Regulation for Enforcement of the Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field - English

(Definitions)

Article 1The terms used in this Regulation carry the meanings of the terms used in the Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field (hereinafter referred to as "the Act").

(Medical Information)

Article 2The impairments of physical and mental function specified by Order of the competent ministries that are referred to in Article 1, item (ii), (a) of the Order for Enforcement of the Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field (hereinafter referred to as "the Order") mean the impairments of physical and mental function prescribed in the items of Article 5 of the Regulation for Enforcement of the Act on the Protection of Personal Information (Rules of the Personal Information Protection Commission No. 3 of 2016).

(Application for Certification)

Article 3(1)A person seeking the certification referred to in Article 8, paragraph (1) of the Act must submit a written application based on Form No. 1 to the competent ministers.

(2)The documents specified by Order of the competent ministries that are referred to in Article 8, paragraph (2) of the Act are as follows:

(i)the following documents regarding the applicant:

(a)its articles of incorporation and certificate of registered information or documents equivalent thereto; and

(b)copies of the resident records of any officer as referred to in Article 8, paragraph (3), item (i), (c) of the Act (simply referred to as "officers" in Article 8, paragraph (2), item (i)) or employee as referred to in that clause (meaning an employee as prescribed in the following Article), or documents that stand in place of resident records;

(ii)its business plans and income and expenditure budgets for the business year that includes the day of the application and for the following business year; and

(iii)other documents that the competent ministers find to be necessary.

(Employees)

Article 4The employees specified by Order of the competent ministries that are referred to in Article 8, paragraph (3), item (i), (c) of the Act (simply referred to as "employees" in Article 8, paragraph (2), item (i)) are those employees of an applicant who have authority and responsibility for the applicant's business of producing anonymized medical data.

(Standards Specified by Order of Competent Ministries as Referred to in Article 8, Paragraph (3), Item (ii) of the Act)

Article 5The standards specified by Order of the competent ministries that are referred to in Article 8, paragraph (3), item (ii) of the Act are as follows:

(i)it has a person who has substantial experience and insight in the production of anonymized medical data that contributes to Japan's medical research and development engaged in the overall management of its business of producing anonymized medical data and responsible therefor;

(ii)it has secured all of the following persons as persons who have sufficient experience and insight to undertake the business of producing anonymized medical data in a proper and reliable manner:

(a)a person who has substantial experience and insight in the large-scale processing of medical information to produce anonymized medical data that contributes to Japan's medical research and development;

(b)a person who has substantial experience and insight in the promotion of Japan's medical research and development using anonymized medical data; and

(c)a person who has substantial experience and insight in the acquisition and organization of medical information used to produce anonymized medical data that contributes to Japan's medical research and development;

(iii)it is equipped with a medical information search system and other equipment necessary to implement its business of producing anonymized medical data;

(iv)internal rules for carrying out the business of producing anonymized medical data in a proper and reliable manner have been established, it has been verified that its business operation is based on those rules, and it has otherwise been ensured that its operation complies with laws and regulations;

(v)it has a sufficient financial basis to continuously carry out the business of producing anonymized medical data in a proper and reliable manner;

(vi)it has a medium-term plan for the business of producing anonymized medical data that is found to be appropriate in light of the basic policy prescribed in Article 4, paragraph (1) of the Act (referred to as the "basic policy" in the following item);

(vii)it has set in place a framework for appropriately examining, when deciding whether or not to provide anonymized medical data, whether anonymized medical data will be handled appropriately so that it will contribute to research and development in the medical field, in light of the basic policy;

(viii)it has set in place frameworks for public relations, for imparting information, and for responding to requests for consultation from principals, enterprises handling medical information, and enterprises handling anonymized medical data;

(ix)the scale and substance of medical information it handles are sufficient for it to carry out the business of producing anonymized medical data in a proper and reliable manner;

(x)it is able to smoothly handle medical information that complies with normal medical standards; and

(xi)the applicant, in the business of producing anonymized medical data that it undertakes, does not subject any specific enterprise handling anonymized medical data to undue differential treatment.

