Data Security Obligations

Is the use of telehealth permitted?

Yes, the use of telehealth is permitted in China. It is commonly referred to as "internet plus healthcare" in China.

How is telehealth regulated?

A series of administrative rules were promulgated on July 17, 2018 by PRC National Health Commission and National Administration of Traditional Chinese Medicine pursuant to PRC State Council’s Opinion to Promote "Internet Plus Healthcare" promulgated on April 25, 2018. These administrative rules include the following:

• Administrative Measures for Internet Diagnosis and Treatment (For Trial Implementation);
• Administrative Measures for Internet Hospitals (For Trial Implementation); and
• Good Administrative Practice for Remote Medical Services (For Trial Implementation).

In addition, on February 8, 2022, PRC National Health Commission and National Administration of Traditional Chinese Medicine further promulgated Rules for the Supervision of Internet Diagnosis and Treatment (For Trial Implementation).

Currently there is no law or administrative regulation, which has greater legal authority than administrative rules, enacted to specifically govern telehealth or internet health.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

According to Administrative Measures for Internet Hospitals (For Trial Implementation), the practice scope of an internet hospital shall not exceed the practice scope of the offline hospital that the internet hospital is affiliated with. There are no specific limitations based on the practice areas. That said, there is a strict ban on initial diagnosis or treatment activity via internet or other information technology. Only after a physician confirms that a patient has been clearly diagnosed with certain common diseases or chronic diseases in an offline hospital, the physician might provide follow-up online consultations for the same diagnosis.

The provision of remote medical service in China involves both proprietary platforms as well as utilisation of general remote messaging tools, such as WeChat. According to the Good Administrative Practice for Remote Medical Services (For Trial Implementation), the inviter institute for remote medical services might directly invite the invitee institute to provide technical support for the inviter institute’s medical treatment activities, via e.g., telecommunications, and computer and network technology. On the other hand, the inviter institute or a third party entity might also establish a proprietary platform for the provision of remote medical service.

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

The aforementioned administrative rules do not distinguish between public healthcare system and private healthcare system. Further, according to Guiding Opinion on Improving Pricing and Payment Policies by Healthcare Security for "Internet plus" Healthcare Service promulgated by National Healthcare Security Administration on August 17, 2019, both public and private medical institutions might provide internet plus medical services. The pricing of medical service provided by public healthcare system is regulated by government whereas that for private healthcare system is regulated by market. Further, Healthcare Security Administration at the provincial level determines the scope of service items to be covered by national healthcare insurance scheme. Several provinces have promulgated their own reimbursement policies. For example, Healthcare Security Administration of Shandong Province allows the follow-up consultation fees and certain refills of prescription drugs to be paid by healthcare security fund after confirmation by local Healthcare Security Administration. On the other hand, the fees associated with imaging, ultrasound and other testing services provided remotely via third party platform or entity shall be approved first prior to their incorporation into the public healthcare insurance scheme.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

China has yet to implement any privacy/data protection law that applies specifically to the provision of internet healthcare. Administrative Measures for Internet Diagnosis and Treatment (For Trial Implementation) stipulates that medical institutions shall comply with all relevant laws and regulations on information security and confidentiality of healthcare data. Such laws and regulations include the following:

• Cyber Security Law;
• Personal Information Proetction Law;
• Data Security Law;
• Regulations of the PRC on Administration of Human Genetic Resources promulgated by PRC State Council;
• Administrative Measures for Health Related Information promulgated by National Health Commission; and
• Administrative Measures for Cyber Security of Medical and Health Institutions promulgated by National Health Commission, National Administration of Traditional Chinese Medicine and National Administration of Disease Control and Prevention;
• Good Administrative Practice for Electronic Medical Records promulgated by National Health Commission and National Administration of Traditional Chinese Medicine.

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

Due to the lack of any specific law or regulation governing telehealth data, the cross border transfer of telehealth data should be carried out in accordance with the applicable law and regulation instituted for healthcare data in general.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

We are not aware such development in the near future but will closely monitor the legislation updates in this area.