Decree 102/2025/ND-CP on health data management

DECREE

On health data management

Pursuant to the Law on Organization of the Government dated February 18, 2025;

Pursuant to the Law on Data dated November 30, 2024;

Pursuant to the Law on E-Transactions dated June 22, 2023;

Pursuant to the Law on Medical Examination and Treatment dated January 9, 2023;

Pursuant to the Law Amending and Supplementing a Number of Articles of the Law on Pharmacy dated November 21, 2024;

Pursuant to the Law on Cyber Security dated June 12, 2018;

Pursuant to the Law on Access to Information dated April 06, 2016;

Pursuant to the Law on Cyberinformation Security dated November 19, 2015;

Pursuant to the Law on Information Technology dated June 29, 2006;

At the proposal of the Minister of Health;

The Government hereby promulgates the Decree on health data management.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

1. This Decree provides for digital health data, including the building, development, protection, administration, processing, and use of digital health data; the national health database; and responsibilities of agencies, organizations, and individuals involved in the management of digital health data.

2. This Decree does not apply to health data related to state secrets.

Article 2. Subjects of application

1. Vietnamese agencies, organizations and individuals.

2. Foreign agencies, organizations, and individuals in Vietnam.

3. Foreign agencies, organizations, and individuals directly participating in or related to activities concerning digital health data in Vietnam.

Article 3. Interpretation of terms

For the purposes of this Decree, the terms below shall be construed as follows:

1. Digital health data means digital data reflecting aspects of the health sector (hereinafter referred to as health data).

2. Health database means a collection of health data that is arranged and organized for access, exploitation, sharing, management, and updating.

3. Electronic health record means an information technology application or software used to update, display, retrieve, and store summarized information on an individual's history of disease prevention, medical examination, treatment, and health care.

Article 4. General principles

1. Health data shall be used to serve the protection, care, and improvement of public health, state management, simplification of administrative procedures, development of the e-Government and digital Government, and socio-economic development.

2. The building, updating, maintenance, development, protection, administration, processing, exploitation, and use of health data and the national health database shall comply with the provisions of this Decree and the laws on data, information technology, e-transactions, cyberinformation security, cybersecurity, access to information, personal data protection; regulations on the management, connection, and sharing of digital data of state agencies; and provisions of law on the building, updating, maintenance, exploitation, and use of national databases.

Chapter II

BUILDING, DEVELOPMENT, PROTECTION, ADMINISTRATION, PROCESSING AND USE OF HEALTH DATA

Article 5. Scope of health data

Health data reflects information related to the health sector, including:

1. Information on preventive medicine.

2. Information on environmental protection in the health sector.

3. Information on medical examination, treatment and rehabilitation.

4. Information on medical assessment, forensic medicine, and forensic psychiatry.

5. Information on traditional medicine and pharmacy.

6. Information on pharmacy.

7. Information on cosmetics.

8. Information on food safety under the management of the health sector.

9. Information on medical equipment.

10. Information on health infrastructure.

11. Information on population.

12. Information on maternal and child health, and reproductive health.

13. Information on health insurance.

14. Information on health communication and education.

15. Information on science and technology in the health sector.

16. Information on international cooperation in the health sector.

17. Information on application of information technology and digital transformation in the health sector.

18. Information on health finance.

19. Information on health inspection.

20. Information on health workforce.

21. Information on training of health workforce.

22. Information on administrative procedures in the health sector.

23. Information on regulatory documents, management and executive documents in the health sector.

24. Information on health facilities.

Article 6. Personal health identification codes

The use of personal identification numbers of Vietnamese citizens and foreigners who have been issued an electronic identification account shall comply with the law on identity used as the personal health identification codes.

Article 7. Health databases

1. The national health database.

2. Specialized health databases include:

a) The health databases of the Ministry of Health, ministries, ministerial-level agencies, government-attached agencies, political organizations, and socio-political organizations containing information pertaining to one or more groups of information specified in Article 5 of this Decree;

b) The health databases of provincial-level People’s Committees containing information pertaining to one or more groups of information specified in Article 5 of this Decree.

3. Health databases of other levels of government and health facilities containing information and health data under their management.

4. Shared health databases include the national health database and specialized health databases.

Article 8. Building and development of health data

The Ministry of Health, ministries, ministerial-level agencies, government-attached agencies, political organizations, socio-political organizations, People’s Committees at all levels, and health facilities shall build and develop health data in accordance with Articles 11 and 12 of the Law on Data and this Decree.

