pdf", "date": "2022-01", "publisherClass": "legal_text" }, { "title": "Loi N°11-001/AU portant Code de la Santé Publique (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf", "date": "2011-03-26", "publisherClass": "legal_text" } ] }, "clinical": { "score": 15, "summary": "A treating clinician sees only the file held where the patient is treated, and there is no shared record across providers. The only transfer rule we found sends tuberculosis and leprosy files to the new doctor through the health authorities.", "sources": [ { "title": "Loi N°11-001/AU portant Code de la Santé Publique (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf", "date": "2011-03-26", "publisherClass": "legal_text" }, { "title": "Assurance Maladie Généralisée : le numérique au service des hôpitaux comoriens (La Gazette des Comores)", "url": "https://lagazettedescomores.com/sant%C3%A9/assurance-maladie-g%C3%A9n%C3%A9ralis%C3%A9e-le-num%C3%A9rique-au-service-des-h%C3%B4pitaux-comoriens-.html", "date": "2025-09-02", "publisherClass": "news" } ] }, "research": { "score": 49, "summary": "Health research is exempt from the consent rule for sensitive data, and there is no general opt-out. A national ethics committee approved its first study in 2022 and the law sets criminal penalties for misuse, so the score sits just under the band cap of 50.", "sources": [ { "title": "Loi du 26 juin 2014 portant protection des données à caractère personnel (Ministère de la Justice)", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf", "date": "2014-06-26", "publisherClass": "legal_text" }, { "title": "Lutte contre la lèpre : le Comité national d'éthique donne avis favorable au protocole Be-People (Al-watwan)", "url": "https://alwatwan.net/societe/lutte-contre-la-l%C3%A8pre-i-le-comit%C3%A9-national-d%E2%80%99%C3%A9thique-donne-avis-favorable-au-protocole-be-people.html", "date": "2022-05-09", "publisherClass": "news" }, { "title": "Loi N°11-001/AU portant Code de la Santé Publique (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf", "date": "2011-03-26", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "Comoros has no rules for clinical AI and no national AI strategy. The Public Health Code counts software as a medical device, but manufacturers certify conformity themselves and nothing addresses AI.", "sources": [ { "title": "Loi N°11-001/AU portant Code de la Santé Publique (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf", "date": "2011-03-26", "publisherClass": "legal_text" }, { "title": "ANAMEV: à propos de l'agence", "url": "https://anamev.org/a-propos.php", "date": "undated", "publisherClass": "official" }, { "title": "Appel à manifestation d'intérêt: expert(e) national(e) Iles des Comores pour l'évaluation de l'état de préparation à l'IA (UNESCO)", "url": "https://www.unesco.org/fr/articles/appel-manifestation-dinteret-experte-nationale-iles-des-comores-pour-soutenir-la-mise-en-oeuvre-de", "date": "2025-10-09", "publisherClass": "intergov" }, { "title": "Intelligence artificielle : le diagnostic Ram 2.0 révèle les défis des Comores (Al-watwan)", "url": "https://alwatwan.net/societe/intelligence-artificielle-i-le-diagnostic-ram-2.0-r%C3%A9v%C3%A8le-les-d%C3%A9fis-des-comores.html", "date": "2026-10-02", "publisherClass": "news" } ] } }, "laws": [ { "name": "Loi N°14-029/AU portant protection des données à caractère personnel", "level": "National", "year": "2014", "what": "Health data needs express consent, with exceptions for treatment and research; creates a data commission; penalties up to 10 years.", "url": "https://justice.gouv.km/wp-content/uploads/2025/03/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-personnel.pdf" }, { "name": "Loi N°11-001/AU portant Code de la Santé Publique", "level": "National", "year": "2011", "what": "Patient right to the information in their file, medical secrecy, device rules covering software, trial safeguards.", "url": "https://faolex.fao.org/docs/pdf/com239753.pdf" }, { "name": "Loi N°21-012/AU relative à la Cyber Sécurité et à la Lutte contre la Cybercriminalité", "level": "National", "year": "2021", "what": "Cybersecurity law with offences for misuse of personal data and an unsubscribe rule for marketing messages.", "url": "https://ancs.gouv.km/wp-content/uploads/2024/02/DEC-N%C2%B022-003-promul-loi-N%C2%B021-012-AU-relative-a-la-Cyber-Securite-et-a-la-Lutte-contre-la-CYbercrimunalite-en-Union-des-Comores.pdf" }, { "name": "Décret 17-011/PR portant création de l'ANAMEV", "level": "National", "year": "2017", "what": "Creates the national agency for medicines, medical devices, clinical trial review and medical evacuations.", "url": "https://anamev.org/a-propos.php" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [] }, { "iso3": "GNQ", "name": "Equatorial Guinea", "region": "Africa", "overall": 32, "rank": "151=", "likelyRank": "113 to 173", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Equatorial Guinea passed a data law in 2016 but never set up its regulator, and patient records remain on paper in each facility.", "categories": { "access": { "score": 40, "summary": "Law 1/2016 gives a free right to a copy of your personal data, but sets no deadline for answering. There is no patient portal, and the regulator meant to hear complaints has not been set up, so 40.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" }, { "title": "Equatorial Guinea data protection factsheet (Data Protection Africa, ALT Advisory)", "url": "https://dataprotection.africa/equatorial-guinea/", "date": "2022-06-24", "publisherClass": "law_firm" } ] }, "control": { "score": 28, "summary": "Health data needs express written consent under Law 1/2016, but care, public health and transfers between state bodies are exempt. There is no shared record, no opt-out and no access log a patient can see.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data needs written consent and misuse is a very serious offence, but fines top out at 15 million CFA francs and no breach notice is required. With no health cases and no working regulator found, this scores the general law at its floor, 45.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" }, { "title": "Ley Núm. 7/2024 por la que se regula el uso de las redes sociales, delitos informáticos y ciberdelincuencia (texto publicado por el PDGE)", "url": "https://www.pdge-guineaecuatorial.com/ley-no-7-2024-por-la-que-se-regula-el-uso-de-las-redes-sociales-delitos-informaticos-y-ciberdelincuencia/", "date": "2024-12-23", "publisherClass": "legal_text" }, { "title": "Equatorial Guinea data protection factsheet (Data Protection Africa, ALT Advisory)", "url": "https://dataprotection.africa/equatorial-guinea/", "date": "2022-06-24", "publisherClass": "law_firm" }, { "title": "Equatorial Guinea: data protection law (Africa Data Protection)", "url": "https://www.africadataprotection.org/en/pays/guinee-equatoriale.html", "date": "undated", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 18, "summary": "Facilities record data on paper sheets that ministry staff copy into spreadsheets. A DHIS2 reporting pilot ran in two districts in June 2025, and the universal health insurance plan was 46.3% through its roadmap in February 2026.", "sources": [ { "title": "Un Sistema de Información Sanitaria para Guinea Ecuatorial (Fundación EHAS)", "url": "https://ehas.org/que-hacemos/sis/sis-guinea-ecuatorial/", "date": "undated", "publisherClass": "academic" }, { "title": "Finaliza con éxito la prueba piloto de la plataforma DHIS2 en Baney y Añisok (Guinea Salud)", "url": "https://guineasalud.com/finaliza-con-exito-la-prueba-piloto-de-la-plataforma-dhis2-en-baney-y-anisok/", "date": "2025-11-25", "publisherClass": "news" }, { "title": "El Comité Multisectorial del Seguro Médico Universal refuerza su hoja de ruta con el respaldo de la OMS (Oficina de Información y Prensa de Guinea Ecuatorial)", "url": "https://www.guineaecuatorialpress.com/noticias/el_comite_multisectorial_del_seguro_medico_universal_refuerza_su_hoja_de_ruta_con_el_respaldo_de_la_oms", "date": "2026-02-20", "publisherClass": "official" }, { "title": "El Gobierno impulsa cambios en INSESO para garantizar una atención sanitaria digna y universal (PDGE)", "url": "https://www.pdge-guineaecuatorial.com/el-gobierno-impulsa-cambios-en-inseso-para-garantizar-una-atencion-sanitaria-digna-y-universal/", "date": "2026-02-12", "publisherClass": "news" } ] }, "commercial": { "score": 40, "summary": "Marketing firms may use only public sources or data people agreed to give, and anyone can opt out of advertising for free within five days. Selling health data without consent can bring prison under Law 7/2024, but no enforcement was found.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" }, { "title": "Ley Núm. 7/2024 por la que se regula el uso de las redes sociales, delitos informáticos y ciberdelincuencia (texto publicado por el PDGE)", "url": "https://www.pdge-guineaecuatorial.com/ley-no-7-2024-por-la-que-se-regula-el-uso-de-las-redes-sociales-delitos-informaticos-y-ciberdelincuencia/", "date": "2024-12-23", "publisherClass": "legal_text" } ] }, "clinical": { "score": 15, "summary": "Law 1/2016 lets health professionals process data for care without consent, but there is no electronic record they can open across facilities. A clinician sees only the paper file held where the patient is treated.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" }, { "title": "Un Sistema de Información Sanitaria para Guinea Ecuatorial (Fundación EHAS)", "url": "https://ehas.org/que-hacemos/sis/sis-guinea-ecuatorial/", "date": "undated", "publisherClass": "academic" }, { "title": "La Comunidad de Madrid recibe a una delegación de Guinea Ecuatorial para compartir su modelo organizativo, sistemas de información y estrategia de cronicidad en Atención Primaria (Comunidad de Madrid)", "url": "https://www.comunidad.madrid/noticias/2026/03/26/comunidad-madrid-recibe-delegacion-guinea-ecuatorial-compartir-su-modelo-organizativo-sistemas-informacion-estrategia-cronicidad", "date": "2026-03-26", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "State bodies may share personal data for statistical and scientific purposes without consent, and there is no opt-out. A national ethics committee set up by decree in 2014, a statutory secrecy duty and penalties for misuse put this at 49.", "sources": [ { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" }, { "title": "Comienzan los trabajos del nuevo Comité Ético Nacional (Oficina de Información y Prensa de Guinea Ecuatorial)", "url": "https://www.guineaecuatorialpress.com/noticias/comienzan_los_trabajos_del_nuevo_comite_etico_nacional_", "date": "2014-10-29", "publisherClass": "official" }, { "title": "El Comité Ético Nacional recibe formación sobre legislación en bioética (Oficina de Información y Prensa de Guinea Ecuatorial)", "url": "https://www.guineaecuatorialpress.com/index.php/noticias/el_comite_etico_nacional_recibe_formacion_sobre_legislacion_en_bioetica", "date": "2019-10-24", "publisherClass": "official" } ] }, "ai": { "score": 18, "summary": "We found no rules for AI in clinical care. The 2003 medicines law defines medical products as physical materials such as gauze and syringes, with no mention of software, while the ministry runs a pilot AI health chatbot.", "sources": [ { "title": "Ley del Medicamento 3/2003 de 18 de noviembre (Compendio de leyes de Guinea Ecuatorial, FAOLEX)", "url": "https://faolex.fao.org/docs/pdf/eqg199517.pdf", "date": "2003-11-18", "publisherClass": "legal_text" }, { "title": "Sanidad lanza \"Guinea Salud\", primer asistente digital con IA en Guinea Ecuatorial (Guinea Salud)", "url": "https://guineasalud.com/sanidad-lanza-guinea-salud-primer-asistente-digital-con-ia-en-guinea-ecuatorial/", "date": "2025-06-06", "publisherClass": "news" }, { "title": "Ley Núm. 1/2016, de fecha 22 de julio, de Protección de Datos Personales (Ministerio de Función Pública)", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf", "date": "2016-07-22", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law 1/2016 on Personal Data Protection", "level": "National", "year": "2016", "what": "Health data needs written consent; free access to a copy; fines up to 15 million CFA francs.", "url": "https://minfuncionpublica.gob.gq/wp-content/uploads/LEY-numero-1-del-2016-PROTECCION-DE-DATOS-PERSONALES.pdf" }, { "name": "Law 7/2024 on social networks, computer crime and cybercrime", "level": "National", "year": "2024", "what": "Prison terms for wrongly obtaining or disclosing personal data, heavier for sensitive data such as health.", "url": "https://www.pdge-guineaecuatorial.com/ley-no-7-2024-por-la-que-se-regula-el-uso-de-las-redes-sociales-delitos-informaticos-y-ciberdelincuencia/" }, { "name": "Law 3/2003 on Medicines", "level": "National", "year": "2003", "what": "Regulates medicines, pharmacies and medical products; medical products defined as physical materials only.", "url": "https://faolex.fao.org/docs/pdf/eqg199517.pdf" }, { "name": "Decree 124/2014 creating the National Ethics Committee (CENGE)", "level": "National", "year": "2014", "what": "Sets up a national committee to review the ethics of research involving people.", "url": "https://www.guineaecuatorialpress.com/noticias/comienzan_los_trabajos_del_nuevo_comite_etico_nacional_" } ], "dti": { "grade": 77, "tier": "Silver", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2024-10-24", "headline": "Governor rebukes hospital staff after video of a patient during care spread online", "paraphrase": "Health workers reportedly filmed a patient during treatment and the video circulated on social media. A provincial governor told staff they must keep professional secrecy and asked managers to identify who made it.", "source": "Real Equatorial Guinea", "url": "https://realequatorialguinea.com/salud/indignacion-por-un-video-difundido-del-hospital-de-evinayong-donde-se-trata-a-un-paciente-herido/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "GTM", "name": "Guatemala", "region": "Americas", "overall": 32, "rank": "151=", "likelyRank": "112 to 171", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Guatemala has no general data law; patients can request what the state holds on them, but records stay split between MSPAS, IGSS and private clinics.", "categories": { "access": { "score": 40, "summary": "The Constitution and the 2008 access law let people get what state bodies, including IGSS, hold on them within 10 working days, paying only reproduction costs. Score is the 45 base minus 5 because private clinics are not covered, with no patient portal.", "sources": [ { "title": "Constitucion Politica de la Republica de Guatemala (OAS copy)", "url": "https://www.oas.org/dil/esp/Constitucion_Guatemala.pdf", "date": "1985", "publisherClass": "legal_text" }, { "title": "Decreto 57-2008, Ley de Acceso a la Informacion Publica (OAS copy)", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf", "date": "2008", "publisherClass": "legal_text" }, { "title": "Decreto 90-97, Codigo de Salud (MSPAS)", "url": "https://medicamentos.mspas.gob.gt/index.php/legislacion-vigente/decretos?download=292%3Acodigo-de-salud", "date": "1997", "publisherClass": "legal_text" }, { "title": "IGSS Afiliados, Google Play", "url": "https://play.google.com/store/apps/details?id=org.igssgt.AfiliadosProd.Android&hl=es_GT", "date": "2024-05-30", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "State bodies may pass personal data between themselves without consent, and no opt-out or patient-visible access log was found. IGSS logs every change to its electronic record, but gives the patient no way to see that log.", "sources": [ { "title": "Decreto 57-2008, Ley de Acceso a la Informacion Publica (OAS copy)", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf", "date": "2008", "publisherClass": "legal_text" }, { "title": "Acuerdo 03/2026 de Gerencia IGSS, reformas al Acuerdo 15/2018 (Expediente Medico Electronico)", "url": "https://www.igssgt.org/wp-content/uploads/2026/09/Acuerdo-03-2026-de-Gerencia-IGSS.pdf", "date": "2026-02-20", "publisherClass": "official" } ] }, "privacy": { "score": 30, "summary": "Health data is legally sensitive and only the person may see it, but Guatemala has no general data law, no dedicated data protection authority and no breach notification duty. A 2026 wave of attacks on state systems reached the National Health Laboratory.", "sources": [ { "title": "Decreto 57-2008, Ley de Acceso a la Informacion Publica (OAS copy)", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf", "date": "2008", "publisherClass": "legal_text" }, { "title": "Salud confirma ataque cibernetico en Laboratorio Nacional (La Hora)", "url": "https://lahora.gt/nacionales/kjordan/2026/04/14/salud-confirma-ataque-cibernetico-en-laboratorio-nacional-pero-asegura-que-fue-contenido-sin-que-datos-sensibles-fuera-robados/", "date": "2026-04-14", "publisherClass": "news" }, { "title": "Ministerio de Salud reacciona ante supuesta amenaza cibernetica en su base de datos (La Hora)", "url": "https://lahora.gt/nacionales/hloarca/2026/06/24/ministerio-de-alud-reacciona-ante-supuesta-amenaza-cibernetica-en-su-base-de-datos/", "date": "2026-06-24", "publisherClass": "news" }, { "title": "Comision de Asuntos de Seguridad analiza Iniciativa de Ley de Proteccion de Datos Personales (Emisoras Unidas)", "url": "https://emisorasunidas.com/nacional/2026/07/16/comision-de-asuntos-de-seguridad-analiza-iniciativa-de-ley-de-proteccion-de-datos-personales/", "date": "2026-07-16", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "IGSS has rolled out its electronic record unit by unit since 2018, and by February 2026 rollout was still incomplete. MSPAS said in 2024 it had no central patient register, only islands of information.", "sources": [ { "title": "Acuerdo 03/2026 de Gerencia IGSS, reformas al Acuerdo 15/2018 (Expediente Medico Electronico)", "url": "https://www.igssgt.org/wp-content/uploads/2026/09/Acuerdo-03-2026-de-Gerencia-IGSS.pdf", "date": "2026-02-20", "publisherClass": "official" }, { "title": "La Sala Anexa de San Benito, Peten, ahora es Consultorio, y ha modernizado su atencion (IGSS)", "url": "https://www.igssgt.org/noticias/2026/06/05/la-sala-anexa-de-san-benito-peten-ahora-es-consultorio-y-ha-modernizado-su-atencion/", "date": "2026-06-05", "publisherClass": "official" }, { "title": "Avanza implementacion de Registro Medico Electronico (IGSS)", "url": "https://www.igssgt.org/noticias/2023/02/04/avanza-implementacion-de-registro-medico-electronico/", "date": "2023-02-04", "publisherClass": "official" }, { "title": "Expediente clinico electronico, la nueva herramienta para la atencion medica de los guatemaltecos (AGN)", "url": "https://agn.gt/expediente-clinico-electronico-la-nueva-herramienta-para-la-atencion-medica-de-los-guatemaltecos/", "date": "2024-04-12", "publisherClass": "official" } ] }, "commercial": { "score": 35, "summary": "Selling sensitive data held by public bodies is banned, and selling protected personal data without written consent carries five to eight years in prison. Private clinics, apps and data brokers fall outside any data law.", "sources": [ { "title": "Decreto 57-2008, Ley de Acceso a la Informacion Publica (OAS copy)", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf", "date": "2008", "publisherClass": "legal_text" }, { "title": "Comision de Asuntos de Seguridad analiza Iniciativa de Ley de Proteccion de Datos Personales (Emisoras Unidas)", "url": "https://emisorasunidas.com/nacional/2026/07/16/comision-de-asuntos-de-seguridad-analiza-iniciativa-de-ley-de-proteccion-de-datos-personales/", "date": "2026-07-16", "publisherClass": "news" } ] }, "clinical": { "score": 28, "summary": "An IGSS clinician can see the electronic record inside IGSS units that have switched over. No route was found for MSPAS, IGSS and private clinicians to see each other's records.", "sources": [ { "title": "Avanza implementacion de Registro Medico Electronico (IGSS)", "url": "https://www.igssgt.org/noticias/2023/02/04/avanza-implementacion-de-registro-medico-electronico/", "date": "2023-02-04", "publisherClass": "official" }, { "title": "Expediente clinico electronico, la nueva herramienta para la atencion medica de los guatemaltecos (AGN)", "url": "https://agn.gt/expediente-clinico-electronico-la-nueva-herramienta-para-la-atencion-medica-de-los-guatemaltecos/", "date": "2024-04-12", "publisherClass": "official" }, { "title": "Acuerdo 03/2026 de Gerencia IGSS, reformas al Acuerdo 15/2018 (Expediente Medico Electronico)", "url": "https://www.igssgt.org/wp-content/uploads/2026/09/Acuerdo-03-2026-de-Gerencia-IGSS.pdf", "date": "2026-02-20", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Clinical trials need free, written informed consent and ethics committee approval under Acuerdo Ministerial 82-2019. Personal data can be used for science without consent only after it is made unlinkable, and there is no opt-out.", "sources": [ { "title": "Acuerdo Ministerial 82-2019, Normativa para la regulacion de ensayos clinicos en humanos (MSPAS)", "url": "https://medicamentos.mspas.gob.gt/phocadownload/Acuerdo%20Ministerial%2082-2019.pdf", "date": "2019-03-25", "publisherClass": "legal_text" }, { "title": "Decreto 57-2008, Ley de Acceso a la Informacion Publica (OAS copy)", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf", "date": "2008", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "Medical devices need MSPAS sanitary registration, but no rule for AI or software as a medical device was found. A national AI strategy was still being drafted with UNDP and EU funding in July 2026.", "sources": [ { "title": "Solicitud de Inscripcion Sanitaria de Dispositivos Medicos, DRCPFA (Catalogo de Tramites)", "url": "https://tramites.gob.gt/servicio/3362/", "date": "undated", "publisherClass": "official" }, { "title": "Avanza proceso de construccion de la Estrategia de Inteligencia Artificial del Organismo Ejecutivo (MINGOB)", "url": "https://mingob.gob.gt/avanza-proceso-de-construccion-de-la-estrategia-de-inteligencia-artificial-del-organismo-ejecutivo/", "date": "2026-07-03", "publisherClass": "official" }, { "title": "Que es la regulacion de IA en Guatemala (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-guatemala-es", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitucion Politica de la Republica, Articulo 31", "level": "National", "year": "1985", "what": "Right to know, correct and update what state archives and registers hold about you.", "url": "https://www.oas.org/dil/esp/Constitucion_Guatemala.pdf" }, { "name": "Decreto 57-2008, Ley de Acceso a la Informacion Publica", "level": "National", "year": "2008", "what": "Habeas data for public bodies; health data sensitive; ban and prison terms for selling personal data.", "url": "https://www.oas.org/juridico/pdfs/mesicic4_gtm_acceso.pdf" }, { "name": "Decreto 90-97, Codigo de Salud", "level": "National", "year": "1997", "what": "Right to privacy and professional secrecy in health; national health information system.", "url": "https://medicamentos.mspas.gob.gt/index.php/legislacion-vigente/decretos?download=292%3Acodigo-de-salud" }, { "name": "Acuerdo Ministerial 82-2019 (ensayos clinicos en humanos)", "level": "National", "year": "2019", "what": "Written informed consent and ethics committee approval for clinical trials.", "url": "https://medicamentos.mspas.gob.gt/phocadownload/Acuerdo%20Ministerial%2082-2019.pdf" }, { "name": "IGSS Acuerdo de Gerencia 15/2018, reformed by Acuerdo 03/2026", "level": "National", "year": "2026", "what": "Progressive IGSS electronic medical record; change log; becomes the only valid record per unit.", "url": "https://www.igssgt.org/wp-content/uploads/2026/09/Acuerdo-03-2026-de-Gerencia-IGSS.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-09-03", "headline": "Ransomware locked a national hospital's clinical planning records, delaying sessions for 194 patients", "paraphrase": "Attackers encrypted the system holding a national specialist hospital's clinical plans and images and demanded payment. The hospital's leadership said it refused to negotiate, reported the attack to prosecutors and police, and rescheduled 194 patients.", "source": "Infobae", "url": "https://www.infobae.com/guatemala/2026/09/04/ataque-cibernetico-golpea-al-instituto-contra-el-cancer-en-guatemala-194-pacientes-datos-clinicos-encriptados-y-un-enlace-en-la-deep-web-para-negociar/", "theme": "breach", "status": "admitted" }, { "date": "2026-04-13", "headline": "Health ministry confirms attack encrypted files at its national laboratory", "paraphrase": "The health ministry confirmed an attack that encrypted internal files at its national laboratory. It said backups restored the files and it found no evidence that patient data was accessed, but some processes and its web platform were interrupted.", "source": "Prensa Libre", "url": "https://www.prensalibre.com/guatemala/comunitario/ataque-informatico-afecta-al-laboratorio-nacional-de-salud-y-activa-protocolos-de-seguridad-breaking/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "NIC", "name": "Nicaragua", "region": "Americas", "overall": 32, "rank": "151=", "likelyRank": "116 to 174", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Nicaragua's public clinics are moving to a digital record, but patients get only summaries, cannot opt out, and the data regulator was never created.", "categories": { "access": { "score": 35, "summary": "Ley 787 gives a general right to see one's personal data within 10 working days, but the MINSA record norm allows copies only with the facility head's permission. Patients get a discharge summary (epicrisis) and, on written request, a clinical summary, with no national portal.", "sources": [ { "title": "Ley No. 423, Ley General de Salud, Articulos 8 y 9: Derechos y obligaciones del usuario (MINSA copy)", "url": "https://www.minsa.gob.ni/sites/default/files/2022-10/DERECHOS%20Y%20OBLIGACIONES%20DEL%20USUARIO%20EN%20SALUD.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Ley No. 787, Ley de Proteccion de Datos Personales (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf", "date": "2012-03-29", "publisherClass": "legal_text" }, { "title": "Normativa 004, Norma para el manejo del expediente clinico (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/Normativa%20-%20004%20%27Norma%20para%20el%20manejo%20del%20expediente%20cl%C3%ADnico%27.pdf", "date": "2008-05", "publisherClass": "official" }, { "title": "Normativa 004 Segunda Edicion, Norma y Manual para el manejo del expediente clinico, Acuerdo Ministerial 525-2013 (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/N%20-%20004%20Norma%20para%20el%20manejo%20de%20expediente%20cl%C3%ADnica%20y%20Manual%20para%20el%20manejo%20del%20Expediente%20Cl%C3%ADnico%20%28Segunda%20Edici%C3%B3n.pdf", "date": "2013-06", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "Patients have no way to opt out of the MINSA record or see who opened it, and the record norm names the police, prosecutors, courts and MINSA as authorities that may request records. Access inside MINSA systems is set by staff role.", "sources": [ { "title": "Normativa 004 Segunda Edicion, Norma y Manual para el manejo del expediente clinico, Acuerdo Ministerial 525-2013 (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/N%20-%20004%20Norma%20para%20el%20manejo%20de%20expediente%20cl%C3%ADnica%20y%20Manual%20para%20el%20manejo%20del%20Expediente%20Cl%C3%ADnico%20%28Segunda%20Edici%C3%B3n.pdf", "date": "2013-06", "publisherClass": "official" }, { "title": "Ministerio de Salud muestra los avances de la salud digital a los representantes de la cooperacion internacional (OPS/OMS)", "url": "https://www.paho.org/es/noticias/20-3-2024-ministerio-salud-muestra-avances-salud-digital-representantes-cooperacion", "date": "2024-03-20", "publisherClass": "intergov" }, { "title": "Ley No. 787, Ley de Proteccion de Datos Personales (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf", "date": "2012-03-29", "publisherClass": "legal_text" } ] }, "privacy": { "score": 25, "summary": "Ley 787 lists health data as sensitive, but the Data Protection Directorate it created has never been set up, and its sanctions include no fines. Police and army intelligence may process data without consent, and breach notice is required only for police and army data.", "sources": [ { "title": "Ley No. 787, Ley de Proteccion de Datos Personales (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf", "date": "2012-03-29", "publisherClass": "legal_text" }, { "title": "Data protection laws of the world: Nicaragua (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=authority&c=NI", "date": "2024-01-28", "publisherClass": "law_firm" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" }, { "title": "Ley No. 423, Ley General de Salud, Articulos 8 y 9: Derechos y obligaciones del usuario (MINSA copy)", "url": "https://www.minsa.gob.ni/sites/default/files/2022-10/DERECHOS%20Y%20OBLIGACIONES%20DEL%20USUARIO%20EN%20SALUD.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 34, "summary": "MINSA runs an electronic record and VITAL in primary care, plus a separate FLEMING platform in at least one hospital, but PAHO said in July 2026 that interoperability is still a goal. Coverage figures were not verified, so the score sits in the band's lower half.", "sources": [ { "title": "Salud digital y atencion primaria: avanzando hacia un sistema de salud mas conectado y eficiente (OPS/OMS)", "url": "https://www.paho.org/es/noticias/14-7-2026-salud-digital-atencion-primaria-avanzando-hacia-sistema-salud-mas-conectado", "date": "2026-07-14", "publisherClass": "intergov" }, { "title": "Ministerio de Salud muestra los avances de la salud digital a los representantes de la cooperacion internacional (OPS/OMS)", "url": "https://www.paho.org/es/noticias/20-3-2024-ministerio-salud-muestra-avances-salud-digital-representantes-cooperacion", "date": "2024-03-20", "publisherClass": "intergov" }, { "title": "La estrategia de Salud Digital en Nicaragua esta cambiando las atenciones medicas (MINSA)", "url": "http://www.minsa.gob.ni/centro-de-medios/noticias/la-estrategia-de-salud-digital-en-nicaragua-esta-cambiando-las-atenciones", "date": "2024-01-15", "publisherClass": "official" }, { "title": "Alerta en Nicaragua por reaparicion del Chikungunya (Infobae)", "url": "https://www.infobae.com/nicaragua/2026/05/29/alerta-en-nicaragua-por-reaparicion-del-chikungunya-minsa-reporta-12-casos-en-medio-de-vacios-epidemiologicos/", "date": "2026-05-29", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "On paper, Ley 787 requires prior consent to transfer personal data and lets people refuse electronic marketing. With no regulator in place, these rules are not enforced, and no rules on health apps or data brokers were found.", "sources": [ { "title": "Ley No. 787, Ley de Proteccion de Datos Personales (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf", "date": "2012-03-29", "publisherClass": "legal_text" }, { "title": "Data protection laws of the world: Nicaragua (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=authority&c=NI", "date": "2024-01-28", "publisherClass": "law_firm" } ] }, "clinical": { "score": 30, "summary": "Within MINSA, clinicians see record data by role through VITAL and the electronic record, and teleconsultation links health centres to hospitals. The record norm still sets one record per facility, and links between primary care and hospital platforms remain a goal.", "sources": [ { "title": "Normativa 004 Segunda Edicion, Norma y Manual para el manejo del expediente clinico, Acuerdo Ministerial 525-2013 (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/N%20-%20004%20Norma%20para%20el%20manejo%20de%20expediente%20cl%C3%ADnica%20y%20Manual%20para%20el%20manejo%20del%20Expediente%20Cl%C3%ADnico%20%28Segunda%20Edici%C3%B3n.pdf", "date": "2013-06", "publisherClass": "official" }, { "title": "Salud digital y atencion primaria: avanzando hacia un sistema de salud mas conectado y eficiente (OPS/OMS)", "url": "https://www.paho.org/es/noticias/14-7-2026-salud-digital-atencion-primaria-avanzando-hacia-sistema-salud-mas-conectado", "date": "2026-07-14", "publisherClass": "intergov" }, { "title": "Ministerio de Salud muestra los avances de la salud digital a los representantes de la cooperacion internacional (OPS/OMS)", "url": "https://www.paho.org/es/noticias/20-3-2024-ministerio-salud-muestra-avances-salud-digital-representantes-cooperacion", "date": "2024-03-20", "publisherClass": "intergov" }, { "title": "La estrategia de Salud Digital en Nicaragua esta cambiando las atenciones medicas (MINSA)", "url": "http://www.minsa.gob.ni/centro-de-medios/noticias/la-estrategia-de-salud-digital-en-nicaragua-esta-cambiando-las-atenciones", "date": "2024-01-15", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Trials need written consent and authorisation by the national health research committee CONIS under NTON 19001 (2022). Clinical records are kept for research with no individual consent or opt-out, so the score is base 40 plus two safeguards (ethics permits, statutory secrecy).", "sources": [ { "title": "NTON 19001, Medicamentos de uso humano. Ensayos clinicos. Requisitos para su autorizacion (La Gaceta 225, Leybook copy)", "url": "https://www.leybook.com/doc/30468", "date": "2022-11-30", "publisherClass": "legal_text" }, { "title": "Ley No. 423, Ley General de Salud, Articulos 8 y 9: Derechos y obligaciones del usuario (MINSA copy)", "url": "https://www.minsa.gob.ni/sites/default/files/2022-10/DERECHOS%20Y%20OBLIGACIONES%20DEL%20USUARIO%20EN%20SALUD.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Ley No. 787, Ley de Proteccion de Datos Personales (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf", "date": "2012-03-29", "publisherClass": "legal_text" }, { "title": "Normativa 004 Segunda Edicion, Norma y Manual para el manejo del expediente clinico, Acuerdo Ministerial 525-2013 (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/N%20-%20004%20Norma%20para%20el%20manejo%20de%20expediente%20cl%C3%ADnica%20y%20Manual%20para%20el%20manejo%20del%20Expediente%20Cl%C3%ADnico%20%28Segunda%20Edici%C3%B3n.pdf", "date": "2013-06", "publisherClass": "official" } ] }, "ai": { "score": 40, "summary": "NTON 24001:2023 counts software as a medical device, sets risk classes for diagnostic and treatment software, and requires a filing for software changes, but it never mentions AI. A national health AI roadmap was only being drafted in September 2026.", "sources": [ { "title": "NTON 24001:2023 Tecnologia de la salud. Dispositivos medicos. Requisitos para el Registro Sanitario (MINSA)", "url": "https://www.minsa.gob.ni/sites/default/files/publicaciones/NTON%2024001%20Tecnolog%C3%ADa%20de%20la%20salud.%20Dispositivos%20m%C3%A9dicos.%20Requisitos%20para%20el%20Registro%20Sanitario..pdf", "date": "2024-04-04", "publisherClass": "legal_text" }, { "title": "Nicaragua fortalece su preparacion para la adopcion responsable de la inteligencia artificial en salud (OPS/OMS)", "url": "https://www.paho.org/es/noticias/17-9-2026-nicaragua-fortalece-su-preparacion-para-adopcion-responsable-inteligencia", "date": "2026-09-17", "publisherClass": "intergov" }, { "title": "Nicaragua y la OPS definen prioridades para la incorporacion de IA en el sistema de salud del pais (Salud Digital)", "url": "https://saluddigital.com/noticias/nicaragua-y-la-ops-definen-prioridades-para-la-incorporacion-de-ia-en-el-sistema-de-salud-del-pais/", "date": "2026-09-18", "publisherClass": "news" } ] } }, "laws": [ { "name": "Ley No. 423, Ley General de Salud", "level": "National", "year": "2002", "what": "Patient rights to information, record confidentiality, written consent, and consent before any experimentation.", "url": "https://www.minsa.gob.ni/sites/default/files/2022-10/DERECHOS%20Y%20OBLIGACIONES%20DEL%20USUARIO%20EN%20SALUD.pdf" }, { "name": "Decreto 001-2003, Reglamento de la Ley General de Salud (texto consolidado)", "level": "National", "year": "2023", "what": "Facilities must keep the record confidential to authorised staff and hand over the discharge summary.", "url": "https://faolex.fao.org/docs/pdf/nic175683.pdf" }, { "name": "Ley No. 787, Ley de Proteccion de Datos Personales", "level": "National", "year": "2012", "what": "General data law; health data sensitive; access right; creates a Directorate that was never set up.", "url": "https://database.cyberpolicyportal.org/entity/trpx98tiuil?page=3&file=1658413503525lkgw2zj008.pdf" }, { "name": "Normativa 004, Norma y Manual para el manejo del expediente clinico (2a edicion)", "level": "National", "year": "2013", "what": "Copies only with facility head's permission; police, prosecutors and courts may request records.", "url": "https://www.minsa.gob.ni/sites/default/files/2023-02/N%20-%20004%20Norma%20para%20el%20manejo%20de%20expediente%20cl%C3%ADnica%20y%20Manual%20para%20el%20manejo%20del%20Expediente%20Cl%C3%ADnico%20%28Segunda%20Edici%C3%B3n.pdf" }, { "name": "NTON 19001, Ensayos clinicos de medicamentos de uso humano", "level": "National", "year": "2022", "what": "Trials need ethics and research committee approval, regulator review and CONIS authorisation.", "url": "https://www.leybook.com/doc/30468" }, { "name": "NTON 24001:2023, Dispositivos medicos. Requisitos para el Registro Sanitario", "level": "National", "year": "2024", "what": "Registers medical devices including software, with risk classes and filings for software changes.", "url": "https://www.minsa.gob.ni/sites/default/files/publicaciones/NTON%2024001%20Tecnolog%C3%ADa%20de%20la%20salud.%20Dispositivos%20m%C3%A9dicos.%20Requisitos%20para%20el%20Registro%20Sanitario..pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-06-04", "headline": "Authorities publicly disclosed a young doctor's mental health details, experts say", "paraphrase": "After a woman reported missing by her family was found, officials told a press conference about her mental health history and private life. Specialists interviewed say this breached confidentiality standards for mental health information.", "source": "Divergentes", "url": "https://www.divergentes.com/crisis-salud-mental-espectaculo-nicaragua/", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-04-22", "headline": "Patient told her hospital file could not be found and had to repeat tests", "paraphrase": "A woman interviewed under a first name says two appointments were cancelled for lack of doctors, then staff said they could not locate her file. She repeated her tests and waited about fourteen months for follow-up.", "source": "Divergentes", "url": "https://www.divergentes.com/nicaragua-menos-medicos-centroamerica-atencion-salud/", "theme": "access_delay_or_cost", "status": "alleged" }, { "date": "2026-01-20", "headline": "Photos of patients during medical exams appeared in official propaganda posts", "paraphrase": "The outlet reports that a public hospital published photos of patients undergoing scans, some partly undressed and recognisable, in political messaging. Lawyers and health workers say this breaks the health law's confidentiality rules; no explanation was given.", "source": "Darío Medios", "url": "https://dariomedios.com/minsa-expone-a-pacientes-en-propaganda-oficial-y-viola-la-ley-general-de-salud", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2025-08-01", "headline": "Insured patients moved after clinic seizure to doctors who lacked their histories", "paraphrase": "After authorities shut a private clinic network serving social security members, an inside source says surgeries were cancelled and patients were left with doctors who did not know their medical histories. Members were redirected elsewhere.", "source": "Darío Medios", "url": "https://dariomedios.com/regimen-sandinista-confisca-amocsa-y-traslada-asegurados-al-cuestionado-sistema-sermesa", "theme": "lost_between_providers", "status": "alleged" } ] }, { "iso3": "LCA", "name": "Saint Lucia", "region": "Americas", "overall": 32, "rank": "151=", "likelyRank": "114 to 173", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Saint Lucia's public clinics share one electronic record, but the patient's legal right to see it has not been switched on since 2011.", "categories": { "access": { "score": 25, "summary": "The Data Protection Act 2011 gives a right to a copy within 30 days for a fee, but that part of the Act has never been brought into force. There is no patient portal, so no enforceable right to the record exists.", "sources": [ { "title": "Data Protection Act, 2011 (No. 11 of 2011), Saint Lucia", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf", "date": "2011-04-06", "publisherClass": "legal_text" }, { "title": "Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4)", "url": "https://npc.govt.lc/laws/download/T1dVbFFjRVYzMVhYdC9lTHNlZ2RrN1lNSHp6NjRkSmtkVHZRZUFkcExaNWN5NkhRa2piUjJYZktJV0tFVkpvMmdkc2xsZEhiMDVkRHJHcFBWRXZjY2M0dThTbklrbDhnZ0k4aWhhc3lpWlJvVkQvTFQrTHRaYVc0cC9LZnZ1MFE=", "date": "2023-01-09", "publisherClass": "legal_text" }, { "title": "Data Protection Laws: St Lucia (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-slu", "date": "undated", "publisherClass": "academic" }, { "title": "Health Practitioners Act, 2006 (No. 33 of 2006), Saint Lucia", "url": "https://npc.govt.lc/laws/download/UjVlcXRvZTd3RG93ODVaQ0tsbWNwUzhEbTJSSmQ4WjJ6bityNGtvOStjUll4K01EdG0rNFVMaXBLbHIyeVAySjd6Qi8zNWxLL2JQMlphdVJMeGhOSlJ1cFJpc1dTRDF0V09vcEphV0pYbWNMTDduTUMydXdEUmFERTU3UE5Rd3Y=", "date": "2006-11-16", "publisherClass": "legal_text" } ] }, "control": { "score": 30, "summary": "Consent rules for sensitive data have applied since January 2023, but health workers may process health data for care and service management without consent. Records are shared across all public clinics with no opt-out and no patient-visible access log.", "sources": [ { "title": "Data Protection Act, 2011 (No. 11 of 2011), Saint Lucia", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf", "date": "2011-04-06", "publisherClass": "legal_text" }, { "title": "Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4)", "url": "https://npc.govt.lc/laws/download/T1dVbFFjRVYzMVhYdC9lTHNlZ2RrN1lNSHp6NjRkSmtkVHZRZUFkcExaNWN5NkhRa2piUjJYZktJV0tFVkpvMmdkc2xsZEhiMDVkRHJHcFBWRXZjY2M0dThTbklrbDhnZ0k4aWhhc3lpWlJvVkQvTFQrTHRaYVc0cC9LZnZ1MFE=", "date": "2023-01-09", "publisherClass": "legal_text" }, { "title": "From Paper to Platform: The Evolution of Digital Health in Saint Lucia (Caribbean Currents)", "url": "https://caribbeancurrents.org/digital-health-transformation-saint-lucia/", "date": "2026-06-11", "publisherClass": "news" } ] }, "privacy": { "score": 38, "summary": "Health is sensitive data and the security and use-limitation duties have applied since 2023. But the Commissioner's enforcement powers are not in force, the Act has no breach notification duty, and no health-sector enforcement was found.", "sources": [ { "title": "Data Protection Act, 2011 (No. 11 of 2011), Saint Lucia", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf", "date": "2011-04-06", "publisherClass": "legal_text" }, { "title": "Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4)", "url": "https://npc.govt.lc/laws/download/T1dVbFFjRVYzMVhYdC9lTHNlZ2RrN1lNSHp6NjRkSmtkVHZRZUFkcExaNWN5NkhRa2piUjJYZktJV0tFVkpvMmdkc2xsZEhiMDVkRHJHcFBWRXZjY2M0dThTbklrbDhnZ0k4aWhhc3lpWlJvVkQvTFQrTHRaYVc0cC9LZnZ1MFE=", "date": "2023-01-09", "publisherClass": "legal_text" }, { "title": "Data Protection Laws: St Lucia (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-slu", "date": "undated", "publisherClass": "academic" } ] }, "journey": { "score": 35, "summary": "One electronic record, SLUHIS, covers all public primary care, but hospitals run a separate system with only limited data exchange. The main public hospital's CEO said in July 2026 that too much work still depends on paper.", "sources": [ { "title": "White Paper on Saint Lucia Universal Health Coverage (Ministry of Health, via World Bank)", "url": "https://documents1.worldbank.org/curated/en/099080724165027120/pdf/P1766621debc940421a5621d7371e88f280.pdf", "date": "2024-07-22", "publisherClass": "official" }, { "title": "Ministry of Health, Wellness and Elderly Affairs embarks on new initiative to enhance data reporting (Government of Saint Lucia)", "url": "https://www.govt.lc/news/ministry-of-health-wellness-and-elderly-affairs-embarks-on-new-initiative-to-enhance-data-reporting2", "date": "2023-05-23", "publisherClass": "official" }, { "title": "From Paper to Platform: The Evolution of Digital Health in Saint Lucia (Caribbean Currents)", "url": "https://caribbeancurrents.org/digital-health-transformation-saint-lucia/", "date": "2026-06-11", "publisherClass": "news" }, { "title": "CEO Greaves acknowledges OKEU Hospital challenges, outlines plan to address concerns (St. Lucia Times)", "url": "https://stluciatimes.com/182458/2026/07/ceo-greaves-acknowledges-okeu-hospital-challenges-outlines-plan-to-address-concerns/", "date": "2026-07-29", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "Selling or marketing with health data would need explicit consent under rules in force since 2023. But the offence for selling unlawfully obtained data and the right to stop direct marketing are in parts of the Act not yet in force.", "sources": [ { "title": "Data Protection Act, 2011 (No. 11 of 2011), Saint Lucia", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf", "date": "2011-04-06", "publisherClass": "legal_text" }, { "title": "Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4)", "url": "https://npc.govt.lc/laws/download/T1dVbFFjRVYzMVhYdC9lTHNlZ2RrN1lNSHp6NjRkSmtkVHZRZUFkcExaNWN5NkhRa2piUjJYZktJV0tFVkpvMmdkc2xsZEhiMDVkRHJHcFBWRXZjY2M0dThTbklrbDhnZ0k4aWhhc3lpWlJvVkQvTFQrTHRaYVc0cC9LZnZ1MFE=", "date": "2023-01-09", "publisherClass": "legal_text" } ] }, "clinical": { "score": 32, "summary": "A clinician at any public wellness centre can open the patient's SLUHIS record over the government network. Hospital doctors work in a separate system with partial links, and much hospital work is still on paper.", "sources": [ { "title": "White Paper on Saint Lucia Universal Health Coverage (Ministry of Health, via World Bank)", "url": "https://documents1.worldbank.org/curated/en/099080724165027120/pdf/P1766621debc940421a5621d7371e88f280.pdf", "date": "2024-07-22", "publisherClass": "official" }, { "title": "From Paper to Platform: The Evolution of Digital Health in Saint Lucia (Caribbean Currents)", "url": "https://caribbeancurrents.org/digital-health-transformation-saint-lucia/", "date": "2026-06-11", "publisherClass": "news" }, { "title": "CEO Greaves acknowledges OKEU Hospital challenges, outlines plan to address concerns (St. Lucia Times)", "url": "https://stluciatimes.com/182458/2026/07/ceo-greaves-acknowledges-okeu-hospital-challenges-outlines-plan-to-address-concerns/", "date": "2026-07-29", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Health data can be used for research without consent under section 38, but only on approved security conditions, early removal of identifiers and a signed agreement. There is no opt-out, and the 2016 Clinical Trials Act's start date was not verified.", "sources": [ { "title": "Data Protection Act, 2011 (No. 11 of 2011), Saint Lucia", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf", "date": "2011-04-06", "publisherClass": "legal_text" }, { "title": "Clinical Trials Act, 2016 (No. 10 of 2016), Saint Lucia", "url": "https://npc.govt.lc/laws/download/UjVlcXRvZTd3RG93ODVaQ0tsbWNwWjZoSTdOaytDV2p3RlZWTDBsQ3psWnhJdU9tdHF2MmJOQmQ5aCt1ck5SKzk5TmJDTDB4NkdsVzYxTzRzV3lQdHlTRmh1L0NGWThmZnR3bC9oM2I5UVFhVURvWERTS0tLMlZ0MEFHTlRUYnk=", "date": "2016-04-19", "publisherClass": "legal_text" }, { "title": "New bill regulates medical research (Government of Saint Lucia)", "url": "https://www.govt.lc/news/new-bill-regulates-medical-research", "date": "2016-02-05", "publisherClass": "official" }, { "title": "The Ministry of Health Officially Launches Saint Lucia's National Cancer Registry (The Voice)", "url": "https://thevoiceslu.com/2026/08/the-ministry-of-health-officially-launches-saint-lucias-national-cancer-registry/", "date": "2026-08-09", "publisherClass": "news" } ] }, "ai": { "score": 20, "summary": "No law, strategy or device rule for clinical AI was found. The 2024 UHC White Paper lists only pharmacy laws for medical products and calls for policies on tools such as AI diagnostics.", "sources": [ { "title": "White Paper on Saint Lucia Universal Health Coverage (Ministry of Health, via World Bank)", "url": "https://documents1.worldbank.org/curated/en/099080724165027120/pdf/P1766621debc940421a5621d7371e88f280.pdf", "date": "2024-07-22", "publisherClass": "official" }, { "title": "AI Regulation in Saint Lucia (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-saint-lucia", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Data Protection Act, 2011 (No. 11 of 2011), Cap. 8.18", "level": "National", "year": "2011", "what": "Health is sensitive data; consent and security rules in force; access rights and enforcement not yet in force.", "url": "https://www.dataguidance.com/sites/default/files/act_11_of_2011.pdf" }, { "name": "Data Protection Act (Commencement) Order, 2023 (S.I. 2023 No. 4)", "level": "National", "year": "2023", "what": "From 31 January 2023, brings into force Part I, sections 32 to 43, Part VI and Schedule 2(a)-(g).", "url": "https://npc.govt.lc/laws/download/T1dVbFFjRVYzMVhYdC9lTHNlZ2RrN1lNSHp6NjRkSmtkVHZRZUFkcExaNWN5NkhRa2piUjJYZktJV0tFVkpvMmdkc2xsZEhiMDVkRHJHcFBWRXZjY2M0dThTbklrbDhnZ0k4aWhhc3lpWlJvVkQvTFQrTHRaYVc0cC9LZnZ1MFE=" }, { "name": "Health Practitioners Act, 2006 (No. 33 of 2006)", "level": "National", "year": "2006", "what": "Registers practitioners; requires patient records of history and treatment kept for seven years.", "url": "https://npc.govt.lc/laws/download/UjVlcXRvZTd3RG93ODVaQ0tsbWNwUzhEbTJSSmQ4WjJ6bityNGtvOStjUll4K01EdG0rNFVMaXBLbHIyeVAySjd6Qi8zNWxLL2JQMlphdVJMeGhOSlJ1cFJpc1dTRDF0V09vcEphV0pYbWNMTDduTUMydXdEUmFERTU3UE5Rd3Y=" }, { "name": "Clinical Trials Act, 2016 (No. 10 of 2016)", "level": "National", "year": "2016", "what": "Informed consent and an ethics committee for trials; starts by ministerial order, commencement not verified.", "url": "https://npc.govt.lc/laws/download/UjVlcXRvZTd3RG93ODVaQ0tsbWNwWjZoSTdOaytDV2p3RlZWTDBsQ3psWnhJdU9tdHF2MmJOQmQ5aCt1ck5SKzk5TmJDTDB4NkdsVzYxTzRzV3lQdHlTRmh1L0NGWThmZnR3bC9oM2I5UVFhVURvWERTS0tLMlZ0MEFHTlRUYnk=" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "STP", "name": "Sao Tome and Principe", "region": "Africa", "overall": 32, "rank": "151=", "likelyRank": "116 to 174", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Sao Tome and Principe has a 2016 data law and an elected regulator, but clinical records are still kept mostly on paper.", "categories": { "access": { "score": 35, "summary": "The 2016 data law gives a right to obtain your data in intelligible form without excessive delay or cost, but health data must be seen through a doctor you choose. There is no patient portal, and records are mostly on paper.", "sources": [ { "title": "Lei n.º 03/2016, Protecção de Dados Pessoais, Diário da República n.º 39 (DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf", "date": "2016-05-10", "publisherClass": "legal_text" }, { "title": "Lei n.º 09/2018, Lei Base de Saúde, Diário da República n.º 74 (Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/10/Dr-n.o-74_Lei-de-Base-da-Saude-Lei-n.o-9.2018.pdf", "date": "2018-06-06", "publisherClass": "legal_text" }, { "title": "Cuidados de Saúde Primários em São Tomé: Relato de Prática (Ordem dos Médicos, Tribuna)", "url": "https://ordemdosmedicos.pt/comunicacao/publicacoes/tribuna/cuidados-de-saude-primarios-em-sao-tome-relato-de-pratica-42951", "date": "undated", "publisherClass": "academic" } ] }, "control": { "score": 28, "summary": "Health data may be used for care without consent if a professional bound by secrecy handles it and the regulator is notified. There is no shared record, so patients have no sharing setting, opt-out or access log.", "sources": [ { "title": "Lei n.º 03/2016, Protecção de Dados Pessoais, Diário da República n.º 39 (DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf", "date": "2016-05-10", "publisherClass": "legal_text" } ] }, "privacy": { "score": 45, "summary": "Health data is a special category and the ANPDP is elected by two-thirds of parliament. With no health-sector cases found, this scores the general law, held at the band floor by no breach notice duty and no published enforcement.", "sources": [ { "title": "Lei n.º 03/2016, Protecção de Dados Pessoais, Diário da República n.º 39 (DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf", "date": "2016-05-10", "publisherClass": "legal_text" }, { "title": "Lei n.º 7/2017, Organização e Funcionamento da Agência Nacional de Protecção de Dados Pessoais, Diário da República n.º 40 (RIPD copy)", "url": "https://www.redipd.org/sites/default/files/2020-03/lei-7-2017-organizacao-e-funcionamento-da-ANPDP.pdf", "date": "2017-04-06", "publisherClass": "legal_text" }, { "title": "CNPD recebeu a Agência Nacional de Proteção de Dados Pessoais de São Tomé e Príncipe (CNPD Portugal)", "url": "https://www.cnpd.pt/comunicacao-publica/noticias/cnpd-recebeu-a-agencia-nacional-de-protecao-de-dados-pessoais-de-sao-tome-e-principe/", "date": "2025-06-23", "publisherClass": "official" } ] }, "journey": { "score": 22, "summary": "DHIS2 collects aggregate and some individual programme data, and mSupply tracks medicine stocks, but WHO describes fragmented systems and weak data. A medical record program was starting in 2022; whether it is in use now was not verified.", "sources": [ { "title": "Sistema de Informação da Saúde (Ministério da Saúde)", "url": "https://minsaude.st/sis/", "date": "undated", "publisherClass": "official" }, { "title": "Estratégia de Cooperação com o País 2023-2027, São Tomé e Príncipe (WHO, Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/08/Estrategia-de-cooperacao-com-o-pais-2023%E2%80%932027-Sao-Tome-and-Principe_compressed.pdf", "date": "undated", "publisherClass": "intergov" }, { "title": "Cuidados de Saúde Primários em São Tomé: Relato de Prática (Ordem dos Médicos, Tribuna)", "url": "https://ordemdosmedicos.pt/comunicacao/publicacoes/tribuna/cuidados-de-saude-primarios-em-sao-tome-relato-de-pratica-42951", "date": "undated", "publisherClass": "academic" }, { "title": "OMS São Tomé e Príncipe Boletim Informativo do 2º Trimestre, Abril a Junho 2026 (WHO AFRO)", "url": "https://www.afro.who.int/sites/default/files/2026-09/Newsletter%20OMS%20Q2%202026%20PT_0.pdf", "date": "2026-09", "publisherClass": "intergov" } ] }, "commercial": { "score": 43, "summary": "Using health data for business needs express consent under the sensitive-data ban, and people can refuse direct marketing free of charge. We found no rule on health apps, data brokers or de-identified data, and no enforcement.", "sources": [ { "title": "Lei n.º 03/2016, Protecção de Dados Pessoais, Diário da República n.º 39 (DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf", "date": "2016-05-10", "publisherClass": "legal_text" } ] }, "clinical": { "score": 17, "summary": "The 2018 Health Base Law calls for confidential flow of clinical information between levels of care, but records are mostly paper and no shared record was found. A clinician in another facility depends on paper notes or the patient.", "sources": [ { "title": "Lei n.º 09/2018, Lei Base de Saúde, Diário da República n.º 74 (Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/10/Dr-n.o-74_Lei-de-Base-da-Saude-Lei-n.o-9.2018.pdf", "date": "2018-06-06", "publisherClass": "legal_text" }, { "title": "Cuidados de Saúde Primários em São Tomé: Relato de Prática (Ordem dos Médicos, Tribuna)", "url": "https://ordemdosmedicos.pt/comunicacao/publicacoes/tribuna/cuidados-de-saude-primarios-em-sao-tome-relato-de-pratica-42951", "date": "undated", "publisherClass": "academic" } ] }, "research": { "score": 45, "summary": "The health ministry set up an ethics commission for research, and drug trials need the patient's consent by law. There is no research opt-out or public register of uses, and the commission's legal basis was not verified, so 45.", "sources": [ { "title": "Estratégia de Cooperação com o País 2023-2027, São Tomé e Príncipe (WHO, Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/08/Estrategia-de-cooperacao-com-o-pais-2023%E2%80%932027-Sao-Tome-and-Principe_compressed.pdf", "date": "undated", "publisherClass": "intergov" }, { "title": "Lei n.º 09/2018, Lei Base de Saúde, Diário da República n.º 74 (Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/10/Dr-n.o-74_Lei-de-Base-da-Saude-Lei-n.o-9.2018.pdf", "date": "2018-06-06", "publisherClass": "legal_text" }, { "title": "Lei n.º 03/2016, Protecção de Dados Pessoais, Diário da República n.º 39 (DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf", "date": "2016-05-10", "publisherClass": "legal_text" } ] }, "ai": { "score": 18, "summary": "No rule on AI in health care was found. The Health Base Law names a medicines authority covering devices but sets no software or AI rules, and AI work so far is a 2024 ethics readiness study and civil service training.", "sources": [ { "title": "Lei n.º 09/2018, Lei Base de Saúde, Diário da República n.º 74 (Ministério da Saúde copy)", "url": "https://minsaude.st/wp-content/uploads/2023/10/Dr-n.o-74_Lei-de-Base-da-Saude-Lei-n.o-9.2018.pdf", "date": "2018-06-06", "publisherClass": "legal_text" }, { "title": "Lançado o projeto-piloto sobre a Ética da inteligência Artificial em STP (Téla Nón)", "url": "https://www.telanon.info/sociedade/2024/01/29/43143/lancado-o-projeto-piloto-sobre-a-etica-da-inteligencia-artificial-em-stp/", "date": "2024-01-29", "publisherClass": "news" }, { "title": "PNUD inicia capacitação em Digitalização e Inteligência Artificial para a Administração Pública em STP (RSTP)", "url": "https://rstp.st/2026/04/22/pnud-inicia-capacitacao-em-digitalizacao-e-inteligencia-artificial-para-a-administracao-publica-em-stp/", "date": "2026-04-22", "publisherClass": "news" } ] } }, "laws": [ { "name": "Lei 03/2016, Protecção de Dados Pessoais", "level": "National", "year": "2016", "what": "Health data is sensitive; access copy via a chosen doctor for health data; ANPDP notification; fines and crimes.", "url": "https://www.dataguidance.com/sites/default/files/STP%20-%20Lei%20n.