Act No. 28 of May 12, 2017
Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field
Table of Contents
Chapter I General Provisions
(Articles 1 through 3)
Chapter II Initiatives Related to Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field
Section 1 Basic Policy Regarding Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field
(Article 4)
Section 2 Initiatives of the State
(Articles 5 through 7)
Chapter III Certified Producers of Anonymized Medical Data
Section 1 Certification of Persons in the Business of Producing Anonymized Medical Data
(Articles 8 through 16)
Section 2 Regulations Concerning Handling of Medical and Related Information and Anonymized Medical Data
(Articles 17 through 27)
Section 3 Enterprises Certified for Entrustment with Handling Medical and Related Information and Anonymized Medical Data
(Articles 28 and 29)
Chapter IV Provision of Medical Information to Certified Producers of Anonymized Medical Data by Enterprises Handling Medical Information
(Articles 30 through 34)
Chapter V Supervision
(Articles 35 through 37)
Chapter VI Miscellaneous Provisions
(Articles 38 through 43)
Chapter VII Penal Provisions
(Articles 44 through 50)
Chapter I General Provisions
(Purpose)
Article 1
The purpose of this Act is to facilitate advanced research and development and the creation of new industry-centered activities in health and medicine (meaning advanced research and development and the creation of new industry-centered activities in health and medicine as prescribed in Article 1 of the Health and Medical Strategy Advancement Act (Act No. 48 of 2014); the same applies in Article 3) by making provisions for anonymized medical data that are meant to contribute to research and development in the medical field, regarding things such as the responsibilities of the State, the formulation of a basic policy, the certification of persons in the business of producing anonymized medical data, and regulations on the handling of medical and related information and anonymized medical data; and thereby to contribute to the formation of a healthy and long-lived society (meaning a healthy and long-lived society as prescribed in Article 1 of that Act).
(Definitions)
Article 2
(1)
The term "medical information" as used in this Act means information regarding the medical history of a specific individual or the mental or physical condition thereof; which constitutes information concerning an individual that includes a description or account (meaning all particulars (excluding an individual identification code (meaning an individual identification code as prescribed in Article 2, paragraph 2 of the Act on the Protection of Personal Information (Act No. 57 of 2003); the same applies hereinafter)) that have been stated or recorded or expressed using voice, movement, or any other means in a written document, drawing, or electronic or magnetic record (meaning a record that is created in electronic or magnetic form (meaning electronic form, magnetic form, or any other form that cannot be perceived with the human senses); the same applies hereinafter); the same applies hereinafter) specified by Cabinet Order as something whose handling requires particular consideration so that the individual or descendants thereof are not subjected to undue differentiation, prejudice, or any other disadvantage based on that mental or physical condition; and which falls under one of the following items:
-
(i)
information containing a name, date of birth, or other description or account that can be used to identify a specific individual (including information that can be readily cross-checked against other information and then used to identify a specific individual); or
-
(ii)
information containing an individual identification code.
(2)
The term "principal" as used in relation to medical information in this Act means the specific individual that the relevant medical information is used to identify.
(3)
The term "anonymized medical data" as used in this Act means data concerning an individual that result when the relevant person takes a measure that one of the following items specifies for the category of medical information set forth in that item to process medical information in such a way that the specific individual cannot be identified, and that the relevant person has prepared in such a way that the medical information cannot be restored:
-
(i)
medical information falling under paragraph (1), item (i):
deleting a part of the description or account contained in that medical information (including by replacing it with another description or account, using an approach that does not have the regularity to enable someone to restore the relevant part of that description or account); or
-
(ii)
medical information falling under paragraph (1), item (ii):
deleting all individual identification codes contained in that medical information (including by replacing them with other descriptions or accounts, using an approach that does not have the regularity to enable someone to restore the relevant individual identification codes).
(4)
The term "the business of producing anonymized medical data" as used in this Act means the business of organizing medical information and processing it to produce anonymized medical data (limited to data that make up a database or similar collection of anonymized medical data (meaning a collection of information containing anonymized medical data which has been systematically organized so as to enable a person to search for specific anonymized medical data using a computer or which is specified by Cabinet Order as having been systematically organized so as to enable a person to readily search for specific anonymized medical data; the same applies in Article 18, paragraph (3)); the same applies hereinafter), so as to contribute to research and development in the medical field.
(5)
The term "enterprise handling medical information" as used in this Act means a person that has a collection of information containing medical information which has been systematically organized so as to enable a person to search for specific medical information using a computer or which is specified by Cabinet Order as having been systematically organized so as to enable a person to readily search for specific medical information (referred to as a "database or similar collection of medical information" in Article 44) for use in its business.
(Responsibilities of the State)
Article 3
The State has the responsibility to implement the necessary initiatives for anonymized medical data that are meant to contribute to research and development in the medical field as a part of the initiatives for advanced research and development and the creation of new industry-centered activities in health and medicine.
Chapter II Initiatives Related to Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field
Section 1 Basic Policy Regarding Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field
Article 4
(1)
The government must establish a basic policy regarding anonymized medical data that are meant to contribute to research and development in the medical field (hereinafter referred to as the "basic policy") in order to comprehensively and integrally advance initiatives related to anonymized medical data that are meant to contribute to research and development in the medical field.
(2)
The basic policy is to provide for the following particulars:
-
(i)
a basic direction for advancing initiatives related to anonymized medical data that are meant to contribute to research and development in the medical field;
-
(ii)
the particulars of measures that the State is to take regarding anonymized medical data that are meant to contribute to research and development in the medical field;
-
(iii)
the particulars of measures to prevent principals, the descendants thereof, and other such persons from being subject to undue differentiation, prejudice, or any other disadvantage due to the medical history or the mental or physical condition of the principals whose medical information is used to produce anonymized medical data;
-
(iv)
the basic particulars of the certification referred to in Article 8, paragraph (1) and Article 28; and
-
(v)
other important particulars involved in the advancement of initiatives related to anonymized medical data that are meant to contribute to research and development in the medical field.
