Executive Yuan Announces New Health Insurance Regulations Effective! Starting August 10, Nationwide Implementation with 'Heavy Fines up to NT$10 Million for Violators' – Full Details Here

The regulations governing the use of National Health Insurance (NHI) data have undergone significant changes. In December 2025, Taiwan's Legislative Yuan passed the 'National Health Insurance Data Management Act' in its third reading, establishing a more comprehensive system for the collection, management, and utilization of NHI data, as well as safeguarding individuals' rights over their own data. The Executive Yuan recently announced that the new law will officially take effect on August 10. One key provision grants individuals the right to 'opt out' of the secondary use of their NHI data beyond its original purpose. Additionally, unauthorized use of NHI data without approval will be subject to fines of up to NT$10 million. Any data already obtained must be legally destroyed.

The new NHI system takes effect on August 10, granting citizens the 'right to opt out' and refuse data use for research. Previously, NHI data was used not only by government agencies but also by medical institutions and academic research units for statistical analysis and research. However, in Constitutional Court Judgment No. 13 of 2022 (111-Nian), the court ruled that while the existing system allowed the NHI database to be used for public and academic research purposes, it lacked sufficient personal data oversight mechanisms and clear channels for individuals to request the cessation of data usage. As a result, parts of the system were deemed unconstitutional. The Constitutional Court ordered relevant institutions to amend the system within three years. The Executive Yuan passed the draft of the 'National Health Insurance Data Management Act' in May 2025, and the Legislative Yuan completed its third reading in December of the same year. After promulgation by the President and announcement by the Executive Yuan, the new system officially comes into force on August 10 this year.

Under the new law, the use of NHI data for purposes beyond its original collection must serve clear public interests. These include improving healthcare quality and accessibility, promoting public health and social welfare, advancing public interest, or reducing health disparities. Furthermore, data usage must not be for commercial purposes, and application eligibility is restricted. Only government agencies, administrative corporations, medical institutions, academic research institutions and universities, as well as legal entities, universities, or other organizations commissioned by government agencies, may apply for data access.

Unauthorized use of NHI data will result in fines of up to NT$10 million, and any obtained data must be 'mandatorily destroyed.' Another major change in the new system is the formal establishment of the public's right to 'opt out' of secondary use of NHI data. Within 30 days after the new law takes effect, the Ministry of Health and Welfare and the NHI Administration will suspend the acceptance of data usage applications from government agencies, medical institutions, and academic research institutions. During this period, individuals may submit opt-out requests. If no opt-out request is made within the 30-day window, individuals will be considered to have consented, in principle, to the use of their NHI data for secondary purposes that meet specific public interest criteria under the new law. However, this does not mean consent is permanent. Individuals may still submit opt-out requests after the initial period.

The new law also strengthens legal liability for unauthorized use of NHI data. Any entity that uses NHI data for purposes beyond its original collection without approval from the competent authority or insurer may be fined between NT$2 million and NT$10 million. In addition to financial penalties, violators will be barred from submitting new NHI data usage applications for one year from the date the penalty is delivered. If violators have already obtained relevant NHI data, they must legally destroy it to prevent unauthorized data from being retained or used.

Given that the NHI database contains vast amounts of personal and sensitive information, the new law not only regulates data usage but also establishes criminal liability for threats to the database and related facilities. Anyone who endangers the safety of NHI database equipment or server rooms through theft, destruction, or other illegal means may face imprisonment of one to seven years and a fine of up to NT$10 million. If the criminal act endangers national security or social stability, the penalty will be increased to three to ten years of imprisonment and a fine of up to NT$50 million. If the offender commits the crime by exploiting their official position, the sentence will be increased by half. Even attempted crimes will be punished according to law.