Key takeaways
Compared to the Previous Regulation, MOH Regulation 24 featured new concepts and requirements regarding medical records. We summarize our observations on the key provisions of MOH Regulation 24 below.
1. Electronic medical records
MOH Regulation 24 introduces a new feature for the storage of medical records. Now all Healthcare Facilities are required to store their medical records electronically in digital-based storage media.
Which business actors need to implement?
The following entities must carry out electronic medical records:
- Self-practicing facilities of doctors, dentists or other healthcare professionals
- Public healthcare centers (puskesmas)
- Clinics
- Hospitals
- Pharmacies
- Health laboratories
- Health halls (balai)
- Other healthcare facilities as determined by the MOH
("Healthcare Facilities")
The implementation of medical records shall be carried out by dedicated working unit within each Healthcare Facility. Similar to the Previous Regulation, a specific personnel — a medical recorder — must be allocated by each Healthcare Facility to carry out medical recording within each Healthcare Facility.
When business actors need to implement?
Pursuant to Article 45 of MOH Regulation 24, all Healthcare Facilities must implement the electronic medical records pursuant to MOH Regulation 24 at the latest of 31 December 2023.
2. Software for medical records — good news for third party vendors?
Article 9 of MOH Regulation 24 stipulates that in doing electronic medical records, each Healthcare Facility may use an electronic system (including sftware program) that is developed by, either: (1) MOH, (2) Healthcare Facility itself, or (3) third party electronic system operator ("ESO") through cooperation with Healthcare Facility.
Unlike in the Previous Regulation, MOH Regulation 24 boldly stipulate that third party ESOs may cooperate with Healthcare Facilities, which is a clear legal basis for third party software to be used by Healthcare Facilities for medical recording purposes.
Nevertheless, this would likely be subject to close monitoring by MOH together with Ministry of Communications and Informatics ("MOCI") on data protection aspects, in case the processing and/or storage of the sensitive patients medical data is being handled by the third party ESO.
MOH Regulation 24 also allows Healthcare Facilities to cooperate with third party ESO in data storage aspects relating to electronic medical records, provided that:
- The data center is located onshore
- ESO must obtain a recommendation from MOH as a pre-approval for the cooperation
For storage activities that are done by third party ESO, the ESO is prohibited under Article 22 of MOH Regulation 24 from disclosing, collecting, manipulating, damaging, utilizing and doing any other adverse act against Healthcare Facility in relation to the data that is being handled by the ESO. To that end, ESO will be required to enter into a non-disclosure agreement which must be executed together with the cooperation agreement with the Healthcare Facility.
Some business actors might consider using electronic system developed by MOH instead of third party ESO's electronic system for compliance reasons. There are several technical and compatibility requirements imposed under MOH Regulation 24 for the medical records electronic system, so business actors might need to do some compliance fine tuning if some of the technical or compatibility standards are not met the third party's software. However, it might not be easy to get hold on MOH's electronic system, as Healthcare Facilities are required to submit written request to MOH in order to obtain medical records electronic system developed by MOH. Currently, it is still unclear on how difficult it is for Healthcare Facilities to gain electronic system developed by MOH for electronic medical records.
3. Potential impact to telemedicine platform operators?
Healthcare Facilities is defined under MOH Regulation 24 as a device and/or location, used for providing healthcare services, either for providing promotive, preventive, curative or rehabilitative services to patients.
It is unclear whether the use of the term 'device' would mean that telemedicine platforms or electronic systems would also be considered as a Healthcare Facility.
If yes, then hypothetically ESOs that are currently operate telemedicine platform might need to implement electronic medical records as well for their platform and must comply with the requirements stipulated under MOH Regulation 24 that are required for Healthcare Facility. This will surely give a major impact to telemedicine operators, since compliance means more resources and it will also means additional complexities to their business model.
4. Featured requirements
|
Requirements
|
Description
|
|
Duration
|
Medical records must now be stored for at least 25 years after the patient's latest visit. Electronic medical record are maintained from the time a patient enters a Healthcare Facility until they return home, are referred to other Healthcare Facilities, or after they have passed away.
In addition to processing electronic medical record data, Healthcare Facilities that for certain reasons cannot maintain electronic medical records must carry out indexing. Indexing is an activity of grouping data at least in the form of the following:
- Patient's name
- Address
- Type of disease
- Action or operation
- Demise
|
|
Storage
|
In essence, electronic medical record storage is a storage activity in a digital-based media in Healthcare Facilities. Such media can be in any of the following forms:
- Server
- Certified cloud computing in accordance with prevailing laws and regulations
- Other digital-based media in accordance with the development of certified technology and information
Electronic medical record storage must ensure the safety, completeness, confidentiality and availability of the electronic medical records. Further, Healthcare Facilities must also have a backup system that is carried out following the below requirements:
- Placed in a different location from the Healthcare Facilities
- Periodically completed
- Inserted in each of the Healthcare Facilities' standard operational procedures
Electronic medical records that are stored by Healthcare Facilities must be connected with an interoperable service platform and healthcare integrated data that is managed by the MOH.
If there is a shortage of resources in Healthcare Facilities, medical records can be stored through cooperation with an ESO that has data storage facilities in Indonesia. Healthcare Facilities that cooperate with an ESO that has storage facilities in Indonesia must obtain unlimited access to the stored electronic medical records.
However, the ESO must obtain a recommendation from the MOH's work unit that is responsible for managing data and information.
|
|
Technical &
Compatibility
|
Healthcare Facilities must prepare standard operating procedures for the administration of medical records that are in accordance with the needs and resources of each of the Healthcare Facilities by referring to the electronic medical record guidelines.