(3)
The Prime Minister must prepare a draft of the basic policy and call for a cabinet decision.
(4)
Once a cabinet decision as under the preceding paragraph has been made, the Prime Minister must issue a public announcement of the basic policy without delay.
(5)
The provisions of the preceding two paragraphs apply mutatis mutandis to the alteration of the basic policy.
Section 2 Initiatives of the State
(Increasing the Understanding of the People)
Article 5
The State is to take the necessary measures to deepen the understanding of the people with regard to anonymized medical data that are meant to contribute to research and development in the medical field through public relations, activities to impart information, and other activities.
(Ensuring the Propriety of Standards)
Article 6
(1)
The State is to prepare the proper standards respecting medical information and anonymized medical data, propagate them, promote their use, and take other necessary measures respecting such data, in order to contribute to producing anonymized medical data that are meant to contribute to research and development in the medical field.
(2)
The preparation of standards under the preceding paragraph is to be undertaken based on things such as international trends in this area and the progress of research and development in the medical field.
(Preparation of Information Systems)
Article 7
The State is to endeavor to prepare information systems, propagate them, promote their use, and take other necessary measures in order to produce anonymized medical data that are meant to contribute to research and development in the medical field.
Chapter III Certified Producers of Anonymized Medical Data
Section 1 Certification of Persons in the Business of Producing Anonymized Medical Data
(Certification)
Article 8
(1)
A person in the business of producing anonymized medical data (limited to a corporation) may, by application, have it certified by the competent ministers that the person is found to be capable of carrying out the business of producing anonymized medical data in a proper and reliable manner.
(2)
Pursuant to the provisions of Order of the competent ministries, a person seeking the certification referred to in the preceding paragraph must submit to the competent ministers a written application giving the following particulars, accompanied by documents evidencing that the certification standards set forth in the items of the following paragraph have been met and other documents specified by Order of the competent ministries:
-
(i)
its name and address;
-
(ii)
its method of organizing medical information;
-
(iii)
its method of processing medical information;
-
(iv)
its method of managing medical and related information (meaning medical information, descriptions or accounts deleted from medical information used for producing anonymized medical data and individual identification codes, and information on the method of processing performed pursuant to the provisions of Article 18, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29); the same applies hereinafter) and anonymized medical data; and
-
(v)
other particulars specified by Order of the competent ministries.
(3)
On finding that an application for certification as referred to in paragraph (1) meets the following standards, the competent ministers must grant the certification referred to in that paragraph:
-
(i)
that the applicant does not constitute any of the following:
(a)
a person that has been sentenced to a fine for violating a provision of this Act, any other Act on the proper handling of personal information that is specified by Cabinet Order, or an order based thereon, if it has not been two years since the day the person finished serving the sentence or ceased to be subject to its enforcement;
(b)
a person whose certification has been rescinded pursuant to the provisions of Article 15, paragraph (1) or Article 16, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29), if it has not been two years since the date of the rescission; and
(c)
a person with an officer carrying on the business of producing anonymized medical data, or an employee as specified by Order of the competent ministries, who constitutes one of the following:
1.
an adult ward or a person under curatorship, or a person equivalent thereto under the laws and regulations of a foreign state;
2.
a person that has become subject to an order commencing bankruptcy proceedings and that has not been discharged from bankruptcy, or a person equivalent thereto under the laws and regulations of a foreign state;
3.
a person sentenced to a fine or heavier punishment for violating a provision of this Act, any other Act on the proper handling of personal information that is specified by Cabinet Order, or an order based thereon, if it has not been two years since the day the person finished serving the sentence or ceased to be subject to its enforcement; or
4.
a person that, within the 30 days before the disposition in question, was an officer engaged in the business to which the certification in question pertained, or an employee as specified by order of the competent ministries, of a person that was certified as referred to in paragraph (1) or Article 28 but that has had its certification rescinded pursuant to the provisions of Article 15, paragraph (1) or Article 16, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29), if it has not been two years since the day of rescission;
-
(ii)
that the applicant meets the standards specified by Order of the competent ministries as having sufficient capability to acquire medical information and to organize and process it so as to properly produce and provide anonymized medical data, in order to contribute to research and development in the medical field;
-
(iii)
that the measures have been taken that Order of the competent ministries specifies as necessary and appropriate for preventing leaks, loss, and damage of medical and related information and of anonymized medical data and for otherwise implementing security controls for medical and related information and for anonymized medical data; and
-
(iv)
that the applicant has sufficient capability to properly implement the security control measures for medical and related information and anonymized medical data provided for in the preceding paragraph.
(4)
Before granting the certification referred to in paragraph (1), the competent ministers must first consult with the Personal Information Protection Commission.
(5)
Having granted the certification referred to in paragraph (1), the competent minsters must notify the applicant of this and issue public notice of the same without delay.
(Amended Certification; Related Matters)
Article 9
(1)
If a person that has been certified as referred to in paragraph (1) of the preceding Article (hereinafter referred to as a "certified producer of anonymized medical data") seeks to change any of the particulars set forth in paragraph (2), items (ii) through (v) of that Article, it must be certified by the competent ministers pursuant to the provisions of Order of the competent ministries; provided, however, that this does not apply to a minor change as specified by Order of the competent ministries.