Article 9. Processing of health data

1. The processing of health data shall comply with Articles 22, 23, 24, 25, and 26 of the Law on Data and this Decree.

2. Conditional access to health information:

a) Information related to trade secrets within the groups of information specified in Clauses 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 15, 17, 18, 19, and 24 Article 5 of this Decree may be accessed with the consent of the owner of such trade secrets;

b) Information related to privacy, personal secrets, health status, genetic characteristics, physical attributes, unique biological features, sexual life, and sexual orientation of individuals within the groups of information specified in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15, 19, and 20 Article 5 of this Decree may be accessed with the individual’s consent, ensuring compliance with the law on personal data protection;

c) Information related to family secrets within the groups of information specified in Clauses 1, 3, 4, 5, 6, 11, 12, 13, 15, and 19 Article 5 of this Decree may be accessed with the consent of family members;

d) In the course of performing their functions, tasks, and powers, the heads of state agencies shall decide on the provision of information related to trade secrets, privacy, personal secrets, and family secrets in necessary cases for the sake of public interest or community health in accordance with relevant laws, without requiring the consent prescribed at Points a, b, and c, Clause 2 of this Article.

Article 10. Use and exploitation of health data

1. The use of health data shall comply with Articles 16, 17, and 21 of the Law on Data and this Decree.

2. Subjects entitled to exploit and use health data

a) Party agencies, state agencies, the Vietnam Fatherland Front, and political organizations and socio-political organizations may exploit and use health data in conformity with their respective functions and tasks;

b) Data subjects may exploit and use health data reflecting themselves;

c) Organizations and individuals not specified at Points a and b of this Clause may exploit and use health data as follows: freely exploit and use open health data; exploit and use personal data upon obtaining the consent of the entity managing and maintaining data and the individual who is the subject of the data to be exploited; exploit and use other data upon obtaining the consent of the entity managing and maintaining data.

3. Master data in the national health database shall be officially valid and equivalent to paper documents issued by competent agencies.

4. Master data in the health databases of ministries, sectors and localities shall be officially valid and equivalent to paper documents provided by ministries, sectors or localities.

5. Use of health data for implementation of electronic health records

a) Health data on disease prevention, medical examination and treatment, health care, and related information shall be used to implement electronic health records;

b) Health facilities lawfully operating in Vietnam shall be responsible for connecting, sharing, and interoperating relevant health data with electronic health records integrated into the national identification application;

c) Health facilities lawfully operating under legal regulations, Vietnamese citizens, or foreigners who have been issued electronic identification accounts may use electronic health records integrated into the national identification application in lieu of related paper documents during the process of disease prevention, medical examination and treatment, and health care in accordance with regulations.

Article 11. Administration and protection of health data

The administration and protection of health data shall comply with Articles 15 and 27 of the Law on Data and this Decree.

Chapter III

NATIONAL HEALTH DATABASE

Article 12. Agency administering the national health database

The Ministry of Health shall be the agency administering the national health database.

Article 13. Objectives of building the national health database

1. To serve state management in the health sector, and to share data with other ministries, sectors, and localities for the purposes of policy formulation, planning, and socio-economic development strategy building; to support the settlement of administrative procedures, administrative reform, and simplification of administrative procedures for the people and enterprises; to meet the needs for data exploitation, use, and application by organizations and individuals, and to serve socio-economic development goals.

2. To serve the protection, care, and improvement of public health; and to assist individuals in managing their own health.

Article 14. Scope of the national health database

1. Information on agencies and organizations operating in accordance with law in the fields of medical examination and treatment; traditional medicine and pharmacy; rehabilitation; medical assessment; forensic medicine; forensic psychiatry; preventive medicine and biosafety in medical testing; population; maternal and child health, reproductive health; health insurance; medical equipment; drugs; drug materials; functional foods; micronutrient-fortified foods; environmental protection in health-related activities; science and technology in the health sector; education and training in health-related disciplines; pharmaceutical production and trading; cosmetic production and trading; medical equipment production and trading; functional food production and trading; production and trading of chemicals and preparations for insecticide and disinfection use in domestic and healthcare sectors, including:

a) Electronic identification information of agencies and organizations;

b) Organizational form;

c) Information on scope of operation and service provision in the health sector.

2. Information on health workforce

a) Basic personal information;

b) Information on training and further training;

c) Information on practice certificates.

3. Basic information on pharmacy and medical equipment

a) Identification information;

b) Circulation information;

c) Information on export licenses;

d) Information on import licenses.

4. Individual health information:

a) Personal health identification codes;

b) Basic personal information;

c) Information on birth certificate and birth registration;

d) Information on health insurance;

dd) Information on disease prevention, medical examination and treatment, and personal healthcare;

e) Information on death notice and death registration.

Article 15. Information on master data for storage and sharing

1. Information on the scope of operation and scope of service provision in the health sector as specified at Point c Clause 1 Article 14 of this Decree.

2. Information on practice certificates as specified at Point c Clause 2 Article 14 of this Decree.

3. Identification information and circulation information as specified at Points a and b Clause 3 Article 14 of this Decree.

4. Information on birth certificate; information on disease prevention, medical examination and treatment, and personal healthcare; and information on death notice as specified at Points c, dd, and e Clause 4 Article 14 of this Decree.

