Decree 102/2025/ND-CP on health data management

DECREE

Providing the management of health data^[1]

Pursuant to the February 18, 2025 Law on Organization of the Government;

Pursuant to the November 30, 2024 Law on Data;

Pursuant to the June 22, 2023 Law on Electronic Transactions;

Pursuant to the January 9, 2023 Law on Medical Examination and Treatment;

Pursuant to the November 21, 2024 Law Amending and Supplementing a Number of Articles of the Pharmacy Law;

Pursuant to the June 12, 2018 Law on Cyber Security;

Pursuant to the April 6, 2015 Law on Access to Information;

Pursuant to the November 19, 2015 Law on Cyberinformation Security;

Pursuant to the June 29, 2006 Law on Information Technology;

At the proposal of the Minister of Health;

The Government promulgates the Decree providing the management of health data.

Chapter I

GENRAL PROVISIONS

Article 1. Scope of regulation

1. This Decree provides digital health data, including the building, development, protection, administration, processing and use of digital health data; the National Database on Health; and the responsibilities of agencies, organizations and individuals involved in managing digital health data.

2. This Decree does not apply to health data involving state secrets.

Article 2. Subjects of application

1. Vietnamese agencies, organizations and individuals.

2. Foreign agencies, organizations and individuals in Vietnam.

3. Foreign agencies, organizations and individuals directly participating in or related to digital health data activities in Vietnam.

Article 3. Interpretation of terms

In this Decree, the terms below are construed as follows:

1. Digital health data means digital data reflecting medical fields (below referred to as health data).

2. Health database mean a collection of health data arranged, organized for access, exploitation, sharing, management and updating.

3. Electronic health book means an application or information technology software for updating, displaying, searching and storing brief information about the process of disease prevention, medical examination and treatment, and healthcare of individuals.

Article 4. General principles

1. Health data shall be used for protecting, caring and improving the people’s health, carrying out state management activities, simplifying administrative procedures, building electronic and digital government, and supporting socio-economic development.

2. The building, updating, maintenance, development, protection, administration, processing, and exploitation and use of health data and the National Health Database must comply with this Decree and the laws on data, information technology, e-transactions, cyberinformation security, cyber security, access to information, and protection of personal data; regulations on management, connection and sharing of digital data of state agencies; and regulations on building, updating, maintenance, exploitation and use of national databases.

Chapter II

BUILDING, DEVELOPMENT, PROTECTION, ADMINISTRATION, PROCESSING AND USE OF HEALTH DATA

Article 5. Scope of health data

Health data reflecting information on medical fields, including:

1. Information on preventive medicine.

2. Information on environmental protection in the medical field.

3. Information on medical examination and treatment, functional rehabilitation.

4. Information on medical, forensic, and forensic psychiatric assessments.

5. Information on traditional medicine and pharmacy.

6. Information on pharmacy.

7. Information on cosmetics.

8. Information on food safety under the management of the health sector.

9. Information on medical equipment.

10. Information on medical infrastructure.

11. Information on population.

12. Information on maternal and child health, reproductive health

13. Information on health insurance.

14. Information on health communication and education in the health sector

15. Information on science, technology in the health sector.

16. Information on international cooperation in health.

17. Information on application of information technology, and digital transformation in the the health sector.

18. Information on health finance.

19. Information on health inspection.

20. Information on health personnel.

21. Information on health personnel training.

22. Information on administrative procedures in the health sector.

23. Information on legal normative, management and administration documents in the health sector.

24. Information on health establishments

Article 6.  Personal health identification codes

The personal identification codes of Vietnamese citizens and foreigners who are granted the electronic personal identification accounts shall be used in accordance with the law on identification as personal health identification codes.

Article 7. Health databases

1. The National Health Database.

2. The specialized health databases, including:

a/ The health databases of the Ministry of Health, ministries, ministerial-level agencies, Government-attached agencies, political organizations, socio-political organizations, which contain information in one or many information groups defined in Article 5 of this Decree;

b/ The health databases of provincial-level People’s Committees containing information in one or many groups of information defined in Article 5 of this Decree.

3. The health databases of administrations of other levels and health establishments which contain health information and data under their respective management.

4. Shared-use health databases, including the national health database and specialized health databases.

Article 8. Building and development of health data

The Ministry of Health, ministries, ministerial-level agencies, Government-attached agencies, political organizations, socio-political organizations, People’s Committees at all levels and health establishments shall build and develop health data under the provisions of Article 11 and Article 12 of the Data Law and the provisions of this Decree.

Article 9. Processing of health data

1. The processing of health data must comply with Articles 22, 23, 24, 25 and 26 of the Data Law and the provisions of this Decree.

