Not automatically. A worker's medical check-up results are a personal health secret. Doctors and clinics may not hand them freely to HR — even when the company arranged and paid for the examination. There are two lawful routes to disclosure: with the worker's consent, or without consent, among other grounds for other purposes prescribed by law, on a request from an authorised party. Which route applies to HR requires legal advice. For general worker examinations, the regulations reviewed here do not specify exactly what HR may receive. The operating principle is disclosure limited to what is needed. HR typically needs the doctor's conclusion on fitness for work or work restrictions — not the full diagnosis or laboratory results.
Why MCU results are protected health information
Medical examinations and fitness-for-work assessments are part of preventive occupational health care (Government Regulation 28/2024 on Health, Article 233(5)(d) and (e)). Because healthcare services include preventive care, a worker who is examined is a patient (Health Law 17/2023, Article 1 nos. 3 and 23).
Every person has the right to “confidentiality of their personal health data and information” (Health Law 17/2023, Article 4(1)(i)). Medical professionals and healthcare facilities are obliged to keep that secret (Article 301(1), Article 177(1)). The secret covers identity, physical and investigative examination results, and diagnosis (Government Regulation 28/2024, Article 788(3)). This data forms part of the medical record, and its disclosure therefore follows the rules governing the release of medical record contents (Government Regulation 28/2024, Article 788(4), Article 790(1)). A doctor appointed by the employer (Ministerial Regulation on Occupational Health Examinations No. 2/1980, Article 1(d)) remains bound by the same obligation.
When disclosure is lawful
The exceptions to the right of confidentiality in Health Law 17/2023, Article 4(4) do not mention the employer. Government Regulation 28/2024, Article 783 divides the disclosure of medical record contents into two routes. In both, the request must be in writing (electronic or non-electronic) and disclosure must be “limited to what is needed” (Articles 783(2)–(4)).
The first route is disclosure with the patient's consent, including at the patient's own request (Articles 783(1)(a) and (5)(b)). Consent to process personal data must be explicit for a purpose already communicated, and must be in writing or recorded (Personal Data Protection Law 27/2022, Articles 20(2)(a) and 22(1)).
The second route is disclosure without the patient's consent, including for other purposes prescribed by law on a written request from an authorised party or institution (Articles 783(1)(b), (11)(e) and (12)). Health Law 17/2023, Article 4(4)(h) carries the same exception. These provisions do not answer whether an employer's obligations under Occupational Safety Law 1/1970, Ministerial Regulation 2/1980 and Government Regulation 28/2024 Article 241 qualify as those “other prescribed purposes”, or whether the company qualifies as an “authorised party”.
For mental health examinations for specific jobs, the worker's consent covers the transmission of results to the applicant — including the employer — in a letter that states at minimum whether there is a meaningful potential for psychopathology (Ministerial Health Regulation 29/2022, Articles 12(2)–(3) and 16(2) and (4)). This regulation was issued under Health Mental Law 18/2014, which Health Law 17/2023 repealed (Article 454(g)). Implementing regulations for Law 18/2014 remain in force insofar as they do not conflict with Law 17/2023 (Article 453(f)). Government Regulation 28/2024, Article 172 now continues the obligation for these examinations and delegates details to a Ministerial Regulation (Articles (1) and (6)).
Micromeet builds governed healthcare AI infrastructure for continuous care. Clinicians and authorized staff review consequential outputs.
Employer obligations and data already received
The employer (pengurus) is obliged to have workers examined (Occupational Safety Law 1/1970, Article 8(1) and (2)) and to act on abnormalities found in periodic examinations (Ministerial Regulation 2/1980, Article 3(6)). The employer is also obliged to provide occupational health services in accordance with occupational health standards at all workplaces (Government Regulation 28/2024, Article 241(1)). None of these provisions grant the employer the right to receive a worker's medical file.
Data received by the company becomes the company's responsibility as a data controller (Personal Data Protection Law 27/2022, Articles 1 nos. 4 and 7). The company must process it for the stated purpose (Article 28) and keep it confidential (Article 36). This operates alongside health data protections under Health Law 17/2023. Violations of the controller's obligations may be subject to administrative sanctions, including fines (Articles 57(1) and (2)). Intentional and unlawful disclosure of another person's personal data carries a criminal penalty of up to 4 years' imprisonment and/or a fine of up to four billion rupiah (Article 67(2)).
Under a governed healthcare AI workflow such as MCU CoPilot, the boundary is explicit: AI writes, doctors decide. The platform helps structure and draft fit-to-work determinations without exposing full confidential medical files to unauthorized recipients.
Legal basis
- Health Law 17/2023: Articles 1 nos. 3 and 23; Article 4; Article 177; Article 301; Articles 453 and 454.
- Government Regulation 28/2024 (Implementing Regulation for Law 17/2023): Articles 172, 233, 241, 783, 788, 790(1).
- Personal Data Protection Law 27/2022: Articles 1, 20, 22, 28, 36, 57, 67.
- Occupational Safety Law 1/1970, Article 8; Ministerial Regulation 2/1980, Articles 1 and 3; Ministerial Health Regulation 29/2022, Articles 12 and 16.
FAQ
Can HR receive the complete medical check-up results of a worker? No, not automatically. In Indonesian health law, complete examination results and diagnosis are protected medical secrets. HR is only entitled to receive a conclusion on the worker's fitness for work (fit to work certificate) or necessary work adjustments, unless there is explicit written consent or an exception prescribed by law.
What information is HR entitled to receive from an employee MCU? HR is typically entitled to receive the doctor's conclusion on work fitness (e.g. Fit to Work, Fit with Restrictions, Temporary Unfit, or Unfit) and operational recommendations for workplace safety, without disclosing detailed medical diagnoses or raw laboratory values.
What laws protect worker medical examination results in Indonesia? Medical confidentiality and health data are protected under Health Law 17/2023 (Articles 4, 177, and 301), Government Regulation 28/2024 (Articles 783, 788, and 790), and Personal Data Protection Law 27/2022 where health data is classified as specific personal data.