%C2%BA%2003_2016%20-%20Lei%20de%20Garantia%20e%20Protec%C3%A7%C3%A3o%20dos%20Dados%20Pessoais%20d....pdf" }, { "name": "Lei 07/2017, Organisation and Functioning of the ANPDP", "level": "National", "year": "2017", "what": "ANPDP is independent, with three members elected by two-thirds of deputies for five-year terms.", "url": "https://www.redipd.org/sites/default/files/2020-03/lei-7-2017-organizacao-e-funcionamento-da-ANPDP.pdf" }, { "name": "Lei 09/2018, Lei Base de Saúde", "level": "National", "year": "2018", "what": "Users' right to confidentiality and information; confidential flow of clinical information; consent for drug trials.", "url": "https://minsaude.st/wp-content/uploads/2023/10/Dr-n.o-74_Lei-de-Base-da-Saude-Lei-n.o-9.2018.pdf" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-11", "headline": "Evacuated patient says official file wrongly lists a state subsidy she never received", "paraphrase": "A patient sent abroad for treatment under the health agreement says her file wrongly shows a monthly state subsidy. Social security refused her claims on that basis, and she says the embassy would not explain the entry.", "source": "Rádio Somos Todos Primos (RSTP)", "url": "https://rstp.st/2026/07/11/doente-sao-tomense-em-portugal-denuncia-alegadas-irregularidades-da-embaixada-de-stp/", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "LKA", "name": "Sri Lanka", "region": "Asia", "overall": 32, "rank": "151=", "likelyRank": "116 to 174", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Sri Lanka has a data protection law and regulator, but core duties start in 2027 and the national health record is still a plan.", "categories": { "access": { "score": 30, "summary": "The Medical Council says patients may see and copy their records, but this rests on professional rules. The general data access right in the PDPA (Part II) is still not in force, and there is no national patient portal.", "sources": [ { "title": "Patient Rights (Sri Lanka Medical Council)", "url": "https://slmc.gov.lk/en/services/public/patient-rights", "date": "undated", "publisherClass": "official" }, { "title": "Legal experts flag unique compliance landscape in staggered PDPA rollout (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Legal-experts-flag-unique-compliance-landscape-in-staggered-PDPA-rollout/108-346685", "date": "2026-07-27", "publisherClass": "news" }, { "title": "Aspects of patient rights in a developing country: a qualitative study (BMC Medical Ethics)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12121050/", "date": "2025-05-28", "publisherClass": "academic" }, { "title": "President calls for internationally recognised healthcare standards (Ada Derana)", "url": "https://adaderana.lk/news/cmrd4n38j000k356p1ngjlibv", "date": "2026-07-09", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "Patients have no working consent controls or access log for shared records today. The 2023 Digital Health Blueprint plans consent, opt-out directives and audit trails, but the national record behind them is still only proposed.", "sources": [ { "title": "Sri Lanka Digital Health Blueprint (Ministry of Health)", "url": "https://www.health.gov.lk/wp-content/uploads/2023/11/Digital-Health-Blue-Print-Full-Book-01.11.2023-Final.pdf", "date": "2023-11-01", "publisherClass": "official" }, { "title": "President calls for internationally recognised healthcare standards (Ada Derana)", "url": "https://adaderana.lk/news/cmrd4n38j000k356p1ngjlibv", "date": "2026-07-09", "publisherClass": "news" }, { "title": "Personal Data Protection Act, No. 9 of 2022 (Parliament of Sri Lanka)", "url": "https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf", "date": "2022-03-19", "publisherClass": "legal_text" } ] }, "privacy": { "score": 35, "summary": "The PDPA treats health data as a special category and allows fines up to LKR 10 million. But its core duties start only on 1 January 2027, the penalty part is still deferred, and no health-sector enforcement was found.", "sources": [ { "title": "Personal Data Protection Act, No. 9 of 2022 (Parliament of Sri Lanka)", "url": "https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf", "date": "2022-03-19", "publisherClass": "legal_text" }, { "title": "Legal experts flag unique compliance landscape in staggered PDPA rollout (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Legal-experts-flag-unique-compliance-landscape-in-staggered-PDPA-rollout/108-346685", "date": "2026-07-27", "publisherClass": "news" }, { "title": "Data protection laws in Sri Lanka (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LK", "date": "undated", "publisherClass": "law_firm" }, { "title": "Data Protection Authority of Sri Lanka", "url": "https://www.dpa.gov.lk/", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 35, "summary": "HHIMS runs in 80 public hospitals with 9.5 million patients registered, and a cluster pilot links 31 facilities. There is no national record yet, and the 2023 Blueprint says private insurance data flows are not linked to the Ministry.", "sources": [ { "title": "Hospital Health Information Management System (HHIMS) (ICTA)", "url": "https://www.icta.lk/projects/digital-government/hospital-health-information-management-system-hhims", "date": "2025-09-30", "publisherClass": "official" }, { "title": "Sri Lanka Digital Health Blueprint (Ministry of Health)", "url": "https://www.health.gov.lk/wp-content/uploads/2023/11/Digital-Health-Blue-Print-Full-Book-01.11.2023-Final.pdf", "date": "2023-11-01", "publisherClass": "official" }, { "title": "Health Ministry to launch Cluster Health Information System tomorrow (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Health-Ministry-to-launch-Cluster-Health-Information-System-tomorrow/108-310651", "date": "2025-06-04", "publisherClass": "news" }, { "title": "Concerns raised over Rs. 3 billion HIQI digital health procurements (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Concerns-raised-over-Rs-3-billion-HIQI-digital-health-procurements/108-340259", "date": "2026-05-14", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "Once in force, the PDPA will require consent to process health data, and consent plus a free opt-out for marketing messages. Today those parts are not in force, and no health-specific ban on selling data was found.", "sources": [ { "title": "Personal Data Protection Act, No. 9 of 2022 (Parliament of Sri Lanka)", "url": "https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf", "date": "2022-03-19", "publisherClass": "legal_text" }, { "title": "Legal experts flag unique compliance landscape in staggered PDPA rollout (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Legal-experts-flag-unique-compliance-landscape-in-staggered-PDPA-rollout/108-346685", "date": "2026-07-27", "publisherClass": "news" }, { "title": "Data protection laws in Sri Lanka (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LK", "date": "undated", "publisherClass": "law_firm" } ] }, "clinical": { "score": 30, "summary": "Clinicians see records within their own hospital system, and inside one pilot cluster across 31 facilities. Outside that, there is no shared view across providers.", "sources": [ { "title": "Health Ministry to launch Cluster Health Information System tomorrow (Daily Mirror)", "url": "https://www.dailymirror.lk/breaking-news/Health-Ministry-to-launch-Cluster-Health-Information-System-tomorrow/108-310651", "date": "2025-06-04", "publisherClass": "news" }, { "title": "Sri Lanka Digital Health Blueprint (Ministry of Health)", "url": "https://www.health.gov.lk/wp-content/uploads/2023/11/Digital-Health-Blue-Print-Full-Book-01.11.2023-Final.pdf", "date": "2023-11-01", "publisherClass": "official" }, { "title": "Hospital Health Information Management System (HHIMS) (ICTA)", "url": "https://www.icta.lk/projects/digital-government/hospital-health-information-management-system-hhims", "date": "2025-09-30", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "Clinical trials need approval from an NMRA-recognised ethics committee. No general opt-out or consent register exists for reuse of records, and the PDPA research condition is not yet in force.", "sources": [ { "title": "Clinical trials (National Medicines Regulatory Authority)", "url": "https://www.nmra.gov.lk/pages/clinical-trials", "date": "undated", "publisherClass": "official" }, { "title": "Personal Data Protection Act, No. 9 of 2022 (Parliament of Sri Lanka)", "url": "https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf", "date": "2022-03-19", "publisherClass": "legal_text" }, { "title": "Sri Lanka Digital Health Blueprint (Ministry of Health)", "url": "https://www.health.gov.lk/wp-content/uploads/2023/11/Digital-Health-Blue-Print-Full-Book-01.11.2023-Final.pdf", "date": "2023-11-01", "publisherClass": "official" } ] }, "ai": { "score": 30, "summary": "The NMRA medical device definition covers software, but no rules for AI devices were found. The national AI strategy is still a draft, and there is no AI law.", "sources": [ { "title": "Medical devices (National Medicines Regulatory Authority)", "url": "https://www.nmra.gov.lk/pages/medical-devices", "date": "undated", "publisherClass": "official" }, { "title": "Artificial Intelligence (AI) governance is a concern Sri Lanka must address now (LIRNEasia)", "url": "https://lirneasia.net/2026/01/artificial-intelligence-ai-governance-is-a-concern-sri-lanka-must-address-now/", "date": "2026-01-02", "publisherClass": "academic" }, { "title": "Push for AI-integrated health records sparks debate (The Morning)", "url": "https://www.themorning.lk/articles/hRB94HjdAVDrWSLR337z", "date": "2026-03-08", "publisherClass": "news" } ] } }, "laws": [ { "name": "Personal Data Protection Act, No. 9 of 2022", "level": "National", "year": "2022", "what": "Health is a special category; sets rights, Authority and penalties. Core parts in force 1 January 2027.", "url": "https://www.parliament.lk/uploads/acts/gbills/english/6242.pdf" }, { "name": "Personal Data Protection (Amendment) Act, No. 22 of 2025", "level": "National", "year": "2025", "what": "Removed fixed start dates; minister sets operative dates by gazette.", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LK" }, { "name": "National Medicines Regulatory Authority Act, No. 5 of 2015", "level": "National", "year": "2015", "what": "Regulates medical devices including software, and clinical trials with recognised ethics committees.", "url": "https://www.nmra.gov.lk/pages/medical-devices" }, { "name": "Medical Ordinance (Cap. 105)", "level": "National", "year": "not verified", "what": "Basis cited by the Medical Council for patient record access and confidentiality.", "url": "https://slmc.gov.lk/en/services/public/patient-rights" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-08-13", "headline": "Nearly 400,000 records from a national health website offered for sale online", "paraphrase": "A seller on a breach forum offered about 398,000 records said to include patients' national ID numbers, phone numbers, addresses and medical appointment details. The report said no official statement had been issued.", "source": "ReadMe", "url": "https://readme.lk/ministry-of-health-hack-likely-compromised-nearly-400000-records/", "theme": "breach", "status": "alleged" }, { "date": "2024-11-29", "headline": "Doctor booking website let anyone look up patient details by name", "paraphrase": "A public search page on an appointment booking platform reportedly showed patients' names, national ID numbers, phone numbers and appointment history. It came down only after a public post, and users were not told.", "source": "ReadMe", "url": "https://readme.lk/mobitel-echannelling-website-had-a-data-leak-problem/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "TJK", "name": "Tajikistan", "region": "Asia", "overall": 32, "rank": "151=", "likelyRank": "113 to 171", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Tajik patients have a right to health information but no verified right to a copy; the national Tandurusti.tj platform was piloting in late 2025.", "categories": { "access": { "score": 40, "summary": "The 2018 data law gives access to one's own data, with replies due in 3 working days, but the Health Code lets doctors withhold harmful information. We found no explicit right to a copy and no patient portal: base 45, minus 5 for limited scope.", "sources": [ { "title": "Health Code of the Republic of Tajikistan No. 1413, Articles 39 and 48 (Ministry of Health and Social Protection)", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf", "date": "2017-05-30", "publisherClass": "legal_text" }, { "title": "Law No. 1537 on Personal Data Protection, Articles 8, 22 and 25 (Majlisi Milli legislation database)", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru", "date": "2018-08-03", "publisherClass": "legal_text" }, { "title": "Tajikistan: health system review 2025, Health Systems in Transition Vol. 27 No. 1 (European Observatory on Health Systems and Policies, WHO Europe)", "url": "https://www.ecoi.net/en/file/local/2127574/Tjk%20Healthsystemreview_9789289014540-eng.pdf", "date": "2025-05-14", "publisherClass": "intergov" }, { "title": "Tajikistan to launch a single digital platform for medical data (Sputnik Tajikistan)", "url": "https://tj.sputniknews.ru/20251123/tajikistan-edinaya-cifrovaya-platforma-1073168147.html", "date": "2025-11-23", "publisherClass": "news" } ] }, "control": { "score": 28, "summary": "Processing needs consent under the 2018 data law, but state bodies may process data without it while doing their legal functions. We found no opt-out from health record sharing, no patient-visible access log and no patient account on the national platform.", "sources": [ { "title": "Law No. 1537 on Personal Data Protection, Articles 8, 11, 12, 21 and 22 (Majlisi Milli legislation database)", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru", "date": "2018-08-03", "publisherClass": "legal_text" }, { "title": "Terms of reference: Immunization Information System Expansion in Tajikistan, describing the Tandurusti.tj platform (UNICEF Tajikistan)", "url": "https://www.unicef.org/tajikistan/media/9046/file", "date": "2025-11-13", "publisherClass": "intergov" } ] }, "privacy": { "score": 30, "summary": "Health data is not a special category in the 2018 data law, there is no breach notification duty, and the law sets no penalties of its own. Doctors must keep medical secrecy, but must report illness on an investigator's order or court ruling.", "sources": [ { "title": "Law No. 1537 on Personal Data Protection, Articles 5, 14, 17 and 25 (Majlisi Milli legislation database)", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru", "date": "2018-08-03", "publisherClass": "legal_text" }, { "title": "Health Code of the Republic of Tajikistan No. 1413, Articles 49 and 162 (Ministry of Health and Social Protection)", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf", "date": "2017-05-30", "publisherClass": "legal_text" }, { "title": "Problems and challenges in personal data protection in Tajikistan (CABAR.asia)", "url": "https://cabar.asia/ru/problemy-i-vyzovy-v-oblasti-zashhity-personalnyh-dannyh-v-tadzhikistane", "date": "2024-02-19", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "The Tandurusti.tj platform has a national patient index and modules for births, deaths, immunisation, labs and HIV, but it was still piloting in Dushanbe in late 2025. WHO's 2025 review says primary care data still reach districts on paper and hospital systems are fragmented.", "sources": [ { "title": "Terms of reference: Immunization Information System Expansion in Tajikistan, describing the Tandurusti.tj platform (UNICEF Tajikistan)", "url": "https://www.unicef.org/tajikistan/media/9046/file", "date": "2025-11-13", "publisherClass": "intergov" }, { "title": "Tajikistan to launch a single digital platform for medical data (Sputnik Tajikistan)", "url": "https://tj.sputniknews.ru/20251123/tajikistan-edinaya-cifrovaya-platforma-1073168147.html", "date": "2025-11-23", "publisherClass": "news" }, { "title": "Tajikistan: health system review 2025, Health Systems in Transition Vol. 27 No. 1 (European Observatory on Health Systems and Policies, WHO Europe)", "url": "https://www.ecoi.net/en/file/local/2127574/Tjk%20Healthsystemreview_9789289014540-eng.pdf", "date": "2025-05-14", "publisherClass": "intergov" }, { "title": "Dushanbe begins testing the eTib digital system for health facilities (Mir 24)", "url": "https://tj.mir24.tv/news/16680982/v-dushanbe-nachali-testirovat-cifrovuyu-sistemu-dlya-medicinskih-uchrezhdenij-etib", "date": "2026-08-10", "publisherClass": "news" } ] }, "commercial": { "score": 35, "summary": "The 2018 data law needs consent for using data beyond its original purpose, and the Health Code bars doctors from pharma gifts and advertising on prescriptions. We found no ban on selling health data and no rules for health apps.", "sources": [ { "title": "Law No. 1537 on Personal Data Protection, Articles 8 and 16 (Majlisi Milli legislation database)", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru", "date": "2018-08-03", "publisherClass": "legal_text" }, { "title": "Health Code of the Republic of Tajikistan No. 1413, Article 48 (Ministry of Health and Social Protection)", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf", "date": "2017-05-30", "publisherClass": "legal_text" }, { "title": "Law No. 2032 amending the Health Code (Spinform CIS legislation database)", "url": "https://base.spinform.ru/show_doc.fwx?rgn=156360", "date": "2024-01-03", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "No system lets a treating doctor see a patient's record across providers: hospitals and health centres run their own systems, according to WHO's 2025 review. The national patient index links records only within Tandurusti.tj modules, mostly public health registries.", "sources": [ { "title": "Tajikistan: health system review 2025, Health Systems in Transition Vol. 27 No. 1 (European Observatory on Health Systems and Policies, WHO Europe)", "url": "https://www.ecoi.net/en/file/local/2127574/Tjk%20Healthsystemreview_9789289014540-eng.pdf", "date": "2025-05-14", "publisherClass": "intergov" }, { "title": "Terms of reference: Immunization Information System Expansion in Tajikistan, describing the Tandurusti.tj platform (UNICEF Tajikistan)", "url": "https://www.unicef.org/tajikistan/media/9046/file", "date": "2025-11-13", "publisherClass": "intergov" }, { "title": "Health Code of the Republic of Tajikistan No. 1413, Article 49 (Ministry of Health and Social Protection)", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf", "date": "2017-05-30", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Clinical and biomedical trials need the person's written consent and ministry permission, and the person can stop at any stage. Data used for research must be de-identified, but no consent or opt-out applies to that secondary use.", "sources": [ { "title": "Health Code of the Republic of Tajikistan No. 1413, Articles 65 and 123 (Ministry of Health and Social Protection)", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf", "date": "2017-05-30", "publisherClass": "legal_text" }, { "title": "Law No. 1537 on Personal Data Protection, Articles 19 and 21 (Majlisi Milli legislation database)", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru", "date": "2018-08-03", "publisherClass": "legal_text" } ] }, "ai": { "score": 28, "summary": "The 2022 AI Strategy to 2040 names health as a target sector and calls for an AI law to be drafted, but we found no adopted AI law and no rules for clinical AI. Device law defines medical goods without mentioning software.", "sources": [ { "title": "Strategy for the Development of Artificial Intelligence to 2040, Government Decree No. 483 as amended by Decree No. 83 of 2025 (State Committee on Investment)", "url": "https://investcom.tj/uploads/post_docs/49/G06e7kwzNVad.pdf", "date": "2025-01-31", "publisherClass": "official" }, { "title": "Law No. 1893 on Medicines, Medical Goods and Pharmaceutical Activity (Spinform CIS legislation database)", "url": "https://base.spinform.ru/show_red.fwx?rid=157622", "date": "2022-07-19", "publisherClass": "legal_text" }, { "title": "Tajikistan launches Project Soro, AI Council under the Ministry of Industry and New Technologies (UNICEF Tajikistan)", "url": "https://www.unicef.org/tajikistan/press-releases/tajikistan-launches-project-soro", "date": "2025-10-27", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Health Code of the Republic of Tajikistan (No. 1413)", "level": "National", "year": "2017", "what": "Right to health information, medical secrecy and its exceptions, consent for trials and surgery.", "url": "https://moh.tj/wp-content/uploads/2024/10/KODEKS-ZDRAVOOHRANENIYA-RESPUBLIKI-TADZHIKISTAN.pdf" }, { "name": "Law No. 1537 on Personal Data Protection", "level": "National", "year": "2018", "what": "Consent-based processing, 3-day replies, data localisation, de-identification for research; no health category.", "url": "http://base.mmk.tj/view_sanadhoview.php?showdetail=&sanadID=609&language=ru" }, { "name": "Law No. 2032 amending the Health Code", "level": "National", "year": "2024", "what": "Bars health staff from recommending purchase of medicines from a specific pharmacy.", "url": "https://base.spinform.ru/show_doc.fwx?rgn=156360" }, { "name": "Law No. 1893 on Medicines, Medical Goods and Pharmaceutical Activity", "level": "National", "year": "2022", "what": "Registration and circulation of medicines and medical goods, including medical equipment.", "url": "https://base.spinform.ru/show_red.fwx?rid=157622" }, { "name": "Government Decree No. 483 on the AI Development Strategy to 2040", "level": "National", "year": "2022", "what": "National AI strategy naming health as a priority and calling for a future AI law.", "url": "https://investcom.tj/uploads/post_docs/49/G06e7kwzNVad.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "CMR", "name": "Cameroon", "region": "Africa", "overall": 31, "rank": "159=", "likelyRank": "118 to 175", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "A data law took full effect in June 2026, but no regulator had been set up by August 2026 and records stay inside each facility.", "categories": { "access": { "score": 30, "summary": "Law 2024/017 gives a right to a copy, but at the cost of reproduction, with deadlines left to a regulation and no regulator to enforce it. There is no patient portal, and the electronic record runs in about 50 pilot facilities.", "sources": [ { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" }, { "title": "Plan Stratégique National de Santé Numérique 2026-2030 (Ministère de la Santé Publique)", "url": "https://www.minsante.cm/site/sites/default/files/PSNSN%202026-2030%20Fr.pdf", "date": "2026-03", "publisherClass": "official" }, { "title": "RGPH-4 prolongé jusqu'au 15 septembre: sous quel régime les données collectées sont-elles protégées? (Observatoire de Cybersécurité du Cameroun)", "url": "https://obs-cc.org/rgph-4-prolongation-septembre-2026-protection-donnees-personnelles/", "date": "2026-08-12", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "The law requires prior, specific consent and lets people object, but a health-protection exception applies and patients have no tools to set sharing rules or see who opened their file.", "sources": [ { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" }, { "title": "RGPH-4 prolongé jusqu'au 15 septembre: sous quel régime les données collectées sont-elles protégées? (Observatoire de Cybersécurité du Cameroun)", "url": "https://obs-cc.org/rgph-4-prolongation-septembre-2026-protection-donnees-personnelles/", "date": "2026-08-12", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 40, "summary": "Health data is sensitive under Law 2024/017, with breach notice 'without delay', transfer authorisation and prison terms. But the law sends the creation of its regulator to a presidential decree that we could not find.", "sources": [ { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" }, { "title": "RGPH-4 prolongé jusqu'au 15 septembre: sous quel régime les données collectées sont-elles protégées? (Observatoire de Cybersécurité du Cameroun)", "url": "https://obs-cc.org/rgph-4-prolongation-septembre-2026-protection-donnees-personnelles/", "date": "2026-08-12", "publisherClass": "blog_vendor" }, { "title": "Plan Stratégique National de Santé Numérique 2026-2030 (Ministère de la Santé Publique)", "url": "https://www.minsante.cm/site/sites/default/files/PSNSN%202026-2030%20Fr.pdf", "date": "2026-03", "publisherClass": "official" }, { "title": "Data protection adequacy for non-EU countries (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 25, "summary": "Records are mostly local. The health ministry says the electronic record runs in about fifty pilot facilities, there are no national interoperability standards, and only regional hospitals have been linked up.", "sources": [ { "title": "Plan Stratégique National de Santé Numérique 2026-2030 (Ministère de la Santé Publique)", "url": "https://www.minsante.cm/site/sites/default/files/PSNSN%202026-2030%20Fr.pdf", "date": "2026-03", "publisherClass": "official" }, { "title": "Santé numérique: le Cameroun avance vers la Couverture Santé Universelle grâce à la digitalisation (MINSANTE)", "url": "https://minsante.cm/site/?q=fr/content/sant%C3%A9-num%C3%A9rique-le-cameroun-avance-vers-la-couverture-sant%C3%A9-universelle-gr%C3%A2ce-%C3%A0-la", "date": "2025-08-21", "publisherClass": "official" }, { "title": "Cameroun: Le projet du carnet électronique du patient en couveuse (Digital Business Africa)", "url": "https://www.digitalbusiness.africa/cameroun-le-projet-du-carnet-electronique-du-patient-en-couveuse/", "date": "2026-02-23", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "Direct marketing needs prior consent and doctors may not advertise. The rules are strong on paper but have no regulator behind them, and we found nothing on health apps, data brokers or de-identified data.", "sources": [ { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" }, { "title": "Décret n° 83-166 du 12 avril 1983 portant code de déontologie des médecins (Camerlex copy)", "url": "https://www.camerlex.com/cameroun-decret-n-83-166-12-avril-1983/", "date": "1983-04-12", "publisherClass": "legal_text" }, { "title": "La loi sur la protection des données personnelles entre officiellement en vigueur (Direction Générale du Budget, MINFI)", "url": "https://www.dgb.cm/la-loi-sur-la-protection-des-donnees-personnelles-entre-officiellement-en-vigueur/", "date": "2026-07-06", "publisherClass": "official" } ] }, "clinical": { "score": 22, "summary": "A clinician usually sees only their own facility's file. In February 2026 the health minister described networking all facilities, so a referred patient need carry nothing, as work still in progress.", "sources": [ { "title": "Plan Stratégique National de Santé Numérique 2026-2030 (Ministère de la Santé Publique)", "url": "https://www.minsante.cm/site/sites/default/files/PSNSN%202026-2030%20Fr.pdf", "date": "2026-03", "publisherClass": "official" }, { "title": "Cameroun: Le projet du carnet électronique du patient en couveuse (Digital Business Africa)", "url": "https://www.digitalbusiness.africa/cameroun-le-projet-du-carnet-electronique-du-patient-en-couveuse/", "date": "2026-02-23", "publisherClass": "news" }, { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" } ] }, "research": { "score": 50, "summary": "Law 2022/008 requires free, informed, written consent to reuse health data for research, with ethics clearance. That protects choice, but we found no public register or research data infrastructure, so it stays below the opt-in band.", "sources": [ { "title": "Loi n° 2022/008 du 27 avril 2022 relative à la recherche médicale impliquant la personne humaine au Cameroun (Présidence de la République)", "url": "https://www.prc.cm/files/74/f7/b0/73110e67ad0c98efb6a87820a936ffa8.pdf", "date": "2022-04-27", "publisherClass": "legal_text" }, { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "There are no binding rules for clinical AI. The government held AI consultations and reportedly adopted a strategy in 2025, but the medicines agency is still being set up.", "sources": [ { "title": "CONIA: concertations nationales sur l'intelligence artificielle (MINPOSTEL)", "url": "https://www.minpostel.gov.cm/index.php/fr/actualites/485-conia", "date": "2024-06", "publisherClass": "official" }, { "title": "Régulation pharmaceutique: l'Agence Camerounaise du Médicament (ACM) en gestation (MINSANTE)", "url": "https://minsante.cm/site/?q=fr/content/r%C3%A9gulation-pharmaceutique-lagence-camerounaise-de-m%C3%A9dicaments-acm-en-gestation", "date": "2025-03-13", "publisherClass": "official" }, { "title": "Intelligence artificielle au Cameroun: état des lieux et suivi (Observatoire de Cybersécurité du Cameroun)", "url": "https://obs-cc.org/intelligence-artificielle-au-cameroun/", "date": "2026-08-13", "publisherClass": "blog_vendor" }, { "title": "Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun (Présidence de la République)", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf", "date": "2024-12-23", "publisherClass": "legal_text" } ] } }, "laws": [ { "name": "Law No. 2024/017 on personal data protection", "level": "National", "year": "2024", "what": "Consent, access and objection rights, health as sensitive data, breach notice, transfer authorisation, regulator by future decree.", "url": "https://prc.cm/files/2b/9f/21/1055fa3c2251b4c4248fd301f584daaf.pdf" }, { "name": "Law No. 2022/008 on medical research involving humans", "level": "National", "year": "2022", "what": "Written informed consent for research and reuse of health data, ethics clearance, conditions on export.", "url": "https://www.prc.cm/files/74/f7/b0/73110e67ad0c98efb6a87820a936ffa8.pdf" }, { "name": "Law No. 2010/012 on cybersecurity and cybercrime", "level": "National", "year": "2010", "what": "Security framework for networks and information systems; defines ICT offences; protects privacy.", "url": "https://ictpolicyafrica.org/fr/document/2xyan42talo" }, { "name": "Decree No. 83/166 on the code of medical ethics", "level": "National", "year": "1983", "what": "Professional secrecy for doctors unless law says otherwise; bans medical advertising.", "url": "https://www.camerlex.com/cameroun-decret-n-83-166-12-avril-1983/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-05", "headline": "Fire at a public hospital destroyed its medical records unit", "paraphrase": "A June 2026 fire at a public hospital in the North-West Region destroyed its medical records unit, along with its drug store and computer equipment, while the health ministry planned reconstruction.", "source": "Cameroon News Agency", "url": "https://cameroonnewsagency.com/government-begins-reconstruction-process-for-fire-damaged-bamenda-regional-hospital/", "theme": "other", "status": "alleged" } ] }, { "iso3": "NPL", "name": "Nepal", "region": "Asia", "overall": 31, "rank": "159=", "likelyRank": "119 to 176", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Nepal makes consent the rule for health data, but patients cannot get a copy of their full record and each hospital keeps its own files.", "categories": { "access": { "score": 28, "summary": "We found no Nepali law that gives patients a right to a copy of their whole medical record. The Constitution and the Public Health Service Act give a right to be told about one's condition, and admitted patients get a discharge summary.", "sources": [ { "title": "Nepal's Constitution of 2015 (rev. 2016), English text (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Nepal_2016.pdf", "date": "2015", "publisherClass": "legal_text" }, { "title": "The Public Health Service Act, 2075 (2018), Nepal Law Commission English translation", "url": "https://bwcimplementation.org/sites/default/files/resource/NP_Public-Health-Service-Act-2075_EN.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "Govt hospitals now go digital with online appointments, reports and payments (Republica)", "url": "https://www.myrepublica.nagariknetwork.com/news/govt-hospitals-now-go-digital-with-online-appointments-reports-and-payments-86-79.html", "date": "2026-04-11", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "The Privacy Act requires consent before anyone shares health examination details, but treatment, criminal investigations and national security are exempt. Patients have no opt-out tool and no way to see who opened their record.", "sources": [ { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "The Public Health Service Act, 2075 (2018), Nepal Law Commission English translation", "url": "https://bwcimplementation.org/sites/default/files/resource/NP_Public-Health-Service-Act-2075_EN.pdf", "date": "2018-09-18", "publisherClass": "legal_text" } ] }, "privacy": { "score": 35, "summary": "Health data is sensitive under the Privacy Act and confidential under the Public Health Service Act, but there is no data protection regulator. For most offences the victim files with a District Court within three months, and the maximum penalty is 3 years or NPR 30,000.", "sources": [ { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "The Public Health Service Act, 2075 (2018), Nepal Law Commission English translation", "url": "https://bwcimplementation.org/sites/default/files/resource/NP_Public-Health-Service-Act-2075_EN.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "Weak data protection exposes Nepal to growing cybersecurity risks (Onlinekhabar English)", "url": "https://english.onlinekhabar.com/weak-data-protection-exposes-nepal-to-growing-cybersecurity-risks.html", "date": "2026-08-07", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "A 2081 (2024) directive requires every facility to register its electronic record system and make it interoperable, but the Ministry says no national count of EMR use exists. Insurance claims are the main data flow that runs nationally.", "sources": [ { "title": "Progress of Health and Population Sector 2024/25 (2081/82): National Joint Annual Review Report (Ministry of Health and Population)", "url": "https://giwmscdnone.gov.np/media/pdf_upload/NJAR_Report_2024_25%20(2081_82)_ag6xlgz.pdf", "date": "2025-11-26", "publisherClass": "official" }, { "title": "Nepal's healthcare has a memory problem (Onlinekhabar English)", "url": "https://english.onlinekhabar.com/nepals-healthcare-memory-problem.html", "date": "2026-07-29", "publisherClass": "news" } ] }, "commercial": { "score": 38, "summary": "Sharing health examination details without consent is a crime under the Privacy Act, and misleading health advertising is banned. No rules on data brokers, health apps or sale of de-identified data were found.", "sources": [ { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "The Public Health Service Act, 2075 (2018), Nepal Law Commission English translation", "url": "https://bwcimplementation.org/sites/default/files/resource/NP_Public-Health-Service-Act-2075_EN.pdf", "date": "2018-09-18", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "A doctor in Nepal usually sees only their own hospital's records plus whatever paper the patient brings. No cross-provider record viewer was found, and the planned Digital Health Blueprint was still in development in late 2025.", "sources": [ { "title": "Progress of Health and Population Sector 2024/25 (2081/82): National Joint Annual Review Report (Ministry of Health and Population)", "url": "https://giwmscdnone.gov.np/media/pdf_upload/NJAR_Report_2024_25%20(2081_82)_ag6xlgz.pdf", "date": "2025-11-26", "publisherClass": "official" }, { "title": "Nepal's healthcare has a memory problem (Onlinekhabar English)", "url": "https://english.onlinekhabar.com/nepals-healthcare-memory-problem.html", "date": "2026-07-29", "publisherClass": "news" }, { "title": "The digital pulse and the structural fracture: 100 days of Balen government in health sector (Onlinekhabar English)", "url": "https://english.onlinekhabar.com/the-digital-pulse-and-the-structural-fracture-100-days-of-balen-government.html", "date": "2026-07-06", "publisherClass": "news" }, { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" } ] }, "research": { "score": 50, "summary": "The Privacy Act requires informed consent to collect data for research, misuse is a crime, and the statutory Nepal Health Research Council must approve health research. There is no opt-out register or public list of secondary uses.", "sources": [ { "title": "The Privacy Act, 2075 (2018), English translation (MoHP Integrated Health Information Management Section)", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf", "date": "2018-09-18", "publisherClass": "legal_text" }, { "title": "Ethical Approval in Nepal: Barriers or Facilitators? (J Nepal Health Res Counc 22(64))", "url": "https://jnhrc.com.np/index.php/jnhrc/article/view/4410/4703", "date": "2024", "publisherClass": "academic" } ] }, "ai": { "score": 25, "summary": "Nepal's National AI Policy, 2025 names diagnostic imaging and disease detection as goals and plans an AI Regulation Council. No binding rules for clinical AI or AI as a medical device were verified.", "sources": [ { "title": "National Artificial Intelligence (A.I.) Policy, 2025 (Government of Nepal)", "url": "https://giwmscdnone.gov.np/media/pdf_upload/National%20AI%20Policy-Final_uxc94vg.pdf", "date": "2025", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitution of Nepal 2015, Articles 28 and 35", "level": "National", "year": "2015", "what": "Right to privacy of records and data; right to be informed about one's health condition.", "url": "https://www.constituteproject.org/constitution/Nepal_2016.pdf" }, { "name": "The Privacy Act, 2075 (2018)", "level": "National", "year": "2018", "what": "Consent to share health details; health is sensitive data; up to 3 years or NPR 30,000.", "url": "https://hmis.gov.np/media/22/03_The-Privacy-Act-2075-2018.pdf" }, { "name": "The Public Health Service Act, 2075 (2018)", "level": "National", "year": "2018", "what": "Informed consent, confidentiality, discharge summaries and record keeping by health institutions.", "url": "https://bwcimplementation.org/sites/default/files/resource/NP_Public-Health-Service-Act-2075_EN.pdf" }, { "name": "Public Health Service Regulation, 2077 (2020)", "level": "National", "year": "2020", "what": "Sets discharge summary format and requires facilities to keep separate patient records.", "url": "https://extranet.who.int/ncdccs/Data/NPL_B3_S23_Public%20Health%20Service%20Regulation%202020%20-ENG%20Unofc%20translation-%20clean.pdf" }, { "name": "Integrated EMR System Operation and Management Directives, 2081", "level": "National", "year": "2024", "what": "All facilities must register EMR systems within 12 months; sets rules on data networking, security and privacy.", "url": "https://giwmscdnone.gov.np/media/pdf_upload/NJAR_Report_2024_25%20(2081_82)_ag6xlgz.pdf" }, { "name": "National Artificial Intelligence (A.I.) Policy, 2025", "level": "National", "year": "2025", "what": "Plans an AI Regulation Council and a data security law; names health AI uses.", "url": "https://giwmscdnone.gov.np/media/pdf_upload/National%20AI%20Policy-Final_uxc94vg.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-01", "headline": "Insurance claims filed in a patient's name for care that never took place", "paraphrase": "A newspaper reports that a hospital submitted a claim with false bills for care it never gave an insured patient, and repeat claims for one patient, before the Health Insurance Board spotted and rejected them.", "source": "Naya Patrika", "url": "https://www.nayapatrikadaily.com/news-details/198797/2026-07-01", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-03-23", "headline": "Hospital operators charged with faking visitors' medical records in insurance scheme", "paraphrase": "Prosecutors charged 32 people, including hospital operators and doctors, accused of fabricating records and issuing separate bills for patients on one flight to support inflated insurance claims for foreign trekkers.", "source": "The Kathmandu Post", "url": "https://kathmandupost.com/national/2026/03/23/nepal-charges-32-in-fake-rescue-scam", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-02-01", "headline": "National health insurance system failure left months of claims data out of reach", "paraphrase": "A guest editorial reports that Nepal's national health insurance information system failed, making months of claims inaccessible overnight; hospitals struggled to recover the data, while some with their own electronic records resubmitted claims.", "source": "Nepali Times", "url": "https://nepalitimes.com/fix-what-is-broken", "theme": "other", "status": "alleged" } ] }, { "iso3": "SYR", "name": "Syria", "region": "Middle East", "overall": 31, "rank": "159=", "likelyRank": "123 to 177", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Syria's 2024 data law covers only electronic records, and the new national health portal reached five public hospitals in 2026.", "categories": { "access": { "score": 35, "summary": "Law No. 12 of 2024 gives a right to obtain your personal data within 7 working days, but only electronic data, so paper hospital files fall outside it. An official portal at five public hospitals since April 2026 puts the score at the band's top.", "sources": [ { "title": "Law No. 12 of 2024 on Personal Data Protection, full text (Bunud legal database)", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law", "date": "2024-03-28", "publisherClass": "legal_text" }, { "title": "Sanctions and fines: Assad issues the personal data law for Syrians (Syria TV)", "url": "https://www.syria.tv/%D8%B9%D9%82%D9%88%D8%A8%D8%A7%D8%AA-%D9%88%D8%BA%D8%B1%D8%A7%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%A3%D8%B3%D8%AF-%D9%8A%D8%B5%D8%AF%D8%B1-%D8%A7%D9%84%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D8%AE%D8%A7%D8%B5-%D8%A8%D9%80%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9-%D9%84%D9%84%D8%B3%D9%88%D8%B1%D9%8A%D9%8A%D9%86", "date": "2024-03-28", "publisherClass": "news" }, { "title": "Ministry of Health launches the Digital Health Portal (SANA)", "url": "https://sana.sy/health/2440858/", "date": "2026-04-02", "publisherClass": "news" }, { "title": "Health ministry records over 161,000 visits on the digital services portal (SANA)", "url": "https://sana.sy/health/2567848/", "date": "2026-08-31", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "On paper, Law No. 12 requires written, explicit consent to process health data and lets people withdraw consent. In practice the ministry's portal privacy policy offers no sharing choices, and we found no opt-out or patient-visible access log.", "sources": [ { "title": "Law No. 12 of 2024 on Personal Data Protection, full text (Bunud legal database)", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law", "date": "2024-03-28", "publisherClass": "legal_text" }, { "title": "National EHR platform: site use, privacy and information security policy (Ministry of Health)", "url": "https://health.moh.gov.sy/privacy-policy", "date": "undated", "publisherClass": "official" }, { "title": "Communications ministry bars collecting personal data except through approved platforms (SANA)", "url": "https://sana.sy/locals/2207943/", "date": "2025-04-15", "publisherClass": "news" } ] }, "privacy": { "score": 36, "summary": "Law No. 12 of 2024 makes health data sensitive and requires breach reports within 72 hours, with prison terms for misuse. But the regulator is chaired by a minister, includes defence and interior representatives, and the law exempts national security and public order uses.", "sources": [ { "title": "Law No. 12 of 2024 on Personal Data Protection, full text (Bunud legal database)", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law", "date": "2024-03-28", "publisherClass": "legal_text" }, { "title": "Penal Code, Legislative Decree 148 of 1949, Article 565 (Syria Law)", "url": "https://syria-law.com/laws/%D9%85%D8%A7%D8%AF%D8%A9-565-%D9%85%D9%86-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D8%B9%D9%82%D9%88%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%B3%D9%88%D8%B1%D9%8A-%D8%A7%D9%84%D9%85%D8%B1%D8%B3/", "date": "undated", "publisherClass": "legal_text" }, { "title": "Executive instructions for the Personal Data Protection Law (Al-Thawra)", "url": "https://archive.thawra.sy/?p=574284", "date": "2024-07-18", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 20, "summary": "Syria has no connected national record yet: the ministry's EHR portal linked five public hospitals at its April 2026 launch. WHO is helping the ministry build a unified reporting system, and no e-prescription or claims link was found.", "sources": [ { "title": "WHO welcomes NOK 10.2 million from Norway to strengthen Syria's national health information system (WHO EMRO)", "url": "https://www.emro.who.int/syria/news/who-welcomes-us-1-million-from-norway-to-strengthen-syrias-national-health-information-system.html", "date": "2025-12-24", "publisherClass": "intergov" }, { "title": "Ministry of Health launches the Digital Health Portal (SANA)", "url": "https://sana.sy/health/2440858/", "date": "2026-04-02", "publisherClass": "news" }, { "title": "Syrian Arab Red Crescent completes health information system (SANA)", "url": "https://sana.sy/en/health/2301011/", "date": "2026-03-07", "publisherClass": "news" }, { "title": "Syria expands digital health services with a platform recalling Turkey's e-Nabız (Turk Press)", "url": "https://www.turkpress.co/node/112470", "date": "2026-09-28", "publisherClass": "news" } ] }, "commercial": { "score": 42, "summary": "A December 2025 health ministry decision bars approved health apps from sharing or reusing user data without consent, and Law No. 12 requires consent for electronic marketing. We found no rule on data brokers or sale of de-identified health data.", "sources": [ { "title": "Regulatory Decision 24/T on e-health applications (Ministry of Health)", "url": "https://www.moh.gov.sy/legislation/decisions/%D9%82%D8%B1%D8%A7%D8%B1-%D8%AA%D9%86%D8%B8%D9%8A%D9%85%D9%8A-24-%D8%AA-%D8%A8%D8%AE%D8%B5%D9%88%D8%B5-%D8%AA%D8%B7%D8%A8%D9%8A%D9%82%D8%A7%D8%AA-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9", "date": "2025-12-02", "publisherClass": "official" }, { "title": "Law No. 12 of 2024 on Personal Data Protection, full text (Bunud legal database)", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law", "date": "2024-03-28", "publisherClass": "legal_text" } ] }, "clinical": { "score": 18, "summary": "We found no system that lets a treating doctor see a patient's record from another provider. The new portal is built for patients, covers a handful of public hospitals, and most records stay on paper inside each facility.", "sources": [ { "title": "Digital Health Portal app (Ministry of Health)", "url": "https://www.moh.gov.sy/about-app", "date": "undated", "publisherClass": "official" }, { "title": "Code of Doctors' Duties and Professional Ethics (Syrian Doctors' Syndicate)", "url": "https://syrma.org.sy/wp-content/uploads/2023/07/%D9%86%D8%B8%D8%A7%D9%85-%D9%88%D8%A7%D8%AC%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A8-%D9%88%D8%A2%D8%AF%D8%A7%D8%A8-%D8%A7%D9%84%D9%85%D9%87%D9%86%D8%A9.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Health ministry warns of apps impersonating it (SANA)", "url": "https://sana.sy/health/2491512/", "date": "2026-06-02", "publisherClass": "news" } ] }, "research": { "score": 45, "summary": "The doctors' ethics code allows patient information to be used for research without names, and Law No. 12 exempts scientific use from its rules. University ethics committees use consent forms, but no national research ethics rules were verified, so the score is 45.", "sources": [ { "title": "Code of Doctors' Duties and Professional Ethics (Syrian Doctors' Syndicate)", "url": "https://syrma.org.sy/wp-content/uploads/2023/07/%D9%86%D8%B8%D8%A7%D9%85-%D9%88%D8%A7%D8%AC%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A8-%D9%88%D8%A2%D8%AF%D8%A7%D8%A8-%D8%A7%D9%84%D9%85%D9%87%D9%86%D8%A9.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Medical research ethics committee approval request and consent forms (Latakia University)", "url": "https://latakia-univ.edu.sy/ar/Home/Details/46308/%D8%B7%D9%84%D8%A8-%D8%A7%D9%84%D8%AD%D8%B5%D9%88%D9%84-%D8%B9%D9%84%D9%89-%D9%85%D9%88%D8%A7%D9%81%D9%82%D8%A9-%D9%84%D8%AC%D9%86%D8%A9-%D8%A3%D8%AE%D9%84%D8%A7%D9%82%D9%8A%D8%A7%D8%AA-%D8%A7%D9%84%D8%A8%D8%AD%D9%88%D8%AB-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A9-%D9%86%D9%85%D9%88%D8%B0%D8%AC-10", "date": "2025-12-29", "publisherClass": "academic" }, { "title": "Review of national research ethics regulations and guidelines in Middle Eastern Arab countries (BMC Medical Ethics, Europe PMC full text)", "url": "https://www.ebi.ac.uk/europepmc/webservices/rest/PMC3576357/fullTextXML", "date": "2012-12-12", "publisherClass": "academic" }, { "title": "Law No. 12 of 2024 on Personal Data Protection, full text (Bunud legal database)", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law", "date": "2024-03-28", "publisherClass": "legal_text" } ] }, "ai": { "score": 42, "summary": "A December 2025 health ministry decision bars approved health apps from using AI as a source of clinical information unless the app's medical team checks it, and requires ministry approval for app changes. We found no AI law or medical device rules for AI software.", "sources": [ { "title": "Regulatory Decision 24/T on e-health applications (Ministry of Health)", "url": "https://www.moh.gov.sy/legislation/decisions/%D9%82%D8%B1%D8%A7%D8%B1-%D8%AA%D9%86%D8%B8%D9%8A%D9%85%D9%8A-24-%D8%AA-%D8%A8%D8%AE%D8%B5%D9%88%D8%B5-%D8%AA%D8%B7%D8%A8%D9%8A%D9%82%D8%A7%D8%AA-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9", "date": "2025-12-02", "publisherClass": "official" } ] } }, "laws": [ { "name": "Law No. 12 of 2024 on Personal Data Protection", "level": "National", "year": "2024", "what": "Health is sensitive data; access, withdrawal and breach rights; electronic data only; in force 1 January 2025.", "url": "https://www.bunud.ai/sy/laws/personal-data-protection-law" }, { "name": "Constitutional Declaration of the Syrian Arab Republic, Articles 13 and 51", "level": "National", "year": "2025", "what": "State protects private life; laws in force continue unless amended or repealed.", "url": "https://www.aljazeera.net/encyclopedia/2025/3/14/%D9%86%D8%B5-%D8%A7%D9%84%D8%A5%D8%B9%D9%84%D8%A7%D9%86-%D8%A7%D9%84%D8%AF%D8%B3%D8%AA%D9%88%D8%B1%D9%8A-%D9%84%D8%B3%D9%88%D8%B1%D9%8A%D8%A7-2025" }, { "name": "Penal Code, Legislative Decree 148 of 1949, Article 565", "level": "National", "year": "1949", "what": "Up to one year in prison for disclosing or exploiting a secret learned through one's profession.", "url": "https://syria-law.com/laws/%D9%85%D8%A7%D8%AF%D8%A9-565-%D9%85%D9%86-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84%D8%B9%D9%82%D9%88%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%B3%D9%88%D8%B1%D9%8A-%D8%A7%D9%84%D9%85%D8%B1%D8%B3/" }, { "name": "Ministry of Health Regulatory Decision 24/T on e-health applications", "level": "National", "year": "2025", "what": "Health apps need approval, local data hosting, consent for data sharing, and human review of AI output.", "url": "https://www.moh.gov.sy/legislation/decisions/%D9%82%D8%B1%D8%A7%D8%B1-%D8%AA%D9%86%D8%B8%D9%8A%D9%85%D9%8A-24-%D8%AA-%D8%A8%D8%AE%D8%B5%D9%88%D8%B5-%D8%AA%D8%B7%D8%A8%D9%8A%D9%82%D8%A7%D8%AA-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D8%A7%D9%84%D9%83%D8%AA%D8%B1%D9%88%D9%86%D9%8A%D8%A9" }, { "name": "Code of Doctors' Duties and Professional Ethics (Syrian Doctors' Syndicate)", "level": "National", "year": "not verified", "what": "Medical secrecy; disclosure allowed to the patient, guardians, courts, and for research without names.", "url": "https://syrma.org.sy/wp-content/uploads/2023/07/%D9%86%D8%B8%D8%A7%D9%85-%D9%88%D8%A7%D8%AC%D8%A8%D8%A7%D8%AA-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A%D8%A8-%D9%88%D8%A2%D8%AF%D8%A7%D8%A8-%D8%A7%D9%84%D9%85%D9%87%D9%86%D8%A9.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "HND", "name": "Honduras", "region": "Americas", "overall": 30, "rank": "162=", "likelyRank": "127 to 180", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Honduras has no data protection law and, per its health minister, the law still requires paper records, so each hospital keeps its own file.", "categories": { "access": { "score": 40, "summary": "The Constitution gives a free, fast right to see your own data, and public bodies must answer in 10 days, but there is no national patient portal. A right to a copy of the clinical record was not verified, so the score sits low.", "sources": [ { "title": "Constitucion de la Republica de Honduras (OAS copy)", "url": "https://www.oas.org/dil/esp/constitucion_de_honduras.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Ley de Transparencia y Acceso a la Informacion Publica, Decreto 170-2006 (TSC)", "url": "https://www.tsc.gob.hn/web/leyes/Ley_de_Transparencia.pdf", "date": "2006", "publisherClass": "legal_text" }, { "title": "Honduras implementa carnet de vacunacion digital (DPL News)", "url": "https://dplnews.com/honduras-implementa-carnet-de-vacunacion-digital-como-conseguirlo-paso-a-paso/", "date": "2026-05-15", "publisherClass": "news" } ] }, "control": { "score": 30, "summary": "Patients have no tools to choose who sees their record or to view an access log. Protection rests on medical secrecy in the doctors' ethics code and a Transparency Law rule that personal data goes only to the person or a court.", "sources": [ { "title": "Codigo de Etica del Colegio Medico de Honduras (BVS Honduras)", "url": "https://www.bvs.hn/Honduras/Postgrados/27_reglamento_codigo_etica.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Ley de Transparencia y Acceso a la Informacion Publica, Decreto 170-2006 (TSC)", "url": "https://www.tsc.gob.hn/web/leyes/Ley_de_Transparencia.pdf", "date": "2006", "publisherClass": "legal_text" } ] }, "privacy": { "score": 28, "summary": "Honduras has no general data protection law and no data protection authority, so the score sits below the general-law band. Health status is confidential personal data under the 2006 Transparency Law, which binds public bodies only.", "sources": [ { "title": "Ley de Transparencia y Acceso a la Informacion Publica, Decreto 170-2006 (TSC)", "url": "https://www.tsc.gob.hn/web/leyes/Ley_de_Transparencia.pdf", "date": "2006", "publisherClass": "legal_text" }, { "title": "Proteccion de datos en Centroamerica: como gestionar la diversa regulacion regional (LexLatin)", "url": "https://lexlatin.com/opinion/proteccion-datos-centroamerica-gestionar-regulacion-diversa", "date": "2026-03-04", "publisherClass": "law_firm" }, { "title": "IAIP da a conocer beneficios de la Ley de Proteccion de Datos Personales (El Heraldo)", "url": "https://www.elheraldo.hn/honduras/iaip-destaca-beneficios-honduras-ley-proteccion-datos-personales-BP26294115", "date": "2025-06-18", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "A national integrated electronic record has been planned since 2024 with PAHO support, but in October 2025 the health minister said current law still requires physical records. Digital records exist inside single institutions such as Hospital Escuela.", "sources": [ { "title": "Mision conjunta para fortalecer la transformacion digital en salud (OPS/OMS)", "url": "https://www.paho.org/es/noticias/2-7-2024-mision-conjunta-para-fortalecer-transformacion-digital-salud", "date": "2024-07-02", "publisherClass": "intergov" }, { "title": "CN escucha propuestas de la Sesal orientadas a modernizar el sistema sanitario (Canal 8)", "url": "https://cn8.spe.gob.hn/nacional/cn-escucha-propuestas-de-la-sesal-orientadas-a-modernizar-el-sistema-sanitario/", "date": "2025-10-18", "publisherClass": "news" }, { "title": "En linea 5 millones de expedientes electronicos en el Hospital Escuela (La Prensa)", "url": "https://www.laprensa.hn/honduras/linea-5-millones-expedientes-electronicos-hospital-escuela-HX8505810", "date": "2022-06-05", "publisherClass": "news" }, { "title": "Sistema de salud iniciara el registro digital de vacunas a partir del 1 de agosto (DPL News)", "url": "https://dplnews.com/honduras-sistema-de-salud-iniciara-el-registro-digital-de-vacunas-a-partir-del-1-de-agosto/", "date": "2026-06-22", "publisherClass": "news" } ] }, "commercial": { "score": 25, "summary": "Public bodies may not sell or pass on confidential personal data, but no law limits private companies, apps or data brokers. A September 2026 investigation found a state digital wallet's first terms let user data pass to a buyer in a merger.", "sources": [ { "title": "Ley de Transparencia y Acceso a la Informacion Publica, Decreto 170-2006 (TSC)", "url": "https://www.tsc.gob.hn/web/leyes/Ley_de_Transparencia.pdf", "date": "2006", "publisherClass": "legal_text" }, { "title": "Honduras Digital: BIEN y ALERTA-HN sin controles de datos (Contracorriente)", "url": "https://contracorriente.red/2026/09/14/el-gobierno-de-xiomara-castro-contrato-la-billetera-electronica-con-empresa-vinculada-a-contratacion-investigada-por-irregularidades/", "date": "2026-09-14", "publisherClass": "news" } ] }, "clinical": { "score": 20, "summary": "A clinician generally sees only the file held by their own facility, often on paper. The shared record that would link hospitals and health centres in all 298 municipalities is still awaiting a law.", "sources": [ { "title": "CN escucha propuestas de la Sesal orientadas a modernizar el sistema sanitario (Canal 8)", "url": "https://cn8.spe.gob.hn/nacional/cn-escucha-propuestas-de-la-sesal-orientadas-a-modernizar-el-sistema-sanitario/", "date": "2025-10-18", "publisherClass": "news" }, { "title": "Mision conjunta para fortalecer la transformacion digital en salud (OPS/OMS)", "url": "https://www.paho.org/es/noticias/2-7-2024-mision-conjunta-para-fortalecer-transformacion-digital-salud", "date": "2024-07-02", "publisherClass": "intergov" }, { "title": "En linea 5 millones de expedientes electronicos en el Hospital Escuela (La Prensa)", "url": "https://www.laprensa.hn/honduras/linea-5-millones-expedientes-electronicos-hospital-escuela-HX8505810", "date": "2022-06-05", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "Clinical trials need ARSA authorisation, a registered ethics committee and approved informed consent. No rules on secondary use of health records, and no opt-out, were found, so the score is the no-consent base plus one safeguard.", "sources": [ { "title": "ARSA Acuerdo No. 041-2020, ensayos clinicos (La Gaceta)", "url": "https://arsa.gob.hn/wp-content/uploads/2022/01/AcuerdoNo.041-2020-EnsayosClinicos.pdf", "date": "2020-11-04", "publisherClass": "legal_text" }, { "title": "Codigo de Etica del Colegio Medico de Honduras (BVS Honduras)", "url": "https://www.bvs.hn/Honduras/Postgrados/27_reglamento_codigo_etica.pdf", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 30, "summary": "ARSA's 2023 medical device regulation counts software as a medical device, with risk classification and vigilance, but has no AI-specific or change-control rules. A June 2026 review found no AI law, bill or regulator.", "sources": [ { "title": "Acuerdo 0631-ARSA-2023, Reglamento para el Control Sanitario de Dispositivos Medicos (ARSA)", "url": "https://arsateca.arsa.hn/wp-content/uploads/2025/03/REGLAMENTO-DM_PDF_compressed.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Regulacion de la IA en Honduras: que existe en 2026 (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-honduras-es", "date": "2026-09-07", "publisherClass": "blog_vendor" }, { "title": "CN escucha propuestas de la Sesal orientadas a modernizar el sistema sanitario (Canal 8)", "url": "https://cn8.spe.gob.hn/nacional/cn-escucha-propuestas-de-la-sesal-orientadas-a-modernizar-el-sistema-sanitario/", "date": "2025-10-18", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitucion de la Republica, Articulo 182 (Habeas Data)", "level": "National", "year": "2003", "what": "Free, fast right to access and correct data about oneself in public or private databases.", "url": "https://www.oas.org/dil/esp/constitucion_de_honduras.pdf" }, { "name": "Ley de Transparencia y Acceso a la Informacion Publica (Decreto 170-2006)", "level": "National", "year": "2006", "what": "Health status is confidential personal data; public bodies fined for unlawful disclosure.", "url": "https://www.tsc.gob.hn/web/leyes/Ley_de_Transparencia.pdf" }, { "name": "ARSA Acuerdo No. 041-2020 (ensayos clinicos)", "level": "National", "year": "2020", "what": "Trial authorisation, ethics committee registration and committee-approved informed consent.", "url": "https://arsa.gob.hn/wp-content/uploads/2022/01/AcuerdoNo.041-2020-EnsayosClinicos.pdf" }, { "name": "Acuerdo 0631-ARSA-2023, Reglamento para el Control Sanitario de Dispositivos Medicos", "level": "National", "year": "2023", "what": "Medical device rules covering software, with risk classification and vigilance.", "url": "https://arsateca.arsa.hn/wp-content/uploads/2025/03/REGLAMENTO-DM_PDF_compressed.