Impact of Personal Data Protection Act on Healthcare Information

Madam, the healthcare sector and healthcare-related information will continue to be regulated by existing laws, such as the Private Hospitals and Medical Clinics Act. These laws set out data confidentiality and disclosure requirements relating to healthcare information. Medical professionals and healthcare institutions will continue to be subject to existing patient confidentiality requirements. Patients will also continue to be able to request for medical reports about their health status from healthcare institutions, as with current practice.

The Personal Data Protection Act, or the PDPA for short, will not override these existing laws and requirements. The PDPA is a baseline law that ensures a common standard of protection for individuals' personal data across the

Page: 67

economy, especially in sectors where rules on the management of personal data are currently lacking. For sectors that are already regulated by other laws and regulations, such as the healthcare sector, the PDPA will apply concurrently. Organisations in those sectors will continue to comply with the requirements under their current laws and regulations as well as the PDPA. Where there are cases of inconsistency, the provisions of those other written laws will prevail.

Madam, a supplementary question for the Minister. For third-party providers that are not covered under the healthcare Act and MOH that are collecting information, either IT-providers or phone service providers, there is uncertainty because some of the information is collected in the context of healthcare but is not technical or medical information. Would that information be covered under the Personal Data Protection Act or the existing regulations?

For third-party providers, in certain cases, depending on what exactly the use of the data is collected for, we have to look at the usage. By and large, it should be covered because you are basically working on instruction of another party to collect the data for certain purposes. Therefore, the individual who is actually giving up the information must be assured that data is collected for that particular purpose. As far as we are concerned, the baseline of the PDPA will prevail across but, if there are exceptions to be made, we have to look at the exceptions because there are exceptions within this threshold.