Disclaimer
This guide solely covers the PDPA aspects of healthcare software and patient data. Private healthcare legislation, Ministry of Health requirements, and professional codes on confidentiality and medical records apply independently and, where more demanding, prevail. Providers should confirm their position under those regimes alongside their PDPA obligations.Healthcare providers in Malaysia often use software solutions to store and manage patient medical records, which is considered sensitive personal data under Malaysia’s PDPA and imposes strict confidentiality duties on top of existing obligations.
To help healthcare providers and SaaS vendors stay compliant while handling some of the most sensitive personal data a Malaysian business is ever given access to, this guide covers:
- the three layers of obligation that apply to patient data
- the registration requirement most healthcare providers are caught by
- what the PDPA effectively requires of the software itself
- what to ask a vendor before adopting a clinic or hospital system
Note: For obligations that apply to healthcare providers and beyond just software, see our guide to PDPA for medical practitioners.
Three layers of obligation
Healthcare providers should approach compliance with patient data as three separate sets of obligations operating at the same time, and the software must satisfy all three.
| Layer | What it adds |
| PDPA | Health information is sensitive personal data, so explicit consent applies, alongside the seven principles covering security, retention, access and the rest. |
| Healthcare sector regulation | Private healthcare legislation imposes its own medical records requirements, including how records are kept and for how long. These operate independently of the PDPA and can require longer retention than a business would otherwise choose. |
| Professional confidentiality | Practitioners owe duties of confidentiality under professional conduct rules. A disclosure can breach professional obligations even where a PDPA basis exists. |
The practical consequence is that PDPA compliance alone is not a complete answer in a healthcare setting. A system configured to delete records efficiently may satisfy the Retention Principle while breaching a sector retention requirement.
Healthcare provider data controller registration
Under the Personal Data Protection (Class of Data Users) Order 2013 healthcare providers are legally required to register as data controllers with the Commissioner and are issued a certificate of registration, which must be renewed and displayed.
This is a standing statutory obligation, distinct from general PDPA compliance. Failing to register when required is an offence in its own right.
Healthcare SaaS data processor obligations
Software vendors serving the healthcare sector should be aware that a vendor holding patient data on behalf of clinics may be a data processor rather than a data controller, which affects whether registration applies to it, but the 2024 amendments imposed direct security obligations on data processors, so a vendor cannot treat compliance as entirely their client’s problem.
What the PDPA requires of the software
The Security Principle requires practical steps proportionate to the nature of the data and the harm that would result from its loss or misuse. For patient records, that sits at the high end and in system terms this normally requires the following.
| Requirement | Description |
| Role-based access controls | Restrict access based on job responsibilities. For example, a receptionist managing appointments does not need access to clinical notes. Allowing every logged-in user to view every record is a common weakness in smaller clinic deployments. |
| Audit trails | Record who viewed, amended, printed or exported each patient record, and when. This helps detect internal misuse and establish the scope of an incident quickly. |
| Data encryption | Encrypt data at rest and in transit, including data accessed through mobile phones or tablets at the bedside or in consultation rooms. |
| Controlled export | Restrict bulk downloads and the sending of records through email or messaging apps. Convenience features can be a frequent source of data leakage. |
| Configurable retention | Allow different retention periods for different record types and flag records subject to sector-specific retention requirements to prevent premature deletion. |
| Access request support | Enable the extraction of a patient’s complete record in an intelligible format when an access request is received, without requiring manual searches through individual records. |
See our guide to the PDPA Security Principle for how proportionality is assessed.
What to ask a vendor before adopting a system
To ensure PDPA compliance, ensure the following questions receive satisfactory answers:
- Where is the data physically hosted? On-premise, Malaysian data centre, or overseas cloud. This determines whether cross-border transfer rules are engaged.
- Who at the vendor can access patient data? Support staff often have broad access for troubleshooting. Ask how that access is controlled, logged, and revoked.
- What happens to the data if we leave? Export format, transition assistance, and confirmed deletion from the vendor’s systems and backups.
- What is the breach notification commitment? The healthcare provider carries the notification obligation to the Commissioner, so it needs the vendor to alert it fast enough to meet that deadline.
- Does the system support audit trails and role-based access out of the box, or only on a higher tier?
- Is there a written data processing agreement, and does it reflect how the system is actually used?
Where hosting is overseas, the arrangement needs to be assessed under the cross-border transfer rules.
Patient consent and digital records
Health information requires explicit consent, which means a clear affirmative act specific to that category of data rather than consent bundled into general registration terms, and two situations come up often:
Migrating from paper to digital
Converting existing records into a new system is a change in how data is processed and stored. The purpose has not changed, but the risk profile has, and the patient privacy notice should reflect where records now sit and who can access them.
Sharing between providers
Referrals, group practices, and shared platforms involve disclosure to a separate entity. Common ownership does not remove the need for a proper basis, and this should be addressed in the privacy notice at registration.
Breach exposure in a healthcare setting
A data breach involving patient records is close to the worst case the PDPA contemplates as it is highly capable of causing significant harm. Where the breach originates with a software vendor, the healthcare provider is still the one that must notify the Commissioner and data subjects within the statutory timeframes.
A practical checklist
These should sit within a broader PDPA compliance framework:
- Review access rights in the system and remove anything not justified by role.
- Confirm audit trails are enabled and that someone actually reviews them periodically.
- Establish where data is hosted and assess any overseas hosting under the cross-border rules.
- Put a written agreement in place with the software vendor covering security, breach alerting, and deletion on exit.
- Check the patient privacy notice actually describes how records are now held and shared.
- Consider whether a Data Protection Officer is required, given the volume and sensitivity of the data processed.
Furthermore, in most healthcare settings the ongoing ownership belongs with a Data Protection Officer.
PDPA compliance in 90 days
We advise Malaysian clinics and health-tech vendors on patient data protection, including data controller registration, reviewing software vendor agreements before adoption, drafting patient privacy notices and consent forms, and acting as outsourced Data Protection Officer. If you are selecting a clinical system or reviewing an existing one, book a consultation with us.