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-01-26", "headline": "Social security server failure leaves doctors unable to open patients' records", "paraphrase": "A patient arrived for a booked consultation and was sent away because staff could not open her medical history. The institute's board said 14 of 24 storage disks failed, forcing staff to record visits by hand for weeks.", "source": "La Prensa (Honduras)", "url": "https://www.laprensa.hn/honduras/medicos-ihss-acceso-datos-pacientes-falla-servidores-IO23783092", "theme": "access_refused", "status": "admitted" }, { "date": "2025-10-06", "headline": "Repeated system outages halt appointments and laboratory results for insured patients", "paraphrase": "Insured patients were told there was no system for several days, so appointments, medicine and laboratory results stopped. The hospital director said the system had failed, as many times before, because of an internet provider problem.", "source": "El Heraldo", "url": "https://www.elheraldo.hn/honduras/fallas-sistema-afiliados-ihss-sin-citas-sin-recibir-medicamento-DB27626665", "theme": "access_delay_or_cost", "status": "admitted" } ] }, { "iso3": "IRN", "name": "Iran", "region": "Middle East", "overall": 30, "rank": "162=", "likelyRank": "122 to 179", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Iranians can see insurer prescription records, but there is no data protection law, and in January 2026 security forces reportedly tracked protesters through hospital records.", "categories": { "access": { "score": 40, "summary": "A 2009 ministerial charter, not a statute, says patients may see their whole clinical record and get a copy. Insurer apps show prescription and treatment history, but no national patient portal to the full record was verified.", "sources": [ { "title": "منشور حقوق بیمار (بیمارستان فارابی، دانشگاه علوم پزشکی تهران)", "url": "https://farabih.tums.ac.ir/%D9%85%D9%86%D8%B4%D9%88%D8%B1-%D8%AD%D9%82%D9%88%D9%82-%D8%A8%DB%8C%D9%85%D8%A7%D8%B1", "date": "undated", "publisherClass": "official" }, { "title": "قانون تجارت الکترونیکی مصوب ۱۳۸۲ (متن کامل، شناسنامه)", "url": "https://shenasname.ir/laws/7060-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AA%D8%AC%D8%A7%D8%B1%D8%AA-%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%DB%8C", "date": "2020-07-21", "publisherClass": "legal_text" }, { "title": "روزانه ۶۰۰ هزار نسخه الکترونیک ثبت می‌شود (ایرنا)", "url": "https://www.irna.ir/news/86207633/", "date": "2026-07-13", "publisherClass": "news" }, { "title": "راهنمای استعلام نسخه الکترونیک بیمه (بقراط)", "url": "https://boghrat.com/articles/2450", "date": "2025-09-13", "publisherClass": "blog_vendor" } ] }, "control": { "score": 22, "summary": "The 2024 Seventh Plan Law makes every provider send health data to a central state database in real time. No patient opt-out or access log was found, and a UN report says security forces seized hospital admission lists in January 2026.", "sources": [ { "title": "قانون برنامه هفتم پیشرفت جمهوری اسلامی ایران، ماده ۶۹ (شناسنامه)", "url": "https://shenasname.ir/barname7/7298-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D9%87-%D9%87%D9%81%D8%AA%D9%85-%D9%BE%DB%8C%D8%B4%D8%B1%D9%81%D8%AA", "date": "undated", "publisherClass": "legal_text" }, { "title": "قانون برنامه ششم توسعه، ماده ۷۴ (دیپ‌لا)", "url": "https://deeplaw.ir/laws.php?id=25522&table=legal_entries", "date": "undated", "publisherClass": "legal_text" }, { "title": "A/HRC/61/59 Situation of human rights in the Islamic Republic of Iran in 2025 and the nationwide protests (UN Special Rapporteur, advance unedited version)", "url": "https://www.globalsecurity.org/military/library/report/2026/a-hrc-61-59_iran-rights-situation_hrc_20260309.pdf", "date": "2026-03-09", "publisherClass": "intergov" } ] }, "privacy": { "score": 15, "summary": "Iran has no general data protection law or regulator; a bill has been stalled for years. Health secrecy rests on the penal code and the e-commerce law, while the UN and the BBC report security forces using hospital records to find protesters.", "sources": [ { "title": "قانون تجارت الکترونیکی مصوب ۱۳۸۲ (متن کامل، شناسنامه)", "url": "https://shenasname.ir/laws/7060-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AA%D8%AC%D8%A7%D8%B1%D8%AA-%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%DB%8C", "date": "2020-07-21", "publisherClass": "legal_text" }, { "title": "A/HRC/61/59 Situation of human rights in the Islamic Republic of Iran in 2025 and the nationwide protests (UN Special Rapporteur, advance unedited version)", "url": "https://www.globalsecurity.org/military/library/report/2026/a-hrc-61-59_iran-rights-situation_hrc_20260309.pdf", "date": "2026-03-09", "publisherClass": "intergov" }, { "title": "'Don't take us to a hospital': Iran protesters treated in secret to avoid arrest (BBC News)", "url": "https://www.bbc.com/news/articles/c5yx015nkplo", "date": "2026-01-28", "publisherClass": "news" }, { "title": "حفاظت از داده‌ها همچنان در خلأ قانونی (دنیای اقتصاد)", "url": "https://donya-e-eqtesad.com/%D8%A8%D8%AE%D8%B4-%D8%A8%D8%A7%D8%B2%D8%A7%D8%B1-%D8%AF%DB%8C%D8%AC%DB%8C%D8%AA%D8%A7%D9%84-19/4145558-%D8%AD%D9%81%D8%A7%D8%B8%D8%AA-%D8%A7%D8%B2-%D8%AF%D8%A7%D8%AF%D9%87-%D9%87%D8%A7-%D9%87%D9%85%DA%86%D9%86%D8%A7%D9%86-%D8%AF%D8%B1-%D8%AE%D9%84%D8%A3-%D9%82%D8%A7%D9%86%D9%88%D9%86%DB%8C", "date": "2025-01-19", "publisherClass": "news" } ] }, "journey": { "score": 40, "summary": "E-prescribing has run nationwide since early 2022 and logs about 600,000 prescriptions a day, linking doctors, pharmacies and insurers. A full national health record is still not in place, and the first vice president said in December 2025 that e-health lags the world average.", "sources": [ { "title": "سامانه سپاس (مدیریت آمار و فناوری اطلاعات، دانشگاه علوم پزشکی شاهرود)", "url": "https://shmu.ac.ir/sit/fa/page/167/%D8%B3%D8%A7%D9%85%D8%A7%D9%86%D9%87-%D8%B3%D9%BE%D8%A7%D8%B3", "date": "undated", "publisherClass": "official" }, { "title": "پرونده الکترونیک سلامت تا پایان امسال اجرا می‌شود (روزنامه ایران)", "url": "https://irannewspaper.ir/8814/1/130455", "date": "2025-08-17", "publisherClass": "news" }, { "title": "عارف: عقب‌ماندگی سلامت الکترونیک باید جبران شود (خبرگزاری مهر)", "url": "https://www.mehrnews.com/news/6686524/", "date": "2025-12-12", "publisherClass": "news" }, { "title": "روزانه ۶۰۰ هزار نسخه الکترونیک ثبت می‌شود (ایرنا)", "url": "https://www.irna.ir/news/86207633/", "date": "2026-07-13", "publisherClass": "news" } ] }, "commercial": { "score": 30, "summary": "The e-commerce law requires explicit consent before health data is processed electronically and limits use to stated purposes, with prison for breaches. No rules on health data brokers, advertising or sale of de-identified data were found.", "sources": [ { "title": "قانون تجارت الکترونیکی مصوب ۱۳۸۲ (متن کامل، شناسنامه)", "url": "https://shenasname.ir/laws/7060-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AA%D8%AC%D8%A7%D8%B1%D8%AA-%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%DB%8C", "date": "2020-07-21", "publisherClass": "legal_text" }, { "title": "هک شرکت‌های بیمه در ایران و نگرانی از ضعف امنیت سایبری (بی‌بی‌سی فارسی)", "url": "https://www.bbc.com/persian/articles/clk147yydv2o", "date": "2023-09-04", "publisherClass": "news" } ] }, "clinical": { "score": 30, "summary": "The law tells the health ministry to give treating doctors the data held in the national health database. Whether clinicians can actually pull a patient's history from other providers at the bedside was not verified, and the full national record is not finished.", "sources": [ { "title": "پروژه‌ها: سامانه پرونده الکترونیک سلامت (سپاس) (مرکز فناوری اطلاعات، دانشگاه علوم پزشکی تهران)", "url": "https://sit.tums.ac.ir/%D9%BE%D8%B1%D9%88%DA%98%D9%87%E2%80%8C%D9%87%D8%A7", "date": "undated", "publisherClass": "official" }, { "title": "قانون برنامه هفتم پیشرفت جمهوری اسلامی ایران، ماده ۶۹ (شناسنامه)", "url": "https://shenasname.ir/barname7/7298-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D9%87-%D9%87%D9%81%D8%AA%D9%85-%D9%BE%DB%8C%D8%B4%D8%B1%D9%81%D8%AA", "date": "undated", "publisherClass": "legal_text" }, { "title": "پرونده الکترونیک سلامت تا پایان امسال اجرا می‌شود (روزنامه ایران)", "url": "https://irannewspaper.ir/8814/1/130455", "date": "2025-08-17", "publisherClass": "news" } ] }, "research": { "score": 45, "summary": "A national ethics committee issues ethics approval codes that journals check online, and the patient charter gives a right to refuse research. No general opt-out or public register of data uses was found.", "sources": [ { "title": "منشور حقوق بیمار (بیمارستان فارابی، دانشگاه علوم پزشکی تهران)", "url": "https://farabih.tums.ac.ir/%D9%85%D9%86%D8%B4%D9%88%D8%B1-%D8%AD%D9%82%D9%88%D9%82-%D8%A8%DB%8C%D9%85%D8%A7%D8%B1", "date": "undated", "publisherClass": "official" }, { "title": "کد تصویب کمیته اخلاق در پژوهش های زیست پزشکی (مجله دانشور پزشکی، دانشگاه شاهد)", "url": "https://daneshvarmed.shahed.ac.ir/news?newsCode=37", "date": "2022-09-22", "publisherClass": "official" }, { "title": "Ethical considerations in the biomedical research: analysis of national biomedical research ethics guidelines in Iran (J Med Ethics Hist Med)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC6642447/", "date": "2019-04-17", "publisherClass": "academic" }, { "title": "ماده ۶۴۸ قانون مجازات اسلامی، تعزیرات (دادپرس)", "url": "https://daadpors.ir/rules/240950365", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 30, "summary": "No binding rule for clinical AI is in force. The food and drug authority was reviewing a draft instruction for registering medical software, including AI, in May 2026, and a health-sector AI document is still being drafted.", "sources": [ { "title": "تدوین سند ملی هوش مصنوعی در نظام سلامت کشور (معاونت تحقیقات و فناوری، دانشگاه علوم پزشکی تهران)", "url": "https://vcr.tums.ac.ir/news/%D8%AA%D8%AF%D9%88%DB%8C%D9%86-%D8%B3%D9%86%D8%AF-%D9%85%D9%84%DB%8C-%D9%87%D9%88%D8%B4-%D9%85%D8%B5%D9%86%D9%88%D8%B9%DB%8C-%D8%AF%D8%B1-%D9%86%D8%B8%D8%A7%D9%85-%D8%B3%D9%84%D8%A7%D9%85%D8%AA-%DA%A9%D8%B4%D9%88%D8%B1", "date": "2025-10-09", "publisherClass": "official" }, { "title": "دستورالعمل جدید ثبت نرم‌افزارهای هوش مصنوعی در تجهیزات پزشکی (سیناپرس)", "url": "https://sinapress.ir/news/605007/", "date": "2026-05-23", "publisherClass": "news" }, { "title": "راهبرد سه‌گانه سازمان غذا و دارو برای ساماندهی هوش مصنوعی در سلامت (ایرنا)", "url": "https://www.irna.ir/news/86140610/", "date": "2026-04-29", "publisherClass": "news" } ] } }, "laws": [ { "name": "Patient Rights Charter (منشور حقوق بیمار)", "level": "National", "year": "2009", "what": "Ministerial charter: right to see and copy the whole clinical record, privacy, and choice on research.", "url": "https://farabih.tums.ac.ir/%D9%85%D9%86%D8%B4%D9%88%D8%B1-%D8%AD%D9%82%D9%88%D9%82-%D8%A8%DB%8C%D9%85%D8%A7%D8%B1" }, { "name": "Electronic Commerce Law (قانون تجارت الکترونیکی)", "level": "National", "year": "2004", "what": "Explicit consent for electronic health data, access and erasure rights, one to three years prison.", "url": "https://shenasname.ir/laws/7060-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AA%D8%AC%D8%A7%D8%B1%D8%AA-%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%DB%8C" }, { "name": "Islamic Penal Code (Ta'zirat), Article 648", "level": "National", "year": "1996", "what": "Doctors, midwives and pharmacists who disclose secrets outside legal cases face prison or fines.", "url": "https://daadpors.ir/rules/240950365" }, { "name": "Sixth Development Plan Law, Article 74", "level": "National", "year": "2017", "what": "Ordered a national health record built with privacy and subject to people's permission.", "url": "https://deeplaw.ir/laws.php?id=25522&table=legal_entries" }, { "name": "Seventh Development Plan Law, Article 69", "level": "National", "year": "2024", "what": "All providers send health data in real time to a central national health database.", "url": "https://shenasname.ir/barname7/7298-%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A8%D8%B1%D9%86%D8%A7%D9%85%D9%87-%D9%87%D9%81%D8%AA%D9%85-%D9%BE%DB%8C%D8%B4%D8%B1%D9%81%D8%AA" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2024-10-23", "headline": "Health ministry has 333 clinic social pages blocked for posting patient images", "paraphrase": "Doctors and clinics posted patients' photos, videos and record details on social media pages. The health ministry referred 333 pages to prosecutors, who blocked them, and cases went to courts and the medical council.", "source": "Kayhan", "url": "https://kayhan.ir/fa/news/298197/", "theme": "sold_or_shared", "status": "finding" }, { "date": "2026-02-15", "headline": "Security council sought medical records of people hurt in protests, lawmaker says", "paraphrase": "A member of parliament's health committee confirmed a security council letter asking medical universities for patients' records after the January protests. He said the health ministry objected in confidential correspondence, citing patient confidentiality.", "source": "Khabar Online", "url": "https://www.khabaronline.ir/news/2182585/", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-02-02", "headline": "Reports say security forces searched hospital files to identify treated protesters", "paraphrase": "Reports cited by the outlet say security officers checked hospital records of discharged patients and pressed medical staff to report certain patients, and many people avoided hospitals for fear of arrest.", "source": "Radio Zamaneh", "url": "https://www.radiozamaneh.com/876871/", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-01-12", "headline": "E-prescription records show medicines dispensed in full when patients got only part", "paraphrase": "Pharmacists say drugs dropped from a prescription are often not recorded, so the national e-prescription system shows a complete prescription while the patient received only part of it.", "source": "Asr Iran", "url": "https://www.asriran.com/fa/news/1131759/", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "KNA", "name": "Saint Kitts and Nevis", "region": "Americas", "overall": 30, "rank": "162=", "likelyRank": "127 to 180", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Saint Kitts and Nevis began rolling out a national digital health record in 2026, but its 2018 data protection law has never come into force.", "categories": { "access": { "score": 30, "summary": "The Data Protection Act 2018 would give a right to a copy within 30 days for a fee, but it awaits a commencement order, so no right is enforceable. The Ministry's new system promises access through a patient portal; patient use was not verified.", "sources": [ { "title": "Data Protection Act, 2018 (No. 5 of 2018), Saint Christopher and Nevis (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4", "date": "2018-06-07", "publisherClass": "legal_text" }, { "title": "NDHIS Privacy Policy (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/privacy-policy", "date": "undated", "publisherClass": "official" }, { "title": "External Resources: Data Protection Laws, St Kitts and Nevis (UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-skn", "date": "undated", "publisherClass": "academic" } ] }, "control": { "score": 30, "summary": "With the Data Protection Act not in force, patients have no legal say over who sees their health records. The NDHIS website says patients can see who opened their record, but whether that works in practice was not verified.", "sources": [ { "title": "Data Protection Act, 2018 (No. 5 of 2018), Saint Christopher and Nevis (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4", "date": "2018-06-07", "publisherClass": "legal_text" }, { "title": "NDHIS: National Digital Health Information System (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/", "date": "undated", "publisherClass": "official" }, { "title": "National Digital Health Information System Deployed at JNF General Hospital (St Kitts Nevis Observer, from SKNIS)", "url": "https://www.thestkittsnevisobserver.com/national-digital-health-information-system-deployed-at-jnf-general-hospital/", "date": "2026-08-14", "publisherClass": "news" } ] }, "privacy": { "score": 32, "summary": "Health data would be sensitive under the 2018 Act, with fines up to EC$200,000 or two years in prison, but the Act is not in force. Its future regulator, the Information Commissioner, sits under the FOI Act, fully in force since November 2023, but has no data protection powers yet.", "sources": [ { "title": "Data Protection Act, 2018 (No. 5 of 2018), Saint Christopher and Nevis (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4", "date": "2018-06-07", "publisherClass": "legal_text" }, { "title": "St. Kitts and Nevis Enhances Transparency with Passage of Freedom of Information (Amendment) Bill, 2024 (SKNIS)", "url": "https://www.sknis.gov.kn/2024/07/05/st-kitts-and-nevis-enhances-transparency-with-passage-of-freedom-of-information-amendment-bill-2024/", "date": "2024-07-05", "publisherClass": "official" }, { "title": "Electronic Crimes Act, Act 27 of 2009, revised edition (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/ay7zmnel9xk", "date": "2009-11-26", "publisherClass": "legal_text" }, { "title": "NDHIS Privacy Policy (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/privacy-policy", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 32, "summary": "A national health network links health centres and hospitals on St Kitts, and the new national record went live at the main hospital in August 2026. Labs, pharmacy, billing and Nevis are planned but not yet shown to be connected.", "sources": [ { "title": "Government Partners with Local Innovators to Launch National Digital Health Information System (SKNIS)", "url": "https://www.sknis.gov.kn/2026/05/29/government-partners-with-local-innovators-to-launch-national-digital-health-information-system/", "date": "2026-05-29", "publisherClass": "official" }, { "title": "St. Kitts Health Services ICT Project Symbolises Government's Strategic Step Towards Modernising Health Services Through Digitisation (SKNIS)", "url": "https://www.sknis.gov.kn/2024/06/05/st-kitts-health-services-ict-project-symbolises-governments-strategic-step-towards-modernising-health-services-through-digitisation/", "date": "2024-06-05", "publisherClass": "official" }, { "title": "National Digital Health Information System Deployed at JNF General Hospital (St Kitts Nevis Observer, from SKNIS)", "url": "https://www.thestkittsnevisobserver.com/national-digital-health-information-system-deployed-at-jnf-general-hospital/", "date": "2026-08-14", "publisherClass": "news" } ] }, "commercial": { "score": 28, "summary": "No law in force stops health data being sold or used for marketing. The Ministry's NDHIS policy says it will never sell health information for marketing, a promise that binds only the public system.", "sources": [ { "title": "NDHIS Privacy Policy (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/privacy-policy", "date": "undated", "publisherClass": "official" }, { "title": "NDHIS Terms of Use (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/terms", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Act, 2018 (No. 5 of 2018), Saint Christopher and Nevis (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4", "date": "2018-06-07", "publisherClass": "legal_text" } ] }, "clinical": { "score": 25, "summary": "Clinicians at the JNF General Hospital began using the national record in August 2026; it is designed to flag allergies and past visits. Records from government clinics, private doctors and Nevis are not yet linked.", "sources": [ { "title": "National Digital Health Information System Deployed at JNF General Hospital (St Kitts Nevis Observer, from SKNIS)", "url": "https://www.thestkittsnevisobserver.com/national-digital-health-information-system-deployed-at-jnf-general-hospital/", "date": "2026-08-14", "publisherClass": "news" }, { "title": "Government Partners with Local Innovators to Launch National Digital Health Information System (SKNIS)", "url": "https://www.sknis.gov.kn/2026/05/29/government-partners-with-local-innovators-to-launch-national-digital-health-information-system/", "date": "2026-05-29", "publisherClass": "official" }, { "title": "New Committee Positions Nursing Services as the Designated Clinical Authority for Nursing-Specific Aspects of the Federation's HIS/EHR Transformation (St Kitts Nevis Observer)", "url": "https://www.thestkittsnevisobserver.com/new-committee-positions-nursing-services-as-the-designated-clinical-authority-for-nursing-specific-aspects-of-the-federations-historic-his-ehr-transformation-2/", "date": "2026-06-25", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "No law in force governs research use of health records, and there is no opt-out. One safeguard counts: the Ministry of Health's Interim Ethics Review Committee, set up by the Chief Medical Officer and still approving studies in recent years.", "sources": [ { "title": "Ministry of Health releases statement concerning investigation of clinical trials (St Kitts Nevis Observer)", "url": "https://www.thestkittsnevisobserver.com/ministry-of-health-releases-statement-concerning-investigation-of-clinical-trials/", "date": "2017-08-30", "publisherClass": "news" }, { "title": "The metabolic chronic disease prevention program in Saint Kitts and Nevis: a dietary recall study (Frontiers in Nutrition, via PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12370524/", "date": "2025-08-08", "publisherClass": "academic" }, { "title": "Data Protection Act, 2018 (No. 5 of 2018), Saint Christopher and Nevis (UNIDIR Cyber Policy Portal copy)", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4", "date": "2018-06-07", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "Saint Kitts and Nevis has no AI law, national AI strategy or device rules for clinical AI. The NDHIS website says its AI features are advisory only, but that is a system policy, not regulation.", "sources": [ { "title": "Artificial intelligence readiness in the Caribbean: an exploratory review (ECLAC Studies and Perspectives No. 131)", "url": "https://caribbean.un.org/en/download/185262/295561", "date": "2024", "publisherClass": "intergov" }, { "title": "Artificial intelligence regulation and policy are at an early stage in the Caribbean (Cullen International)", "url": "https://www.cullen-international.com/news/2026/09/Artificial-intelligence-regulation-and-policy-are-at-an-early-stage-in-the-Caribbean.html", "date": "2026-09-30", "publisherClass": "news" }, { "title": "NDHIS Privacy Policy (Ministry of Health, St. Kitts and Nevis)", "url": "https://ndhis.gov.kn/privacy-policy", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Data Protection Act, 2018 (No. 5 of 2018)", "level": "National", "year": "2018", "what": "Access within 30 days for a fee; health is sensitive data; not in force, awaits commencement order.", "url": "https://database.cyberpolicyportal.org/en/entity/obcyhbt2e4" }, { "name": "Freedom of Information Act, 2018 (No. 6 of 2018), amended 2023 and 2024", "level": "National", "year": "2018", "what": "Creates the Information Commissioner, who would also enforce the Data Protection Act.", "url": "https://observatoriop10.cepal.org/en/instrument/freedom-information-act-no-6-2018" }, { "name": "Electronic Crimes Act (Act 27 of 2009)", "level": "National", "year": "2009", "what": "Makes unauthorised access to, interception of and interference with computer data offences.", "url": "https://database.cyberpolicyportal.org/en/entity/ay7zmnel9xk" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "WSM", "name": "Samoa", "region": "Oceania", "overall": 30, "rank": "162=", "likelyRank": "122 to 180", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Samoa now runs one Ministry electronic record across its main and district hospitals, but has no data protection law and no patient controls.", "categories": { "access": { "score": 25, "summary": "A 2015 Ministry of Health policy lists a patient right to access health information and to receive a medical report on request, but no law gives that right. There is no patient portal, and no deadline or fee rule was found.", "sources": [ { "title": "Patient Complaint and Grievance Policy 2015 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Patient-Complaint-and-Grievance-Policy-2015.pdf", "date": "2015", "publisherClass": "official" }, { "title": "Samoa's Constitution of 1962 with Amendments through 2017 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Samoa_2017.pdf?lang=en", "date": "2022-04-27", "publisherClass": "legal_text" } ] }, "control": { "score": 25, "summary": "The Ministry's eHealth policy proposes that the Ministry be the authority granting access to health data, and a patient consent law it called for in 2017 was never found. Records are shared inside one central system with no opt-out or patient-visible access log.", "sources": [ { "title": "Samoa eHealth Policy and Strategy 2017-2022 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Samoa-eHealth-Policy-Strategy-2017-2022.pdf", "date": "2017", "publisherClass": "official" }, { "title": "Rural hospitals come online (Samoa Observer)", "url": "https://www.samoaobserver.ws/category/samoa/106872", "date": "2023-11-26", "publisherClass": "news" }, { "title": "Patient Complaint and Grievance Policy 2015 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Patient-Complaint-and-Grievance-Policy-2015.pdf", "date": "2015", "publisherClass": "official" } ] }, "privacy": { "score": 25, "summary": "Samoa's own cybersecurity strategy says the country has no legal framework for personal data protection; a Data Protection Bill is only planned. The Constitution has no privacy right, and no health privacy law or regulator exists.", "sources": [ { "title": "Samoa National Cybersecurity Strategy 2025/26-2030/31 (Ministry of Communications and Information Technology)", "url": "https://mcit.gov.ws/wp-content/uploads/2026/04/SAMOA_NATIONAL_CYBERSECURITY_STRATEGY-2026.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "Telecommunications Act 2005 (Office of the Regulator, Samoa)", "url": "https://www.regulator.gov.ws/images/Act/TELECOMMUNICATIONS_ACT_2005_-_Eng.pdf", "date": "2005", "publisherClass": "legal_text" }, { "title": "Samoa's Constitution of 1962 with Amendments through 2017 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Samoa_2017.pdf?lang=en", "date": "2022-04-27", "publisherClass": "legal_text" } ] }, "journey": { "score": 45, "summary": "In July 2026 the Tamanu record went live across all inpatient departments of the national hospital, after every Upolu district hospital joined by February 2026. Labs still lack an integrated information system and pharmacy runs on separate mSupply stock software.", "sources": [ { "title": "Poutasi hospital launches Electronic Health Record system (Samoa Observer)", "url": "https://www.samoaobserver.ws/category/samoa/118777", "date": "2026-03-05", "publisherClass": "news" }, { "title": "Anatomy of a digital health Go-Live (BES International)", "url": "https://www.bes.au/anatomy-of-a-digital-health-go-live/", "date": "2026-07-14", "publisherClass": "blog_vendor" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "National Medical Laboratory Policy and Action Plan FY2024/25-FY2028/29 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2025/02/FINAL-NATIONAL-MEDICAL-LABORATORY-POLICY-2024-2029-_07_01_2025.pdf", "date": "2025-01-07", "publisherClass": "official" } ] }, "commercial": { "score": 20, "summary": "No law limits the sale or marketing use of health data, because Samoa has no personal data protection framework at all. Only telecom providers face a statutory limit on using customer information.", "sources": [ { "title": "Samoa National Cybersecurity Strategy 2025/26-2030/31 (Ministry of Communications and Information Technology)", "url": "https://mcit.gov.ws/wp-content/uploads/2026/04/SAMOA_NATIONAL_CYBERSECURITY_STRATEGY-2026.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "Telecommunications Act 2005 (Office of the Regulator, Samoa)", "url": "https://www.regulator.gov.ws/images/Act/TELECOMMUNICATIONS_ACT_2005_-_Eng.pdf", "date": "2005", "publisherClass": "legal_text" } ] }, "clinical": { "score": 48, "summary": "Because Tamanu is one central record, authorised staff can now see a patient's history across visits and facilities, including on referral from rural hospitals to the national hospital. This only became hospital-wide at the national hospital in July 2026.", "sources": [ { "title": "Preparing for TTM Go-Live: Clinicians Leading the Change (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/preparing-for-ttm-go-live-clinicians-leading-the-change/", "date": "2026-06-03", "publisherClass": "official" }, { "title": "Tamanu electronic health record system goes live at TTM Hospital (Samoa Newshub)", "url": "https://samoanewshub.com/2026/07/23/tamanu-electronic-health-record-system-goes-live-at-ttm-hospital/", "date": "2026-07-23", "publisherClass": "news" }, { "title": "Rural hospitals come online (Samoa Observer)", "url": "https://www.samoaobserver.ws/category/samoa/106872", "date": "2023-11-26", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "The Samoa National Health Research Committee must approve research using health data, checks privacy and consent forms, and requires researchers not to identify individuals. There is no opt-out or consent rule for secondary use of records.", "sources": [ { "title": "Samoa National Health Research Guidelines 2021 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Samoa-National-Health-Research-Guidelines.pdf", "date": "2021", "publisherClass": "official" }, { "title": "Ministry of Health Annual Report FY2023/2024 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2026/05/MOH-ANNUAL-REPORT-FY2023.2024-ENGLISH-FINAL-FINAL.pdf", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 18, "summary": "No rules for clinical AI or medical device software were found. The Ministry's own medicines policy says a regulatory framework for pharmaceuticals is urgently needed and the core drug law dates from 1967.", "sources": [ { "title": "National Medicines Policy and Plan of Action FY2023/24-FY2027/28 (Ministry of Health Samoa)", "url": "https://www.health.gov.ws/wp-content/uploads/2024/06/FINAL-NATIONAL-MEDICINES-POLICY-PLAN-OF-ACTION_MASTER-COPY.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Samoa National Cybersecurity Strategy 2025/26-2030/31 (Ministry of Communications and Information Technology)", "url": "https://mcit.gov.ws/wp-content/uploads/2026/04/SAMOA_NATIONAL_CYBERSECURITY_STRATEGY-2026.pdf", "date": "2025-07", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitution of the Independent State of Samoa, Part II", "level": "National", "year": "1962", "what": "Fundamental rights in Articles 5 to 15; no right to privacy or to information.", "url": "https://www.constituteproject.org/constitution/Samoa_2017.pdf?lang=en" }, { "name": "Telecommunications Act 2005, sections 48 to 51", "level": "National", "year": "2005", "what": "Telecom providers must protect customer information and not use it for undisclosed purposes; government access allowed.", "url": "https://www.regulator.gov.ws/images/Act/TELECOMMUNICATIONS_ACT_2005_-_Eng.pdf" }, { "name": "Ministry of Health Act 2006", "level": "National", "year": "2006", "what": "Sets Ministry functions, including health information, research and consumer complaint systems; no patient data rights.", "url": "https://www.health.gov.ws/wp-content/uploads/2022/07/7Ministry_of_Health_Act_2006_-_Eng.pdf" }, { "name": "Patient Complaint and Grievance Policy 2015", "level": "National", "year": "2015", "what": "Ministry policy, not law; lists rights to confidentiality, access to health information and a medical report.", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Patient-Complaint-and-Grievance-Policy-2015.pdf" }, { "name": "Samoa National Health Research Guidelines 2021", "level": "National", "year": "2021", "what": "Research using health data needs Committee approval, a permit and an undertaking not to identify individuals.", "url": "https://www.health.gov.ws/wp-content/uploads/2023/02/Samoa-National-Health-Research-Guidelines.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "BOL", "name": "Bolivia", "region": "Americas", "overall": 29, "rank": "166=", "likelyRank": "134 to 184", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Bolivian patients can ask for a copy of their record, but with no data protection law or shared record, the hospital holds the keys.", "categories": { "access": { "score": 40, "summary": "A 2008 Health Ministry norm says patients may not be refused access to their record and may get a certified paper or digital copy, but it sets no deadline and asks patients not in hospital for a notarised request. No national patient portal exists.", "sources": [ { "title": "Norma Tecnica para el Manejo del Expediente Clinico, Resolucion Ministerial 0090 (Ministerio de Salud y Deportes)", "url": "https://minsalud.gob.bo/images/Documentacion/redes_salud/NORMA%20TECNICA%20PARA%20EL%20MANEJO%20DEL%20EXPEDIENTE%20CLINICO.pdf", "date": "2008-02-26", "publisherClass": "official" }, { "title": "Ley 3131 del Ejercicio Profesional Medico (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/images/Documentacion/normativa/Ley%203131%20Ejercicio%20Mdico.pdf", "date": "2005-08-08", "publisherClass": "legal_text" }, { "title": "Constitucion Politica del Estado de Bolivia (OAS copy)", "url": "https://www.oas.org/dil/esp/constitucion_bolivia.pdf", "date": "2009-02-07", "publisherClass": "legal_text" }, { "title": "Expediente clinico: propiedad del paciente o de la institucion de salud? (Unifranz)", "url": "https://unifranz.edu.bo/blog/expediente-clinico-propiedad-del-paciente-o-de-la-institucion-de-salud/", "date": "2023-05-23", "publisherClass": "academic" } ] }, "control": { "score": 28, "summary": "Ley 3131 makes medical secrecy a patient right, and the 2008 norm requires the patient's written authorisation before clinical details go to third parties. There is no opt-out, no patient-visible access log, and the facility, not the patient, controls the record.", "sources": [ { "title": "Ley 3131 del Ejercicio Profesional Medico (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/images/Documentacion/normativa/Ley%203131%20Ejercicio%20Mdico.pdf", "date": "2005-08-08", "publisherClass": "legal_text" }, { "title": "Norma Tecnica para el Manejo del Expediente Clinico, Resolucion Ministerial 0090 (Ministerio de Salud y Deportes)", "url": "https://minsalud.gob.bo/images/Documentacion/redes_salud/NORMA%20TECNICA%20PARA%20EL%20MANEJO%20DEL%20EXPEDIENTE%20CLINICO.pdf", "date": "2008-02-26", "publisherClass": "official" }, { "title": "Reglamento del Manejo del Expediente Clinico para Primer Nivel de Atencion (SEDES La Paz)", "url": "https://www.sedeslapaz.gob.bo/wp-content/uploads/2024/10/REGLAMENTO-DEL-MANEJO-DEL-EXPEDIENTE-CLII%C2%81NICO-PARA-EL-PRIMER-NIVEL-DE-ATENCIOI%C2%81N.pdf", "date": "2024-10", "publisherClass": "official" } ] }, "privacy": { "score": 25, "summary": "Bolivia has no general data protection law, no data protection authority and, the Health Ministry says, no duty to report breaches publicly. Protection rests on the Constitution and medical secrecy in Ley 3131; a deputy asked in May 2026 to revive a data protection bill.", "sources": [ { "title": "Ciberseguridad en el Sector Salud (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/9215-ciberseguridad-en-el-sector-salud", "date": "undated", "publisherClass": "official" }, { "title": "Anteproyecto de Ley de Proteccion de Datos Personales, presentacion (AGETIC)", "url": "https://agetic.gob.bo/sites/default/files/2025-06/DATOS-PERSONALES-PRESENTACION-ANTEPROYECTO-DE-LEY-2024-firmado.pdf", "date": "2024", "publisherClass": "official" }, { "title": "PL-538/25, solicitud de reposicion del Proyecto de Ley 605/2024-2025 de Proteccion de Datos Personales (Camara de Diputados)", "url": "https://diputados.gob.bo/wp-content/uploads/2026/07/PL-538-2025-2026.pdf", "date": "2026-05-22", "publisherClass": "legal_text" }, { "title": "Educacion digital y proteccion de datos son claves para fortalecer la privacidad (Red Uno)", "url": "https://www.reduno.com.bo/educacion-e-innovacion/educacion-digital-y-proteccion-de-datos-son-claves-para-fortalecer-la-privacidad-2026527151735", "date": "2026-05-27", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "The Ministry's SUIS digital platform links appointments, referrals and hospital beds in 336 facilities across six departments, not a shared clinical record. A single electronic record is a goal of the 2026-2030 health plan.", "sources": [ { "title": "Ministerio de Salud consolida transformacion digital del sistema (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/9344-ministerio-de-salud-consolida-transformacion-digital-del-sistema", "date": "2026-08-06", "publisherClass": "official" }, { "title": "Ministerio presenta Plan de Salud 2026-2030 (Ministerio de Salud y Deportes)", "url": "https://minsalud.gob.bo/9131-ministerio-presenta-plan-de-salud-2026-2030", "date": "2026-04-29", "publisherClass": "official" }, { "title": "Reglamento del Manejo del Expediente Clinico para Primer Nivel de Atencion (SEDES La Paz)", "url": "https://www.sedeslapaz.gob.bo/wp-content/uploads/2024/10/REGLAMENTO-DEL-MANEJO-DEL-EXPEDIENTE-CLII%C2%81NICO-PARA-EL-PRIMER-NIVEL-DE-ATENCIOI%C2%81N.pdf", "date": "2024-10", "publisherClass": "official" } ] }, "commercial": { "score": 25, "summary": "No Bolivian rule found bars selling health data, using it for marketing, or brokering it. Medical secrecy binds doctors, but apps, brokers and advertisers face no health-data law, and the bill that would regulate marketing use is not law.", "sources": [ { "title": "Anteproyecto de Ley de Proteccion de Datos Personales, presentacion (AGETIC)", "url": "https://agetic.gob.bo/sites/default/files/2025-06/DATOS-PERSONALES-PRESENTACION-ANTEPROYECTO-DE-LEY-2024-firmado.pdf", "date": "2024", "publisherClass": "official" }, { "title": "PL-538/25, solicitud de reposicion del Proyecto de Ley 605/2024-2025 de Proteccion de Datos Personales (Camara de Diputados)", "url": "https://diputados.gob.bo/wp-content/uploads/2026/07/PL-538-2025-2026.pdf", "date": "2026-05-22", "publisherClass": "legal_text" }, { "title": "Ley 3131 del Ejercicio Profesional Medico (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/images/Documentacion/normativa/Ley%203131%20Ejercicio%20Mdico.pdf", "date": "2005-08-08", "publisherClass": "legal_text" } ] }, "clinical": { "score": 22, "summary": "Doctors in another facility usually see only the referral form that travels with the patient. The SUIS platform tracks referrals between 336 facilities, but no national system lets clinicians view a patient's full record across providers.", "sources": [ { "title": "Ministerio de Salud consolida transformacion digital del sistema (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/9344-ministerio-de-salud-consolida-transformacion-digital-del-sistema", "date": "2026-08-06", "publisherClass": "official" }, { "title": "Reglamento del Manejo del Expediente Clinico para Primer Nivel de Atencion (SEDES La Paz)", "url": "https://www.sedeslapaz.gob.bo/wp-content/uploads/2024/10/REGLAMENTO-DEL-MANEJO-DEL-EXPEDIENTE-CLII%C2%81NICO-PARA-EL-PRIMER-NIVEL-DE-ATENCIOI%C2%81N.pdf", "date": "2024-10", "publisherClass": "official" }, { "title": "Ministerio presenta Plan de Salud 2026-2030 (Ministerio de Salud y Deportes)", "url": "https://minsalud.gob.bo/9131-ministerio-presenta-plan-de-salud-2026-2030", "date": "2026-04-29", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "The Constitution bans scientific experiments without consent, Ley 3131 lets patients refuse research, and AGEMED inspects trials against a 2004 norm requiring ethics committee approval. No rules on reusing records for research were found.", "sources": [ { "title": "Constitucion Politica del Estado de Bolivia (OAS copy)", "url": "https://www.oas.org/dil/esp/constitucion_bolivia.pdf", "date": "2009-02-07", "publisherClass": "legal_text" }, { "title": "Ley 3131 del Ejercicio Profesional Medico (Ministerio de Salud y Deportes)", "url": "https://www.minsalud.gob.bo/images/Documentacion/normativa/Ley%203131%20Ejercicio%20Mdico.pdf", "date": "2005-08-08", "publisherClass": "legal_text" }, { "title": "Manual de Inspeccion de Buenas Practicas Clinicas para Medicamentos y Dispositivos Medicos (AGEMED)", "url": "https://www.agemed.gob.bo/normas_consulta/NORMA-2024-02.pdf", "date": "2024", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "Bolivia has no AI law in force and no clinical-AI rules. AGEMED's 2025 diagnostic device manual leaves standalone software outside its scope, and two general AI bills await the Chamber of Deputies.", "sources": [ { "title": "Manual de Registro Sanitario de Dispositivos Medicos de Diagnostico In Vitro, Circular 22-2025 (AGEMED)", "url": "https://www.agemed.gob.bo/circulares/2025/CIRCULAR-22-2025.pdf", "date": "2025", "publisherClass": "official" }, { "title": "PL-288/25, Proyecto de Ley que regula el desarrollo, la implementacion y utilizacion de los sistemas de inteligencia artificial (Camara de Diputados)", "url": "https://diputados.gob.bo/wp-content/uploads/2026/03/PL-288-2025-2026.pdf", "date": "2026-02-26", "publisherClass": "legal_text" }, { "title": "Senado aprueba proyecto de ley para regular el uso de inteligencia artificial en Bolivia (Correo del Sur)", "url": "https://correodelsur.com/politica/20251023/senado-aprueba-proyecto-de-ley-para-regular-el-uso-de-inteligencia-artificial-en-bolivia.html", "date": "2025-10-23", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitucion Politica del Estado", "level": "National", "year": "2009", "what": "Right to privacy; court action to know or correct data; no experiments without consent.", "url": "https://www.oas.org/dil/esp/constitucion_bolivia.pdf" }, { "name": "Ley 3131 del Ejercicio Profesional Medico", "level": "National", "year": "2005", "what": "Patient rights to confidentiality and secrecy; record held by facility for the doctor's use.", "url": "https://www.minsalud.gob.bo/images/Documentacion/normativa/Ley%203131%20Ejercicio%20Mdico.pdf" }, { "name": "Decreto Supremo 28562 (Reglamento a la Ley 3131)", "level": "National", "year": "2005", "what": "Defines the medical record and its contents; requires display of patient rights.", "url": "https://www.lexivox.org/norms/BO-DS-28562.html" }, { "name": "Norma Tecnica para el Manejo del Expediente Clinico (RM 0090)", "level": "National", "year": "2008", "what": "Patient access to a certified record copy; written consent for third-party disclosure.", "url": "https://minsalud.gob.bo/images/Documentacion/redes_salud/NORMA%20TECNICA%20PARA%20EL%20MANEJO%20DEL%20EXPEDIENTE%20CLINICO.pdf" }, { "name": "Norma para Estudios Clinicos (RM 0834)", "level": "National", "year": "2004", "what": "Trials follow ICH good clinical practice with informed consent and ethics committee review.", "url": "https://www.agemed.gob.bo/normas_consulta/NORMA-2024-02.pdf" }, { "name": "Reglamento del Manejo del Expediente Clinico para Primer Nivel (SEDES La Paz)", "level": "Regional", "year": "2024", "what": "Archive access limited to authorised staff; records kept 10 years in active archive.", "url": "https://www.sedeslapaz.gob.bo/wp-content/uploads/2024/10/REGLAMENTO-DEL-MANEJO-DEL-EXPEDIENTE-CLII%C2%81NICO-PARA-EL-PRIMER-NIVEL-DE-ATENCIOI%C2%81N.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-08-13", "headline": "Family says hospital left a patient's record request unanswered; court declines to rule", "paraphrase": "Relatives of an adult patient said in a constitutional claim that a written request for his clinical record went unanswered. His lawyer later acknowledged obtaining copies. The Constitutional Court denied protection without examining the merits.", "source": "Tribunal Constitucional Plurinacional (SCP 0923/2025-S1)", "url": "https://jurisprudenciaconstitucional.com/resolucion/223637-sentencia-constitucional-plurinacional-0923-2025-s1", "theme": "access_delay_or_cost", "status": "alleged" } ] }, { "iso3": "FJI", "name": "Fiji", "region": "Oceania", "overall": 29, "rank": "166=", "likelyRank": "133 to 183", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Fiji guarantees privacy in its Constitution but has no data protection law or regulator, no patient portal and no patient say over sharing.", "categories": { "access": { "score": 35, "summary": "Section 25 of the 2013 Constitution gives a right of access to information held by any public office. No health-specific right to a copy, deadline, fee rule or national patient portal was verified.", "sources": [ { "title": "Constitution of the Republic of Fiji 2013 (University of Nottingham copy)", "url": "https://cjad.nottingham.ac.uk/documents/implementations/pdf/Fiji-_Constitution_2013_EN.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Aspen Medical selects MEDITECH Expanse to advance patient care at Fiji hospitals (MEDITECH)", "url": "https://ehr.meditech.com/news/aspen-medical-selects-meditech-expanse-to-advance-patient-care-at-fiji-hospitals", "date": "2025-10-14", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "Ministry systems such as PATISPlus share records among health workers with no opt-out or patient-visible access log that we found. Only HIV information has a statutory consent rule for disclosure.", "sources": [ { "title": "HIV/AIDS Decree 2011 (Decree No. 5 of 2011), ILO NATLEX copy", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/86222/FJI86222.pdf", "date": "2011", "publisherClass": "legal_text" }, { "title": "Data protection laws in Fiji (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=FJ", "date": "undated", "publisherClass": "law_firm" }, { "title": "New HIV digital module launched to improve patient tracking and care in Fiji (Fijivillage)", "url": "https://www.fijivillage.com/r/new-hiv-digital-module-launched-to-improve-patient-tracking-and-care-in-fiji-d783ba/", "date": "2026-07-10", "publisherClass": "news" }, { "title": "New digital system puts prison health data at fingertips (Fiji Sun)", "url": "https://fijisun.com.fj/living/health/new-digital-system-puts-prison-health-data-at-fingertips", "date": "2026-09-02", "publisherClass": "news" } ] }, "privacy": { "score": 30, "summary": "Fiji has no data protection law, no regulator and no breach notification duty; the Constitution's section 24 right to privacy is the main protection. Cabinet endorsed a national privacy policy in October 2025, but the law it promises was not verified as tabled.", "sources": [ { "title": "Constitution of the Republic of Fiji 2013 (University of Nottingham copy)", "url": "https://cjad.nottingham.ac.uk/documents/implementations/pdf/Fiji-_Constitution_2013_EN.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "HIV/AIDS Decree 2011 (Decree No. 5 of 2011), ILO NATLEX copy", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/86222/FJI86222.pdf", "date": "2011", "publisherClass": "legal_text" }, { "title": "Medical and Dental Practitioner Act 2010 (Fiji College of General Practitioners copy)", "url": "https://fijigp.com/wp-content/uploads/2020/08/Medical_and_Dental_Practitioner_Act_2010.pdf", "date": "2010", "publisherClass": "legal_text" }, { "title": "National privacy and personal data protection policy endorsed by Cabinet (Fijivillage)", "url": "https://www.fijivillage.com/news/National-privacy-and-personal-data-protection-policy-to-safeguard-data-protection-endorsed-by-Cabinet-r8xf54/", "date": "2025-10-11", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "Records are split across PATISPlus, a new immunization registry, separate pharmacy and private-partner hospital systems. An October 2025 study found an electronic record in 44 of 217 Fiji facilities (20.3%).", "sources": [ { "title": "PHIN country experience: Fiji Master Patient Index and Immunization Information System (Pacific Community)", "url": "https://phd.spc.int/sites/default/files/p-related-files/2025-03/Item%2016.2_PHIN%20TP_Country%20Experience_Fiji_0.pdf", "date": "2025-03", "publisherClass": "intergov" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "No more paper: Fiji launches first-ever digital immunization records for every child (UNICEF)", "url": "https://www.unicef.org/pacificislands/press-releases/no-more-paper-fiji-launches-first-ever-digital-immunization-records-every-child", "date": "2026-03-31", "publisherClass": "intergov" }, { "title": "Aspen Medical selects MEDITECH Expanse to advance patient care at Fiji hospitals (MEDITECH)", "url": "https://ehr.meditech.com/news/aspen-medical-selects-meditech-expanse-to-advance-patient-care-at-fiji-hospitals", "date": "2025-10-14", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 20, "summary": "No law limits the sale or marketing use of health data, and no regulator oversees data brokers or health apps. A 2026 Fiji Times column says the consumer regulator has largely let firms send bulk SMS without consent.", "sources": [ { "title": "Data protection laws in Fiji (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=FJ", "date": "undated", "publisherClass": "law_firm" }, { "title": "OPINION: Is your privacy being protected? (Fiji Times)", "url": "https://www.fijitimes.com.fj/opinion-is-your-privacy-being-protected/", "date": "2026-04-05", "publisherClass": "news" }, { "title": "National privacy and personal data protection policy endorsed by Cabinet (Fijivillage)", "url": "https://www.fijivillage.com/news/National-privacy-and-personal-data-protection-policy-to-safeguard-data-protection-endorsed-by-Cabinet-r8xf54/", "date": "2025-10-11", "publisherClass": "news" } ] }, "clinical": { "score": 25, "summary": "Outside the three major hospitals, clinicians often rely on paper. The Health Minister said in July 2026 that patient histories were often rebuilt from paper records and phone calls when patients moved between facilities.", "sources": [ { "title": "PHIN country experience: Fiji Master Patient Index and Immunization Information System (Pacific Community)", "url": "https://phd.spc.int/sites/default/files/p-related-files/2025-03/Item%2016.2_PHIN%20TP_Country%20Experience_Fiji_0.pdf", "date": "2025-03", "publisherClass": "intergov" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "New HIV digital module launched to improve patient tracking and care in Fiji (Fijivillage)", "url": "https://www.fijivillage.com/r/new-hiv-digital-module-launched-to-improve-patient-tracking-and-care-in-fiji-d783ba/", "date": "2026-07-10", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "A national ethics committee reviews health research, and the HIV/AIDS Decree makes its approval mandatory for HIV research. There is no general consent or opt-out rule for secondary use of health records.", "sources": [ { "title": "HIV/AIDS Decree 2011 (Decree No. 5 of 2011), ILO NATLEX copy", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/86222/FJI86222.pdf", "date": "2011", "publisherClass": "legal_text" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" } ] }, "ai": { "score": 18, "summary": "No rules for clinical AI were verified, even as the Ministry installs X-ray machines with built-in AI that flags abnormalities. Fiji has no verified medical device rules for AI software or human oversight duties.", "sources": [ { "title": "Fiji's hospitals go digital with AI equipped X-ray upgrade (Fijivillage)", "url": "https://www.fijivillage.com/news/fiji-s-hospitals-go-digital-with-ai-equipped-x-ray-upgrade-204545/", "date": "2026-01-11", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitution of the Republic of Fiji 2013, sections 24 and 25", "level": "National", "year": "2013", "what": "Right to privacy and confidentiality of personal information; right of access to information held by public offices.", "url": "https://cjad.nottingham.ac.uk/documents/implementations/pdf/Fiji-_Constitution_2013_EN.pdf" }, { "name": "HIV/AIDS Decree 2011 (Decree No. 5 of 2011)", "level": "National", "year": "2011", "what": "Informed consent for HIV testing, confidentiality of HIV status, ethics approval for HIV research.", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/86222/FJI86222.pdf" }, { "name": "Medical and Dental Practitioner Act 2010", "level": "National", "year": "2010", "what": "Licenses doctors; improper disposal of medical records is unprofessional conduct; fines for official disclosures.", "url": "https://fijigp.com/wp-content/uploads/2020/08/Medical_and_Dental_Practitioner_Act_2010.pdf" }, { "name": "National Privacy and Personal Data Protection Policy", "level": "National", "year": "2025", "what": "Cabinet policy, not law; lays groundwork for a data protection act and Convention 108+ accession.", "url": "https://www.fijivillage.com/news/National-privacy-and-personal-data-protection-policy-to-safeguard-data-protection-endorsed-by-Cabinet-r8xf54/" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-08-03", "headline": "Hospital staff allegedly opened a well-known patient's records without a care reason", "paraphrase": "The outlet reports indications that several staff at a public hospital in western Fiji opened a prominent patient's medical records to check public reports about their health. The hospital operator said patient confidentiality is of the utmost importance.", "source": "fijivillage", "url": "https://www.fijivillage.com/news/A-number-of-medical-staff-allegedly-access-medical-records-of-Aiyaz-Sayed-Khaiyum-845frx/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "GUY", "name": "Guyana", "region": "Americas", "overall": 29, "rank": "166=", "likelyRank": "131 to 182", "band": "Weak", "keysModel": "State", "confidence": "high", "headline": "Guyana began a national electronic health record in 2026, but its 2023 data protection law still has no commencement order.", "categories": { "access": { "score": 30, "summary": "The Data Protection Act 2023 promises a free copy within one month, but no commencement order had been shown by September 2026. The 2011 Access to Information Act reaches public hospital files, slowly, so this sits near the top of the no-enforceable-right band.", "sources": [ { "title": "Data Protection Act 2023 (Act No. 18 of 2023), Official Gazette Legal Supplement A", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023", "date": "2023-08-16", "publisherClass": "legal_text" }, { "title": "Access to Information Act 2011 (Act No. 21 of 2011)", "url": "https://documentosexternos.cepal.org/bitstreams/5df930e0-3cfb-4bfe-b5a1-5f7e5af829f8/download", "date": "2011", "publisherClass": "legal_text" }, { "title": "500 appointments booked since e-health app launch (Department of Public Information)", "url": "https://dpi.gov.gy/500-appointments-booked-since-e-health-app-launch/", "date": "2026-03-18", "publisherClass": "official" }, { "title": "A Portal Before a Protector (592 Guardian)", "url": "https://592guardian.com/a-portal-before-a-protector/", "date": "2026-09-30", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "The new EHR follows a \"one patient, one record\" rule across public facilities, with no opt-out and no access log a patient can see. Access is role-based and staff entries are traceable, but the consent rules of the 2023 Act are not in force.", "sources": [ { "title": "Transforming Healthcare Delivery in Guyana (Georgetown Public Hospital Corporation)", "url": "https://gphc.gov.gy/release/transforming-healthcare-delivery-in-guyana/", "date": "2026-02-12", "publisherClass": "official" }, { "title": "Patients commend e-health system at Festival City Polyclinic (Department of Public Information)", "url": "https://dpi.gov.gy/patients-commend-e-health-system-at-festival-city-polyclinic/", "date": "2026-03-23", "publisherClass": "official" }, { "title": "Data Protection Act 2023 (Act No. 18 of 2023), Official Gazette Legal Supplement A", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023", "date": "2023-08-16", "publisherClass": "legal_text" } ] }, "privacy": { "score": 30, "summary": "With the 2023 Act not commenced, no data protection office enforces anything yet, so this sits below the general-law band. A Commissioner was appointed in 2026 but also runs the digital ID registry, and no health data breach was found.", "sources": [ { "title": "Data Protection Act 2023 (Act No. 18 of 2023), Official Gazette Legal Supplement A", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023", "date": "2023-08-16", "publisherClass": "legal_text" }, { "title": "Guyana does have a Data Protection Act (letter from the Data Protection Commissioner, Guyana Times)", "url": "https://guyanatimesgy.com/guyana-does-have-a-data-protection-act/", "date": "2026-05-15", "publisherClass": "news" }, { "title": "Patients' digital info is secured, health minister (Demerara Waves)", "url": "https://demerarawaves.com/2025/12/02/patients-digital-info-is-secured-health-minister/", "date": "2025-12-02", "publisherClass": "news" }, { "title": "Former top GECOM official now data commissioner (Demerara Waves)", "url": "https://demerarawaves.com/2026/02/07/former-top-gecom-official-now-data-commissioner/", "date": "2026-02-07", "publisherClass": "news" } ] }, "journey": { "score": 35, "summary": "A national EHR built by RioMed went live at one Georgetown polyclinic in January 2026 and was being phased into Georgetown Public Hospital from June. Lab reports, diagnostic results and prescriptions are linked at those sites, but most facilities were not yet connected.", "sources": [ { "title": "Seamless transfers, efficient diagnosis promised with National Electronic Health Record System (News Room Guyana)", "url": "https://newsroom.gy/2026/01/17/seamless-transfers-efficient-diagnosis-promised-with-national-electronic-health-record-system/", "date": "2026-01-17", "publisherClass": "news" }, { "title": "Transforming Healthcare Delivery in Guyana (Georgetown Public Hospital Corporation)", "url": "https://gphc.gov.gy/release/transforming-healthcare-delivery-in-guyana/", "date": "2026-02-12", "publisherClass": "official" }, { "title": "EHR rollout to modernise patient care at GPHC (Department of Public Information)", "url": "https://dpi.gov.gy/ehr-rollout-to-modernise-patient-care-at-gphc/", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Over 100,000 children to benefit from lifelong digital health records, President Ali (Department of Public Information)", "url": "https://dpi.gov.gy/over-100000-children-to-benefit-from-lifelong-digital-health-records-president-ali/", "date": "2026-03-01", "publisherClass": "official" } ] }, "commercial": { "score": 25, "summary": "No law in force limits the sale or marketing use of health data. The 2023 Act would make health records sensitive data, give a right to stop direct marketing and punish selling unlawfully obtained data, but it has not started.", "sources": [ { "title": "Data Protection Act 2023 (Act No. 18 of 2023), Official Gazette Legal Supplement A", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023", "date": "2023-08-16", "publisherClass": "legal_text" }, { "title": "Digital ID law now active, but data protection act still not operational (Demerara Waves)", "url": "https://demerarawaves.com/2026/03/31/digital-identity-card-law-now-active-but-data-protection-act-still-not-operational/", "date": "2026-03-31", "publisherClass": "news" } ] }, "clinical": { "score": 30, "summary": "Clinicians at Festival City Polyclinic, about 128 assessments a day, and in GPHC departments as they come online see one unified record. Elsewhere in the public system and in private practice, records are still paper or separate.", "sources": [ { "title": "500 appointments booked since e-health app launch (Department of Public Information)", "url": "https://dpi.gov.gy/500-appointments-booked-since-e-health-app-launch/", "date": "2026-03-18", "publisherClass": "official" }, { "title": "EHR rollout to modernise patient care at GPHC (Department of Public Information)", "url": "https://dpi.gov.gy/ehr-rollout-to-modernise-patient-care-at-gphc/", "date": "2026-06-27", "publisherClass": "official" }, { "title": "Guyana's electronic health records system goes live (Demerara Waves)", "url": "https://demerarawaves.com/2026/01/17/guyanas-electronic-health-records-system-goes-live/", "date": "2026-01-17", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "No consent rule or opt-out governs research use of health data, since the 2023 Act is not in force. One safeguard counts: the Ministry of Health's Institutional Review and Ethics Board reviews research involving human participants, material and data.", "sources": [ { "title": "Institutional Review and Ethics Board (IRB) (Ministry of Health Guyana)", "url": "https://health.gov.gy/institutional-review-and-ethics-board-irb/", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Act 2023 (Act No. 18 of 2023), Official Gazette Legal Supplement A", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023", "date": "2023-08-16", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found, yet public hospitals already use AI. Enmore hospital pilots AI reading of X-rays, and about 300 physicians are to test the OpenEvidence tool.", "sources": [ { "title": "Guyana moving to predictive healthcare through AI, Min Anthony (Department of Public Information)", "url": "https://dpi.gov.gy/guyana-moving-to-predictive-healthcare-through-ai-min-anthony/", "date": "2026-04-23", "publisherClass": "official" }, { "title": "Guyana using AI to read X-rays (Demerara Waves)", "url": "https://demerarawaves.com/2026/01/17/guyana-using-artificial-intelligence-to-read-x-rays/", "date": "2026-01-17", "publisherClass": "news" }, { "title": "AI, digital pharmacy take centre stage at Pharmacists' Symposium (News Room Guyana)", "url": "https://newsroom.gy/2026/09/21/ai-digital-pharmacy-take-centre-stage-at-pharmacists-symposium/", "date": "2026-09-21", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act 2023 (Act No. 18 of 2023)", "level": "National", "year": "2023", "what": "Health records are sensitive data; free copy within one month, 72-hour breach notice. No commencement order shown.", "url": "https://parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023" }, { "name": "Access to Information Act 2011 (Act No. 21 of 2011)", "level": "National", "year": "2011", "what": "Right to official documents of public authorities, including Regional Health Authorities, via the Commissioner of Information.", "url": "https://documentosexternos.cepal.org/bitstreams/5df930e0-3cfb-4bfe-b5a1-5f7e5af829f8/download" }, { "name": "Digital Identity Card Act 2023 (Act No. 19 of 2023)", "level": "National", "year": "2023", "what": "National digital ID, in force since 31 March 2026; registry run by the Data Protection Commissioner.", "url": "https://parliament.gov.gy/publications/acts-of-parliament/digitalidentitycardact19of2023" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-09-11", "headline": "Public hospital apologises after staff member films patient and video spreads online", "paraphrase": "A video of an adult patient filmed inside the hospital without permission circulated online. The hospital said a technician was the suspect, called it a violation of patient privacy, apologised, and referred the matter to police.", "source": "iNews Guyana", "url": "https://inewsguyana.com/police-to-probe-gphc-staff-over-unauthorised-video-of-patient-receiving-emergency-care/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "KIR", "name": "Kiribati", "region": "Oceania", "overall": 29, "rank": "166=", "likelyRank": "134 to 183", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Kiribati passed a data protection law in 2025 but no start date was verified, and only its main hospitals keep electronic records.", "categories": { "access": { "score": 30, "summary": "The Data Protection Act 2025 gives a right to a free electronic copy of personal data, but no commencement notice was found, so it is not verified as in force. There is no patient portal.", "sources": [ { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Digital Government Act 2023 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Digital%20Government%20Act%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Data Protection Act 2025, automated decisions (LexLint)", "url": "https://lexlint.io/l/ki-data-protection-2025-s-17-right-not-be-subjec", "date": "2026-09-26", "publisherClass": "blog_vendor" }, { "title": "AI Regulation in Kiribati: What Applies (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-kiribati", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "control": { "score": 28, "summary": "Hospital records are shared among staff in the Tamanu system, with no patient opt-out or patient-visible access log found. A 2023 law requires written consent before others access personal data held by public bodies; whether it covers health staff was not verified.", "sources": [ { "title": "Digital Government Act 2023 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Digital%20Government%20Act%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Supporting maternal health care in Kiribati (BES International)", "url": "https://www.bes.au/supporting-maternal-health-care-in-kiribati/", "date": "2026-04-14", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 32, "summary": "Kiribati passed a Data Protection Act in 2025 with breach notification and penalties up to $100,000, but its commencement was not verified, so this sits below the general-law band. No health-specific confidentiality law was found, and the enforcer is an office inside a ministry.", "sources": [ { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Digital Government Act 2023 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Digital%20Government%20Act%202023.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Constitution of Kiribati (Constitute Project copy)", "url": "https://www.constituteproject.org/constitution/Kiribati_2013?lang=en", "date": "2013", "publisherClass": "legal_text" }, { "title": "Medical Services Act 1996 (Kiribati Trade Portal copy)", "url": "https://kiribati.tradeportal.org/Home/DownloadFile?filePath=%2Fmedia%2Fmsa1996153.pdf&l=en", "date": "1996", "publisherClass": "legal_text" } ] }, "journey": { "score": 28, "summary": "A 2024 scan found an electronic record in 2 of 116 Kiribati facilities (1.7%). The vendor says Tungaru Central Hospital runs Tamanu in emergency and in maternity clinics and wards, while outer islands are only now getting DHIS2 reporting.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Ministry of Health and Medical Services, Kiribati National Health Strategic Plan 2020-2023 (WHO FCTC copy)", "url": "https://extranet.who.int/fctcapps/sites/default/files/2024-04/391_KIR%20MHMS%20strategic%20plan%20FINAL%20%2814Oct2022%29.pdf", "date": "2022-10", "publisherClass": "official" }, { "title": "Supporting maternal health care in Kiribati (BES International)", "url": "https://www.bes.au/supporting-maternal-health-care-in-kiribati/", "date": "2026-04-14", "publisherClass": "blog_vendor" }, { "title": "WHO vacancy: Consultant DHIS2 optimization and expansion, Kiribati (Impactpool copy)", "url": "https://www.impactpool.org/jobs/1191603", "date": "2026-01", "publisherClass": "intergov" } ] }, "commercial": { "score": 25, "summary": "No law in force limits the sale or marketing use of health data, and no regulator oversees data brokers or health apps. The 2025 Act would require a lawful basis for processing, but its commencement was not verified.", "sources": [ { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "Health Service Delivery Profile, Kiribati 2012 (Ministry of Finance and Economic Development copy)", "url": "https://mfed.gov.ki/sites/default/files/2025-06/Microsoft%20Word%20-%20Kiribati%20health%20service%20delivery%20profile_V5.docx%20-%20Service%20delivery%20profile%20Kiribati.pdf", "date": "2012", "publisherClass": "official" }, { "title": "AI Regulation in Kiribati: What Applies (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-kiribati", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 27, "summary": "Clinicians at Tungaru Central Hospital can see emergency and maternity history in Tamanu, the vendor says, but this is not verified by the Ministry. A 2024 scan found no electronic record in Kiribati primary care.", "sources": [ { "title": "Supporting maternal health care in Kiribati (BES International)", "url": "https://www.bes.au/supporting-maternal-health-care-in-kiribati/", "date": "2026-04-14", "publisherClass": "blog_vendor" }, { "title": "TamanuEMR is live in the Kiribati national hospital's Emergency Department (BES International, LinkedIn)", "url": "https://www.linkedin.com/posts/beyond-essential-systems_tamanuemr-kiribati-kiribati-activity-7266895934385467392-6Yny", "date": "2024-11-25", "publisherClass": "blog_vendor" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Ministry of Health and Medical Services, Kiribati National Health Strategic Plan 2020-2023 (WHO FCTC copy)", "url": "https://extranet.who.int/fctcapps/sites/default/files/2024-04/391_KIR%20MHMS%20strategic%20plan%20FINAL%20%2814Oct2022%29.pdf", "date": "2022-10", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "A 2025 regional review says Kiribati requires ethics review, enacted a research law in 2023 and has a national research committee, but no ethics committee. There is no consent or opt-out rule for secondary use of records.", "sources": [ { "title": "The Pacific Way: advancing ethical research governance in the Pacific islands (Lancet Regional Health Western Pacific, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12756169/", "date": "2025-12-11", "publisherClass": "academic" }, { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found. The 2025 Data Protection Act gives a right not to face decisions based solely on automated processing, but it is not verified as in force.", "sources": [ { "title": "Data Protection Act 2025 (Ministry of Information, Communications and Transport)", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf", "date": "2025-09-18", "publisherClass": "legal_text" }, { "title": "AI Regulation in Kiribati: What Applies (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-kiribati", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Data Protection Act 2025", "level": "National", "year": "2025", "what": "Access, correction and consent rights, breach notification, penalties; starts on ministerial notice, not verified in force.", "url": "https://www.mict.gov.ki/sites/default/files/publications/Data%20Protection%20Act%202025.pdf" }, { "name": "Digital Government Act 2023", "level": "National", "year": "2023", "what": "Creates the Digital Transformation Office; written consent before others access personal data held by public bodies.", "url": "https://www.mict.gov.ki/sites/default/files/publications/Digital%20Government%20Act%202023.pdf" }, { "name": "Cybersecurity Act 2026", "level": "National", "year": "2026", "what": "Healthcare systems may be designated critical infrastructure; operators must manage risks and report incidents.", "url": "https://www.mict.gov.ki/sites/default/files/publications/Kiribati_Cybersecurity_Act_2026.pdf" }, { "name": "Constitution of Kiribati, section 9", "level": "National", "year": "1979", "what": "Protects against search of person or property and entry on premises without consent; no information privacy right.", "url": "https://www.constituteproject.org/constitution/Kiribati_2013?lang=en" }, { "name": "Medical Services Act 1996", "level": "National", "year": "1996", "what": "Registration and discipline of doctors and nurses; no patient record rules found.", "url": "https://kiribati.tradeportal.org/Home/DownloadFile?filePath=%2Fmedia%2Fmsa1996153.pdf&l=en" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "LAO", "name": "Laos", "region": "Asia", "overall": 29, "rank": "166=", "likelyRank": "133 to 183", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Laos protects electronic data and patient confidentiality on paper, but patients cannot get their records and no shared health record exists.", "categories": { "access": { "score": 25, "summary": "No law gives patients a right to a copy of their medical record. The 2017 Electronic Data Protection Law lets people access their own electronic data, but most records are not electronic and there is no national portal.", "sources": [ { "title": "Law on Health Care (amended), 2023 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/5.