Digital Health in Thailand, Vietnam, and Indonesia

What does “digital health” include within each jurisdiction?

Thailand: For the most part, the idea of “digital health” or “telemedicine” has generally fallen within the area of medical device regulation in Thailand. The normal sort of digital health components you would think of—like software and device accessories for diagnosis, monitoring, prevention, or treatment of illnesses—would fall into medical device classification, so long as they do not achieve their intended function by immunological, metabolic, or pharmacological means. The “digital health” devices you commonly think of, like mobile medical apps, wearable technologies and software, fall mainly within this definition.

After the last update to the Medical Device Act in 2008, Thailand next looked at digital health in 2019, with the Personal Data Protection Act (PDPA)—which is largely aligned with GDPR principles—and the Cybersecurity Act. These deal with important issues arising from “digital health” and “telemedicine” like personal data protection, consent to use and consent to transfer data, and privacy.

Vietnam: Similarly, in Vietnam, while there’s not a clear definition of “digital health” in the law, it is understood to include various types of medical devices, software, and online services used for healthcare purposes—including diagnosis and treatment as well as medical records and telemedicine. There’s no law on digital health, per se, but many of these areas are covered by separate circulars issued by the Ministry of Health. There’s a circular (referred to as “Circular 49”) from late 2017 on telemedicine, for example, that actually uses the term “telemedicine” to identify the industry and sets out licensing and technical requirements. Indicators such as this show that Vietnam is definitely embracing the concept.

Indonesia: In Indonesia, there is also no precise definition of “digital health.” Digital health is regulated under several laws and regulations, such as provisions concerning medical devices under the health law, electronic information and transactions law, medical records regulations, and consumer protection law. Any digital health device that meets the definition of a medical device must be registered as one. Since the definition is rather broad, it is likely that any digital health device would fall in this category. Digital health medical devices classified as conventional medical devices must obtain proper medical device manufacturing and distribution permits prior to distribution in Indonesia.

Are there any current government initiatives to facilitate the rise in digital health?

Thailand: There are a lot. The Thai government is supporting and encouraging digital health efforts—particularly in updating regulatory guidance and making it more relevant to today. There have been several conferences and seminars and public and private health software design competitions and for the development of digital health applications and services. And the pandemic has only accelerated both public need and interest in digital health.

Probably the most encouraging development so far was the Ministry of Public Health’s announcement of its e-Health Strategy in 2016. This is a 10-year plan for the development of e-government services, including several development goals and government support earmarks for digital health. This is now well underway at several government hospitals across Thailand, including what’s called the “AI Smart Health Profile,” which enables sharing of patient profiles between hospitals, and the use of big data. Some hospitals have even established their own telehealth services in partnership with the National Broadcasting and Telecommunication Commission using high-speed internet to provide health services like screenings for noncommunicable diseases, diabetes, hypertension, common skin and eye conditions, and similar ailments. This has mostly been aimed at hospitals and patients in rural locations, but the plan is to expand this into mid-tier urban centers.

In 2019, there was a collaboration of three government agencies to connect healthcare services provided by 116 government hospitals through an IT system and a mobile phone application. This project allows Thai physicians to share medical information online among themselves. Some benefits of this project have been long-distance study in the medical sciences and medical consultations in teleradiology, telecardiology, and telepathology. There are almost 900 government hospitals in Thailand, so this program has room to grow.

Vietnam: The government has issued several decisions and released plans and seminars on the development of smart healthcare. For example, the City of Hanoi and the Ministry of Health have approved plans for further expansion of e-government facilities, and this will include digital health initiatives. This is generally in line with the push for modernization and digitalization of nearly everything in Vietnam, though sometimes, of course, it takes a while for reality to catch up with the various five-year plans. Still, Vietnam is making good progress in these areas and just like in Thailand and most all other jurisdictions in Asia, the pandemic has accelerated this markedly.

Indonesia: In 2021, Indonesia’s Ministry of Health, in partnership with the United Nations, issued Blueprint of Digital Health Transformation Strategy 2024. This blueprint maps out how using digital information technology can aid Indonesia in accelerating its plan to provide universal, affordable, equitable, and quality healthcare to all Indonesians. Prior to this, the effort to digitize the health sector was announced in a Ministry of Health regulation in 2020. As there are numerous health applications developed by the government, there is no comprehensive health data due to a lack of regulation and standardization. Thus, the Ministry of Health will develop the Indonesia Health Services Platform to provide data connection, analysis, and services to support and integrate various existing healthcare applications in Indonesia.

