What does MHLW's security guideline ask of a clinic in Japan?

Article 14 of the 医療法施行規則 requires every clinic's 管理者 to take the measures needed to secure cybersecurity, and MHLW's 医療情報システムの安全管理に関するガイドライン, revised to 第7.0版 in June 2026, sets out how. The FY2026 checklist turns its priorities into 19 yes or no items for the clinic, and the 保健所 reads it at the 立入検査.

The guideline and the rule behind it

MHLW revised the guideline to 第7.0版 in June 2026, in an overview and volumes for management, planning, system operation and maintenance contractors, with a Q&A updated in September 2026.¹ The enforcement regulation requires the 管理者 of every hospital, clinic and birth centre to take the measures needed to secure cybersecurity, so that care is not seriously disrupted.² The FY2026 checklist asks clinics to answer yes to every item during the year, and to write a target date beside each no.³

What the FY2026 checklist asks

1. Name the lead. A 医療情報システム安全管理責任者, with the authority to act.
2. List the systems. Every server, terminal and network device, and who maintains each one.
3. Set access by role. Each person sees what their job needs, and the administrators are named.
4. Close old accounts. Every leaver's account removed or disabled on their last day.
5. Plan for an incident. A contact chart, backups you have restored once, and a BCP that assumes an attack.
6. Write it down. Each measure in the operating rules, ready for the 保健所 to read.

1. Fiscal year ______ Safety lead ______
2. Items answered yes ______ of 19
3. Item ______ Target date ______ Owner ______
4. Contact chart updated on ______
5. Backup restored and tested on ______
6. Checklist shown at the 立入検査 on ______

Copy template

Where the records may sit

When a clinic stores medical information with an outside provider, the planning volume asks it to make sure the equipment holding the information is within reach of Japanese law, to check the country where it sits and whether foreign law applies to the provider, and to tell patients in advance, for example by a notice in the clinic.⁴ In FY2023 the cybersecurity item was met by 5,639 of the 6,188 hospitals checked on it, 91.1%, the lowest rate of any item.⁵ The 要綱 tells inspectors to confirm the checklist is filled in and to ask to see the incident contact chart.⁶

Questions

Is the security guideline law?

The guideline is MHLW's guidance. The duty to take cybersecurity measures is law, in article 14 of the 医療法施行規則, and the guideline sets out how.

Does the 保健所 check the cybersecurity checklist?

Yes, the FY2026 checklist says it is checked at the 立入検査, and the 要綱 asks inspectors to see the incident contact chart.

Does two-factor login have to be in place now?

The checklist accepts two-factor login in place now, or planned for the first system update from FY2027 onwards.

Sources

1. 1Ministry of Health, Labour and Welfare, 2026医療情報システムの安全管理に関するガイドライン 第7.0版, June 2026Read source
2. 2e-Gov法令検索, Digital Agency, 2026医療法施行規則 (Ordinance for Enforcement of the Medical Care Act)Read source
3. 3Ministry of Health, Labour and Welfare, 2026令和8年度版 医療機関・薬局におけるサイバーセキュリティ対策チェックリスト, June 2026Read source
4. 4Ministry of Health, Labour and Welfare, 2026医療情報システムの安全管理に関するガイドライン 第7.0版 企画管理編Read source
5. 5Ministry of Health, Labour and Welfare, 2026医療法第25条に基づく病院に対する立入検査結果 (令和５年度), published 29 May 2026Read source
6. 6Ministry of Health, Labour and Welfare, 2025医療法第25条第１項の規定に基づく立入検査要綱, revised June 2025, 医政発0627第７号Read source

Written by the wai team from Ministry of Health, Labour and Welfare, with the prefectures and public health centres guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither MHLW nor any prefecture or public health centre endorses wai or any software.