Every step in the employee medical check-up (MCU) workflow has its own legal foundation. In workplaces covered by Occupational Safety Law 1/1970, employers must examine the health of their workers (Article 8 of Law 1/1970 and Ministerial Regulation 2/1980). Laboratory quality standards are governed by Ministerial Health Regulation 43/2013. Examination results form part of the medical record (Government Regulation 28/2024). Every medical record entry must include the name, timestamp, and signature of the attending medical practitioner or health worker (Health Law 17/2023, Article 296(4) and Ministerial Health Regulation 24/2022, Article 16(2)), and its content remains the worker's confidential personal health data. Read together, fitness-for-work conclusions are determined by the examining physician, not by the employer and not by software. No single Indonesian regulation defines the “MCU report” as a unitary document from start to finish, so the compliance workflow is synthesized across multiple authorities.
Step 1: The employer's duty to examine workers through an appointed physician
Article 8 of Occupational Safety Law 1/1970 requires employers (pengurus) to examine the physical health, mental condition, and physical capability of workers to be hired or transferred. All workers must also undergo periodic medical check-ups conducted by a physician appointed by the employer and confirmed by the competent authority. This duty applies across workplaces listed in Article 2(2), covering sites using dangerous machinery or materials, high-altitude work, and medical facilities.
Ministerial Regulation PER-02/MEN/1980 outlines three types of worker examinations: pre-employment, periodic, and special (Article 1). Periodic check-ups must occur at least once a year unless determined otherwise by the competent authority. The scope includes a complete physical examination, general fitness assessment, chest X-ray where feasible, routine laboratory panels, and any additional tests deemed necessary (Article 3(2)–(3)). The employer and appointed physician jointly formulate examination guidelines tailored to the specific operational risks (Article 3(4)). The examining physician must satisfy statutory certification standards (Article 1(d)), and paramedic roles are directed by that physician (Article 6(4)).
Government Regulation 28/2024 classifies health examinations and fitness-for-work assessments as preventive occupational healthcare (Article 233(5)) and requires employers to implement occupational health measures across all workplaces (Article 241(1)). Detailed technical standards are delegated to ministerial regulations (Article 241(2)), meaning examination categories and frequencies continue to draw from Ministerial Regulation 2/1980 pending updated ministerial enactments.
Step 2: Defensible clinical laboratory records
Article 3(1) of Ministerial Health Regulation 43/2013 requires every clinical laboratory to satisfy criteria across governance, physical facilities, equipment, reagents, specimen handling, test methods, quality control, biosafety, and recording and reporting. Under Article 2, the statutory objective is to deliver defensible, high-quality testing services. Specific technical criteria are detailed in the official regulation annex (Article 3(4)).
Health laboratories are statutory healthcare facilities required to implement electronic medical records (Ministerial Health Regulation 24/2022, Article 3(2)(f)).
Ministerial Health Regulation 43/2013 was issued under the 2009 Health Law. Health Law 17/2023 repealed that statute (Article 454(d)) while keeping prior implementing regulations effective to the extent they do not conflict with the new law (Article 453).
Step 3: Clinical conclusions and physician signatures
All examination findings enter the electronic medical record. Government Regulation 28/2024 defines a medical record as documentation containing patient identity, examinations, treatments, clinical actions, and other care services (Article 778(3)). In institutional healthcare facilities, record governance is the responsibility of the facility management (Article 778(2)). A patient-facing medical summary must state patient identity, physical and diagnostic findings, diagnoses, treatment regimens, follow-up plans, and the attending practitioner's name and signature (Ministerial Health Regulation 24/2022, Article 26(2) and (6)).
The signature requirement is anchored in primary statute. Health Law 17/2023, Article 296(4) establishes: “Every medical record entry must bear the name, timestamp, and signature of the Medical Practitioner or Health Worker who delivered the service or action.” The fitness-for-work determination (penilaian kelaikan kerja under Government Regulation 28/2024, Article 233(5)(e)) constitutes a clinical care service. Because occupational health examinations must be conducted by a licensed physician under Ministerial Regulation 2/1980, Article 1(a)–(c), reading these mandates together confirms that fitness determinations must be finalized and signed by the examining doctor.
Signatures do not need to be manual ink on paper. Ministerial Health Regulation 24/2022 allows electronic medical records to incorporate electronic signatures for data integrity verification and signatory authentication (Article 31). Under Electronic Information and Transactions (ITE) Law 11/2008, Article 11(1), electronic signatures carry legal validity if signature creation data remains exclusively with the signatory during signing, alterations are detectable, signatory identity is certifiable, and document consent is demonstrated. Government Regulation 71/2019 distinguishes certified digital signatures (issued by an Indonesian accredited certification authority) from uncertified signatures (Article 60(2)–(4)), though occupational health regulations do not mandate a specific certificate tier for MCU reports.
Step 4: Who can view which results
Health data constitutes specific personal data under Personal Data Protection Law 27/2022 (Article 4(2)(a)). Data controllers must establish a lawful processing basis, such as explicit consent for a defined purpose disclosed to the worker (Article 20). Controllers must also conduct a Data Protection Impact Assessment (DPIA) when processing specific personal data (Article 34(1) and (2)(b)) and implement rigorous security measures (Articles 35 and 36).
