Decree No. 102/2025/ND-CP on health data management

DECREE

Regulations on Health Data Management

On the basis of Law on Government Organization dated February 18, 2025;

On the basis of Law on Data November 30, 2024;

On the basis of Law on Electronic Transactions June 22, 2023;

On the basis of Law on Medical Examination and Treatment January 9, 2023;

On the basis of Law Amending and Supplementing Certain Provisions of the Medicine Law November 21, 2024;

On the basis of Cybersecurity Law June 12, 2018;

On the basis of Law on Access to Information April 6, 2016;

On the basis of Law on Cybersecurity November 19, 2015;

On the basis of Law on Information Technology June 29, 2006;

At the proposal of the Minister of Health;

The Government issues this Decree to regulate health data management.

PART I

GENERAL PROVISIONS

Article 1. Scope of Regulation

Article 1. This Decree stipulates the management of digital health data including the construction, development, protection, governance, processing, and utilization of digital health data; the National Health Database; and the responsibilities of agencies, organizations, and individuals related to the management of digital health data.

Article 2. This Decree does not apply to health data related to state secrets.

Article 2. Applicability

1. Agencies, organizations, and individuals of Vietnam.

2. Agencies, organizations, and individuals from foreign countries operating in Vietnam.

3. Agencies, organizations, and individuals from foreign countries directly participating in or related to digital health data activities in Vietnam.

3. Amend Clause 3 Article 2 as follows:Article 3. Definitions

In this Decree, the following terms are understood as follows:

1. Digital health data refers to digital data reflecting health fields (hereinafter referred to as health data).

2. Health database is a collection of health data organized for access, exploitation, sharing, management, and updating.

3. Electronic health record is an application or information technology software to update, display, search, store summary information about disease prevention, medical examination, treatment, and health care of individuals.

Article 4. General Principles

Article 4. Utilization of health data

1. Health data shall be used to serve the protection, care, and improvement of people's health, state management work, simplification of administrative procedures, building of electronic and digital government, economic and social development.

Chapter II

2. The construction, updating, maintenance, development, protection, governance, processing, exploitation, and utilization of health data, the National Health Database shall comply with the provisions of this Decree and laws on data, information technology, electronic transactions, cybersecurity, national security, information access, personal data protection; regulations on the management, connection, and sharing of digital data of state agencies; and regulations on the construction, updating, maintenance, exploitation, and utilization of the National Health Database.

CONSTRUCTION, DEVELOPMENT, PROTECTION, GOVERNANCE, PROCESSING, AND UTILIZATION OF HEALTH DATA

Article 5. Scope of health data

Health data reflects information on health fields, including:

1. Information on preventive healthcare.

2. Information on environmental protection in the health sector.

3. Information on medical examination and treatment, rehabilitation.

4. Information on medical forensic, forensic psychiatry.

5. Information on traditional medicine.

6. Information on pharmaceuticals.

7. Information on cosmetics.

8. Information on food safety within the health sector's jurisdiction.

9. Information on medical equipment.

10. Information on health infrastructure.

11. Information on population.

12. Information on maternal and child health, reproductive health.

13. Information on health insurance.

14. Information on health communication and education.

15. Information on science and technology in the health sector.

16. Information on international cooperation in health.

17. Information on the application of information technology, digital transformation in health.

18. Information on health finance.

19. Information on health inspection.

20. Information on health workforce.

21. Information on health workforce training.

22. Information on administrative procedures in the health sector.

23. Information on regulatory and operational documents in the health sector.

Article 6. Health identification code for individuals

The health identification code for individuals shall be the citizen identification number of Vietnamese citizens and foreigners who have been issued an electronic identity account in accordance with the laws on identification cards.

Article 7. Health databases

1. National health database.

2. Specialized health databases including:

a) Health databases of the Ministry of Health, other ministries and ministerial-level agencies, government agencies, political organizations, and political-social organizations containing information belonging to one or more groups of information as prescribed in Article 5 of this Decree;

b) Health databases of provincial People's Committees containing information belonging to one or more groups of information as prescribed in Article 5 of this Decree.

3. Health databases of other levels of authority, healthcare facilities containing health information and data within their management scope.

4. Common health databases comprising the national health database and specialized health databases.

Article 8. Construction and development of health data

The Ministry of Health, other ministries and ministerial-level agencies, government agencies, political organizations, political-social organizations, People's Committees at all levels, and healthcare facilities shall implement the construction and development of health data in accordance with the provisions of Articles 11 and 12 of the Data Law and the provisions of this Decree.

Article 9. Processing of health data

1. The processing of health data shall be carried out in accordance with the provisions of Articles 22, 23, 24, 25, and 26 of the Data Law and the provisions of this Decree.

