What two registrations are mandatory for an electronic medical record software vendor under Permenkes 24/2022?

1. Healthcare-sector PSE registration with Kominfo under Article 9(3); and 2. System registration with the Ministry of Health under Article 12(1).

Can a clinic outsource electronic medical record storage to a foreign cloud provider?

No. Article 22 paragraph (1) of Permenkes 24/2022 explicitly requires partner PSEs to have domestic data storage facilities inside Indonesia.

Who owns electronic medical records when a clinic uses third-party vendor software?

Under Article 25 of Permenkes 24/2022, medical records remain the legal property of the healthcare facility, which retains legal responsibility.

What does Permenkes 24/2022 regulate regarding electronic medical records for electronic system operators?

Permenkes 24/2022 permits clinics to use third-party PSE electronic medical record systems, requiring Kominfo and Kemenkes registration, SATUSEHAT interoperability, domestic storage, and non-disclosure pacts.

Ministry of Health Regulation Number 24 of 2022 on Medical Records (Permenkes 24/2022) authorizes healthcare facilities to implement electronic medical records (RME) in partnership with third-party Electronic System Operators (PSE). Partner PSEs must be registered as healthcare-sector PSEs at Kominfo, and their electronic systems must be registered with the Ministry of Health. Where cloud data storage is entrusted to a PSE, Article 22 mandates domestic storage infrastructure, a formal Ministry of Health recommendation. In addition, An absolute prohibition against unauthorized data access or commercial exploitation.

Who qualifies as a PSE under Permenkes 24/2022

Article 1 point 8 defines a PSE as any individual, business entity, community group. Alternatively, State institution other than the Ministry of Health that provides, manages, or operates an electronic system. Third-party electronic medical record software vendors serve as PSEs under this definition. RME systems may be developed by the Ministry of Health, internally by healthcare facilities, or through partnerships with registered PSEs (Article 9 paragraph (1)).

Dual registration mandates and SATUSEHAT interoperability

Dual registration (Article 9 paragraph (3). Article 12): The RME software provider must be registered as a healthcare-sector PSE with Kominfo. In addition, the healthcare facility or PSE must register the operational system with the Ministry of Health, documenting system architecture, metadata variables, and storage locations.
Data standards and SATUSEHAT integration (Articles 10, 11, 21): The RME platform must be compatible. Furthermore, Interoperable with the national health data exchange platform (SATUSEHAT) managed by the Ministry of Health, conforming to national clinical metadata standards.

Electronic medical record storage requirements (Articles 20 and 22)

RME storage may utilize on-premises servers, certified cloud computing systems, or other certified digital media (Article 20 paragraph (3)). Facilities must maintain off-site data backups under standard operating procedures (paragraphs (4) and (5)). Furthermore, Retain RME data for at least 25 years from the patient's last visit (Article 39 paragraph (1)).

When a facility partners with a PSE for data storage due to resource constraints, Article 22 mandates four strict conditions:

the PSE must operate data storage facilities located inside Indonesia (paragraph (1));
the PSE must secure a formal recommendation from the Ministry of Health's data governance unit (paragraph (2));
the PSE is strictly prohibited from opening, extracting, altering, or exploiting patient data under an integrity pact or NDA (paragraphs (3) and (4)). and
the healthcare facility must retain unrestricted access to stored patient records (paragraph (5)).

Medical record files remain the legal property of the healthcare facility, which retains statutory responsibility for record preservation and confidentiality (Article 25).

Regulatory validity

Pursuant to Article 453 of Law Number 17 of 2023 on Health. Permenkes 24/2022 remains legally effective insofar as it does not conflict with the new statute. PP 28/2024 reinforces mandatory nationwide RME integration in Articles 781 and 786.

Legal basis

Ministry of Health Regulation Number 24 of 2022 on Medical Records: Article 1 point 8. Articles 9–12. Articles 20–22. Article 25. Article 32 paragraph (2). Article 39 paragraph (1). and Article 42.
Law Number 17 of 2023 on Health: Article 453 and Article 454 sub-paragraphs (c) and (h).
Government Regulation Number 28 of 2024: Article 781 and Article 786 paragraph (1).