(Security Control Measures)

Article 6The measures specified by Order of the competent ministries that are referred to in Article 8, paragraph (3), item (iii) of the Act and Article 20 of the Act are as follows:

(i)systematic security control measures:

(a)it has established a basic policy regarding security controls for the medical and related information and anonymized medical data that it manages in connection with the certified business (referred to as "medical and related information and anonymized medical data associated with its certified business" in this Article);

(b)it has assigned a person in charge who has substantial experience and insight in security controls for medical and related information and anonymized medical data associated with its certified business;

(c)it has clarified the authority, responsibility, and duties of persons handling medical and related information and anonymized medical data associated with its certified business;

(d)a framework has been prepared for business processing upon the occurrence of a leak, loss, or damage involving medical and related information and anonymized medical data associated with its certified business;

(e)it has formulated and implemented rules for security control measures security control measure, and has evaluated and improved the operation thereof; and

(f)it continuously seeks to ensure measures for security controls by undergoing information security audits by outside experts or by obtaining a third-party certification;

(ii)human security control measures:

(a)it has confirmed that persons handling medical and related information and anonymized medical data associated with its certified business do not fall under item (i), (c), 1. through 4. of Article 8, paragraph (3) of the Act;

(b)it has taken measures to ensure that persons handling medical and related information and anonymized medical data associated with its certified business do not handle this beyond the scope necessary for achieving the purpose of its certified business;

(c)it provides the necessary education and training to persons handling medical and related information and anonymized medical data associated with its certified business; and

(d)it has taken measures to prevent persons who do not have the authority to handle medical and related information and anonymized medical data associated with its certified business from handling it;

(iii)physical security control measures:

(a)it has separated the facilities and equipment it uses to handle medical and related information and anonymized medical data associated with certified business from other facilities and equipment;

(b)it has taken measures to restrict entry and the bringing of devices into facilities and equipment used for handling medical and related information and anonymized medical data associated with certified business, and has installed surveillance cameras or otherwise set up equipment to continuously monitor the interiors of those facilities and equipment;

(c)the terminal devices associated with the handling of medical and related information that it manages in connection with its certified business do not, in principle, have a function for recording onto auxiliary storage or portable recording media (meaning portable media and devices onto which data can be saved if they are inserted into or connected to a computer or its peripheral equipment); and

(d)when it deletes medical and related information and anonymized medical data associated with its certified business or disposes of a device, electronic medium, or the like containing medical and related information and anonymized medical data associated with its certified business, it does so in a way that makes it impossible to restore the medical and related information and anonymized medical data associated with its certified business;

(iv)technical security control measures:

(a)it takes appropriate measures for facilities and equipment that handle medical and related information and anonymized medical data associated with its certified business to prevent acts of unauthorized computer access (meaning acts of unauthorized computer access as prescribed in Article 2, paragraph (4) of the Act on Prohibition of Unauthorized Computer Access (Act No. 128 of 1999));

(b)in addition to recording the activity of computers and terminal devices used for handling medical and related information and anonymized medical data associated with its certified business, it takes measures to detect if someone has operated those computers and terminal devices in a way that is unexpected and to control computers and terminal devices that someone has operated in an unexpected way;

(c)it verifies that computers and terminal devices used to handle medical and related information and anonymized medical data associated with its certified business have not been equipped with a function that allows a third party to make the computer or terminal device act in a way that is counter to the purpose for which it is being used; and

(d)it takes the following measures when transmitting, receiving, transferring, or being transferred medical and related information and anonymized medical data associated with its certified business via telecommunications:

1.using dedicated lines or the like (including virtual dedicated lines used by an IP-VPN service (meaning an IP-VPN service set forth in Article 1, paragraph (2), item (xv) of the Telecommunications Business Reporting Regulations (Order of the Ministry of Posts and Telecommunications No. 46 of 1988)) or any other virtual dedicated line whose safety is found to be equivalent thereto) as the telecommunications lines it uses for transmission and reception with the outside;

2.not equipping server computers that are connected to a telecommunications line as prescribed in 1. and that are used for receiving medical information from enterprises handling medical information with a function that allows them to transmit data to the outside;

3.not equipping server computers that are connected to a telecommunications line as prescribed in 1. and that are used for transmitting anonymized medical data to enterprises handling anonymized medical data with a function that allows them to receive data from the outside; also, using server computers that do not constitute computers as prescribed in 2. or (e); and

4.beyond what is set forth in 1. through 3., encrypting data and taking other necessary measures to appropriately transfer or receive medical and related information and anonymized medical data associated with certified business;

(e)it uses server computers that do not constitute computers as referred to in (d), 2. and 3. for managing the medical information it uses to produce anonymized medical data, and it does not connect its network to the outside by a means other than through computers as prescribed in (d), 2. and 3.; also, it uses dedicated lines for connecting with computers as prescribed in (d), 2. and 3.