(2)
If a particular set forth in paragraph (2), item (i) of the preceding Article has changed or if a certified producer of anonymized medical data has made a minor change as specified by Order of the competent ministries that is referred to in the proviso of the preceding paragraph, it must file a notification of this with the competent ministers without delay.
(3)
Having received a notification under the preceding paragraph (limited to a notification relating to any of the particulars set forth in paragraph (2), item (i) of the preceding Article), the competent minsters must issue public notice of this without delay.
(4)
The provisions of paragraph (3) (excluding item (i)) and paragraph (4) of the preceding Article apply mutatis mutandis to an amended certification as referred to in paragraph (1).
(Succession)
Article 10
(1)
If a corporation that is a certified producer of anonymized medical data transfers all of the business of producing anonymized medical data to which the certification referred to in Article 8, paragraph (1) pertains (hereinafter referred to as its "certified business") to another corporation that is a certified producer of anonymized medical data, the transferee succeeds to the status of the transferror as a certified producer of anonymized medical data under this Act.
(2)
If a corporation that is a certified producer of anonymized medical data merges with another corporation that is a certified producer of anonymized medical data, the corporation surviving the merger or the corporation incorporated in the merger succeeds to the status of the corporation or corporations disappearing in the merger as a certified producer of anonymized medical data under this Act.
(3)
A corporation that has succeeded to another corporation's status as a certified producer of anonymized medical data pursuant to the provisions of the preceding two paragraphs must file a notification of this with the competent ministers without delay pursuant to the provisions of Order of the competent ministries.
(4)
If a corporation that is a certified producer of anonymized medical data transfers all of its certified business to a corporation that is not a certified producer of anonymized medical data and the transferror and transferee have obtained the prior approval of the competent ministers for the transfer and acquisition pursuant to the provisions of Order of the competent ministries, the transferee succeeds to the status of the transferror as a certified producer of anonymized medical data under this Act.
(5)
If a corporation that is a certified producer of anonymized medical data disappears due to a merger with a corporation that is not a certified producer of anonymized medical data and the prior approval of the competent ministers has been obtained for the merger pursuant to the provisions of Order of the competent ministries, the corporation surviving the merger or the corporation incorporated in the merger succeeds to the status of the corporation disappearing in the merger as a certified producer of anonymized medical data under this Act.
(6)
If a corporation that is a certified producer of anonymized medical data has another person succeed to all of its certified business through a company split and the prior approval of the competent ministers has been obtained for the company split pursuant to the provisions of Order of the competent ministries, the corporation succeeding to all of the certified business in the company split succeeds to the status of the split corporation as a certified producer of anonymized medical data under this Act.
(7)
The provisions of Article 8, paragraphs (3) through (5) apply mutatis mutandis to the approval referred to in the preceding three paragraphs.
(8)
If a corporation that is a certified producer of anonymized medical data transfers all of its certified business to a corporation that is not a certified producer of anonymized medical data; merges with a corporation that is not a certified producer of anonymized medical data; or has another person succeed to all of its certified business through a company split; but does not apply for the approval referred to in paragraphs (4) through (6), it must file a notification of this with the competent ministers pursuant to the provisions of Order of the competent ministries by the date of transfer of all of its certified business or by the date of the merger or company split.
(9)
If a corporation that is a certified producer of anonymized medical data transfers all of its certified business to a corporation that is not a certified producer of anonymized medical data; disappears in a merger with a corporation that is not a certified producer of anonymized medical data; or has another person succeed to all of its certified business through a company split; but a disposition has been reached not to grant the approval referred to in paragraphs (4) through (6) (or if it has undertaken the transfer of all of its certified business or the merger or company split without having applied for that approval), the certification referred to in Article 8, paragraph (1) ceases to be effective, and the transferee, the corporation surviving the merger or corporation incorporated in the merger, or the corporation succeeding to all of the certified business through the company split must delete the medical and related information and anonymized medical data it manages in connection with that certified business without delay.
(10)
Having received a notification under paragraph (3) or paragraph (8), or having reached a disposition not to grant the approval referred to in paragraphs (4) through (6), the competent minsters must issue public notice of this without delay.
(Notification of Discontinuation)
Article 11
(1)
Before discontinuing its certified business, a certified producer of anonymized medical data must first file a notification of this with the competent ministers pursuant to the provisions of Order of the competent ministries.
(2)
When a notification under the preceding paragraph has been filed, the certification referred to in Article 8, paragraph (1) ceases to be effective and the corporation that was a certified producer of anonymized medical data must delete the medical and related information and anonymized medical data it manages in connection with its certified business without delay.
(3)
When a notification under paragraph (1) has been filed, the competent minsters must issue public notice of this without delay.
(Notification of Dissolution)
Article 12
(1)
If a corporation that is a certified producer of anonymized medical data has dissolved for a reason other than a merger, its liquidator or bankruptcy trustee or a person equivalent thereto under the laws and regulations of a foreign state must file a notification of this with the competent ministers without delay, pursuant to the provisions of Order of the competent ministries, notify the competent ministers thereof without delay.
(2)
If a corporation that is a certified producer of anonymized medical data has dissolved for a reason other than a merger, the certification referred to in Article 8, paragraph (1) ceases to be effective, and the corporation in liquidation or special liquidation, the corporation against which bankruptcy proceedings have been commenced, or a person equivalent thereto under laws and regulations of a foreign state must delete the medical and related information and anonymized medical data that it manages in connection with its certified business without delay.
(3)
When a notification under paragraph (1) has been filed, the competent minsters must issue public notice of this without delay.
