What are a patient's rights to health data confidentiality under Indonesian law?

Every person has the right to the confidentiality of their personal health data. Furthermore, Information under Health Law Number 17 of 2023 (UU 17/2023 Article 4(1)(i)). This right is paired with a strict statutory duty: healthcare facilities (Article 177(1)) as well as medical. Furthermore, Health personnel (Article 301(1)) must maintain patient health confidentiality. PP 28/2024 Article 789 extends this obligation to facility management, billing personnel, any staff holding patient data, and third parties involved in service delivery.

Scope of protected data and post-mortem protection

Under PP 28/2024 Article 788(3) and its Elucidation, protected confidentiality covers patient identity, anamnesis, physical. Furthermore, Supporting examinations, diagnoses, treatments, procedures, payment data, and social data. Medical record confidentiality continues to apply even after the patient has passed away (Article 785). Facilities must also operate an information security management system (Article 791(1)) and handle cyber incidents (Article 792(1)).

When patient health confidentiality may be disclosed

Article 4(4) of UU 17/2023 lists eight narrow exceptions where confidentiality does not apply: law enforcement requests, outbreak or disaster response, de-identified education. Furthermore, Research, protecting others from safety threats, patient care and treatment, the patient's own request, administrative/insurance payment needs, and other statutory mandates. Under PP 28/2024 Article 783, any medical record disclosure requires a written request and is strictly limited to what is necessary.

Employers are not named in the Article 4(4) exception list. Therefore, an employer or HR department is not automatically entitled to a worker's full medical record or diagnosis. clinics must verify a valid basis (such as explicit patient consent) and limit employer reporting to fitness-for-work conclusions.