Note that the MOH also facilitates the maintenance of electronic medical records in Healthcare Facilities by providing the following aspects:
(a) Electronic systems in the administration of electronic medical records
(b) Service platforms and interoperability standards and the integration of health data
The electronic system used to maintain electronic medical records must have compatibility and/or interoperability capabilities. As a background, compatibility means the compatibility of one electronic system with another electronic system, while interoperability means different electronic systems' ability to work in an integrated manner to communicate or exchange data with one or more other electronic systems using data exchange standards.
The aforementioned compatibility and/or interoperability must refer to metadata variables determined by the MOH, which consist of a definition, format and codification.
|
|
Minimum Activities
|
MOH Regulation 24 specifically stipulates that Healthcare Facilities must at least conduct the following activities in connection with carrying out medical records activities:
- Patient registration
- Distribution of medical record data
- Filling in clinical information
- Electronic medical record information process
- Data entry for payment claims
- Electronic medical record storage
- Electronic medical record quality assurance
- Electronic medical record content transfer
Points (a), (b), (d), (e), (f), (g) and (h) above must be carried out by a medical recorder or health information personnel and can also be done in cooperation with other work units. However, if there is a shortage of medical recorder or health information personnel, the electronic medical record can be carried out by another healthcare professional ("HCP") trained to process electronic medical records. Point (c) must be done by the HCP that provides healthcare services.
|
|
Ownership
|
The 'content' of medical records are primarily owned by and must be relayed to the patient, while the medical records 'document' itself is considered as owned by each Healthcare Facility.
The contents may also be relayed to the closest family members or other parties. Under MOH Regulation 24, medical records must contain at least the following aspects:
- Patient's identity
- Results of physical examination and supporting examination
- Diagnosis, treatment and follow-up plans for health services
- Name and signature of the HCP responsible for the healthcare service
|
|
Registrations
|
ESO whose electronic system is utilized by Healthcare Facilities for carrying out electronic medical records is subject to ESO registration requirement at MOCI as ESO for healthcare electronic system.
In addition to the above, Healthcare Facilities that carry out electronic medical records or ESOs are obliged to register their electronic system with the MOH. The registration must be carried out by attaching, at least, the following documents:
- Name of the electronic system
- System's documentation
- Available feature or function
- Data storage location
- Metadata variable
- List of Healthcare Facilities that use the electronic system (if the electronic system is being used by other Healthcare Facilities)
|
|
Change of Data
|
If any data changes, Healthcare Facilities that carry out electronic medical records or ESOs must report it to the MOH.
|
5. Disclosure of contents of medical records
The contents of medical records must be kept confidential by all parties that have access to the patient's health data and information, even after the patient's demise. However, please be informed that under MOH Regulation 24, medical records can be disclosed either with or without consent from the patient for certain reasons. Please see below the differences.
|
|
With consent
|
Without consent
|
|
Reason for opening medical records
|
The contents of medical records can be disclosed with the patient's consent for any of the following reasons:
- Health maintenance, treatment, healing and patient care
- Patient's own request
- Administrative needs, insurance payments or health financing guarantees
|
The contents of medical records can be disclosed without the patient's consent for any of the following reasons:
- Law enforcement officers' request
- Ethics or discipline enforcement
- Medical audits
- Extraordinary events/outbreaks of infectious diseases/public health emergencies/ disaster handling
- Education and research
- Protection of the safety of others individually or in the community from dangers or threats
- Other matters regulated under laws and regulations
|
|
Parties who have the right to request
|
MOH Regulation 24 does not provide definite information regarding parties who have the right to request medical records with consent.
However, requests for disclosure are submitted to the head of the Healthcare Facility and must be agreed on by the patient or their closest family members (i.e., husband/wife, adult children, biological parents and/or biological siblings) if the patient is not capable of giving their consent. Other than the aforementioned family members, the patient's heirs can give their approval to the request for disclosure.
|
Requests for disclosure are made by the authorized party or institution with the approval of the MOH. The disclosure of medical record contents is carried out without revealing the identity of the patient.
|
|
Release of rights: A patient or a patient's family member who publicizes the contents of a medical record through mass media is considered to have released their right to keep the contents of the medical records confidential. As a consequence, Healthcare Facilities have the right to disclose the contents of medical records as a right to reply.
|
6. Sanctions
Under MOH Regulation 24 and in contrast to the Previous Regulation, Healthcare Facilities that do not comply with the electronic medical records obligation may face either of the following forms of administrative sanctions:
- Written warnings
- A recommendation on the revocation of their accreditation status
- Revocation of their accreditation status
Conclusion
Overall, the new electronic medical records obligations stipulated under MOH Regulation 24 provide more detailed guidelines for Healthcare Facilities to implement. Relevant business actors should consider MOH Regulation 24 as the primary guidelines to understand the new legal framework for conducting electronic medical records.
As such, it is important for Healthcare Facilities to understand and identify the compliance actions that are applicable to them and that they need to implement in respect to MOH Regulation 24. Especially, business actors operating telemedicine platforms should closely monitor the progress on how MOH will fully implement the requirements in practice and establish a close line of communication with MOH on this regard.
Note that electronic medical records need to be implemented by Healthcare Facilities by 31 December 2023 at the latest, so the regulation will only come into full force as of 31 December 2023, and business actors should have ample time to adapt to the new regime of requirements. Like with other regulations with delayed implementation time, we expect some trial and errors in MOH during that period.
* * * * *
© 2022 HHP Law Firm. All rights reserved. HHP Law Firm is a member firm of Baker & McKenzie International. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