(Books)
Article 13
Pursuant to the provisions of Order of the competent ministries, a certified producer of anonymized medical data must keep books (including electronic or magnetic records, if such records have been created in lieu of books; the same applies hereinafter), enter the particulars specified by Order of the competent ministries regarding its business in those books, and preserve them.
(Restriction on the Use of Names)
Article 14
A person that is not a certified producer of anonymized medical data must not use the name "認定匿名加工医療情報作成事業者" (transliterated as "nintei tokumei kakou iryou jouhou sakusei jigyousha" and meaning "certified producer of anonymized medical data") or any name confusingly similar thereto.
(Rescission of Certification)
Article 15
(1)
The competent ministers may rescind a certification referred to in Article 8, paragraph (1) if a certified producer of anonymized medical data (excluding a corporation without a principal office in Japan that handles medical and related information or anonymized medical data in a foreign state (hereinafter referred to as a "foreign handler"); the same applies in the following paragraph) falls under one of the following items:
-
(i)
if it was certified as referred to in Article 8, paragraph (1) or Article 9, paragraph (1) or obtained the approval referred to in Article 10, paragraphs (4) through (6) by deception or other wrongful means;
-
(ii)
if it has ceased to meet a standard set forth in one of the items of Article 8, paragraph (3);
-
(iii)
if it has changed a particular for which it must be certified pursuant to the provisions of Article 9, paragraph (1) without being certified as referred to in that paragraph;
-
(iv)
if it provides medical information in violation of Article 26, paragraph (1); or
-
(v)
if it violates an order under Article 37, paragraph (1).
(2)
Having had its certification referred to in Article 8, paragraph (1) rescinded pursuant to the provisions of the preceding paragraph, a certified producer of anonymized medical data must delete the medical and related information and anonymized medical data that it manages in connection with its certified business without delay.
(3)
Before rescinding the certification referred to in Article 8, paragraph (1) pursuant to the provisions of paragraph (1), the competent minsters must first consult with the Personal Information Protection Commission.
(4)
Having rescinded the certification referred to in Article 8, paragraph (1) pursuant to the provisions of paragraph (1), the competent minsters must issue public notice of this without delay.
Article 16
(1)
The competent ministers may rescind a certification referred to in Article 8, paragraph (1) if a certified producer of anonymized medical data (limited to a foreign handler; the same applies in item (iii) and paragraph (3)) falls under one of the following items:
-
(i)
if it falls under one of items (i) through (iv) of paragraph (1) of the preceding Article;
-
(ii)
if it fails to respond to a request under the provisions of Article 37, paragraph (1), as applied mutatis mutandis pursuant to paragraph (3) of that Article following a deemed replacement of terms;
-
(iii)
if the competent ministers, to the extent necessary for the enforcement of this Act, have attempted to require the certified producer of anonymized medical data to report the necessary information, to have the relevant officials enter that person's office or other place of business of the person and inspect its books, documents, or other items, or to have those officials ask questions of the persons concerned, but no report or a false report is made; the inspection is refused, obstructed, or evaded; or no answer or a false answer is given to the questions; or
-
(iv)
if it fails to bear the costs under paragraph (3).
(2)
The provisions of paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to the rescission of a certification under the preceding paragraph.
(3)
The costs required to undertake an inspection under paragraph (1), item (iii) (limited to the cost specified by Cabinet Order) are borne by the certified producer of anonymized medical data subject to the inspection.
Section 2 Regulations on the Handling of Medical Information and Anonymized Medical Data
(Restriction Due to Purpose of Use)
Article 17
(1)
Having been provided with medical information pursuant to the provisions of Article 25 or Article 30, paragraph (1), a certified producer of anonymized medical data must not handle that medical information beyond the scope necessary for it to achieve the purpose of its certified business, so that it does not to contravene the intent of the medical information having been provided in order to contribute to research and development in the medical field.
(2)
The provisions of the preceding paragraph do not apply to the following cases:
-
(i)
if this is based on laws and regulations; and
-
(ii)
if there is an urgent necessity to do so in order to save a person's life, provide disaster relief, or otherwise respond to an emergency.
(Production of Anonymized Medical Data)
Article 18
(1)
When a certified producer of anonymized medical data produces anonymized medical data, it must process the medical information in accordance with the standards specified by Order of the competent ministries as being necessary to make it impossible to identify a specific individual and to restore medical information used for the production.
(2)
In producing anonymized medical data and handling that anonymized medical data itself, a certified producer of anonymized medical data must not cross-check the anonymized medical data against other information for the purpose of identifying the principal whose medical information has been used to produce the anonymized medical data.
(3)
It is prohibited for an enterprise handling anonymized medical data (meaning a person using a database or similar collection of anonymized medical data for its business; the same applies hereinafter), in handling anonymized medical data that has been produced pursuant to the provisions of paragraph (1) (including as applied mutatis mutandis pursuant to Article 29) (excluding anonymized medical data which it produces itself by processing medical information), to acquire information relating to a description or account or individual identification code that has been deleted from the medical information, to acquire information on the method of processing that has been carried out pursuant to the provisions of that paragraph (including as applied mutatis mutandis pursuant to that Article), or to cross-check the anonymized medical data against other information, for the purpose of identifying the principal to whom the medical information that was used to produce that anonymized medical data pertains.
(4)
The provisions of Article 36 of the Act on the Protection of Personal Information do not apply when a certified producer of anonymized medical data or a person that has been certified as referred to in Article 28 (hereinafter referred to as a "enterprise certified for entrustment with handling medical and related information and anonymized medical data") produces anonymized medical data pursuant to the provisions of paragraph (1) (including as applied mutatis mutandis pursuant to Article 29); and the provisions of Articles 37 through 39 of that Act do not apply when an enterprise handling anonymized medical data handles the anonymized medical data prescribed in the preceding paragraph.
