Newsletter
Promulgation of the National Health Insurance Data Management Act
Promulgation of the National Health Insurance Data Management Act
Ken-Ying Tseng/Katherine Juang/Yi-Mei Pan
The Ministry of Health and Welfare (“MOHW”) and the National Health Insurance Administration, pursuant to the National Health Insurance Act, collect personal national health insurance data and, under specific conditions, may provide such data externally for purposes such as statistical analysis or academic research. On August 12, 2022, the Constitutional Court rendered Constitutional Judgment No. 13, holding that the existing legal framework lacks explicit and specific regulations governing the storage, processing, external transmission, and use of national health insurance data, thereby violating the principle of legal reservation under Article 23 of the Constitution and the protection of information privacy rights under Article 22 of the same.
The judgment required that, within three years, the relevant laws be amended or a special law be enacted to clearly regulate the use of such data, establish supervisory and protective mechanisms, and grant data subjects the right to request cessation of data use. In response, the MOHW initiated the drafting of a special law. The draft National Health Insurance Data Management Act was approved by the Executive Yuan on May 15, 2025, passed by the Legislative Yuan on December 2, 2025, and promulgated by the President on December 19, 2025. The effective date of the Act is to be determined by the Executive Yuan.
The National Health Insurance Data Management Act (the “Act”) comprises a total of 27 articles, with the following key points:
1. Composition of the National Health Insurance Data Advisory Council
This Act requires the competent authority (MOHW) to establish a National Health Insurance Data Advisory Council and stipulates its duties and composition.
2. Establishment and Management of the National Health Insurance Database and Data Transmission
The competent authority and the insurer are responsible for the establishment, management, and assessment of the information and communication system of the national health insurance database. This Act expressly provides that data transmission must be conducted in a pseudonymized manner.
3. Application Mechanism for Use of National Health Insurance Data for Purposes Other Than Specific Purposes
Except for applications submitted by government agencies (institutions) or administrative legal persons as required for the performance of their statutory duties, as well as retrievals by judicial authorities pursuant to procedural laws or by supervisory authorities pursuant to the Control Act, other applicants must submit an application and a utilization plan, which are subject to review and approval by the competent authority or the insurer. The results of such utilization must not contain personally identifiable information.
4. Opt-Out Mechanism for Data Subjects
This Act sets forth the procedures and effects for data subjects to request cessation of the use of their personal national health insurance data, as well as the relevant exceptions. Within 30 days of the implementation of this Act, applications for use of data for purposes other than specific purposes will be temporarily suspended to ensure that data subjects are fully informed and have the right to consent. During this period, data subjects may choose whether their national health insurance data may be used for purposes other than specific purposes.
5. Stipulation of Penalties
This Act stipulates the criminal liability and administrative penalties for applicants and data users who violate the provisions of this Act.
Pursuant to this Act, the competent authority is required to formulate relevant sub-laws regarding application review and relief procedures, information security maintenance measures, security operation environment standards, and procedures for data subjects to request cessation of data use. Our firm’s “Life Sciences & Healthcare Practice Group” and “Digital, TMT, and Data Privacy Practice Group” have long assisted enterprises and institutions in handling pharmaceutical, biotechnology, and personal data protection matters. Should you require any assistance, please do not hesitate to contact our team of experts.