Under healthcare law, individuals possess the right to confidentiality over their personal health data (Health Law 17/2023, Article 4(1)(i)). Medical practitioners and healthcare management share a strict duty of confidentiality (Article 301(1) and Government Regulation 28/2024, Articles 788(3) and 789). Disclosure of medical record contents is restricted to demonstrated need (Article 783(4)). The patient owns the content of the medical record, and disclosure to third parties requires patient consent (Ministerial Health Regulation 24/2022, Article 26(1), (2), and (5)). Consent-based disclosure is limited to patient care, patient self-requests, or billing administration (Government Regulation 28/2024, Article 783(5)). Disclosure without consent is strictly limited to authorized statutory inquiries (Article 783(1)(b), (11)(e), and (12)).
The employing company qualifies as an external third party (“pihak lain”) under Ministerial Health Regulation 24/2022, Article 26. What may be shared with HR is constrained by statute and worker consent (see our analysis on whether HR can receive worker medical check-up results). An employer's operational need is typically confined to the fitness conclusion or required work accommodations, rather than granular lab values or primary diagnoses. Transmission boundaries must strictly follow the principle of purpose-limited disclosure.
Micromeet builds governed healthcare AI infrastructure for continuous care. Clinicians and authorized staff review consequential outputs.
Step 5: Post-examination obligations and retention
When abnormalities are detected during periodic examinations, employers are legally required to implement corrective measures addressing the workplace condition (Ministerial Regulation 2/1980, Article 3(6)). This duty must be balanced against privacy boundaries: data transferred to the employer remains strictly limited. The employer must also submit examination reports to the regional manpower authority within two months of completion (Article 6(1)–(2)). Technical reporting forms are determined by appointed officials (Article 7(3)). Under Government Regulation 28/2024, Article 240, occupational health records must integrate with the National Health Information System. Furthermore, electronic medical record data must be retained for at least 25 years from the patient's last visit (Ministerial Health Regulation 24/2022, Article 39(1)).
Ministerial Regulation 2/1980 designates the Regional Health Advisory Board (Majelis Pertimbangan Kesehatan Daerah) to adjudicate disputes regarding examination findings, with a 14-day appeal window to the central board (Article 8(1)–(2)). Employers bear the cost of mandated re-examinations (Article 9). Failure to comply is subject to penal sanctions under Occupational Safety Law 1/1970, Article 15(2)–(3), including detention of up to three months or statutory fines.
Operational checklist before issuing MCU reports
- The examining physician holds a valid appointment satisfying the occupational health certification mandates under Ministerial Regulation 2/1980, Article 1(d).
- The clinical laboratory demonstrates full compliance with Ministerial Health Regulation 43/2013 quality and specimen criteria.
- Every clinical report includes the doctor's name, execution timestamp, and authenticated signature, with detectable post-signature tamper controls.
- Worker consent documentation explicitly details which summary data will be shared with the employer and for what specific occupational purpose.
- Statutory manpower reporting templates are aligned with the local manpower agency (Dinas Tenaga Kerja) requirements.
Under a governed healthcare AI workflow like MCU CoPilot, the platform structures draft reports from lab values and physical exams while enforcing the operational principle: AI writes, doctors decide. The examining physician retains complete authority over review, verification, and digital signature.
Legal basis
- Occupational Safety Law 1/1970: Article 2(2), Article 8, Article 15(2)–(3).
- Ministerial Regulation PER-02/MEN/1980 (Worker Health Examinations): Articles 1, 3, 6–10.
- Ministerial Health Regulation 43/2013 (Good Clinical Laboratory Practice): Articles 2 and 3.
- Health Law 17/2023: Article 4(1) and (4), Article 296(4), Articles 301, 453, 454.
- Government Regulation 28/2024 (Implementing Health Law 17/2023): Articles 233, 240, 241, 778, 783, 788, 789.
- Ministerial Health Regulation 24/2022 (Electronic Medical Records): Articles 3, 16, 26, 31, 39.
- Personal Data Protection Law 27/2022: Articles 4, 20, 34–36.
- Electronic Information and Transactions (ITE) Law 11/2008 (amended by Law 19/2016 and Law 1/2024): Article 11(1).
- Government Regulation 71/2019 (Electronic Systems and Transactions): Articles 59 and 60.
FAQ
Who is legally authorized to determine and sign employee MCU fitness conclusions? Under Health Law 17/2023, Article 296(4) and Ministerial Regulation 2/1980, Article 1, fitness-for-work determinations must be evaluated and signed by the appointed examining physician, not by administrative staff, employers, or autonomous software.
Are electronic signatures valid on occupational health MCU reports in Indonesia? Yes. Ministerial Health Regulation 24/2022, Article 31 and ITE Law 11/2008, Article 11 establish the validity of electronic signatures on digital medical records, provided they ensure signatory authentication and data integrity against post-signing alteration.
How long must healthcare facilities retain worker MCU records? Under Ministerial Health Regulation 24/2022, Article 39(1), electronic medical record data must be securely archived for a minimum of 25 years from the patient's last encounter date.
