Which documents and policies does a clinic in Japan need?

Every clinic's 管理者 keeps a written medical safety guideline, trains staff, runs incident reporting, infection control and medicines and device safety, and records it all under article 1-11 of the enforcement regulation. Beside those sit the cybersecurity rules, the posted notice of who practises when and the 利用目的 the APPI guidance asks clinics to post.

The safety system the 施行規則 sets

Article 1-11 of the 医療法施行規則 requires every clinic's 管理者 to keep a 医療に係る安全管理のための指針, to train staff in medical safety, to run incident reporting and improvement, and to keep records of it.¹ A safety committee and a dedicated safety manager are required of hospitals and of clinics with beds.¹ Every clinic also needs an infection control guideline, training and reporting, a 医薬品安全管理責任者 with written medicines procedures, and a 医療機器安全管理責任者 with a maintenance plan.¹

What the safety guideline must cover

MHLW's 要綱 lists what the guideline sets down in writing, the clinic's basic approach to safety, its organisation, the staff training policy, the incident reporting and improvement policy, how to respond when an accident happens, how information is shared with patients, including their access to the guideline, and how patient enquiries are handled.³

1. Write the safety guideline. The basic approach, the organisation, training, incident reporting, accident response, patient information and enquiries.
2. Name the leads. A 医薬品安全管理責任者 and a 医療機器安全管理責任者, with their duties in writing.
3. Write infection control. A guideline, a training plan and a route for reporting infections.
4. Write the system rules. The 運用管理規程 the cybersecurity checklist asks for, covering access, accounts, backups and incidents.
5. Post the notices. The 管理者, the doctors and their hours, and the clinic's purposes for using personal data.
6. Record training. Date, attendees and topics for every session.

1. Document ______ Rule ______
2. Owner ______ Approved by the 管理者 on ______
3. Last reviewed ______ Next review ______
4. Staff told on ______ Training held on ______
5. Where it is kept ______

Copy template

The cybersecurity rules and the posted purposes

Article 14 of the 施行規則 requires the 管理者 to take the measures needed to secure cybersecurity, and MHLW's FY2026 checklist asks that each measure is written into the clinic's operating rules.¹⁴ The 医療法 requires the 管理者, the doctors and their hours to be posted where patients can see them.² The PPC and MHLW guidance asks clinics to post their purposes for using personal information in the clinic and on their website.⁵

Questions

Does a small clinic need a safety committee?

No, the committee and the dedicated safety manager are required of hospitals and clinics with beds. Every clinic still needs the guideline, training and incident reporting.

Does a clinic need a medicines safety lead?

Yes, every hospital and clinic names a 医薬品安全管理責任者, who trains staff and keeps written procedures for using medicines safely.

Where should the 利用目的 be posted?

In the clinic where patients can see it, and on the website, as the PPC and MHLW guidance describes.

Sources

1. 1e-Gov法令検索, Digital Agency, 2026医療法施行規則 (Ordinance for Enforcement of the Medical Care Act)Read source
2. 2e-Gov法令検索, Digital Agency, 2026医療法 (Medical Care Act), Act No. 205 of 1948Read source
3. 3Ministry of Health, Labour and Welfare, 2025医療法第25条第１項の規定に基づく立入検査要綱, revised June 2025, 医政発0627第７号Read source
4. 4Ministry of Health, Labour and Welfare, 2026令和8年度版 医療機関・薬局におけるサイバーセキュリティ対策チェックリスト, June 2026Read source
5. 5Personal Information Protection Commission, 2026医療・介護関係事業者における個人情報の適切な取扱いのためのガイダンス, revised April 2026Read source

Written by the wai team from Ministry of Health, Labour and Welfare, with the prefectures and public health centres guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither MHLW nor any prefecture or public health centre endorses wai or any software.