TAIPEI (Taiwan News) — The legislature passed the third reading of the National Health Insurance Data Management Act, a pivotal piece of legislation that creates a strict, new framework governing how vast amounts of National Health Insurance data can be used.
The law also gives citizens the right to opt out of having their NHI data used for non-clinical, research-related purposes. In a move aimed at deterrence, the act imposes heavy penalties for breaches, including fines of up to NT$10 million (US$318,000) for unauthorized use. Any data acquired without approval must be destroyed, per CNA.
The push for this legislation stems from a 2022 ruling by the Constitutional Court, which determined the use of the NHI database for statistical and research purposes by academic and government entities was permissible, though it ordered the government to create, within three years, a mechanism giving NHI beneficiaries greater control over the use of their personal data.
The Cabinet then put forth the draft in May, which was fast-tracked through the legislature, concluding with cross-caucus negotiations on Nov. 13.
The primary goal of the new act is to balance public good with personal privacy. It aims to regulate the use of NHI data for purposes outside of specific healthcare delivery while safeguarding individual informational privacy.
The law mandates that applications for external data use are restricted to the following public-interest objectives: improving medical quality and accessibility, enhancing public health and social welfare, promoting academic research development, and assisting government agencies in statutory duties.
Furthermore, the law explicitly bans the data from being used for any commercial purposes. Only authorized entities such as government agencies, domestic medical and academic institutions, and commissioned universities can apply for use of the data.
Upon the act’s implementation, the health ministry and NHI must halt the acceptance of data use applications for 30 days. During this period, citizens can formally request to withdraw their consent for non-specific-purpose utilization of their data.
Individuals who do not opt out within the 30-day window are deemed to have consented, though they can still request to withdraw at any later date. The opt-out rule has narrow exceptions for government agencies seeking data solely to prevent immediate danger to lives or property, or when mandated by law.
The penalty for using NHI data without approval is a fine ranging from NT$2 million to NT$10 million. The offending party will also be barred from submitting new applications for one year, and any unlawfully obtained data must be destroyed.
