“Medical information is now transferred by patients”... Full-fledged implementation of transmission request rights

Daeryun Law Firm “Security and reliability must be thoroughly secured”

An era has begun in which patients can directly manage and utilize their medical records and health information. This is when the ‘right to request transmission of personal information’ system was implemented in earnest following the enforcement of the revised ‘Personal Information Protection Act’ last March.

Legal experts advised that a technical and management system must be established as a major change has begun in the data flow between medical institutions and patients. On the 7th, Daeryun Law Firm introduced the systems that companies and institutions must have through a corporate and implications report on the revised personal information processing policy guidelines.

The 'right to request transmission of personal information' is the right of the information subject to request that his or her personal information be transmitted to him or her or a third party. It is a system that was introduced to suit the domestic circumstances of the 'right to data portability' stipulated in the European Union's (EU) General Data Protection Regulation (GDPR).

This system is a core axis of the 'My Data' policy that ensures that individuals can independently integrate and utilize their information on various platforms, and is being applied sequentially in sensitive information fields such as medical care, communications, and finance.

Among them, the medical field in particular is one of the core application areas of this system, and it is believed that it could have a significant impact on the future medical treatment and health management system.

With the implementation of this system, patients can directly receive vaccination records, health checkup results, treatment details, medication history, diagnosis information, etc. that were distributed across public and private institutions such as the Korea Disease Control and Prevention Agency, National Health Insurance Service, Health Insurance Review and Assessment Service, and tertiary general hospitals, or send them to the organization or platform of their choice. This makes it possible to transfer medical records between hospitals as well as integrated health management through the personal health record (PHR) platform.

The Personal Information Protection Committee is expanding the scope of My Data application to the medical field, communications, energy, etc., and plans to establish a more solid institutional foundation for medical information transmission by 2026. Transmission of personal information must be done through a specialized intermediary agency, and is only permitted through encryption and API methods. Scraping methods are prohibited, and medical data is stored and utilized through specialized 'specialized organizations'.

However, the information that can be transmitted is limited to information provided by the information subject or generated through activities, and in principle, data analyzed and processed by the hospital (risk prediction, profiling results, etc.) is not included in the transmission target. Exceptionally, diagnostic information can be transmitted under medical law.

Officials predict that institutionalizing the right to request personal information transmission in medical settings will not only establish patient-centered health information sovereignty, but will also become the basis for precision medicine and customized health management services in the future.

Daeryun Law Firm emphasized, “A patient-centered medical data utilization system has begun,” and “Medical institutions such as general hospitals must thoroughly ensure the security and reliability of the data transmission process, considering the nature of handling sensitive personal information.”

He added, “PHR platforms, digital healthcare companies, etc., as recipients of transmitted data, must also meet My Data registration requirements and have a technical and management system that guarantees the rights of information subjects.”

Meanwhile, as the MyData project is recently on track, the government is also preparing specific guidelines for the transmission of MyData personal information. On the 6th, the Personal Information Protection Committee published the 'Guide to the MyData Personal Information Transmission Request System in All Fields', a draft of which was released in March last year and collected opinions.

[View full article]
"Medical information is now carried by patients"... Full-fledged implementation of transmission request rights (link)