Personal medical data and digital health

In short

Personal medical data are personal data on a person’s health and the medical services provided to them (Health Code, Art. 58(2)). They are covered by medical confidentiality (Art. 273(1)). Data are collected in the course of medical care and transferred to third parties with the patient’s consent, save as provided by law (Art. 60). Details are in the Ministry of Health Rules No. KR DSM-30: processing only for medical care, notifying the patient of every use of their data, storage on servers in Kazakhstan.

Medical confidentiality

Confidentiality covers personal medical data, the fact of seeking medical help, the state of health, the diagnosis and other information obtained during examination and treatment (Art. 273(1)).

• With consent, the information may be shared for scientific research and teaching (Art. 273(3)).
• Without consent, only in a closed list of cases (Art. 273(4)), including: treating a person unable to express their will; a threat of spreading dangerous diseases; requests from investigators, prosecutors, lawyers and courts; informing the legal representative of a minor; suspicion that harm to health was caused unlawfully; quality control of medical services; requests from special state bodies; establishing an insured event.
• Not a disclosure: transferring a backup to the unified backup platform, and digital exchange of information for medical care (Art. 273(5)).
• Linking to other databases. Digital resources containing personal medical data may not be connected to networks linking them to other databases without the individuals’ consent, save in the cases listed in the law (Art. 273(6)).

Digital health

• Collection. Data for electronic medical records are collected in the course of medical care, taking into account the patient’s informed consent to receive care (Art. 60(1)).
• National electronic health passport. Healthcare providers must transfer data to it (Art. 60(2)); this transfer does not require the patient’s consent (Art. 60(4)).
• Third parties receive data with the patient’s consent, save as provided by law (Art. 60(3)).
• Copies of identity documents may not be collected, except those of immigrants (Art. 60(1-1)).

Who gets access

With the patient’s consent, access is given to medical and pharmaceutical providers, the fund reimbursing healthcare costs, health authorities and others on a closed list — only to the extent needed for their services (Art. 61(1)). In emergency and urgent care, access is granted by default (Art. 61(2)). The procedure is set by rules on delimiting access rights, which the Ministry of Health agrees with the personal data regulator (Art. 61(4)).

Patients may see their health information in the electronic health passport and the log of access to their data (Art. 61(5)). For analytics, statistics and research, data are used in de-identified form (Art. 61(9)). Information from medical digital resources is used only in the performance of official duties (Art. 62(3)).

Ministry of Health rules

The Rules No. KR DSM-30 specify:

• consent: in writing, as an electronic document or through the user account on the e-government portal (para 6);
• purpose: processing solely for providing medical care (para 12);
• notification: the patient automatically receives messages in the e-government account about every use, change and addition of their data (para 14);
• research: de-identification (para 15); sharing for research and teaching requires informed consent (para 16);
• localisation: storage on servers physically located in Kazakhstan (para 19);
• patient request: an answer or a reasoned refusal within 3 working days (paras 28–29).

Interpretation. Under para 13 of the Rules, corrections to patient data are made within three working days, while the Personal Data Law requires data to be changed within one working day (Art. 25(2)(8)). The Law prevails, so it is safer to work to one working day.

Medical data as restricted-access data

Medical confidentiality is the main example of restricted-access data (see the note “Types of personal data”). It follows that:

• enhanced protection measures apply, including encryption and access logs (Protection Rules, para 15);
• processing goes through digital objects located in Kazakhstan (para 16);
• the operator moves up one category (para 17). A clinic with 10,000 patients or more becomes a large operator and must notify the regulator (see the note “Notification of the regulator and the register of operators”).

Liability

Persons failing to apply protection measures for medical data, resulting in loss or unlawful processing, are liable under the law (Health Code, Art. 61(8)), i.e. under Art. 79 of the Code of Administrative Offences and Art. 147 of the Criminal Code (see the note “Liability for breaches of personal data law”).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Status of health data	Medical confidentiality, restricted-access data	Special category (Art. 9(1))
Ground for treatment	Informed consent to medical care, law	Health care under professional secrecy (Art. 9(2)(h), Art. 9(3))
Research	Informed consent or de-identification	Safeguards under Art. 89, specific grounds under EU or national law
National database	National electronic health passport, transfer without consent	European Health Data Space (Regulation 2025/327)
Access log for the patient	Yes (Art. 61(5))	Right of access (Art. 15)

Open questions

Open question: apps and wearables. Are fitness apps and services that are not healthcare providers but collect health indicators covered by the Health Code regime?

Open question: linking to other databases. How broadly should the ban in Art. 273(6) be read: does it cover integrating a clinic’s medical system with a CRM, an insurer or a laboratory?

Open question: foreign telemedicine. How can consultations with foreign clinics be reconciled with the duty to store data on servers in Kazakhstan and with the cross-border transfer rules?

Still to research

• Rules on delimiting access rights of digital health entities (Art. 61(4) of the Code).
• Rules on personal medical data aggregators (Art. 58(3) of the Code).
• Enforcement practice against clinics for medical data breaches.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.