The risk of personal medical data leaks stemming from “gaps” in governance
Viet Nam is accelerating the implementation of electronic medical records, aiming to develop “smart hospitals” nationwide. This has served as a vital foundation for improving the quality of healthcare, optimising hospital operations, and fostering the development of AI applications in the medical sector. Data lies at the very core of this objective.
Recently, health insurance data has been connected, integrated, and shared with the Ministry of Public Security via the VNeID platform, while also being incorporated into citizens’ electronic health records.
According to the Ministry of Health, approximately 35 million people currently have an electronic health record on VNeID, and 1,265 healthcare facilities across the country have adopted electronic medical records. This has brought significant convenience to healthcare services and medical treatment.
Expanding these connections necessitates strict management of how personal health information is accessed and used in order to ensure data security and prevent the illicit sale of data. Medical data is classified as sensitive information; therefore, any connectivity or data sharing between healthcare facilities must be accompanied by robust personal data protection, a critical requirement in today’s digital era.
If such information is disclosed beyond authorised parameters, the privacy of patients could be compromised. In cases where data is incorrectly altered or becomes inaccessible when needed, medical examination and treatment services may face significant disruptions.
According to the Ministry of Health, approximately 35 million people currently have an electronic health record on VNeID, and 1,265 healthcare facilities across the country have adopted electronic medical records. This has brought significant convenience to healthcare services and medical treatment.
Recently, acting on information provided by the public and monitoring online activity, the Bac Ninh Provincial Police identified numerous marketing calls originating from businesses offering services related to maternal and infant care.
The investigation revealed that these calls were linked to the illegal sale and exploitation of personal data belonging to many families, sourced from the National Immunisation Information System.
The individuals involved in the two uncovered cases were former consultants at immunisation facilities. In their previous roles, they had been granted access to the National Immunisation Information System for professional purposes and were well-versed in how to search for and extract data. Exploiting this access, they exported the data into Excel files, organised by province or city, and offered them for sale on social media.
Notably, the investigation revealed that many accounts belonging to vaccination centres had become inactive, while others, created specifically for training sessions, were neither deactivated nor revoked as required.
Furthermore, the system for granting user access lacked rigorous controls. Consequently, perpetrators did not need sophisticated cyberattack techniques to easily steal hundreds of thousands of records concerning expectant mothers and newborns, which were then put up for sale.
Cases like these underscore an urgent need to review and tighten governance across all information systems that store personal data, including personal medical records. Ensuring cybersecurity, data security, and information safety for both organisations and individuals must be treated as an integral, non-negotiable requirement throughout the digitalisation process.
Effectively managing cross-border data flows
There is a growing demand, both domestically and internationally, for the cross-border sharing of personal medical data. The digitalisation of medical records, the use of cloud computing, wearable devices, and genetic testing are generating vast quantities of personal health information. This has created a dual challenge: facilitating the seamless flow of data while simultaneously protecting the privacy of the data subjects and clearly defining the responsibilities of all parties involved in the data transfer.
Associate Professor Nguyen Lan Hieu, Director of Ha Noi Medical University Hospital, stated: “We possess millions of anonymised patient records. These constitute an asset; therefore, the Law on Intellectual Property should explicitly mandate that permission be obtained from the medical institution before such data is used to train commercial AI models.”
According to Do An Ha, a PhD candidate at Ha Noi Law University, the 2024–2026 period has seen the issuance of various legal instruments in Viet Nam concerning data and personal data protection. While these have established new mechanisms for the cross-border transfer of personal data, they lack specific provisions for medical data and fail to address legal conflicts that may arise when such data is transferred abroad.
Existing regulations regarding personal medical data, found within various specialised legal documents, are designed primarily for domestic, on-site access based on the consent of healthcare facilities; they lack specific provisions governing the provision of medical records to organisations located overseas.
Assessing the legal gaps and challenges facing Viet Nam, Tran Thanh Nhan from Justix Law Firm notes that the scope of “core data” and “important data” within the healthcare sector remains ill-defined. Furthermore, there is a lack of alignment between personal data protection laws and healthcare-related legislation, while the mechanisms for controlling data transfers remain indirect. Current laws do not impose a direct obligation on overseas recipients to provide notification or obtain consent prior to any further transfer of such data.
Nhan argued that a framework must be designed to ensure the lawful use of data while safeguarding the rights of all involved parties. Moving forward, it is essential to clarify the conceptual framework and the scope of “core data” within the healthcare sector.
The Ministry of Health and the authority responsible for personal data protection must provide unified guidance on “personal health data”, encompassing data from which an individual’s health status can be inferred, while clearly distinguishing this from general “medical data” and de-identified data. Additionally, alongside efforts to harmonise personal data protection laws with healthcare legislation, guidance is needed regarding remote data access.