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B4%E0%BB%88%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%A7-2023.pdf", "date": "2023-11-20", "publisherClass": "legal_text" }, { "title": "Law on Electronic Data Protection No. 25/NA, 2017 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/57.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%81%E0%BA%9B%E0%BB%89%E0%BA%AD%E0%BA%87%E0%BA%82%E0%BB%8D%E0%BB%89%E0%BA%A1%E0%BA%B9%E0%BA%99%E0%BB%80%E0%BA%AD%E0%BB%80%E0%BA%A5%E0%BA%B1%E0%BA%81%E0%BB%82%E0%BA%95%E0%BA%A3%E0%BA%99%E0%BA%B4%E0%BA%81-2017.pdf", "date": "2017-05-12", "publisherClass": "legal_text" }, { "title": "Lao PDR Digital Health Strategy 2023-2027, Ministry of Health (WHO repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/LAO_Lao_People-Digital-Health-Strategy_2023-2027.pdf", "date": "2023", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "The data law requires the owner's permission before personal data is used or passed on, unless another law says otherwise or a competent state body asks for it. We found no opt-out, no granular choices and no access log patients can see.", "sources": [ { "title": "Law on Electronic Data Protection No. 25/NA, 2017 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/57.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%81%E0%BA%9B%E0%BB%89%E0%BA%AD%E0%BA%87%E0%BA%82%E0%BB%8D%E0%BB%89%E0%BA%A1%E0%BA%B9%E0%BA%99%E0%BB%80%E0%BA%AD%E0%BB%80%E0%BA%A5%E0%BA%B1%E0%BA%81%E0%BB%82%E0%BA%95%E0%BA%A3%E0%BA%99%E0%BA%B4%E0%BA%81-2017.pdf", "date": "2017-05-12", "publisherClass": "legal_text" }, { "title": "Lao PDR Digital Health Strategy 2023-2027, Ministry of Health (WHO repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/LAO_Lao_People-Digital-Health-Strategy_2023-2027.pdf", "date": "2023", "publisherClass": "official" } ] }, "privacy": { "score": 35, "summary": "The health care law makes practitioners keep patient information confidential, and the 2017 data law fines breaches 15 million kip. The regulator is a ministry, breach notification is not mandatory, and we found no health-sector enforcement.", "sources": [ { "title": "Law on Health Care (amended), 2023 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/5.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B4%E0%BB%88%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%A7-2023.pdf", "date": "2023-11-20", "publisherClass": "legal_text" }, { "title": "Law on Electronic Data Protection No. 25/NA, 2017 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/57.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%81%E0%BA%9B%E0%BB%89%E0%BA%AD%E0%BA%87%E0%BA%82%E0%BB%8D%E0%BB%89%E0%BA%A1%E0%BA%B9%E0%BA%99%E0%BB%80%E0%BA%AD%E0%BB%80%E0%BA%A5%E0%BA%B1%E0%BA%81%E0%BB%82%E0%BA%95%E0%BA%A3%E0%BA%99%E0%BA%B4%E0%BA%81-2017.pdf", "date": "2017-05-12", "publisherClass": "legal_text" }, { "title": "Data protection laws in Laos (DLA Piper, Tilleke & Gibbins)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=LA", "date": "2026-03-27", "publisherClass": "law_firm" }, { "title": "Adequacy decisions, European Commission", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 26, "summary": "DHIS2 has carried national health reporting since 2013, and an electronic immunisation registry now runs nationwide on it. Patient records are not linked across facilities: electronic records were pilots at two provincial hospitals, and insurance tracking ran on Excel.", "sources": [ { "title": "Lao PDR Digital Health Strategy 2023-2027, Ministry of Health (WHO repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/LAO_Lao_People-Digital-Health-Strategy_2023-2027.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Strengthening Immunisation Data Systems: evaluation of the Lao Electronic Immunisation Registry (npj Digital Public Health)", "url": "https://www.nature.com/articles/s44482-026-00018-6", "date": "2026-05-06", "publisherClass": "academic" }, { "title": "Military Medical Services Advance with Launch of Modern Hospital Information System (KPL)", "url": "https://kpl.gov.la/En/detail.aspx/detail.aspx?id=96284", "date": "2025-12-31", "publisherClass": "news" }, { "title": "Standing with science: Turning data into better health for all (WHO Lao PDR)", "url": "https://www.who.int/laos/news/commentaries/detail/standing-with-science--turning-data-into-better-health-for-all", "date": "2026-04-07", "publisherClass": "intergov" } ] }, "commercial": { "score": 35, "summary": "Personal data may not go to third parties without the owner's permission, and the health insurance law bans disclosing members' data. No law bans selling health data, de-identified data or health app data outright.", "sources": [ { "title": "Law on Electronic Data Protection No. 25/NA, 2017 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/57.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%81%E0%BA%9B%E0%BB%89%E0%BA%AD%E0%BA%87%E0%BA%82%E0%BB%8D%E0%BB%89%E0%BA%A1%E0%BA%B9%E0%BA%99%E0%BB%80%E0%BA%AD%E0%BB%80%E0%BA%A5%E0%BA%B1%E0%BA%81%E0%BB%82%E0%BA%95%E0%BA%A3%E0%BA%99%E0%BA%B4%E0%BA%81-2017.pdf", "date": "2017-05-12", "publisherClass": "legal_text" }, { "title": "Law on Health Insurance, 2018 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/32.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B0%E0%BA%81%E0%BA%B1%E0%BA%99%E0%BA%AA%E0%BA%B8%E0%BA%82%E0%BA%B0%E0%BA%9E%E0%BA%B2%E0%BA%9A-2019.pdf", "date": "2018-12-13", "publisherClass": "legal_text" } ] }, "clinical": { "score": 20, "summary": "A treating clinician cannot look up a patient's record from another hospital; there is no shared record. The health care law only requires the referring facility to send a copy of the treatment record when a patient moves.", "sources": [ { "title": "Law on Health Care (amended), 2023 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/5.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B4%E0%BB%88%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%A7-2023.pdf", "date": "2023-11-20", "publisherClass": "legal_text" }, { "title": "Lao PDR Digital Health Strategy 2023-2027, Ministry of Health (WHO repository)", "url": "https://extranet.who.int/countryplanningcycles/sites/default/files/public_file_rep/LAO_Lao_People-Digital-Health-Strategy_2023-2027.pdf", "date": "2023", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "Health research needs approval from an ethics committee, and clinical trials need the National Ethics Committee for Health Research. Rules for reusing routine health data, including whether consent applies, were not verified, which holds the score in the lower half of its band.", "sources": [ { "title": "Law on Public Health, 2023 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/42.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%AA%E0%BA%B2%E0%BA%97%E0%BA%B2%E0%BA%A5%E0%BA%B0%E0%BA%99%E0%BA%B0%E0%BA%AA%E0%BA%B8%E0%BA%81-2023.pdf", "date": "2023-07-17", "publisherClass": "legal_text" }, { "title": "Law on Drugs and Medical Products (amended), 2025 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/2.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%A2%E0%BA%B2-%E0%BB%81%E0%BA%A5%E0%BA%B0-%E0%BA%9C%E0%BA%B0%E0%BA%A5%E0%BA%B4%E0%BA%94%E0%BA%95%E0%BA%B0%E0%BA%9E%E0%BA%B1%E0%BA%99%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BB%81%E0%BA%9E%E0%BA%94-2025.pdf", "date": "2025-06", "publisherClass": "legal_text" }, { "title": "Law on Health Care (amended), 2023 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/5.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B4%E0%BB%88%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%A7-2023.pdf", "date": "2023-11-20", "publisherClass": "legal_text" } ] }, "ai": { "score": 35, "summary": "Laos has no AI law and no rules for how clinical AI is used. The 2025 drugs law counts software as a medical device and puts devices containing artificial intelligence in the high-risk class, but sets no change control or oversight duties.", "sources": [ { "title": "Law on Drugs and Medical Products (amended), 2025 (National Assembly of Lao PDR, in Lao)", "url": "https://na.gov.la/wp-content/uploads/2021/11/2.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%A2%E0%BA%B2-%E0%BB%81%E0%BA%A5%E0%BA%B0-%E0%BA%9C%E0%BA%B0%E0%BA%A5%E0%BA%B4%E0%BA%94%E0%BA%95%E0%BA%B0%E0%BA%9E%E0%BA%B1%E0%BA%99%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BB%81%E0%BA%9E%E0%BA%94-2025.pdf", "date": "2025-06", "publisherClass": "legal_text" }, { "title": "Laos, China partner in study of AI use in healthcare (Vientiane Times via Asia News Network)", "url": "https://asianews.network/laos-china-partner-in-study-of-ai-use-in-healthcare/", "date": "2026-02-19", "publisherClass": "news" } ] } }, "laws": [ { "name": "Law on Electronic Data Protection (No. 25/NA)", "level": "National", "year": "2017", "what": "Consent to use or share electronic personal data; access, correction and deletion rights; 15 million kip fine.", "url": "https://na.gov.la/wp-content/uploads/2021/11/57.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%81%E0%BA%9B%E0%BB%89%E0%BA%AD%E0%BA%87%E0%BA%82%E0%BB%8D%E0%BB%89%E0%BA%A1%E0%BA%B9%E0%BA%99%E0%BB%80%E0%BA%AD%E0%BB%80%E0%BA%A5%E0%BA%B1%E0%BA%81%E0%BB%82%E0%BA%95%E0%BA%A3%E0%BA%99%E0%BA%B4%E0%BA%81-2017.pdf" }, { "name": "Law on Health Care (amended)", "level": "National", "year": "2023", "what": "Patient confidentiality, duty to inform patients, record systems in every facility. In force 9 January 2024.", "url": "https://na.gov.la/wp-content/uploads/2021/11/5.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B4%E0%BB%88%E0%BA%99%E0%BA%9B%E0%BA%BB%E0%BA%A7-2023.pdf" }, { "name": "Law on Public Health", "level": "National", "year": "2023", "what": "Ministry runs the electronic health information system; research needs ethics committee approval.", "url": "https://na.gov.la/wp-content/uploads/2021/11/42.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%AA%E0%BA%B2%E0%BA%97%E0%BA%B2%E0%BA%A5%E0%BA%B0%E0%BA%99%E0%BA%B0%E0%BA%AA%E0%BA%B8%E0%BA%81-2023.pdf" }, { "name": "Law on Health Insurance", "level": "National", "year": "2018", "what": "Insurance offices and facilities must keep members' treatment data confidential.", "url": "https://na.gov.la/wp-content/uploads/2021/11/32.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BA%9B%E0%BA%B0%E0%BA%81%E0%BA%B1%E0%BA%99%E0%BA%AA%E0%BA%B8%E0%BA%82%E0%BA%B0%E0%BA%9E%E0%BA%B2%E0%BA%9A-2019.pdf" }, { "name": "Law on Drugs and Medical Products (amended)", "level": "National", "year": "2025", "what": "Software counts as a medical device; devices containing AI are high risk; trials need national ethics approval.", "url": "https://na.gov.la/wp-content/uploads/2021/11/2.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%A2%E0%BA%B2-%E0%BB%81%E0%BA%A5%E0%BA%B0-%E0%BA%9C%E0%BA%B0%E0%BA%A5%E0%BA%B4%E0%BA%94%E0%BA%95%E0%BA%B0%E0%BA%9E%E0%BA%B1%E0%BA%99%E0%BA%81%E0%BA%B2%E0%BA%99%E0%BB%81%E0%BA%9E%E0%BA%94-2025.pdf" }, { "name": "Law on Cybersecurity", "level": "National", "year": "2025", "what": "Critical infrastructure protection and incident reporting; in force 1 September 2025.", "url": "https://na.gov.la/wp-content/uploads/2021/11/79.-%E0%BA%81%E0%BA%BB%E0%BA%94%E0%BB%9D%E0%BA%B2%E0%BA%8D%E0%BA%A7%E0%BB%88%E0%BA%B2%E0%BA%94%E0%BB%89%E0%BA%A7%E0%BA%8D%E0%BA%84%E0%BA%A7%E0%BA%B2%E0%BA%A1%E0%BA%9B%E0%BA%AD%E0%BA%94%E0%BB%84%E0%BA%9E%E0%BB%84%E0%BA%8A%E0%BB%80%E0%BA%9A%E0%BA%B5-2025.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "TTO", "name": "Trinidad and Tobago", "region": "Americas", "overall": 29, "rank": "166=", "likelyRank": "132 to 182", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Most of the 2011 Data Protection Act has never come into force, so patients rely on freedom of information requests and mostly paper hospital files.", "categories": { "access": { "score": 35, "summary": "Public patients can get their hospital file through a Freedom of Information Act request, decided within 30 days, but copies carry a fee. Private clinics are not covered because the data protection rules for business were never brought into force, and there is no portal.", "sources": [ { "title": "Freedom of Information Act, Chap. 22:02, with Fees and Charges Regulations (Ministry of the Attorney General, unofficial revision)", "url": "https://www.finance.gov.tt/wp-content/uploads/2019/07/The-Freedom-of-Information-Act.pdf", "date": "2015", "publisherClass": "legal_text" }, { "title": "Patient Service, Medical Records Department (South West Regional Health Authority)", "url": "https://www.swrha.co.tt/patient-service", "date": "undated", "publisherClass": "official" }, { "title": "Patient Charter (South West Regional Health Authority)", "url": "https://www.swrha.co.tt/patient-charter", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "The Act's rule that public bodies need consent to process health data, and may disclose medical information only with consent or a court order, is not in force. No opt-out from sharing and no patient-visible access log were found.", "sources": [ { "title": "Data Protection Act, Chap. 22:04 (Ministry of the Attorney General, unofficial revision)", "url": "http://laws.gov.tt/ttdll-web/revision/download/91970?type=act", "date": "2015", "publisherClass": "legal_text" }, { "title": "Motion: Proclaim the remaining sections of the Data Protection Act (Parliament of Trinidad and Tobago)", "url": "https://www.ttparliament.org/motions/proclaim-the-remaining-sections-of-the-data-protection-act/", "date": "2023-03-28", "publisherClass": "official" }, { "title": "Legal Notice No. 220 of 2021: Proclamation bringing section 42(a) and (b) of the Data Protection Act into operation (Government Printer, DataGuidance copy)", "url": "https://www.dataguidance.com/sites/default/files/ln2021_220.pdf", "date": "2021-08-20", "publisherClass": "legal_text" }, { "title": "Patient Charter (South West Regional Health Authority)", "url": "https://www.swrha.co.tt/patient-charter", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 28, "summary": "Health data is sensitive under the 2011 Act, but the duties on data holders, enforcement and penalties have not been proclaimed and the Information Commissioner is not operating. A 2023 ransomware attack pushed the South West RHA's medical records onto paper, with no regulator to act.", "sources": [ { "title": "External Resources: Data Protection Laws, Trinidad and Tobago (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-tt", "date": "undated", "publisherClass": "academic" }, { "title": "Motion: Proclaim the remaining sections of the Data Protection Act (Parliament of Trinidad and Tobago)", "url": "https://www.ttparliament.org/motions/proclaim-the-remaining-sections-of-the-data-protection-act/", "date": "2023-03-28", "publisherClass": "official" }, { "title": "Breach of Confidence and Privacy Law in Trinidad and Tobago (Martin George)", "url": "https://martingeorge.net/v2/index.php/2024/01/26/breach-of-confidence-the-right-to-privacy-the-progression-of-the-law-and-modern-society/", "date": "2026-04-24", "publisherClass": "law_firm" }, { "title": "SWRHA battles European hacker to save its system (Trinidad Guardian)", "url": "http://www.guardian.co.tt/news/swrha-battles-european-hacker-to-save-its-system-6.2.1852801.718fb8c20d", "date": "2023-11-15", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "A July 2026 PAHO datathon mapped data silos across the five RHAs and named paper records as a barrier. The minister cites electronic prescriptions, digital imaging and vaccination records, but a national system with a Health ID is still being planned.", "sources": [ { "title": "Trinidad and Tobago Advances Digital Health and Data Governance with National Public Health Datathon (PAHO)", "url": "https://www.paho.org/en/news/10-7-2026-trinidad-and-tobago-advances-digital-health-and-data-governance-national-public", "date": "2026-07-10", "publisherClass": "intergov" }, { "title": "Countries of the Americas advance a health sector digital highway to connect care across borders (PAHO)", "url": "https://www.paho.org/en/news/29-9-2026-countries-americas-advance-health-sector-digital-highway-connect-care-across-borders", "date": "2026-09-29", "publisherClass": "intergov" }, { "title": "Budget Statement 2026: T&T First (Ministry of Finance)", "url": "https://www.finance.gov.tt/wp-content/uploads/2025/10/Budget-Statement-FY-2026-2.pdf", "date": "2025-10-13", "publisherClass": "official" }, { "title": "Govt eyes digitisation of public health records (Trinidad Guardian)", "url": "http://www.guardian.co.tt/news/govt-eyes-digitisation-of-public-health-records-6.2.2664076.79b5e04f7f", "date": "2026-09-10", "publisherClass": "news" } ] }, "commercial": { "score": 28, "summary": "The Act's rules for private businesses, including limits on using personal data beyond its purpose, are not in force. In March 2026 the Court of Appeal ruled there is no privacy claim between private parties, leaving breach of confidence as the main remedy.", "sources": [ { "title": "Data Protection Act, Chap. 22:04 (Ministry of the Attorney General, unofficial revision)", "url": "http://laws.gov.tt/ttdll-web/revision/download/91970?type=act", "date": "2015", "publisherClass": "legal_text" }, { "title": "Court of Appeal judges say privacy law may need updating (Trinidad Guardian)", "url": "http://www.guardian.co.tt/news/court-of-appeal-judges-say-privacy-law-may-need-updating-6.2.2536153.841b36b28d", "date": "2026-03-11", "publisherClass": "news" }, { "title": "Breach of Confidence and Privacy Law in Trinidad and Tobago (Martin George)", "url": "https://martingeorge.net/v2/index.php/2024/01/26/breach-of-confidence-the-right-to-privacy-the-progression-of-the-law-and-modern-society/", "date": "2026-04-24", "publisherClass": "law_firm" } ] }, "clinical": { "score": 25, "summary": "Hospital records are largely on paper and held by each RHA. In June 2025 staff said San Fernando General Hospital's records were scattered across locations and incomplete, and a regional board chair asked the minister in 2026 to digitise records.", "sources": [ { "title": "Minister vows to investigate woes at Medical Records Dept of SFGH (Trinidad Guardian)", "url": "http://www.guardian.co.tt/news/minister-vows-to-investigate-woes-at-medical-records-dept-of-sfgh-6.2.2323937.c5a86552e6", "date": "2025-06-04", "publisherClass": "news" }, { "title": "Govt eyes digitisation of public health records (Trinidad Guardian)", "url": "http://www.guardian.co.tt/news/govt-eyes-digitisation-of-public-health-records-6.2.2664076.79b5e04f7f", "date": "2026-09-10", "publisherClass": "news" }, { "title": "How Trinidad and Tobago is Reimagining Healthcare Through Innovation (UN Sustainable Development Group)", "url": "https://unsdg.un.org/latest/stories/how-trinidad-and-tobago-reimagining-healthcare-through-innovation", "date": "2026-02-25", "publisherClass": "intergov" }, { "title": "Trinidad and Tobago Advances Digital Health and Data Governance with National Public Health Datathon (PAHO)", "url": "https://www.paho.org/en/news/10-7-2026-trinidad-and-tobago-advances-digital-health-and-data-governance-national-public", "date": "2026-07-10", "publisherClass": "intergov" } ] }, "research": { "score": 43, "summary": "RHA ethics committees review research, and the North Central RHA lets investigators abstract record data without consent only if no identifiers are kept. The Act's research rules are not in force, and there is no opt-out or register of uses.", "sources": [ { "title": "NCRHA Ethics Committee (North Central Regional Health Authority)", "url": "https://ncrha.co.tt/ethicscommittee/", "date": "undated", "publisherClass": "official" }, { "title": "Guidelines for Research Limited to Retrospective Medical Record Reviews (NCRHA Ethics Committee)", "url": "https://ncrha.co.tt/wp-content/uploads/2019/03/NCRHA-REC-Guidelines-for-Research-Limited-to-Retrospective-Medical-Record-Reviews.pdf", "date": "2019-03", "publisherClass": "official" }, { "title": "Data Protection Act, Chap. 22:04 (Ministry of the Attorney General, unofficial revision)", "url": "http://laws.gov.tt/ttdll-web/revision/download/91970?type=act", "date": "2015", "publisherClass": "legal_text" } ] }, "ai": { "score": 22, "summary": "No law or guidance on clinical AI was found. The Food and Drugs Act defines a device as an instrument, apparatus or contrivance and does not mention software, and a national AI readiness assessment was still being validated in 2026.", "sources": [ { "title": "Food and Drugs Act, Chap. 30:01 (Ministry of Trade and Industry copy)", "url": "https://tradeind.gov.tt/wp-content/uploads/2016/02/Food-and-Drugs-Act-30.01.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Chemistry, Food and Drugs Division (Ministry of Health)", "url": "https://health.gov.tt/services/chemistry-food-and-drugs-division", "date": "undated", "publisherClass": "official" }, { "title": "Trinidad and Tobago Advances Ethical AI Governance with UNESCO RAM Validation Workshop (UNESCO)", "url": "https://www.unesco.org/en/articles/trinidad-and-tobago-advances-ethical-ai-governance-unesco-ram-validation-workshop", "date": "2026-03-13", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Data Protection Act, Chap. 22:04 (Act 13 of 2011), partly proclaimed", "level": "National", "year": "2011", "what": "Health is sensitive data; only Part I, Commissioner provisions and a few sections are in force.", "url": "http://laws.gov.tt/ttdll-web/revision/download/91970?type=act" }, { "name": "Freedom of Information Act, Chap. 22:02", "level": "National", "year": "1999", "what": "Access to documents held by public bodies, including RHAs; 30-day decision; correction of personal information.", "url": "https://www.finance.gov.tt/wp-content/uploads/2019/07/The-Freedom-of-Information-Act.pdf" }, { "name": "Freedom of Information (Fees and Charges) Regulations", "level": "National", "year": "2001", "what": "Sets charges for copies; inspection at the authority is free; hardship waivers possible.", "url": "https://www.finance.gov.tt/wp-content/uploads/2019/07/The-Freedom-of-Information-Act.pdf" }, { "name": "Food and Drugs Act, Chap. 30:01", "level": "National", "year": "1960", "what": "Regulates food, drugs, cosmetics and devices; device definition does not mention software.", "url": "https://tradeind.gov.tt/wp-content/uploads/2016/02/Food-and-Drugs-Act-30.01.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-26", "headline": "Health authority tells court it cannot find parts of a patient's records", "paraphrase": "A man suing a public health authority over his hospital care was allowed to go ahead despite filing late. The authority told the High Court it could not locate some of his medical records.", "source": "Trinidad and Tobago Guardian", "url": "https://www.guardian.co.tt/news/judge-allows-negligence-case-against-swrha-to-proceed-after-limit-expires-6.2.2524354.01804956e9", "theme": "other", "status": "admitted" }, { "date": "2026-07-30", "headline": "Lawyers say prison officials would not disclose a detainee's medical records", "paraphrase": "Lawyers for a woman held in prison under a detention order told the High Court that prison officials decided not to disclose the medical records compiled during her detention, as part of a wider legal challenge.", "source": "Trinidad and Tobago Guardian", "url": "https://www.guardian.co.tt/news/soe-detainee-challenges-state-over-access-to-her-medical-treatment-6.2.2636067.417655f16f", "theme": "access_refused", "status": "alleged" } ] }, { "iso3": "PSE", "name": "Palestine", "region": "Middle East", "overall": 28, "rank": "172=", "likelyRank": "142 to 187", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "No law we found gives Palestinian patients a copy of their record; the ministry's system runs in 15 hospitals and, it says, Gaza's was lost.", "categories": { "access": { "score": 25, "summary": "We found no Palestinian law that gives patients a right to see or copy their file: the 2004 Public Health Law lists five patient rights, none of them access. The government Hukumati portal shows test results, insurance status and referrals only.", "sources": [ { "title": "Public Health Law No. 20 of 2004 (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/145/", "date": "2004-12-27", "publisherClass": "legal_text" }, { "title": "Decree-Law No. 31 of 2018 on Medical and Health Protection and Safety (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/156/", "date": "2018-09-12", "publisherClass": "legal_text" }, { "title": "Health minister: government adopted initiatives to improve services (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7389/Language/ar", "date": "2025-06-03", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "Patients have no opt-out, no consent setting and no access log in the ministry's systems; none was found. The 2018 decree-law bars staff from revealing patient secrets, except to competent bodies in cases set by law.", "sources": [ { "title": "Decree-Law No. 31 of 2018 on Medical and Health Protection and Safety (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/156/", "date": "2018-09-12", "publisherClass": "legal_text" }, { "title": "Public Health Law No. 20 of 2004 (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/145/", "date": "2004-12-27", "publisherClass": "legal_text" }, { "title": "Health minister: government adopted initiatives to improve services (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7389/Language/ar", "date": "2025-06-03", "publisherClass": "official" }, { "title": "Ministry of Health: steps toward localising services and reforming the health system (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7550/Language/ar", "date": "2025-11-09", "publisherClass": "official" } ] }, "privacy": { "score": 28, "summary": "Palestine has no comprehensive data protection law or regulator; a 2025 draft naming health data as sensitive went to public consultation. Protection rests on a medical secrecy duty, a cybercrime privacy offence and a 2019 Cabinet decision, and no breach notification duty was found.", "sources": [ { "title": "Personal data protection in Palestine: scattered rules and real responsibilities (Turabi Law)", "url": "https://turabilaw.com/ar/2026/07/22/%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9-%D9%81%D9%8A-%D9%81%D9%84%D8%B3%D8%B7%D9%8A%D9%86-%D9%82%D9%88%D8%A7%D8%B9/", "date": "2026-07-22", "publisherClass": "law_firm" }, { "title": "Draft Decree-Law of 2025 on Data Protection, public consultation (Ministry of Justice e-consultation platform)", "url": "https://econsultation.moj.pna.ps/consultation-details/98", "date": "2025-10-30", "publisherClass": "official" }, { "title": "Decree-Law No. 10 of 2018 on Cybercrime (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/83/", "date": "2018", "publisherClass": "legal_text" }, { "title": "Health ministry hack: source of the cyberattack was external (Arab48)", "url": "https://www.arab48.com/%D9%81%D9%84%D8%B3%D8%B7%D9%8A%D9%86%D9%8A%D8%A7%D8%AA/%D8%A3%D8%AE%D8%A8%D8%A7%D8%B1/2022/09/09/%D8%A7%D8%AE%D8%AA%D8%B1%D8%A7%D9%82-%D9%85%D9%88%D9%82%D8%B9-%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%A7%D9%84%D9%81%D9%84%D8%B3%D8%B7%D9%8A%D9%86%D9%8A%D8%A9--%D9%85%D8%B5%D8%AF%D8%B1-%D8%A7%D9%84%D9%87%D8%AC%D9%88%D9%85-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A-%D8%AE%D8%A7%D8%B1%D8%AC%D9%8A-%D9%88%D9%84%D9%8A%D8%B3-%D8%AF%D8%A7%D8%AE%D9%84%D9%8A%D8%A7-", "date": "2022-09-09", "publisherClass": "news" } ] }, "journey": { "score": 30, "summary": "The ministry's Avicenna system runs in 15 hospitals, 4 health directorates and 7 clinics, and a DHIS2 patient file runs in 7 directorates. The ministry says the war caused electronic systems to collapse in a number of Gaza facilities.", "sources": [ { "title": "Health minister: government adopted initiatives to improve services (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7389/Language/ar", "date": "2025-06-03", "publisherClass": "official" }, { "title": "Ministry of Health: steps toward localising services and reforming the health system (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7550/Language/ar", "date": "2025-11-09", "publisherClass": "official" }, { "title": "A digital health registry with clinical decision support for improving quality of antenatal care in Palestine (eRegQual), Lancet Digital Health (PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC8811715/", "date": "2022", "publisherClass": "academic" }, { "title": "Information Strategic Plan for the health sector in the southern governorates 2023-2025 (Ministry of Health)", "url": "https://www.moh.gov.ps/mohStatL/HIM-Strategic-Plan.pdf", "date": "2023", "publisherClass": "official" } ] }, "commercial": { "score": 30, "summary": "A 2019 Cabinet decision bans companies and institutions from using service users' personal data for commercial purposes without prior permission. It names no specific penalty, and no rule on health data brokers, health apps or de-identified data sales was found.", "sources": [ { "title": "Cabinet Decision No. 3 of 2019 on citizens' personal data (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/247/", "date": "2019", "publisherClass": "legal_text" }, { "title": "Personal data protection in Palestine: scattered rules and real responsibilities (Turabi Law)", "url": "https://turabilaw.com/ar/2026/07/22/%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9-%D9%81%D9%8A-%D9%81%D9%84%D8%B3%D8%B7%D9%8A%D9%86-%D9%82%D9%88%D8%A7%D8%B9/", "date": "2026-07-22", "publisherClass": "law_firm" } ] }, "clinical": { "score": 28, "summary": "Clinicians in the 15 ministry hospitals on Avicenna can use one system with linked imaging and lab results. WHO reports 18 of Gaza's 36 hospitals partly functioning at end 2025, and no exchange with other providers was found.", "sources": [ { "title": "Health minister: government adopted initiatives to improve services (Ministry of Health)", "url": "https://site.moh.ps/index/ArticleView/ArticleId/7389/Language/ar", "date": "2025-06-03", "publisherClass": "official" }, { "title": "Health conditions in the occupied Palestinian territory, including east Jerusalem, A79/12 (World Health Assembly)", "url": "https://apps.who.int/gb/ebwha/pdf_files/WHA79/A79_12-en.pdf", "date": "2026-05-08", "publisherClass": "intergov" }, { "title": "Gaza Strip Rapid Damage and Needs Assessment (World Bank, EU, UN)", "url": "https://thedocs.worldbank.org/en/doc/e539cbf23b348c3d4fc69b8a7e9c9d7d-0280062026/original/Gaza-RDNA-2026-Final-April-19.pdf", "date": "2026-04", "publisherClass": "intergov" } ] }, "research": { "score": 49, "summary": "Health research needs approval from ministry ethics committees under 2025 instructions, with patient privacy studies and file reviews sent to the higher committee. Drug trials need written informed consent, but no general opt-out from secondary use of records exists.", "sources": [ { "title": "Instructions No. 10 of 2025 on Ethics of Scientific Research in the Health Field (Al-Muqtafi, Birzeit University)", "url": "http://muqtafi.birzeit.edu/en/pg/getleg.asp?id=19037", "date": "2025-11-23", "publisherClass": "legal_text" }, { "title": "Public Health Law No. 20 of 2004 (Maqam legal database, An-Najah National University)", "url": "https://maqam.najah.edu/legislation/145/", "date": "2004-12-27", "publisherClass": "legal_text" }, { "title": "Decree-Law No. 21 of 2016 on Drug Study Procedures (Al-Muqtafi, Birzeit University)", "url": "http://muqtafi.birzeit.edu/pg/getleg.asp?id=16863", "date": "2016", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "No rule on AI used in clinical care, and no device regulation of AI software, was found. A national team approved a general AI strategy and policy for Cabinet adoption; Cabinet adoption is not verified.", "sources": [ { "title": "National team approves final version of the artificial intelligence strategy (Ministry of Telecommunications and Digital Economy)", "url": "https://www.mtde.gov.ps/home/news/21687?culture=ar-SA", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Public Health Law No. 20 of 2004", "level": "National", "year": "2004", "what": "Ministry duties; Article 60 lists five patient rights: emergency care, an explanation of treatment with consent to it, consent to research, privacy and dignity, and complaints.", "url": "https://maqam.najah.edu/legislation/145/" }, { "name": "Decree-Law No. 31 of 2018 on Medical and Health Protection and Safety", "level": "National", "year": "2018", "what": "Providers must keep a medical file; bans disclosing patient secrets except as law allows.", "url": "https://maqam.najah.edu/legislation/156/" }, { "name": "Decree-Law No. 10 of 2018 on Cybercrime", "level": "National", "year": "2018", "what": "Article 22 bans unlawful interference in privacy and publishing private life material.", "url": "https://maqam.najah.edu/legislation/83/" }, { "name": "Cabinet Decision No. 3 of 2019 on Personal Data", "level": "National", "year": "2019", "what": "Bans commercial use of service users' personal data without their prior permission.", "url": "https://maqam.najah.edu/legislation/247/" }, { "name": "Decree-Law No. 21 of 2016 on Drug Study Procedures", "level": "National", "year": "2016", "what": "Drug studies need written informed consent and approval by a drug studies committee.", "url": "http://muqtafi.birzeit.edu/pg/getleg.asp?id=16863" }, { "name": "Instructions No. 10 of 2025 on Ethics of Scientific Research in the Health Field", "level": "National", "year": "2025", "what": "Ministry ethics committees approve health research; privacy studies go to the higher committee.", "url": "http://muqtafi.birzeit.edu/en/pg/getleg.asp?id=19037" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-02", "stories": [ { "date": "2025-11-11", "headline": "Gaza officials say over 70% of three hospitals' medical archives were damaged or lost", "paraphrase": "Gaza's director general of hospitals said over 70% of the medical archive at three hospitals was damaged or lost in the war. A ministry spokesman said staff cannot trace thousands of injured people's medical histories without the records.", "source": "Al-Quds Al-Arabi", "url": "https://www.alquds.co.uk/%D9%83%D9%8A%D9%81-%D8%AF%D9%85%D8%B1-%D8%A7%D9%84%D8%A7%D8%AD%D8%AA%D9%84%D8%A7%D9%84-%D8%A7%D9%84%D8%A5%D8%B3%D8%B1%D8%A7%D8%A6%D9%8A%D9%84%D9%8A-%D8%A7%D9%84%D8%A3%D8%B1%D8%B4%D9%8A%D9%81-%D8%A7/", "theme": "other", "status": "admitted" } ] }, { "iso3": "TLS", "name": "Timor-Leste", "region": "Asia", "overall": 28, "rank": "172=", "likelyRank": "144 to 187", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Timor-Leste's Constitution promises access to personal data, but no data protection law is in force and a draft only went to consultation in August 2026.", "categories": { "access": { "score": 30, "summary": "Article 38 of the Constitution gives citizens a right of access to personal data in computer and manual records, but the law meant to set its conditions does not exist. We found no right to a copy of a medical record and no patient portal.", "sources": [ { "title": "Constituição da República Democrática de Timor-Leste (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/Constituicao_RDTL_PT.pdf", "date": "2002", "publisherClass": "legal_text" }, { "title": "Law No. 10/2004 on the Health System (Timor-Leste Trade Information Portal copy)", "url": "https://www.timor-lestetradeportal.com/upload/files/Legal_1680422501.pdf", "date": "2004-11-24", "publisherClass": "legal_text" }, { "title": "Decreto-Lei de Unidades Privadas de Saúde, 2004 (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/DL_2004_18_Unidades_Privadas_Saude_1.pdf", "date": "2004", "publisherClass": "legal_text" }, { "title": "Esbosu Lei Protesaun Dadus Pessoais: Proposta de Lei da Proteção de Dados Pessoais (Ministério da Justiça)", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 28, "summary": "The Constitution bans computer processing of private-life data without consent, and the health law lets patients refuse care. There is no data law, no consent tool and no access log, so the Ministry of Health decides how records are used.", "sources": [ { "title": "Constituição da República Democrática de Timor-Leste (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/Constituicao_RDTL_PT.pdf", "date": "2002", "publisherClass": "legal_text" }, { "title": "Law No. 10/2004 on the Health System (Timor-Leste Trade Information Portal copy)", "url": "https://www.timor-lestetradeportal.com/upload/files/Legal_1680422501.pdf", "date": "2004-11-24", "publisherClass": "legal_text" }, { "title": "Timor-Leste: digital ID and data protection (Statelessness Encyclopedia Asia Pacific)", "url": "https://seap.nationalityforall.org/digital-id/regional-overview/southeast-asia/timor-leste/", "date": "2026-03-03", "publisherClass": "academic" }, { "title": "Esbosu Lei Protesaun Dadus Pessoais: Proposta de Lei da Proteção de Dados Pessoais (Ministério da Justiça)", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 30, "summary": "Timor-Leste has no data protection law and no data protection authority. A draft law creating an independent authority with fines up to USD 150,000 was in public consultation from 1 to 30 August 2026.", "sources": [ { "title": "Constituição da República Democrática de Timor-Leste (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/Constituicao_RDTL_PT.pdf", "date": "2002", "publisherClass": "legal_text" }, { "title": "Código Penal, Decreto-Lei 19/2009, bilingual edition (La'o Hamutuk copy)", "url": "https://www.laohamutuk.org/econ/corruption/CodigoPenalPtTe.pdf", "date": "2009-04-08", "publisherClass": "legal_text" }, { "title": "Esbosu Lei Protesaun Dadus Pessoais: Proposta de Lei da Proteção de Dados Pessoais (Ministério da Justiça)", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Governo entrega ao Parlamento Nacional proposta de autorização legislativa em matéria de cibersegurança (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/?p=50772&lang=pt", "date": "2026-07-31", "publisherClass": "official" } ] }, "journey": { "score": 28, "summary": "Public health programmes run on a national DHIS2 system with patient-level tracking for TB, HIV, malaria, hypertension and diabetes. Individual digital immunization records only began as a 12-facility pilot in Dili in 2026.", "sources": [ { "title": "Immunization goes digital in Timor-Leste with launch of e-tracker (United Nations in Timor-Leste / WHO)", "url": "https://timorleste.un.org/en/320667-immunization-goes-digital-timor-leste-launch-e-tracker", "date": "2026-08-07", "publisherClass": "intergov" }, { "title": "Timor-Leste launches a digital platform for TB, HIV, and malaria surveillance (WHO)", "url": "https://www.who.int/timorleste/news/detail/22-11-2023-timor-leste-launches-a-digital-platform-for-tb--hiv--and-malaria-surveillance", "date": "2023-11-22", "publisherClass": "intergov" }, { "title": "Ministro da Saúde lança segunda fase do Programa Nacional de Saúde na Família (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/?p=19687&n=1", "date": "2018-03-16", "publisherClass": "official" } ] }, "commercial": { "score": 22, "summary": "No law limits selling health data or using it for marketing, and no regulator could act on it. The 2026 draft law would make unlawful sale or disclosure of personal data a very serious offence when intentional or when health data is involved.", "sources": [ { "title": "Esbosu Lei Protesaun Dadus Pessoais: Proposta de Lei da Proteção de Dados Pessoais (Ministério da Justiça)", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Constituição da República Democrática de Timor-Leste (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/Constituicao_RDTL_PT.pdf", "date": "2002", "publisherClass": "legal_text" }, { "title": "Ministério da Justiça abre consulta pública sobre lei de proteção de dados pessoais (Rádio Rafa)", "url": "https://rafa.tl/pt/ministerio-da-justica-abre-consulta-publica-sobre-lei-de-protecao-de-dados-pessoais/", "date": "2026-08-06", "publisherClass": "news" } ] }, "clinical": { "score": 20, "summary": "The health law calls for confidential exchange of clinical information between care levels, but we found no shared record that clinicians can open across facilities.", "sources": [ { "title": "Law No. 10/2004 on the Health System (Timor-Leste Trade Information Portal copy)", "url": "https://www.timor-lestetradeportal.com/upload/files/Legal_1680422501.pdf", "date": "2004-11-24", "publisherClass": "legal_text" }, { "title": "Ministro da Saúde lança segunda fase do Programa Nacional de Saúde na Família (Governo de Timor-Leste)", "url": "https://timor-leste.gov.tl/?p=19687&n=1", "date": "2018-03-16", "publisherClass": "official" }, { "title": "Immunization goes digital in Timor-Leste with launch of e-tracker (United Nations in Timor-Leste / WHO)", "url": "https://timorleste.un.org/en/320667-immunization-goes-digital-timor-leste-launch-e-tracker", "date": "2026-08-07", "publisherClass": "intergov" } ] }, "research": { "score": 45, "summary": "No consent rule or opt-out governs secondary use of health data. A Ministry of Health ethics office reviews research and trial protocols, and the Penal Code punishes breaches of professional secrecy.", "sources": [ { "title": "Diploma Ministerial 1/2014, Gabinete de Ética e Controlo de Qualidade (Jornal da República)", "url": "https://www.mj.gov.tl/jornal/?q=node/3935", "date": "2014-01-30", "publisherClass": "legal_text" }, { "title": "Law No. 10/2004 on the Health System (Timor-Leste Trade Information Portal copy)", "url": "https://www.timor-lestetradeportal.com/upload/files/Legal_1680422501.pdf", "date": "2004-11-24", "publisherClass": "legal_text" }, { "title": "Código Penal, Decreto-Lei 19/2009, bilingual edition (La'o Hamutuk copy)", "url": "https://www.laohamutuk.org/econ/corruption/CodigoPenalPtTe.pdf", "date": "2009-04-08", "publisherClass": "legal_text" }, { "title": "Esbosu Lei Protesaun Dadus Pessoais: Proposta de Lei da Proteção de Dados Pessoais (Ministério da Justiça)", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "No rules for clinical AI exist. A Ministry of Health TB van already uses AI to read chest X-rays, with health workers responsible for decisions as a matter of practice, not law.", "sources": [ { "title": "What can AI mean for the future of health in Timor-Leste? (WHO)", "url": "https://www.who.int/timorleste/news/detail/25-08-2026-what-can-ai-mean-for-the-future-of-health-in-timor-leste", "date": "2026-08-25", "publisherClass": "intergov" }, { "title": "Government promotes public consultation on Timor-Leste's Digital Transformation Strategy 2026-2036 (Government of Timor-Leste)", "url": "https://timor-leste.gov.tl/?p=48530&lang=en&n=1", "date": "2026-04-17", "publisherClass": "official" }, { "title": "Timor-Leste pharmaceutical country profile 2025 (WHO SEARO)", "url": "https://cdn.who.int/media/docs/default-source/searo/hsd/edm/timor-leste-medical-products-profile-2025.pdf?sfvrsn=cd81d8ad_3", "date": "2025", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Constitution of the Democratic Republic of Timor-Leste, Articles 36, 38, 57", "level": "National", "year": "2002", "what": "Right of access to personal data; consent needed to process private-life data; right to health.", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/Constituicao_RDTL_PT.pdf" }, { "name": "Law No. 10/2004 on the Health System", "level": "National", "year": "2004", "what": "Users' rights to confidentiality and information; clinical information exchange between levels; trials law promised.", "url": "https://www.timor-lestetradeportal.com/upload/files/Legal_1680422501.pdf" }, { "name": "Decree-Law on Private Health Units", "level": "National", "year": "2004", "what": "Private clinics must register all patients and keep clinical files confidential.", "url": "https://timor-leste.gov.tl/wp-content/uploads/2010/03/DL_2004_18_Unidades_Privadas_Saude_1.pdf" }, { "name": "Penal Code (Decree-Law 19/2009), Article 184", "level": "National", "year": "2009", "what": "Revealing a professional secret without consent: up to 1 year in prison or a fine.", "url": "https://www.laohamutuk.org/econ/corruption/CodigoPenalPtTe.pdf" }, { "name": "Ministerial Diploma 1/2014 on the Office of Ethics and Quality Control", "level": "National", "year": "2014", "what": "Ministry of Health office reviews research protocols and clinical trial requests.", "url": "https://www.mj.gov.tl/jornal/?q=node/3935" }, { "name": "Draft Personal Data Protection Law (public consultation, not enacted)", "level": "National", "year": "2026", "what": "Would create an independent data authority, treat health as sensitive data, fines up to USD 150,000.", "url": "https://www.mj.gov.tl/files/2026/Esbosu%20Lei%20Protesaun%20Dadus%20Pessoais.pdf" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-03-20", "headline": "Municipal health service admits running blood tests patients are never told about", "paraphrase": "Since 2024 a municipal health service has screened every patient's blood sample for an extra test without telling them. Its director confirmed patients are not informed. Lawyers called the practice illegal and a breach of privacy and consent.", "source": "Diligente", "url": "https://www.diligenteonline.com/testes-de-vih-sem-consentimento-em-covalima-diretor-de-saude-admite-que-pacientes-nao-podem-saber-juristas-consideram-pratica-ilegal/", "theme": "other", "status": "admitted" }, { "date": "2026-04-25", "headline": "One in five surveyed patients say their health status was disclosed without consent", "paraphrase": "A national survey reported in the press found more than 20 percent of respondents said their confidential health status was revealed without their consent, including cases involving health workers. Some said fear of disclosure made them skip treatment.", "source": "Diligente", "url": "https://www.diligenteonline.com/vih-em-timor-leste-medo-estigma-e-praticas-que-afastam-doentes-dos-servicos-de-saude/", "theme": "breach", "status": "self_reported" } ] }, { "iso3": "VEN", "name": "Venezuela", "region": "Americas", "overall": 28, "rank": "172=", "likelyRank": "140 to 187", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Venezuela tied a national digital health record to the Sistema Patria in 2025, with no data protection law and patients entitled only to a summary.", "categories": { "access": { "score": 35, "summary": "The 1998 Ley Organica de Salud gives patients a written, certified summary of their record on demand, not a full copy. The doctors' ethics code bars patients from examining the record directly, and patient access to the new national platform is not verified.", "sources": [ { "title": "Ley Organica de Salud 1998, articulo 69 (Justia Venezuela)", "url": "https://venezuela.justia.com/federales/leyes-organicas/ley-organica-de-salud/gdoc/", "date": "1998-11-11", "publisherClass": "legal_text" }, { "title": "Codigo de Deontologia Medica, Federacion Medica Venezolana (Justia Venezuela)", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf", "date": "1985-03-20", "publisherClass": "legal_text" }, { "title": "Constitucion de la Republica Bolivariana de Venezuela, articulos 28 y 60 (OEA)", "url": "https://www.oas.org/dil/esp/constitucion_venezuela.pdf", "date": "1999-12-30", "publisherClass": "legal_text" }, { "title": "Gobierno Bolivariano activa plataforma de datos para acceso a la Historia Clinica Digital (Mincyt)", "url": "https://mincyt.gob.ve/gobierno-bolivariano-activa-plataforma-de-datos-para-acceso-a-la-historia-clinica-digital-en-venezuela/", "date": "2025-11-28", "publisherClass": "official" } ] }, "control": { "score": 22, "summary": "The national digital clinical record launched in November 2025 is centralised and tied to the Sistema Patria, and no opt-out, consent switch or access log for patients was found. With no data protection law, the state decides who sees the data.", "sources": [ { "title": "Gobierno Bolivariano activa plataforma de datos para acceso a la Historia Clinica Digital (Mincyt)", "url": "https://mincyt.gob.ve/gobierno-bolivariano-activa-plataforma-de-datos-para-acceso-a-la-historia-clinica-digital-en-venezuela/", "date": "2025-11-28", "publisherClass": "official" }, { "title": "Venezuela implementa sistema nacional de historia clinica digital (Radio Miraflores)", "url": "https://radiomiraflores.net.ve/innovacion-venezuela-implementa-sistema-nacional-de-historia-clinica-digital/", "date": "2025-11-26", "publisherClass": "news" }, { "title": "Activan Plataforma para Historia Clinica Digital en Venezuela (Ciudad CCS)", "url": "https://www.ciudadccs.info/publicacion/38014-0", "date": "2025-11-26", "publisherClass": "news" }, { "title": "Codigo de Deontologia Medica, Federacion Medica Venezolana (Justia Venezuela)", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf", "date": "1985-03-20", "publisherClass": "legal_text" } ] }, "privacy": { "score": 25, "summary": "Venezuela has no data protection law and no data regulator; privacy rests on Article 60 of the Constitution and criminal penalties in the 2001 cybercrime law. TalCual counted at least 11 data leaks since 2024 and found no sanctions for leaks.", "sources": [ { "title": "Constitucion de la Republica Bolivariana de Venezuela, articulos 28 y 60 (OEA)", "url": "https://www.oas.org/dil/esp/constitucion_venezuela.pdf", "date": "1999-12-30", "publisherClass": "legal_text" }, { "title": "Ley Especial contra los Delitos Informaticos, articulos 20 a 22 (OEA)", "url": "https://www.oas.org/juridico/spanish/mesicic3_ven_anexo18.pdf", "date": "2001-10-30", "publisherClass": "legal_text" }, { "title": "Filtraciones de datos crecen en el pais sin controles ni consecuencias claras (TalCual)", "url": "https://talcualdigital.com/a-fondo/filtraciones-de-datos-crecen-en-el-pais-sin-controles-ni-consecuencias-claras/", "date": "2026-04-27", "publisherClass": "news" }, { "title": "Aprobada nueva Ley de Proteccion de Datos Personales en Venezuela (Noticias 24 horas)", "url": "https://www.noticias24hrs.com.ve/aprobada-nueva-ley-de-proteccion-de-datos-personales-en-venezuela/", "date": "2025-04-08", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "The government activated a national digital clinical record platform in November 2025, but no coverage figures were published (not verified). In August 2026 the acting president ordered the digital record model rolled out to all public hospitals, so most are not yet linked.", "sources": [ { "title": "Gobierno Bolivariano activa plataforma de datos para acceso a la Historia Clinica Digital (Mincyt)", "url": "https://mincyt.gob.ve/gobierno-bolivariano-activa-plataforma-de-datos-para-acceso-a-la-historia-clinica-digital-en-venezuela/", "date": "2025-11-28", "publisherClass": "official" }, { "title": "Ejecutivo Nacional entrego resonador magnetico con Inteligencia Artificial al Hospital Universitario de Caracas (MPPS)", "url": "https://mpps.gob.ve/ejecutivo-nacional-entrego-resonador-magnetico-con-inteligencia-artificial-al-hospital-universitario-de-caracas/", "date": "2025-03-11", "publisherClass": "official" }, { "title": "Historia clinica digital interconectada entre hospitales, ordena Delcy Rodriguez (Diario Vea)", "url": "https://diariovea.com.ve/delcy-rodriguez-plantea-digitalizar-sistema-de-salud-publico/", "date": "2026-08-20", "publisherClass": "news" }, { "title": "Historia clinica electronica en Venezuela: que es, como funciona y que sistemas existen en 2026 (Code by Melendez)", "url": "https://codebymelendez.com/insights/historia-clinica-electronica-venezuela", "date": "2026-05-06", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 30, "summary": "No rule limits the sale of health data, health-based advertising or data brokers. The only protection found is the 2001 cybercrime law, which raises prison terms when personal data obtained unlawfully is disclosed or ceded for profit.", "sources": [ { "title": "Ley Especial contra los Delitos Informaticos, articulos 20 a 22 (OEA)", "url": "https://www.oas.org/juridico/spanish/mesicic3_ven_anexo18.pdf", "date": "2001-10-30", "publisherClass": "legal_text" }, { "title": "Codigo de Deontologia Medica, Federacion Medica Venezolana (Justia Venezuela)", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf", "date": "1985-03-20", "publisherClass": "legal_text" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 22, "summary": "Some hospitals keep digital records inside their own walls, but no working access across providers was verified. When a patient moves, the law relies on a certified written summary, and the ethics code requires the patient's consent before a doctor shares information.", "sources": [ { "title": "Ejecutivo Nacional entrego resonador magnetico con Inteligencia Artificial al Hospital Universitario de Caracas (MPPS)", "url": "https://mpps.gob.ve/ejecutivo-nacional-entrego-resonador-magnetico-con-inteligencia-artificial-al-hospital-universitario-de-caracas/", "date": "2025-03-11", "publisherClass": "official" }, { "title": "Ley Organica de Salud 1998, articulo 69 (Justia Venezuela)", "url": "https://venezuela.justia.com/federales/leyes-organicas/ley-organica-de-salud/gdoc/", "date": "1998-11-11", "publisherClass": "legal_text" }, { "title": "Codigo de Deontologia Medica, Federacion Medica Venezolana (Justia Venezuela)", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf", "date": "1985-03-20", "publisherClass": "legal_text" }, { "title": "Historia clinica digital interconectada entre hospitales, ordena Delcy Rodriguez (Diario Vea)", "url": "https://diariovea.com.ve/delcy-rodriguez-plantea-digitalizar-sistema-de-salud-publico/", "date": "2026-08-20", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "Patients may accept or refuse experimental research under the Ley Organica de Salud, but the ethics code lets doctors use hospital record archives for research with only the department head's approval. Two safeguards lift the base of 40: ethics committees and statutory confidentiality.", "sources": [ { "title": "Ley Organica de Salud 1998, articulo 69 (Justia Venezuela)", "url": "https://venezuela.justia.com/federales/leyes-organicas/ley-organica-de-salud/gdoc/", "date": "1998-11-11", "publisherClass": "legal_text" }, { "title": "Codigo de Deontologia Medica, Federacion Medica Venezolana (Justia Venezuela)", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf", "date": "1985-03-20", "publisherClass": "legal_text" }, { "title": "Gobierno Bolivariano activa plataforma de datos para acceso a la Historia Clinica Digital (Mincyt)", "url": "https://mincyt.gob.ve/gobierno-bolivariano-activa-plataforma-de-datos-para-acceso-a-la-historia-clinica-digital-en-venezuela/", "date": "2025-11-28", "publisherClass": "official" } ] }, "ai": { "score": 35, "summary": "The only national AI rule is a non-binding ethics code from the science ministry (February 2026) that names health as a critical use and keeps humans accountable. The AI bill still awaits a second debate, and device rules do not cover software.", "sources": [ { "title": "Codigo de Etica para el desarrollo y aplicacion responsable de la Inteligencia Artificial (Mincyt)", "url": "https://mincyt.gob.ve/wp-content/uploads/2026/02/Codigo_de_Etica_de_Inteligencia_Artificial_de_la_Republica_Bolivariana-1.pdf", "date": "2026-02", "publisherClass": "official" }, { "title": "IA en Venezuela: las clausulas que la ley todavia no escribe (AGT Consultoria)", "url": "https://www.agtconsultoria.com/blog/ia-en-venezuela-las-clausulas-que-la-ley-todavia-no-escribe/", "date": "2026-09-15", "publisherClass": "blog_vendor" }, { "title": "Resolucion 55 y DM-0010-99, registro sanitario de materiales y equipos medicos (SACS)", "url": "https://www.sacs.gob.ve/site/wp-content/uploads/2022/10/Normativa_Registro_Sanitario_Equipos_Materiales.pdf", "date": "1999-12-03", "publisherClass": "legal_text" }, { "title": "Ejecutivo Nacional entrego resonador magnetico con Inteligencia Artificial al Hospital Universitario de Caracas (MPPS)", "url": "https://mpps.gob.ve/ejecutivo-nacional-entrego-resonador-magnetico-con-inteligencia-artificial-al-hospital-universitario-de-caracas/", "date": "2025-03-11", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitucion de la Republica Bolivariana de Venezuela", "level": "National", "year": "1999", "what": "Article 28 habeas data right to see and correct own data; Article 60 privacy and limits on computing.", "url": "https://www.oas.org/dil/esp/constitucion_venezuela.pdf" }, { "name": "Ley Organica de Salud", "level": "National", "year": "1998", "what": "Patient rights: certified record summary on demand, confidentiality, consent to experimental research.", "url": "https://venezuela.justia.com/federales/leyes-organicas/ley-organica-de-salud/gdoc/" }, { "name": "Ley Especial contra los Delitos Informaticos", "level": "National", "year": "2001", "what": "Two to six years in prison for using or disclosing personal data without consent.", "url": "https://www.oas.org/juridico/spanish/mesicic3_ven_anexo18.pdf" }, { "name": "Ley de Infogobierno", "level": "National", "year": "2013", "what": "Public bodies' use of IT must protect privacy and confidentiality, subject to a future data law.", "url": "https://www.suscerte.gob.ve/wp-content/uploads/2024/02/GO-40274-Ley-de-Infogobierno.pdf" }, { "name": "Codigo de Deontologia Medica (Federacion Medica Venezolana)", "level": "National", "year": "1985", "what": "Medical secrecy; patients may not examine records directly; research consent and ethics committees.", "url": "https://docs.venezuela.justia.com/federales/codigos/codigo-de-deontologia-medica.pdf" }, { "name": "Resolucion 55 y DM-0010-99 (registro sanitario de materiales y equipos)", "level": "National", "year": "1999", "what": "Firms making, importing or selling medical equipment must register; no software or AI rules.", "url": "https://www.sacs.gob.ve/site/wp-content/uploads/2022/10/Normativa_Registro_Sanitario_Equipos_Materiales.