(Deletion)
Article 19
If a certified producer of anonymized medical data ceases to need to use any medical and related information or anonymized medical data that it manages in connection with its certified business, it must delete that medical and related information or anonymized medical data without delay.
(Security Control Measures)
Article 20
A certified producer of anonymized medical data must take the measures specified by Order of the competent ministries as necessary and appropriate for preventing leaks, loss, and damage of the medical and related information and anonymized medical data that it manages in connection with its certified business, and for otherwise implementing security controls for that medical and related information or anonymized medical data.
(Supervision of Workers)
Article 21
In having its workers handle medical and related information or anonymized medical data that it manages in connection with its certified business, a certified producer of anonymized medical data must exercise the necessary and appropriate supervision of those workers in order to implement security controls for the medical and related information or anonymized medical data, pursuant to the provisions of Order of the competent ministries.
(Obligations of Workers)
Article 22
It is prohibited for a person who is or was an officer or worker of a certified producer of anonymized medical data to disclose medical and related information or anonymized medical data acquired in connection with its certified business to another person without due cause or to use it for an unjust purpose.
(Entrustment)
Article 23
(1)
A certified producer of anonymized medical data may entrust another person with all or part of the handling of medical and related information or anonymized medical data that it manages in connection with its certified business only if the other person is an enterprise certified for entrustment with handling medical and related information and anonymized medical data.
(2)
An enterprise certified for entrustment with handling medical and related information and anonymized medical data that has been entrusted with all or part of the handling of medical and related information or anonymized medical data pursuant to the provisions of the preceding paragraph may subsequently entrust another person with all or part of the handling with which it has been entrusted only if the other person is another enterprise certified for entrustment with handling medical and related information and anonymized medical data and it has obtained the permission of the certified producer of anonymized medical data that has entrusted it with the handling of the medical and related information or anonymized medical data.
(3)
An enterprise certified for entrustment with handling medical and related information and anonymized medical data that has been subsequently entrusted with all or part of the handling of medical and related information or anonymized medical data pursuant to the provisions of the preceding paragraph is deemed to be the enterprise certified for entrustment with handling medical and related information and anonymized medical data that has been initially entrusted with all or part of the handling of that medical and related information or anonymized medical data, and the provisions of that paragraph apply.
(Supervision of Entrusted Persons)
Article 24
If a certified producer of anonymized medical data entrusts another person with all or part of the handling of medical and related information or anonymized medical data that it manages in connection with its certified business, it must exercise the necessary and appropriate supervision over the entrusted person in order to implement security controls for the medical and related information or anonymized medical data whose handling it has entrusted, pursuant to the provisions of Order of the competent ministries.
(Provision of Medical Information to Other Certified Preparers of Anonymized Medical Data)
Article 25
(1)
At the request of another certified producer of anonymized medical data and pursuant to the provisions of Order of the competent ministries, a certified producer of anonymized medical data that has been provided with medical information pursuant to the provisions of Article 30, paragraph (1) may provide the other certified producer of anonymized medical data with medical information with which it has been provided pursuant to the provisions of that paragraph, to the extent necessary for producing anonymized medical data.
(2)
A certified producer of anonymized medical data that has been provided with medical information pursuant to the provisions of the preceding paragraph is deemed to be a certified producer of anonymized medical data that has been provided with medical information pursuant to the provisions of Article 30, paragraph (1), and the provisions of the preceding paragraph apply.
(Restriction on Provision of Information to Third Parties)
Article 26
(1)
Except when providing medical information pursuant to the provisions of the preceding Article and in the following cases, a certified producer of anonymized medical data must not provide a third party with medical information that has been provided to it pursuant to the provisions of that Article or Article 30, paragraph (1):
-
(i)
if this is based on laws and regulations; and
-
(ii)
if there is an urgent necessity to do so in order to save a person's life, provide disaster relief, or otherwise respond to an emergency.
(2)
To apply the provisions of the preceding paragraph in the following cases, the person that is provided with the medical information is considered not to constitute a third party:
-
(i)
if medical information is provided as a result of a business succession caused by a business transfer under Article 10, paragraph (1), paragraph (2) or paragraphs (4) through (6), or any other reason; and
-
(ii)
if medical information is provided as a result of a certified producer of anonymized medical data entrusting a person with all or part of its handling pursuant to Article 23, paragraph (1).
(Complaint Processing)
Article 27
(1)
Pursuant to the provisions of Order of the competent ministries, a certified producer of anonymized medical data must properly and promptly process complaints about the handling of medical and related information or anonymized medical data that it manages in connection with its certified business.
(2)
Pursuant to the provisions of Order of the competent ministries, a certified producer of anonymized medical data must set in place the necessary system to achieve the purpose referred to in the preceding paragraph.
Section 3 Enterprises Certified for Entrustment with Handling Medical and Related Information and Anonymized Medical Data
(Certification)
Article 28
A person (limited to a corporation) that seeks to be in the business of handling medical and related information and anonymized medical data upon being entrusted (including entrustment two or more steps removed from the initial entrustment) to do so by a certified producer of anonymized medical data may, by application, have it certified by the competent ministers that the person is found to be capable of carrying out that business in a proper and reliable manner.