(v)other measures:

(a)it has taken measures meant to compensate for damage in the event that medical and related information and anonymized medical data associated with certified business is leaked or any other such incident occurs;

(b)it endeavors to prevent damage to the facilities and equipment used to handle medical and related information and anonymized medical data associated with certified business, as well as taking appropriate measures to detect damage in them and to respond if damage is found, including the formulation of a business continuity plan and the installation of spare devices that can function in their stead;

(c)when receiving medical information, it verifies that the means by which the enterprise handling the medical information provides the medical information and its security control measures for this are proper; and

(d)in an agreement on the provision of anonymized medical data, it has ensured that the mode of use of the anonymized medical data by the enterprise handling that anonymized medical data and its security control measures for this are proper for the degree of anonymous processing.

(Issuance of Certificates)

Article 7Having granted a certification referred to in Article 8, paragraph (1) of the Act, the competent ministers are to notify the applicant of this and issue a certificate based on Form No. 2 thereto.

(Application for Amended Certification; Related Matters)

Article 8(1)If a certified producer of anonymized medical data seeks to change any of the particulars set forth in Article 8, paragraph (2), items (ii) through (v) of the Act, it must submit a written application based on Form No. 3 to the competent ministers, along with the following documents, and obtain an amended certification:

(i)those of the documents evidencing that the certification standards set forth in the items of Article 8, paragraph (3) of the Act have been met and those of the documents set forth in the items of Article 3, paragraph (2) which relate to the particular that is to change; and

(ii)a copy of the certificate referred to in the preceding Article.

(2)The minor changes specified by Order of the competent ministries that are referred to in the proviso of Article 9, paragraph (1) of the Act are changes falling under any of the following:

(i)a change in the name of an officer or employee carrying on the business of producing anonymized medical data that does not involve a change of officers or employees; and

(ii)beyond what is set forth in the preceding item, a change not involving any substantial change to a particular forth in Article 8, paragraph (2), items (ii) through (v) of the Act.

(3)If a certified producer of anonymized medical data seeks to file a notification under Article 9, paragraph (2) of the Act, it must submit a written notification based on Form No. 4 to the competent ministers, along with documents relating to the particular that will change and a copy of the certificate referred to in the preceding Article.

(Application for Approval for Succession)

Article 9(1)A person seeking to file a notification under Article 10, paragraph (3) of the Act must submit a written notification based on Form No. 5 to the competent ministers, along with the following documents and the certificate referred to in Article 7 for the transferor:

(i)if it is a corporation that has succeeded to the status of a certified producer of anonymized medical data as a result of taking over all of another person's certified business pursuant to the provisions of Article 10, paragraph (1) of the Act, a business transfer certificate based on Form No. 6 and documents evidencing that all of the certified business was transferred, and a copy of the certificate referred to in Article 7 for the successor;

(ii)if it is a corporation surviving a merger under Article 10, paragraph (2) that has succeeded to the status of a certified producer of anonymized medical data, its certificate of registered information and a copy of the certificate referred to in Article 7 for that corporation; or

(iii)if it is a corporation incorporated in a merger as under Article 10, paragraph (2) of the Act that has succeeded to the status of a certified producer of anonymized medical data, its certificate of registered information.

(2)A person seeking the approval referred to in Article 10, paragraph (4) of the Act must submit a written application based on Form No. 7 to the competent ministers, along with the following documents and the certificate referred to in Article 7 for the transferor:

(i)a business transfer certificate based on Form No. 8 and documents evidencing that all of the certified business will be transferred;

(ii)documents proving that the transferee meets the certification standards set forth in the items of Article 8, paragraph (3) of the Act; and

(iii)documents set forth in the items of Article 3, paragraph (2) for the transferee.

(3)A person seeking the approval referred to in Article 10, paragraph (5) of the Act must submit a written application based on Form No. 9 to the competent ministers, along with the following documents and the certificate referred to in Article 7 for the transferor:

(i)documents evidencing that a merger will be carried out;

(ii)documents evidencing that the corporation that will survive the merger or that will be incorporated in the merger will meet the certification standards set forth in the items of Article 8, paragraph (3) of the Act; and

(iii)the documents set forth in the items of Article 3, paragraph (2) for the corporation that will survive the merger or that will be incorporated in the merger.

(4)A person seeking the approval referred to in Article 10, paragraph (6) of the Act must submit a written application based on Form No. 10 to the competent ministers, along with the following documents and the certificate referred to in Article 7 for the transferor:

(i)a business transfer certificate based on Form No. 11 and documents evidencing that all of the certified business will be succeeded to in a company split;

(ii)documents evidencing that the corporation that will succeed to all of the certified business in the company split meets the certification standards set forth in the items of Article 8, paragraph (3) of the Act; and

(iii)the documents set forth in the items of Article 3, paragraph (2) for the corporation that will succeed to all of the certified business in the company split.

(5)A person seeking to file a notification under Article 10, paragraph (8) of the Act must submit a written notification based on Form No. 12 to the competent ministries, along with the certificate referred to in Article 7 for the transferor.