2. Conditional access to health information

a) Information related to business secrets in the groups of information prescribed in Clauses 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 15, 17, 18, 19, and 24 of Article 5 of this Decree shall be accessed upon the consent of the owner of such business secrets;

b) Information related to private life secrets, personal secrets, health status, genetic characteristics, physical attributes, individual biological characteristics, sexual life, and sexual orientation in the groups of information prescribed in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15, and 20 of Article 5 of this Decree shall be accessed upon the consent of the individual concerned, ensuring compliance with the laws on personal data protection;

c) Information related to family secrets in the groups of information prescribed in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15, and 19 of Article 5 of this Decree shall be accessed upon the consent of the family members;

d) During the performance of their functions, tasks, and powers, the heads of state agencies may decide to provide information related to business secrets, private life, personal secrets, and family secrets when necessary for public interest and community health in accordance with relevant laws without requiring consent as stipulated in Points a, b, and c of Clause 2 of this Article.

Article 10. Use and exploitation of health data

1. The use of health data shall be carried out in accordance with the provisions of Articles 16, 17, and 21 of the Data Law and the provisions of this Decree.

2. Subjects exploiting and using health data

a) Party and State agencies, Vietnam Fatherland Front and political organizations, and political-social organizations may exploit and use health data in accordance with the functions and tasks of the agencies and organizations;

b) Data subjects may exploit and use health data reflecting themselves;

c) Organizations and individuals not covered by Point a and Point b of this Clause may exploit and use health data as follows: freely exploit and use open health data; exploit and use personal data upon the consent of the data management and maintenance unit and the individual being the data subject; exploit and use other data upon the consent of the data management and maintenance unit.

3. Primary data in the National Health Database has official usage value equivalent to paper documents provided by authorized agencies.

4. Primary data in the health databases of ministries, sectors, and localities have official usage value equivalent to paper documents provided by ministries, sectors, and localities.

5. Use of health data to implement Electronic Health Records

a) Health data on disease prevention, diagnosis, treatment, health care, and related information shall be used to implement Electronic Health Records;

b) Healthcare facilities legally operating in Vietnam shall have the responsibility to connect, share, and interlink related health data with integrated Electronic Health Records on the national identification application;

c) Healthcare facilities operating legally in accordance with the law, Vietnamese citizens or foreigners who have been issued an electronic identity account may use integrated Electronic Health Records on the national identification application to replace related documents during disease prevention, diagnosis, treatment, and health care as prescribed.

Article 11. Management and protection of health data

The management and protection of health data shall be carried out in accordance with the provisions of Articles 15 and 27 of the Data Law and the regulations of this Decree.

Chapter III

NATIONAL HEALTH DATABASE

Article 12. Managing Authority of the National Health Database

The Ministry of Health is the managing authority of the National Health Database.

Article 13. Objectives for Building the National Health Database

1. To serve state management work in the healthcare sector, share with other ministries, sectors, and localities to serve policy planning, development planning, economic and social strategies; to serve administrative procedures, administrative reform, simplification of administrative procedures for citizens and businesses; to serve the needs of data exploitation, utilization, and application by organizations and individuals, and economic and social development goals.

2. To serve health protection, care, and improvement of people's health; to serve citizens in managing their own health.

Article 14. Scope of Data in the National Health Database

1. Information on agencies and organizations operating under the law in the fields of medical examination and treatment; traditional medicine; rehabilitation; medical appraisal; forensic medical appraisal; forensic psychiatric appraisal; preventive healthcare and biosafety in medical testing; population; maternal and child health, reproductive health; health insurance; medical equipment; drugs; drug raw materials; functional foods; nutrient-enriched foods; environmental protection in healthcare activities; science and technology in the healthcare field; education and training in healthcare-related fields; pharmaceutical production and business; cosmetic production and business; medical equipment production and business; functional food production and business; chemical, insecticide, and bactericide production and business for household and healthcare use, including:

a) Electronic identity information of agencies and organizations;

b) Organizational form;

c) Information on scope of operation and service provision in the healthcare field.

2. Information on healthcare human resources

a) Basic information of individuals;

b) Information on training and capacity building;

c) Information on professional practice certificates.

3. Basic information on pharmaceuticals and medical equipment

a) Identification information;

b) Circulation information;

c) Export permit information;

d) Import permit information.

4. Health information of individuals

a) Healthcare identification code of individuals;

b) Basic information of individuals;

c) Birth registration information;

d) Health insurance information;

đ) Information on disease prevention, medical examination, treatment, and individual health care;

e) Death registration information.

Article 15. Information on Primary Storage and Sharing of Data

1. Information on the scope of operation and service provision in the healthcare field as stipulated in Point c Clause 1 Article 14 of this Decree.

2. Information on professional practice certificates as stipulated in Point c Clause 2 Article 14 of this Decree.

3. Identification information and circulation information as stipulated in Points a and b Clause 3 Article 14 of this Decree.

4. Birth registration information; information on disease prevention, medical examination, treatment, and individual health care; death registration information as stipulated in Points c, đ, and e Clause 4 Article 14 of this Decree.