What does the current regulatory environment for digital health tools look like?

Thailand: In Thailand, the Ministry of Public Health is the main regulator for health matters—including medical devices, which would include digital health activities. Within the Ministry of Public Health sits the Thai FDA and its Medical Device Control Division, which is responsible for the enforcement of the Medical Device Act. The PDPA and Cybersecurity Act are enforced by the Ministry of Digital Economy and Society, so for digital health there are two regulatory authorities to work with.

Vietnam: In Vietnam, the Ministry of Health is the main regulatory authority over public health issues, and it has been active in terms of setting out regulatory guidance on digital health, telemedicine, and IT systems for doctors and hospitals that offer these services. The Ministry of Health has issued these rules beginning around late 2017 and then on into 2018:

• Circular 46 is on electronic medical records,
• Circular 49 (mentioned earlier) covers telemedicine,
• Circular 53 covers the provision of online healthcare services, and
• Circular 54 provides criteria for IT applications at healthcare facilities.

The main regulatory body is the IT Department at the Ministry of Health, which gives guidelines on and inspects digital health activities, and cooperates with other state agencies to implement state management of digital health. The Ministry of Health may work with other agencies if issues around network security or breaches are raised under the Law on Network Information Security.

Indonesia: In Indonesia, there is no single regulatory body in charge of digital health. Two ministries are particularly relevant. The Ministry of Health formulates and implements health and technical policy relating to public health, health services, pharmacy, health technology, and medical devices. The Ministry of Communications and Information Technology regulates communications, information affairs, and internet censorship.

With digital technology naturally comes privacy concerns, specifically patient privacy. How have regulations addressed this?

Thailand: Thailand has for many years considered patient data to be private and has required its handling to be in keeping with general principles of privacy and consent. Until June 2022 this was by way of requirements for licensed healthcare professionals under their professional ethical guidelines. In 2019, the PDPA was enacted, and on June 1, 2022, it took full effect. Now the entire understanding of personal data has taken on more relevance. The PDPA divides regulations between general data and sensitive data, requiring a patient’s consent before sensitive personal data can be collected or shared. There are a few exceptions, such as to prevent physical harm to the patient, and use for nonprofit or scientific research purposes.

Vietnam: In Vietnam, the situation is a bit different because personal data is not separated or treated differently depending on its type. The various types of data are all treated the same under data protection and privacy law. Under these laws, the general principle is that the data subject must be notified of and provide consent to data processing, and the use of the data must be in line with the purpose that the person was notified of and consented to. Personal data can be transferred to a third party, including across borders, only if prior consent is obtained. Another important point is that EMRs (electronic medical records) must be encrypted to share between healthcare professionals or hospitals—and only certain named authorities can access the EMRs.

Indonesia: In essence, Government Regulation No. 71 of 2019 on the Organization of Electronic Systems and Transactions states that personal data is any information that enables identification of that person. Health data would thus qualify as personal data, and a company that collects patient data needs to request consent from data subjects in order to use their personal data. This includes the collection and sharing of the data.

Medical records can be disclosed for the purpose of research, education, and medical audits. However, the identity of the patient must be withheld.

Considering how fast technology advances, are there any regulations designed to protect emerging digital health intellectual property?

Intellectual property in all its various forms—ranging from registered IP like patents, designs, and trademarks to unregistered IP like copyright and trade secrets—is relevant to any business. For a digital health business, generally all IP can be looked at and decisions made on where in the business that IP right exists, how to register or protect it, and how to commercialize it. It’s important to get IP decisions right early on—not only because there are some IP mistakes that cannot be corrected, but also because having protected and valuable IP around the digital health solution helps promote that business to investors and to customers. Hospital and healthcare procurement officers in Southeast Asia particularly appreciate knowing their solution provider is bringing a tested and viable innovation. This speaks to legitimacy, functionality, and viability, and companies also know that after procurement, they won’t have to worry about receiving a notice letter that they are infringing someone else’s IP.

Thailand: Any technical solution in the form of a product or a process that is novel, inventive, and industrially applicable can be patented in Thailand. However, methods of diagnosis, treatment, and cure are excluded from patent protection. Computer programs and digital health technology data compilations are subject to copyright protection. Thailand has a robust Trade Secrets Act, so unregistered IP is also protectable, but as is the case in most Asian jurisdictions, registered IP is much easier to enforce than unregistered IP.

