Health information is 민감정보 under 개인정보 보호법 제23조, so a clinic processes it only with consent taken separately from other consents, or where a law requires or allows it. A leak is told to the patient and, for health information, reported to the PIPC within 72 hours.
Sensitive information, separate consent
개인정보 보호법 제23조 names health among the categories of 민감정보 and forbids processing them, except where the person was told the purpose, the items and the retention and gave consent separately from any other consent, or where a law requires or permits it. A clinic processing it must also take the safety measures of 제29조, from an internal management plan to keeping access logs.1 The Personal Information Protection Commission is the independent central administrative agency that enforces the Act.3
Consent the 의료법 adds
Before surgery, transfusion or general anaesthesia that could seriously harm the patient, 의료법 제24조의2 asks the doctor to explain the diagnosis, the need, method and content of the procedure, the doctors taking part, the usual side effects and what the patient must do, and to take consent in writing or as an electronic document. The patient may ask for a copy, and a change of method or lead doctor is told in writing.4 Leaving out the explanation or the written consent carries a fine of up to 3 million won.4
- Separate the health consent. One consent for health information, apart from consent for other personal information.
- Say what, why and how long. The purpose, the items, the retention period and the right to refuse.
- Secure it. An internal management plan, access control and access logs, under 제29조.
- Check every transfer abroad. Separate consent, a contract need disclosed in the privacy policy, a certification or an equivalence finding.
- Plan the 72 hours. Who tells patients and who reports to the PIPC when health information leaks.
- Take written consent for procedures. Before surgery, transfusion or general anaesthesia, as 의료법 제24조의2 asks.
- Patient ______ Date ______
- Separate consent for health information given, yes or no ______
- Purpose ______ Items ______ Retention ______
- Transfer abroad ______ Ground under 제28조의8 ______
- Procedure consent under 의료법 제24조의2 ______ Copy given ______
When information leaks
Under 개인정보 보호법 제34조 and 시행령 제39조, the clinic tells the people affected within 72 hours what leaked, when and how, what they can do and whom to contact. Under 시행령 제40조 it reports to the PIPC within 72 hours where 1,000 or more people are affected, where sensitive information such as health leaked, or where the leak came from outside access to its systems.12 Since 11 September 2026 the Act also asks for notice when a leak is likely. Processing health information without consent, or transferring data abroad unlawfully, can bring a surcharge of up to 3% of total revenue.1
Two more laws bear on an AI scribe. Article 31 of the 인공지능기본법 asks an AI business to tell users in advance that a service runs on generative or high-impact AI, and to label generative output.5 Article 14 of the 통신비밀보호법 forbids recording a non-public conversation between other people.6 The Seoul clinic guide covers the consent a scribe needs.
Questions
Is health information sensitive under Korean law?
Yes. 개인정보 보호법 제23조 names health among the 민감정보 that need separate consent or a legal basis.
How fast must a clinic report a leak of health data?
Within 72 hours to the people affected, and within 72 hours to the PIPC or its designated body, because health information is sensitive.
Can patient data be stored outside Korea?
Only on a ground in 개인정보 보호법 제28조의8, such as separate consent, a disclosed contract need, a recognised certification or an equivalence finding by the PIPC.
Sources
- 1국가법령정보센터, Ministry of Government Legislation, 2026개인정보 보호법, 법률 제21445호, in force 11 September 2026Read source
- 2국가법령정보센터, Ministry of Government Legislation, 2026개인정보 보호법 시행령, 대통령령 제36671호, in force 11 September 2026Read source
- 3개인정보보호위원회 (Personal Information Protection Commission), 2026기관소개Read source
- 4국가법령정보센터, Ministry of Government Legislation, 2026의료법, 법률 제21490호, in force 2 October 2026Read source
- 5국가법령정보센터, Ministry of Government Legislation, 2026인공지능 발전과 신뢰 기반 조성 등에 관한 기본법 (인공지능기본법), in force 21 July 2026Read source
- 6국가법령정보센터, Ministry of Government Legislation, 2026통신비밀보호법, in force 2 October 2026Read source
Written by the wai team from Korea Institute for Healthcare Accreditation (의료기관평가인증원) guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither the Ministry of Health and Welfare nor KOIHA endorses wai or any software.