Article 16. Sources of information for building and updating the national health database

1. The national health database shall be established, collected, updated, and synchronized from the following sources:

a) Data from the Ministry of Health and state management agencies in charge of health;

b) Data from health databases managed by the Ministry of Health;

c) Data shared and synchronized from national databases and databases managed by ministries, sectors, provinces, centrally run cities, the Vietnam Fatherland Front, and political organizations and socio-political organizations, which are related to the scope of data specified in Article 14 of this Decree;

d) Data from databases managed by health facilities;

dd) Data resulting from the implementation of administrative procedures and public services in the health sector;

e) Data digitized, provided, and integrated by individuals and organizations.

2. Administering agencies and managing agencies of the national database and databases related to the scope of data in the national health database shall be responsible for updating and adjusting the information specified in Article 14 of this Decree, ensuring the completeness, accuracy, consistency, and quality of the updated and shared data.

Article 17. Use and exploitation of the national health database

1. The use and exploitation of the national health database shall comply with Article 10 of this Decree.

2. Methods of exploitation and use of the national health database

a) Connection and data sharing between the national database, specialized databases, other databases and information systems, and the national health database;

b) The national data portal, the national public service portal, the Ministry of Health’s portal, and the administrative procedure settlement information system of the Ministry of Health;

c) The electronic identification and authentication platform;

d) The national identification application;

dd) Equipment, devices, and software provided by the entity managing and maintaining the data;

e) Other methods as approved by the Ministry of Health.

Chapter IV

RESPONSIBILITIES OF AGENCIES, ENTITIES, ORGANIZATIONS AND INDIVIDUALS

Article 18. Responsibility of the Ministry of Health

1. To assume the prime responsibility for, and coordinate with competent agencies in, including the national health database in the list of national databases as prescribed; to formulate a roadmap for implementation of the national health database; to organize the building, management, administration and maintenance of the national health database.

2. To formulate and promulgate national technical regulation on the national health database, specialized health databases under the management.

3. To build and update the lists of health databases; to publicize the open health data under the management.

4. To formulate and implement the plans and solutions for assurance of health data quality.

Article 19. Responsibilities of the Ministry of Public Security

1. To ensure infrastructure and information security for storing the national database on health on the infrastructure of the National Data Center.

2. To connect, share, and synchronize electronic identification information of agencies and organizations and basic personal information from the national population database with the national health database.

3. To coordinate with the Ministry of Health and relevant agencies and entities in using health data to serve the development and operation of the electronic health record system integrated into the national identification application.

Article 20. Responsibility of the Government Office

To connect, share and synchronize data between the national public service portal, the national reporting information system, and other systems of the Government Office with health databases in accordance with regulations.

Article 21. Responsibilities of ministries, ministerial-level agencies, and government-attached agencies

1. Agencies administering the national database on enterprise registration; the national database on cadres, civil servants, and public employees in state agencies; the national database on insurance; and databases containing information on export licenses, import licenses, pharmaceutical prices, and medical equipment shall be responsible for connecting, sharing, and synchronizing information with the national health database.

2. To build, update, connect, share, and synchronize health-related data under their management with the national health database and specialized health databases in accordance with regulations.

3. To ensure resources for the collection, updating, management, exploitation, and use of health data under their management.

Article 22. Responsibilities of People’s Committees of provinces and centrally run cities

1. To establish and collect health data for the formation of health databases serving the management and use of data in their respective localities.

2. To formulate and update the lists of health databases; open health data under the management.

3. To connect, share, and synchronize health-related data under their management with the national health database and specialized health databases in accordance with regulations.

4. To develop and implement electronic health records for protection, care and improvement of people's health in localities.

Article 23. Responsibility of health facilities

1. To establish, collect, standardize data, and develop the facility’s databases.

2. To connect, share, and synchronize the facility’s data with the national health database, the Ministry of Health’s databases, local health databases, and the electronic health record integrated into the national identification application.

3. To ensure information security and cybersecurity for databases and during the process of data connection, sharing, and synchronization.

Article 24. Rights and responsibilities of agencies, entities, organizations and individuals

1. Agencies, entities, organizations and individuals shall promptly notify the agency administering the health database upon any changes, additions, or errors in data reflecting such agencies, entities, organizations, or individuals.

2. They shall have the right to exploit and use data from health databases in accordance with regulations.

Chapter V

IMPLEMENTATION PROVISIONS

Article 25. Effect

This Decree takes effect from July 1, 2025.

Article 26. Implementation responsibility

1. The Minister of Health shall guide, inspect and urge the implementation of this Decree.

2. Ministers, Heads of ministerial-level agencies, Heads of Government-attached agencies, chairpersons of People’s Committees of provinces and centrally run cities, and related agencies, entities, organizations and individuals shall implement this Decree.