论《个人信息保护法》视角下医疗卫生机构的数据合规义务

On the Data Compliance Obligations of Medical and Health Institutions from the Perspective of Personal Information Protection Law

医疗卫生机构作为医疗健康信息的处理主体,对患者个人信息保护负有不可推卸的义务。2021年《个人信息保护法》的施行,医疗卫生机构数据合规义务面临新的法律环境。此类机构处理的信息敏感、处理场景和关涉主体多元,面临的数据合规场景格外复杂,如果未尽到数据合规义务,将严重影响患者安全,破坏医患信任。针对上述问题,自律和监管是履行数据合规义务的必由之路。考虑到合规管理发展的大背景,卫生行政机关应当将数据合规的行政指导做到行政处罚之前,强调处罚与激励并行的机制,适时引入具有技术实力的中介组织对数据合规进行补充监督,以帮助医疗卫生机构提高数据合规管理水平,保护患者数据安全。

As the main body of medical and health information processing,medical and health institutions have an unshirkable obligation to protect patients'personal information.With the implementation of the Personal Informa⁃tion Protection Law in 2021,healthcare institutions'data compliance obligations face a new legal environment.Such institutions deal with sensitive information,multiple processing scenarios and related subjects,and face extremely complex data compliance scenarios.Failure to fulfill data compliance obligations will seriously affect patients'safety and undermine doctor-patient trust.In view of the above problems,self-discipline and supervision are the only way to fulfill data compliance obligations.Considering the big background of the development of compliance manage⁃ment,health administration authority shall transfer administrative guidance of data compliance before administrative punishment,put emphasis on parallel mechanism of punishment and incentive,and timely introduce intermediary or⁃ganizations with technical strength into data compliance for supplementary supervision so as to help medical institu⁃tions to raise the level of data compliance management and protect patient's data security.