Medical data privacy in China: what the law says

What the law says

How China treats your health data.

The law: Personal Information Protection Law (PIPL), in force since November 2021[S94]
The regulator: Cyberspace Administration of China (CAC), alongside sector regulators[S94]
Health data: Medical health information is sensitive personal information under Article 28. Processing it needs your separate consent (Article 29), a specific purpose and strict protection.[S94]
Sending it abroad: Article 38 requires a CAC security assessment, a standard contract or a certification, and Article 39 your separate consent. Provisions issued in March 2024 exempt several everyday transfers from the assessment and the contract.[S94][S95]
Medical records: Rules on population health information issued in 2014 bar storing it on servers outside China.[S96]
EU adequacy: No. China is absent from the European Commission's adequacy list, so an EU organisation sending data there needs other safeguards.[S77]
If there is a breach: Immediately, to the authorities and to the people affected (Article 57).[S94]
Fines: For serious violations, up to RMB 50 million or 5% of the previous year's turnover (Article 66).[S94]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in China and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

China: common questions.

Is it safe to email medical records to a clinic in China?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in China, local law applies: medical health information is sensitive personal information under Article 28. Processing it needs your separate consent (Article 29), a specific purpose and strict protection. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does China protect health data?

Medical health information is sensitive personal information under Article 28. Processing it needs your separate consent (Article 29), a specific purpose and strict protection. Breaches must be reported immediately, to the authorities and to the people affected (Article 57). The regulator is the Cyberspace Administration of China (CAC), alongside sector regulators.

Can a clinic in China send my medical records abroad?

Article 38 requires a CAC security assessment, a standard contract or a certification, and Article 39 your separate consent. Provisions issued in March 2024 exempt several everyday transfers from the assessment and the contract. Rules on population health information issued in 2014 bar storing it on servers outside China.

Keep reading

More on China, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in China.