2. Conditional access to health information

a/ Information relating to business secrets in the groups of information defined in Clauses 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 15, 17, 18, 19 and 24 of Article 5 of this Decree may be accessed if so consented by the owners of such business secrets;

b/ Information relating to private life, personal secrets, health status, hereditary characteristics, physical traits, personal biological characteristics, sexual life, or sexual orientation in the information groups defined in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15, 19 and 20 of Article 5 of this Decree can be accessed if so consented by such individuals, ensuring compliance with legal provisions on protection of personal data;

c/ Information relating to family secrets in the information groups defined in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15 and 19 of Article 5 of this Decree can be accessed if so consented by family members;

d/ In the course of performing their functions, tasks and powers, heads of state agencies may decide the supply of information relating to business secrets, private life, personal secrets, family secrets in case of necessity for public interests or community health in accordance with provisions of law without the consent prescribed at Points a, b and c, Clause 2 of this Article.

Article 10. Use and exploitation of health data

1. The use of health data must comply with the provisions of Articles 16, 17, 21 of the Data Law and the provisions of this Decree.

2. Subjects entitled to exploit and use health data

a/ Agencies of the Party, the State, Vietnam Fatherland Front and political organizations, and socio-political organizations are entitled to exploit and use health data in conformity with their respective functions and tasks;

b/ Owners of data may exploit and use health data reflecting such owners;

c/ Organizations and individuals other than those specified at Point a and Point b of this Clause may exploit and use health data as follows: freely exploit and use open health data; exploit and use personal data when so consented by data management and maintenance units and individuals being owners of to be-exploited data; and exploit and use other data when so consented by data management and maintenance units.

3. Master data in the National Health Database are valid for official use equivalent to paper documents supplied by competent agencies.

4. Master data in the health databases of ministries, ministerial-level agencies or localities are valid for official use as paper documents supplied by these ministries, ministerial-level agencies or localities.

5. Using health data for deployment of the Electronic Health Book

a/ Health data on disease prevention, medical examination and treatment, healthcare and relevant information may be used for deployment of the Electronic Health Book;

b/ Health establishments operating lawfully in Vietnam shall link, share, and connect relevant health data with the Electronic Health Book integrated on the national identification application;

c/ Health establishments operating lawfully under provisions of law, Vietnamese citizens or foreigners who have been granted electronic identification accounts may use the Electronic Health Book integrated on the national identification application in replacement of relevant papers in the course of disease prevention, medical examination and treatment, and health care according to regulations.

Article 11.- Administration and protection of health data

The administration and protection of health data must comply with the provisions of Article 15 and Article 27 of the Data Law and the provisions of this Decree.

Chapter III

NATIONAL HEALTH DATABASE

Article 12.  National health database managing agency

The Ministry of Health is the agency managing the National Health Database.

Article 13. Objectives of building the National Health Database

1. To serve state management activities of the health sector, share data with relevant other ministries, ministerial-level agencies and localities for the purpose of formulating policies, master plans and strategies on socio-economic development; handling administrative procedures, implementing administrative reform, simplifying administrative procedures for people and businesses, meeting demands for data exploitation, use and application of organizations and individuals, and achieving socio-economic development targets.

2. To serve the work of protecting, caring and improving the people’s health, to assist people in managing their personal health.

Article 14. Scope of data of the National Health Database

1. Information on agencies and organizations operating lawfully in the fields of medical examinations and treatment; traditional medicine and pharmacy; functional rehabilitation, medical assessment, forensic assessment, and forensic psychiatric assessment; preventive medicine and biological safety in medical tests; population; maternal and child health; reproductive health; health insurance; medical equipment; drugs; drug materials; functional foods; micronutrient-fortified foods; environmental protection in health activities; science and technology in the health sector; education and training in health disciplines; pharmaceutical production and trading; cosmetics production and trading; medical equipment manufacture and trading; functional foods production and trading; production and trading of chemicals, insecticides, and bactericides for domestic and medical use, including:

a/ Electronic identification information of agencies and organizations;

b/ Organizational forms;

c/ Information on the scopes of operation, scope of service provision in the medical field.

2. Information on health personnel

a/ Basic information of individuals;

b/ Information on the training and retraining process;

c/ Information on practice certificates.

3. Basic information on pharmaceuticals and medical equipment

a/ Identification information;

b/ Information on circulation;

c/ Information on export permits;

d/ Information on import permits.

4. Information on personal health

a/ Health identification codes of individuals;

b/ Basic information of individuals;

c/ Information on birth certification and declaration;

d/ Information on health insurance;

dd/ Information on disease prevention, medical examination and treatment, and healthcare of individuals;

e/ Information on death notification and declaration.

Article 15. Information on archived and shared master data

1. Information on the scope of operation, scope of health service provision, defined at Point e, Clause 1, Article 14 of this Decree.

2. Information on practice certificates defined at Point c, Clause 2, Article 14 of this Decree.

3. Identification information and circulation information defined at Points a and b, Clause 3, Article 14 of this Decree.

4. Information on birth certification; information on disease prevention, medical examination and treatment, healthcare of individuals; information on death notification defined at Points c, dd and e of Clause 4, Article 14 of this Decree.

