Health and Medical Data in China

Health and medical data in China: what makes it different

Health and medical data in China sits at the intersection of four regimes: personal information protection, data security, health sector regulation and biosecurity. Medical and health information is sensitive personal information under the Personal Information Protection Law (PIPL), so it requires a specific purpose, strict necessity, separate consent and a prior impact assessment. Large datasets may be important data under the Data Security Law. Hospitals and other medical and health institutions are subject to sector rules that were updated in early 2026. And samples and genetic information derived from Chinese individuals fall under the human genetic resources regime, which restricts foreign access independently of data protection law.

For pharmaceutical companies, device makers, contract research organisations, digital health platforms and insurers, the consequence is that a single dataset may need several analyses. A clinical trial database, for example, can contain sensitive personal information of patients, human genetic resources information from biomarker testing, and data that a sector catalogue treats as important. Each layer has its own approvals and transfer tests, and passing one does not satisfy the others.

The practical goal is to design studies, products and data flows so that the right legal pathway is identified before collection starts. Retrofitting consent or seeking human genetic resources approval after samples have been tested is slow, and in some cases impossible.

The regulatory map for health and medical data

The table below summarises the main sources of obligations. Several health sector documents are labelled as trial measures, which in Chinese practice means they are binding but expected to be refined.

The February 2026 measures for medical and health institutions were issued jointly by the National Health Commission (NHC), the Ministry of Public Security, the Cyberspace Administration of China (CAC), the National Administration of Traditional Chinese Medicine and the National Disease Control and Prevention Administration. They require institutions to classify data into three tiers, assign responsibility to those who manage, operate or use data, and apply stronger technical controls, including encryption in storage and transmission, to higher tiers. Provinces have begun issuing local implementing rules. The texts are available through the NHC.

Enforcement risk is real and cumulative. PIPL violations can attract fines of up to RMB 50 million or 5 per cent of the previous year's turnover for serious cases, together with orders to suspend services and liability for responsible managers. The amended Cybersecurity Law, in force since 1 January 2026, increased fines for network security failures. Health authorities can impose sector sanctions on institutions and staff, and unlawful sale or provision of personal information can be a crime under the Criminal Law. Patients may also bring civil claims, with the PIPL placing the burden on the processor to prove it was not at fault.

Processing health and medical data as sensitive personal information

The PIPL sets a demanding standard for sensitive personal information. A processor may handle it only for a specific purpose and where sufficiently necessary, with strict protective measures. In practice that translates into the following steps for anyone processing health and medical data:

1. Purpose and necessity. Define a specific purpose, such as delivering a telemedicine consultation, and limit fields to what that purpose needs.
2. Notice. Explain why sensitive information is needed and the impact on the individual, in addition to the general notice items.
3. Separate consent. Obtain consent specifically for the sensitive processing, not bundled with terms of service. Written consent applies where laws or regulations require it.
4. Impact assessment. Complete and retain a personal information protection impact assessment before processing, and before any entrusted processing, sharing, publication or cross-border transfer.
5. Minors. For children under 14, obtain consent from a parent or guardian and apply specific processing rules.

Consent is not the only basis. Processing necessary to respond to a public health emergency or to protect life, health and property in an emergency can proceed without consent, and processing necessary to perform a contract with the individual may be lawful. However, these bases are interpreted narrowly, and the sensitive-data safeguards still apply. Wearables and wellness apps are a grey area: heart rate or sleep data may be health information depending on context, and the safe course is to treat it as sensitive.

Secondary use is where many projects stumble. A dataset collected for treatment, a trial or customer service cannot automatically be reused for product development, real-world evidence studies or model training. Each new purpose needs a lawful basis and, for sensitive information, separate consent unless the data has been genuinely anonymised. Anonymisation in the PIPL sense is a high bar: the data must be processed so that individuals cannot be identified and the process cannot be reversed. Companies relying on it should document the technique used, test re-identification risk and restrict linkage with other datasets. De-identified data that falls short of that standard remains personal information.

Human genetic resources: the rule that catches researchers

Human genetic resources include materials such as organs, tissues and cells containing the human genome, and information such as genetic data derived from them. The regime restricts the collection, preservation, use and export of these resources, and places particular limits on foreign organisations, individuals and entities they establish or actually control. Since 1 May 2024, administration has rested with the NHC rather than the Ministry of Science and Technology.

The Implementing Rules, effective 1 July 2023, clarified that entities with less than 50 per cent foreign ownership and no other form of foreign control are not treated as foreign parties, which helped many joint ventures and listed companies with foreign shareholders. They also refined the categories of activity that need approval and those that only need filing. International cooperation in scientific research, including many multi-regional clinical trials, needs approval or filing depending on whether materials leave China. Providing human genetic resources information to a foreign party, or making it available for foreign use, triggers a filing and, where it may affect public health, national security or the public interest, a security review.

