Can Patients Erase Their Medical Records Under the PDPA?

Plenty of patients would like part of their treatment history to disappear from a hospital's system. Some were treated for a condition they would rather keep private. Some have moved to another hospital. When they hear that the Personal Data Protection Act (PDPA) gives a right to erasure, they assume that a request is all it takes.

This happened at Songklanagarind Hospital. A service user asked the hospital to delete their treatment history from its database. The Faculty of Medicine, Prince of Songkla University, asked the Office of the Personal Data Protection Committee (the PDPC Office) which legal grounds it could rely on in replying, so that other hospitals receiving similar requests would have guidance too.

This article sets out that answer and places it beside three other medical opinions: the data on a medical certificate, sending health check-up results to another agency, and publishing sanctions against doctors. All four were questions asked by bodies that wanted to get the law right. The people who benefit from the answers are patients, their families, private clinics and hospitals, and employers who receive medical certificates.

Can a patient have their treatment history erased?

A patient can ask, but the hospital does not always have to erase. In its opinion on the Faculty of Medicine, Prince of Songkla University's query about a request to erase treatment history in a hospital, the PDPC said the hospital may refuse where it still needs to keep the history under the medical facilities law, or keeps it for a purpose that Section 33, paragraph two exempts.

A hospital's work falls under several of these exceptions at once, which is why the right to erasure in paragraph one reaches medical records far less often than people expect. The PDPC went through the purposes for which a hospital keeps treatment history and the lawful basis behind each.

Two layers of grounds for refusal

First, the PDPC looked at whether the request meets Section 33, paragraph one at all. The right to erasure arises in four cases: the data is no longer necessary, consent is withdrawn, the data subject objects, or the data was collected unlawfully. If the treatment history is still needed for care, for compliance with the medical facilities law, or for a possible case that is not yet time-barred, the first case is not met.

Second come the exceptions in paragraph two, quoted above. Even where a request meets paragraph one, the right does not apply to retention for the purposes that paragraph two lists. The PDPC therefore concluded that Songklanagarind Hospital could refuse that requester if it needed to keep the history on these grounds.

After five years, must the hospital erase?

Not automatically, but the hospital cannot simply keep the record without thinking either. This is the second half of the opinion, and it is easy to miss. The PDPC stressed that a data controller has a duty under Section 37(3) to run a review system for erasing or destroying personal data when the retention period ends or the data exceeds what is necessary.

For treatment history held for more than five years from the date it was made, the PDPC said the university, through the hospital, must consider whether the data is no longer necessary for its lawful purposes, or whether it must still be kept for care, for public health, for legal claims or for legal compliance.

If the need has ended, or the patient is able to exercise the Section 33 right, the hospital must erase, destroy or anonymise the data under the Personal Data Protection Committee's 2024 notification on erasure. Clause 3 of that notification says that where no exception applies, the controller must act on the request without delay and within 90 days of receiving it.

The hospital refused. What can the patient do next?

The patient is entitled to an answer with reasons, and has a route to complain. The PDPC said the hospital should tell the requester that it cannot comply and explain why, citing Section 33 together with Clauses 3 and 8, paragraph three of the 2024 notification.

A reply that says only "we cannot delete" is incomplete. The patient should learn the purpose for which the hospital keeps the data and which exception it relies on. If the patient believes the hospital should erase and has not, the opinion points to the next step under Section 33, paragraph four, read with Section 73.

A patient who wants to exercise rights over their own treatment history can follow the order below. Steps that are AIPDPA's suggestions rather than legal requirements are marked as such.

1. Ask for access and a copy first. Section 30 gives the right to access and obtain a copy of your own data. Know what the hospital holds before deciding what to ask it to erase. (Suggestion.)
2. Submit the request in writing through the channel the hospital publishes. Give your name, patient number and the period of the history concerned, and keep proof of the date. (Suggestion.)
3. State the ground in the terms of Section 33, paragraph one, for example that the data is no longer necessary because you have not been treated there for a long time.
4. Wait for a reasoned answer. Where no exception applies, Clause 3 of the 2024 notification requires erasure without delay and within 90 days. Where the hospital cannot comply, Clause 8, paragraph three requires reasons.
5. Read the reasons. If the hospital says the record is still within the period the medical facilities law requires, or is still needed for your care, that answer matches the PDPC's opinion.
6. If you believe it should erase and has not, you may complain to the expert committee under Section 33, paragraph four, read with Section 73.

