The health and medical sector sits under a dedicated layer of data rules stacked on top of China’s general data-protection regime. This domain collects the instruments that overseas pharma, medtech, hospital, and digital-health operators must layer onto PIPL, the Data Security Law, and the Network Data Security Regulation: the 2026 Measures for Data Security and Personal Information Protection of Healthcare Institutions, the national health and medical big-data measures, healthcare cybersecurity rules, the electronic-medical-record and population-health-information regimes, the Human Genetic Resources regulation and its implementing rules (with their cross-border choke points), real-world clinical-data guidance, and the foundational Basic Medical and Health Care and Health Promotion Law.
Patient health information is sensitive personal information under PIPL Article 28, so the consent, minimization, retention, and security baselines run higher in this sector than in most. Several instruments here also impose localization and access-control duties specific to medical institutions, and the genetic-resources regime adds an approval-and-security-review layer that has no general-regime equivalent.