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07-21", "headline": "After the earthquakes, families found hospital patient lists with blank or partial names", "paraphrase": "Relatives searching for people after the earthquakes say hospital patient lists held entries that were not names at all, only question marks or single letters, and that some people lost all trace during transfers between hospitals.", "source": "El País", "url": "https://elpais.com/america/2026-07-21/la-angustia-por-los-desaparecidos-tras-los-terremotos-en-venezuela-se-perdio-la-huella-de-mi-madre.html", "theme": "record_wrong", "status": "alleged" }, { "date": "2026-07-12", "headline": "Earthquake survivors taken to hospitals never appeared in admission records, families say", "paraphrase": "Families say people rescued alive and taken away by ambulance were never recorded at any hospital. One family was told a woman may have been admitted under another name. There was no unified register of rescued people.", "source": "El Pitazo", "url": "https://elpitazo.net/regiones/buscarlos-sin-descanso-el-rastro-perdido-de-personas-vistas-con-vida-despues-de-los-terremotos/", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2026-06-29", "headline": "Official register of injured earthquake patients had dead links and unanswered phone lines", "paraphrase": "The government announced a website listing patients treated in eleven hospitals after the earthquakes. The outlet found its links and phone numbers led nowhere, and the list could only be searched by exact name or ID number.", "source": "El Nacional", "url": "https://www.elnacional.com/2026/06/regimen-habilito-pagina-de-registro-de-heridos-que-no-funciona/", "theme": "access_refused", "status": "alleged" } ] }, { "iso3": "IRQ", "name": "Iraq", "region": "Middle East", "overall": 27, "rank": "175=", "likelyRank": "149 to 189", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Iraq has no data protection law and mostly paper records; we found a legal right to a free record copy only in Kurdistan.", "categories": { "access": { "score": 30, "summary": "Kurdistan's Law No. 4 of 2020 gives patients a free copy of their medical file, but we found no matching federal right for the rest of Iraq. The insurer's Damani platform holds an electronic file, but the patient features described are booking, covered services and remaining visits.", "sources": [ { "title": "Law No. 4 of 2020 on the Rights and Duties of the Patient in the Kurdistan Region, full text (AI Lawyer Iraq legal database)", "url": "https://ailawyeriq.cloud/ar-IQ/laws/details?id=3990", "date": "undated", "publisherClass": "legal_text" }, { "title": "Instruction No. 4 of 2022 implementing the Kurdistan patient rights law, KRG Ministry of Health (Yasaii legal database)", "url": "https://www.yasaii.info/yasa/a/item/download/2899_0f57cd0d9e0b33078cbff1d79d7034a6.html", "date": "2022-07-06", "publisherClass": "legal_text" }, { "title": "Health insurance: 2.4 million covered in Baghdad and a plan to expand to 9 governorates (Iraqi News Agency)", "url": "https://ina.iq/ar/local/254161-24-9.html", "date": "2026-02-02", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "In the state insurer's digital system, records are shared by default: a doctor who enters a Damani insurance number sees the patient's full medical history. We found no opt-out, consent choices or patient-visible access log.", "sources": [ { "title": "Health insurance: 2.4 million covered in Baghdad and a plan to expand to 9 governorates (Iraqi News Agency)", "url": "https://ina.iq/ar/local/254161-24-9.html", "date": "2026-02-02", "publisherClass": "news" }, { "title": "Electronic health insurance: Ministry of Health prepares Baghdad launch (Shafaqna Iraq)", "url": "https://iraq.shafaqna.com/AR/612235/", "date": "2026-04-30", "publisherClass": "news" }, { "title": "Instruction No. 4 of 2022 implementing the Kurdistan patient rights law, KRG Ministry of Health (Yasaii legal database)", "url": "https://www.yasaii.info/yasa/a/item/download/2899_0f57cd0d9e0b33078cbff1d79d7034a6.html", "date": "2022-07-06", "publisherClass": "legal_text" }, { "title": "Law No. 4 of 2020 on the Rights and Duties of the Patient in the Kurdistan Region, full text (AI Lawyer Iraq legal database)", "url": "https://ailawyeriq.cloud/ar-IQ/laws/details?id=3990", "date": "undated", "publisherClass": "legal_text" } ] }, "privacy": { "score": 25, "summary": "Iraq has no data protection law and no data regulator, and a law firm notes there is no breach notification duty outside banking. Protection rests on the constitution's privacy clause and the Penal Code's secrecy offence.", "sources": [ { "title": "Iraq's Constitution of 2005 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Iraq_2005", "date": "undated", "publisherClass": "legal_text" }, { "title": "Penal Code No. 111 of 1969 with amendments, English text (UNODC SHERLOC)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/irq/1969/penal_code_html/Iraq_The_Penal_Code_1969ENG.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "From Security First to Resilience First: The Case for Cybersecurity Reform in Iraq (Muayad & Associates)", "url": "https://muayadandassociates.com/from-security-first-to-resilience-first-the-case-for-cybersecurity-reform-in-iraq/", "date": "2026-08-11", "publisherClass": "law_firm" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 25, "summary": "Iraq's records are still mostly on paper. The state insurer's digital file covered about 2.7 million people in September 2026, mostly in Baghdad, and Kurdistan launched a unified hospital system in May 2026.", "sources": [ { "title": "Digital health records: an essential yet neglected step in Iraq (Oxford Open Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12539620/", "date": "2025-10-01", "publisherClass": "academic" }, { "title": "Iraq Health Insurance and Insurance Summit 2026 opens (Iraqi News Agency)", "url": "https://ina.iq/ar/local/272735-2026.html", "date": "2026-09-05", "publisherClass": "news" }, { "title": "Kurdistan unveils first Region-wide digital hospital system (Shafaq News)", "url": "https://shafaq.com/en/Kurdistan/Kurdistan-unveils-first-Region-wide-digital-hospital-system", "date": "2026-05-18", "publisherClass": "news" }, { "title": "WHO launches health digitalization initiative in Iraq (WHO EMRO)", "url": "https://www.emro.who.int/iraq/news/who-launches-health-digitalization-initiative-in-iraq.html", "date": "2023-02-09", "publisherClass": "intergov" } ] }, "commercial": { "score": 25, "summary": "No law limits selling health data or using it for marketing, because Iraq has no data protection law. The only barrier we found is the Penal Code ban on professionals disclosing or profiting from secrets learned at work.", "sources": [ { "title": "Penal Code No. 111 of 1969 with amendments, English text (UNODC SHERLOC)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/irq/1969/penal_code_html/Iraq_The_Penal_Code_1969ENG.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "From Security First to Resilience First: The Case for Cybersecurity Reform in Iraq (Muayad & Associates)", "url": "https://muayadandassociates.com/from-security-first-to-resilience-first-the-case-for-cybersecurity-reform-in-iraq/", "date": "2026-08-11", "publisherClass": "law_firm" }, { "title": "Health insurance: 2.4 million covered in Baghdad and a plan to expand to 9 governorates (Iraqi News Agency)", "url": "https://ina.iq/ar/local/254161-24-9.html", "date": "2026-02-02", "publisherClass": "news" } ] }, "clinical": { "score": 28, "summary": "Doctors at providers inside the health insurance scheme can pull up an insured patient's full history by insurance number. Outside that scheme, and outside new Kurdistan hospital systems, clinicians rely on paper files and reports the patient carries.", "sources": [ { "title": "Health insurance: 2.4 million covered in Baghdad and a plan to expand to 9 governorates (Iraqi News Agency)", "url": "https://ina.iq/ar/local/254161-24-9.html", "date": "2026-02-02", "publisherClass": "news" }, { "title": "Iraq Health Insurance and Insurance Summit 2026 opens (Iraqi News Agency)", "url": "https://ina.iq/ar/local/272735-2026.html", "date": "2026-09-05", "publisherClass": "news" }, { "title": "Law No. 4 of 2020 on the Rights and Duties of the Patient in the Kurdistan Region, full text (AI Lawyer Iraq legal database)", "url": "https://ailawyeriq.cloud/ar-IQ/laws/details?id=3990", "date": "undated", "publisherClass": "legal_text" } ] }, "research": { "score": 45, "summary": "Kurdistan's patient law lets people join or refuse medical research and withdraw at any time, and the Penal Code punishes disclosing professional secrets. We found no rules on reusing health records, and national ethics review was not verified, so the score is 45.", "sources": [ { "title": "Law No. 4 of 2020 on the Rights and Duties of the Patient in the Kurdistan Region, full text (AI Lawyer Iraq legal database)", "url": "https://ailawyeriq.cloud/ar-IQ/laws/details?id=3990", "date": "undated", "publisherClass": "legal_text" }, { "title": "Review of national research ethics regulations and guidelines in Middle Eastern Arab countries (BMC Medical Ethics, Europe PMC full text)", "url": "https://www.ebi.ac.uk/europepmc/webservices/rest/PMC3576357/fullTextXML", "date": "2012-12-12", "publisherClass": "academic" }, { "title": "Penal Code No. 111 of 1969 with amendments, English text (UNODC SHERLOC)", "url": "https://sherloc.unodc.org/cld/uploads/res/document/irq/1969/penal_code_html/Iraq_The_Penal_Code_1969ENG.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "Iraq has no AI law and no rules for AI in clinical care that we could find. A national AI strategy is still being drafted and is not binding.", "sources": [ { "title": "What is AI regulation in Iraq? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-iraq", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "From Security First to Resilience First: The Case for Cybersecurity Reform in Iraq (Muayad & Associates)", "url": "https://muayadandassociates.com/from-security-first-to-resilience-first-the-case-for-cybersecurity-reform-in-iraq/", "date": "2026-08-11", "publisherClass": "law_firm" } ] } }, "laws": [ { "name": "Constitution of the Republic of Iraq, Article 17", "level": "National", "year": "2005", "what": "Gives every individual a right to personal privacy, limited by others' rights and public morals.", "url": "https://www.constituteproject.org/constitution/Iraq_2005" }, { "name": "Penal Code No. 111 of 1969, Articles 437 and 438", "level": "National", "year": "1969", "what": "Criminalises disclosing professional secrets and publishing details of another person's private or family life.", "url": "https://sherloc.unodc.org/cld/uploads/res/document/irq/1969/penal_code_html/Iraq_The_Penal_Code_1969ENG.pdf" }, { "name": "Health Insurance Law No. 22 of 2020", "level": "National", "year": "2020", "what": "Creates the Health Insurance Authority under the health ministry, covering all Iraqis resident in Iraq.", "url": "https://www.moj.gov.iq/upload/pdf/4614.pdf" }, { "name": "Law No. 4 of 2020 on the Rights and Duties of the Patient (Kurdistan Region)", "level": "Regional", "year": "2020", "what": "Free copy of the medical file, health privacy, consent to surgery and the right to refuse research.", "url": "https://ailawyeriq.cloud/ar-IQ/laws/details?id=3990" }, { "name": "Instruction No. 4 of 2022 implementing the Patient Rights Law (Kurdistan Region)", "level": "Regional", "year": "2022", "what": "Adds rights to a medical report and test copies; file contents stay confidential without patient or court written authorisation.", "url": "https://www.yasaii.info/yasa/a/item/download/2899_0f57cd0d9e0b33078cbff1d79d7034a6.html" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-04", "headline": "Investigation reports trainees filming procedures on phones, with a patient's name visible", "paraphrase": "An investigation into teaching hospitals quoted a trainee who said students filmed a procedure on their phones and the patient's name appeared in the footage. No one told the patient. The health ministry did not reply.", "source": "Al-Mada", "url": "https://almadapaper.net/446748/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "SLE", "name": "Sierra Leone", "region": "Africa", "overall": 27, "rank": "175=", "likelyRank": "153 to 191", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Sierra Leone has no data protection law yet, so patient rights rest on a health ministry policy while most clinics still keep paper records.", "categories": { "access": { "score": 32, "summary": "No health law gives patients a right to a copy of their record. The Right to Access Information Act 2013 lets anyone request information from public bodies within 15 working days, but whether hospitals honour it for medical records is not verified.", "sources": [ { "title": "The Right to Access Information Act, 2013", "url": "https://www.sierra-leone.org/Laws/2013-02.pdf", "date": "2013-10-31", "publisherClass": "legal_text" }, { "title": "Sierra Leone Health Information System (HIS) Policy, Ministry of Health and Sanitation", "url": "https://mohs.gov.sl/download/50/policy-documents/17808/his_policy_15-11-2021_final-3.pdf", "date": "2021-12", "publisherClass": "official" }, { "title": "Ministry of Health, Request for Expressions of Interest: phased implementation of an EMR system (MoH/IHPAU/SRHR/CQS/01/2025)", "url": "https://mohs.gov.sl/jobs/hiring-of-a-consulting-firm-to-develop-customize-deploy-manage-and-maintain-an-electronic-medical-records-system/", "date": "2025-12-18", "publisherClass": "official" }, { "title": "The Minister of Health Unveils New Starlink Internet Connectivity for 300 Healthcare Facilities", "url": "https://mohs.gov.sl/the-minister-of-health-unveils-new-starlink-internet-connectivity-for-300-healthcare-facilities/", "date": "2026-07-27", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "The 2007 HIV Act requires written consent to disclose an HIV test result, and a 2021 ministry policy asks for written consent before sharing with third parties. There is no opt-out or access log, and the data terms of a December 2025 US health MOU are unpublished.", "sources": [ { "title": "The Prevention and Control of HIV and AIDS Act, 2007", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf", "date": "2007", "publisherClass": "legal_text" }, { "title": "Sierra Leone Health Information System (HIS) Policy, Ministry of Health and Sanitation", "url": "https://mohs.gov.sl/download/50/policy-documents/17808/his_policy_15-11-2021_final-3.pdf", "date": "2021-12", "publisherClass": "official" }, { "title": "Sierra Leone and the United States Sign Landmark Agreement (Ministry of Health)", "url": "https://mohs.gov.sl/sierra-leone-and-the-united-states-sign-landmark-agreement/", "date": "2025-12", "publisherClass": "official" }, { "title": "Why Sierra Leone Must Publish the Full US Health MOU (Sierra Eye)", "url": "https://www.sierraeyemagazine.com/why-sierra-leone-must-publish-the-full-us-health-mou/", "date": "2025-12-27", "publisherClass": "news" } ] }, "privacy": { "score": 28, "summary": "Sierra Leone has no data protection law and no regulator. Cabinet approved a policy and a Data Protection and Right to Access Information bill in April 2026, but it was not enacted by July 2026; the main health rule is the 2007 HIV Act's confidentiality duty.", "sources": [ { "title": "The Prevention and Control of HIV and AIDS Act, 2007", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf", "date": "2007", "publisherClass": "legal_text" }, { "title": "Cabinet Approves First Ever Data Protection Policy, Paving Way for New Data Law (Right to Access Information Commission)", "url": "https://raic.gov.sl/index.php/all-categories-list/press-release/cabinet-approves-first-ever-data-protection-policy-paving-way-for-new-data-law", "date": "2026-04-30", "publisherClass": "official" }, { "title": "CHRDI Engages Lawmakers on Data Protection and Privacy Bill (Sierraloaded)", "url": "https://sierraloaded.sl/news/chrdi-lawmakers-data-protection-privacy-bill/", "date": "2026-07-03", "publisherClass": "news" }, { "title": "Sierra Leone Fact Sheet (Data Protection Africa, ALT Advisory)", "url": "https://dataprotection.africa/sierra-leone/", "date": "undated", "publisherClass": "law_firm" } ] }, "journey": { "score": 24, "summary": "Disease surveillance has run electronically in every government facility since 2019, but patient records are mostly paper. The Ministry sought a firm in December 2025 to roll out OpenMRS to 300 facilities and added Starlink internet to 300 facilities in July 2026.", "sources": [ { "title": "Sierra Leone leads the way in Africa with fully functional electronic disease surveillance system (WHO Africa)", "url": "https://www.afro.who.int/countries/sierra-leone/news/sierra-leone-leads-way-africa-fully-functional-electronic-disease-surveillance-system", "date": "2019-06-06", "publisherClass": "intergov" }, { "title": "Ministry of Health, Request for Expressions of Interest: phased implementation of an EMR system (MoH/IHPAU/SRHR/CQS/01/2025)", "url": "https://mohs.gov.sl/jobs/hiring-of-a-consulting-firm-to-develop-customize-deploy-manage-and-maintain-an-electronic-medical-records-system/", "date": "2025-12-18", "publisherClass": "official" }, { "title": "The Minister of Health Unveils New Starlink Internet Connectivity for 300 Healthcare Facilities", "url": "https://mohs.gov.sl/the-minister-of-health-unveils-new-starlink-internet-connectivity-for-300-healthcare-facilities/", "date": "2026-07-27", "publisherClass": "official" }, { "title": "Sierra Leone moves closer to Universal Health Coverage with high-level engagement on draft SLAUHC Bill (WHO Africa)", "url": "https://www.afro.who.int/countries/sierra-leone/news/sierra-leone-moves-closer-universal-health-coverage-high-level-engagement-draft-slauhc-bill", "date": "2025-07-17", "publisherClass": "intergov" } ] }, "commercial": { "score": 22, "summary": "No law limits selling health data or using it for marketing, because Sierra Leone has no data protection law. The 2007 HIV Act only stops insurers and lenders from forcing an HIV test or status disclosure.", "sources": [ { "title": "The Prevention and Control of HIV and AIDS Act, 2007", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf", "date": "2007", "publisherClass": "legal_text" }, { "title": "Sierra Leone Fact Sheet (Data Protection Africa, ALT Advisory)", "url": "https://dataprotection.africa/sierra-leone/", "date": "undated", "publisherClass": "law_firm" }, { "title": "Government Finalizes Sierra Leone's Data Protection and Right to Access Information Bill (Sierraloaded)", "url": "https://sierraloaded.sl/news/government-data-protection-information-bill/", "date": "2025-11-09", "publisherClass": "news" } ] }, "clinical": { "score": 17, "summary": "A clinician usually sees only the paper file at their own facility. EMR pilots exist, such as Connaught Hospital from 2023, and a 300-facility rollout was at tender stage in December 2025, with no published go-live figures.", "sources": [ { "title": "EMR system to improve health care delivery in Sierra Leone (Ministry of Health)", "url": "https://mohs.gov.sl/emr-system-to-improve-health-care-delivery-in-sierra-leone/", "date": "2023-10-11", "publisherClass": "official" }, { "title": "Ministry of Health, Request for Expressions of Interest: phased implementation of an EMR system (MoH/IHPAU/SRHR/CQS/01/2025)", "url": "https://mohs.gov.sl/jobs/hiring-of-a-consulting-firm-to-develop-customize-deploy-manage-and-maintain-an-electronic-medical-records-system/", "date": "2025-12-18", "publisherClass": "official" }, { "title": "The Prevention and Control of HIV and AIDS Act, 2007", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf", "date": "2007", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "All clinical trials need review by the national ethics committee, and HIV research needs written informed consent by law. No rule on reusing records for research was found, so two safeguards lift the base of 40 to 46.", "sources": [ { "title": "Pharmacy Board of Sierra Leone, Good Clinical Practice Guidelines (PBSL/GL/039)", "url": "https://pharmacyboard.gov.sl/admin/gallery/878704f4f830e1c8c383578755c47d08.pdf", "date": "2024-05-15", "publisherClass": "official" }, { "title": "The Prevention and Control of HIV and AIDS Act, 2007", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf", "date": "2007", "publisherClass": "legal_text" }, { "title": "Sierra Leone Health Information System (HIS) Policy, Ministry of Health and Sanitation", "url": "https://mohs.gov.sl/download/50/policy-documents/17808/his_policy_15-11-2021_final-3.pdf", "date": "2021-12", "publisherClass": "official" } ] }, "ai": { "score": 22, "summary": "Sierra Leone has no AI law or clinical AI rules, and its first National AI Strategy was still being drafted in May 2026. The Pharmacy Board's device guideline treats software changes as variations needing approval, but says nothing about AI.", "sources": [ { "title": "Pharmacy Board of Sierra Leone, Guidelines for Registration of Medical Device (PBSL/GL/027)", "url": "https://pharmacyboard.gov.sl/admin/gallery/7dde9aa38a7472e7243433f0c2d4ff07.pdf", "date": "2024-05-15", "publisherClass": "official" }, { "title": "MoCTI, with the World Bank Group, is developing Sierra Leone's first-ever National AI Strategy", "url": "https://mocti.gov.sl/the-ministry-of-communication-technology-and-innovation-mocti-in-collaboration-with-the-world-bank-group-is-developing-sierra-leones-first-ever-national-ai-strategy/", "date": "2026-05-20", "publisherClass": "official" }, { "title": "AI regulation in Sierra Leone explained (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-sierra-leone", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Right to Access Information Act, 2013", "level": "National", "year": "2013", "what": "Right to information held by public bodies within 15 working days; cost-based fees allowed.", "url": "https://www.sierra-leone.org/Laws/2013-02.pdf" }, { "name": "Prevention and Control of HIV and AIDS Act, 2007", "level": "National", "year": "2007", "what": "Confidential HIV results, written consent for disclosure and research, no forced testing for insurance.", "url": "https://www.sierra-leone.org/Laws/2007-8p.pdf" }, { "name": "Data Protection and Right to Access Information Bill, 2025 (pending)", "level": "National", "year": "2025", "what": "First data protection law; one authority for privacy and information access. Approved by Cabinet, not enacted.", "url": "https://raic.gov.sl/index.php/all-categories-list/press-release/cabinet-approves-first-ever-data-protection-policy-paving-way-for-new-data-law" }, { "name": "Public Health Act, 2022", "level": "National", "year": "2022", "what": "Replaces the 1960 Act; sets up the National Public Health Agency and disease control powers.", "url": "https://sierralii.gov.sl/akn/sl/act/2023/17/eng@2023-05-12" }, { "name": "Pharmacy and Drugs Act, 2001 (medical device guidelines under section 44)", "level": "National", "year": "2001", "what": "Pharmacy Board registers medical devices; software changes need a variation application.", "url": "https://pharmacyboard.gov.sl/admin/gallery/7dde9aa38a7472e7243433f0c2d4ff07.pdf" }, { "name": "ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection", "level": "Supranational", "year": "2010", "what": "Health data is sensitive; member states must adopt a law and a data protection authority.", "url": "https://www.statewatch.org/media/documents/news/2013/mar/ecowas-dp-act.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "GRD", "name": "Grenada", "region": "Americas", "overall": 26, "rank": "177=", "likelyRank": "155 to 192", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Grenada passed a Data Protection Act in 2023 but has not switched it on, so patients still have no enforceable right over their health records.", "categories": { "access": { "score": 25, "summary": "The Data Protection Act 2023 would give a right to see personal data within 60 days for a fee, but it is not in force, so no enforceable right exists. There is no patient portal, and the hospital records process was not verified.", "sources": [ { "title": "Data Protection Bill, 2023, with House of Representatives amendments (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "Financial institutions must brace for banking data protection demands (NOW Grenada)", "url": "https://nowgrenada.com/2025/06/financial-institutions-must-brace-for-banking-data-protection-demands/", "date": "2025-06-27", "publisherClass": "news" }, { "title": "What is AI regulation in Grenada? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-grenada", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "control": { "score": 25, "summary": "With the Data Protection Act not in force, patients have no legal say over who sees or shares their health records. The Act, once started, would still let health professionals process health data for medical purposes without written consent.", "sources": [ { "title": "Data Protection Bill, 2023, with House of Representatives amendments (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "Health Minister gives full support for Project Polaris (The New Today)", "url": "https://www.thenewtodaygrenada.com/local-news/health-minister-gives-full-support-for-project-polaris/", "date": "2026-04-04", "publisherClass": "news" } ] }, "privacy": { "score": 30, "summary": "Health data is sensitive data under the 2023 Act, with fines up to EC$200,000 or two years in prison for misuse, but the Act is not in force and its Information Commission does not exist. The Electronic Crimes Act 2013 punishes unauthorised access to computer data.", "sources": [ { "title": "Data Protection Bill, 2023, with House of Representatives amendments (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "2026 Investment Climate Statement: Grenada (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/09/701264_2026-Grenada-Investment-Climate-Statement.pdf", "date": "2026-09", "publisherClass": "official" }, { "title": "Electronic Crimes Act, No. 23 of 2013 (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2021/08/Act-No.-23-of-2013-Electronic-Crimes-Act.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "What is AI regulation in Grenada? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-grenada", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "journey": { "score": 25, "summary": "Grenada uses DHIS2 for weekly disease reporting and a cancer registry, but has no shared patient record. In April 2026 the health minister said integrated health information systems were still under serious consideration.", "sources": [ { "title": "Grenada aims to strengthen health information systems (PAHO IS4H blog)", "url": "https://www.paho.org/en/information-systems-health-is4h-blog/grenada-aims-strengthen-health-information-systems", "date": "undated", "publisherClass": "intergov" }, { "title": "Government of Grenada 2026 Budget Statement (hosted by NOW Grenada)", "url": "https://nowgrenada.com/wp-content/uploads/2025/12/Budget-Statement-2026.pdf", "date": "2025-12-01", "publisherClass": "official" }, { "title": "Consultancy to evaluate the DHIS2 Cancer Module, Ministry of Health, Grenada (CARICOM)", "url": "https://caricom.org/procurement/request-for-expressions-of-interestconsulting-services-firms-selection/", "date": "undated", "publisherClass": "intergov" }, { "title": "Health Minister gives full support for Project Polaris (The New Today)", "url": "https://www.thenewtodaygrenada.com/local-news/health-minister-gives-full-support-for-project-polaris/", "date": "2026-04-04", "publisherClass": "news" } ] }, "commercial": { "score": 25, "summary": "No law in force stops health data being sold or used for marketing. The 2023 Act would bar disclosure beyond the original purpose without consent, but it has not started.", "sources": [ { "title": "Data Protection Bill, 2023, with House of Representatives amendments (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "Financial institutions must brace for banking data protection demands (NOW Grenada)", "url": "https://nowgrenada.com/2025/06/financial-institutions-must-brace-for-banking-data-protection-demands/", "date": "2025-06-27", "publisherClass": "news" } ] }, "clinical": { "score": 20, "summary": "No shared record lets a clinician see a patient's history across Grenada's hospitals and health centres. PAHO notes that retrieving older records is manual and slow, and pharmacists log dispensing on paper forms.", "sources": [ { "title": "Grenada aims to strengthen health information systems (PAHO IS4H blog)", "url": "https://www.paho.org/en/information-systems-health-is4h-blog/grenada-aims-strengthen-health-information-systems", "date": "undated", "publisherClass": "intergov" }, { "title": "Pharmacy Act, Chapter 241 (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2021/08/Cap241-PHARMACY-ACT.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Health Minister gives full support for Project Polaris (The New Today)", "url": "https://www.thenewtodaygrenada.com/local-news/health-minister-gives-full-support-for-project-polaris/", "date": "2026-04-04", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "No law in force governs research use of health records, and there is no opt-out. One safeguard counts: a research ethics committee for Grenada, described in 2001 and listed among Eastern Caribbean committees in 2017; how it works today was not verified.", "sources": [ { "title": "Data Protection Bill, 2023, with House of Representatives amendments (Parliament of Grenada)", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf", "date": "2023-03", "publisherClass": "legal_text" }, { "title": "Research ethics committee: getting started (West Indian Medical Journal, PubMed)", "url": "https://pubmed.ncbi.nlm.nih.gov/11769020/", "date": "2001-09", "publisherClass": "academic" }, { "title": "Research in epidemic and emergency situations: a model for collaboration and expediting ethics review in two Caribbean countries (Developing World Bioethics, PMC)", "url": "https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6586066/", "date": "2017-07-28", "publisherClass": "academic" } ] }, "ai": { "score": 20, "summary": "Grenada has no AI law, regulator or national AI strategy, and no rules for clinical AI were found. The health minister said in April 2026 that AI in health was under serious consideration.", "sources": [ { "title": "What is AI regulation in Grenada? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-grenada", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Health Minister gives full support for Project Polaris (The New Today)", "url": "https://www.thenewtodaygrenada.com/local-news/health-minister-gives-full-support-for-project-polaris/", "date": "2026-04-04", "publisherClass": "news" } ] } }, "laws": [ { "name": "Data Protection Act, No. 1 of 2023", "level": "National", "year": "2023", "what": "Gives access rights and treats health data as sensitive; not in force, awaiting a ministerial commencement order.", "url": "https://grenadaparliament.gd/wp-content/uploads/2023/03/Data-Protection-Bill-2023-8-3-23-with-HOR-amendments-Final.pdf" }, { "name": "Electronic Crimes Act, No. 23 of 2013", "level": "National", "year": "2013", "what": "Makes unauthorised access to computer systems and copying of data a criminal offence.", "url": "https://grenadaparliament.gd/wp-content/uploads/2021/08/Act-No.-23-of-2013-Electronic-Crimes-Act.pdf" }, { "name": "Pharmacy Act, Chapter 241 (Act No. 25 of 1987, as amended)", "level": "National", "year": "1987", "what": "Sets up the Pharmacy Council; requires dispensing records on Council forms for inspection.", "url": "https://grenadaparliament.gd/wp-content/uploads/2021/08/Cap241-PHARMACY-ACT.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "LBR", "name": "Liberia", "region": "Africa", "overall": 26, "rank": "177=", "likelyRank": "154 to 191", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Liberia signed its first data protection law in August 2026, but clinic records are mostly paper and a US aid deal allows patient data audits.", "categories": { "access": { "score": 28, "summary": "No law in force that we opened gives every patient a right to see or copy their medical record. The new Data Protection Act was signed in August 2026, but its access rules are not verified, so this stays in the 15 to 35 band.", "sources": [ { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" }, { "title": "Public Health Law of Liberia as Revised (2019), validation draft", "url": "https://naturecompact.org/admin_1230naturecompact/subresources/202301315880010.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Pres. Boakai Signs Cybercrime, Data Protection Acts Into Law (Liberian Investigator via AllAfrica)", "url": "https://allafrica.com/stories/202608210322.html", "date": "2026-08-21", "publisherClass": "news" }, { "title": "Ministry of Health, Request for Expression of Interest for an EMR/EHR system (MOH/5993/QCBS/001/2026)", "url": "https://moh.gov.lr/wp-content/uploads/REOI-EMR-Project-5993-08062026-3.pdf", "date": "2026-06", "publisherClass": "official" } ] }, "control": { "score": 25, "summary": "Disclosing an HIV test result needs the person's prior written consent, but no general consent rule for health records was verified. A December 2025 US aid deal commits Liberia to give US officials 'any data access' for audits, with no explicit privacy safeguards.", "sources": [ { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" }, { "title": "Human Rights Assessment of the 2025-2026 US Bilateral Health Agreements (Human Rights Watch)", "url": "https://www.hrw.org/news/2026/06/08/human-rights-assessment-of-the-2025-2026-us-bilateral-health-agreements", "date": "2026-06-08", "publisherClass": "news" }, { "title": "Secret US-Liberia Health Pact Lets Washington Audit Clinics, Demand Patient Data (Liberian Investigator)", "url": "https://liberianinvestigator.com/secret-us-liberia-health-pact-audit-clinics-patient-data/", "date": "2026-06-09", "publisherClass": "news" }, { "title": "Memorandum of Understanding between the United States and the Government of Liberia (text via Health Policy Watch)", "url": "https://healthpolicy-watch.news/wp-content/uploads/2025/12/US-Liberia-MOU-2025.pdf", "date": "2025-12-09", "publisherClass": "official" } ] }, "privacy": { "score": 32, "summary": "Until August 2026 Liberia had no data protection law or regulator, and the new Act's rules, penalties and start date are not verified. The main health-specific protection is a 2010 HIV confidentiality rule with fines from L$1,000 and licence suspension.", "sources": [ { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" }, { "title": "Draft National Data Governance Policy, Liberia 2026 (Ministry of Posts and Telecommunications)", "url": "https://mopt.gov.lr/wp-content/uploads/2022/06/2026-Liberia-Data-Governance-Policy-REVISED-CIPESA-1.pdf", "date": "2026", "publisherClass": "official" }, { "title": "Human Rights Assessment of the 2025-2026 US Bilateral Health Agreements (Human Rights Watch)", "url": "https://www.hrw.org/news/2026/06/08/human-rights-assessment-of-the-2025-2026-us-bilateral-health-agreements", "date": "2026-06-08", "publisherClass": "news" }, { "title": "Liberia fines Orange over unauthorized SIM card swap (Connecting Africa)", "url": "https://www.connectingafrica.com/regulation/liberia-fines-orange-over-unauthorized-sim-card-swap", "date": "2026-06-01", "publisherClass": "news" } ] }, "journey": { "score": 22, "summary": "The Ministry of Health says most primary health centres keep paper records and that fragmented systems limit continuity of care. It sought a firm in June 2026 to build an EMR linked to DHIS2 and mSupply, starting with pilot sites.", "sources": [ { "title": "Ministry of Health, Request for Expression of Interest for an EMR/EHR system (MOH/5993/QCBS/001/2026)", "url": "https://moh.gov.lr/wp-content/uploads/REOI-EMR-Project-5993-08062026-3.pdf", "date": "2026-06", "publisherClass": "official" }, { "title": "Draft National Data Governance Policy, Liberia 2026 (Ministry of Posts and Telecommunications)", "url": "https://mopt.gov.lr/wp-content/uploads/2022/06/2026-Liberia-Data-Governance-Policy-REVISED-CIPESA-1.pdf", "date": "2026", "publisherClass": "official" }, { "title": "Memorandum of Understanding between the United States and the Government of Liberia (text via Health Policy Watch)", "url": "https://healthpolicy-watch.news/wp-content/uploads/2025/12/US-Liberia-MOU-2025.pdf", "date": "2025-12-09", "publisherClass": "official" } ] }, "commercial": { "score": 25, "summary": "We found no rule in force that limits selling health data or using it for marketing. The 2010 HIV chapter bars insurers and others with record access from disclosing records, but the new Act's commercial rules are not verified.", "sources": [ { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" }, { "title": "Data protection laws in Liberia (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LR", "date": "undated", "publisherClass": "law_firm" } ] }, "clinical": { "score": 15, "summary": "A treating clinician usually sees only the paper file held at their own facility. The Ministry's planned EMR, at the tender stage in June 2026, would sync facility servers with a central server, but no shared record exists yet.", "sources": [ { "title": "Ministry of Health, Request for Expression of Interest for an EMR/EHR system (MOH/5993/QCBS/001/2026)", "url": "https://moh.gov.lr/wp-content/uploads/REOI-EMR-Project-5993-08062026-3.pdf", "date": "2026-06", "publisherClass": "official" }, { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "Clinical trials need written informed consent and National Research Ethics Board review, and people who withdraw decide whether their stored data may still be used. No rule on reusing records for research was verified, so two safeguards lift the base of 40 to 46.", "sources": [ { "title": "Clinical Research Regulation for Liberia (NIH ClinRegs)", "url": "https://clinregs.niaid.nih.gov/country/liberia", "date": "2026-04-13", "publisherClass": "official" }, { "title": "An Act to Amend the Public Health Law, Title 33, to create Chapter 18 on HIV and AIDS (ILO NATLEX)", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf", "date": "2010-03-11", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "Liberia has no AI law, AI regulator or clinical AI rules. The medicines regulator's 2018 guideline treats software in lab diagnostics as a device and requires approval of changes, but nothing covers AI in care.", "sources": [ { "title": "LMHRA Guidelines for Registration of In-Vitro Diagnostics, Version 002", "url": "https://www.isglobal.org/documents/10179/7074221/Guidelines+Registration/3040c0c0-028a-46d1-a85f-e6964621fd15", "date": "2018-10", "publisherClass": "official" }, { "title": "What is AI regulation in Liberia? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-liberia", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Memorandum of Understanding between the United States and the Government of Liberia (text via Health Policy Watch)", "url": "https://healthpolicy-watch.news/wp-content/uploads/2025/12/US-Liberia-MOU-2025.pdf", "date": "2025-12-09", "publisherClass": "official" } ] } }, "laws": [ { "name": "Personal Data Protection and Privacy Act of 2024 (signed August 2026)", "level": "National", "year": "2026", "what": "First general data protection law. Signed August 2026; text, regulator and start date not verified.", "url": "https://liblaw.org/document/personal-data-protection-and-privacy-act-of-2024-2026/" }, { "name": "Act to Amend the Public Health Law, Title 33, Chapter 18 (HIV and AIDS)", "level": "National", "year": "2010", "what": "Written consent to disclose HIV results; medical record confidentiality; fines, licence suspension, civil action.", "url": "https://natlex.ilo.org/dyn/natlex2/natlex2/files/download/96959/LBR96959.pdf" }, { "name": "Public Health Law of Liberia as Revised (2019 validation draft)", "level": "National", "year": "2019", "what": "Draft: patient confidentiality, record security and research disclosure rules. Enactment not verified.", "url": "https://naturecompact.org/admin_1230naturecompact/subresources/202301315880010.pdf" }, { "name": "Liberia Medicines and Health Products Regulatory Authority Act", "level": "National", "year": "2010", "what": "Creates LMHRA, which registers medicines, devices and diagnostics, including diagnostic software.", "url": "https://www.isglobal.org/documents/10179/7074221/Guidelines+Registration/3040c0c0-028a-46d1-a85f-e6964621fd15" }, { "name": "Telecommunications Act, section 51(5)", "level": "National", "year": "2007", "what": "Telecom providers must protect customer information with safeguards suited to its sensitivity.", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LR" }, { "name": "ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection", "level": "Supranational", "year": "2010", "what": "Health data is sensitive; member states must adopt a law and a data protection authority.", "url": "https://www.statewatch.org/media/documents/news/2013/mar/ecowas-dp-act.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-02-24", "headline": "Hospital worker suspended after live broadcast from wards allegedly exposed patients' privacy", "paraphrase": "A government agency suspended a hospital worker, accusing him of escorting journalists through wards and broadcasting live on social media. The agency said this exposed vulnerable patients and compromised their privacy, and ordered an investigation.", "source": "GNN Liberia", "url": "https://gnnliberia.com/moi-rejects-claims-of-law-targeting-weah/", "theme": "breach", "status": "alleged" } ] }, { "iso3": "NAM", "name": "Namibia", "region": "Africa", "overall": 26, "rank": "177=", "likelyRank": "157 to 192", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Namibia has no data protection law in force and no shared patient record, so patients rely on a charter, ethics rules and the Constitution.", "categories": { "access": { "score": 28, "summary": "The Ministry's Patient Charter promises you can obtain and inspect a copy of your health information, but no law in force gives an enforceable right. The 2022 Access to Information Act is still not in force.", "sources": [ { "title": "Patient Charter: Your Health Our Concern (Ministry of Health and Social Services)", "url": "http://www.lac.org.na/laws/codes/Patient_Charter.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Ethical Guidelines for Health Professionals (Health Professions Councils of Namibia)", "url": "https://hpcna.com/uploads/documents/Ethical%20Guidelines-240925-085235.pdf", "date": "2010", "publisherClass": "official" }, { "title": "Minister halts commissioner recruitment (The Namibian)", "url": "https://www.namibian.com.na/minister-halts-commissioner-recruitment/", "date": "2026-03-10", "publisherClass": "news" }, { "title": "Delay in act gagging media freedom (The Namibian)", "url": "https://www.namibian.com.na/delay-in-act-gagging-media-freedom/", "date": "2026-05-11", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "The Patient Charter says health information will not be disclosed without consent, but no law gives patients sharing choices, an opt-out or an access log. Facilities hold the record and decide how it is used.", "sources": [ { "title": "Patient Charter: Your Health Our Concern (Ministry of Health and Social Services)", "url": "http://www.lac.org.na/laws/codes/Patient_Charter.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Ethical Guidelines for Health Professionals (Health Professions Councils of Namibia)", "url": "https://hpcna.com/uploads/documents/Ethical%20Guidelines-240925-085235.pdf", "date": "2010", "publisherClass": "official" }, { "title": "National Digital Health Policy 2026-2036 (Ministry of Health and Social Services)", "url": "https://nrpa.gov.na/documents/146502/7587969/Digital+Health+Policy+Booklet+2026+-+2036.pdf/0818e941-b8ae-5a47-7ac9-2ed81015e138?t=1771335440368&download=true", "date": "2026-02", "publisherClass": "official" } ] }, "privacy": { "score": 28, "summary": "Namibia has no data protection law, regulator or breach notice rule in force; the Data Protection Bill was still being finalised in July 2026. Health data relies on the Constitution's privacy article and narrow rules such as a N$50,000 fine for disclosing STI status.", "sources": [ { "title": "Namibian Constitution (annotated, Legal Assistance Centre)", "url": "https://www.lac.org.na/laws/annoSTAT/Namibian%20Constitution.pdf", "date": "1990", "publisherClass": "legal_text" }, { "title": "Public and Environmental Health Act 1 of 2015 (annotated, Legal Assistance Centre)", "url": "https://www.lac.org.na/laws/annoSTAT/Public%20and%20Environmental%20Health%20Act%201%20of%202015.pdf", "date": "2015", "publisherClass": "legal_text" }, { "title": "Namibia pushes cyber security reforms (ITWeb Africa)", "url": "https://itweb.africa/article/namibia-pushes-cyber-security-reforms/mQwkoq6YJWlM3r9A", "date": "2026-07-14", "publisherClass": "news" }, { "title": "US health deal faces data privacy backlash in Namibia (The Namibian)", "url": "https://www.namibian.com.na/us-health-deal-faces-data-privacy-backlash-in-namibia/", "date": "2026-08-31", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "The Ministry's own 2026 policy calls the digital health system siloed, with limited interoperability. An e-Health network reaches all hospitals and some health centres, and a national exchange (NAM-X) is planned, not running.", "sources": [ { "title": "National Digital Health Policy 2026-2036 (Ministry of Health and Social Services)", "url": "https://nrpa.gov.na/documents/146502/7587969/Digital+Health+Policy+Booklet+2026+-+2036.pdf/0818e941-b8ae-5a47-7ac9-2ed81015e138?t=1771335440368&download=true", "date": "2026-02", "publisherClass": "official" }, { "title": "Namibia launches National Digital Health Policy to advance equitable, people-centred healthcare (WHO Africa)", "url": "https://www.afro.who.int/countries/namibia/news/namibia-launches-national-digital-health-policy-advance-equitable-people-centred-healthcare", "date": "2026-02-06", "publisherClass": "intergov" }, { "title": "Strengthening Namibia's health system: Vote 13 budget motivation by the health minister (The Namibian)", "url": "https://www.namibian.com.na/strengthening-namibias-health-system-through-investment-in-infrastructure-digitalisation-and-equity/", "date": "2025-05-12", "publisherClass": "news" } ] }, "commercial": { "score": 18, "summary": "No law stops the sale or marketing use of health data. The opt-in rule for electronic marketing in the Electronic Transactions Act 2019 sits in Chapter 4, which the annotated text shows is still not in force.", "sources": [ { "title": "Electronic Transactions Act 4 of 2019 (annotated, Legal Assistance Centre)", "url": "https://www.lac.org.na/laws/annoSTAT/Electronic Transactions Act 4 of 2019.pdf", "date": "2019", "publisherClass": "legal_text" }, { "title": "Namibian boards need to rethink data privacy (The Namibian)", "url": "https://www.namibian.com.na/namibian-boards-need-to-rethink-data-privacy/", "date": "2026-05-17", "publisherClass": "news" }, { "title": "National Digital Health Policy 2026-2036 (Ministry of Health and Social Services)", "url": "https://nrpa.gov.na/documents/146502/7587969/Digital+Health+Policy+Booklet+2026+-+2036.pdf/0818e941-b8ae-5a47-7ac9-2ed81015e138?t=1771335440368&download=true", "date": "2026-02", "publisherClass": "official" } ] }, "clinical": { "score": 22, "summary": "A clinician cannot open one record that follows the patient across public and private care. The Ministry claims real-time record access at some connected facilities, but the scope of that access was not verified.", "sources": [ { "title": "Strengthening Namibia's health system: Vote 13 budget motivation by the health minister (The Namibian)", "url": "https://www.namibian.com.na/strengthening-namibias-health-system-through-investment-in-infrastructure-digitalisation-and-equity/", "date": "2025-05-12", "publisherClass": "news" }, { "title": "Health policy to bring rules for digital health providers (Namibian Observer)", "url": "https://observer24.com.na/health-policy-to-bring-rules-for-digital-health-providers/", "date": "2026-02-09", "publisherClass": "news" }, { "title": "National Digital Health Policy 2026-2036 (Ministry of Health and Social Services)", "url": "https://nrpa.gov.na/documents/146502/7587969/Digital+Health+Policy+Booklet+2026+-+2036.pdf/0818e941-b8ae-5a47-7ac9-2ed81015e138?t=1771335440368&download=true", "date": "2026-02", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "Health research goes through the Ministry's Biomedical Research Ethics Committee and Research Management Committee, and ethics rules require informed consent. There is no data protection law and no opt-out from secondary use of records.", "sources": [ { "title": "Namibia: Biomedical Research Ethics Committee and Research Management Committee (Health Research Web Africa)", "url": "https://healthresearchwebafrica.org.za/en/namibia/ethics_993", "date": "undated", "publisherClass": "academic" }, { "title": "Ethical Guidelines for Health Professionals (Health Professions Councils of Namibia)", "url": "https://hpcna.com/uploads/documents/Ethical%20Guidelines-240925-085235.pdf", "date": "2010", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "The medicines regulator says it does not currently regulate medical devices, so AI used in care has no device approval route. The 2026 Digital Health Policy only plans future AI guidelines.", "sources": [ { "title": "Medicines Registration FAQ (Namibia Medicines Regulatory Council)", "url": "https://nmrc.gov.na/registration", "date": "undated", "publisherClass": "official" }, { "title": "National Digital Health Policy 2026-2036 (Ministry of Health and Social Services)", "url": "https://nrpa.gov.na/documents/146502/7587969/Digital+Health+Policy+Booklet+2026+-+2036.pdf/0818e941-b8ae-5a47-7ac9-2ed81015e138?t=1771335440368&download=true", "date": "2026-02", "publisherClass": "official" } ] } }, "laws": [ { "name": "Namibian Constitution, Article 13", "level": "National", "year": "1990", "what": "Protects privacy of homes, correspondence and communications, with lawful exceptions including for health.", "url": "https://www.lac.org.na/laws/annoSTAT/Namibian%20Constitution.pdf" }, { "name": "Public and Environmental Health Act 1 of 2015", "level": "National", "year": "2015", "what": "Disease notification; STI status confidentiality with N$50,000 fine; emergency powers to collect and disclose personal information.", "url": "https://www.lac.org.na/laws/annoSTAT/Public%20and%20Environmental%20Health%20Act%201%20of%202015.pdf" }, { "name": "Access to Information Act 8 of 2022", "level": "National", "year": "2022", "what": "Right to information held by public entities, including state hospitals; not yet in force.", "url": "https://namiblii.org/akn/na/act/2022/8/eng@2022-12-28" }, { "name": "Electronic Transactions Act 4 of 2019", "level": "National", "year": "2019", "what": "Recognises electronic records; Chapter 4 marketing opt-in rule not yet in force.", "url": "https://www.lac.org.na/laws/annoSTAT/Electronic Transactions Act 4 of 2019.pdf" }, { "name": "Medicines and Related Substances Control Act 13 of 2003", "level": "National", "year": "2003", "what": "Sets up the medicines regulator NMRC; medical devices are not currently regulated.", "url": "https://www.lac.org.na/laws/annoSTAT/Medicines%20and%20Related%20Substances%20Control%20Act%2013%20of%202003.pdf" }, { "name": "Health Professions Act 16 of 2024", "level": "National", "year": "2024", "what": "Creates the Health Professions Council of Namibia to register and discipline health professionals; in force March 2025.", "url": "https://www.lac.org.na/laws/annoSTAT/Health%20Professions%20Act%2016%20of%202024.pdf" }, { "name": "Communications Act 8 of 2009, Part 6 of Chapter V", "level": "National", "year": "2009", "what": "Interception centres staffed by the intelligence service; in force from 1 January 2023.", "url": "https://www.lac.org.na/laws/annoSTAT/Communications%20Act%208%20of%202009.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-03-19", "headline": "State hospital admits patient files sat on floors and old beds", "paraphrase": "Photos showed patient files on a hospital floor, some soaked. Hospital management said it ran out of storage space, kept files on unusable beds, and acknowledged the store did not comply with archives law.", "source": "The Namibian", "url": "https://www.namibian.com.na/oshakati-hospital-stores-records-on-floor-old-beds/", "theme": "other", "status": "admitted" }, { "date": "2024-12-17", "headline": "Health ministry confirms hackers breached one of its medicine data systems", "paraphrase": "After a national telecom data leak, the health ministry confirmed attackers breached an internet-facing pharmaceutical dashboard. It said only counts of patients using services were exposed, not personal details, and took the system offline.", "source": "The Namibian", "url": "https://www.namibian.com.na/health-ministry-systems-hacked-after-telecom-leak/", "theme": "breach", "status": "admitted" } ] }, { "iso3": "PAK", "name": "Pakistan", "region": "Asia", "overall": 26, "rank": "177=", "likelyRank": "156 to 192", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Pakistan has no data protection law, mostly paper records and no patient portal, so patients rely on doctors' ethics rules to protect records.", "categories": { "access": { "score": 25, "summary": "Pakistan has no data protection law giving a right to a copy of one's record; the 2023 bill was withdrawn in a Senate committee. An older doctors' ethics code allows copies or summaries, with no deadline; the 2026 code's wording was not verified, and there is no portal.", "sources": [ { "title": "PMDC Code of Ethics of Practice for Medical and Dental Practitioners (pre-2026 version, university mirror)", "url": "https://fjmu.edu.pk/wp-content/uploads/2022/10/PMDC-Code-of-ethic.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "The Personal Data Protection Bill, 2023: bill summary (Senate of Pakistan)", "url": "https://www.senate.gov.pk/en/billsummary.php?bid=1182", "date": "undated", "publisherClass": "official" }, { "title": "National Data Governance Policy (Pakistan Digital Authority)", "url": "https://pda.gov.pk/press-details.php?id=data-governance-policy", "date": "2026-06-30", "publisherClass": "official" }, { "title": "Towards Connected Care: Why Pakistan Needs Integrated Electronic Health Records (JCPSP)", "url": "https://jcpsp.pk/article-detail/ptowards-connected-care-why-pakistan-needs-integrated-electronic-health-recordsorp", "date": "2026-05", "publisherClass": "academic" } ] }, "control": { "score": 25, "summary": "The only consent rule is in the doctors' ethics code: records must not be handed to anyone without the patient's consent. There is no opt-out, no access log and no digital consent tool, and providers decide in practice.", "sources": [ { "title": "PMDC Code of Ethics of Practice for Medical and Dental Practitioners (pre-2026 version, university mirror)", "url": "https://fjmu.edu.pk/wp-content/uploads/2022/10/PMDC-Code-of-ethic.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Officials, healthcare workforce decry mandatory bodycam order for Punjab hospital staff (Dawn)", "url": "https://www.dawn.com/news/1966378", "date": "2026-01-12", "publisherClass": "news" }, { "title": "PM&DC seeks explanation over alleged filming of patients in operation theatre (PM&DC press release)", "url": "https://pmdc.pk/Documents/press/Press%20Release30-03-2026.pdf", "date": "2026-03-30", "publisherClass": "official" } ] }, "privacy": { "score": 28, "summary": "Pakistan has no general or health data protection law, so health records rely on a criminal cyber law and professional confidentiality rules. Pakistan is not on the EU adequacy list, and the EU's EHDS does not apply.", "sources": [ { "title": "Prevention of Electronic Crimes Act, 2016 (National Assembly)", "url": "https://www.na.gov.pk/uploads/documents/1470910659_707.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "IT ministry unveils draft data governance policy (Dawn)", "url": "https://www.dawn.com/news/2011804", "date": "2026-06-30", "publisherClass": "news" }, { "title": "Gaps drive AI push at private hospitals (Express Tribune)", "url": "https://tribune.com.pk/story/2623568/gaps-drive-ai-push-at-private-hospitals", "date": "2026-08-13", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 24, "summary": "Care records are mostly on paper and stay with each provider; a national unified medical record was only named as a priority in August 2026. The national insurance scheme, run through State Life with NADRA under contract, is the one wider thread.", "sources": [ { "title": "Towards Connected Care: Why Pakistan Needs Integrated Electronic Health Records (JCPSP)", "url": "https://jcpsp.pk/article-detail/ptowards-connected-care-why-pakistan-needs-integrated-electronic-health-recordsorp", "date": "2026-05", "publisherClass": "academic" }, { "title": "Pakistan's Health Sector Sets Its Digital Priorities (Pakistan Digital Authority)", "url": "https://pda.gov.pk/press-details.php?id=pakistan-s-health-sector-sets-its-digita", "date": "2026-08-20", "publisherClass": "official" }, { "title": "Islamabad, AJK, GB residents to get back health insurance from Jan 16 (Dawn)", "url": "https://www.dawn.com/news/1966599", "date": "2026-01-13", "publisherClass": "news" }, { "title": "E-Health implementation in Pakistan: challenges, opportunities, and the path forward (Frontiers in Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13167984/", "date": "2026-04-29", "publisherClass": "academic" } ] }, "commercial": { "score": 27, "summary": "No law limits selling health data, marketing with it or health apps. Only PECA's ban on selling identity information and a 2026 research rule against selling health research data apply.", "sources": [ { "title": "Prevention of Electronic Crimes Act, 2016 (National Assembly)", "url": "https://www.na.gov.pk/uploads/documents/1470910659_707.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "Regulatory framework for violations of NBC-HRI data sharing approval requirements (Health Research Institute, NIH)", "url": "https://www.nih.org.pk/wp-content/uploads/2026/07/regulatory-framework-for-violations-of-nbc-hri-data-sharing-approval-requirements.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "Gaps drive AI push at private hospitals (Express Tribune)", "url": "https://tribune.com.pk/story/2623568/gaps-drive-ai-push-at-private-hospitals", "date": "2026-08-13", "publisherClass": "news" } ] }, "clinical": { "score": 20, "summary": "Treating doctors usually see only their own facility's notes and what the patient brings on paper. Pakistan lacks a unified electronic record across hospitals, a digital engineering firm co-founder told the Express Tribune in August 2026.", "sources": [ { "title": "Towards Connected Care: Why Pakistan Needs Integrated Electronic Health Records (JCPSP)", "url": "https://jcpsp.pk/article-detail/ptowards-connected-care-why-pakistan-needs-integrated-electronic-health-recordsorp", "date": "2026-05", "publisherClass": "academic" }, { "title": "Gaps drive AI push at private hospitals (Express Tribune)", "url": "https://tribune.com.pk/story/2623568/gaps-drive-ai-push-at-private-hospitals", "date": "2026-08-13", "publisherClass": "news" }, { "title": "Pakistan's Health Sector Sets Its Digital Priorities (Pakistan Digital Authority)", "url": "https://pda.gov.pk/press-details.php?id=pakistan-s-health-sector-sets-its-digita", "date": "2026-08-20", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "Health research needs ethics approval and informed consent, and a July 2026 national framework bars sharing research data without National Bioethics Committee approval. There is no rule on secondary use of routine care records and no opt-out.", "sources": [ { "title": "Regulatory framework for violations of NBC-HRI data sharing approval requirements (Health Research Institute, NIH)", "url": "https://www.nih.org.pk/wp-content/uploads/2026/07/regulatory-framework-for-violations-of-nbc-hri-data-sharing-approval-requirements.pdf", "date": "2026-07", "publisherClass": "official" }, { "title": "PMDC Code of Ethics of Practice for Medical and Dental Practitioners (pre-2026 version, university mirror)", "url": "https://fjmu.edu.pk/wp-content/uploads/2022/10/PMDC-Code-of-ethic.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "PM&DC enforces patient safety code of ethics (The News)", "url": "https://www.thenews.pk/print/1402412-pm-dc-enforces-patient-safety-code-of-ethics", "date": "2026-03-03", "publisherClass": "news" } ] }, "ai": { "score": 22, "summary": "The National AI Policy 2025 is a non-binding strategy that names medical record digitisation and telemedicine as health priorities. No binding rule for clinical AI, and no AI-specific device rule from the drug regulator, was verified.", "sources": [ { "title": "National Artificial Intelligence Policy 2025 (Ministry of IT and Telecommunication)", "url": "https://moitt.gov.pk/SiteImage/Policies/National%20AI%20Policy.pdf", "date": "2025-07", "publisherClass": "official" }, { "title": "National Artificial Intelligence Policy 2025 (AI Policy Tracker)", "url": "https://aipolicytracker.org/policies/pakistan-national-artificial-intelligence-policy-2025", "date": "2026-09-11", "publisherClass": "blog_vendor" }, { "title": "Pakistan DRAP: Medical Device Regulator Guide (Pure Global)", "url": "https://www.pureglobal.com/glossary/pakistan-drap", "date": "2026-07-24", "publisherClass": "blog_vendor" }, { "title": "National Centre for Digital Health established to drive telemedicine, AI and health innovation (The News)", "url": "https://www.thenews.pk/print/1420485-national-centre-for-digital-health-established-to-drive-telemedicine-ai-and-health-innovation", "date": "2026-06-14", "publisherClass": "news" } ] } }, "laws": [ { "name": "Prevention of Electronic Crimes Act, 2016", "level": "National", "year": "2016", "what": "Cybercrime law: unauthorised access and sale of identity information are offences; no data subject rights.", "url": "https://www.na.gov.pk/uploads/documents/1470910659_707.pdf" }, { "name": "Digital Nation Pakistan Act, 2025", "level": "National", "year": "2025", "what": "Creates digital commission and authority; requires a health sectoral plan and a Data Exchange Layer.", "url": "https://www.pda.gov.pk/downloads/Digital-Nation-Pakistan-Act-1-of-2025.pdf" }, { "name": "PMDC Code of Ethics of Practice for Medical and Dental Practitioners", "level": "National", "year": "undated", "what": "Patients may get copies or summaries of records; records not handed over without consent.", "url": "https://fjmu.edu.pk/wp-content/uploads/2022/10/PMDC-Code-of-ethic.pdf" }, { "name": "Islamabad Healthcare Regulation Act, 2018", "level": "Regional", "year": "2018", "what": "Licenses Islamabad health facilities; inspectors may not disclose medical record contents.", "url": "https://ihra.gov.pk/wp-content/uploads/2021/07/IHRA-Act-2018.pdf" }, { "name": "Punjab Healthcare Commission Act 2010", "level": "State/Provincial", "year": "2010", "what": "Regulates Punjab health facilities; may make regulations on patient records; inspectors bound to secrecy.", "url": "https://os.phc.org.pk/downloads/PHC_Final_Act.pdf" }, { "name": "NBC-HRI regulatory framework on health research data sharing", "level": "National", "year": "2026", "what": "No health research data sharing without National Bioethics Committee approval; tiered penalties.", "url": "https://www.nih.org.pk/wp-content/uploads/2026/07/regulatory-framework-for-violations-of-nbc-hri-data-sharing-approval-requirements.