Each right has its own deadline. The detail from the responder's side is in Access, Erasure, Objection: Answering Data Subject Requests on Time. For another case where one law requires data to be kept while the data subject asks for erasure, see the log-retention example in 90-Day Logs vs the Right to Erasure.

What is on a medical certificate, and who may see it?

A medical certificate carries the health data needed for the purpose of that certificate, and its owner may show it to anyone. The Medical Council of Thailand asked the PDPC about its certificate forms for health check-ups and for driving licences. Part 1 of each form has the applicant fill in their own health history, such as underlying conditions, and sign to confirm it.

The PDPC took the view that issuing a medical certificate is part of the work covered by Section 26(5)(a), so a medical facility may collect this data without consent. How much it collects depends on the purpose of the certificate, case by case. The opinion gives the driving-licence certificate as an example: a history of epilepsy is needed because the condition may be dangerous while driving.

The Council's second question was how far the data subject may disclose the certificate to third parties. The PDPC explained that Section 7 of the National Health Act, and Section 26 read with Section 27 of the PDPA, are aimed at other people who come to know someone's health data and disclose it. They do not stop a person from disclosing their own.

Once the certificate is in someone else's hands, PDPA duties attach to that recipient as well. An employer, school, insurer or agency that takes a medical certificate is collecting that person's health data. The PDPC made this point in its observation on the third issue.

An HR team that receives sick-leave certificates every week is squarely within this. Certificates piled in a drawer, or photographed and posted in a department chat group, are Section 26 data that needs proper safeguards. On the lawful basis for keeping employees' certificates, see The Sensitive Data Your Company Holds Without Knowing It.

Can my health check-up results be passed to another agency?

Yes, without consent, if the recipient needs them for a task given to it by law and both sides meet several further conditions. This comes from the PDPC's opinion on Navamindradhiraj University's query about sending health check-up results under the one-million-people check-up policy.

The facts: the Bangkok Metropolitan Administration (BMA) asked the university to send check-up results from Vajira Hospital's system to the BMA Portal with names, national ID numbers, addresses, health-risk data, vital signs, screening results and laboratory results. The earlier arrangement had been to send the results with identities masked. The university asked whether this was permitted.

The PDPC noted that the BMA has public-health powers under its own statute. If the BMA considers this dataset necessary for that mission, it may collect it without consent under Section 24(4), or Section 26(5)(a) and/or (b), as the case may be, and the university may disclose it on the same bases read with Section 27, paragraph one. The PDPC did not itself rule on whether identifiable data was necessary. It set conditions for both sides instead.

• The recipient is bound by the stated purpose. The BMA must not use or disclose the data beyond the purpose it gave the university when requesting it, under Section 27, paragraph two, and only as set out in the project's privacy notice.
• Only what is necessary. Both sides must stay within Section 22.
• The sender must inform the people examined. The university must give the Section 23 details before or at the time of collection, including the purposes and the categories of bodies to which data may be disclosed, such as the BMA.
• The sender must record the disclosure in its Section 39 record, as Section 27, paragraph three requires.
• Both sides must secure the data under Section 37(1) and the Committee's minimum standard, with specific measures to keep health data confidential under Section 26(5)(b).
• A Data Sharing Agreement may be made, setting the purpose, method, conditions and each party's duties. The PDPC offered this as an observation for the two bodies to consider as appropriate.

For anyone attending a check-up, the practical point is to read the privacy notice at registration. It should say which kinds of bodies will receive the results and why. The PDPC also explained that the university, as a state agency, must follow the official information law first, with the PDPA applying in addition under Section 3.

Can a doctor's licence suspension be made public?

