Legal Protection of the Confidentiality of Patient Health Data in Physiotherapy Services

Abstract

The electronic medical record (EMR) makes the data of physiotherapy patients easy to store and share, but also easy to leak. This study analyses how the confidentiality of patient health data is protected in physiotherapy services and what legal duties physiotherapists have to keep it. It uses normative legal research with statutory, conceptual and case approaches, supported by secondary data. Confidentiality is protected in layers by Law No. 17 of 2023 on Health (Article 274(c) and Article 301), Minister of Health Regulation No. 24 of 2022 on Medical Records, and Law No. 27 of 2022 on Personal Data Protection (the PDP Law). The physiotherapy service standard (Minister of Health Regulation No. 65 of 2015) contains documentation forms but no confidentiality duty. Enforcement is fragmented: the administrative sanction in Regulation No. 24 of 2022 covers only the duty to operate an EMR, the data protection agency had not been formed on 16 September 2026, and by the authors’ calculation the maximum fine in Article 67(1) of the PDP Law falls by 96.00% after the criminal-penalty adjustment. The study concludes that physiotherapists are bound by duties across the whole data cycle, but enforcement is incomplete and needs implementing regulations, a supervisory agency and clarity on the roles of the different supervisors.