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-03-29", "headline": "Health department disciplines hospital staff after patients were filmed during care", "paraphrase": "Staff recorded patients during procedures and the video spread online. The provincial health department, which runs the hospital, suspended senior staff and said the recording breached medical ethics and undermined patient privacy.", "source": "The News International", "url": "https://www.thenews.pk/story/1407037-five-lahore-doctors-postgraduate-training-terminated-over-ethical-breach", "theme": "breach", "status": "admitted" }, { "date": "2026-06-30", "headline": "Families say hospitals withhold clinical summaries needed to move patients elsewhere", "paraphrase": "Attendants told the newspaper that public, private and charitable hospitals often refuse a short clinical summary while treatment continues, saying it comes only after formal discharge, leaving families unable to arrange transfers or second opinions.", "source": "The News International", "url": "https://www.thenews.pk/print/1423136-hospital-transfers-continue-to-be-ordeal-for-families-of-critical-patients", "theme": "lost_between_providers", "status": "alleged" }, { "date": "2026-09-01", "headline": "Police refer case of allegedly false medical reports to Sindh health regulator", "paraphrase": "Police finished an inquiry into medical reports allegedly faked to justify a procedure on a woman at a private hospital in Sindh. The provincial healthcare commission will have experts review all records and hear both sides.", "source": "The Express Tribune", "url": "https://tribune.com.pk/story/2626839/fake-pregnancy-real-c-section-hospital-case-lands-before-shcc", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "PNG", "name": "Papua New Guinea", "region": "Oceania", "overall": 26, "rank": "177=", "likelyRank": "157 to 193", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Papua New Guinea has no data protection law in force, no patient portal, and electronic records in 4 of 3,234 health facilities.", "categories": { "access": { "score": 30, "summary": "Section 51 of the Constitution gives citizens reasonable access to official documents, but no law sets a procedure, and the Right to Information Policy was only validated in June 2026. No health-specific right to a copy and no patient portal were verified.", "sources": [ { "title": "Constitution of the Independent State of Papua New Guinea 1975 (rev. 2016), Constitute Project copy", "url": "https://www.constituteproject.org/constitution/Papua_New_Guinea_2016.pdf?lang=en", "date": "2016", "publisherClass": "legal_text" }, { "title": "DICT, TIPNG Validates Right to Information Policy (Department of ICT)", "url": "https://www.ict.gov.pg/dict-tipng-validates-right-to-information-policy/", "date": "2026-06-22", "publisherClass": "official" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" } ] }, "control": { "score": 28, "summary": "The Health Department decides who can use health data: access to the national eNHIS database is granted by health officials and, for partners, by the Health Secretary under an MOU. Only HIV information has a statutory consent rule for disclosure.", "sources": [ { "title": "HIV/AIDS Management and Prevention Act 2003 (copy hosted by KELIN)", "url": "https://kelinkenya.org/wp-content/uploads/2010/10/HIV-law-Papua-new-Guinea.pdf", "date": "2003", "publisherClass": "legal_text" }, { "title": "Standard Operating Procedures for Management of Data from Routine Health Information Systems (National Department of Health)", "url": "https://www.health.gov.pg/pdf/SOPdm_2024.pdf", "date": "2023", "publisherClass": "official" } ] }, "privacy": { "score": 30, "summary": "PNG has no data protection law, no regulator and no breach notification duty in force; Section 49 of the Constitution and the HIV Act are the main protections. A Data Governance and Data Protection Bill 2026 went to public consultation in August 2026.", "sources": [ { "title": "Constitution of the Independent State of Papua New Guinea 1975 (rev. 2016), Constitute Project copy", "url": "https://www.constituteproject.org/constitution/Papua_New_Guinea_2016.pdf?lang=en", "date": "2016", "publisherClass": "legal_text" }, { "title": "HIV/AIDS Management and Prevention Act 2003 (copy hosted by KELIN)", "url": "https://kelinkenya.org/wp-content/uploads/2010/10/HIV-law-Papua-new-Guinea.pdf", "date": "2003", "publisherClass": "legal_text" }, { "title": "Draft Data Governance and Data Protection Bill 2026, public consultation portal (Department of ICT)", "url": "https://www.ict.gov.pg/data-governance-and-data-protection-bill-2026/", "date": "2026-08-06", "publisherClass": "official" }, { "title": "Papua New Guinea seeks feedback on digital ID, data protection laws (Biometric Update)", "url": "https://www.biometricupdate.com/202608/papua-new-guinea-seeks-feedback-on-digital-id-data-protection-laws", "date": "2026-08-11", "publisherClass": "news" } ] }, "journey": { "score": 20, "summary": "By mid-2022 the national eNHIS took monthly aggregate reports from over 89% of facilities, but patient records are not linked across care. A 2025 study found an electronic record in 4 of 3,234 facilities (0.1%).", "sources": [ { "title": "Standard Operating Procedures for Management of Data from Routine Health Information Systems (National Department of Health)", "url": "https://www.health.gov.pg/pdf/SOPdm_2024.pdf", "date": "2023", "publisherClass": "official" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "PNG's ICT Officers Unite to Drive Digital Health Transformation (WHO Papua New Guinea)", "url": "https://www.who.int/papuanewguinea/news/detail/13-10-2025-png-s-ict-officers-unite-to-drive-digital-health-transformation", "date": "2025-10-13", "publisherClass": "intergov" }, { "title": "U.S.-Funded Initiatives Strengthen Papua New Guinea's Digital Health and HIV Response (U.S. Embassy)", "url": "https://pg.usembassy.gov/u-s-funded-initiatives-strengthen-papua-new-guineas-digital-health-and-hiv-response/", "date": "2026-03-30", "publisherClass": "official" } ] }, "commercial": { "score": 20, "summary": "No law in force limits the sale or marketing use of health data, and no regulator oversees data brokers or health apps. The 2026 draft Bill would add limits on selling biometric data, but it is not law.", "sources": [ { "title": "National Data Governance and Data Protection Policy 2024 (Department of ICT)", "url": "https://www.ict.gov.pg/ndgdpp/", "date": "2024", "publisherClass": "official" }, { "title": "Draft Data Governance and Data Protection Bill 2026, public consultation portal (Department of ICT)", "url": "https://www.ict.gov.pg/data-governance-and-data-protection-bill-2026/", "date": "2026-08-06", "publisherClass": "official" }, { "title": "Papua New Guinea seeks feedback on digital ID, data protection laws (Biometric Update)", "url": "https://www.biometricupdate.com/202608/papua-new-guinea-seeks-feedback-on-digital-id-data-protection-laws", "date": "2026-08-11", "publisherClass": "news" } ] }, "clinical": { "score": 15, "summary": "With electronic records in 4 of 3,234 facilities, a treating clinician almost never sees a patient's record from another provider. The national systems report aggregate data, not clinical histories.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Standard Operating Procedures for Management of Data from Routine Health Information Systems (National Department of Health)", "url": "https://www.health.gov.pg/pdf/SOPdm_2024.pdf", "date": "2023", "publisherClass": "official" }, { "title": "Strengthening Papua New Guinea's Health System in the Era of Artificial Intelligence (PNG Medical Blog)", "url": "https://pngmedicalblog.com/2026/09/06/strengthening-papua-new-guineas-health-system-in-the-era-of-artificial-intelligence/", "date": "2026-09-06", "publisherClass": "blog_vendor" } ] }, "research": { "score": 43, "summary": "The national Medical Research Advisory Committee gives final ethics approval for health research, and the HIV Act makes approval mandatory for HIV research. There is no general consent or opt-out rule for secondary use of health records.", "sources": [ { "title": "HIV/AIDS Management and Prevention Act 2003 (copy hosted by KELIN)", "url": "https://kelinkenya.org/wp-content/uploads/2010/10/HIV-law-Papua-new-Guinea.pdf", "date": "2003", "publisherClass": "legal_text" }, { "title": "Institutional Review Board (PNG Institute of Medical Research)", "url": "https://www.pngimr.org.pg/about/institutional-review-board/", "date": "undated", "publisherClass": "official" }, { "title": "Lessons from developing the Papua New Guinea National Health Research Agenda 2025-2030 (PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13015753/", "date": "2026-03-17", "publisherClass": "academic" }, { "title": "Standard Operating Procedures for Management of Data from Routine Health Information Systems (National Department of Health)", "url": "https://www.health.gov.pg/pdf/SOPdm_2024.pdf", "date": "2023", "publisherClass": "official" } ] }, "ai": { "score": 20, "summary": "No rules for clinical AI are in force. A national AI strategy and the draft data protection Bill's risk-based AI rules were both still out for consultation in 2026.", "sources": [ { "title": "National Sovereign AI and Digital Transformation Strategy, consultation page (Department of ICT)", "url": "https://www.ict.gov.pg/national-ai-bx-strategy/", "date": "undated", "publisherClass": "official" }, { "title": "Draft Data Governance and Data Protection Bill 2026, public consultation portal (Department of ICT)", "url": "https://www.ict.gov.pg/data-governance-and-data-protection-bill-2026/", "date": "2026-08-06", "publisherClass": "official" }, { "title": "Opportunities and challenges for AI adoption in Papua New Guinea: insights from AI Summit 2026 (PNG National Research Institute)", "url": "https://pngnri.org/images/Publications/Spotlight_Vol_19_Issue_3-Opportunities_and_challenges_for_AI_adoption_in_Papua_New_Guinea-_Insights_from_AI_Summit_2026.pdf", "date": "2026-04", "publisherClass": "academic" } ] } }, "laws": [ { "name": "Constitution of the Independent State of Papua New Guinea, sections 49 and 51", "level": "National", "year": "1975", "what": "Right to reasonable privacy; citizens' right of reasonable access to official documents, with no implementing law.", "url": "https://www.constituteproject.org/constitution/Papua_New_Guinea_2016.pdf?lang=en" }, { "name": "HIV/AIDS Management and Prevention Act 2003", "level": "National", "year": "2003", "what": "Informed consent for HIV testing, confidentiality of HIV information with penalties, approval required for HIV research.", "url": "https://kelinkenya.org/wp-content/uploads/2010/10/HIV-law-Papua-new-Guinea.pdf" }, { "name": "Digital Government Act 2022", "level": "National", "year": "2022", "what": "Framework for whole-of-government digital services and infrastructure; not a personal data protection law.", "url": "https://www.ict.gov.pg/digital-government-act-2022/" }, { "name": "National Data Governance and Data Protection Policy 2024", "level": "National", "year": "2024", "what": "Policy published by the Department of ICT, not law; basis for the 2026 data protection Bill.", "url": "https://www.ict.gov.pg/ndgdpp/" }, { "name": "Data Governance and Data Protection Bill 2026 (draft)", "level": "National", "year": "2026", "what": "Draft under consultation: data rights, breach notification, AI safeguards, NICTA as interim regulator. Not in force.", "url": "https://www.ict.gov.pg/data-governance-and-data-protection-bill-2026/" } ], "dti": { "grade": 92, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "VCT", "name": "Saint Vincent and the Grenadines", "region": "Americas", "overall": 26, "rank": "177=", "likelyRank": "154 to 191", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Saint Vincent and the Grenadines has an electronic record in its public clinics, but its only privacy law has not been in force since 2003.", "categories": { "access": { "score": 25, "summary": "No law gives patients an enforceable right to their record: the Privacy Act 2003 and Freedom of Information Act 2003 were never brought into force. A hospital policy promises a free review and a paid copy, but no portal exists.", "sources": [ { "title": "MCMH Patients' Guide (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/mcmh", "date": "undated", "publisherClass": "official" }, { "title": "Privacy Act, 2003 (No. 18 of 2003), Saint Vincent and the Grenadines (text via The Information Collective)", "url": "https://www.theinformationcollective.com/dpl/st-vincent-and-the-grenadines-the-privacy-act", "date": "2003-10-21", "publisherClass": "legal_text" }, { "title": "Data Protection Laws: St Vincent and the Grenadines (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-svg", "date": "undated", "publisherClass": "academic" }, { "title": "After 16 years, SVG's freedom of info law yet to come into effect (iWitness News)", "url": "https://www.iwnsvg.com/2019/12/02/after-16-years-svgs-freedom-of-info-law-yet-to-come-into-effect/", "date": "2019-12-02", "publisherClass": "news" } ] }, "control": { "score": 25, "summary": "With no privacy law in force, patients have no legal say over who sees their health data. Records sit in a single ministry system used across public clinics, with no opt-out or patient-visible access log found.", "sources": [ { "title": "Health Information System (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/health-information-system", "date": "undated", "publisherClass": "official" }, { "title": "MCMH Patients' Guide (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/mcmh", "date": "undated", "publisherClass": "official" }, { "title": "Data Protection Laws: St Vincent and the Grenadines (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-svg", "date": "undated", "publisherClass": "academic" }, { "title": "'Digital Public Service' examined during Public Service Week forum (Searchlight)", "url": "https://www.searchlight.vc/press-release/2026/06/26/digital-public-service-examined-public-service-week-forum/", "date": "2026-06-26", "publisherClass": "news" } ] }, "privacy": { "score": 25, "summary": "There is no data protection law in force and no regulator: the 2003 Privacy Act and its Privacy Commissioner exist only on paper. The US State Department said in September 2026 that no specific data protection law has been adopted.", "sources": [ { "title": "2026 Saint Vincent and the Grenadines Investment Climate Statement (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/09/701264_2026-Saint-Vincent-and-the-Grenadines-Investment-Climate-Statement.pdf", "date": "2026-09", "publisherClass": "official" }, { "title": "Privacy Act, 2003 (No. 18 of 2003), Saint Vincent and the Grenadines (text via The Information Collective)", "url": "https://www.theinformationcollective.com/dpl/st-vincent-and-the-grenadines-the-privacy-act", "date": "2003-10-21", "publisherClass": "legal_text" }, { "title": "Saint Vincent and the Grenadines Constitution Order 1979 (FAOLEX)", "url": "https://faolex.fao.org/docs/pdf/stv135212.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Data Protection Laws: St Vincent and the Grenadines (The UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-svg", "date": "undated", "publisherClass": "academic" } ] }, "journey": { "score": 30, "summary": "The ministry's Health Information System holds electronic records at 36 to 45 public facilities, but the main hospital's records were on paper when PAHO last reported (undated story). Current coverage of hospital, lab and pharmacy links was not verified.", "sources": [ { "title": "Health Information System (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/health-information-system", "date": "undated", "publisherClass": "official" }, { "title": "St. Vincent and the Grenadines is digitizing the Medical Records Department at the Milton Cato Memorial Hospital (PAHO)", "url": "https://www.paho.org/en/ish/all-stories/st-vincent-and-grenadines-digitizing-medical-records-department-milton-cato", "date": "undated", "publisherClass": "intergov" }, { "title": "St. Vincent and the Grenadines advances Integrated Health Surveillance Guidelines with PAHO support (PAHO)", "url": "https://www.paho.org/en/news/19-6-2026-st-vincent-and-grenadines-advances-integrated-health-surveillance-guidelines-paho", "date": "2026-06-19", "publisherClass": "intergov" }, { "title": "Surveillance Data Quality Audit of Kingstown Clinic, St. Vincent and the Grenadines (TEPHINET)", "url": "https://www.tephinet.org/learning/fead/surveillance-data-quality-audit-kingstown-clinic-st-vincent-and-grenadines-june-2022", "date": "undated", "publisherClass": "academic" } ] }, "commercial": { "score": 20, "summary": "No law limits the sale of health data, its use in marketing, or data brokers. The only privacy statute is not in force and would cover public bodies, not private firms.", "sources": [ { "title": "Privacy Act, 2003 (No. 18 of 2003), Saint Vincent and the Grenadines (text via The Information Collective)", "url": "https://www.theinformationcollective.com/dpl/st-vincent-and-the-grenadines-the-privacy-act", "date": "2003-10-21", "publisherClass": "legal_text" }, { "title": "2026 Saint Vincent and the Grenadines Investment Climate Statement (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/09/701264_2026-Saint-Vincent-and-the-Grenadines-Investment-Climate-Statement.pdf", "date": "2026-09", "publisherClass": "official" } ] }, "clinical": { "score": 28, "summary": "A clinician at a public facility on SVGHIS can open the patient's electronic record and enter orders. The main hospital's history sat in paper files in an undated PAHO report, and private practices are not known to be linked.", "sources": [ { "title": "Health Information System (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/health-information-system", "date": "undated", "publisherClass": "official" }, { "title": "St. Vincent and the Grenadines is digitizing the Medical Records Department at the Milton Cato Memorial Hospital (PAHO)", "url": "https://www.paho.org/en/ish/all-stories/st-vincent-and-grenadines-digitizing-medical-records-department-milton-cato", "date": "undated", "publisherClass": "intergov" } ] }, "research": { "score": 43, "summary": "No law governs research use of health data or requires ethics approval for trials, according to the 2012 national pharmaceutical profile. The main hospital's patient guide does let patients refuse to take part in research.", "sources": [ { "title": "Saint Vincent and the Grenadines Pharmaceutical Country Profile (Ministry of Health with PAHO/WHO)", "url": "https://www.paho.org/sites/default/files/2025-06/pharmaceutical-country-profile-saint-vincent-grenadines.pdf", "date": "2012-05", "publisherClass": "official" }, { "title": "MCMH Patients' Guide (Ministry of Health, Saint Vincent and the Grenadines)", "url": "https://health.gov.vc/health/index.php/mcmh", "date": "undated", "publisherClass": "official" }, { "title": "Privacy Act, 2003 (No. 18 of 2003), Saint Vincent and the Grenadines (text via The Information Collective)", "url": "https://www.theinformationcollective.com/dpl/st-vincent-and-the-grenadines-the-privacy-act", "date": "2003-10-21", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "No AI law, strategy, regulator or medical device rule for clinical AI was found. A September 2026 benchmark found no AI-specific framework in any of 13 Caribbean countries, this one included.", "sources": [ { "title": "What is AI regulation in Saint Vincent and the Grenadines? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-saint-vincent-and-the-grenadines", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Artificial intelligence regulation and policy are at an early stage in the Caribbean (Cullen International)", "url": "https://www.cullen-international.com/news/2026/09/Artificial-intelligence-regulation-and-policy-are-at-an-early-stage-in-the-Caribbean.html", "date": "2026-09-30", "publisherClass": "blog_vendor" }, { "title": "Saint Vincent and the Grenadines Pharmaceutical Country Profile (Ministry of Health with PAHO/WHO)", "url": "https://www.paho.org/sites/default/files/2025-06/pharmaceutical-country-profile-saint-vincent-grenadines.pdf", "date": "2012-05", "publisherClass": "official" } ] } }, "laws": [ { "name": "Privacy Act, 2003 (No. 18 of 2003)", "level": "National", "year": "2003", "what": "Public-sector privacy rules and a Privacy Commissioner; never brought into force.", "url": "https://www.theinformationcollective.com/dpl/st-vincent-and-the-grenadines-the-privacy-act" }, { "name": "Freedom of Information Act, 2003 (No. 27 of 2003)", "level": "National", "year": "2003", "what": "Right of access to official documents of public authorities; starts by ministerial order, not in force.", "url": "https://observatoriop10.cepal.org/sites/default/files/documents/vc_-_freedom_of_information_act_2003.pdf" }, { "name": "Saint Vincent and the Grenadines Constitution Order 1979", "level": "National", "year": "1979", "what": "Protects privacy of the home and freedom from search of the person without consent.", "url": "https://faolex.fao.org/docs/pdf/stv135212.pdf" }, { "name": "Pharmacy Act (No. 54 of 2002)", "level": "National", "year": "2002", "what": "Regulates pharmacy practice and medicines; no clinical trials or device control found.", "url": "https://www.paho.org/sites/default/files/2025-06/pharmaceutical-country-profile-saint-vincent-grenadines.pdf" } ], "dti": { "grade": 83, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "KHM", "name": "Cambodia", "region": "Asia", "overall": 25, "rank": "183=", "likelyRank": "158 to 193", "band": "Weak", "keysModel": "Institutional", "confidence": "medium", "headline": "Cambodia has no data protection law yet, so patient records stay with each provider under a 2003 ethics code while a draft law waits.", "categories": { "access": { "score": 25, "summary": "No statute gives Cambodian patients a right to a copy of their full record; the 2007 clients' rights guideline is a guideline, not a law. The only national patient view verified is vaccination history in the MyHealth mini-app.", "sources": [ { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Awareness, Intention to Act and Action in the Exercising of Patients' Rights among Cambodian patients (PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC7646469/", "date": "2020-11-02", "publisherClass": "academic" }, { "title": "Joint Press Release on Launching Ceremony of Electronic Immunization Registry (EIR) and HFMIS (Ministry of Post and Telecommunications)", "url": "https://mptc.gov.kh/en/2026/03/joint-press-release-on-launching-ceremony-of-electronic-immunization-registry-eir-and-health-facility-management-information-system-hfmis/", "date": "2026-03-12", "publisherClass": "official" }, { "title": "Draft Law on Personal Data Protection, final draft 23 June 2025, English (MPTC, via Open Development Cambodia)", "url": "https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/download/20250623_final-draft-pdp-law_eng.pdf", "date": "2025-06-23", "publisherClass": "legal_text" } ] }, "control": { "score": 25, "summary": "Records are held by each provider, and doctors may share them with other doctors on the patient's request or consent under the 2003 ethics code. No opt-out, granular choice or patient-visible access log was found.", "sources": [ { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Joint Press Release on Launching Ceremony of Electronic Immunization Registry (EIR) and HFMIS (Ministry of Post and Telecommunications)", "url": "https://mptc.gov.kh/en/2026/03/joint-press-release-on-launching-ceremony-of-electronic-immunization-registry-eir-and-health-facility-management-information-system-hfmis/", "date": "2026-03-12", "publisherClass": "official" }, { "title": "Draft Law on Personal Data Protection, final draft 23 June 2025, English (MPTC, via Open Development Cambodia)", "url": "https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/download/20250623_final-draft-pdp-law_eng.pdf", "date": "2025-06-23", "publisherClass": "legal_text" } ] }, "privacy": { "score": 30, "summary": "Cambodia has no data protection law, no data regulator and no breach notification duty, and the draft law was still under validation in August 2026. Doctors owe professional secrecy, and the 2019 E-Commerce Law adds a general security duty.", "sources": [ { "title": "MPTC holds Validation Workshop on the Draft Law on Personal Data Protection (Ministry of Post and Telecommunications)", "url": "https://mptc.gov.kh/en/2026/08/ministry-of-post-and-telecommunications-holds-validation-workshop-on-the-draft-law-on-personal-data-protection/", "date": "2026-08-05", "publisherClass": "official" }, { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Electronic Commerce, NS/RKM/1119/017, English text", "url": "https://commerce-cambodia.com/wp-content/uploads/2021/06/eCommerceLawEN.pdf", "date": "2019-11-02", "publisherClass": "legal_text" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 22, "summary": "The Ministry of Health's 2025 plan says existing digital systems are fragmented, siloed and not interoperable. National systems built so far are aggregate reporting (DHIS2) and an immunization registry, not a shared patient record.", "sources": [ { "title": "Health Strategic Plan 2025-2034 (Ministry of Health)", "url": "https://hismohcambodia.org/public/fileupload/HEALTH%20STRATEGIC%20PLAN%202025-2034_Eng%20Final.pdf", "date": "2025-09", "publisherClass": "official" }, { "title": "Cambodia launches digital health information system to strengthen decision-making nationwide (WHO Cambodia)", "url": "https://www.who.int/cambodia/news/detail/15-05-2026-cambodia-launches-digital-health-information-system-to-strengthen-decision-making-nationwide", "date": "2026-05-15", "publisherClass": "intergov" }, { "title": "Joint Press Release on Launching Ceremony of Electronic Immunization Registry (EIR) and HFMIS (Ministry of Post and Telecommunications)", "url": "https://mptc.gov.kh/en/2026/03/joint-press-release-on-launching-ceremony-of-electronic-immunization-registry-eir-and-health-facility-management-information-system-hfmis/", "date": "2026-03-12", "publisherClass": "official" }, { "title": "Cambodia, SEARCH strategic purchasing profile (NUS Saw Swee Hock School of Public Health)", "url": "https://blog.nus.edu.sg/searchsp/cambodia/", "date": "undated", "publisherClass": "academic" } ] }, "commercial": { "score": 25, "summary": "The only enacted health-specific limit is the ethics code rule that doctors must de-identify patients or get consent before publishing case material. Marketing messages need only an opt-out under the E-Commerce Law, and no ban on selling health data was found.", "sources": [ { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Law on Electronic Commerce, NS/RKM/1119/017, English text", "url": "https://commerce-cambodia.com/wp-content/uploads/2021/06/eCommerceLawEN.pdf", "date": "2019-11-02", "publisherClass": "legal_text" }, { "title": "Draft Law on Personal Data Protection, final draft 23 June 2025, English (MPTC, via Open Development Cambodia)", "url": "https://data.opendevelopmentcambodia.net/en/dataset/792fc94d-1a84-49cc-bad3-9b420f99b70f/resource/03e9c060-9bc8-42d5-80a6-8db777f61d1c/download/20250623_final-draft-pdp-law_eng.pdf", "date": "2025-06-23", "publisherClass": "legal_text" }, { "title": "Data protection laws in Cambodia (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=KH", "date": "2026-02-13", "publisherClass": "law_firm" } ] }, "clinical": { "score": 20, "summary": "A doctor sees another provider's record only if it is sent on the patient's request, under Article 43 of the 2003 ethics code. In March 2026 the health minister was still urging public hospitals to adopt EMRs, and no cross-provider viewer was found.", "sources": [ { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Minister urges use of electronic medical records in public hospitals nationwide (Ministry of Health)", "url": "https://moh.gov.kh/en/events/detail/1890", "date": "2026-03-16", "publisherClass": "official" }, { "title": "Health Strategic Plan 2025-2034 (Ministry of Health)", "url": "https://hismohcambodia.org/public/fileupload/HEALTH%20STRATEGIC%20PLAN%202025-2034_Eng%20Final.pdf", "date": "2025-09", "publisherClass": "official" } ] }, "research": { "score": 45, "summary": "Patients may refuse medical research, and a National Ethics Committee for Health Research reviews proposals through a public research portal. Rules for secondary use of routine health data were not verified, so the score stays in the lower half of its band.", "sources": [ { "title": "Physicians' Code of Ethics, unofficial English translation (JICA-HRD Project, via Open Development Mekong)", "url": "https://data.opendevelopmentmekong.net/dataset/5fd716fa-0b28-4aa6-8d6e-a36d39721c74/resource/c503c491-3a91-4639-a863-2fe77e7e2ce9/download/c1ab3b73-00b5-494b-9b3e-de743c27817b.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Country research information platforms (WHO Global Observatory on Health R&D)", "url": "https://www.who.int/observatories/global-observatory-on-health-research-and-development/resources/databases/country-databases/country-research-information-platforms", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 18, "summary": "No rules for clinical AI are in force; the National AI Strategy 2025-2030 was still listed as a draft in June 2026. The health plan aims to use AI in clinical practice, but no device rule for AI software was verified.", "sources": [ { "title": "Announcement on Progress of Preparing and Opening Public Consultation on Draft National AI Strategy (MPTC)", "url": "https://mptc.gov.kh/en/2025/06/announcement-on-progress-of-preparing-and-opening-public-consultation-on-draft-national-artificial-intelligence-strategy/", "date": "2025-06-01", "publisherClass": "official" }, { "title": "National Artificial Intelligence Strategy 2025-2030 (OECD.AI Policy Navigator)", "url": "https://oecd.ai/en/dashboards/policy-initiatives/national-artificial-intelligence-strategy-2025-2030", "date": "2026-06-09", "publisherClass": "intergov" }, { "title": "Health Strategic Plan 2025-2034 (Ministry of Health)", "url": "https://hismohcambodia.org/public/fileupload/HEALTH%20STRATEGIC%20PLAN%202025-2034_Eng%20Final.pdf", "date": "2025-09", "publisherClass": "official" } ] } }, "laws": [ { "name": "Sub-Decree No. 61 on Physicians' Code of Ethics", "level": "National", "year": "2003", "what": "Confidential medical records, consent for care, right to refuse research, de-identification before publication.", "url": "https://data.opendevelopmentcambodia.net/en/laws_record/sub-decree-on-physicians-code-of-ethics" }, { "name": "Law on Electronic Commerce (NS/RKM/1119/017)", "level": "National", "year": "2019", "what": "Security duty for electronic personal information (Art. 32); opt-out rule for unsolicited marketing (Art. 30).", "url": "https://data.opendevelopmentmekong.net/laws_record/law-on-e-commerce" }, { "name": "Sub-Decree No. 252 on personal identification data", "level": "National", "year": "2021", "what": "Covers only identification data held by the Ministry of Interior, not health records.", "url": "https://data.opendevelopmentmekong.net/laws_record/sub-decree-no-252-on-the-management-usage-and-security-protection-of-personal-data" }, { "name": "Draft Law on Personal Data Protection", "level": "National", "year": "2025", "what": "Draft, not enacted as of August 2026. Health is sensitive data; 72-hour breach notice; excludes public authorities.", "url": "https://data.opendevelopmentcambodia.net/laws_record/draft-law-on-personal-data-protection" } ], "dti": { "grade": 84, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "FSM", "name": "Micronesia", "region": "Oceania", "overall": 25, "rank": "183=", "likelyRank": "159 to 194", "band": "Weak", "keysModel": "State", "confidence": "medium", "headline": "Micronesia is joining its state hospital records into one national system, but no law yet gives patients access, consent or privacy rights.", "categories": { "access": { "score": 20, "summary": "Micronesia has no data protection law and no statutory right to see or copy a health record was found. The 2025 data protection bill is still pending, covers only national departments, and contains no access right.", "sources": [ { "title": "Constitution of the Federated States of Micronesia, Article IV (Declaration of Rights), FSM Legal Information System", "url": "https://fsmlaw.org/fsm/constitution/article4.htm", "date": "undated", "publisherClass": "legal_text" }, { "title": "C.B. No. 24-17, FSM Personal Data Protection Act of 2025 (Congress of the FSM)", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2025/06/CB-24-17.pdf", "date": "2025-05-17", "publisherClass": "legal_text" }, { "title": "FSM Code (Annotated) 2014, Title 41 Public Health, Safety, and Welfare", "url": "http://www.fsmlaw.org/fsm/code/PDF/FSMCA2014Tit41.pdf", "date": "2014", "publisherClass": "legal_text" }, { "title": "FSM Digital Health Strategic Plan 2026-2030 (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/wp-content/uploads/2026/03/FSM-Digital-Health-Strategic-Plan-Signed-1.pdf", "date": "undated", "publisherClass": "official" } ] }, "control": { "score": 22, "summary": "Records now sit in one national system that a clinician can open from any state, with no opt-out or patient-visible access log found. The cancer registry law requires reporting every case and only tells the patient it was reported.", "sources": [ { "title": "Unifying health data across the four Federated States of Micronesia (BES International)", "url": "https://www.bes.au/unifying-health-data-across-the-four-federated-states-of-micronesia/", "date": "2026-09-14", "publisherClass": "blog_vendor" }, { "title": "FSM Code Title 41, Chapter 11, Cancer Registry System Act (FSM Legal Information System)", "url": "https://fsmlaw.org/fsm/code/code2014/FSMCode2014Tit41Chap11.html", "date": "undated", "publisherClass": "legal_text" }, { "title": "FSM Digital Health Strategic Plan 2026-2030 (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/wp-content/uploads/2026/03/FSM-Digital-Health-Strategic-Plan-Signed-1.pdf", "date": "undated", "publisherClass": "official" }, { "title": "C.B. No. 24-17, FSM Personal Data Protection Act of 2025 (Congress of the FSM)", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2025/06/CB-24-17.pdf", "date": "2025-05-17", "publisherClass": "legal_text" } ] }, "privacy": { "score": 22, "summary": "There is no data protection law, regulator or breach notification duty, and the Health Department's own plan says sensitive patient data may be inadequately protected. A ransomware attack forced Yap's health department to take its whole network offline in March 2025.", "sources": [ { "title": "Data protection laws in the Federated States of Micronesia (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=FM", "date": "2026-02-02", "publisherClass": "law_firm" }, { "title": "C.B. No. 24-17, FSM Personal Data Protection Act of 2025 (Congress of the FSM)", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2025/06/CB-24-17.pdf", "date": "2025-05-17", "publisherClass": "legal_text" }, { "title": "Ransomware attack takes down health system network in Micronesia (The Record)", "url": "https://therecord.media/ransomware-attack-micronesia-health-system", "date": "2025-03-14", "publisherClass": "news" }, { "title": "Standing Committee Report on C.B. No. 24-15, with Kosrae State submission on the digital governance bills (Congress of the FSM)", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2026/05/SCR-No.-24-29.pdf", "date": "2026-05", "publisherClass": "official" } ] }, "journey": { "score": 34, "summary": "The vendor BES says hospitals in Yap, Pohnpei and Kosrae now share one Tamanu record holding about 128,000 patients, with Chuuk migrating (not verified by the health department). Primary care is mostly outside it: a 2024 scan found an EHR in 4 of 119 facilities.", "sources": [ { "title": "Unifying health data across the four Federated States of Micronesia (BES International)", "url": "https://www.bes.au/unifying-health-data-across-the-four-federated-states-of-micronesia/", "date": "2026-09-14", "publisherClass": "blog_vendor" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories: Environmental Scan (J Med Internet Res, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "FSM Digital Health Strategic Plan 2026-2030 (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/wp-content/uploads/2026/03/FSM-Digital-Health-Strategic-Plan-Signed-1.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Job Vacancy: Immunization Information System Coordinator (FSM DHSA)", "url": "https://hsa.gov.fm/job-vacancy-immunization-information-system-coordinator/", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 15, "summary": "No law limits the sale of health data, marketing use, data brokers or health apps. The pending data protection bill would bind only national government departments, so private clinics, insurers and app makers would stay outside it.", "sources": [ { "title": "Data protection laws in the Federated States of Micronesia (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=FM", "date": "2026-02-02", "publisherClass": "law_firm" }, { "title": "C.B. No. 24-17, FSM Personal Data Protection Act of 2025 (Congress of the FSM)", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2025/06/CB-24-17.pdf", "date": "2025-05-17", "publisherClass": "legal_text" } ] }, "clinical": { "score": 34, "summary": "The vendor says a clinician can open Tamanu in any of three states and see the patient's history back to 2018, but this is not verified by the health department. Chuuk was not yet migrated, and dispensaries and health centres are mostly not on it.", "sources": [ { "title": "Unifying health data across the four Federated States of Micronesia (BES International)", "url": "https://www.bes.au/unifying-health-data-across-the-four-federated-states-of-micronesia/", "date": "2026-09-14", "publisherClass": "blog_vendor" }, { "title": "FSM Health ICT Team Conducts Successful Reverse Site Visit to Palau Ministry of Health and Human Services (FSM DHSA)", "url": "https://hsa.gov.fm/fsm-health-ict-team-conducts-successful-reverse-site-visit-to-palau-ministry-of-health-and-human-services/", "date": "2025-11", "publisherClass": "official" }, { "title": "FSM Digital Health Strategic Plan 2026-2030 (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/wp-content/uploads/2026/03/FSM-Digital-Health-Strategic-Plan-Signed-1.pdf", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 49, "summary": "Health research needs a national permit and ethics review, and cancer registry data is confidential by law with a fine or prison for misuse. There is no opt-out and no rules for research use of the new national record.", "sources": [ { "title": "The Federated States of Micronesia Cultural Research Policy (FSM NACH)", "url": "https://nach.gov.fm/wp-content/uploads/2018/05/the-federated-states-of-micronesia-cultural-research-policy_5-30-18.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Conducting Research in the FSM (FSM Office of National Archives, Culture and Historic Preservation)", "url": "https://nach.gov.fm/research/", "date": "undated", "publisherClass": "official" }, { "title": "FSM Code Title 41, Chapter 11, Cancer Registry System Act (FSM Legal Information System)", "url": "https://fsmlaw.org/fsm/code/code2014/FSMCode2014Tit41Chap11.html", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 20, "summary": "No law, guidance or device rule for clinical AI was found, and the 2022 medicines law does not cover devices. The vendor used AI to map legacy procedure and medication text to code lists, with human review.", "sources": [ { "title": "FSM Safe Pharmaceutical Act of 2022, Public Law No. 22-136 (FSM DHSA)", "url": "https://hsa.gov.fm/wp-content/uploads/2023/06/FSM-Safe-Pharmaceutical-Act-of-2022.pdf", "date": "2022-06-21", "publisherClass": "legal_text" }, { "title": "FSM Digital Health Strategic Plan 2026-2030 (FSM Department of Health and Social Affairs)", "url": "https://hsa.gov.fm/wp-content/uploads/2026/03/FSM-Digital-Health-Strategic-Plan-Signed-1.pdf", "date": "undated", "publisherClass": "official" }, { "title": "AI Regulation in Micronesia (FSM) (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-micronesia", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Unifying health data across the four Federated States of Micronesia (BES International)", "url": "https://www.bes.au/unifying-health-data-across-the-four-federated-states-of-micronesia/", "date": "2026-09-14", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitution of the FSM, Article IV, section 5", "level": "National", "year": "1978", "what": "Protects against unreasonable search, seizure or invasion of privacy; gives no record-access right.", "url": "https://fsmlaw.org/fsm/constitution/article4.htm" }, { "name": "Cancer Registry System Act (PL 15-39), 41 F.S.M.C. 1101-1108", "level": "National", "year": "2008", "what": "Mandatory cancer reporting; data confidential; research release needs ethics approval; $2,000 fine for leaks.", "url": "https://fsmlaw.org/fsm/code/code2014/FSMCode2014Tit41Chap11.html" }, { "name": "FSM Safe Pharmaceutical Act of 2022 (Public Law No. 22-136)", "level": "National", "year": "2022", "what": "Medicines registration and import control; no medical device or software rules.", "url": "https://hsa.gov.fm/wp-content/uploads/2023/06/FSM-Safe-Pharmaceutical-Act-of-2022.pdf" }, { "name": "C.B. No. 24-17, Personal Data Protection Act of 2025 (pending bill)", "level": "National", "year": "2025", "what": "Not enacted. Data principles for national departments only; health data sensitive; no access right or damages.", "url": "https://www.cfsm.gov.fm/wp-content/uploads/2025/06/CB-24-17.pdf" }, { "name": "FSM National Research Policy and Cultural Research Policy", "level": "National", "year": "2024", "what": "Research permits; medical research reviewed by the FSM Human Research Ethics Committee; informed consent.", "url": "https://nach.gov.fm/research/" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-03-16", "headline": "Ransomware forces Yap health department to shut down its computer network", "paraphrase": "Ransomware hit the Yap State health department's network. The department shut down every computer and its digital health systems, said so in a public notice, and kept serving patients more slowly while systems were rebuilt.", "source": "Security Affairs", "url": "https://securityaffairs.com/175445/cyber-crime/a-ransomware-attack-hit-the-micronesian-state-of-yap.html", "theme": "breach", "status": "admitted" } ] }, { "iso3": "SLB", "name": "Solomon Islands", "region": "Oceania", "overall": 25, "rank": "183=", "likelyRank": "161 to 194", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "Solomon Islands has no data protection law, no right-to-information law and no electronic patient record; most patients carry their own paper booklet.", "categories": { "access": { "score": 30, "summary": "No law gives patients a right to see or copy their health record, and there is no right-to-information law. In practice most patients keep their own paper care booklet, which the World Bank says is at high risk of being lost or damaged.", "sources": [ { "title": "Constitution of Solomon Islands 1978 (rev. 2018), Constitute Project copy", "url": "https://www.constituteproject.org/constitution/Solomon_Islands_2018?lang=en", "date": "undated", "publisherClass": "legal_text" }, { "title": "Transparency Solomon Islands urges government to enact Right to Information law (In-Depth Solomons)", "url": "https://indepthsolomons.com.sb/transparency-solomon-islands-urges-government-to-enact-right-to-information-law/", "date": "2025-09-29", "publisherClass": "news" }, { "title": "Primary Health Care System in Solomon Islands: A PHC Performance Initiative Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523193918574/pdf/P1598650ce402801e0a5d4000e14f5643e2.pdf", "date": "2023", "publisherClass": "intergov" } ] }, "control": { "score": 25, "summary": "Patients have no legal say over who sees or uses their health data, no opt-out and no access log. There is no general data protection law, so control rests with the Ministry of Health and individual clinicians.", "sources": [ { "title": "Regional Digital Trade Integration Index 2.1 Economy Profile: Solomon Islands (UN ESCAP)", "url": "https://dtri.uneca.org/v1/uploads/country-profile/slb-country-profile-en.pdf", "date": "2026-06", "publisherClass": "intergov" }, { "title": "Primary Health Care System in Solomon Islands: A PHC Performance Initiative Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523193918574/pdf/P1598650ce402801e0a5d4000e14f5643e2.pdf", "date": "2023", "publisherClass": "intergov" } ] }, "privacy": { "score": 25, "summary": "There is no data protection law, no regulator and no general breach notification duty; a Data Protection and Privacy Bill is still being drafted with UNCTAD support. The Constitution's privacy clause covers searches and entry, not personal information.", "sources": [ { "title": "Constitution of Solomon Islands 1978 (rev. 2018), Constitute Project copy", "url": "https://www.constituteproject.org/constitution/Solomon_Islands_2018?lang=en", "date": "undated", "publisherClass": "legal_text" }, { "title": "Regional Digital Trade Integration Index 2.1 Economy Profile: Solomon Islands (UN ESCAP)", "url": "https://dtri.uneca.org/v1/uploads/country-profile/slb-country-profile-en.pdf", "date": "2026-06", "publisherClass": "intergov" }, { "title": "Solomon Islands Data Protection and Privacy Legislation (Pacific Ecommerce Initiative, Pacific Islands Forum Secretariat)", "url": "https://pacificecommerce.org/pei-project/solomon-islands-data-protection-and-privacy-legislation/", "date": "undated", "publisherClass": "intergov" }, { "title": "Medical and Dental Practitioners Act 1988 (National Parliament of Solomon Islands)", "url": "https://parliament.gov.sb/files/legislation/Acts/1988/MEDICAL%20AND%20DENTAL%20PRACTITIONERS%20ACT%201988.pdf", "date": "1988", "publisherClass": "legal_text" } ] }, "journey": { "score": 20, "summary": "A 2025 study found no electronic health record in any of 293 facilities. The Ministry's DHIS2 system collects mostly aggregate data built from paper forms that are entered at provincial level.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories: Environmental Scan (JMIR, PMC12534756)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Primary Health Care System in Solomon Islands: A PHC Performance Initiative Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523193918574/pdf/P1598650ce402801e0a5d4000e14f5643e2.pdf", "date": "2023", "publisherClass": "intergov" }, { "title": "Data and digital transformation to achieve Health for All (WHO Western Pacific)", "url": "https://www.who.int/westernpacific/about/how-we-work/pacific-support/news/detail/20-11-2025-data-and-digital-transformation-to-achieve-health-for-all", "date": "2025-11-20", "publisherClass": "intergov" }, { "title": "MHMS paves the way for digital health transformation (Solomon Islands Government)", "url": "https://solomons.gov.sb/solomon-islands-ministry-of-health-and-medical-services-paves-the-way-for-digital-health-transformation/", "date": "2025-01-21", "publisherClass": "official" } ] }, "commercial": { "score": 20, "summary": "No law limits the sale or marketing use of health data, and no regulator oversees data brokers or health apps. The only data-collection limits ESCAP found apply to telecom operators.", "sources": [ { "title": "Regional Digital Trade Integration Index 2.1 Economy Profile: Solomon Islands (UN ESCAP)", "url": "https://dtri.uneca.org/v1/uploads/country-profile/slb-country-profile-en.pdf", "date": "2026-06", "publisherClass": "intergov" }, { "title": "Solomon Islands Data Protection and Privacy Legislation (Pacific Ecommerce Initiative, Pacific Islands Forum Secretariat)", "url": "https://pacificecommerce.org/pei-project/solomon-islands-data-protection-and-privacy-legislation/", "date": "undated", "publisherClass": "intergov" } ] }, "clinical": { "score": 20, "summary": "Clinicians usually see only what the patient brings in a paper booklet; there is no shared electronic record. At the National Referral Hospital, staff used special software to link a child's repeat admissions because there is no national patient ID.", "sources": [ { "title": "Primary Health Care System in Solomon Islands: A PHC Performance Initiative Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523193918574/pdf/P1598650ce402801e0a5d4000e14f5643e2.pdf", "date": "2023", "publisherClass": "intergov" }, { "title": "Data that Saved Lives: How the Solomon Islands Reduced Child Deaths from Severe Acute Malnutrition (CDC Foundation)", "url": "https://www.cdcfoundation.org/data-for-health-feature-solomon-islands-reduced-child-deaths", "date": "undated", "publisherClass": "news" } ] }, "research": { "score": 43, "summary": "The Solomon Islands Health Research and Ethics Review Board must approve any health research and reviews consent forms. No law on consent, opt-out or transparency for secondary use of health records was found.", "sources": [ { "title": "Newly appointed SIHRERB members induction workshop (Solomon Islands Government)", "url": "https://solomons.gov.sb/newly-appointed-sihrerb-members-induction-workshop/", "date": "2025-04-25", "publisherClass": "official" } ] }, "ai": { "score": 18, "summary": "AI already screens chest X-rays for tuberculosis, yet no rules for clinical AI were found. Solomon Islands has no AI law, no AI regulator and no verified medical device rules for AI software.", "sources": [ { "title": "Solomon Islands (Delft Imaging)", "url": "https://delftimaging.com/impact/solomon-islands/", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "AI Regulation in Solomon Islands: Current Status (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-solomon-islands", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitution of Solomon Islands 1978, sections 9 and 12", "level": "National", "year": "1978", "what": "Protects against search of person or property without consent; protects freedom to receive and communicate information.", "url": "https://www.constituteproject.org/constitution/Solomon_Islands_2018?lang=en" }, { "name": "Medical and Dental Practitioners Act 1988 (No. 7 of 1988)", "level": "National", "year": "1988", "what": "Registers doctors and dentists; Board can discipline negligence and unprofessional conduct. No specific confidentiality clause.", "url": "https://parliament.gov.sb/files/legislation/Acts/1988/MEDICAL%20AND%20DENTAL%20PRACTITIONERS%20ACT%201988.pdf" }, { "name": "Telecommunications Act 2009 (No. 20 of 2009), sections 72 and 73, as amended 2021", "level": "National", "year": "2009", "what": "Limits consumer data collection and protects communications confidentiality, for the telecom sector only.", "url": "https://dtri.uneca.org/v1/uploads/country-profile/slb-country-profile-en.pdf" }, { "name": "Data Protection and Privacy Bill (in drafting)", "level": "National", "year": "draft", "what": "Planned economy-wide personal data law, drafted by the Ministry of Communication and Aviation with UNCTAD; not yet law.", "url": "https://pacificecommerce.org/pei-project/solomon-islands-data-protection-and-privacy-legislation/" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "SSD", "name": "South Sudan", "region": "Africa", "overall": 25, "rank": "183=", "likelyRank": "161 to 194", "band": "Weak", "keysModel": "Institutional", "confidence": "high", "headline": "South Sudan has no data protection law, mostly paper records and no shared record; a free legal route to your own file exists on paper.", "categories": { "access": { "score": 34, "summary": "The Right of Access to Information Act 2013 lets citizens request records about themselves free, with a reply in 7 working days. It is not a health records law and its commission has lacked staff and money, so 34, the band of Sierra Leone (32).", "sources": [ { "title": "Right of Access to Information Act 2013 (Act No. 65), Laws of South Sudan (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/ssd182371.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "Information Commission complains about lack of access to information (Radio Tamazuj)", "url": "https://www.radiotamazuj.org/en/news/article/information-commission-complain-about-lack-of-access-to-information", "date": "2017-09-29", "publisherClass": "news" }, { "title": "Maturity of the health information system of South Sudan: progress, gaps and priorities for investment (WHO South Sudan)", "url": "https://www.afro.who.int/sites/default/files/2025-03/Knowledge%20Management%20Series%20for%20Health%20Maturity%20of%20the%20Health%20Information%20System%20of%20South%20Sudan%20_%20progress%2C%20gaps%20and%20priorities%20for%20investment.pdf", "date": "2025-02", "publisherClass": "intergov" } ] }, "control": { "score": 24, "summary": "No law sets consent rules for health data, and patients have no opt-out and no access log. The only tools are a constitutional privacy right and a rule letting a body refuse to release a third party's personal information unless that person consents.", "sources": [ { "title": "South Sudan's Constitution of 2011, revised 2013 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/South_Sudan_2013?lang=en", "date": "2013", "publisherClass": "legal_text" }, { "title": "Right of Access to Information Act 2013 (Act No. 65), Laws of South Sudan (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/ssd182371.pdf", "date": "2013", "publisherClass": "legal_text" }, { "title": "South Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/south-sudan/", "date": "2022-05-24", "publisherClass": "law_firm" } ] }, "privacy": { "score": 22, "summary": "South Sudan has no data protection law, regulator or breach notice rule, and has not signed the AU Malabo Convention. The 2026 Cybercrimes Act makes providers keep user data 180 days but requires court orders for searches and interception, a little above Sudan (20).", "sources": [ { "title": "Cybercrimes and Computer Misuse Act 2026, Laws of South Sudan (South Sudan NGO Forum library copy)", "url": "https://docs.southsudanngoforum.org/sites/default/files/2026-08/South-Sudan-Cybercrimes-And-Computer-Misuse-Act-2026.pdf", "date": "2026-02-18", "publisherClass": "legal_text" }, { "title": "List of countries that have signed, ratified or acceded to the AU Convention on Cyber Security and Personal Data Protection (African Union)", "url": "https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf", "date": "2024-07-08", "publisherClass": "intergov" }, { "title": "South Sudan's new cybercrime law ramps up threat of jail for journalists (Committee to Protect Journalists)", "url": "https://cpj.org/2026/04/south-sudans-new-cybercrime-law-ramps-up-threat-of-jail-for-journalists/", "date": "2026-04-09", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 20, "summary": "DHIS2 carries aggregate reports from facilities to national level, but WHO found only 22.4% of facilities with full electronic systems and rated the health information system 40.5%, minimal maturity. No national record, exchange or e-prescription service was found.", "sources": [ { "title": "Maturity of the health information system of South Sudan: progress, gaps and priorities for investment (WHO South Sudan)", "url": "https://www.afro.who.int/sites/default/files/2025-03/Knowledge%20Management%20Series%20for%20Health%20Maturity%20of%20the%20Health%20Information%20System%20of%20South%20Sudan%20_%20progress%2C%20gaps%20and%20priorities%20for%20investment.pdf", "date": "2025-02", "publisherClass": "intergov" }, { "title": "Digital Care Companion: WHO invests in technology that connects the last mile (WHO South Sudan, Voices from the Field issue 21)", "url": "https://www.afro.who.int/sites/default/files/2026-09/WHO%20Voices%20From%20the%20Field%20issue%2021%20-%20Digital%20Care%20Companion%20WHO%20invests%20in%20technology%20that%20connects%20the%20last%20mile.pdf", "date": "2026-09", "publisherClass": "intergov" } ] }, "commercial": { "score": 20, "summary": "No South Sudanese law limits selling health data or using it for marketing, because there is no data protection law. The nearest rule is a 2026 duty on telecom and internet providers to keep user data confidential, which does not reach health providers or apps.", "sources": [ { "title": "South Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/south-sudan/", "date": "2022-05-24", "publisherClass": "law_firm" }, { "title": "Cybercrimes and Computer Misuse Act 2026, Laws of South Sudan (South Sudan NGO Forum library copy)", "url": "https://docs.southsudanngoforum.org/sites/default/files/2026-08/South-Sudan-Cybercrimes-And-Computer-Misuse-Act-2026.pdf", "date": "2026-02-18", "publisherClass": "legal_text" }, { "title": "South Sudan to get data protection bill in 2026, says minister (Radio Tamazuj)", "url": "https://www.radiotamazuj.org/en/news/article/south-sudan-to-get-data-protection-bill-in-2026-says-minister", "date": "2025-12-11", "publisherClass": "news" } ] }, "clinical": { "score": 18, "summary": "Most clinicians see only their own facility's paper registers. WHO says its Digital Care Companion lets a record be retrieved at later visits, including at other facilities, but it is new and its reach is not counted.", "sources": [ { "title": "Digital Care Companion: WHO invests in technology that connects the last mile (WHO South Sudan, Voices from the Field issue 21)", "url": "https://www.afro.who.int/sites/default/files/2026-09/WHO%20Voices%20From%20the%20Field%20issue%2021%20-%20Digital%20Care%20Companion%20WHO%20invests%20in%20technology%20that%20connects%20the%20last%20mile.pdf", "date": "2026-09", "publisherClass": "intergov" }, { "title": "Maturity of the health information system of South Sudan: progress, gaps and priorities for investment (WHO South Sudan)", "url": "https://www.afro.who.int/sites/default/files/2025-03/Knowledge%20Management%20Series%20for%20Health%20Maturity%20of%20the%20Health%20Information%20System%20of%20South%20Sudan%20_%20progress%2C%20gaps%20and%20priorities%20for%20investment.pdf", "date": "2025-02", "publisherClass": "intergov" } ] }, "research": { "score": 43, "summary": "No law sets consent or opt-out rules for reusing health records in research. One safeguard counts: a Ministry of Health Research Ethics Review Board, set up as a research ethics committee in 2006, that reviews studies.", "sources": [ { "title": "Guidance for undertaking research in the Republic of South Sudan (South Sudan Medical Journal)", "url": "http://www.southsudanmedicaljournal.com/archive/august-2011/guidance-for-undertaking-research-in-the-republic-of-south-sudan.html", "date": "2011-08", "publisherClass": "academic" }, { "title": "South Sudan's road to universal health coverage (Pan African Medical Journal, via PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9475057/", "date": "2022-06-07", "publisherClass": "academic" }, { "title": "South Sudan health legislation: thematic highlights (WHO Country Planning Cycle Database)", "url": "https://extranet.who.int/cpcd/health-legislation/countries/ssd/thematic-highlights", "date": "undated", "publisherClass": "intergov" } ] }, "ai": { "score": 20, "summary": "No rules for AI or software as a medical device were found, which puts South Sudan in the no-rules band. The medicines regulator's 2012 Act covers medical devices in general, and a WHO-backed decision support tool keeps clinicians in charge by design, not by law.", "sources": [ { "title": "Drug and Food Control Authority Act, 2012 (Act No. 37) (UNEP LEAP, from FAOLEX)", "url": "https://leap.unep.org/en/countries/ss/national-legislation/drug-and-food-control-authority-act-2012-act-no-37", "date": "2012", "publisherClass": "intergov" }, { "title": "Low cost technology solutions for expanding quality services into hard to reach areas: the Digital Care Companion innovation (UNHCR, via ReliefWeb)", "url": "https://reliefweb.int/report/south-sudan/low-cost-technology-solutions-expanding-quality-services-hard-reach-areas-digital-care-companion-innovation", "date": "2026-09-18", "publisherClass": "intergov" } ] } }, "laws": [ { "name": "Transitional Constitution 2011 (revised 2013), Articles 22 and 32", "level": "National", "year": "2011", "what": "Protects privacy of private life and correspondence; gives citizens access to official records, limited by others' privacy.", "url": "https://www.constituteproject.org/constitution/South_Sudan_2013?lang=en" }, { "name": "Right of Access to Information Act 2013 (Act No. 65)", "level": "National", "year": "2013", "what": "Citizens may request records; replies in 7 working days; no fee for one's own personal information.", "url": "https://faolex.fao.org/docs/pdf/ssd182371.pdf" }, { "name": "Drug and Food Control Authority Act 2012 (Act No. 37)", "level": "National", "year": "2012", "what": "Sets up the regulator for drugs, poisons, cosmetics, medical devices and food.", "url": "https://leap.unep.org/en/countries/ss/national-legislation/drug-and-food-control-authority-act-2012-act-no-37" }, { "name": "Cybercrimes and Computer Misuse Act 2026", "level": "National", "year": "2026", "what": "Providers keep user data 180 days, confidential without judicial order; court orders needed for searches and interception.", "url": "https://docs.southsudanngoforum.org/sites/default/files/2026-08/South-Sudan-Cybercrimes-And-Computer-Misuse-Act-2026.pdf" }, { "name": "AU Convention on Cyber Security and Personal Data Protection (Malabo)", "level": "Supranational", "year": "2014", "what": "Regional data protection treaty; South Sudan had neither signed nor ratified as of July 2024.", "url": "https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "DMA", "name": "Dominica", "region": "Americas", "overall": 24, "rank": "187=", "likelyRank": "167 to 196", "band": "Poor", "keysModel": "Institutional", "confidence": "high", "headline": "Dominica has no data protection law, and the national health record system it has announced was still being prepared for rollout in mid-2026.", "categories": { "access": { "score": 20, "summary": "No law gives patients a right to see or copy their health record: Dominica has no data protection act and no freedom of information act. A patient portal is planned in the national health information system, but it is not live.", "sources": [ { "title": "2026 Investment Climate Statement: Dominica (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/08/701264_2026-Dominica-Investment-Climate-Statement.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "HMIS FAQs: Access (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/access", "date": "undated", "publisherClass": "official" }, { "title": "HMIS Implementation status (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/implementation", "date": "undated", "publisherClass": "official" }, { "title": "Constitution of the Commonwealth of Dominica, 1978 (Georgetown PDBA copy)", "url": "https://pdba.georgetown.edu/Constitutions/Dominica/constitution.pdf", "date": "1978", "publisherClass": "legal_text" } ] }, "control": { "score": 25, "summary": "With no data protection law, patients have no legal right to consent to or refuse sharing of their health data. The planned HMIS promises role-based access, an audit trail and patient choice over private doctors, but none of this is live.", "sources": [ { "title": "HMIS FAQs: Access (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/access", "date": "undated", "publisherClass": "official" }, { "title": "HMIS FAQs: Audit Trail (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/audit-trail", "date": "undated", "publisherClass": "official" }, { "title": "HMIS FAQs: Privacy (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/privacy", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 25, "summary": "Dominica has no data protection law, no regulator, no breach notification duty and no penalties for misusing health data. Hospital staff owe a duty of confidentiality under section 49 of the Hospitals Authority Act 2021, and a 2024 leak ended in a resignation.", "sources": [ { "title": "2026 Investment Climate Statement: Dominica (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/08/701264_2026-Dominica-Investment-Climate-Statement.