医療機関における個人情報の取扱いに関する注意喚起 ｜個人情報保護委員会

This page presents alerts from the Personal Information Protection Commission regarding medical institutions' handling of personal information. Following cases where multiple clinics provided ophthalmic surgery videos to medical device manufacturers, it clarifies that surgical videos constitute "personal information" if patients can be identified through cross-reference with medical records, and "personal data" if systematically managed. Medical institutions must specify and notify their purposes of use, obtain proper consent before third-party provision, and implement appropriate security measures with staff supervision. Data breaches involving sensitive information or affecting over 1,000 individuals require reporting to the Commission and notification to affected individuals.