The regime is easy to underestimate because it applies to information as well as samples. Genomic sequencing results, biomarker data or other genetic data generated from Chinese samples can fall within it even if the samples never leave China. Companies should map these flows separately from their general personal information transfers.

Practical steps reduce friction. Sponsors should identify at protocol stage whether samples will be tested in China or abroad, whether any genetic data will be generated, and which parties are foreign under the 2023 rules. Contracts with sites and central laboratories should allocate responsibility for approvals and filings, and timelines should allow for review. Where data must be shared abroad, providing analysis results rather than raw sequencing data can sometimes simplify the position, but this should be confirmed with licensed PRC counsel before the study plan is fixed.

Moving health and medical data across borders

Exports of health and medical data must clear each applicable regime. Under the cross-border data provisions of March 2024, the mechanism depends on volumes counted cumulatively from 1 January of the current year, and on whether the data is important data or comes from a critical information infrastructure operator. Because medical information is sensitive, the relevant thresholds are lower than for ordinary personal information.

The certification route has its own measures, issued by the CAC and the State Administration for Market Regulation and in force from 1 January 2026. Separately, pilot free trade zones may publish negative lists that specify which data requires a mechanism; companies registered in those zones should check whether a list covers their data. Our guide to cross-border data transfer explains each mechanism, and primary texts are published on the CAC website and the national laws database.

Remember too that a transfer can be lawful under data protection rules and still prohibited under the human genetic resources regime, or vice versa. Contractual pathways such as key-coded data, aggregated reporting and remote access from abroad still need analysis: remote viewing of data stored in China is generally treated as a transfer.

Sector scenarios and a worked example

• Pharmaceutical companies. Pharmacovigilance reports, medical information enquiries and clinical trial data often flow to global safety databases. See our pages on pharmaceuticals and biotech licensing and business development.
• Device makers. Connected devices send usage and physiological data to cloud platforms; remote servicing can expose patient data. See medical devices.
• Hospitals, clinics and insurers. Foreign-invested hospitals and health insurers handle large volumes of records and claims data and are directly within the February 2026 measures where they are medical and health institutions. See healthcare services and health insurance.
• AI developers. Training diagnostic models on clinical data raises consent, anonymisation and genetic resources questions; see healthcare AI.

Consider a European sponsor running a multi-regional oncology trial with 600 patients at Chinese sites. Patient case report forms are pseudonymised at the sites; tumour samples are tested in a central laboratory in China; and the sponsor wants the coded clinical data and sequencing results in its global database. The analysis covers sensitive personal information (below 10,000 individuals, so a standard contract or certification), the human genetic resources position (international cooperation approval or filing, plus a filing for providing genetic information abroad), and whether any dataset could be important data. Consent forms are drafted to cover each use and transfer, and the vendor contracts include matching obligations.

Compliance checklist for health and medical data

A sound programme for health and medical data in China typically includes:

• A data inventory distinguishing ordinary personal information, sensitive health information, human genetic resources information and potential important data.
• Classification against the three-tier approach of the February 2026 measures where the business is a medical and health institution, and against relevant sector catalogues otherwise.
• Consent templates with separate consent for sensitive processing and for transfers, in Chinese, tested against the actual user journey.
• Impact assessments retained for at least three years, as the PIPL requires.
• A cross-border register recording each flow, recipient, mechanism and filing number.
• Vendor and site agreements with data protection, security and incident reporting clauses.
• Incident response aligned with the CAC reporting measures, as explained in our page on data breach response.
• A compliance audit cycle; processors of personal information of more than ten million people must audit at least every two years.

Cross-border groups should also align their China programme with foreign regimes. In the EU, health data is special category data under the GDPR, and the European Health Data Space Regulation will introduce further rules on secondary use over the coming years. In Hong Kong, the Personal Data (Privacy) Ordinance applies, and mainland-Hong Kong arrangements in the Greater Bay Area have created facilitated channels for some personal information flows. Using a common inventory and risk methodology across these jurisdictions avoids duplicating effort.

How TRW & Co helps with health and medical data

We help life sciences, medical technology, digital health and insurance clients design compliant data strategies for China and connect them to their global programmes. We map data flows, structure study and product designs to reduce transfer burdens, prepare consent and contractual frameworks, and coordinate cross-border filings and human genetic resources workstreams with clinical, regulatory and IT teams. We advise on the laws of jurisdictions where our lawyers are qualified, including EU and Hong Kong requirements, and on international practice. Where PRC legal advice, approvals or filings with Chinese authorities are needed, we work with licensed PRC law firms. To discuss a project, please contact us.