Vietnam: Any novel or innovative technical product or process can be patented in Vietnam, with some exceptions. Unfortunately, these exceptions include computer programs, presentations of information, and methods for preventing, diagnosing, and treating human and animal diseases. In practice, it’s much easier to get a patent on a physical device than a process or application. Both computer programs and data compilations of digital health technology are subject to copyright. While copyright registration for a work is not required for enforcement, it is recommended to register a work to establish prima facie evidence of copyright subsistence and ownership.

Indonesia: An invented product or process that is novel, inventive, and industrially applicable can be patented in Indonesia, with some exceptions. Any method of examination, treatment, medication, or surgery applied to humans or animals is not patentable. Rules and methods that only contain a computer program are not patentable, but a computer program that has a technical effect beyond a normal physical interaction, and that functions to solve a problem, is a patentable invention. Computer programs are also subject to copyright protection. Although copyright recordation is not mandatory, it is recommended for obtaining proof of ownership.

Are there specific rules relating to telemedicine, remote consultations/opinions, diagnoses, and so on, and compliance regarding overseas or nonlocally domiciled healthcare providers?

Vietnam: There are currently no specific rules in Vietnam, but these are expected so that there will be clear guidance on whether foreign doctors—particularly those who don’t reside in Vietnam—are allowed to participate in digital health services for patients in Vietnam. For example, can a local doctor consult an overseas doctor about a patient’s health status? Right now, it’s only clear that doctors who are based in Vietnam can obtain the medical practice certificate required to be part of the telemedicine examination and treatment process.

Indonesia: In April 2020, the Indonesian Medical Council issued Regulation Number 74 of 2020 on Clinical Privilege and Medical Practices through Telemedicine during Coronavirus Disease 2019 (COVID-19) Pandemic in Indonesia as a temporary solution during the pandemic. Though in effect only until the end of the COVID-19 state of public health emergency, this regulation allows doctors and dentists to provide healthcare services through telemedicine. Doctors and dentists who perform medical practice through telemedicine must have a registration certificate and a practice license.

This regulation followed a Ministry of Health regulation in 2019 regarding implementation of telemedicine services by health service facilities, which regulates the organization of telemedicine among health service facilities.

The Decision of the Minister of Health No. 4829 of 2021 also provides guidelines for health services through telemedicine during the COVID-19 pandemic. This decision allows the provision of healthcare services remotely through information and communication technologies to enable communication between health service facilities. Specifically, it states that hospitals, public health centers, clinics, independent private medical and dental practices, medical laboratories, and pharmacies are permitted to offer telemedicine services. This regulation remains in effect until the pandemic is officially declared over by the government.

Considering the current pandemic and the global rise in digital services, what changes in digital health regulations or adoption do you anticipate for the future?

Thailand: The COVID-19 pandemic has put implementation of digital health options in Thailand squarely in the sights of government and business. Several government agencies are actively seeking out and supporting digital health ideas and business. These include the National Innovation Agency and the National Science and Technology Development Agency, where healthcare solutions providers can obtain financial and professional support for the development of digital health services. Looking ahead, Thailand may see further participation by foreign service providers—including those without a presence in the country—by way of things like genomic testing and remote second opinions.

Vietnam: The government has passed legislation encouraging healthcare facilities to use technology to provide and improve their services. For example, in 2018, legislation was passed permitting and regulating telemedicine activities. These activities include remote consultations via tech applications, teleradiology, and training in telemedicine technology transfer. Medical records can also be prepared and stored in digital form according to this legislation. The government’s attention to this area in recent years is expected to lead to further development and maturing of the ecosystem for digital health services in the coming years.

Indonesia: Based on the Blueprint for Digital Health Transformation Strategy 2024, there should be progress towards new regulation and adoption of digital health services in Indonesia—as there are not yet adequate regulations regarding data protection, data standardization, and patient rights and privacy. More standardization in data exchange between actors in the health industry is also to be expected. This standardization will enable the Ministry of Health to monitor compliance with data requirements and service standards.

The current regulations on telemedicine have limitations. The Ministry of Health regulation from 2019 is limited to only health service facilities, and the other two regulations mentioned above only remain in place during the COVID-19 pandemic. Therefore, the government needs to develop regulations on the implementation of telemedicine beyond the period of COVID-19 pandemic.

By Tilleke & Gibbins, Vietnam, a Transatlantic Law International Affiliated Firm. 

For further information or for any assistance please contact vietnam@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.