(Provisions Applied Mutatis Mutandis)
Article 29
The provisions of Article 8, paragraph (2) (excluding items (ii) and (iii)), paragraph (3) (excluding item (ii)), paragraph (4), and paragraph (5) apply mutatis mutandis to the certification referred to in the preceding Article; and the provisions of Articles 9 through 14, Article 17, Article 18, paragraphs (1) and (2), Articles 19 through 22, Article 24, Article 26, and Article 27 apply mutatis mutandis to an enterprise certified for entrustment with handling medical and related information and anonymized medical data; and the provisions of Article 15 and Article 16 apply mutatis mutandis to the rescission of the certification of an enterprise certified for entrustment with handling medical and related information and anonymized medical data. In such a case, the terms and phrases set forth in the middle column of the following table that appear in the provisions set forth in the corresponding left-hand column of that table are deemed to be replaced with the corresponding terms or phrases set forth in the right-hand column of that table, and any other necessary deemed technical replacement of terms is specified by Cabinet Order.
Article 8, paragraph (2)
the items of the following paragraph
items (i), (iii), and (iv) of the following paragraph
Article 8, paragraph (3), item (i), (c)
the business of producing anonymized medical data
that business
Article 9, paragraph (1)
paragraph (2), items (ii) through (v) of that Article
paragraph (2), item (iv) or (v) of the preceding Article
Article 9, paragraph (4)
item (i)
items (i) and (ii)
Article 10, paragraph (1)
the business of producing anonymized medical data to which the certification referred to in Article 8, paragraph (1) pertains
the business prescribed in Article 28 to which the certification referred to in that Article pertains
Article 10, paragraph (7)
Article 8, paragraphs (3) through (5)
Article 8, paragraph (3) (excluding item (ii)), and paragraphs (4) and (5)
Article 10, paragraph (9), Article 11, paragraph (2), and Article 12, paragraph (2)
Article 8, paragraph (1)
Article 28
Article 15, paragraph (1), item (ii)
the items of Article 8, paragraph (3)
Article 8, paragraph (3), item (i), (iii) or (iv)
Article 15, paragraph (1), item (v)
Article 37, paragraph (1)
Article 37, paragraph (2)
Article 16, paragraph (1), item (ii)
paragraph (1) of that Article
paragraph (2) of that Article
Article 17, paragraph (1)
Having been provided with medical information pursuant to the provisions of Article 25 or Article 30, paragraph (1)
Having been initially entrusted or subsequently entrusted with all or part of the handling of medical information pursuant to the provisions of Article 23, paragraph (1) or (2)
Article 26, paragraph (1)
when providing medical information pursuant to the provisions of the preceding Article and in the following
in the following
that has been provided to it pursuant to the provisions of that Article or Article 30, paragraph (1)
all or part of whose handling it has been initially or subsequently entrusted with pursuant to the provisions of Article 23, paragraph (1) or (2)
Article 26, paragraph (2), item (ii)
pursuant to Article 23, paragraph (1)
or a certified producer of anonymized medical data pursuant to Article 23, paragraph (2) or (1)
entrustment
initial entrustment or subsequent entrustment
Chapter IV Provision of Medical Information to Certified Producers of Anonymized Medical Data by Enterprises Handling Medical Information
(Provision of Medical Information by Enterprises Handling Medical Information)
Article 30
(1)
If an enterprise handling medical information has decided that it will stop providing medical information that identifies the principal to certified producers of anonymized medical data upon receipt of a request, pursuant to Order of the competent ministries, from the principal or a surviving family member thereof (meaning a deceased principal's child, grandchild, or other person specified by Cabinet Order; the same applies hereinafter) regarding medical information that is provided to certified producers of anonymized medical data, but the enterprise handling medical information notifies the principal of the following particulars as well as filing a notification regarding them with the competent ministers in advance pursuant to Order of the competent ministries, it may provide that medical information to a certified producer of anonymized medical data:
-
(i)
that it will provide a certified producer of anonymized medical data with the relevant medical information as information for use in producing anonymized medical data that are meant to contribute to research and development in the medical field;
-
(ii)
the items of medical information that it will provide to a certified producer of anonymized medical data;
-
(iii)
its way of providing a certified producer of anonymized medical data therewith;
-
(iv)
that it will stop providing certified producers of anonymized medical data with medical information identifying the principal at the request of the principal or a surviving family member thereof; and
-
(v)
its way of receiving requests from principals and the surviving family members thereof.
(2)
Before changing a particular as set forth in item (ii), (iii), or (v) of the preceding paragraph, an enterprise handling medical information must notify the principal of the substance of the change and file a notification of this with the competent ministers, in advance and pursuant to the provisions of Order of the competent ministries.
(3)
When a notification under paragraph (1) has been filed, the competent ministers must issue a public announcement of the particulars to which the notification pertains pursuant to the provisions of Order of the competent ministries. The same applies when a notification under the preceding paragraph has been filed.
(Delivery of Documents)
Article 31
(1)
Having been requested by a principal or a surviving family member thereof that has been notified as under the preceding Article, paragraph (1) to stop providing certified producers of anonymized medical data with medical information that identifies the principal, an enterprise handling medical information must deliver a document indicating that the request has been made and giving other particulars specified by Order of the competent ministries to the person making the request without delay, pursuant to the provisions of Order of the competent ministries.
(2)
In lieu of delivering a document as under the provisions of the preceding paragraph, an enterprise handling medical information may provide an electronic or magnetic record giving the particulars that are required to be stated in that document after having first obtained the consent of the person that has made the request prescribed in that paragraph. In such a case, the enterprise handling medical information is deemed to have delivered the document as under that paragraph.
(3)
An enterprise handling medical information that has delivered a document as under the provisions of paragraph (1) or that has provided an electronic or magnetic record pursuant to the provisions of the preceding paragraph must preserve a copy of the document or the electronic or magnetic record pursuant to the provisions of Order of the competent ministries.
