October 2025
The NHIA Issued the “Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data”(Taiwan)
In order to regulate the application, review, and use procedures by the National Health Insurance Administration of the Ministry of Health and Welfare (hereinafter “NHIA”) for the use of National Health Insurance data (hereinafter “NHI Data”) beyond specific purposes, and to implement the protection of data owners’ right to discontinue use under Article 22 of the Constitution as articulated in Judgment 113-Hsien-Pan-13 of the Constitutional Court (hereinafter the “Judgment”), the NHIA issued the “Directions for the Application and Management of Research Use and Cessation of Use of National Health Insurance Data” (hereinafter the “Directions”) on August 11, 2025, which became effective on August 12, 2025.
The Judgment held that when the NHIA provides NHI Data to other government agencies or academic research institutions for purposes beyond those originally specified, the existing system lacks procedures through which data subjects may request the opt-out mechanism for data use. It further required that relevant laws be enacted or amended within three years from the date of the Judgment’s pronouncement (i.e., August 12, 2022) to safeguard the ex post control rights of personal data subjects. In light of the expiration of the legislative deadline set by the Judgment, the NHIA issued the Directions as a transitional basis for the public to exercise the right to opt-out with respect to their NHI Data.
With respect to the ex ante control over NHI Data, pursuant to Articles 79 and 80 of the National Health Insurance Act, in conjunction with Article 6, Paragraph 1 (Proviso), Subparagraph 4 of the Personal Data Protection Act (hereinafter the “PDPA”), the NHIA may provide NHI Data lawfully collected in the course of administering National Health Insurance to government agencies or academic research institutions for use beyond the original purpose of collection, provided that certain conditions are satisfied. As for ex post control over personal data, under Article 11 of the PDPA, a data subject may request the relevant authority to cease processing or using such personal data only where there is a dispute regarding the accuracy of the personal data, where the specific purpose for which it was collected no longer exists, or where such data is collected, processed, or used in violation of the law. The Judgment found that while the aforementioned restrictions on ex ante control under the PDPA with respect to NHI are constitutional, the exercise of ex post control by data subjects over their NHI Data must nonetheless be protected. As Article 11 of the PDPA does not encompass situations involving the lawful collection, processing, and use of accurate NHI Data pursuant to Article 6, Paragraph 1 (Proviso), Subparagraph 4 of the same Act, the provision of such NHI Data by the NHIA to government agencies or academic research institutions for use beyond the specified purpose, under the current legal framework, evidently lacks protections concerning the right to opt-out.
To ensure that data subjects have the right to opt-out their NHI Data, the Directions set forth the key procedural requirements as follows:
I. The data subject shall complete the “Application Form for Cessation of Use of National Health Insurance Data Beyond the Original Purpose” (Annex 5 of the Directions) and submit it to the NHIA. Upon receiving complete application materials, the NHIA shall complete the approval and notation procedures within thirty days from the following day and notify the data subject of the result (Article 17 of the Directions).
II. The NHI Data for which a data subject may request cessation of use is categorized into insurance coverage data and medical services data. The former includes the insured status and salary range of the data subject; the latter includes records of medical visits and prescriptions, medical imaging, pathology reports, examination and test results, and major illness or injury status (Article 2 of the Directions).
III. The institutions for which a data subject may request cessation of use include government agencies, medical institutions, academic research institutions, universities, or universities, legal persons, or institutions commissioned by government agencies that have applied to use NHI Data for academic research or public interest purposes (Article 3 of the Directions).
In summary, following the implementation of the Directions, data subjects may autonomously decide whether to cease the provision of their NHI Data—such as salary range under insurance coverage, major illness or injury status, pathology reports, and biochemical examination data—to relevant institutions. This mechanism serves to fulfill the intent of the Judgment in safeguarding ex post control over NHI Data and the informational privacy rights of individuals.
The Judgment held that when the NHIA provides NHI Data to other government agencies or academic research institutions for purposes beyond those originally specified, the existing system lacks procedures through which data subjects may request the opt-out mechanism for data use. It further required that relevant laws be enacted or amended within three years from the date of the Judgment’s pronouncement (i.e., August 12, 2022) to safeguard the ex post control rights of personal data subjects. In light of the expiration of the legislative deadline set by the Judgment, the NHIA issued the Directions as a transitional basis for the public to exercise the right to opt-out with respect to their NHI Data.
With respect to the ex ante control over NHI Data, pursuant to Articles 79 and 80 of the National Health Insurance Act, in conjunction with Article 6, Paragraph 1 (Proviso), Subparagraph 4 of the Personal Data Protection Act (hereinafter the “PDPA”), the NHIA may provide NHI Data lawfully collected in the course of administering National Health Insurance to government agencies or academic research institutions for use beyond the original purpose of collection, provided that certain conditions are satisfied. As for ex post control over personal data, under Article 11 of the PDPA, a data subject may request the relevant authority to cease processing or using such personal data only where there is a dispute regarding the accuracy of the personal data, where the specific purpose for which it was collected no longer exists, or where such data is collected, processed, or used in violation of the law. The Judgment found that while the aforementioned restrictions on ex ante control under the PDPA with respect to NHI are constitutional, the exercise of ex post control by data subjects over their NHI Data must nonetheless be protected. As Article 11 of the PDPA does not encompass situations involving the lawful collection, processing, and use of accurate NHI Data pursuant to Article 6, Paragraph 1 (Proviso), Subparagraph 4 of the same Act, the provision of such NHI Data by the NHIA to government agencies or academic research institutions for use beyond the specified purpose, under the current legal framework, evidently lacks protections concerning the right to opt-out.
To ensure that data subjects have the right to opt-out their NHI Data, the Directions set forth the key procedural requirements as follows:
I. The data subject shall complete the “Application Form for Cessation of Use of National Health Insurance Data Beyond the Original Purpose” (Annex 5 of the Directions) and submit it to the NHIA. Upon receiving complete application materials, the NHIA shall complete the approval and notation procedures within thirty days from the following day and notify the data subject of the result (Article 17 of the Directions).
II. The NHI Data for which a data subject may request cessation of use is categorized into insurance coverage data and medical services data. The former includes the insured status and salary range of the data subject; the latter includes records of medical visits and prescriptions, medical imaging, pathology reports, examination and test results, and major illness or injury status (Article 2 of the Directions).
III. The institutions for which a data subject may request cessation of use include government agencies, medical institutions, academic research institutions, universities, or universities, legal persons, or institutions commissioned by government agencies that have applied to use NHI Data for academic research or public interest purposes (Article 3 of the Directions).
In summary, following the implementation of the Directions, data subjects may autonomously decide whether to cease the provision of their NHI Data—such as salary range under insurance coverage, major illness or injury status, pathology reports, and biochemical examination data—to relevant institutions. This mechanism serves to fulfill the intent of the Judgment in safeguarding ex post control over NHI Data and the informational privacy rights of individuals.
