Taiwan enacts health insurance data law with opt-out rights and heavy fines

Taiwan's National Health Insurance Administration has enacted a new regulation governing the use and management of health insurance data, effective August 10th. This legislation, the "National Health Insurance Data Management Act," establishes a framework for how health insurance data can be utilized and overseen, while also empowering individuals to request their exclusion from certain data uses.

The new law addresses a constitutional court ruling from 2022, which found that while the use of health insurance data for statistical research by government and academic institutions was constitutional, the existing system lacked personal data supervision mechanisms and provisions for individuals to request the cessation of data use. The court mandated legislative amendments within three years.

Key provisions include the right for individuals to request the cessation of the use of their health insurance data for purposes beyond those explicitly permitted. For 30 days following the law's implementation, the Ministry of Health and Welfare and the National Health Insurance Administration will halt accepting applications for health data use from government, hospital, and academic institutions. During this period, individuals can opt out; failure to do so will be considered consent for data use for specified purposes, though subsequent opt-out requests remain possible.

However, exceptions exist, such as when data provision is an obligation of the governing authority or insurer, or to prevent immediate danger to life, body, or property. Such exceptions require government agency applications with specific justifications for purpose, necessity, duration, and data utilization. Unauthorized use of health insurance data can lead to fines ranging from NT$2 million to NT$10 million, and violators will be barred from applying for data use for one year, with acquired data subject to destruction. The law also includes severe penalties for illegally accessing or damaging health insurance database facilities, with potential prison sentences and substantial fines.