Can an electronic system operator perform worthiness testing internally?

Yes. Both PP 71/2019 Article 1 point 14 and PP 28/2024 Article 986 allow self-assessment by the operator and/or testing by an authorized institution.

When must a Health Information System undergo worthiness testing under PP 28/2024?

Article 981 paragraph (1) of PP 28/2024 requires worthiness testing to be completed before the health information infrastructure is put into use.

What does PP 71/2019 regulate regarding electronic system worthiness testing?

Q: Which five system components are listed in the elucidation of PP 71/2019 Article 23?

The elucidation lists software, hardware, human experts, security systems, and governance as the components of an electronic system.

Article 34 of PP 71/2019 requires every Electronic System Operator to conduct objective worthiness testing on system components internally or through an authorized institution.

Government Regulation Number 71 of 2019 (PP 71/2019) requires every Electronic System Operator (PSE) to conduct electronic system worthiness testing (Article 34 paragraph (1)). Worthiness testing (uji kelaikan) is an objective evaluation of system components conducted internally and/or by an authorized competent institution. PP 71/2019 establishes the mandatory duty and component scope without specifying testing schedules or named testing bodies.

Who must comply and which components are tested

This obligation applies to every PSE, whether an individual, business entity, or state agency operating an electronic system (Article 1 point 4). Both Public-Scope and Private-Scope PSEs must comply (Article 2 paragraph (2)). This broad definition covers hospitals or clinics running electronic medical record systems as well as their software vendors.

The assessment covers each component of the electronic system (Article 1 point 14). The elucidation of Article 23 lists five core components: software, hardware, human experts, security systems, and governance. Article 34 paragraph (2) allows testing to cover all or part of these components depending on protection needs and the strategic nature of the system. Article 99 notes that the healthcare sector holds strategic Electronic Data, though it does not cross-reference Article 34 directly.

Who conducts the testing

Article 1 point 14 provides two pathways for worthiness testing. The evaluation may be performed through self-assessment by the operator and/or by an authorized and competent institution. PP 71/2019 does not name specific testing institutions, and the elucidation of Article 34 simply states "sufficiently clear."

Ministry of Communication and Informatics Regulation Number 5 of 2020 (Permenkominfo 5/2020) reinforces this obligation in the Private-Scope PSE registration form (Article 3 paragraph (3)(d)). Registrants must declare their commitment to conduct worthiness testing in accordance with laws and regulations.

Distinction from periodic audits and reliability certification

Periodic system audits (Article 13): PSEs must maintain a periodic audit mechanism for their electronic systems as a separate obligation from worthiness testing.
Reliability certification (Article 73 paragraph (1)): Certification by a reliability certification body is optional ("may") for electronic transaction businesses, whereas worthiness testing is mandatory.
User security disclosure (Article 29(c)): PSEs must provide system worthiness or security information to users, and worthiness test results can support that disclosure.

Sanctions and parallel healthcare sector rules

Administrative sanctions (PP 71/2019 Article 100). Violating Article 34 paragraph (1) triggers administrative sanctions including written warnings, administrative fines, temporary suspension, access blocking, or removal from the PSE registry. These sanctions do not eliminate civil or criminal liability (Article 100 paragraph (5)).
Health Information System worthiness testing (PP 28/2024): Health Information System operators must perform worthiness testing before infrastructure is put into use. Furthermore, Maintain operational maintenance guidelines (Article 981 paragraphs (1) and (2)). Article 986 paragraph (1)(a), paragraph (2). Furthermore, Paragraph (3) likewise state that worthiness testing may be performed internally and/or by an authorized institution (implementing Law 17/2023 Article 347 paragraph (2)(a)).

Legal basis

Government Regulation Number 71 of 2019 on Electronic Systems and Transactions (PP 71/2019): Article 1 points 4. Furthermore, 14, Article 2 paragraph (2), Article 13, Article 29(c), Article 34 paragraphs (1). Furthermore, (2), Article 73 paragraph (1), Articles 99–101, and Elucidation of Articles 23 and 34.
Permenkominfo Number 5 of 2020 on Private-Scope Electronic System Operators: Article 3 paragraph (3)(d).
Government Regulation Number 28 of 2024 (PP 28/2024): Article 1 point 23, Article 981 paragraphs (1). Furthermore, (2), and Article 986 paragraph (1)(a), (2), and (3).
Law Number 17 of 2023 on Health: Article 347 paragraph (2)(a).