How does the APPI apply to patient data in a Japanese clinic?

A patient's medical history is 要配慮個人情報 under the APPI, so a clinic needs consent to collect it, posts its purposes of use, protects it and supervises the staff and contractors who handle it. A leak of it is reported to the 個人情報保護委員会 promptly and in full within 30 days, and the patient is told.

What the law requires

The APPI names a person's medical history among 要配慮個人情報, which a business may not acquire without the person's prior consent except in cases the law lists.¹ The business must notify or publish its purposes of use, take the security measures needed to prevent leaks, loss or damage, and supervise its staff and any contractor it entrusts with the data.¹ It needs consent before giving personal data to a third party, or to a third party abroad, outside the cases the law allows, and must disclose a person's data when asked.¹

What the guidance adds for clinics

The PPC and MHLW guidance for medical and care providers, revised in April 2026, covers hospitals, clinics and pharmacies.² It asks a clinic to post its purposes of use in the clinic and on its website, treats a patient who raises no objection to posted care purposes as consenting to those uses, and asks for organisational, personal, physical and technical safeguards.²

1. Post the purposes. The 利用目的 in the clinic and on the website, with uses beyond care named separately.
2. Take consent where needed. For sensitive data, for third parties, and for any provider abroad outside the law's exceptions.
3. Secure the data. Named accounts, access by role, an access log, and contractors supervised under contract.
4. Train the staff. Who may see what, and what to do the moment a leak is suspected.
5. Set the leak clock. A prompt first report to the PPC, the full report within 30 days, and the patient told.
6. Answer disclosure. A route for patients to ask for their data, answered without delay.

1. Discovered on ______ By ______
2. Data involved ______ Patients affected ______
3. First report to the PPC on ______
4. Full report due ______ Sent on ______
5. Patients told on ______ How ______
6. Cause ______ Measures to prevent it ______

Copy template

Reporting a leak, and what is changing

A leak, loss or damage of personal data that includes 要配慮個人情報 must be reported to the PPC, unless it was protected by strong encryption, and so must any leak affecting more than 1,000 people.³ The first report goes promptly after the clinic learns of it, and the full report within 30 days, or 60 days where the leak may have been deliberate.³ The amended APPI was promulgated on 17 July 2026 and takes effect on a date set by cabinet order within two years, so the current rules apply until then.⁴ MHLW's notice to inspectors reminds them of the duty to report leaks, including those caused by a cyberattack.⁶ Where records are stored with an outside provider, the security guideline asks the clinic to tell patients in advance.⁵

Questions

Does a clinic need written consent for every use of patient data?

The guidance treats a patient who raises no objection to the care purposes posted in the clinic as consenting to those uses. Uses beyond care, and most third-party provision, need consent.

How fast must a clinic report a leak of medical data?

Promptly after learning of it, then in full within 30 days, or 60 days where the leak may have been deliberate, and the patient is told.

Is the amended APPI in force?

Not yet. It was promulgated on 17 July 2026 and takes effect on a date set by cabinet order within two years.

Sources

1. 1e-Gov法令検索, Digital Agency, 2026個人情報の保護に関する法律 (Act on the Protection of Personal Information), Act No. 57 of 2003Read source
2. 2Personal Information Protection Commission, 2026医療・介護関係事業者における個人情報の適切な取扱いのためのガイダンス, revised April 2026Read source
3. 3e-Gov法令検索, Digital Agency, 2026個人情報の保護に関する法律施行規則 (PPC enforcement rules)Read source
4. 4Personal Information Protection Commission, 2026個人情報の保護に関する法律等の一部を改正する法律の公布について, 17 July 2026Read source
5. 5Ministry of Health, Labour and Welfare, 2026医療情報システムの安全管理に関するガイドライン 第7.0版 企画管理編Read source
6. 6Ministry of Health, Labour and Welfare, 2025令和７年度の医療法第25条第１項の規定に基づく立入検査の実施について, 医政発0627第９号, 27 June 2025Read source

Written by the wai team from Ministry of Health, Labour and Welfare, with the prefectures and public health centres guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither MHLW nor any prefecture or public health centre endorses wai or any software.