February 2026
Enactment of the National Health Insurance Data Management Act (Taiwan)
In Judgment 111-Hsien-Pan-13 (the “Judgment”), the Constitutional Court (the “Court”) held that the existing legal framework lacks clear statutory safeguards governing the supervision and management mechanisms for the storage, processing, external transmission, and provision for use of National Health Insurance data (“NHI Data”) maintained in the National Health Insurance database (“NHI Database”) by the competent authority. Such regulatory deficiencies were found to fall short of the principle of legal reservation required under the Constitution. The Court further noted that, with respect to the use of NHI Data beyond specific purposes, the prevailing legal regime failed to clearly provide data subjects with the right and procedures to request cessation of use or to opt-out. Accordingly, the Court ordered the competent authority to amend the relevant laws or enact a special statute within three years from the date of the Judgment’s pronouncement (August 12, 2022), in order to strengthen the protection and management of NHI Data
[1]
.
To bridge the gap prior to the completion and implementation of formal legislation, the National Health Insurance Administration of the Ministry of Health and Welfare (“NHIA”) promulgated the Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data on August 12, 2025, establishing preliminary rules governing the application, review, and use of NHI Data for purposes beyond specific purposes [2] .
Subsequently, the Legislative Yuan passed the National Health Insurance Data Management Act (the “Act”) on December 2, 2025, which was promulgated by the President on December 19, 2025. The Act was enacted to implement the legislative revisions required by the Judgment. The effective date of the Act remains subject to further announcement by the Executive Yuan.
Key Points of the Act:
1. Establishment of the NHI Data Advisory Committee (Article 4)
The Act requires the competent authority, namely the Ministry of Health and Welfare, to establish an NHI Data Advisory Committee tasked with matters relating to the management, supervision, and dispute resolution concerning the use of NHI Data beyond specific purposes.
2. Establishment and Management of the NHI Database (Article 6)
The competent authority and the National Health Insurance Insurer (“Insurer”) are responsible for the establishment of the NHI Database and must designate dedicated units or dedicated personnel for its management. Any NHI Data transmitted for the purpose of NHI Database establishment must first be pseudonymized by the Insurer prior to transmission to the competent authority.
3. Application for and Results of the Use of NHI Data Beyond Specific Purposes (Articles 8 to 14)
Except where government agencies or administrative legal persons apply for use in the course of performing statutory duties in accordance with applicable laws, or where judicial or control authorities obtain data pursuant to law, any applicant seeking to use NHI Data beyond specific purposes for public interest purposes must submit an application together with a use plan beyond those specific purposes. Such applications are subject to review and approval by the competent authority or the Insurer.
The results derived from the approved use of NHI Data must not contain information that can identify specific individuals, nor may such results be used for purposes beyond the scope of the approved plan.
4. Right of Data Subjects to Request Cessation of Use (Articles 16 to 19)
Data subjects are entitled to request the cessation of all or part of their personal NHI Data used beyond specific purposes. In principle, such requests must be granted unless the use is required for the performance of statutory duties or involves specific urgent dangers.
5. Penalties (Articles 20 to 24)
Any person who undermines the functioning of the NHI Database or engages in the use of NHI Data beyond specific purposes, in violation of the Act, may be subject to criminal liability or administrative penalties, depending on the severity of the violation.
In sum, following the Judgment, the Act represents the first special statute comprehensively regulating the management and use of NHI Data beyond specific purposes, while expressly incorporating data subjects’ right to request cessation of use. As the regulatory regime continues to take shape, institutions involved in the collection, research, or use of NHI Data should closely monitor evolving application procedures and compliance requirements.
[1] For the key holdings of Judgment 111-Hsien-Pan-13, please refer to “ The Secondary Use of the National Health Insurance Database Found Partially Unconstitutional in Taiwan Constitutional Court Decision ”
[2] For the key points of the Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data, please refer to “ The NHIA Issued the “Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data”(Taiwan) ”
To bridge the gap prior to the completion and implementation of formal legislation, the National Health Insurance Administration of the Ministry of Health and Welfare (“NHIA”) promulgated the Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data on August 12, 2025, establishing preliminary rules governing the application, review, and use of NHI Data for purposes beyond specific purposes [2] .
Subsequently, the Legislative Yuan passed the National Health Insurance Data Management Act (the “Act”) on December 2, 2025, which was promulgated by the President on December 19, 2025. The Act was enacted to implement the legislative revisions required by the Judgment. The effective date of the Act remains subject to further announcement by the Executive Yuan.
Key Points of the Act:
1. Establishment of the NHI Data Advisory Committee (Article 4)
The Act requires the competent authority, namely the Ministry of Health and Welfare, to establish an NHI Data Advisory Committee tasked with matters relating to the management, supervision, and dispute resolution concerning the use of NHI Data beyond specific purposes.
2. Establishment and Management of the NHI Database (Article 6)
The competent authority and the National Health Insurance Insurer (“Insurer”) are responsible for the establishment of the NHI Database and must designate dedicated units or dedicated personnel for its management. Any NHI Data transmitted for the purpose of NHI Database establishment must first be pseudonymized by the Insurer prior to transmission to the competent authority.
3. Application for and Results of the Use of NHI Data Beyond Specific Purposes (Articles 8 to 14)
Except where government agencies or administrative legal persons apply for use in the course of performing statutory duties in accordance with applicable laws, or where judicial or control authorities obtain data pursuant to law, any applicant seeking to use NHI Data beyond specific purposes for public interest purposes must submit an application together with a use plan beyond those specific purposes. Such applications are subject to review and approval by the competent authority or the Insurer.
The results derived from the approved use of NHI Data must not contain information that can identify specific individuals, nor may such results be used for purposes beyond the scope of the approved plan.
4. Right of Data Subjects to Request Cessation of Use (Articles 16 to 19)
Data subjects are entitled to request the cessation of all or part of their personal NHI Data used beyond specific purposes. In principle, such requests must be granted unless the use is required for the performance of statutory duties or involves specific urgent dangers.
5. Penalties (Articles 20 to 24)
Any person who undermines the functioning of the NHI Database or engages in the use of NHI Data beyond specific purposes, in violation of the Act, may be subject to criminal liability or administrative penalties, depending on the severity of the violation.
In sum, following the Judgment, the Act represents the first special statute comprehensively regulating the management and use of NHI Data beyond specific purposes, while expressly incorporating data subjects’ right to request cessation of use. As the regulatory regime continues to take shape, institutions involved in the collection, research, or use of NHI Data should closely monitor evolving application procedures and compliance requirements.
[1] For the key holdings of Judgment 111-Hsien-Pan-13, please refer to “ The Secondary Use of the National Health Insurance Database Found Partially Unconstitutional in Taiwan Constitutional Court Decision ”
[2] For the key points of the Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data, please refer to “ The NHIA Issued the “Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data”(Taiwan) ”