(Creating Records of the Provision of Medical Information)
Article 32
(1)
Having provided medical information to a certified producer of anonymized medical data pursuant to the provisions of Article 30, paragraph (1), an enterprise handling medical information must create a record of the date on which it provided the medical information, the name and address of the certified producer of anonymized medical data, and other particulars specified by Order of the competent ministries, pursuant to the provisions of Order of the competent ministries.
(2)
An enterprise handling medical information must preserve the record referred to in the preceding paragraph for the period specified by Order of the competent ministries after the date on which it has created that record.
(Confirmation When Being Provided with Medical Information)
Article 33
(1)
At the time it receives medical information from an enterprise handling medical information pursuant to the provisions of Article 30, paragraph (1), a certified producer of anonymized medical data must confirm the following particulars pursuant to the provisions of Order of the competent ministries:
-
(i)
the name and address of the enterprise handling medical information and, if it is a corporation, the name of its representative (if it is an organization that is not a corporation but that has specified a representative or administrator, the name of its representative or administrator); and
-
(ii)
the circumstances under which the medical information was acquired by the enterprise handling medical information.
(2)
When a certified producer of anonymized medical data undertakes a confirmation as under the provisions of the preceding paragraph, the enterprise handling medical information referred to in that paragraph must not deceive that certified producer of anonymized medical data regarding a particular subject to the confirmation.
(3)
Having undertaken a confirmation under the provisions of paragraph (1), a certified producer of anonymized medical data must create a record of the date on which it was provided with the medical information, the particulars subject to that confirmation, and other particulars specified by Order of the competent ministries, pursuant to the provisions of Order of the competent ministries.
(4)
A certified producer of anonymized medical data must preserve the record referred to in the preceding paragraph for the period specified by Order of the competent ministries after the date of producing the record.
(When It Is Not Permissible to Be Provided with Medical Information by an Enterprise Handling Medical Information)
Article 34
Unless it is based on laws and regulations, a certified producer of anonymized medical data must not be provided with the following medical information by an enterprise handling medical information:
-
(i)
medical information for which no notice or notification under Article 30, paragraph (1) or (2) has been filed; and
-
(ii)
medical information regarding which a request as prescribed in Article 31, paragraph (1) has been made.
Chapter V Supervision
(On-site Inspections)
Article 35
(1)
To the extent necessary for the enforcement of this Act, the competent ministers may require a certified producer of anonymized medical data or enterprise certified for entrustment with handling medical and related information and anonymized medical data (excluding those that are foreign handlers) or an enterprise handling anonymized medical data or enterprise handling medical information to report the necessary information, and may have the relevant officials enter its office or any other place of business, inspect its books, documents, or other items, and ask persons concerned questions.
(2)
An official who performs an on-site inspection under the preceding paragraph must carry identification and present it if requested by a person concerned.
(3)
The authority for an on-site inspection under paragraph (1) must not be construed as being granted for criminal investigation purposes.
(4)
Before requiring a report or conducting an on-site inspection under paragraph (1), the competent ministers must first consult with the Personal Information Protection Commission.
(Guidance and Advice)
Article 36
The competent ministers are to provide a certified producer of anonymized medical data or an enterprise certified for entrustment with handling medical and related information and anonymized medical data with the necessary guidance and advice to properly carry out the business to which the certification referred to in Article 8, paragraph (1) or Article 28 pertains.
(Rectification Order)
Article 37
(1)
Upon finding that a certified producer of anonymized medical data (excluding a foreign handler) is in violation of the provisions of Article 17, paragraph (1), Article 18, paragraph (1) or (2), Articles 19 through 21, Article 23, paragraph (1), Article 24, Article 25, paragraph (1), Article 26, paragraph (1), Article 27, Article 33 (excluding paragraph (2)), or Article 34, the competent ministers may order the person to take the necessary measures to rectify the violation.
(2)
Upon finding that an enterprise certified for entrustment with handling medical and related information and anonymized medical data (excluding a foreign handler) is in violation of the provisions of Article 23, paragraph (2), or the provisions of Article 17, paragraph (1), Article 18, paragraph (1) or (2), Articles 19 through 21, Article 24, Article 26, paragraph (1) or Article 27, as applied mutatis mutandis pursuant to Article 29, the competent ministers may order the person to take the necessary measures to rectify the violation.
(3)
The provisions of the preceding two paragraphs apply mutatis mutandis to certified producers of anonymized medical data and enterprises certified for entrustment with handling medical and related information and anonymized medical data (limited to those that are foreign handlers). In such a case, the term "order" in these provisions is deemed to be replaced with "request".
(4)
Upon finding that an enterprise handling anonymized medical data is in violation of the provisions of Article 18, paragraph (3), the competent ministers may order the person to take the necessary measures to rectify the violation.
(5)
Upon finding that an enterprise handling medical information is in violation of the provisions of Article 30, paragraph (1) or (2), Article 31, paragraph (1) or (3), or Article 32, the competent ministers may order the person to take the necessary measures to rectify the violation.
(6)
Before giving an order under paragraph (1), (2), (4) or the preceding paragraph, or making a request under paragraph (1) or (2), as applied mutatis mutandis pursuant to paragraph (3) following a deemed replacement of terms, the competent ministers must first consult with the Personal Information Protection Commission.
Chapter VI Miscellaneous Provisions
(Communication and Cooperation)
Article 38
In enforcing this Act, the competent ministers, the Personal Information Protection Commission, and the Minister for Internal Affairs and Communications must closely communicate and cooperate with one another about particulars that concern the proper handling of medical and related information and anonymized medical data.