(Notification of Discontinuation)

Article 10If a certified producer of anonymized medical data seeks to file a notification under Article 11, paragraph (1) of the Act, it must submit a written notification based on Form No. 13 to the competent ministers, along with the certificate referred to in Article 7.

(Notification of Dissolution)

Article 11If a liquidator or bankruptcy trustee or a person equivalent thereto under the laws and regulations of a foreign state files a notification under Article 12, paragraph (1) of the Act, that person must submit a written notification based on Form No. 14 to the competent ministers, along with the certificate referred to in Article 7.

(Particulars Required to Be Entered in Books)

Article 12(1)The particulars specified by Order of the competent ministries that are referred to in Article 13 of the Act are the following:

(i)the following particulars, when a certified producer of anonymized medical data has provided an enterprise handling anonymized medical data with anonymized medical data:

(a)particulars sufficient to identify the enterprise handling anonymized medical data, including the name and address thereof;

(b)the date on which it provided the anonymized medical data; and

(c)the items of the anonymized medical data;

(ii)the following particulars, when an enterprise handling anonymized medical data has provided another enterprise handling anonymized medical data with anonymized medical data:

(a)particulars sufficient to identify the enterprise handling anonymized medical data that is the providing source, including the name and address thereof;

(b)particulars sufficient to identify the enterprise handling anonymized medical data that is the recipient, including the name and address thereof;

(c)the date on which the anonymized medical data was provided; and

(d)the items of the anonymized medical data;

(iii)the following particulars, when the relevant person has deleted anonymized medical data pursuant to the provisions of Article 19 of the Act:

(a)the date on which it deleted the anonymized medical data; and

(b)the items of the anonymized medical data;

(iv)the following particulars, if the relevant person has provided medical information to another certified producer of anonymized medical data pursuant to the provisions of Article 25 of the Act:

(a)particulars sufficient to identify the other certified producer of anonymized medical data, including the name and address thereof;

(b)the date on which it provided the medical information; and

(c)the items of the medical information;

(v)the following particulars, if the relevant person has received medical information from another certified producer of anonymized medical data pursuant to the provisions of Article 25 of the Act:

(a)particulars sufficient to identify the other certified producer of anonymized medical data, including the name and address thereof;

(b)the date on which it received the medical information; and

(c)the items of the medical information;

(2)The books referred to in Article 13 of the Act must be prepared using written documents, electronic or magnetic records, or microfilm.

(3)In a case as prescribed in the items of paragraph (1), a certified producer of anonymized medical data must enter the particulars set forth in the relevant item of that paragraph in its books without delay, and preserve them for a period of three years from the date of entry.

(Business Plans)

Article 13(1)Prior to the commencement of each business year, a certified producer of anonymized medical data must prepare and submit to the competent ministers a business plan and an income and expenditure budget for its certified business, and issue a public announcement of the same. The same applies if it seeks to change these.

(2)Within three months from the end of each business year, a certified producer of anonymized medical data must prepare and submit to the competent ministries a business report and a statement of income and expenditure for the certified business, and issue a public announcement of the same.

(Procedure for Rescission of Certification)

Article 14Having rescinded the certification of a person that has been certified as referred to in Article 8 paragraph (1) of the Act based on Article 15, paragraph (1) or Article 16, paragraph (1) of the Act, the competent ministers are to notify the person that had obtained that certification in writing thereof.

(Amount of Travel Expenses)

Article 15The amount constituting the amount of travel expenses that are referred to in Article 5 of the Order (referred to as the "amount constituting travel expenses" in the following Article and Article 17) is the amount of travel expenses that are to be paid out pursuant to the provisions of the Act on Travel Expenses of National Public Officers, etc. (Act No. 114 of 1950; referred to as the "Travel Expenses Act" in the following Article and Article 17). In such a case, the amount of travel expenses for any official making a business trip to the place of inspection for the purpose of the relevant inspection is to be calculated on the assumption that the official is at the fourth grade of service on the Administrative Service (I) Salary Schedule prescribed in Article 6, paragraph (1), item (i), (a) of the Act on Remuneration of Officials in Regular Service (Act No. 95 of 1950).

(Location of Office Where Official Works)

Article 16When the amount constituting travel expenses is calculated, the location of the office where the official works referred to in Article 2, paragraph (1), item (vi) of the Travel Expenses Act for each official making a business trip to the place of inspection for the purpose of the relevant inspection is set forth in the following table.

