This research is a normative legal study aimed at analyzing the norms governing the protection of patients' medical records under Law Number 17 of 2023 on Health and Law Number 27 of 2022 on Personal Data Protection, as a doctrinal review of related legislation. The method used is a juridical-normative approach through library research of statutory regulations, article explanations, legal doctrines, and secondary legal literature to explore the principles, rights, and obligations of data subjects and controllers. The normative analysis highlights the alignment of the principle of medical record confidentiality as stipulated in Article 177 paragraph 1 of Law Number 17 of 2023 on Health and the obligation to maintain the confidentiality of Personal Data under Article 36 of Law 27/2022, as well as patients’ right to access as regulated in Article 276 of Law 17/2023. The research findings identify an overlap between the long-term retention provisions of medical records and the "right to erasure" principle, which is not specifically regulated in Law 27/2022, thereby indicating the need for harmonization of norms and technical guidelines in the health sector. These findings underscore the importance of formulating a Government Regulation to implement Article 299 of Law 17/2023 in order to bridge the obligations of data retention and the mechanisms for erasing medical data, ensuring legal certainty and the protection of patients’ rights.
Widiarta et al. (Sat,) studied this question.