Personal medical data and digital healthcare.
Click a question to see a short answer. The detailed analysis with legal references is in the note below.
Medical data are covered by medical confidentiality and are restricted-access data. They are collected in the course of medical care, passed to third parties with the patient's consent (save as provided by law), stored on servers in Kazakhstan, and used for research only with consent or in de-identified form. The patient receives eGov notifications of every use of their data.
With the patient's consent, access is given to medical and pharmaceutical organisations, the fund paying for medical care and health authorities — only to the extent they need. In emergency care, access is open by default. The patient can see their data in the electronic health passport and a log of who accessed them.
Note
The special regime for personal medical data under the Health Code: medical confidentiality and when it may be lifted, the electronic health passport, who may access patient data and when, and Ministry of Health rules on consent, patient notification and storage in Kazakhstan.
Personal medical data, the fact of seeking care, health status and diagnosis constitute medical secrecy (Art. 273(1)); Art. 273 lists when they may be disclosed without consent, and Art. 62 covers digital resources with medical data.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial
● Checked 26 October 2026in forceTypes of personal dataHealthcare
Patient consent, processing only for medical care, automatic notification via e-government of each use of the data, de-identification for research, storage on servers in Kazakhstan, 3 working days to answer a patient's request.
Open:Adilet (opens in a new tab)officialzakon.uchet.kz (opens in a new tab)alternative source, unofficial