Article 16. Sources of information for building and updating the National Health Database

1. The National Health Database shall be built, collected, updated and synchronized from the following sources:

a/ Data from the Ministry of Health and agencies performing the state management of health;

b/ Data from health databases managed by the Ministry of Health;

c/ Data shared and synchronized from national databases, databases managed by ministries, ministerial-level agencies, provinces, centrally run cities, Vietnam Fatherland Front committees, political organizations, and socio-political organizations, which are related to the data scope defined in Article 14 of this Decree;

d/ Data from databases managed by health establishments;

dd/ Data collected from the process of carrying out administrative procedures and public services in the health sector.

e/ Data that are digitalized, provided and integrated by individuals and organizations.

2. Agencies managing the national databases and databases related to the scope of data in the National Health Database shall update and adjust information specified in Article 14 of this Decree, ensuring the completeness, accuracy, consistency and quality of the updated and shared data.

Article 17. Use and exploitation of the National Health Database

1. The exploitation and use of the National Health Database must comply with Article 10 of this Decree.

2. Methods of exploiting and using the National Health Database

a/ Connecting and sharing data between national databases, specialized databases, other databases, information systems, and the National Health Database;

b/ The National Data Portal, the National Public Service Portal, the Ministry of Health’s Portal, the Ministry of Health’s Information System for Settlement of Administrative Procedures;

c/ The Electronic Identification and Authentication Platform;

d/ The national identification application;

dd/ Equipment, facilities and software supplied by data-managing and -maintaining units;

e/ Other methods approved by the Ministry of Health.

Chapter IV

RESPONSIBILITIES OF AGENCIES, UNITS, ORGANIZATIONS AND INDIVIDUALS

Article 18. Responsibilities of the Ministry of Health

1. To assume the prime responsibility for, and coordinate with competent agencies in, including the National Health Database in the list of national databases according to regulations; to work out a roadmap for deploying the National Health Database according to regulations; to organize the building, management, administration and maintenance of the National Health Database.

2. To formulate and promulgate the national technical standards on the National Health Database, and the specialized health databases under its management.

3. To make and update the lists of health databases; to publicize the open health data under its management.

4. To formulate and implement schemes and solutions to ensure the quality of health data.

Article 19. Responsibilities of the Ministry of Public Security

1. To ensure infrastructure and information security for archiving the National Health Database on the infrastructure of the National Data Center.

2. To connect, share and synchronize electronic identification information of agencies and organizations and basic information of individuals from the national population database with the National Health Database.

3. To coordinate with the Ministry of Health and relevant agencies and units in using health data for the purpose of building and operating the system of electronic health books on the national identification application.

Article 20. Responsibilities of the Government Office

To connect, share and synchronize data between the National Public Service Portal, the national information and reporting system, and other systems of the Government Office with health databases according to regulations.

Article 21. Responsibilities of ministries, ministerial-level agencies, and Government-attached agencies

1. Agencies managing the national database on enterprise registration; the national database on cadres, civil servants and public employees in state agencies; the national database on insurance; databases containing information on export and import permits, pharmaceutical prices, and medical equipment shall connect, share and synchronize information with the National Health Database.

2. To build, update, connect, share, and synchronize relevant health data under their respective management with the National Health Database and specialized health databases according to regulations.

3. To ensure resources for collecting, updating, managing, exploiting and using health data under their respective management.

Article 22. Responsibilities of provincial-level People’s Committees

1. To build and collect health data for the establishment of health databases to serve data management and use in localities.

2. To make and update lists of health databases, open health data within the ambit of their management.

3. To connect, share and synchronize health-related data under local management with the National Health Database and specialized health databases according to regulations.

4. To build and deploy the Electronic Health Book for the protection, care and improvement of people’s health in their respective localities.

Article 23. Responsibilities of health establishments

1. To build, collect and standardize data and build their own databases.

2. To connect, share and synchronize their own data with the National Health Database, database of the Ministry of Health, local health databases and electronic health books integrated into the national identification application.

3. To ensure information security and cyber security for databases and the process of connecting, sharing and synchronizing data.

Article 24. Rights, responsibilities of agencies, units, organizations and individuals

1. Agencies, units, organizations and individuals shall promptly report to the agencies managing health databases on the changes, additions or errors in data relating to agencies, units, organizations and individuals.

2. To be entitled to exploit and use data from health databases according to regulations.

Chapter V

IMPLEMENTATION PROVISIONS

Article 25. Effect

This Decree takes effect on July 1, 2025.

Article 26. Implementation responsibility

1. The Minister of Health shall guide, examine and supervise the implementation of this Decree.

2. Ministers, heads of ministerial-level agencies, heads of Government-attached agencies, chairpersons of provincial-level People’s Committees, and related agencies, units, organizations and individuals shall implement this Decree.

On behalf of the Government
For the Prime Minister
Deputy Prime Minister
LE THANH LONG