Article 16. Sources of information for building and updating the National Health Database

1. The National Health Database is established, collected, updated, and synchronized from the following sources:

a) Data from the Ministry of Health and other state management agencies on health;

b) Data from health databases managed by the Ministry of Health;

c) Data shared and synchronized from national databases, databases managed by ministries, sectors, provinces, centrally governed cities, the Vietnam Fatherland Front, and political organizations and socio-political organizations related to the scope of data specified in Article 14 of this Decree;

d) Data from databases managed by healthcare facilities;

đ) Data resulting from the implementation of administrative procedures and public services in the health sector;

e) Digitized data provided and integrated by individuals and organizations.

2. The managing authorities, database management agencies, and related databases within the National Health Database are responsible for updating and adjusting the information as stipulated in Article 14 of this Decree, ensuring the completeness, accuracy, consistency, and quality of the updated and shared data.

Article 17. Utilization and Exploitation of the National Health Database

1. The exploitation and utilization of the National Health Database shall be carried out in accordance with the provisions of Article 10 of this Decree.

2. Methods of utilizing and exploiting the National Health Database

a) Connecting and sharing data between the national database; specialized databases; other databases, information systems with the National Health Database;

b) The National Data Portal, the National Public Service Portal, the Ministry of Health's Electronic Information Portal, the Ministry of Health's Administrative Procedure Information System;

c) The electronic identity and authentication platform;

d) The national identity application;

đ) Equipment, means, software provided by the data management and maintenance units;

e) Other methods when approved by the Ministry of Health.

Chapter IV

RESPONSIBILITIES OF AUTHORITIES, UNITS, ORGANIZATIONS, AND INDIVIDUALS

Article 18. Responsibilities of the Ministry of Health

1. To take the lead and coordinate with competent agencies to include the National Health Database in the list of National Databases as prescribed; to develop the roadmap for implementing the National Health Database; to organize the construction, management, governance, and maintenance of the National Health Database.

2. To develop and promulgate national technical standards for the National Health Database and specialized health databases under its jurisdiction.

3. To build and update health database directories; to publicly disclose open health data under its jurisdiction.

4. To develop and implement plans and solutions to ensure the quality of health data.

Article 19. Responsibilities of the Ministry of Public Security

1. To ensure infrastructure and information security for storing the National Health Database on the infrastructure of the National Data Center.

2. To connect, share, and synchronize electronic identity information of agencies and organizations and basic personal information from the National Population Database with the National Health Database.

3. To cooperate with the Ministry of Health and relevant agencies to utilize health data to serve the construction and operation of the Electronic Health Record system on the national identity application.

Article 20. Responsibilities of the Government Office

Connecting, sharing, and synchronizing data between the National Public Service Portal, the National Information Reporting System, other systems of the Government Office, and health-related databases as prescribed.

Article 21. Responsibilities of Ministries, ministerial-level agencies, and government agencies

1. The managing agencies of the National Enterprise Registration Database; the National Civil Servant, Public Official, and Public Corporation Staff Database; the National Health Insurance Database; and databases containing export permit, import permit, drug price, and medical equipment information shall be responsible for connecting, sharing, and synchronizing information with the National Health Database.

2. Building, updating, connecting, sharing, and synchronizing health-related data managed by their agencies with the National Health Database and specialized health databases as prescribed.

3. Ensuring resources for activities related to collecting, updating, managing, exploiting, and using health-related data within their jurisdiction.

Article 22. Responsibilities of People's Committees of provinces and centrally governed cities

1. Implementing the creation and collection of health data to form health databases serving management and data usage at the local level.

2. Building and updating lists of health-related databases and open health data under their authority.

3. Connecting, sharing, and synchronizing health-related data managed locally with the National Health Database and specialized health databases as prescribed.

4. Building and implementing electronic health records to serve health protection, care, and improvement for the people in their jurisdiction.

Article 23. Responsibilities of healthcare facilities

1. Creating, collecting, standardizing data, and building unit databases.

2. Connecting, sharing, and synchronizing unit data with the National Health Database, the Ministry of Health’s database, local health databases, and integrated electronic health records on national identification applications.

3. Ensuring information security and cybersecurity for databases and the processes of connection, sharing, and synchronization of data.

Article 24. Rights and responsibilities of agencies, units, organizations, and individuals

1. Agencies, units, organizations, and individuals shall promptly notify the managing agency of the health database of any changes, additions, or errors in the data reflecting their agency, unit, organization, or individual.

2. Having the right to exploit and use data from health-related databases as prescribed.

Chapter V

IMPLEMENTING PROVISIONS

Article 25. Effective Date

This Decree takes effect from July 1, 2025.

Article 26. Responsibility for Implementation

1. The Minister of Health is responsible for guiding, inspecting, and urging the implementation of this Decree.

2. Ministers, heads of ministerial-level agencies, heads of government agencies, Chairpersons of People's Committees of provinces and centrally governed cities, and relevant agencies, units, organizations, and individuals are responsible for implementing this Decree./.