Classification of competent ministers	Location of office where official works
Prime Minister	1-11-39 Nagata-cho, Chiyoda-ku, Tokyo, Japan
Minister of Education, Culture, Sports, Science and Technology	3-2-2 Kasumigaseki, Chiyoda-ku, Tokyo, Japan
Minister of Health, Labour and Welfare	1-2-2 Kasumigaseki, Chiyoda-ku, Tokyo, Japan
Minister of Economy, Trade and Industry	1-3-1 Kasumigaseki, Chiyoda-ku, Tokyo, Japan

(Details Related to Calculation of Amount of Travel Expenses)

Article 17(1)The preparation fee referred to in Article 6, paragraph (1) of the Travel Expenses Act is not included in the amount constituting travel expenses.

(2)The number of days during which an inspection is conducted is deemed to be three days per office or place of business subject to the inspection when the amount equivalent to travel expenses is calculated.

(3)The miscellaneous travel expenses referred to in Article 6, paragraph (1) of the Travel Expenses Act are deemed to be 10,000 yen when the amount constituting travel expenses is calculated.

(4)If, pursuant to the provisions of Article 46, paragraph (1) of the Travel Expenses Act, the competent ministers do not pay out any part of travel expenses that exceed actual costs or that are unnecessary, the amount equivalent to that part is not included in the calculation of the amount constituting travel expenses.

(Standards for Producing Anonymized Medical Data)

Article 18The standards specified by Order of the competent ministers that are referred to in Article 18, paragraph (1) of the Act are as follows:

(i)deleting all or part of any description or account contained in the medical information that can be used to identify a specific individual (this includes replacing all or part of it with another description or account, using an approach that does not have the regularity to enable someone to restore the full or partial description or account);

(ii)deleting all individual identification codes contained in the medical information (this includes replacing them with other descriptions or accounts, using an approach that does not have the regularity to enable someone to restore the individual identification codes);

(iii)deleting codes that link medical information to the information derived from measures taken involving that medical information (limited to codes cross-linking information that is being handled by a certified producer of anonymized medical data at the time in question) (this includes replacing such codes with other codes that cannot be used to link the medical information and information derived from measures taken involving that medical information, using an approach that does not have the regularity to enable someone to restore the codes);

(iv)deleting idiosyncratic descriptions and accounts (including replacing the idiosyncratic descriptions and accounts with other descriptions and accounts by a method that does not have the regularity to enable someone to restore the idiosyncratic descriptions and accounts); and

(v)beyond the measures set forth in the preceding items, taking appropriate measures based on the results of a consideration of the attributes of a database or similar collection of medical information, including the differences between descriptions and accounts contained in medical information that is included in the database or similar collection of medical information and those contained in other medical information that makes up the same database or similar collection of medical information.

(Record of Deleting Medical and Related Information)

Article 19(1)Having deleted medical and related information under Article 19 of the Act, a certified producer of anonymized medical data must create a record of the following particulars and preserve the record for a period of three years from the date of creation:

(i)the date on which it deleted the medical and related information; and

(ii)the items of the medical and related information

(2)The means of creating a record as referred to in the preceding paragraph is a means that involves creating that record using a written document, electronic or magnetic record, or microfilm.

(Supervision of Workers)

Article 20A certified producer of anonymized medical data is to exercise the supervision that it is required to exercise over its workers pursuant to the provisions of Article 21 of the Act by confirming that business is being carried out in accordance with the security control measures specified in Article 6 and by taking other measures.

(Conclusion of Entrustment Contracts)

Article 21(1)If entrusting a person with business as under Article 23, paragraph (1) of the Act, a certified producer of anonymized medical data must enter into a contract with the enterprise certified for entrustment with handling medical and related information and anonymized medical data that is entrusted with that business, through a document stating the following particulars:

(i)the scope of operations relating to the entrustment;

(ii)the particulars of procedures for operations subject to entrustment;

(iii)that the certified producer of anonymized medical data can check on whether or not operations subject to entrustment are being performed properly and smoothly in accordance with the procedures referred to in the preceding item;

(iv)the particulars of giving instructions to the enterprise certified for entrustment with handling medical and related information and anonymized medical data;

(v)that having given instructions as referred to in the preceding item, the certified producer of anonymized medical data can check on whether or not measures have been taken based on those instructions;

(vi)the particulars of reports that the enterprise certified for entrustment with handling medical and related information and anonymized medical data makes to the certified producer of anonymized medical data; and

(vii)other particulars necessary for operations subject to entrustment.

(2)The provisions of the preceding paragraph apply mutatis mutandis to re-entrustment under Article 23, paragraph (2) of the Act. In such a case, the term "certified producer of anonymized medical data" is deemed to be replaced with "enterprise certified for entrustment with handling medical and related information and anonymized medical data that is entrusted with all or part of the handling of medical and related information or anonymized medical data pursuant to the provisions of Article 23, paragraph (1) of the Act".

