Data Security Obligations

Is the use of telehealth permitted?

Yes. Telehealth is referred to as ‘telemedicine’ in Hong Kong SAR, which is defined as "… the practice of medicine over a distance, in which interventions, diagnoses, therapeutic decisions, and subsequent treatment recommendations are based on patient data, documents and other information transmitted through telecommunication systems" in the Ethical Guidelines on Practice of Telemedicine issued by The Medical Council of Hong Kong in December 2019 (the "Guidelines"). This follows the definition of telemedicine in the World Medical Association ("WMA") Statement on the Ethics of Telemedicine, last amended in October 2018 (page 2, para. 8).

How is telehealth regulated?

There is no legislation or regulation governing telemedicine in Hong Kong. The Guidelines issued by the Medical Council are not binding and not exhaustive. The Guidelines state that they are to be read in conjunction with the WMA Statement on the Ethics of Telemedicine, however, the provisions of the Guidelines shall prevail if those set out in the latter are different (Guidelines, page 2, para. 8).

Telemedicine includes a wide range of activities, including but not limited to the following four principal areas:

1. Tele-treatment of patients within the definition of WMA;
2. Collaboration between doctors and / or with other healthcare professionals through telecommunication systems;
3. Monitoring of patients through telecommunication systems; and
4. Dissemination of service information and / or health education to the public (including patients) through telecommunication systems.

(The Guidelines focus on the first three areas. Doctors practising in Hong Kong are therefore advised to familiarise themselves with the requirements under Part B of the Code of Professional Conduct issued by the Medical Council before carrying out any activities falling under the fourth area (Guidelines, pages 1, para. 4).)

The Guidelines do not constitute a legal document, however, contravention of the Guidelines may render doctors liable to disciplinary proceedings. The Guidelines are not intended to be applied to overseas-qualified doctors who practise telemedicine on patients in Hong Kong (Guidelines, page 2, para. 7). The Medical Council, however, may report any unregistered medical practitioners practising telemedicine on patients in Hong Kong to the relevant professional body and / or law enforcement agency.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

There are various types of healthcare services for which telehealth is available, including general practice, psychiatry, dermatology, dentistry, geriatrics, and occupational and physiotherapy services. Almost all types of healthcare services utilise telehealth through the "HA Go" app provided by the Hospital Authority ("HA"), a statutory body managing government hospitals and institutions in Hong Kong (see Costs of Telehealth for further details). Such healthcare services are made available to the public through the use of existing messenger and teleconferencing apps (e.g. WeChat and Zoom), as well as proprietary platforms and apps.

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

The public health system includes a wide range of telehealth services provided by HA, which manages 43 public hospitals and institutions, 49 Specialist Outpatient Clinics and 73 General Outpatient Clinics in Hong Kong.

The provision of telehealth services is done via HA Go, a one-stop mobile app for patients to access the HA services launched on 12 December 2019. HA Go allows its users to check appointments made with HA hospitals or clinics, pay HA bills and drug charges (excluding self-financed items), book appointment for general outpatient services and new case of specialist outpatient services, view medication and perform rehabilitation exercise following prescriptions.

The use of HA Go is free of charge, however, it is limited to patients over 18 years old who possess a Hong Kong Identification Card ("HKID"). Patients must activate the app at designated HA hospitals and clinics before using it. HA has announced that it will expand availability of the app to those who do not have a HKID and currently excluded groups in the future. Via HA Go, patients can also download various mobile apps published by HA.

In addition, a suite of apps have been launched on clinical mobile devices to allow clinicians to access patient data in the Clinical Management System On-ramp ("CMS"), a clinical management system that allows sharing of patients’ clinical data with the Electronic Health Record Sharing System ("eHRSS") in Hong Kong.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

There are no specific privacy and / or data protection laws that apply to the provision of telehealth services in Hong Kong.

The Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") regulates the general collection and handling of personal data. Under the Code of Professional Conduct for the Guidance of Registered Medical Practitioners issued by the Medical Council of Hong Kong, Hong Kong registered doctors should have regard to their responsibilities and liabilities under the PDPO, in particular, patient’s rights of access to and correction of information in the medical record.

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

"Telehealth data" is undefined in Hong Kong. However the PDPO defines "personal data" as any data relating directly or indirectly to a living individual. This broad definition of "personal data" would likely include the data generated during a telemedical consultation between a doctor and the patient.

There are currently no restrictions on transfer of personal data outside of Hong Kong, as the cross-border transfer restrictions set out in section 33 of the PDPO were held back and have not yet come into force. Section 33 of the PDPO prohibits the transfer of personal data to a place outside Hong Kong unless certain conditions are met (including a white list of jurisdictions; separate and voluntary consent obtained from the data subject; and an enforceable data transfer agreement).

Non-binding best practice guidance issued by the Hong Kong Office of the Privacy Commissioner for Personal Data ("PCPD") encourages compliance with the cross-border transfer restrictions in section 33 of the PDPO. To that end, the PCPD has also provided suggested model clauses for organisations to use. In practice, companies in Hong Kong will typically include these clauses into their data transfer agreements where personal data is being transferred out of Hong Kong.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

No.