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "External Resources: Data Protection Laws, Dominica (UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-dominica", "date": "2025-02", "publisherClass": "academic" }, { "title": "ECCB publishes policy considerations for data protection and privacy legislation in the ECCU", "url": "https://www.eccb-centralbank.org/news/eastern-caribbean-central-bank-publishes-policy-considerations-for-data-protection-and-privacy-legislation-in-the-eastern-caribbean-currency-union", "date": "2025-03-03", "publisherClass": "intergov" }, { "title": "Hospital completes investigations into voice notes on social media about patient (Nature Isle News)", "url": "https://natureisle.news/breaking-news/hospital-completes-investigations-into-voice-notes-on-social-media-about-patient/", "date": "2024-01-25", "publisherClass": "news" } ] }, "journey": { "score": 25, "summary": "A national HMIS is planned for three hospitals and 49 health centres, but in June 2026 the ministry was still preparing its rollout. The national lab runs a fully electronic information system, and surveillance uses DHIS2 alongside paper.", "sources": [ { "title": "About the HMIS (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/about", "date": "undated", "publisherClass": "official" }, { "title": "PAHO has donated 20 computers to the Ministry of Health to enhance health surveillance and digital health systems (Q95 Radio)", "url": "http://www.q95da.com/news/paho-has-donated-20-computers-to-the-ministry-of-health-wellness-and-social-services-to-enhance-health-surveillance-and-digital-health-systems-in-dominica", "date": "2026-06-16", "publisherClass": "news" }, { "title": "Dominica strengthens surveillance capacity through DHIS2 training (PAHO)", "url": "https://www.paho.org/en/news/21-5-2026-dominica-strengthens-surveillance-capacity-through-dhis2-training", "date": "2026-05-21", "publisherClass": "intergov" }, { "title": "National Laboratory upgrades information system (Variety News Group)", "url": "https://www.varietynewsgroup.com/post/national-laboratory-upgrades-information-system-to-deliver-faster-more-reliable-patient-care", "date": "2026-07-13", "publisherClass": "news" } ] }, "commercial": { "score": 20, "summary": "No law limits the sale of health data or its use for marketing, and no rules cover health apps or data brokers. The only national privacy policy found covers personal data collected on government websites.", "sources": [ { "title": "2026 Investment Climate Statement: Dominica (US Department of State)", "url": "https://www.state.gov/wp-content/uploads/2026/08/701264_2026-Dominica-Investment-Climate-Statement.pdf", "date": "2026-08", "publisherClass": "official" }, { "title": "External Resources: Data Protection Laws, Dominica (UWI Data Protection Office)", "url": "https://www.uwi.edu/data-protection/resources-external-dominica", "date": "2025-02", "publisherClass": "academic" } ] }, "clinical": { "score": 20, "summary": "Clinicians cannot yet see a patient's record across facilities, because the shared HMIS is not live. Lab results are electronic at the national lab, but private doctors are not linked and old paper records will not be fully migrated.", "sources": [ { "title": "HMIS FAQs: Records (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/records", "date": "undated", "publisherClass": "official" }, { "title": "HMIS FAQs: Private doctors (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/privitization", "date": "undated", "publisherClass": "official" }, { "title": "HMIS FAQs: Pharmacy (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/pharmacy", "date": "undated", "publisherClass": "official" }, { "title": "HMIS FAQs: Lab work (Government of Dominica HMIS project)", "url": "https://hmisdevelopment.gov.dm/faqs/labwork", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "No law requires ethics approval for clinical trials, says the 2012 ministry and PAHO pharmaceutical profile, and with no data protection law nothing governs reuse of health records. A National Human Research Ethics Committee has approved studies, adding one safeguard to the base score.", "sources": [ { "title": "Dominica Pharmaceutical Country Profile (Ministry of Health with PAHO/WHO)", "url": "https://www.paho.org/sites/default/files/2025-06/pharmaceutical-country-profile-dominica.pdf", "date": "2012-03", "publisherClass": "official" }, { "title": "Distribution, Burden, and Impact of Acute Gastroenteritis in Dominica, 2009-2010 (PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC4021997/", "date": "2013-12", "publisherClass": "academic" } ] }, "ai": { "score": 20, "summary": "No law, guidance or regulator covers clinical AI, and Dominica has no medicines or device regulator. Ministry staff were trained in 2026 to use AI tools such as Copilot for data work, with no published rules.", "sources": [ { "title": "Dominica Ministry of Health and PAHO strengthen clerical staff capacity in data analysis (PAHO)", "url": "https://www.paho.org/en/news/24-6-2026-dominica-ministry-health-and-paho-strengthen-clerical-staff-capacity-data-analysis", "date": "2026-06-24", "publisherClass": "intergov" }, { "title": "Dominica Pharmaceutical Country Profile (Ministry of Health with PAHO/WHO)", "url": "https://www.paho.org/sites/default/files/2025-06/pharmaceutical-country-profile-dominica.pdf", "date": "2012-03", "publisherClass": "official" }, { "title": "What is AI regulation in Dominica? (Levellers)", "url": "https://www.levellers.ai/what-is/ai-regulation-dominica", "date": "2026-06-07", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitution of the Commonwealth of Dominica", "level": "National", "year": "1978", "what": "Protects privacy of the home and other property; no general data protection or record access right.", "url": "https://pdba.georgetown.edu/Constitutions/Dominica/constitution.pdf" }, { "name": "Dominica Hospitals Authority Act, 2021 (No. 8 of 2021), amended by Act No. 13 of 2024", "level": "National", "year": "2021", "what": "Creates the Hospitals Authority; the hospital cites its section 49 confidentiality duty for staff. Link is the 2024 amendment.", "url": "https://printery.dominica.gov.dm/Uploads/Preview01f7e34b-fbd9-4b11-b019-549e4d28dbdd.pdf" }, { "name": "Medical Profession Act, 2026", "level": "National", "year": "2026", "what": "Creates a Dominica Medical Council with complaints and disciplinary committees for doctors.", "url": "https://printery.dominica.gov.dm/ProductDocuments/DownloadPreview/7911" }, { "name": "Medical Laboratories Act, 2024", "level": "National", "year": "2024", "what": "Sets up a Medical Laboratories Council to license labs and staff and enforce quality standards.", "url": "https://pressroomopm.gov.dm/cabinet-approves-the-appointment-of-the-medical-laboratories-council/" }, { "name": "Electronic Evidence Act, 2010", "level": "National", "year": "2010", "what": "Governs electronic records as evidence in court; not a data protection law.", "url": "https://www.unodc.org/cld/document/dma/2010/electronic_evidence_act.html" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-06-23", "headline": "Hospitals authority investigates staff role after video of a patient spread online", "paraphrase": "A video of a patient receiving hospital care circulated on social media. The hospitals authority called it a breach of privacy, condemned its sharing, and said staff found involved would face strict discipline.", "source": "Q95 Radio (Dominica)", "url": "https://www.q95da.com/news/dominica-hospitals-authority-dha-launches-an-investigation-into-the-circulation-of-a-video-on-social-media-showing-a-patient-in-a-vulnerable-condition-sparking-concern-about-patient-privacy-care-standards", "theme": "breach", "status": "admitted" } ] }, { "iso3": "HTI", "name": "Haiti", "region": "Americas", "overall": 24, "rank": "187=", "likelyRank": "167 to 196", "band": "Poor", "keysModel": "Institutional", "confidence": "medium", "headline": "Haiti has no data protection law and no verified right to see your record; an HIV-born electronic record links some clinics, not the country.", "categories": { "access": { "score": 20, "summary": "No Haitian law found gives patients a right to see or copy their medical record, and a June 2026 legal analysis says a decade passed without a data protection law. There is no patient portal; any access right in health regulations is not verified.", "sources": [ { "title": "Code penal d'Haiti (1835, as amended), compiled text, Art. 323", "url": "https://www.oas.org/juridico/PDFs/mesicic4_hti_penal.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Decret portant sur le droit de tout administre a s'adresser a l'administration publique par des moyens electroniques, Le Moniteur No. 20", "url": "https://www.omrh.gouv.ht/Media/Publications/3-Decrets/Decret%20portant%20sur%20le%20droit%20de%20tout%20administr%C3%A9.pdf", "date": "2016-01-29", "publisherClass": "legal_text" }, { "title": "La reglementation du numerique en Haiti : faut-il adopter de nouvelles normes ou mettre en oeuvre celles existantes ? (Village de la Justice)", "url": "https://www.village-justice.com/articles/reglementation-numerique-haiti-faut-adopter-nouvelles-normes-mettre-oeuvre,57798.html", "date": "2026-06-10", "publisherClass": "news" }, { "title": "De la responsabilite hospitaliere en droit haitien : essai de droit prospectif (Le Nouvelliste, opinion)", "url": "https://lenouvelliste.com/article/270277/de-la-responsabilite-hospitaliere-en-droit-haitien-essai-de-droit-prospectif", "date": "2026-07-24", "publisherClass": "news" } ] }, "control": { "score": 22, "summary": "Without a data protection law, patients have no legal right to consent, refuse sharing or see who opened their record. The iSantePlus record is shared across connected sites by design, and its fingerprint register held more than 100,000 prints.", "sources": [ { "title": "Decret du 11 mars 2020 portant Code penal, Le Moniteur Special No. 10 (24 June 2020), Arts. 434 and 437 to 439", "url": "https://faolex.fao.org/docs/pdf/hai210028.pdf", "date": "2020-06-24", "publisherClass": "legal_text" }, { "title": "iSantePlus, systeme d'information sanitaire (CHARESS)", "url": "https://charess.org/isanteplus", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Projet de loi instituant la carte d'identification nationale unique et portant sur la protection des donnees personnelles (HaitiDocs)", "url": "https://www.haitidocs.org/doc/prh-projet-loi-carte-identification-donnees-personnelles?lang=fr", "date": "2018", "publisherClass": "blog_vendor" }, { "title": "Le CPT et le gouvernement reportent l'entree en vigueur du nouveau code penal et procedure penale revises (Gazette Haiti)", "url": "https://gazettehaiti.com/node/13192", "date": "2025-12-27", "publisherClass": "news" } ] }, "privacy": { "score": 24, "summary": "Haiti has no data protection law, no regulator and no breach rules; the 1835 Penal Code punishes doctors, pharmacists and midwives who reveal secrets with one month to one year in prison. A tougher 2020 code was postponed in December 2025.", "sources": [ { "title": "Code penal d'Haiti (1835, as amended), compiled text, Art. 323", "url": "https://www.oas.org/juridico/PDFs/mesicic4_hti_penal.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Decret du 11 mars 2020 portant Code penal, Le Moniteur Special No. 10 (24 June 2020), Arts. 434 and 437 to 439", "url": "https://faolex.fao.org/docs/pdf/hai210028.pdf", "date": "2020-06-24", "publisherClass": "legal_text" }, { "title": "Le CPT et le gouvernement reportent l'entree en vigueur du nouveau code penal et procedure penale revises (Gazette Haiti)", "url": "https://gazettehaiti.com/node/13192", "date": "2025-12-27", "publisherClass": "news" }, { "title": "La reglementation du numerique en Haiti : faut-il adopter de nouvelles normes ou mettre en oeuvre celles existantes ? (Village de la Justice)", "url": "https://www.village-justice.com/articles/reglementation-numerique-haiti-faut-adopter-nouvelles-normes-mettre-oeuvre,57798.html", "date": "2026-06-10", "publisherClass": "news" } ] }, "journey": { "score": 28, "summary": "MSPP's national health information system, SISNU, gathers facility data for planning, and PAHO called it a pillar of health governance in September 2026. Patient-level links exist only inside iSantePlus, which reached 157 facilities in 2022.", "sources": [ { "title": "Haiti presente le rapport statistique 2025 du secteur sante (OPS/OMS)", "url": "https://www.paho.org/fr/nouvelles/24-9-2026-haiti-presente-le-rapport-statistique-2025-du-secteur-sante", "date": "2026-09-24", "publisherClass": "intergov" }, { "title": "Comparative analysis of HIV data completeness in Haiti's iSante Plus Electronic Medical Record system (BMJ Open)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12258347/", "date": "2025-07-13", "publisherClass": "academic" }, { "title": "iSantePlus, systeme d'information sanitaire (CHARESS)", "url": "https://charess.org/isanteplus", "date": "undated", "publisherClass": "blog_vendor" } ] }, "commercial": { "score": 22, "summary": "No law in force limits selling health data or using it for marketing, because Haiti has no data protection law. The postponed 2020 Penal Code would punish storing health data without express consent and prospecting despite a person's objection.", "sources": [ { "title": "Code penal d'Haiti (1835, as amended), compiled text, Art. 323", "url": "https://www.oas.org/juridico/PDFs/mesicic4_hti_penal.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Decret du 11 mars 2020 portant Code penal, Le Moniteur Special No. 10 (24 June 2020), Arts. 434 and 437 to 439", "url": "https://faolex.fao.org/docs/pdf/hai210028.pdf", "date": "2020-06-24", "publisherClass": "legal_text" }, { "title": "Le CPT et le gouvernement reportent l'entree en vigueur du nouveau code penal et procedure penale revises (Gazette Haiti)", "url": "https://gazettehaiti.com/node/13192", "date": "2025-12-27", "publisherClass": "news" } ] }, "clinical": { "score": 22, "summary": "A clinician can see a patient's history only when both facilities use iSantePlus, which began in HIV care. Elsewhere records are mostly on paper, and CHARESS says paper once meant no continuity of care.", "sources": [ { "title": "iSantePlus, systeme d'information sanitaire (CHARESS)", "url": "https://charess.org/isanteplus", "date": "undated", "publisherClass": "blog_vendor" }, { "title": "Comparative analysis of HIV data completeness in Haiti's iSante Plus Electronic Medical Record system (BMJ Open)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12258347/", "date": "2025-07-13", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "No law sets consent or opt-out rules for reusing health records, and a 2025 study used de-identified iSantePlus data with consent waived. Two safeguards count: National Bioethics Committee review, and the statutory medical secrecy offence.", "sources": [ { "title": "Procedures du Comite National de Bioethique pour approbation de protocole de recherche (MSPP, version du 14 janvier 2019)", "url": "https://mspp.gouv.ht/sites/default/files/publications/CNB%20Procedures%20pour%20soumission%20de%20Protocole%20de%20Recherche%20au%20CNB%20pour%20avis%20Version%20du%2014%20jan%2019%20(1).pdf", "date": "2019-01-14", "publisherClass": "official" }, { "title": "Comparative analysis of HIV data completeness in Haiti's iSante Plus Electronic Medical Record system (BMJ Open)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12258347/", "date": "2025-07-13", "publisherClass": "academic" } ] }, "ai": { "score": 18, "summary": "We found no rules for AI in clinical care: no AI law, no AI strategy and no health AI guidance. MSPP's pharmacy directorate requires medical devices to be registered, but its 2008 norms do not mention software or AI.", "sources": [ { "title": "Normes et Procedures de la Direction de la Pharmacie, du Medicament et de la Medecine Traditionnelle (DPM/MT, MSPP)", "url": "https://www.mspp.gouv.ht/sites/default/files/publications/Normes%20et%20Procedures%20de%20la%20DPMMT.pdf", "date": "2008-07", "publisherClass": "official" }, { "title": "La reglementation du numerique en Haiti : faut-il adopter de nouvelles normes ou mettre en oeuvre celles existantes ? (Village de la Justice)", "url": "https://www.village-justice.com/articles/reglementation-numerique-haiti-faut-adopter-nouvelles-normes-mettre-oeuvre,57798.html", "date": "2026-06-10", "publisherClass": "news" } ] } }, "laws": [ { "name": "Code penal (1835, as amended), Article 323", "level": "National", "year": "1835", "what": "Health professionals who reveal patient secrets face one month to one year in prison.", "url": "https://www.oas.org/juridico/PDFs/mesicic4_hti_penal.pdf" }, { "name": "Decret du 11 mars 2020 portant Code penal (not in force)", "level": "National", "year": "2020", "what": "Adds personal data offences, including storing health data without express consent; start postponed in December 2025.", "url": "https://faolex.fao.org/docs/pdf/hai210028.pdf" }, { "name": "Decret du 29 janvier 2016 sur le droit de tout administre a s'adresser a l'administration par des moyens electroniques", "level": "National", "year": "2016", "what": "E-administration principles include private life and personal data protection; not a data protection law.", "url": "https://www.omrh.gouv.ht/Media/Publications/3-Decrets/Decret%20portant%20sur%20le%20droit%20de%20tout%20administr%C3%A9.pdf" }, { "name": "Projet de loi instituant la carte d'identification nationale unique et portant sur la protection des donnees personnelles (draft)", "level": "National", "year": "2018", "what": "Draft ID and data protection bill; never adopted.", "url": "https://www.haitidocs.org/doc/prh-projet-loi-carte-identification-donnees-personnelles?lang=fr" }, { "name": "Procedures du Comite National de Bioethique (MSPP)", "level": "National", "year": "2019", "what": "Research needs prior ethics opinion; voluntary, withdrawable consent in French and Creole.", "url": "https://mspp.gouv.ht/sites/default/files/publications/CNB%20Procedures%20pour%20soumission%20de%20Protocole%20de%20Recherche%20au%20CNB%20pour%20avis%20Version%20du%2014%20jan%2019%20(1).pdf" }, { "name": "Normes et Procedures de la DPM/MT", "level": "National", "year": "2008", "what": "Medical devices need registration and marketing authorisation; no software or AI rules.", "url": "https://www.mspp.gouv.ht/sites/default/files/publications/Normes%20et%20Procedures%20de%20la%20DPMMT.pdf" } ], "dti": { "grade": 82, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-07", "headline": "Patient says a health worker who was her neighbour disclosed her diagnosis", "paraphrase": "The paper reports that a woman, writing under a pseudonym, says a health worker living nearby told his partner her diagnosis. The news spread through her neighbourhood. A doctor quoted in the piece says confidentiality breaches happen.", "source": "Le Nouvelliste", "url": "https://lenouvelliste.com/article/269367/vih-en-haiti-quand-la-discrimination-sajoute-a-la-maladie-dans-les-hopitaux", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-04-19", "headline": "Gangs burn decades of patient archives at a public hospital, forcing care to restart", "paraphrase": "The outlet reports that armed groups vandalised and burned nearly fifty years of archives at a public specialist hospital. A doctor there says he has had to restart some patients' follow-up from zero.", "source": "AyiboPost", "url": "https://ayibopost.com/50-ans-darchives-sur-la-sante-mentale-en-haiti-incendiees-par-des-gangs-a-mars-kline/", "theme": "other", "status": "alleged" }, { "date": "2026-01-18", "headline": "Patient's medical evacuation abroad delayed while she waits for a medical certificate", "paraphrase": "The outlet reports that a woman awaiting transfer abroad for specialist care told it she could not fly until a medical certificate and other papers were issued. Her departure was postponed while the file was completed.", "source": "Vant Bèf Info", "url": "https://vantbefinfo.com/katiana-milfort-bloquee-au-cap-haitien-en-attente-de-documents-pour-un-transfert-medical-a-cuba/", "theme": "access_delay_or_cost", "status": "self_reported" } ] }, { "iso3": "LBY", "name": "Libya", "region": "Africa", "overall": 23, "rank": "189=", "likelyRank": "172 to 197", "band": "Poor", "keysModel": "Institutional", "confidence": "high", "headline": "Libya has no data protection law and mostly paper records; a 1986 law protects medical secrets, but patients have no verified right to their file.", "categories": { "access": { "score": 20, "summary": "No Libyan law we opened gives patients a right to see or copy their medical record, and Libya has no data protection law. Records are still mostly on paper, and no patient portal was found.", "sources": [ { "title": "Law No. 17 of 1986 on Medical Responsibility (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/", "date": "1986", "publisherClass": "legal_text" }, { "title": "Law No. 6 of 2022 on Electronic Transactions (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-6-%D9%84%D8%B3%D9%86%D8%A9-2022-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A5%D9%84%D9%83/", "date": "2022", "publisherClass": "legal_text" }, { "title": "Data protection laws in Libya (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LY", "date": "2024-01-18", "publisherClass": "law_firm" }, { "title": "Physicians' perceptions of the expected impact of electronic medical records: Ajdabiya case study (Fezzan University Scientific Journal)", "url": "https://fezzanu.edu.ly/fusj/index.php/FUAJ/article/download/831/547", "date": "2026-07-20", "publisherClass": "academic" } ] }, "control": { "score": 22, "summary": "Patients have no legal tools to decide who sees their health record: no opt-out, no granular consent and no access log. The main protection is a 1986 duty on medical staff to keep patient secrets.", "sources": [ { "title": "Law No. 17 of 1986 on Medical Responsibility (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/", "date": "1986", "publisherClass": "legal_text" }, { "title": "Law No. 6 of 2022 on Electronic Transactions (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-6-%D9%84%D8%B3%D9%86%D8%A9-2022-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A5%D9%84%D9%83/", "date": "2022", "publisherClass": "legal_text" }, { "title": "Data protection under Libya's e-Transactions Law (Eltumi & Partners)", "url": "https://eltumipartners.com/2023/12/data-protection-under-libya-e-transactions-law/", "date": "2023-12-14", "publisherClass": "law_firm" } ] }, "privacy": { "score": 25, "summary": "Libya has no data protection law, no data regulator and no breach notice rule. Health data relies on medical secrecy in the 1986 law and a 2022 cybercrime law that punishes altering or hiding medical results.", "sources": [ { "title": "Law No. 5 of 2022 on Combating Cybercrimes (Law Society of Libya)", "url": "https://lawsociety.ly/en/legislation/law-no-5-of-2022-regarding-combating-cybercrimes/", "date": "2022", "publisherClass": "legal_text" }, { "title": "Libya data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/libya/", "date": "undated", "publisherClass": "academic" }, { "title": "Libya (Governance Atlas)", "url": "https://atlas.ayoadeabel.tech/countries/libya", "date": "2026-08", "publisherClass": "blog_vendor" }, { "title": "Data protection laws in Libya (DLA Piper)", "url": "https://www.dlapiperdataprotection.com/index.html?t=law&c=LY", "date": "2024-01-18", "publisherClass": "law_firm" } ] }, "journey": { "score": 18, "summary": "The Ministry of Health's information centre runs DHIS2 for aggregate facility statistics, but patient records do not follow people between clinics, hospitals, labs and pharmacies. A 2026 study says paper records still dominate.", "sources": [ { "title": "Health Information and Documentation Centre (Ministry of Health)", "url": "https://moh.gov.ly/pages/centers-offices/health-info-center", "date": "undated", "publisherClass": "official" }, { "title": "WHO and Libya's Ministry of Health sign Strategic Collaboration Framework (WHO EMRO)", "url": "https://www.emro.who.int/lby/libya-news/who-and-libyas-ministry-of-health-sign-strategic-collaboration-framework-to-strengthen-the-national-health-system.html", "date": "2026-05-05", "publisherClass": "intergov" }, { "title": "Libya launches two national initiatives to transform community and school health (United Nations Libya)", "url": "https://libya.un.org/en/316616-libya-launches-two-national-initiatives-transform-community-and-school-health", "date": "2026-06-03", "publisherClass": "intergov" }, { "title": "Physicians' perceptions of the expected impact of electronic medical records: Ajdabiya case study (Fezzan University Scientific Journal)", "url": "https://fezzanu.edu.ly/fusj/index.php/FUAJ/article/download/831/547", "date": "2026-07-20", "publisherClass": "academic" } ] }, "commercial": { "score": 25, "summary": "No Libyan law limits selling health data or using it for marketing, because there is no data protection law. The 1986 law only bars medical staff from exploiting a patient's need for their own gain.", "sources": [ { "title": "Law No. 17 of 1986 on Medical Responsibility (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/", "date": "1986", "publisherClass": "legal_text" }, { "title": "Law No. 6 of 2022 on Electronic Transactions (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-6-%D9%84%D8%B3%D9%86%D8%A9-2022-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A5%D9%84%D9%83/", "date": "2022", "publisherClass": "legal_text" }, { "title": "Libya (Governance Atlas)", "url": "https://atlas.ayoadeabel.tech/countries/libya", "date": "2026-08", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 17, "summary": "The 1986 law obliges a doctor to share what they know about a patient with other treating doctors on request, but there is no shared record. A clinician mostly sees only the paper file their own facility holds.", "sources": [ { "title": "Law No. 17 of 1986 on Medical Responsibility (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/", "date": "1986", "publisherClass": "legal_text" }, { "title": "Physicians' perceptions of the expected impact of electronic medical records: Ajdabiya case study (Fezzan University Scientific Journal)", "url": "https://fezzanu.edu.ly/fusj/index.php/FUAJ/article/download/831/547", "date": "2026-07-20", "publisherClass": "academic" } ] }, "research": { "score": 46, "summary": "No law sets consent or opt-out rules for reusing health records in research. Two safeguards count: a national bioethics committee set up in 2016, and a 1990 law that jails misuse of personal data collected for state studies.", "sources": [ { "title": "Law No. 4 of 1990 on the National System for Information and Documentation (DCAF Libya legal database)", "url": "https://security-legislation.ly/ar/latest-laws/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-4-%D9%84%D8%B3%D9%86%D8%A9-1990-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%86%D8%B8%D8%A7%D9%85-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84/", "date": "1990", "publisherClass": "legal_text" }, { "title": "Law No. 17 of 1986 on Medical Responsibility (Law Society of Libya)", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/", "date": "1986", "publisherClass": "legal_text" }, { "title": "Research ethics committee (Sebha University)", "url": "https://sebhau.edu.ly/research-ethics-committee/", "date": "undated", "publisherClass": "academic" } ] }, "ai": { "score": 25, "summary": "In June 2026 the Prime Minister adopted a national AI Ethics Charter saying AI should support, not replace, human decisions in health. It is a voluntary reference, like Egypt's 2023 charter, and no rules for AI medical devices or software were found.", "sources": [ { "title": "Dbaiba adopts AI Ethics Charter and launches National AI Strategy 2026 to 2030 (Libyan News Agency)", "url": "https://lana.gov.ly/post.php?lang=en&id=358532", "date": "2026-06-01", "publisherClass": "official" }, { "title": "National Artificial Intelligence Strategy of Libya 2025 to 2030 (OECD.AI)", "url": "https://oecd.ai/en/dashboards/policy-initiatives/national-artificial-intelligence-strategy-of-libya-2025-2030", "date": "2026-04-23", "publisherClass": "intergov" }, { "title": "Health ministry approves medical products registration regulation (Ean Libya)", "url": "https://www.eanlibya.com/%D8%A7%D9%84%D8%B5%D8%AD%D8%A9-%D8%AA%D8%B9%D8%AA%D9%85%D8%AF-%D9%84%D8%A7%D8%A6%D8%AD%D8%A9-%D8%AA%D8%B3%D8%AC%D9%8A%D9%84-%D8%A7%D9%84%D9%85%D9%86%D8%AA%D8%AC%D8%A7%D8%AA-%D8%A7%D9%84%D8%B7/", "date": "2026-03-04", "publisherClass": "news" } ] } }, "laws": [ { "name": "Constitutional Declaration of 2011, Articles 12 and 13", "level": "National", "year": "2011", "what": "Protects private life and the confidentiality of correspondence and communications.", "url": "https://dataprotection.africa/libya/" }, { "name": "Health Law No. 106 of 1973", "level": "National", "year": "1973", "what": "Licenses health facilities, pharmacies and medical professions; we found no patient record access clause.", "url": "https://security-legislation.ly/ar/latest-laws/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-106-%D9%84%D8%B3%D9%86%D8%A9-1973-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A5%D8%B5%D8%AF%D8%A7%D8%B1-%D8%A7%D9%84%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%A7%D9%84/" }, { "name": "Medical Responsibility Law No. 17 of 1986", "level": "National", "year": "1986", "what": "Medical secrecy, treatment consent, record-keeping duty, consent for experiments on people.", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-17-%D9%84%D8%B3%D9%86%D8%A9-1986-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B3%D8%A4%D9%88%D9%84%D9%8A%D8%A9-%D8%A7%D9%84%D8%B7%D8%A8%D9%8A/" }, { "name": "Law No. 4 of 1990 on the National System for Information and Documentation", "level": "National", "year": "1990", "what": "Personal data collected for state studies stays confidential; misuse brings prison and fines.", "url": "https://security-legislation.ly/ar/latest-laws/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-4-%D9%84%D8%B3%D9%86%D8%A9-1990-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%86%D8%B8%D8%A7%D9%85-%D8%A7%D9%84%D9%88%D8%B7%D9%86%D9%8A-%D9%84%D9%84/" }, { "name": "Law No. 5 of 2022 on Combating Cybercrimes", "level": "National", "year": "2022", "what": "Punishes unlawful access and electronic tampering with medical results; allows state content monitoring.", "url": "https://lawsociety.ly/en/legislation/law-no-5-of-2022-regarding-combating-cybercrimes/" }, { "name": "Law No. 6 of 2022 on Electronic Transactions", "level": "National", "year": "2022", "what": "Consent, notice and access duties for personal data, mainly binding certification service providers.", "url": "https://lawsociety.ly/legislation/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%B1%D9%82%D9%85-6-%D9%84%D8%B3%D9%86%D8%A9-2022-%D9%85-%D8%A8%D8%B4%D8%A3%D9%86-%D8%A7%D9%84%D9%85%D8%B9%D8%A7%D9%85%D9%84%D8%A7%D8%AA-%D8%A7%D9%84%D8%A5%D9%84%D9%83/" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "MHL", "name": "Marshall Islands", "region": "Oceania", "overall": 23, "rank": "189=", "likelyRank": "170 to 196", "band": "Poor", "keysModel": "State", "confidence": "medium", "headline": "A 2025 data law covering only government bodies gives no record access right and is not yet in force, while most records stay on paper.", "categories": { "access": { "score": 20, "summary": "No law giving patients a right to see or copy their health record was found, and there is no patient portal. The 2025 data protection law covers only government bodies, has no access right and takes effect 12 months after its 7 October 2025 certification.", "sources": [ { "title": "Personal Data Protection Act 2025 (P.L. 2025-43), Nitijela", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=893:pl-2025-43-personal-data-protection-act-2025&start=20", "date": "2025-10-07", "publisherClass": "legal_text" }, { "title": "Constitution of the Republic of the Marshall Islands (RMI Judiciary copy)", "url": "https://rmicourts.org/wp-content/uploads/2022/02/ConstitutionoftheRepublicoftheMarshallIslands_1.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "control": { "score": 25, "summary": "No opt-out, granular choice or patient-visible access log was found. Only sexually transmitted disease information has a statutory consent rule, and the 2025 law lets ministries share personal data with each other without asking the person.", "sources": [ { "title": "Communicable Diseases Prevention and Control Act 1988, 7 MIRC Ch.15 (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/MH_Communicable%20Diseases%20Prevention%20and%20Control%20Act_EN.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Cancer Registry Act 2009, Nitijela", "url": "https://rmiparliament.org/cms/images/LEGISLATION/PHOCA/PL_2009_19_Cancer%20Registry%20Act%202009.pdf", "date": "2009", "publisherClass": "legal_text" }, { "title": "Personal Data Protection Act 2025 (P.L. 2025-43), Nitijela", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=893:pl-2025-43-personal-data-protection-act-2025&start=20", "date": "2025-10-07", "publisherClass": "legal_text" } ] }, "privacy": { "score": 30, "summary": "Health data is protected mainly by narrow sector laws, such as a $1,000 fine for leaking STD information and a $2,000 fine for Health Fund staff disclosures. The 2025 data protection law is not yet in force, and its staff were unfunded and unappointed in March 2026.", "sources": [ { "title": "Personal Data Protection Act 2025 (P.L. 2025-43), Nitijela", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=893:pl-2025-43-personal-data-protection-act-2025&start=20", "date": "2025-10-07", "publisherClass": "legal_text" }, { "title": "Digital Republic of the Marshall Islands Project (P171517), Aide Memoire, March 2026 missions (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099062826194018850/pdf/P171517-d70f1d25-0f6a-4a39-a27c-a28f3be6eb53.pdf", "date": "2026-06-28", "publisherClass": "intergov" }, { "title": "Communicable Diseases Prevention and Control Act 1988, 7 MIRC Ch.15 (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/MH_Communicable%20Diseases%20Prevention%20and%20Control%20Act_EN.pdf", "date": "undated", "publisherClass": "legal_text" }, { "title": "Marshall Islands Health Fund Act of 2002, 7 MIRC Ch.2 (WHO copy)", "url": "https://platform.who.int/docs/default-source/mca-documents/policy-documents/law/MHL-CH-14-01-LAW-2014-eng-Marshall-Islands-Health-Fund-Act-of-2002.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "journey": { "score": 20, "summary": "Records are mostly on paper outside the hospitals. A 2025 study found an electronic record in 1 of 60 facilities (1.7%), and a 2023 World Bank review found no system to track primary care patients over time.", "sources": [ { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "The Primary Health Care System of the Republic of the Marshall Islands: A PHCPI Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523194155037/pdf/P1598650e39db8048080d8013c44af6a5a8.pdf", "date": "2023", "publisherClass": "intergov" }, { "title": "Marshall Islands Immunization Registry (WebIZ) login, Ministry of Health and Human Services", "url": "https://webiz.rmihealth.org/webiznet_rmi/Login.aspx", "date": "undated", "publisherClass": "official" }, { "title": "Digital Republic of the Marshall Islands Project (P171517), Aide Memoire, March 2026 missions (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099062826194018850/pdf/P171517-d70f1d25-0f6a-4a39-a27c-a28f3be6eb53.pdf", "date": "2026-06-28", "publisherClass": "intergov" } ] }, "commercial": { "score": 15, "summary": "No law limits the sale of health data, its use in marketing, data brokers or health apps. The 2025 data protection law binds only core government bodies, so private clinics, insurers and app makers fall outside it.", "sources": [ { "title": "Personal Data Protection Act 2025 (P.L. 2025-43), Nitijela", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=893:pl-2025-43-personal-data-protection-act-2025&start=20", "date": "2025-10-07", "publisherClass": "legal_text" }, { "title": "AI Regulation in the Marshall Islands (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-marshall-islands", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 18, "summary": "A clinician outside the main hospital usually works from paper. Only 1 of 60 facilities had an electronic record in a 2025 study, so a cross-provider view of a patient's history is not available at national scale.", "sources": [ { "title": "The Primary Health Care System of the Republic of the Marshall Islands: A PHCPI Assessment (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099121523194155037/pdf/P1598650e39db8048080d8013c44af6a5a8.pdf", "date": "2023", "publisherClass": "intergov" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "Communicable Diseases Prevention and Control Act 1988, 7 MIRC Ch.15 (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/MH_Communicable%20Diseases%20Prevention%20and%20Control%20Act_EN.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "research": { "score": 46, "summary": "The Ministry's Institutional Review Committee must approve release of confidential cancer registry data for research, and registry data is confidential by law. There is no consent or opt-out rule for research use of other health records.", "sources": [ { "title": "Cancer Registry Act 2009, Nitijela", "url": "https://rmiparliament.org/cms/images/LEGISLATION/PHOCA/PL_2009_19_Cancer%20Registry%20Act%202009.pdf", "date": "2009", "publisherClass": "legal_text" }, { "title": "Communicable Diseases Prevention and Control Act 1988, 7 MIRC Ch.15 (BWC Implementation copy)", "url": "https://bwcimplementation.org/sites/default/files/resource/MH_Communicable%20Diseases%20Prevention%20and%20Control%20Act_EN.pdf", "date": "undated", "publisherClass": "legal_text" } ] }, "ai": { "score": 18, "summary": "No law, guidance or device rule for clinical AI was found. A June 2026 review says the country has no AI law, bill, strategy or regulator, and none of its 2025 digital laws mentions AI.", "sources": [ { "title": "AI Regulation in the Marshall Islands (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-marshall-islands", "date": "2026-06-08", "publisherClass": "blog_vendor" }, { "title": "Republic of the Marshall Islands Policies and Regulations (Pacific Basin Telehealth Resource Center)", "url": "https://www.pbtrc.org/policies-and-regulations/republic-of-the-marshall-islands-policies-and-regulations/", "date": "undated", "publisherClass": "academic" } ] } }, "laws": [ { "name": "Constitution of the Republic of the Marshall Islands, Article II section 13", "level": "National", "year": "1979", "what": "Freedom from unreasonable interference in personal choices and from unreasonable intrusions into privacy.", "url": "https://rmicourts.org/wp-content/uploads/2022/02/ConstitutionoftheRepublicoftheMarshallIslands_1.pdf" }, { "name": "Personal Data Protection Act 2025 (P.L. 2025-43)", "level": "National", "year": "2025", "what": "Data principles for core government bodies only; health data sensitive; no access right; no damages; effective 12 months after certification.", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=893:pl-2025-43-personal-data-protection-act-2025&start=20" }, { "name": "Communicable Diseases Prevention and Control Act 1988, 7 MIRC Ch.15", "level": "National", "year": "1988", "what": "STD and HIV information confidential; release with consent or listed exceptions; $1,000 fine per breach.", "url": "https://bwcimplementation.org/sites/default/files/resource/MH_Communicable%20Diseases%20Prevention%20and%20Control%20Act_EN.pdf" }, { "name": "Cancer Registry Act 2009", "level": "National", "year": "2009", "what": "Mandatory national cancer registry; data confidential; research release needs Institutional Review Committee approval.", "url": "https://rmiparliament.org/cms/images/LEGISLATION/PHOCA/PL_2009_19_Cancer%20Registry%20Act%202009.pdf" }, { "name": "Marshall Islands Health Fund Act of 2002, 7 MIRC Ch.2", "level": "National", "year": "2002", "what": "Health Fund for covered persons; staff disclosure of personal information is an offense, up to $2,000 fine.", "url": "https://platform.who.int/docs/default-source/mca-documents/policy-documents/law/MHL-CH-14-01-LAW-2014-eng-Marshall-Islands-Health-Fund-Act-of-2002.pdf" }, { "name": "Digital Transformation and Identity Verification Act 2025", "level": "National", "year": "2025", "what": "Digital identity system; section 118 applies data protection principles and security duties to participating public bodies.", "url": "https://www.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html?download=875:pl-2025-26-digital-transformation-and-identity-verification-act-2025" } ], "dti": { "grade": 90, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "TUV", "name": "Tuvalu", "region": "Oceania", "overall": 23, "rank": "189=", "likelyRank": "169 to 196", "band": "Poor", "keysModel": "State", "confidence": "high", "headline": "Tuvalu has no data protection law, no regulator and no right to your record; its one hospital runs a closed, poorly maintained system.", "categories": { "access": { "score": 20, "summary": "No law gives patients a right to see or copy their health record: Tuvalu has no data protection act, and its Constitution protects only against searches of person and property. There is no patient portal.", "sources": [ { "title": "The Constitution of Tuvalu Act 2023 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/tuv127524.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Tuvalu, National Cyber Security Index (e-Governance Academy)", "url": "https://ncsi.ega.ee/country/tv/", "date": "2026-05-19", "publisherClass": "academic" }, { "title": "Health Professionals Act (2022 Revised Edition), Tuvalu Legislation Online", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2016/2016-0004/2016-0004_2.pdf", "date": "2016", "publisherClass": "legal_text" } ] }, "control": { "score": 25, "summary": "Patients have no legal say over who sees their records. A new Tamanu record at the Maternal and Child Health clinic lets clinicians at different facilities open the same record; we found no opt-out or patient-visible access log.", "sources": [ { "title": "Tuvalu's Maternal and Child Health clinic has a new digital health platform (Australian High Commission Tuvalu)", "url": "https://www.facebook.com/AusHCfnfu/photos/tuvalus-maternal-and-child-health-clinic-has-a-new-digital-health-platform-the-t/1381003020741966/", "date": "undated", "publisherClass": "official" }, { "title": "Health Professionals Act (2022 Revised Edition), Tuvalu Legislation Online", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2016/2016-0004/2016-0004_2.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "Tuvalu, National Cyber Security Index (e-Governance Academy)", "url": "https://ncsi.ega.ee/country/tv/", "date": "2026-05-19", "publisherClass": "academic" } ] }, "privacy": { "score": 22, "summary": "Tuvalu has no data protection law, no regulator and no breach notification duty, and no health confidentiality statute was found. The Constitution protects only against searches, not the use of personal information.", "sources": [ { "title": "The Constitution of Tuvalu Act 2023 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/tuv127524.pdf", "date": "2023", "publisherClass": "legal_text" }, { "title": "Tuvalu, National Cyber Security Index (e-Governance Academy)", "url": "https://ncsi.ega.ee/country/tv/", "date": "2026-05-19", "publisherClass": "academic" }, { "title": "The impact of digital communication and data exchange on primary health service delivery in a small island developing state setting (PLOS Digital Health, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9931309/", "date": "2022-10-07", "publisherClass": "academic" } ] }, "journey": { "score": 24, "summary": "Princess Margaret Hospital runs its own information system on a closed network, and most other records stay on paper. The World Bank said in September 2026 that a plan to fix or replace the hospital system was still pending.", "sources": [ { "title": "Implementation Status and Results Report: Tuvalu Health System Strengthening Project (P175170), Seq 9 (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099092426221038392/pdf/P175170-3a07fa71-ced3-4424-8deb-45c2eea95e0b.pdf", "date": "2026-09-25", "publisherClass": "intergov" }, { "title": "National Electronic Health Record Coverage in Pacific Island Countries and Territories (JMIR, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12534756/", "date": "2025-10-03", "publisherClass": "academic" }, { "title": "The impact of digital communication and data exchange on primary health service delivery in a small island developing state setting (PLOS Digital Health, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9931309/", "date": "2022-10-07", "publisherClass": "academic" }, { "title": "Tuvalu's Maternal and Child Health clinic has a new digital health platform (Australian High Commission Tuvalu)", "url": "https://www.facebook.com/AusHCfnfu/photos/tuvalus-maternal-and-child-health-clinic-has-a-new-digital-health-platform-the-t/1381003020741966/", "date": "undated", "publisherClass": "official" } ] }, "commercial": { "score": 15, "summary": "No law limits the sale, sharing or marketing use of health data, and no regulator oversees data brokers or health apps. A vendor review says the 2024 National ICT Policy only calls for future data protection and consumer laws (policy text not verified).", "sources": [ { "title": "Tuvalu, National Cyber Security Index (e-Governance Academy)", "url": "https://ncsi.ega.ee/country/tv/", "date": "2026-05-19", "publisherClass": "academic" }, { "title": "AI regulation in Tuvalu: current approach (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-tuvalu", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 25, "summary": "Outside the hospital and the maternal clinic, clinicians work from paper and share information ad hoc over satellite links. The World Bank's baseline says the hospital system does not fully work across hospital departments, and its review is still pending.", "sources": [ { "title": "The impact of digital communication and data exchange on primary health service delivery in a small island developing state setting (PLOS Digital Health, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC9931309/", "date": "2022-10-07", "publisherClass": "academic" }, { "title": "Implementation Status and Results Report: Tuvalu Health System Strengthening Project (P175170), Seq 9 (World Bank)", "url": "https://documents1.worldbank.org/curated/en/099092426221038392/pdf/P175170-3a07fa71-ced3-4424-8deb-45c2eea95e0b.pdf", "date": "2026-09-25", "publisherClass": "intergov" }, { "title": "Tuvalu's Maternal and Child Health clinic has a new digital health platform (Australian High Commission Tuvalu)", "url": "https://www.facebook.com/AusHCfnfu/photos/tuvalus-maternal-and-child-health-clinic-has-a-new-digital-health-platform-the-t/1381003020741966/", "date": "undated", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "Ethics review is required but Tuvalu has no research ethics committee, and research laws are still in progress. The Civil Registration Act 2025 lets the Registrar release named records for health research only if public benefit outweighs privacy.", "sources": [ { "title": "The Pacific Way: advancing ethical research governance in the Pacific islands (Lancet Regional Health Western Pacific, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC12756169/", "date": "2025-12-11", "publisherClass": "academic" }, { "title": "Civil Registration Act (Act 7 of 2025), Tuvalu Legislation Online", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0007/2025-0007_1.pdf", "date": "2025", "publisherClass": "legal_text" } ] }, "ai": { "score": 25, "summary": "No AI law or health AI guidance exists, yet SPC reports a partnership for AI-assisted digitisation of medical records. The Pharmacy and Therapeutic Products Act 2016 covers device software only by relying on approvals from regulators the Ministry recognises.", "sources": [ { "title": "Pharmacy and Therapeutic Products Act 2016 (2022 Revised Edition), Tuvalu Legislation Online", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2016/2016-0006/2016-0006_2.pdf", "date": "2016", "publisherClass": "legal_text" }, { "title": "Digital Health: Peer learning as a tool for change to strengthen Health Information Systems in Tuvalu (Pacific Community)", "url": "https://www.spc.int/updates/blog/2026/01/digital-health-peer-learning-as-a-tool-for-change-to-strengthen-health", "date": "2026-01-29", "publisherClass": "intergov" }, { "title": "AI regulation in Tuvalu: current approach (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-tuvalu", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitution of Tuvalu Act 2023, section 21", "level": "National", "year": "2023", "what": "Protects against search of person or property and entry without consent; no protection for personal information.", "url": "https://faolex.fao.org/docs/pdf/tuv127524.pdf" }, { "name": "Health Professionals Act 2016", "level": "National", "year": "2016", "what": "Registration Board, registration, complaints and inquiries for health professionals; no patient records or confidentiality rules.", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2016/2016-0004/2016-0004_2.pdf" }, { "name": "Pharmacy and Therapeutic Products Act 2016", "level": "National", "year": "2016", "what": "Medicines and medical devices, including device software, must be approved by a regulator the Ministry recognises.", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2016/2016-0006/2016-0006_2.pdf" }, { "name": "Civil Registration Act 2025 (Act 7 of 2025)", "level": "National", "year": "2025", "what": "Births and deaths registry; section 81 allows health research access with a public benefit versus privacy test.", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0007/2025-0007_1.pdf" }, { "name": "Public Health Act (1926)", "level": "National", "year": "1926", "what": "Lets the Minister make regulations on sanitation and infectious diseases; says nothing about health records.", "url": "https://tuvalu-legislation.tv/cms/images/LEGISLATION/PRINCIPAL/1926/1926-0008/1926-0008_2.pdf" } ], "dti": { "grade": 88, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "YEM", "name": "Yemen", "region": "Middle East", "overall": 23, "rank": "189=", "likelyRank": "169 to 196", "band": "Poor", "keysModel": "Institutional", "confidence": "high", "headline": "Yemen, split between rival authorities and at war, has no data protection law; most clinics still keep paper records and no patient portal exists.", "categories": { "access": { "score": 25, "summary": "Law No. 13 of 2012 lets a person see only the personal data they gave a public body, so it is not a right to the whole chart. With paper records in most facilities and no portal, Yemen sits between Sudan (22) and Iraq (30).", "sources": [ { "title": "Law No. 13 of 2012 on the Right of Access to Information, English translation (WIPO Lex)", "url": "https://www.wipo.int/wipolex/en/legislation/details/20003", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Republican Decree Law No. 26 of 2002 on Practising the Medical and Pharmacy Professions, Arabic text (Yemeni Law)", "url": "https://www.yemenilaw.com/library/yemeni-laws/qanun-almihan-altibiya-walsaydaliya/", "date": "2002", "publisherClass": "legal_text" }, { "title": "Health Information Systems in Yemen (World Bank)", "url": "https://openknowledge.worldbank.org/server/api/core/bitstreams/cdb53fc6-4d3e-42b6-8c2f-8fc6e4a3a5a7/content", "date": "2024-03-15", "publisherClass": "intergov" } ] }, "control": { "score": 25, "summary": "Patients have no consent tools, no opt-out and no access log. Law No. 13 does require written consent before a public body passes personal data to a third party, which puts Yemen just above Sudan (22).", "sources": [ { "title": "Law No. 13 of 2012 on the Right of Access to Information, English translation (WIPO Lex)", "url": "https://www.wipo.int/wipolex/en/legislation/details/20003", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Republican Decree Law No. 26 of 2002 on Practising the Medical and Pharmacy Professions, Arabic text (Yemeni Law)", "url": "https://www.yemenilaw.com/library/yemeni-laws/qanun-almihan-altibiya-walsaydaliya/", "date": "2002", "publisherClass": "legal_text" }, { "title": "The journey of the health information system and digital health in Yemen 2021 to 2026 (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?p=13758", "date": "2026-09-29", "publisherClass": "official" } ] }, "privacy": { "score": 22, "summary": "Yemen has no data protection law, no regulator and no breach notice rule; the constitution protects only communications. Biometric ID data is stored in Saudi Arabia with no legal framework, and Houthi forces seized devices at a UN office in Sana'a in October 2025.", "sources": [ { "title": "Yemen's Constitution of 1991 with amendments through 2015 (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Yemen_2015?lang=en", "date": "2015", "publisherClass": "legal_text" }, { "title": "The Yemeni laws governing collection of personal data (Hemaiah Center for Human Rights)", "url": "https://hemaiahcenter.org/the-yemeni-laws-governing-collection-of-personal-data/?lang=en", "date": "2021-05-16", "publisherClass": "blog_vendor" }, { "title": "How the Biometric ID Card Became a Matter of Data Protection, Sovereignty, and National Security (Sana'a Center, The Yemen Review)", "url": "https://sanaacenter.org/the-yemen-review/april-june-2026/28121", "date": "2026-07-31", "publisherClass": "news" }, { "title": "Houthis Storm UN Office for Project Services (UNOPS) in Sana'a (Yemen Monitor)", "url": "https://www.yemenmonitor.com/en/Details/ArtMID/908/ArticleID/153874", "date": "2025-10-28", "publisherClass": "news" } ] }, "journey": { "score": 20, "summary": "DHIS2 collects mostly aggregate data from public facilities, but the World Bank says it is not a medical record and Yemen has no patient ID or record standards. Two rival ministries in Aden and Sana'a run separate hubs.", "sources": [ { "title": "Health Information Systems in Yemen (World Bank)", "url": "https://openknowledge.worldbank.org/server/api/core/bitstreams/cdb53fc6-4d3e-42b6-8c2f-8fc6e4a3a5a7/content", "date": "2024-03-15", "publisherClass": "intergov" }, { "title": "The journey of the health information system and digital health in Yemen 2021 to 2026 (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?p=13758", "date": "2026-09-29", "publisherClass": "official" }, { "title": "Director General of Health Information and Research discusses updating medical records to include people with disabilities (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?p=13764", "date": "2026-10-01", "publisherClass": "official" } ] }, "commercial": { "score": 22, "summary": "No Yemeni law stops private companies selling health data or using it for marketing, because Law No. 13 covers only public bodies. The only private-sector shield is the medical secrecy duty in the 2002 professions law.", "sources": [ { "title": "Law No. 13 of 2012 on the Right of Access to Information, English translation (WIPO Lex)", "url": "https://www.wipo.int/wipolex/en/legislation/details/20003", "date": "2012-04-24", "publisherClass": "legal_text" }, { "title": "Republican Decree Law No. 26 of 2002 on Practising the Medical and Pharmacy Professions, Arabic text (Yemeni Law)", "url": "https://www.yemenilaw.com/library/yemeni-laws/qanun-almihan-altibiya-walsaydaliya/", "date": "2002", "publisherClass": "legal_text" }, { "title": "The Yemeni laws governing collection of personal data (Hemaiah Center for Human Rights)", "url": "https://hemaiahcenter.org/the-yemeni-laws-governing-collection-of-personal-data/?lang=en", "date": "2021-05-16", "publisherClass": "blog_vendor" } ] }, "clinical": { "score": 15, "summary": "The World Bank says Yemen has no point-of-care systems that show clinicians a patient's history, so a treating doctor sees only the file at their own facility. A September 2026 pilot adds disability questions to medical records in Aden and Taiz.", "sources": [ { "title": "Health Information Systems in Yemen (World Bank)", "url": "https://openknowledge.worldbank.org/server/api/core/bitstreams/cdb53fc6-4d3e-42b6-8c2f-8fc6e4a3a5a7/content", "date": "2024-03-15", "publisherClass": "intergov" }, { "title": "Director General of Health Information and Research discusses updating medical records to include people with disabilities (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?p=13764", "date": "2026-10-01", "publisherClass": "official" } ] }, "research": { "score": 46, "summary": "Researchers apply to the Aden ministry for ethical approval through an online form, and a national ethics committee was reported in 2009. No patient opt-out or consent rule for secondary use of records was found.", "sources": [ { "title": "Ethical approval for health research (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?page_id=12365", "date": "undated", "publisherClass": "official" }, { "title": "Capacity mapping of national ethics committees in the Eastern Mediterranean Region (BMC Medical Ethics)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC2712467/", "date": "2009-07-04", "publisherClass": "academic" }, { "title": "Republican Decree Law No. 26 of 2002 on Practising the Medical and Pharmacy Professions, Arabic text (Yemeni Law)", "url": "https://www.yemenilaw.com/library/yemeni-laws/qanun-almihan-altibiya-walsaydaliya/", "date": "2002", "publisherClass": "legal_text" } ] }, "ai": { "score": 18, "summary": "Yemen has no AI law, no AI authority and no rules for AI medical devices. The Arab AI Governance Lab counts zero AI-related regulations and zero AI governance bodies.", "sources": [ { "title": "Yemen: country profile (Arab AI Governance Lab)", "url": "https://arablab.ai/ar/countries/yemen/", "date": "2025", "publisherClass": "academic" }, { "title": "The journey of the health information system and digital health in Yemen 2021 to 2026 (Ministry of Public Health and Population)", "url": "https://moh-ye.org/?p=13758", "date": "2026-09-29", "publisherClass": "official" }, { "title": "Key themes of the Yemen AI Summit 2026 (Modern Specialized University, Sana'a)", "url": "https://msu.edu.ye/key-themes-of-the-yemen-ai-summit-2026/", "date": "2026-07-01", "publisherClass": "academic" } ] } }, "laws": [ { "name": "Constitution of the Republic of Yemen, Article 53", "level": "National", "year": "1991", "what": "Protects confidentiality of mail and communications except by law and court order.", "url": "https://www.constituteproject.org/constitution/Yemen_2015?lang=en" }, { "name": "Law No. 13 of 2012 on the Right of Access to Information", "level": "National", "year": "2012", "what": "Public bodies: written consent for third-party disclosure, purpose limits, access to data a person submitted.", "url": "https://www.wipo.int/wipolex/en/legislation/details/20003" }, { "name": "Republican Decree Law No. 26 of 2002 on Practising the Medical and Pharmacy Professions", "level": "National", "year": "2002", "what": "Patient secrecy duty with exceptions, consent to treatment, doctors must keep patient registers.", "url": "https://www.yemenilaw.com/library/yemeni-laws/qanun-almihan-altibiya-walsaydaliya/" }, { "name": "Ministerial Decision No. 13 of 2026 establishing the Virtual Health Services Centre", "level": "National", "year": "2026", "what": "Creates a telehealth centre meant to feed a unified digital patient file.", "url": "https://moh-ye.org/?p=13758" } ], "dti": { "grade": 89, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-05-14", "headline": "Report says Houthi security units collect daily patient data from hospitals", "paraphrase": "Security sources told the outlet that hospitals and clinics in Houthi-held areas were linked to a new security unit and pressed to hand over daily details of patients and cases, building a health database on residents.", "source": "Al-Ain News", "url": "https://al-ain.com/article/new-houthi-policy-il-persons", "theme": "sold_or_shared", "status": "alleged" }, { "date": "2026-02-18", "headline": "Faulty hospital lab machine gave a patient a dangerously wrong test result", "paraphrase": "A relative says a hospital lab in the capital recorded a blood test value far outside the normal range. An emergency doctor doubted it and ordered a retest elsewhere, which came back normal, pointing to a broken machine.", "source": "Crater Sky, via Yemen Vibe", "url": "https://yemenvibe.com/news-article/%D8%B5%D9%86%D8%B9%D8%A7%D8%A1-%D8%AE%D8%B1%D8%A8%D8%A7%D9%86-%D9%85%D9%88%D8%A7%D8%B7%D9%86-%D9%85%D8%AE%D8%A8%D8%B1%D9%8A-%D8%A7%D9%84%D9%85%D8%B3%D8%AA%D8%B4%D9%81%D9%89-%D8%A7%D9%84%D8%B9%D8%B3%D9%83%D8%B1%D9%8A.html", "theme": "record_wrong", "status": "alleged" } ] }, { "iso3": "ERI", "name": "Eritrea", "region": "Africa", "overall": 22, "rank": "193=", "likelyRank": "176 to 197", "band": "Poor", "keysModel": "State", "confidence": "medium", "headline": "Eritrea has no data protection law and mostly paper records; doctors face prison for revealing secrets, but patients have no verified right to their records.", "categories": { "access": { "score": 18, "summary": "We found no legal right for a patient to see or copy their medical record: the 2015 Civil Code's medical contract chapter is silent on records, and any such rule in other health proclamations is not verified. There is no patient portal.", "sources": [ { "title": "Civil Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri211041.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Eritrea data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/eritrea/", "date": "undated", "publisherClass": "academic" }, { "title": "Introduction to Eritrean Legal System and Research (GlobaLex, NYU Law)", "url": "https://www.nyulawglobal.org/globalex/eritrea1.html", "date": "2023-07", "publisherClass": "academic" }, { "title": "Prescribed medicines among pregnant women attending health facilities in Eritrea (Frontiers in Pharmacology)", "url": "https://www.frontiersin.org/journals/pharmacology/articles/10.3389/fphar.2026.1806253/full", "date": "2026-07-21", "publisherClass": "academic" } ] }, "control": { "score": 22, "summary": "The Civil Code lets a person refuse treatment and stop a professional revealing what they confided. Beyond that, no consent choices, opt-out or access log for health records were found, and data runs to a ministry system.", "sources": [ { "title": "Civil Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri211041.