The legal status of electronic medical records and health data privacy in Indonesia: Current regulations, gaps, and future directions

Abstract

Introduction: Indonesia’s healthcare system is undergoing digital transformation through mandatory Electronic Medical Records (EMR) under Regulation No. 24 of 2022 and the Health Omnibus Law (Law No. 17 of 2023). While EMR enhances data integration via SATUSEHAT, it raises privacy concerns under the Personal Data Protection Law. This study aims to assess the adequacy of Indonesia’s legal framework governing EMR and health data protection.

Methods: This study applies a normative-juridical method complemented by empirical analysis. It reviews relevant statutes, implementing regulations, and academic literature on EMR and data protection, alongside secondary empirical data from institutional reports and documented cybersecurity incidents. The analysis focuses on regulatory harmonization, consent mechanisms, government access to health data, and data subject rights.

Results: The findings indicate that EMR implementation in Indonesia is supported by a legitimate normative foundation but remains operationally fragile. Regulatory inconsistencies persist between health sector regulations and the personal data protection regime, particularly concerning state access to medical data, informed consent, and the right to erasure. Empirically, implementation is constrained by cybersecurity vulnerabilities, unequal digital infrastructure readiness in community health centers, and limited human resource capacity, increasing legal and liability risks.

Conclusion: While Indonesia’s EMR policy reflects progress toward digital health governance, enforcement of privacy protection remains underdeveloped. Strengthening the system requires clearer implementing regulations, improved cybersecurity standards, and robust institutional oversight to ensure a rights-based and sustainable digital health ecosystem.