How should a Japanese clinic record and report incidents?

Every clinic runs incident reporting and improvement under article 1-11 of the 医療法施行規則, and reports an unexpected death linked to its care to the 医療事故調査・支援センター without delay under article 6-10 of the 医療法. A leak of patient data goes to the PPC, and a cyber incident goes to the people on the contact chart the FY2026 checklist asks for.

Incidents inside the clinic

The enforcement regulation requires every clinic's 管理者 to run incident reporting and other improvement measures, to train staff and to keep records of medical safety.¹ MHLW's notice asks inspectors to check that incidents are reported, analysed and turned into improvements shared across the facility, with root causes examined for serious ones.³

Four reports a clinic may owe

Article 6-10 requires the 管理者 to report a 医療事故, a death or stillbirth caused or suspected to be caused by care that the 管理者 did not expect, to the 医療事故調査・支援センター without delay, after explaining to the family.² A leak of medical data goes to the PPC promptly, and in full within 30 days, or 60 where it may have been deliberate.⁴⁵ The FY2026 checklist asks every clinic for a contact chart covering its vendor, MHLW and the police, backups with a tested recovery and a BCP that assumes an attack.⁶

1. Write the route. Who reports, to whom, and how fast, in the safety guideline.
2. Record the facts. What happened, when, to whom and who was there, from the record and the audit trail.
3. Decide what is owed. An unexpected death, a data leak or a cyberattack each has its own report.
4. Find the cause. For serious events, the background and the root cause.
5. Fix and share. The improvement, its owner and its date, told to every member of staff.
6. Check it worked. Review the measure at the next safety meeting or training.

1. Date and time ______ Reported by ______
2. What happened ______
3. Reports owed 医療事故 ______ PPC ______ Cyber ______
4. Cause ______
5. Improvement ______ Owner ______ Due ______
6. Staff told on ______ Reviewed on ______

Copy template

Questions

Does a small clinic need a safety committee for incidents?

No, the committee is required of hospitals and clinics with beds. Every clinic still runs incident reporting and improvement and keeps records of it.

Which deaths go to the 医療事故調査・支援センター?

A death or stillbirth caused or suspected to be caused by the clinic's care that the 管理者 did not expect, as the 医療法 and its ordinance define it.

Who does a clinic call in a cyberattack?

The people on its contact chart, which the FY2026 checklist asks to cover the vendor, MHLW and the police.

Sources

1. 1e-Gov法令検索, Digital Agency, 2026医療法施行規則 (Ordinance for Enforcement of the Medical Care Act)Read source
2. 2e-Gov法令検索, Digital Agency, 2026医療法 (Medical Care Act), Act No. 205 of 1948Read source
3. 3Ministry of Health, Labour and Welfare, 2025令和７年度の医療法第25条第１項の規定に基づく立入検査の実施について, 医政発0627第９号, 27 June 2025Read source
4. 4e-Gov法令検索, Digital Agency, 2026個人情報の保護に関する法律 (Act on the Protection of Personal Information), Act No. 57 of 2003Read source
5. 5e-Gov法令検索, Digital Agency, 2026個人情報の保護に関する法律施行規則 (PPC enforcement rules)Read source
6. 6Ministry of Health, Labour and Welfare, 2026令和8年度版 医療機関・薬局におけるサイバーセキュリティ対策チェックリスト, June 2026Read source

Written by the wai team from Ministry of Health, Labour and Welfare, with the prefectures and public health centres guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither MHLW nor any prefecture or public health centre endorses wai or any software.