Short answer: Health data sits at the highest protection tier in Vietnamese law because two regimes overlap: it is sensitive personal data under the Personal Data Protection Law 91/2025/QH15, and simultaneously the patient’s health-secrecy under the Law on Medical Examination and Treatment 15/2023/QH15. A medical facility sharing data while looking at only one layer misses half its duties.
Two protection layers and sharing principles
The health-sector layer sets the principle: information on health status and private life recorded in medical records is secret, disclosable only with the patient’s consent or in legally permitted cases such as treatment, anonymised scientific research or competent-authority requests. The personal-data layer sets the operating mechanics: lawful bases for sensitive data, impact assessment for electronic health record systems, processing agreements with hospital software vendors and incident notification. Sharing between hospital and insurer is the typical collision: the insurer needs data to assess claims, but shared data must be limited to what relates to the specific insurance benefit and rest on a valid basis from the patient, not a wholesale transfer of the entire medical record on a simple administrative request.
Telemedicine and foreign-invested hospitals
Remote medical examination and treatment is recognised by the health law with conditions on facilities, personnel and the catalogue of techniques permitted remotely; telemedicine’s data layer is heavier than in-person care at three points: the audio-video platform is a sensitive-data processor, session data may be recorded, and infrastructure may sit outside the hospital or offshore. A foreign-invested hospital in Vietnam bears the same record-protection and retention frame as a domestic facility; a group model centralising patient data to a regional hub must first be tested against medical-record retention duties and the outbound personal-data transfer mechanism under Law 91/2025 — the global model cannot be applied as-is. Every facility should maintain a health-data sharing matrix: data type, recipient, basis, retention — the centerpiece of any inspection.
Checklist for medical facilities
- A sharing matrix: records, insurers, research, regulators — one basis per flow.
- A dedicated impact assessment for the EHR system and telemedicine platform.
- Processing agreements with hospital software vendors including incident clauses.
- Patient consent processes separated by sharing purpose, and withdrawable.
Frequently asked questions
At what level is health data protected?
At the system’s highest level: sensitive personal data under Law 91/2025 and the patient’s health secret under the Law on Medical Examination and Treatment 15/2023. Consequences are stricter lawful bases, mandatory impact assessment for processing systems, reinforced security and heavy sanctions on violation — in both professional and data-protection dimensions.
How is data shared between hospitals and insurers?
On a valid basis tied to the patient’s specific insurance benefit, limited to data necessary for claim assessment, under a confidentiality agreement between the parties. The insurer has no default right to the full medical record; the hospital must control sharing scope and log every data provision.
What legal frame governs telemedicine?
It is recognised in the Law on Medical Examination and Treatment 15/2023 with conditions on performing facilities, personnel and the catalogue of techniques permitted remotely. The accompanying data layer includes: the technology platform as a sensitive-data processor, management of session recordings and an impact assessment for the whole telemedicine data flow under Law 91/2025.
How must foreign-invested hospitals store data?
Under the same frame as domestic facilities: medical-record retention under sector rules and personal data protection under Law 91/2025. Centralising patient data to offshore infrastructure must satisfy the outbound personal-data transfer mechanism and record-retention requirements — to be assessed before applying a group’s global data model.
This article has been quality-reviewed by the FLAW AI Legal Council