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Penal Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri210565.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Eritrea data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/eritrea/", "date": "undated", "publisherClass": "academic" } ] }, "privacy": { "score": 25, "summary": "A medical professional who discloses a patient's secret commits a crime carrying one to three years in prison under the 2015 Penal Code. But Eritrea has no data protection law, no regulator and no breach rules.", "sources": [ { "title": "Penal Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri210565.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Data protection in Eritrea: law, regulator, enforcement (Law Lab Africa)", "url": "https://research.lawlab.africa/eritrea/", "date": "2026-09-28", "publisherClass": "academic" }, { "title": "Eritrea data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/eritrea/", "date": "undated", "publisherClass": "academic" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 20, "summary": "The Ministry of Health collects aggregate facility reports through DHIS2, which connected 342 facilities in 2018, mostly offline. Patient records do not follow people between clinics, hospitals and pharmacies.", "sources": [ { "title": "National Health Policy, Ministry of Health, Eritrea (copy hosted by African Child Policy Forum)", "url": "https://clr.africanchildforum.org/policy%20per%20country/eritrea/eritrea_health_2010_en.pdf", "date": "2010-03", "publisherClass": "official" }, { "title": "DHIS2: Improving Data Management and Health in Eritrea (Shabait, Ministry of Information)", "url": "https://shabait.com/2018/11/07/dhis2-improving-data-management-and-health-in-eritrea/", "date": "2018-11-07", "publisherClass": "official" }, { "title": "Overcoming Connectivity Barriers: The Role of DHIS2 in Enhancing Health Data Management in Eritrea (DHIS2 Community)", "url": "https://community.dhis2.org/t/overcoming-connectivity-barriers-the-role-of-dhis2-platform-in-enhancing-health-data-management-in-eritrea/57621", "date": "2024-03-13", "publisherClass": "blog_vendor" }, { "title": "Prescribed medicines among pregnant women attending health facilities in Eritrea (Frontiers in Pharmacology)", "url": "https://www.frontiersin.org/journals/pharmacology/articles/10.3389/fphar.2026.1806253/full", "date": "2026-07-21", "publisherClass": "academic" } ] }, "commercial": { "score": 25, "summary": "No law limits selling health data or using it for marketing, because Eritrea has no data protection law. The only protection found is the Penal Code's secrecy offence, with a heavier sentence for disclosure for gain.", "sources": [ { "title": "Penal Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri210565.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Civil Code of the State of Eritrea 2015 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/eri211041.pdf", "date": "2015-05-15", "publisherClass": "legal_text" }, { "title": "Eritrea data protection fact sheet (Data Protection Africa)", "url": "https://dataprotection.africa/eritrea/", "date": "undated", "publisherClass": "academic" } ] }, "clinical": { "score": 15, "summary": "A treating doctor cannot see records held by other facilities, because no shared record or exchange exists. A 2018 Ministry of Information report quoted an IT technician calling nationwide connected hospital wards a future goal.", "sources": [ { "title": "DHIS2: Improving Data Management and Health in Eritrea (Shabait, Ministry of Information)", "url": "https://shabait.com/2018/11/07/dhis2-improving-data-management-and-health-in-eritrea/", "date": "2018-11-07", "publisherClass": "official" }, { "title": "Prescribed medicines among pregnant women attending health facilities in Eritrea (Frontiers in Pharmacology)", "url": "https://www.frontiersin.org/journals/pharmacology/articles/10.3389/fphar.2026.1806253/full", "date": "2026-07-21", "publisherClass": "academic" }, { "title": "National Health Policy, Ministry of Health, Eritrea (copy hosted by African Child Policy Forum)", "url": "https://clr.africanchildforum.org/policy%20per%20country/eritrea/eritrea_health_2010_en.pdf", "date": "2010-03", "publisherClass": "official" } ] }, "research": { "score": 43, "summary": "No law sets consent or opt-out rules for reusing health data, and data reuse rules are not verified. One safeguard counts: the Ministry of Health's Research Ethics and Protocol Review Committee approves studies, which report written consent.", "sources": [ { "title": "National Health Policy, Ministry of Health, Eritrea (copy hosted by African Child Policy Forum)", "url": "https://clr.africanchildforum.org/policy%20per%20country/eritrea/eritrea_health_2010_en.pdf", "date": "2010-03", "publisherClass": "official" }, { "title": "Prescribed medicines among pregnant women attending health facilities in Eritrea (Frontiers in Pharmacology)", "url": "https://www.frontiersin.org/journals/pharmacology/articles/10.3389/fphar.2026.1806253/full", "date": "2026-07-21", "publisherClass": "academic" }, { "title": "National ethics guidance in Sub-Saharan Africa on the collection and use of human biological specimens: a systematic review (BMC Med Ethics, PMC)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC5075204/", "date": "2016-10", "publisherClass": "academic" } ] }, "ai": { "score": 18, "summary": "We found no rules for AI in clinical care: no AI law, no AI strategy and no regulator. A 2019 medical device registration guideline exists, but no AI or software rules were found.", "sources": [ { "title": "Eritrea: Consensus Building Workshop on Medical Devices Registration Guideline (WHO Africa)", "url": "https://www.afro.who.int/fr/node/11544?country=29&name=Eritrea", "date": "2019-07-31", "publisherClass": "intergov" }, { "title": "Eritrea country page (AUDA-NEPAD African Medicines Regulatory Harmonisation)", "url": "https://amrh.nepad.org/amrh-countries/eritrea", "date": "undated", "publisherClass": "intergov" }, { "title": "AI Regulation in Eritrea: Law and Status (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-eritrea", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Penal Code of the State of Eritrea", "level": "National", "year": "2015", "what": "Article 145: medical professionals revealing secrets face one to three years; computer misuse is an offence.", "url": "https://faolex.fao.org/docs/pdf/eri210565.pdf" }, { "name": "Civil Code of the State of Eritrea", "level": "National", "year": "2015", "what": "Right to refuse treatment, professional secrecy (Article 23), image rights, medical contract rules.", "url": "https://faolex.fao.org/docs/pdf/eri211041.pdf" }, { "name": "Constitution of Eritrea (ratified, not in force)", "level": "National", "year": "1997", "what": "Article 18 right to privacy; ratified in 1997 but never brought into effect.", "url": "https://www.constituteproject.org/constitution/Eritrea_1997" }, { "name": "National Health Policy", "level": "National", "year": "2010", "what": "Plans an automated central and regional health data repository and ethical research.", "url": "https://clr.africanchildforum.org/policy%20per%20country/eritrea/eritrea_health_2010_en.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "MMR", "name": "Myanmar", "region": "Asia", "overall": 22, "rank": "193=", "likelyRank": "173 to 197", "band": "Poor", "keysModel": "State", "confidence": "medium", "headline": "Myanmar has no data protection law or patient record rights, records stay in each facility, and the state can demand health information.", "categories": { "access": { "score": 18, "summary": "No law we found gives patients a right to see or copy their medical record, and there is no patient portal. The 2007 private health care law only makes private hospitals and clinics keep a systematic medical record.", "sources": [ { "title": "Measures relating to the Private Health Care Services Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Private%20Health%20Care%20Services%20Law", "date": "undated", "publisherClass": "official" }, { "title": "Measures relating to the Electronic Transactions Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Electronic%20Transactions%20Law", "date": "undated", "publisherClass": "official" }, { "title": "Data protection laws in Myanmar (DLA Piper, Tilleke & Gibbins)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=MM", "date": "2026-02-11", "publisherClass": "law_firm" }, { "title": "Privacy concerns regarding personal health information in Myanmar: a cross-sectional survey (PLOS Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13020815/", "date": "2026-03-26", "publisherClass": "academic" } ] }, "control": { "score": 24, "summary": "The Electronic Transactions Law bars disclosing personal information without the owner's permission, but exempts security, investigations and 'stability of state sovereignty'. Private providers must hand over health information on official request, and there is no opt-out or access log.", "sources": [ { "title": "Measures relating to the Electronic Transactions Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Electronic%20Transactions%20Law", "date": "undated", "publisherClass": "official" }, { "title": "Finally Personal Data Protection In Myanmar? A Closer Look Into The Law Amending The Electronic Transactions Law (ZICO Law via Conventus Law)", "url": "https://conventuslaw.com/report/finally-personal-data-protection-in-myanmar-a/", "date": "2021-08-25", "publisherClass": "law_firm" }, { "title": "Measures relating to the Private Health Care Services Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Private%20Health%20Care%20Services%20Law", "date": "undated", "publisherClass": "official" } ] }, "privacy": { "score": 22, "summary": "Myanmar has no data protection law, regulator or general breach notification duty, and DLA Piper found no enforcement by February 2026. Safeguards against searches and interception were suspended in 2021, and the 2025 Cybersecurity Law makes platforms keep user data for three years.", "sources": [ { "title": "Data protection laws in Myanmar (DLA Piper, Tilleke & Gibbins)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=MM", "date": "2026-02-11", "publisherClass": "law_firm" }, { "title": "Myanmar Amends Legislation on the Privacy and Security of Citizens amid State of Emergency (Tilleke & Gibbins)", "url": "https://www.tilleke.com/insights/myanmar-amends-legislation-on-the-privacy-and-security-of-citizens-amid-state-of-emergency/", "date": "2021-02-23", "publisherClass": "law_firm" }, { "title": "Cybersecurity Law, State Administration Council Law No. 1/2025 (unofficial English translation, Lincoln Legal Services)", "url": "https://www.lincolnmyanmar.com/wp-content/uploads/2025/01/Cybersecurity-Law.pdf", "date": "2025-01-01", "publisherClass": "legal_text" }, { "title": "Adequacy decisions, European Commission", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 20, "summary": "The health ministry has used DHIS2 for aggregate reporting since 2013, and TB, HIV and malaria data were merged into it in early 2021. Patient records are not linked across facilities, and the national information system plan stalled after the coup.", "sources": [ { "title": "Electronic Data Management at National TB Programme operational in 2019 following DHIS-2 roll out (WHO Myanmar)", "url": "https://www.who.int/myanmar/our-work/electronic-data-management-at-national-tb-programme-operational-in-2019-following-dhis-2-roll-out", "date": "undated", "publisherClass": "intergov" }, { "title": "Privacy concerns regarding personal health information in Myanmar: a cross-sectional survey (PLOS Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13020815/", "date": "2026-03-26", "publisherClass": "academic" }, { "title": "Newly emerged resistance healthcare systems in northwest Myanmar's Sagaing Region post-military coup (BMJ Global Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13059961/", "date": "2026-01-08", "publisherClass": "academic" } ] }, "commercial": { "score": 28, "summary": "Disclosing personal information without the owner's permission is barred under the Electronic Transactions Law, and the Cybersecurity Law punishes selling data with dishonest intent. No rule addresses health data sales, data brokers, de-identified data or health apps, and no enforcement was found.", "sources": [ { "title": "Measures relating to the Electronic Transactions Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Electronic%20Transactions%20Law", "date": "undated", "publisherClass": "official" }, { "title": "Finally Personal Data Protection In Myanmar? A Closer Look Into The Law Amending The Electronic Transactions Law (ZICO Law via Conventus Law)", "url": "https://conventuslaw.com/report/finally-personal-data-protection-in-myanmar-a/", "date": "2021-08-25", "publisherClass": "law_firm" }, { "title": "Myanmar Cybersecurity Law Takes Effect (Tilleke & Gibbins)", "url": "https://www.tilleke.com/insights/myanmar-cybersecurity-law-takes-effect/", "date": "2025-08-01", "publisherClass": "law_firm" }, { "title": "Data protection laws in Myanmar (DLA Piper, Tilleke & Gibbins)", "url": "https://www.dlapiperdataprotection.com/?t=law&c=MM", "date": "2026-02-11", "publisherClass": "law_firm" } ] }, "clinical": { "score": 15, "summary": "A treating clinician cannot look up a patient's record held by another provider, because no shared record or exchange exists. The private health care law only requires hospitals and clinics to keep their own records and run a referral system.", "sources": [ { "title": "Measures relating to the Private Health Care Services Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Private%20Health%20Care%20Services%20Law", "date": "undated", "publisherClass": "official" }, { "title": "Privacy concerns regarding personal health information in Myanmar: a cross-sectional survey (PLOS Digital Health)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13020815/", "date": "2026-03-26", "publisherClass": "academic" } ] }, "research": { "score": 43, "summary": "Private providers need Ministry of Health permission for research on patients, and the Department of Medical Research has run an ethics committee since 1980. Rules on reusing routine health data were not verified, which keeps the score in the lower half of its band.", "sources": [ { "title": "Measures relating to the Private Health Care Services Law (Myanmar Services Trade portal)", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Private%20Health%20Care%20Services%20Law", "date": "undated", "publisherClass": "official" }, { "title": "About DMR, Department of Medical Research, Ministry of Health", "url": "https://www.dmr.gov.mm/about.php", "date": "undated", "publisherClass": "official" }, { "title": "Assessing Research Ethics Committees in Myanmar (Asian Bioethics Review)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC7747290/", "date": "2020-03-17", "publisherClass": "academic" } ] }, "ai": { "score": 25, "summary": "Myanmar has no AI law and no rules for clinical AI. Medical devices are registered with the FDA using the ASEAN directive's risk classes, which count software as a device, but no AI-specific duties exist.", "sources": [ { "title": "ASEAN Medical Device Directive (ASEAN Secretariat)", "url": "https://asean.org/wp-content/uploads/2016/06/22.-September-2015-ASEAN-Medical-Device-Directive.pdf", "date": "2015-09", "publisherClass": "intergov" }, { "title": "Myanmar FDA Medical Device Registration: e-Submission and AMDD Class Guide (ElendiLabs)", "url": "https://elendilabs.com/en/articles/mmr-fda-esubmission-medical-device-registration-amdd", "date": "2026-06-30", "publisherClass": "blog_vendor" }, { "title": "AI regulation in Myanmar, overview of law and policy (Levellers.ai)", "url": "https://www.levellers.ai/what-is/ai-regulation-myanmar", "date": "2026-06-08", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Law Relating to Private Health Care Services (SPDC Law No. 5/2007)", "level": "National", "year": "2007", "what": "Private providers keep systematic records and patient confidentiality, except on official request; research on patients needs ministry permission.", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Private%20Health%20Care%20Services%20Law" }, { "name": "Law Amending the Private Health Care Services Law (Law No. 7/2026)", "level": "National", "year": "2026", "what": "Adds training schools and outpatient surgery as licensed businesses; bans false or misleading provider advertising.", "url": "https://www.dfdl.com/insights/legal-and-tax-updates/myanmar-2026-amendment-to-the-private-health-care-services-law/" }, { "name": "Electronic Transactions Law, as amended 2021", "level": "National", "year": "2004", "what": "2021 chapter on personal information: no disclosure without permission, broad security exemptions, 1 to 3 years' prison.", "url": "https://servicetrade.gov.mm/service/measures/Measures%20relating%20to%20the%20Electronic%20Transactions%20Law" }, { "name": "Cybersecurity Law (SAC Law No. 1/2025)", "level": "National", "year": "2025", "what": "Health is critical information infrastructure; platforms keep user data 3 years and hand it over on request.", "url": "https://www.lincolnmyanmar.com/wp-content/uploads/2025/01/Cybersecurity-Law.pdf" }, { "name": "Law Protecting the Privacy and Security of Citizens", "level": "National", "year": "2017", "what": "Privacy safeguards on searches, detention and interception; Sections 5, 7 and 8 suspended in February 2021.", "url": "https://www.tilleke.com/insights/myanmar-amends-legislation-on-the-privacy-and-security-of-citizens-amid-state-of-emergency/" }, { "name": "ASEAN Medical Device Directive", "level": "Supranational", "year": "2015", "what": "Regional device rules; defines medical devices to include software; risk classes A to D.", "url": "https://asean.org/wp-content/uploads/2016/06/22.-September-2015-ASEAN-Medical-Device-Directive.pdf" } ], "dti": { "grade": 86, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-09", "headline": "Hospital staff alert the military before treating emergency patients, people nearby say", "paraphrase": "People close to a military-guarded public hospital in Sagaing Region say staff notify the army when emergency patients arrive, and treatment waits until soldiers and police have checked them, so patient details reach security forces first.", "source": "Democratic Voice of Burma (DVB)", "url": "https://burmese.dvb.no/post/925240", "theme": "sold_or_shared", "status": "alleged" } ] }, { "iso3": "SDN", "name": "Sudan", "region": "Africa", "overall": 22, "rank": "193=", "likelyRank": "176 to 197", "band": "Poor", "keysModel": "Institutional", "confidence": "high", "headline": "Sudan, at war since 2023, has no data protection law or patient right to a record copy; electronic records reached two sites in 2026.", "categories": { "access": { "score": 22, "summary": "No Sudanese law we opened gives patients a right to a copy of their record, and the 2015 information law exempts medical records from disclosure. A 2011 rule obliging lab staff to give patients their results puts Sudan just above Libya (20).", "sources": [ { "title": "Right to Access Information Act 2015 (Arabic text, CYRILLA)", "url": "https://cyrilla.org/api/files/1732903956524pdhozzggxw.pdf", "date": "2015", "publisherClass": "legal_text" }, { "title": "Controls and regulations, including the Medical Laboratory Practice Regulation 2011 (National Council for Medical and Health Professions)", "url": "https://sncmhp.gov.sd/controls-and-regulations/", "date": "undated", "publisherClass": "official" }, { "title": "Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/sudan/", "date": "2022-05-24", "publisherClass": "law_firm" }, { "title": "Baladna platform adds digital health services including health insurance and the medical commission (Sudan Akhbar, from SUNA)", "url": "https://www.sudanakhbar.com/1820129", "date": "2026-07-31", "publisherClass": "news" } ] }, "control": { "score": 22, "summary": "Patients have no legal tools to decide who sees their record: no consent rules for sharing, no opt-out and no access log. Protection rests on a professional secrecy duty and a constitutional privacy right.", "sources": [ { "title": "Sudan Constitutional Charter 2019 (Constitute Project, International IDEA translation)", "url": "https://www.constituteproject.org/constitution/Sudan_2019?lang=en", "date": "2019", "publisherClass": "legal_text" }, { "title": "Controls and regulations, including the Medical Laboratory Practice Regulation 2011 (National Council for Medical and Health Professions)", "url": "https://sncmhp.gov.sd/controls-and-regulations/", "date": "undated", "publisherClass": "official" }, { "title": "Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/sudan/", "date": "2022-05-24", "publisherClass": "law_firm" }, { "title": "Sudan: Freedom on the Net 2025 (Freedom House)", "url": "https://freedomhouse.org/country/sudan/freedom-net/2025", "date": "2025-11-12", "publisherClass": "news" } ] }, "privacy": { "score": 20, "summary": "Sudan has no data protection law, no data regulator and no breach notice rule, and it signed but has not ratified the AU Malabo Convention. Draft cybercrime amendments approved in October 2025 would allow warrantless digital searches, so it scores below Libya (25).", "sources": [ { "title": "Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/sudan/", "date": "2022-05-24", "publisherClass": "law_firm" }, { "title": "List of countries that have signed, ratified or acceded to the AU Convention on Cyber Security and Personal Data Protection (African Union)", "url": "https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf", "date": "2024-07-08", "publisherClass": "intergov" }, { "title": "Sudan's draconian Cybercrime Law amendments pose grave threat to digital freedoms (Skyline International)", "url": "https://skylineforhuman.org/en/news/details/875/sudans-draconian-cybercrime-law-amendments-pose-grave-threat-to-digital-freedoms", "date": "2025-10-16", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "official" } ] }, "journey": { "score": 18, "summary": "In May 2026 the health and digital ministries started a hospital system with electronic patient records at one Khartoum hospital and one Gedaref centre. No national record, exchange or e-prescription service in operation was found.", "sources": [ { "title": "Unified digital hospital management system launched to digitise Sudan's health sector (Sudafax)", "url": "https://sudafax.com/559584/%D8%A5%D8%B7%D9%84%D8%A7%D9%82-%D9%86%D8%B8%D8%A7%D9%85-%D8%B1%D9%82%D9%85%D9%8A-%D9%85%D9%88%D8%AD%D8%AF-%D9%84%D8%A5%D8%AF%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D8%B3%D8%AA%D8%B4%D9%81%D9%8A%D8%A7", "date": "2026-05-11", "publisherClass": "news" }, { "title": "Khartoum health ministry sets out plans to run state hospitals on an integrated electronic system (Sudan Akhbar, from SUNA)", "url": "https://www.sudanakhbar.com/1759992", "date": "2026-03-03", "publisherClass": "news" }, { "title": "Health ministry begins digital health transformation project with the digital ministry (Sudan Akhbar, from SUNA)", "url": "https://www.sudanakhbar.com/1751910", "date": "2026-02-08", "publisherClass": "news" }, { "title": "Baladna platform adds digital health services including health insurance and the medical commission (Sudan Akhbar, from SUNA)", "url": "https://www.sudanakhbar.com/1820129", "date": "2026-07-31", "publisherClass": "news" } ] }, "commercial": { "score": 20, "summary": "No Sudanese law limits selling health data or using it for marketing, because there is no data protection law. The only general shield is the constitutional privacy right in Article 55, which no statute applies to companies.", "sources": [ { "title": "Sudan Constitutional Charter 2019 (Constitute Project, International IDEA translation)", "url": "https://www.constituteproject.org/constitution/Sudan_2019?lang=en", "date": "2019", "publisherClass": "legal_text" }, { "title": "The legal framework for protecting privacy and personal data in the age of AI, in light of Sudan's Cybercrime Law (Shendi University Journal)", "url": "https://journals.ush.edu.sd/law/2026/04/07/%D8%A7%D9%84%D8%A7%D8%B7%D8%A7%D8%B1-%D8%A7%D9%84%D9%82%D8%A7%D9%86%D9%88%D9%86%D9%8A-%D9%84%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9-%D9%88-%D8%A7%D9%84%D8%A8/", "date": "2026-04-07", "publisherClass": "academic" }, { "title": "The privacy gap in Sudan: balancing digital transformation and data protection laws, part 1 (Sudan Center for Policy Studies)", "url": "https://sudancps.com/2026/07/20/%D9%81%D8%AC%D9%88%D8%A9-%D8%A7%D9%84%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9-%D9%81%D9%8A-%D8%A7%D9%84%D8%B3%D9%88%D8%AF%D8%A7%D9%86-%D8%A7%D9%84%D9%85%D9%88%D8%A7%D8%B2%D9%86%D8%A9-%D8%A8%D9%8A%D9%86/", "date": "2026-07-20", "publisherClass": "academic" }, { "title": "Sudan data protection factsheet (Data Protection Africa)", "url": "https://dataprotection.africa/sudan/", "date": "2022-05-24", "publisherClass": "law_firm" } ] }, "clinical": { "score": 15, "summary": "No shared record across providers was found, so a treating clinician mostly sees what their own facility holds. Electronic patient records started in May 2026 at two sites only.", "sources": [ { "title": "Unified digital hospital management system launched to digitise Sudan's health sector (Sudafax)", "url": "https://sudafax.com/559584/%D8%A5%D8%B7%D9%84%D8%A7%D9%82-%D9%86%D8%B8%D8%A7%D9%85-%D8%B1%D9%82%D9%85%D9%8A-%D9%85%D9%88%D8%AD%D8%AF-%D9%84%D8%A5%D8%AF%D8%A7%D8%B1%D8%A9-%D8%A7%D9%84%D9%85%D8%B3%D8%AA%D8%B4%D9%81%D9%8A%D8%A7", "date": "2026-05-11", "publisherClass": "news" }, { "title": "Controls and regulations, including the Medical Laboratory Practice Regulation 2011 (National Council for Medical and Health Professions)", "url": "https://sncmhp.gov.sd/controls-and-regulations/", "date": "undated", "publisherClass": "official" }, { "title": "Health ministry begins digital health transformation project with the digital ministry (Sudan Akhbar, from SUNA)", "url": "https://www.sudanakhbar.com/1751910", "date": "2026-02-08", "publisherClass": "news" } ] }, "research": { "score": 46, "summary": "No law sets consent or opt-out rules for reusing health records in research. Two safeguards count: a national health research ethics committee dating from a 2002 decree, and a 2011 rule requiring ethics approval and patient consent for lab research.", "sources": [ { "title": "The ethical review system in Sudan, module 2 (SNAC research ethics project, University of Bergen)", "url": "https://snac-research-ethics.w.uib.no/files/2024/12/The-Ethical-review-System-in-Sudan-Module-2.pdf", "date": "2024-12", "publisherClass": "academic" }, { "title": "Controls and regulations, including the Medical Laboratory Practice Regulation 2011 (National Council for Medical and Health Professions)", "url": "https://sncmhp.gov.sd/controls-and-regulations/", "date": "undated", "publisherClass": "official" }, { "title": "Regulations (National Medicines and Poisons Board)", "url": "https://nmpb.gov.sd/regulation.php", "date": "undated", "publisherClass": "official" } ] }, "ai": { "score": 25, "summary": "A November 2025 decree created a Sudanese Data and AI Authority, but it had issued no binding rules by mid-2026. No rules for AI or software as a medical device were found, the no-rules band, matching Libya and Egypt (25).", "sources": [ { "title": "Sudan establishes three digital authorities to advance e-government (Ecofin Agency)", "url": "https://www.ecofinagency.com/news-digital/0711-50229-sudan-establishes-three-digital-authorities-to-advance-e-govt", "date": "2025-11-07", "publisherClass": "news" }, { "title": "The privacy gap in Sudan: balancing digital transformation and data protection laws, part 1 (Sudan Center for Policy Studies)", "url": "https://sudancps.com/2026/07/20/%D9%81%D8%AC%D9%88%D8%A9-%D8%A7%D9%84%D8%AE%D8%B5%D9%88%D8%B5%D9%8A%D8%A9-%D9%81%D9%8A-%D8%A7%D9%84%D8%B3%D9%88%D8%AF%D8%A7%D9%86-%D8%A7%D9%84%D9%85%D9%88%D8%A7%D8%B2%D9%86%D8%A9-%D8%A8%D9%8A%D9%86/", "date": "2026-07-20", "publisherClass": "academic" }, { "title": "Regulations (National Medicines and Poisons Board)", "url": "https://nmpb.gov.sd/regulation.php", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Constitutional Charter 2019, Article 55", "level": "National", "year": "2019", "what": "Protects privacy, private and family life and correspondence, except as the law allows.", "url": "https://www.constituteproject.org/constitution/Sudan_2019?lang=en" }, { "name": "Right to Access Information Act 2015", "level": "National", "year": "2015", "what": "Right to request information from public bodies; Article 12(e) exempts personal and medical records.", "url": "https://cyrilla.org/api/files/1732903956524pdhozzggxw.pdf" }, { "name": "Medicines and Poisons Act 2009", "level": "National", "year": "2009", "what": "Medicines regulator law; medicinal clinical trials must be reviewed by the National Medicines and Poisons Board.", "url": "https://nmpb.gov.sd/law.php" }, { "name": "Medical Laboratory Practice Regulation 2011", "level": "National", "year": "2011", "what": "Lab staff must give patients results, keep secrets, and get ethics approval and consent for research.", "url": "https://sncmhp.gov.sd/controls-and-regulations/" }, { "name": "Electronic Transactions Act 2007 (amended 2015)", "level": "National", "year": "2007", "what": "Electronic transactions and certification; the only Act listed on the Cybersecurity Authority's laws page.", "url": "https://sca.gov.sd/en/regulations" }, { "name": "Combating Cybercrimes Law 2018 (amended 2020; 2025 amendments approved by Cabinet)", "level": "National", "year": "2018", "what": "Online offences; 2025 draft amendments would allow warrantless digital searches and content removal.", "url": "https://skylineforhuman.org/en/news/details/875/sudans-draconian-cybercrime-law-amendments-pose-grave-threat-to-digital-freedoms" }, { "name": "AU Convention on Cyber Security and Personal Data Protection (Malabo)", "level": "Supranational", "year": "2014", "what": "Regional data protection treaty; Sudan signed on 15 March 2023 and has not ratified.", "url": "https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2026-08-10", "headline": "Patient files left behind when a specialist hospital closed in the war", "paraphrase": "A hospital official said staff left and patient files and data stayed inside after the building was taken over. Displaced patients lost the link to their records and doctors, and some now carry their own papers between centres.", "source": "Independent Arabia", "url": "https://www.independentarabia.com/node/655365/%D8%B3%D9%8A%D8%A7%D8%B3%D8%A9/%D8%AA%D9%82%D8%A7%D8%B1%D9%8A%D8%B1/%D9%85%D8%B1%D8%A7%D9%83%D8%B2-%D8%A7%D9%84%D8%A3%D9%88%D8%B1%D8%A7%D9%85-%D9%88%D9%85%D8%B9%D8%B1%D9%83%D8%A9-%D8%A7%D9%84%D8%A8%D9%82%D8%A7%D8%A1-%D9%81%D9%8A-%D8%A7%D9%84%D8%B3%D9%88%D8%AF%D8%A7%D9%86", "theme": "lost_between_providers", "status": "admitted" } ] }, { "iso3": "GNB", "name": "Guinea-Bissau", "region": "Africa", "overall": 21, "rank": "196", "likelyRank": "180 to 198", "band": "Poor", "keysModel": "Institutional", "confidence": "high", "headline": "Guinea-Bissau has no data protection law and keeps clinical records on paper, so patients have almost no legal or practical hold on their health data.", "categories": { "access": { "score": 20, "summary": "No law gives patients a right to see or copy their medical record, and Guinea-Bissau has no data protection law. Clinical records in every health centre and hospital are kept on paper, so there is nothing to view online.", "sources": [ { "title": "Constitution of Guinea-Bissau 1984 (rev. 1996), English text (Constitute Project)", "url": "https://www.constituteproject.org/constitution/Guinea_Bissau_1996?lang=en", "date": "undated", "publisherClass": "legal_text" }, { "title": "Decreto n.º 10/2025, approving the Estratégia Nacional para a Transformação Digital (ENTD.GW) 2025-2030, Boletim Oficial n.º 12, 4.º Suplemento (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/gbs235634.pdf", "date": "2025-03-28", "publisherClass": "legal_text" }, { "title": "Plano Nacional de Desenvolvimento Sanitário III (PNDS III) 2023-2028 (MINSAP)", "url": "https://convencaocidada.gw/assets/docs/anexos/a3849c8d-1055-4615-938f-6df2b7eb98f8_Plano_Nacional_de_Desenvolvimento_Sanit%C3%A1rio_(PNDS_III)__2023-2028.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "Guia Sanitário do Setor Autónomo de Bissau, with the Decálogo dos Direitos e Deveres dos Utentes (Gabinete do Utente and Liga Guineense dos Direitos Humanos, EU-funded)", "url": "https://ong-aida.org/wp-content/uploads/2023/04/GUIA-SANITARIA.pdf", "date": "2017-11", "publisherClass": "blog_vendor" } ] }, "control": { "score": 20, "summary": "There is no data law, so patients have no legal consent, objection or access-log rights over health data. Records sit on paper in each facility, and providers and programmes decide how data moves.", "sources": [ { "title": "Supplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWAS", "url": "https://www.statewatch.org/media/documents/news/2013/mar/ecowas-dp-act.pdf", "date": "2010-02-16", "publisherClass": "intergov" }, { "title": "Guinea-Bissau Data Protection Factsheet (Data Protection Africa, ALT Advisory)", "url": "https://dataprotection.africa/guinea-bissau/", "date": "2022-05-25", "publisherClass": "law_firm" }, { "title": "Plano Nacional de Desenvolvimento Sanitário III (PNDS III) 2023-2028 (MINSAP)", "url": "https://convencaocidada.gw/assets/docs/anexos/a3849c8d-1055-4615-938f-6df2b7eb98f8_Plano_Nacional_de_Desenvolvimento_Sanit%C3%A1rio_(PNDS_III)__2023-2028.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "Guia Sanitário do Setor Autónomo de Bissau, with the Decálogo dos Direitos e Deveres dos Utentes (Gabinete do Utente and Liga Guineense dos Direitos Humanos, EU-funded)", "url": "https://ong-aida.org/wp-content/uploads/2023/04/GUIA-SANITARIA.pdf", "date": "2017-11", "publisherClass": "blog_vendor" } ] }, "privacy": { "score": 22, "summary": "Guinea-Bissau has no data protection law, no regulator and no breach notification duty. The main protection is a Penal Code crime of revealing a professional secret, punished by up to one year in prison or a fine, and only on complaint.", "sources": [ { "title": "Código Penal, Decreto-Lei n.º 4/93 (compilation copy, FEC)", "url": "https://fecongd.org/pdf/crianca/CodigoPenal.pdf", "date": "1993-10-13", "publisherClass": "legal_text" }, { "title": "Guinea Bissau: Digital Policy Dialogue, Engagement Note (World Bank, Report AUS0003328)", "url": "https://documents1.worldbank.org/curated/en/099061523115010183/pdf/P179627-b7cacceb-3c50-4061-8f7e-c52e69bb90e7.pdf", "date": "2023", "publisherClass": "intergov" }, { "title": "Guiné-Bissau anuncia início do Recenseamento Geral da População e Habitação para Junho (Forbes África Lusófona, Council of Ministers communiqué)", "url": "https://forbesafricalusofona.com/guine-bissau-anuncia-inicio-do-recenseamento-geral-da-populacao-e-habitacao-para-junho/", "date": "2026-05-08", "publisherClass": "news" }, { "title": "Guiné-Bissau: CNT aprova lei contra 'fake news' em ambiente de restrição política (e-Global)", "url": "https://e-global.pt/noticias/lusofonia/guine-bissau/nova-lei-contra-desinformacao/", "date": "2026-05-22", "publisherClass": "news" } ] }, "journey": { "score": 20, "summary": "DHIS2 has collected aggregate health statistics from all 11 health regions since 2011, but patient records are on paper and no hospital information system works. The health plan calls the information system fragmented, with partners' data not reaching the ministry.", "sources": [ { "title": "Plano Nacional de Desenvolvimento Sanitário III (PNDS III) 2023-2028 (MINSAP)", "url": "https://convencaocidada.gw/assets/docs/anexos/a3849c8d-1055-4615-938f-6df2b7eb98f8_Plano_Nacional_de_Desenvolvimento_Sanit%C3%A1rio_(PNDS_III)__2023-2028.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "Guinea Bissau: DHIS2 Climate & Health country profile (DHIS2)", "url": "https://dhis2.org/climate/country-profiles/guinea-bissau/", "date": "2026-07", "publisherClass": "blog_vendor" }, { "title": "Decreto n.º 31/2024, approving PNDS III, Boletim Oficial n.º 4 (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/gbs235753.pdf", "date": "2025-01-27", "publisherClass": "legal_text" } ] }, "commercial": { "score": 20, "summary": "No law limits selling health data, marketing with it or reusing de-identified data, because there is no data protection law. We found no rules on health apps or data brokers and no enforcement.", "sources": [ { "title": "Supplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWAS", "url": "https://www.statewatch.org/media/documents/news/2013/mar/ecowas-dp-act.pdf", "date": "2010-02-16", "publisherClass": "intergov" }, { "title": "Decreto n.º 10/2025, approving the Estratégia Nacional para a Transformação Digital (ENTD.GW) 2025-2030, Boletim Oficial n.º 12, 4.º Suplemento (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/gbs235634.pdf", "date": "2025-03-28", "publisherClass": "legal_text" }, { "title": "Código Penal, Decreto-Lei n.º 4/93 (compilation copy, FEC)", "url": "https://fecongd.org/pdf/crianca/CodigoPenal.pdf", "date": "1993-10-13", "publisherClass": "legal_text" } ] }, "clinical": { "score": 15, "summary": "A treating clinician sees only the paper file their own facility holds. There is no shared record across providers, and a telemedicine centre at the national hospital was described as not working before a new one opened in 2025.", "sources": [ { "title": "Plano Nacional de Desenvolvimento Sanitário III (PNDS III) 2023-2028 (MINSAP)", "url": "https://convencaocidada.gw/assets/docs/anexos/a3849c8d-1055-4615-938f-6df2b7eb98f8_Plano_Nacional_de_Desenvolvimento_Sanit%C3%A1rio_(PNDS_III)__2023-2028.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "Inaugurado Centro de Telemedicina e Saúde no Hospital Nacional Simão Mendes (ANG)", "url": "https://ang.gw/inaugurado-centro-de-telemedicina-e-saude-no-hospital-nacional-simao-mendes/", "date": "2025-08-13", "publisherClass": "news" }, { "title": "Missão da OMS de apoio técnico aos programas de Saúde Digital do Ministério da Saúde Pública (WHO AFRO)", "url": "https://www.afro.who.int/pt/countries/guinea-bissau/news/missao-da-oms-de-apoio-tecnico-aos-programas-de-saude-digital-do-ministerio-da-saude-publica", "date": "2022-03-31", "publisherClass": "intergov" } ] }, "research": { "score": 43, "summary": "The CNEPS ethics committee reviews health research, but there is no research law and the draft ethics code was found weak on consent and data confidentiality. In January 2026 the health minister halted a US-funded newborn vaccine trial the committee had approved in November 2025.", "sources": [ { "title": "National health research ethics committee of Guinea-Bissau (CNEPS) website", "url": "https://bcawaethicsii.wixsite.com/cnepsgb", "date": "undated", "publisherClass": "official" }, { "title": "CT-Luso Deliverable 3.3, Recomendações legislativas (EU-funded project 101145790)", "url": "https://ct-luso.com/pluginfile.php/672/mod_page/content/36/CT-Luso_Deliverable_3.3_Recomenda%C3%A7%C3%B5es_Legislativas_final_PT.pdf", "date": "2025-11", "publisherClass": "academic" }, { "title": "'Suspended or Cancelled': Guinea-Bissau Health Minister Halts Controversial Hepatitis B Trial (Health Policy Watch)", "url": "https://healthpolicy-watch.news/suspended-or-cancelled-guinea-bissau-health-minister-halts-controversial-hepatitis-trial/", "date": "2026-01-22", "publisherClass": "news" } ] }, "ai": { "score": 15, "summary": "We found no rules for AI in clinical care and no regulation of medical software. The 2025 digital strategy says missing data protection rules limit safe and ethical use of AI.", "sources": [ { "title": "Decreto n.º 10/2025, approving the Estratégia Nacional para a Transformação Digital (ENTD.GW) 2025-2030, Boletim Oficial n.º 12, 4.º Suplemento (FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/gbs235634.pdf", "date": "2025-03-28", "publisherClass": "legal_text" }, { "title": "Plano Nacional de Desenvolvimento Sanitário III (PNDS III) 2023-2028 (MINSAP)", "url": "https://convencaocidada.gw/assets/docs/anexos/a3849c8d-1055-4615-938f-6df2b7eb98f8_Plano_Nacional_de_Desenvolvimento_Sanit%C3%A1rio_(PNDS_III)__2023-2028.pdf", "date": "2023-06", "publisherClass": "official" }, { "title": "Guinea Bissau: DHIS2 Climate & Health country profile (DHIS2)", "url": "https://dhis2.org/climate/country-profiles/guinea-bissau/", "date": "2026-07", "publisherClass": "blog_vendor" } ] } }, "laws": [ { "name": "Constitution of the Republic of Guinea-Bissau (1984, revised 1996), Article 44", "level": "National", "year": "1996", "what": "Protects intimate privacy and family life; no specific right over health records.", "url": "https://www.constituteproject.org/constitution/Guinea_Bissau_1996?lang=en" }, { "name": "Penal Code, Decree-Law 4/93, Articles 142 and 143", "level": "National", "year": "1993", "what": "Revealing a professional secret: up to one year or a fine, on complaint. Bans publicising private life.", "url": "https://fecongd.org/pdf/crianca/CodigoPenal.pdf" }, { "name": "ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection", "level": "Supranational", "year": "2010", "what": "Health data is sensitive; states must adopt a law and a regulator. Not yet done nationally.", "url": "https://www.statewatch.org/media/documents/news/2013/mar/ecowas-dp-act.pdf" }, { "name": "Decree 31/2024 approving the National Health Development Plan (PNDS III) 2023-2028", "level": "National", "year": "2024", "what": "Health plan; records health information gaps and plans a health base law.", "url": "https://faolex.fao.org/docs/pdf/gbs235753.pdf" }, { "name": "Decree 10/2025 approving the National Digital Transformation Strategy (ENTD.GW) 2025-2030", "level": "National", "year": "2025", "what": "Lists a pending data protection bill and a health data programme with the public health institute.", "url": "https://faolex.fao.org/docs/pdf/gbs235634.pdf" } ], "dti": { "grade": 85, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "AFG", "name": "Afghanistan", "region": "Asia", "overall": 20, "rank": "197", "likelyRank": "183 to 198", "band": "Poor", "keysModel": "State", "confidence": "medium", "headline": "Afghanistan has no data protection law and mostly paper records, and its health policy says the ministry owns all health data.", "categories": { "access": { "score": 20, "summary": "Only private clinics have a written duty to give patients a copy of their clinical records, under a 2012 regulation. There is no national patient portal, and records are still mostly on paper.", "sources": [ { "title": "Private Health Centres Regulation, Official Gazette No. 1084 (MoPH copy)", "url": "https://moph.gov.af/sites/default/files/2025-07/PHCR%201084-2012.pdf", "date": "2012-08-11", "publisherClass": "legal_text" }, { "title": "Laws and regulations (Ministry of Public Health)", "url": "https://moph.gov.af/dr/%D9%82%D9%88%D8%A7%D9%86%DB%8C%D9%86-%D9%88-%D9%85%D9%82%D8%B1%D8%B1%D9%87-%D9%87%D8%A7", "date": "undated", "publisherClass": "official" }, { "title": "Strategic analysis of the health information system for communicable disease control in Afghanistan (BMC Health Services Research)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13195962/", "date": "2026-04-11", "publisherClass": "academic" } ] }, "control": { "score": 20, "summary": "The 2025 to 2030 National Health Policy states that the Ministry of Public Health owns all health-related data. We found no patient consent choices, opt-out or access log for health records.", "sources": [ { "title": "National Health Policy 1446 to 1451 (2025 to 2030), Ministry of Public Health (copy hosted by ORCD)", "url": "https://www.orcd.org/Resources/NHS--English%20-Jan%202026%20-PDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Strategic analysis of the health information system for communicable disease control in Afghanistan (BMC Health Services Research)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13195962/", "date": "2026-04-11", "publisherClass": "academic" } ] }, "privacy": { "score": 20, "summary": "Afghanistan has no data protection law and no data regulator; Human Rights Watch reported none in 2022 and we found none since. Doctors carry a legal duty of medical secrecy, but there are no health data breach rules or penalties.", "sources": [ { "title": "Public Health Law, legislative decree approved by the Council of Ministers 1385/8/30 (MoPH copy)", "url": "https://moph.gov.af/sites/default/files/2019-07/%D8%AA%D9%88%D8%B4%DB%8C%D8%AD%20%D8%B7%D8%B1%D8%AD%20%D9%82%D8%A7%D9%86%D9%88%D9%86%20%D8%B5%D8%AD%D8%AA%20%D8%B9%D8%A7%D9%85%D9%87.pdf", "date": "2006-11-21", "publisherClass": "legal_text" }, { "title": "Cybercrimes in the Penal Code of Afghanistan (Ministry of Communications and IT)", "url": "https://mcit.gov.af/dr/%D8%AC%D8%B1%D8%A7%DB%8C%D9%85-%D8%B3%D8%A7%DB%8C%D8%A8%D8%B1%DB%8C%D8%8C-%D8%AF%D8%B1-%DA%A9%D9%88%D8%AF-%D8%AC%D8%B2%D8%A7%DB%8C-%D8%A7%D9%81%D8%BA%D8%A7%D9%86%D8%B3%D8%AA%D8%A7%D9%86", "date": "undated", "publisherClass": "official" }, { "title": "New Evidence that Biometric Data Systems Imperil Afghans (Human Rights Watch)", "url": "https://www.hrw.org/news/2022/03/30/new-evidence-biometric-data-systems-imperil-afghans", "date": "2022-03-30", "publisherClass": "news" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 18, "summary": "Health facilities report aggregate data to the ministry through DHIS2, but patient records do not follow people between clinics, hospitals and pharmacies. An electronic record system was still at pilot planning in June 2026.", "sources": [ { "title": "Afghanistan annual report 2025 (WHO Afghanistan Country Office)", "url": "https://applications.emro.who.int/docs/9789292747589-eng.pdf", "date": "2026", "publisherClass": "intergov" }, { "title": "Strategic analysis of the health information system for communicable disease control in Afghanistan (BMC Health Services Research)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13195962/", "date": "2026-04-11", "publisherClass": "academic" }, { "title": "Technical Meeting Held on the Development of the Electronic Health Record (EHR/EMR) System (MoPH)", "url": "https://moph.gov.af/en/technical-meeting-held-development-electronic-health-record-ehremr-system", "date": "2026-06-03", "publisherClass": "official" }, { "title": "The trouble with coded prescriptions in Afghanistan: how feasible are computerised prescriptions? (BBC News Dari)", "url": "https://www.bbc.com/dari/articles/cy8v8xvy959o", "date": "2025-11-20", "publisherClass": "news" } ] }, "commercial": { "score": 22, "summary": "No law limits selling health data or using it for marketing, because Afghanistan has no data protection law. The only protection we found is the medical secrecy duty on doctors and private clinics.", "sources": [ { "title": "Public Health Law, legislative decree approved by the Council of Ministers 1385/8/30 (MoPH copy)", "url": "https://moph.gov.af/sites/default/files/2019-07/%D8%AA%D9%88%D8%B4%DB%8C%D8%AD%20%D8%B7%D8%B1%D8%AD%20%D9%82%D8%A7%D9%86%D9%88%D9%86%20%D8%B5%D8%AD%D8%AA%20%D8%B9%D8%A7%D9%85%D9%87.pdf", "date": "2006-11-21", "publisherClass": "legal_text" }, { "title": "Private Health Centres Regulation, Official Gazette No. 1084 (MoPH copy)", "url": "https://moph.gov.af/sites/default/files/2025-07/PHCR%201084-2012.pdf", "date": "2012-08-11", "publisherClass": "legal_text" }, { "title": "New Evidence that Biometric Data Systems Imperil Afghans (Human Rights Watch)", "url": "https://www.hrw.org/news/2022/03/30/new-evidence-biometric-data-systems-imperil-afghans", "date": "2022-03-30", "publisherClass": "news" }, { "title": "Strategic analysis of the health information system for communicable disease control in Afghanistan (BMC Health Services Research)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13195962/", "date": "2026-04-11", "publisherClass": "academic" } ] }, "clinical": { "score": 15, "summary": "A treating doctor cannot see records held by other providers, because no shared record or exchange exists. Single hospitals, such as Ibn Sina emergency hospital in Kabul, have only begun online patient databases.", "sources": [ { "title": "Online database system officially opened at Ibn Sina emergency hospital (Didpress)", "url": "https://didpress.com/178032/", "date": "2025-10-31", "publisherClass": "news" }, { "title": "Strategic analysis of the health information system for communicable disease control in Afghanistan (BMC Health Services Research)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC13195962/", "date": "2026-04-11", "publisherClass": "academic" }, { "title": "MoPH meeting on an electronic health record and treatment registration system for hospitals (Pashto)", "url": "https://moph.gov.af/index.php/ps/%D8%AF-%D8%B9%D8%A7%D9%85%DB%90-%D8%B1%D9%88%D8%BA%D8%AA%DB%8C%D8%A7-%D9%88%D8%B2%D8%A7%D8%B1%D8%AA-%D8%AF-%D8%B1%D9%88%D8%BA%D8%AA%D9%88%D9%86%D9%88%D9%86%D9%88-%D9%84%D9%BE%D8%A7%D8%B1%D9%87-%D8%AF-%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%D9%8A-%D8%B1%D9%88%D8%BA%D8%AA%DB%8C%D8%A7%DB%8C%D9%8A-%D8%B1%DB%8C%DA%A9%D8%A7%D8%B1%DA%89-%D8%A7%D9%88-%D8%AF%D8%B1%D9%85%D9%84%D9%86%DB%90-%D8%AF-%D8%AB%D8%A8%D8%AA-%D9%BE%D8%B1-%D8%B3%DB%8C%D8%B3%D8%AA%D9%85-%D9%86%D8%A7%D8%B3%D8%AA%D9%87", "date": "2025-12-14", "publisherClass": "official" }, { "title": "Private Health Centres Regulation, Official Gazette No. 1084 (MoPH copy)", "url": "https://moph.gov.af/sites/default/files/2025-07/PHCR%201084-2012.pdf", "date": "2012-08-11", "publisherClass": "legal_text" } ] }, "research": { "score": 30, "summary": "National health studies need approval from the ministry's Institutional Review Board under the 2025 to 2030 health policy. No law on research consent or reuse of patient records was verified, and the ministry claims ownership of all health data.", "sources": [ { "title": "National Health Policy 1446 to 1451 (2025 to 2030), Ministry of Public Health (copy hosted by ORCD)", "url": "https://www.orcd.org/Resources/NHS--English%20-Jan%202026%20-PDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Ministry of Public Health Convenes Institutional Review Board (IRB) Meeting (MoPH)", "url": "https://moph.gov.af/en/ministry-public-health-convenes-institutional-review-board-irb-meeting", "date": "2025-10-28", "publisherClass": "official" }, { "title": "Conducting Health Research in the Current Afghan Society: Challenges, Opportunities, and Recommendations (Risk Manag Healthc Policy)", "url": "https://pmc.ncbi.nlm.nih.gov/articles/PMC10662640/", "date": "2023-11-17", "publisherClass": "academic" } ] }, "ai": { "score": 15, "summary": "We found no rules for AI in clinical care: no AI law, no health AI guidance and no regulation of medical software. The 2025 to 2030 National Health Policy covers e-health and telemedicine but does not mention AI.", "sources": [ { "title": "National Health Policy 1446 to 1451 (2025 to 2030), Ministry of Public Health (copy hosted by ORCD)", "url": "https://www.orcd.org/Resources/NHS--English%20-Jan%202026%20-PDF.pdf", "date": "undated", "publisherClass": "official" }, { "title": "Afghanistan Food and Drugs Authority (AFDA): mandate and background", "url": "https://www.afda.gov.af/en/afghanistan-food-and-drugs-authority-afda", "date": "undated", "publisherClass": "official" } ] } }, "laws": [ { "name": "Public Health Law", "level": "National", "year": "2006", "what": "Free primary care; Article 10 binds doctors and medical staff to medical secrecy, with outbreak reporting.", "url": "https://moph.gov.af/sites/default/files/2019-07/%D8%AA%D9%88%D8%B4%DB%8C%D8%AD%20%D8%B7%D8%B1%D8%AD%20%D9%82%D8%A7%D9%86%D9%88%D9%86%20%D8%B5%D8%AD%D8%AA%20%D8%B9%D8%A7%D9%85%D9%87.pdf" }, { "name": "Private Health Centres Regulation (Official Gazette No. 1084)", "level": "National", "year": "2012", "what": "Private centres must give patients a copy of clinical records and keep records for 10 years.", "url": "https://moph.gov.af/sites/default/files/2025-07/PHCR%201084-2012.pdf" }, { "name": "Penal Code, cybercrime chapter", "level": "National", "year": "2017", "what": "Criminalises unauthorised access to, and interference with, computer data and systems.", "url": "https://mcit.gov.af/dr/%D8%AC%D8%B1%D8%A7%DB%8C%D9%85-%D8%B3%D8%A7%DB%8C%D8%A8%D8%B1%DB%8C%D8%8C-%D8%AF%D8%B1-%DA%A9%D9%88%D8%AF-%D8%AC%D8%B2%D8%A7%DB%8C-%D8%A7%D9%81%D8%BA%D8%A7%D9%86%D8%B3%D8%AA%D8%A7%D9%86" }, { "name": "National Health Policy 1446 to 1451 (2025 to 2030)", "level": "National", "year": "2025", "what": "Ministry owns all health data; plans electronic records; health research needs ministry IRB approval.", "url": "https://www.orcd.org/Resources/NHS--English%20-Jan%202026%20-PDF.pdf" }, { "name": "Taliban leader's order on computerised prescriptions", "level": "National", "year": "2025", "what": "Tells the health ministry to trial computerised prescriptions where facilities allow, then expand.", "url": "https://www.bbc.com/dari/articles/cy8v8xvy959o" } ], "dti": { "grade": 87, "tier": "Gold", "tierCapped": false }, "asOf": "2026-10-01", "stories": [] }, { "iso3": "PRK", "name": "North Korea", "region": "Asia", "overall": 19, "rank": "198", "likelyRank": "187 to 198", "band": "Poor", "keysModel": "State", "confidence": "high", "headline": "North Korean law gives patients no right to their records and no say over sharing, while the UN finds state surveillance growing.", "categories": { "access": { "score": 15, "summary": "No law we read gives a patient the right to see or copy their medical record. The Medical Law says a diagnosis is told to the patient, but a diagnosis judged harmful to treatment may be told only to the guardian.", "sources": [ { "title": "Medical Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-11-20", "publisherClass": "legal_text" }, { "title": "Public Health Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=184&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-04-03", "publisherClass": "legal_text" } ] }, "control": { "score": 20, "summary": "Patients must consent to surgery and to the use of organs, but the Medical Law makes hospitals register every patient found in check-ups and report them to the 'relevant bodies'. We found no choice over sharing and no access log.", "sources": [ { "title": "Medical Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-11-20", "publisherClass": "legal_text" }, { "title": "Situation of human rights in the DPRK, report of the High Commissioner (A/HRC/60/58)", "url": "https://documents.un.org/api/symbol/access?s=A/HRC/60/58&l=en&t=pdf", "date": "2025-09-04", "publisherClass": "intergov" } ] }, "privacy": { "score": 15, "summary": "We found no data protection law, no regulator and no medical secrecy duty in the health laws we read. A UN report in 2025 found general surveillance 'more pervasive, aided by advances in technology'.", "sources": [ { "title": "Situation of human rights in the DPRK, report of the High Commissioner (A/HRC/60/58)", "url": "https://documents.un.org/api/symbol/access?s=A/HRC/60/58&l=en&t=pdf", "date": "2025-09-04", "publisherClass": "intergov" }, { "title": "Medical Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-11-20", "publisherClass": "legal_text" }, { "title": "North Korean law trends: State Secrets Protection Law (Ministry of Government Legislation, Seoul)", "url": "https://www.moleg.go.kr/boardDownload.es?bid=legnlpst&list_key=4013&seq=1", "date": "undated", "publisherClass": "official" }, { "title": "Adequacy decisions (European Commission)", "url": "https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en", "date": "undated", "publisherClass": "intergov" } ] }, "journey": { "score": 20, "summary": "The health ministry reported a telemedicine network linking Pyongyang with hospitals in 12 provinces and 215 county hospitals, but its own plan describes unintegrated health information systems. No shared patient record exists.", "sources": [ { "title": "Medium Term Strategic Plan for the Development of the Health Sector, DPR Korea 2016-2020 (Ministry of Public Health, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/prk199549.pdf", "date": "2017", "publisherClass": "official" }, { "title": "WHO supports DPR Korea through a three-day webinar on digital health transformation and AI for health (WHO DPR Korea)", "url": "https://www.who.int/dprkorea/news/detail/09-04-2026-who-supports-dpr-korea-through-a-three-day-webinar-on-digital-health-transformation-and-artificial-intelligence-for-health", "date": "2026-04-09", "publisherClass": "intergov" }, { "title": "North Korea's 'all-resident medical service system' plan: potential and dilemmas of digital health (SPN, Kim Shin-gon, Korea University)", "url": "https://www.spnews.co.kr/news/articleView.html?idxno=106912", "date": "2026-05-04", "publisherClass": "news" } ] }, "commercial": { "score": 20, "summary": "No law limits selling health data or using it for marketing; the health laws we read say nothing on sale or reuse of records. Care is moving to fees and a 'health insurance fund', which analysts link to the free-care clause dropped from the 2026 constitution.", "sources": [ { "title": "Public Health Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=184&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-04-03", "publisherClass": "legal_text" }, { "title": "Situation of human rights in the DPRK, report of the High Commissioner (A/HRC/60/58)", "url": "https://documents.un.org/api/symbol/access?s=A/HRC/60/58&l=en&t=pdf", "date": "2025-09-04", "publisherClass": "intergov" }, { "title": "2026 North Korean constitutional revision analysis (4): health care (Korea Institute for National Unification)", "url": "https://hairo.unikorea.go.kr/com/nsisFileDownload.do?fileName=FILE_000000000007950.pdf&localSaveFileName=2026%20%EB%B6%81%ED%95%9C%20%ED%97%8C%EB%B2%95%20%EA%B0%9C%EC%A0%95%20%EB%B6%84%EC%84%9D(3)_%EB%B3%B4%EA%B1%B4%EC%9D%98%EB%A3%8C%20%EB%B6%84%EC%95%BC.pdf&secondPath=bbs/2026/06", "date": "2026-05-13", "publisherClass": "academic" }, { "title": "North Korea overhauls free care and introduces a health insurance fund (News1 via Daum)", "url": "https://v.daum.net/v/20260930070206030", "date": "2026-09-30", "publisherClass": "news" } ] }, "clinical": { "score": 15, "summary": "A doctor in a county hospital can consult specialists in Pyongyang by video link, but no system lets a treating clinician see a patient's record from other providers. Records stay as paper or local files.", "sources": [ { "title": "Medical Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-11-20", "publisherClass": "legal_text" }, { "title": "Medium Term Strategic Plan for the Development of the Health Sector, DPR Korea 2016-2020 (Ministry of Public Health, FAOLEX copy)", "url": "https://faolex.fao.org/docs/pdf/prk199549.pdf", "date": "2017", "publisherClass": "official" }, { "title": "North Korea uses its remote medical service system for remote medical training (NK Economy)", "url": "http://www.nkeconomy.com/news/articleView.html?idxno=15376", "date": "2025-10-11", "publisherClass": "news" } ] }, "research": { "score": 40, "summary": "No rule on research consent, opt-out or reuse of patient data was found, so this sits at the no-consent base of 40. No safeguard counts: the Medical Law's approval of new diagnostic methods and council review of gene therapy are clinical, not research, controls.", "sources": [ { "title": "Public Health Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=184&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-04-03", "publisherClass": "legal_text" }, { "title": "Medical Law of the DPRK, 2012 text (Unification Law Database, Ministry of Government Legislation, Seoul)", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000", "date": "2012-11-20", "publisherClass": "legal_text" } ] }, "ai": { "score": 18, "summary": "We found no rules for AI in clinical care: no AI law, no health AI guidance and no regulation of medical software. A February 2026 WHO webinar only introduced AI governance to ministry staff.", "sources": [ { "title": "WHO supports DPR Korea through a three-day webinar on digital health transformation and AI for health (WHO DPR Korea)", "url": "https://www.who.int/dprkorea/news/detail/09-04-2026-who-supports-dpr-korea-through-a-three-day-webinar-on-digital-health-transformation-and-artificial-intelligence-for-health", "date": "2026-04-09", "publisherClass": "intergov" }, { "title": "Status and outlook of North Korean AI research and development (NK Economy)", "url": "http://www.nkeconomy.com/news/articleView.html?idxno=15921", "date": "2026-02-02", "publisherClass": "news" } ] } }, "laws": [ { "name": "Medical Law", "level": "National", "year": "1997 (amended 2012)", "what": "Records must be kept; diagnosis may be told only to guardian; patients registered and reported to authorities.", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=181&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000" }, { "name": "Public Health Law", "level": "National", "year": "1980 (amended 2012)", "what": "Promises free care and section doctors; state leads medical research; no data or confidentiality rules.", "url": "https://www.unilaw.go.kr/bbs/selectBoardArticle.do?bbsId=BBSMSTR_000000000021&nttId=184&bbsTyCode=BBST01&bbsAttrbCode=BBSA02&authFlag=Y&menuNo=3010000&upperMenuId=3000000" }, { "name": "Socialist Constitution, Article 49", "level": "National", "year": "2026", "what": "Revised health clause drops universal free care, section doctors and preventive medicine wording.", "url": "https://hairo.unikorea.go.kr/com/nsisFileDownload.do?fileName=FILE_000000000007950.pdf&localSaveFileName=2026%20%EB%B6%81%ED%95%9C%20%ED%97%8C%EB%B2%95%20%EA%B0%9C%EC%A0%95%20%EB%B6%84%EC%84%9D(3)_%EB%B3%B4%EA%B1%B4%EC%9D%98%EB%A3%8C%20%EB%B6%84%EC%95%BC.pdf&secondPath=bbs/2026/06" }, { "name": "State Secrets Protection Law", "level": "National", "year": "2023", "what": "Defines state secrets broadly as anything tied to state security and interests, with criminal penalties.", "url": "https://www.moleg.go.kr/boardDownload.es?bid=legnlpst&list_key=4013&seq=1" } ], "dti": { "grade": 91, "tier": "Platinum", "tierCapped": false }, "asOf": "2026-10-01", "stories": [ { "date": "2025-04-07", "headline": "North Korean hospitals post a fee for diagnosis certificates as free care fades", "paraphrase": "Residents told a news outlet that hospitals now post charges at reception, including a fee for a diagnosis certificate, so patients must pay to get a written record of their own diagnosis.", "source": "Radio Free Asia (Korean service)", "url": "https://www.rfa.org/korean/in-focus/2025/04/07/north-korea-hospital-treatment-cost/", "theme": "access_delay_or_cost", "status": "alleged" } ] } ] }