Can electronic medical records be stored in cloud computing systems in Indonesia?

Yes. Ministry of Health Regulation Number 24 of 2022 on Medical Records (Permenkes 24/2022) recognizes cloud computing as an approved digital storage medium for electronic medical records (RME). Provided the cloud service is certified. This follows Laws and regulations (Article 20 paragraph (3)). Healthcare facilities must also guarantee data security and maintain periodic backups at a separate location (Article 20 paragraphs (2), (4), and (5)). Under Government Regulation Number 28 of 2024 (PP 28/2024) Article 966, the underlying data center must be located inside Indonesia.

Approved digital storage media and retention period

Article 20 paragraph (3) of Permenkes 24/2022 lists three digital storage media: servers, certified cloud computing systems, and other certified digital media. Regardless of medium, storage must guarantee the security, integrity, confidentiality, and availability of RME data (Article 20 paragraph (2)). Periodic backups must be stored at a location separate from the facility under a standard operating procedure (Article 20 paragraphs (4) and (5)). Electronic medical records must be retained for at least 25 years from the patient's last visit (Article 39 paragraph (1)).

Data centers must be located inside Indonesia

Law 17/2023 Article 345 paragraph (2)(c) designates healthcare facilities as Health Information System operators. With electronic medical records serving as a primary health data source (PP 28/2024 Article 958 paragraph (2)(a)). PP 28/2024 Article 966 paragraphs (2) and (3) require health data to be stored in data centers inside Indonesia, including when using cloud computing.

When engaging a third-party storage provider, PP 28/2024 Article 966 paragraph (5) requires four conditions:

1. storage is executed within the territory of Indonesia;
2. a cooperation agreement governs confidentiality, service levels (SLA), and service level targets;
3. the data remains fully owned and controlled by the healthcare facility. and
4. the provider fulfills all obligations of a personal data processor.

Cross-border transfers of health data are allowed only for specific, limited purposes with approval from the Minister of Health. Furthermore, Compliance with personal data transfer rules (Law 17/2023 Article 349 paragraph (7). PP 28/2024 Article 972 paragraphs (2) and (3)).

Additional requirements when partnering with a PSE (Permenkes 24/2022 Article 22)

For healthcare facilities with limited internal resources, Article 22 of Permenkes 24/2022 permits cloud storage cooperation with an Electronic System Operator (PSE) provided that:

• the PSE operates domestic data storage facilities and obtains a recommendation from the relevant Ministry of Health data unit (Article 22 paragraphs (1) and (2));
• the PSE is registered as a healthcare-sector PSE at Kominfo and the system is registered with the Ministry of Health (Article 9 paragraph (3). Article 12);
• the PSE is prohibited from opening, taking, manipulating, or exploiting the data under an integrity pact or NDA (Article 22 paragraphs (3) and (4)). and
• the healthcare facility retains unrestricted access to stored RME data and remains legally responsible for medical record integrity (Article 22 paragraph (5). Article 25 paragraph (2)).

Under Article 453 of Law 17/2023, Permenkes 24/2022 remains in force insofar as it does not conflict with Law 17/2023. Furthermore, Has not yet been replaced.

Legal basis

• Ministry of Health Regulation Number 24 of 2022 on Medical Records (Permenkes 24/2022). Article 9 paragraph (3), Article 12, Article 20, Article 22, Article 25 paragraph (2), and Article 39 paragraph (1).
• Government Regulation Number 28 of 2024 (PP 28/2024): Articles 778, 784, 958, 966, and 972.
• Law Number 17 of 2023 on Health: Articles 296–299, 345, 349, 453, and 454.