Taipei: Taiwan’s Legislative Yuan has enacted a new law regulating the use of National Health Insurance (NHI) data, granting individuals the right to opt out of having their records utilized for nonmedical purposes and imposing substantial fines for unauthorized access.

According to Focus Taiwan, the law establishes a framework for managing NHI data, aiming to enhance privacy protections while allowing for the continued use of the data in supporting healthcare quality, public health, social welfare, academic research, and government operations. Currently, the NHI database, which includes insurance and medical records of nearly all insured individuals, can be accessed by government agencies or research institutions, provided the data is anonymized.

Under the new legislation, individuals can request the Ministry of Health and Welfare or the National Health Insurance Administration to cease the use of all or part of their NHI records for nonmedical purposes. However, exceptions exist when authorities have a legal obligation to use the data or when necessary to prevent imminent danger to life, health, or property. Such usage is restricted to government agencies, which must specify the purpose, necessity, duration, and method of data use.

Individuals will have 30 days from the law’s implementation to submit an initial opt-out request. Those who do not opt out will be deemed to have consented to the nonmedical use of their data, though they can withdraw their consent later. The law also delineates who may apply to use NHI data, the permissible purposes, and the procedures for reviewing applications.

Unauthorized use of NHI data for nonmedical purposes will result in fines ranging from NT$2 million to NT$10 million, and violators will be prohibited from submitting new applications for one year. Moreover, anyone found guilty of stealing, altering, or unlawfully tampering with the NHI system or insured individuals’ data will face prison terms of one to seven years and fines of up to NT$10 million.

Crimes committed with the intent to threaten national security or disrupt social stability may lead to up to 10 years in prison and an additional fine of NT$50 million. This legislation was drafted following an August 2022 Constitutional Court ruling that mandated the government to create a mechanism within three years, granting NHI beneficiaries greater control over the use of their personal data.