(3)The provisions of paragraph (1) apply mutatis mutandis to re-entrustment under Article 23, paragraph (2) of the Act which is applied pursuant to the provisions of paragraph (3) of that Article. In such a case, the term "certified producer of anonymized medical data" is to be deemed to be replaced with "an enterprise certified for entrustment with handling medical and related information and anonymized medical data who is further entrusted with all or part of the handling of medical and related information or anonymized medical data pursuant to the provisions of Article 23, paragraph (2) of the Act."

(Supervision of Entrusted Persons)

Article 22A certified producer of anonymized medical data is to exercise the supervision over an entrusted person that it is required to exercise pursuant to the provisions of Article 24 of the Act by carrying out audits of security control operations and taking other measures to achieve the proper security controls for medical and related information and anonymized medical data.

(Provision of Medical Information to Other Certified Producers of Anonymized Medical Data)

Article 23In giving and receiving medical information under Article 25, paragraph (1) of the Act, a certified producer of anonymized medical data must enter into a contract with another certified producer of anonymized medical data relating to the giving and receiving of that information through a document stating the following particulars, and must preserve the written contract:

(i)the name and address of the certified producer of anonymized medical data providing the medical information pursuant to the provisions of Article 25, paragraph (1) of the Act, and the name of its representative;

(ii)the name and address of the certified producer of anonymized medical data receiving what is provided as referred to in the preceding paragraph, and the name of its representative;

(iii)the items of the medical information referred to in item (i); and

(iv)the means of providing the medical information referred to in item (i).

(Complaint Processing)

Article 24A certified producer of anonymized medical data must process complaints about the handling of medical and related information or anonymized medical data that it manages in connection with its certified business pursuant to the provisions of the following items:

(i)when receiving a complaint, investigating the cause of the matter to which the complaint pertains without delay;

(ii)taking the required measures if, based on the results of an investigation into the cause of a matter as referred to in the preceding item, it is necessary to improve the handling of medical and related information or anonymized medical data that it manages in connection with its certified business; and

(iii)producing a record of its complaint processing that states the details of the complaint, the results of its investigation into the cause, and improvement measures, and preserving the record for a period of three years from the date of its creation.

Article 25A certified producer of anonymized medical data must set in place the necessary framework to achieve the purpose referred to in Article 27, paragraph (1) of the Act by taking measures such as establishing a point of contact for receiving complaints and formulating procedures for dealing with them.

(Mutatis Mutandis Application of Provisions)

Article 26The provisions of Article 3, Article 4, Article 6 (excluding item (v), (c) and (d)), and Article 7 apply mutatis mutandis to the certification referred to in Article 28 of the Act; the provisions of Articles 8 through 11, Article 12, paragraph (1), item (iii), paragraphs (2) and (3), Article 13, Article 18, Article 19, Article 20, Article 22, Article 24, and Article 25 apply mutatis mutandis to an enterprise certified for entrustment with handling medical and related information and anonymized medical data; and the provisions of Article 14 apply mutatis mutandis to the rescission of the certification of an enterprise certified for entrustment with handling medical and related information and anonymized medical data. In such a case, the terms and phrases set forth in the middle column of the table below that appear in the provisions set forth in the left-hand column of that table are deemed to be replaced with the corresponding terms and phrases set forth in the right-hand column of that table.