(Competent Ministers)
Article 39
(1)
The competent ministers as referred to in this Act are the Prime Minister; the Minister of Education, Culture, Sports, Science and Technology; the Minister of Health, Labour and Welfare; and the Minister of Economy Trade and Industry.
(2)
Order of the competent ministries as referred to in this Act means the order issued by the competent ministers.
(3)
Before establishing or altering the Order of the competent ministries, the competent ministers must first consult with the Personal Information Protection Commission.
(Administrative Functions That Local Governments Handle)
Article 40
The head of a local government may handle an administrative function that is part of the authority of the competent ministers prescribed in Article 35, paragraph (1) (limited to administrative functions concerning enterprises handling medical information handling), pursuant to the provisions of Cabinet Order.
(Delegation of Authority)
Article 41
Part of the authority of the competent ministers prescribed in this Act may be delegated to the head of a local branch bureau, pursuant to the provisions of Cabinet Order.
(Delegation to Order of Competent Ministries)
Article 42
Beyond what is provided for in this Act, Order of the competent ministries prescribes procedures for implementing this Act and other necessary particulars connected with the entry into effect of this Act.
(Transitional Measures)
Article 43
When an order is enacted, amended, or repealed based on the provisions of this Act, that order may provide for the required transitional measures (including those concerning penal provisions) to the extent considered reasonably necessary in association with the enactment, amendment, or repeal.
Chapter VII Penal Provisions
Article 44
If a person who is or was an officer or worker of a certified producer of anonymized medical data or an enterprise certified for entrustment with handling medical and related information and anonymized medical data has provided, without a legitimate grounds, a database or similar collection of medical information (including all or part of a reproduced or processed database or similar collection of medical information) containing any confidential information about an individual that the person has handled in the course of duties for doing so, that person is subject to imprisonment for not more than two years, a fine of not more than one million yen, or both.
Article 45
If a person as prescribed in the preceding Article has provided a person with or misappropriated medical and related information or anonymized medical data that the person has acquired in the course of duties for the purpose of that person's own or a third party's unlawful benefit, that person is subject to imprisonment for not more than one year, a fine of not more than one million yen, or both.
Article 46
A person falling under any of the following items is subject to imprisonment for not more than one year, a fine of not more than five hundred thousand yen, or both:
-
(i)
a person that has gained the certification referred to in Article 8, paragraph (1), Article 9, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29) or Article 28, or the approval referred to in Article 10, paragraphs (4) through (6) (including as these provisions are applied mutatis mutandis pursuant to Article 29) by deception or other wrongful means;
-
(ii)
a person that has changed a particular referred to in Article 8, paragraph (2), items (ii) through (v) in violation of Article 9, paragraph (1);
-
(iii)
a person that has disclosed medical and related information or anonymized medical data acquired in connection with certified business to another person without due cause, or that has used the information for an unjust purpose, in violation of Article 22 (including as applied mutatis mutandis pursuant to Article 29);
-
(iv)
a person that has changed a particular referred to in Article 8, paragraph (2), item (iv) or (v), as applied mutatis mutandis pursuant to Article 29, in violation of Article 9, paragraph (1), as applied mutatis mutandis pursuant to Article 29; or
-
(v)
a person that has violated an order under Article 37, paragraph (1), (2), (4), or (5).
Article 47
A person falling under one of the following items is subject to a fine of mot more than five hundred thousand yen:
-
(i)
a person failing to file a notification or filing a false notification under Article 9, paragraph (2), Article 10, paragraph (3) or (8), or Article 11, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29);
-
(ii)
a person failing to delete medical and related information or anonymized medical data, in violation of Article 10, paragraph (9), Article 11, paragraph (2), Article 12, paragraph (2) or Article 15, paragraph (2) (including as applied mutatis mutandis pursuant to Article 16, paragraph (2)) (including as these provisions are applied mutatis mutandis pursuant to Article 29);
-
(iii)
a person failing to keep books or make entries in them, making false entries in them, or failing to preserve them, in violation of Article 13 (including as applied mutatis mutandis pursuant to Article 29); or
-
(iv)
a person failing to make a report or making a false report under Article 35, paragraph (1); refusing, precluding, or evading an inspection under that paragraph; or failing to give an answer or giving a false answer to any question under that paragraph.
Article 48
Provisions on the crimes referred to in Article 44, Article 45, Article 46 (limited to the part pertaining to items (iii) and (v) (limited to the part pertaining to Article 37, paragraph (1) (excluding the part pertaining to Article 33, paragraphs (1), (3) and (4), and Article 34) and paragraph (2))) and the preceding Article (limited to the part pertaining to item (ii)) also apply to a person committing a crime as referred to in one of those Articles outside Japan.
Article 49
(1)
If the representative of a corporation (including an organization that is not a corporation but that has specified a representative or administrator; hereinafter the same applies in this paragraph), or the agent, employee, or other worker of a corporation or individual commits a violation referred to in Articles 44 through 47 in connection with the business of the corporation or individual, in addition to the offender being subject to punishment, the corporation or individual is subject to the fine referred to in the relevant Article.
(2)
If the provisions of the preceding paragraph apply to an organization that is not a corporation, its representative or administrator represents the organization that is not a corporation as regards its procedural act, and the provisions of laws on criminal proceedings in which a corporation is the accused or a suspect apply mutatis mutandis.
Article 50
A person falling under one of the following items is subject to a civil fine of not more than 100,000 yen:
-
(i)
a person failing to file a notification or filing a false notification under Article 12, paragraph (1) (including as applied mutatis mutandis pursuant to Article 29); or
-
(ii)
a person violating the provisions of Article 14 (including as applied mutatis mutandis pursuant to Article 29) or Article 33, paragraph (2).