Licence status can be disclosed; the content of a sanction order has to be weighed first. The PDPC's opinion on the Medical Council's query about disclosing sanctions against medical practitioners starts from this fact: when someone searches the Council's website for a doctor whose licence is suspended or revoked, the system shows "no record found". The Council thought it should show the status and the suspension period instead, to protect the public.

The PDPC said the Council may publish on its website a practitioner's name, licence number, licence status, any revocation or suspension, and the suspension period, without consent, under Section 24(4) and (6) read with Section 27, paragraph one. This is work within its powers under the medical profession law to protect public safety. The Council must log the disclosure in its record of processing, and what it shows must be accurate under Section 35.

On two points the PDPC gave a test rather than a yes or no. The first is whether a past suspension may stay visible after the suspension period has ended. The Council must weigh how useful and necessary that disclosure is for protecting the public against whether it would be an unreasonable intrusion on the practitioner's privacy, under the official information law and the necessity principle in Section 22 of the PDPA.

The second is publishing sanction orders online, in whole or in part. The PDPC said this lies within the Medical Council Committee's discretion under the Council's own regulations, subject to the same weighing and to disclosing only the personal data that is necessary. It urged particular care with posting a full copy of an order whose content may affect the honour and reputation of the persons concerned without removing or redacting identifying parts, especially where related legal proceedings are not yet final.

A sanction order against a doctor usually contains a patient's story too. "Persons concerned" in the opinion is therefore not limited to the doctor. A patient or relative who made the complaint also has a stake in what is redacted before publication.

Four opinions: who may do what?

What must private clinics and hospitals get right?

All four opinions came from state bodies and a professional council, but Sections 26, 27, 33 and 37 apply to every data controller. Aesthetic clinics, dental clinics, laboratories and private hospitals hold health data, which the law places under Section 26. Mistakes with it are penalised more heavily than mistakes with ordinary data.

The easiest mistake to make is disclosure: a staff member tells a relative a test result over the phone when the patient has not authorised it, a lab result goes to the wrong person, or a patient's photo appears in the clinic's marketing without explicit consent. Disclosing health data in breach of Section 27 is a criminal offence.

Where the act is done to obtain an unlawful benefit, Section 79, paragraph two raises the penalty to imprisonment of up to one year, a fine of up to 1 million baht, or both. Offences under this section are compoundable. Where the clinic is a juristic person, liability reaches the individuals who gave the instruction or failed in their duty.

The list below can be checked at the front counter in a single morning. Each item ties back to something the PDPC said in these opinions, or to a section quoted above.

• There is a channel for patients' rights requests, and a named person who replies in writing with reasons.
• The retention period for medical records is written down, with a review cycle for files past the minimum period under the medical facilities law.
• Health-history forms ask only what is needed for the service or the certificate being issued.
• No results or history are given by phone, chat or to relatives until the requester's identity and authority are confirmed.
• The privacy notice names the categories of bodies that may receive data, such as insurers, outside laboratories and state agencies.
• Every disclosure made without consent is logged in the Section 39 record.
• Any routine transfer of patient data to another body is covered by a written agreement stating the purpose and each party's duties.

What do the opinions leave unanswered?

An advisory opinion answers the facts it was asked about. Readers may go on to wonder about at least five things that none of the four documents settles, so this article does not settle them either.

• The longest period treatment history may be kept. The opinion refers to a five-year minimum under the medical facilities law and leaves the hospital to assess necessity after that. It sets no ceiling.
• Limitation periods for each type of case. The opinion mentions cases that are not yet time-barred as one reason to keep records, without giving any period.
• Erasing only certain entries, such as a single test result. The opinion addresses treatment history as a whole.
• Whether identifiable check-up results were in fact necessary. The PDPC left the requesting body to assess necessity against its own mission.
• How long a past sanction should stay visible after a suspension ends. The PDPC gave a balancing test, not a number.

The right to erasure under the PDPA is bounded by the purpose for which data is kept, and medical records are data that several laws want preserved. What patients gain from this opinion is the right to know the reason, and the right to have the hospital review the record once that reason is gone. For the case where officials ask a hospital for patient history, see Police Want Customer Data: What a Thai Company May Hand Over.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)