Article 3, paragraph (1)	Article 8, paragraph (1)	Article 28
Article 3, paragraph (1)	Form No. 1	Form No. 15
Article 4	the business of producing anonymized medical data	the business prescribed in Article 28 of the Act
Article 7	Article 8, paragraph (1)	Article 28
Article 7	Form No. 2	Form No. 16
the main sentence of Article 8, paragraph (1)	Article 8, paragraph (2), items (ii) through (v)	Article 8, paragraph (2), item (iv) or (v)
the main sentence of Article 8, paragraph (1)	Form No. 3	Form No. 17
Article 8, paragraph (1), item (i)	the items of Article 8, paragraph (3)	Article 8, paragraph (3), items (i), (iii), and (iv)
Article 8, paragraph (2), item (i)	the business of producing anonymized medical data	the business prescribed in Article 28 of the Act
Article 8, paragraph (2), item (ii)	Article 8, paragraph (2), items (ii) through (v)	Article 8, paragraph (2), item (iv) or (v)
Article 8, paragraph (3)	Form No. 4	Form No. 18
the main sentence of Article 9, paragraph (1)	Form No. 5	Form No. 19
Article 9, paragraph (1), item (i)	Form No. 6	Form No. 20
the main sentence of Article 9, paragraph (2)	Form No. 7	Form No. 21
Article 9, paragraph (2), item (i)	Form No. 8	Form No. 22
Article 9, paragraph (2), item (ii)	the items of Article 8, paragraph (3)	Article 8, paragraph (3), items (i), (iii), and (iv)
the main sentence of Article 9, paragraph (3)	Form No. 9	Form No. 23
Article 9, paragraph (3), item (ii)	the items of Article 8, paragraph (3)	Article 8, paragraph (3), items (i), (iii), and (iv)
the main sentence of Article 9, paragraph (4)	Form No. 10	Form No. 24
Article 9, paragraph (4), item (i)	Form No, 11	Form No. 25
Article 9, paragraph (4), item (ii)	the items of Article 8, paragraph (3)	Article 8, paragraph (3), items (i), (iii), and (iv)
Article 9, paragraph (5)	Form No. 12	Form No. 26
Article 10	Form No. 13	Form No. 27
Article 11	Form No. 14	Form No. 28
Article 12, paragraph (3)	the items of paragraph (1)	paragraph (1), item (iii)
Article 12, paragraph (3)	the relevant item of that paragraph	that item
Article 14	Article 8, paragraph (1)	Article 28

(Means of Requesting a Person to Stop Providing Medical Information)

Article 27A person is to make a request to an enterprise handling medical information to stop providing information under Article 30, paragraph (1) of the Act in writing, orally, or by other means.

(Prior Notice Concerning the Provision of Medical Information)

Article 28(1)The relevant person is to notify the principal as under Article 30, paragraph (1) or (2) of the Act as follows:

(i)notifying the principal after specifying the necessary period for the principal who is identified in medical information that is to be provided to a certified producer of anonymized medical data, or for a surviving family member of the principal, to request the it to stop providing that information; and

(ii)using an appropriate and reasonable means that allows the principal to become cognizant of the particulars set forth in the items of Article 30, paragraph (1) of the Act.

(2)If an enterprise handling medical information files a notification under Article 30, paragraph (1) or (2) of the Act, it must do so in one of the following ways:

(i)a means that involves using an electronic data processing system (meaning an electronic data processing system that connects computers used by the competent ministers with a computer used by a person making a notification over telecommunications lines) as specified by the competent ministers; or

(ii)a means that involves the submission of a written notification based on Form No. 29 and something such as an optical disk onto which the particulars required to be stated in the written notification have been recorded.

(3)If an enterprise handling medical information has an agent file a notification under Article 30, paragraph (1) or (2) of the Act, it must submit to the competent ministers a document (inclusive of an electronic or magnetic record; the same applies hereinafter) evidencing the authority of the agent based on Form No. 30.

(Public Announcement by Competent Ministers Regarding Provision of Medical Information)

Article 29The public announcement under Article 30, paragraph (3) of the Act is to be issued using the Internet or by other appropriate means without delay after a notification under paragraph (1) or (2) of that Article has been filed.

(Public Announcement by an Enterprise Handling Medical Information Regarding Provision of Medical Information)

Article 30When a public announcement under Article 30, paragraph (3) of the Act has been issued, an enterprise handling medical information is to promptly issue a public announcement of the particulars set forth in paragraph (1) of that Article (or the particulars set forth in item (ii), (iii), or (v) of that paragraph after any change that has been made) using the Internet or by other appropriate means.

(Delivery of Documents)

Article 31The particulars specified by Order of the competent ministries referred to in Article 31, paragraph (1) of the Act are the following particulars:

(i)an indication that a request prescribed in Article 30, paragraph (1) of the Act has been made;

(ii)particulars sufficient to identify the person that has made the request referred to in the preceding item, including the name and address thereof;

(iii)the date on which it received the request referred to in item (i);

(iv)an indication that the document specified by Order of the competent ministries prescribed in Article 31, paragraph (1) of the Act will be delivered;

(v)the date on which it will stop providing the medical information; and

(vi)the date of delivery of the document to be delivered upon the request referred to in item (i).

(Obligation to Preserve a Copy of Documents)

Article 32The relevant person must preserve a copy of a document or an electronic or magnetic record as under Article 31, paragraph (3) of the Act for three years after the date when the document is delivered pursuant to the provisions of paragraph (1) of that Article or the electronic or magnetic record is provided pursuant to the provisions of paragraph (2) of that Article.

(Creating Records of the Provision of Medical Information)

Article 33The relevant person is to create a record under Article 32, paragraph (1) of the Act as follows:

(i)it is to create the record using a written document, electronic or magnetic record, or microfilm; and

(ii)it must create a record promptly once it has provided medical information to a certified producer of anonymized medical data; provided, however, that if it has provided or expects to provide medical information to the certified producer of anonymized medical data continuously or repeatedly, it may create the record in an integrated manner.

(Particulars to Be Recorded Regarding the Provision of Medical Information)

Article 34(1)The particulars specified by Order of the competent ministries that are referred to in Article 32, paragraph (1) of the Act are the following particulars:

(i)the date on which the relevant person provided the medical information to the certified producer of anonymized medical data pursuant to the provisions of Article 30, paragraph (1) of the Act;

(ii)particulars sufficient to identify the certified producer of anonymized medical data referred to in the preceding item, including the name and address thereof;

(iii)particulars sufficient to identify the principal who is identified by the medical information referred to in item (i), including the name and address thereof; and

(iv)the items of the medical information.

(2)It is permissible not to create a record of a particular set forth in any of the items of the preceding paragraph that is identical in substance to a particular contained in a record as referred to in Article 32, paragraph (1) of the Act that has already been produced by the means prescribed in the preceding Article (but only if that record has been preserved).

(Period for the Preservation of Records Regarding the Provision of Medical Information)

Article 35The period specified by Order of the competent ministries that is referred to in Article 32, paragraph (2) of the Act is the period specified in the relevant of the following items for the classification set forth in that item:

(i)if a record has been created by the means prescribed in the proviso of Article 33, item (ii):the period that runs until the last day in the three-year period calculated as beginning on the last day on which the relevant person provided the medical information to which the record pertains; or

(ii)cases other than the preceding item:for three years.

(Confirmation When Receiving Medical Information)

Article 36(1)The relevant person is to make the confirmation under Article 33, paragraph (1) of the Act pursuant to the provisions of the relevant of the following items for the classification set forth in that item:

(i)the particulars referred to in Article 33, paragraph (1), item (i) of the Act:by a means that involves receiving a report from the enterprise handling medical information that is providing the medical information or any other such appropriate means; or

(ii)the particulars referred to in Article 33, paragraph (1), item (ii) of the Act:being presented with a record confirming that a public announcement has been issued by the competent ministers pursuant to the provisions of Article 30, paragraph (3) of the Act and being presented with a record indicating circumstances under which medical information was acquired from an enterprise handling medical information, or any other such appropriate means.

(2)Notwithstanding the provisions of the preceding paragraph, the means of confirming particulars that the relevant person has already confirmed by a means prescribed in the preceding paragraph (but only if a record of the confirmation has been produced and preserved by the means prescribed in the following Article) when being provided with other medical information by an enterprise handling medical information, is to confirm that the substance of the particulars is identical to that of the particulars set forth in the items of Article 33, paragraph (1) concerning the other medical information with which it was provided.

(Particulars to Be Recorded When Medical Information Is Received)

Article 37(1)The particulars specified by Order of the competent ministries referred to in Article 33, paragraph (3) of the Act are the following particulars:

(i)the date on which the relevant person receives the medical information pursuant to the provisions of Article 30, paragraph (1) of the Act;

(ii)the particulars set forth in the items of Article 33, paragraph (1) of the Act;

(iii)particulars sufficient to identify the principal who is identified by the medical information referred to in item (i), including the name and address thereof;

(iv)the items of medical information referred to in item (i); and

(v)an indication that a public announcement has been issued pursuant to the provisions of Article 30, paragraph (3) of the Act.

(2)It is permissible not to create a record of a particular set forth in the preceding paragraph which is identical in substance to a particular contained in the record referred to in Article 33, paragraph (3) of the Act that has already been produced by the means prescribed in the preceding Article (but only if that record has been preserved).

(Mutatis Mutandis Application of Provisions)

Article 38The provisions of Article 33 and Article 35 apply mutatis mutandis to a certified producer of anonymized medical data. In such a case, the terms and phrases set forth in the middle column of the following table that appear in the provisions set forth in the left-hand column of that table are deemed to be replaced with the corresponding terms and phrases set forth in the right-hand column of that table.

Article 33	Article 32, paragraph (1)	Article 33, paragraph (3)
	provided medical information to a certified producer of anonymized medical data	been provided with medical information by an enterprise handling medical information
	medical information to the certified producer of anonymized medical data	by an enterprise handling medical information
	has provided	has been provided with medical information
	expects to provide	expects to be provided with medical information
Article 35	Article 32, paragraph (2)	Article 33, paragraph (4)
Article 35	provided	was provided with

(Identification of Persons Carrying Out On-site Inspections)

Article 39The identification of an official referred to in Article 35, paragraph (2) of the Act is to be based on Form No. 31.