Data Security Obligations

Is the use of telehealth permitted?

Yes. In Thailand, telehealth is regulated as part of "telemedicine", which is the provision of healthcare services through the use of telecommunication technology. As there is no separate definition for telehealth under Thai law, any references to "telehealth" hereinafter will be covered under the scope of "telemedicine".

Recently, on 1 February 2021, the Ministry of Public Health ("MOPH"), which is the body responsible for overseeing public health in Thailand, has issued the Notification Re: Standards of Service in Respect of Medical Facility via Telemedicine System ("MOPH Notification ") which effectively legalised telemedicine businesses for medical facilities in Thailand.

How is telehealth regulated?

Currently, there are very limited guidelines and regulations available in relation to "telemedicine". The relevant guidelines and regulations include the following.

TMC Notification

The Notification No. 54/2563 (2020) issued by The Medical Council of Thailand effective from 21 July 2020 ("TMC Notification") defines "telemedicine" as "the transmission or communication of data on modern medicine from a medical practitioner, including from a health facility, in the public and / or private sector, from one place to another place by electronic means in order to provide advice, recommendations to other medical practitioners, or any other person, for a medical procedure within the scope of the medical profession, according to the condition, nature and existing circumstances under responsibility of the person who transmits or communicates such medical data.

The TMC Notification only governs the act of medical practitioners and not third party health facility or patients. Therefore, the TMC Notification is aimed at the action and ethical conduct of physicians and the limits of their practice.

According to the TMC Notification, the provision of telemedicine shall be in compliance with other regulations issued by the TMC, such as the Professional Standards for Medical Practitioner B.E. 2555 (2012), the Medical Competency Assessment Criteria for Licensing to Practice as a Medical Practitioner B.E. 2555 (2012) and its amendment B.E. 2563 (2020)) and other criteria or guidelines determined by the TMC within the scope of the medical profession law.

Similarly, there are also regulations governing the nursing profession in the provision of telemedicine services and these are issued by The Nursing and Midwifery Council of Thailand ("TNMC"). Generally, the nurses who provide telenursing will need to comply with the Professional Nursing and Midwifery Act B.E. 2528 (1985) (as amended) and other regulations issued by the TNMC such as in relation to ethical conduct.

TTMC Notification

Like the TMC Notification, the Thai Traditional Medical Council (“TTMC”) issued a Notification dated 8 February 2022 (“TTMC Notification”), governing the provision of Thai traditional telemedicine and Applied Thai Traditional telemedicine services. The definition of “Thai traditional telemedicine” is similar to the definition of “telemedicine” given under TMC Notification but applicable to “Thai traditional medicine” and “Thai traditional medical practitioner” instead of modern medicine and medical practitioner.

Under the TTMC Notification, the provision of Thai traditional telemedicine and Applied Thai Traditional telemedicine services shall be in compliance with other regulations issued by the TTMC, such as the Professional Standards for Thai Traditional Medical Practitioner B.E. 2563 (2020), the Professional Standards for Applied Thai Traditional Medical Practitioner B.E. 2560 (2017), the Medical Competency Assessment Criteria for Licensing to Practice as a Thai Traditional Medical Practitioner B.E. 2557 (2014) and its amendments, the Medical Competency Assessment Criteria for Licensing to Practice as an Applied Thai Traditional Medical Practitioner B.E. 2557 (2014) and its amendments, and other criteria or guidelines determined by the TTMC within the scope of the Thai traditional medical profession law.  

MOPH Notification

Previously there were concerns regarding the standard, quality and safety of services provided through telemedicine. Therefore, through the MOPH Notification, the MOPH regulates the provision of telemedicine service provided via telemedicine systems. In other words, the MOPH Notification assists in ensuring that receivers of telemedicine services are provided with standardised services performed by qualified practitioners.

The MOPH Notification defines "telemedicine service" as "medical and public health services of medical facilities provided to service receivers by practitioner via telemedicine in order to exchange information that is beneficial for consultation, examination, diagnosis, treatment, nursing, prevention, health reinforcement and recover and beneficial for continuous education of medical and public health personnel" and "telemedicine system" as "systems using digital platforms for providing medical and public health services to those who are in different places by transmitting visual and audio information or other methods".

Under the MOPH Notification, a medical facility who wishes to operate telemedicine services as an additional service must obtain permission from the MOPH. Likewise, medical facilities who wishes to operate telenursing must first obtain approval from the MOPH. Therefore, it can be understood that only existing medical facilities, as approved by the Medical Facilities Act B.E. 2541 (as amended), are able to provide such telemedicine services. Once the approval is granted, the medical facility must also comply with other obligations stated in the MOPH Notification such as ensuring that there are proper registration and recording systems in place, the medical facility is sufficiently staffed with skillful and experienced practitioners, appropriate telecommunication devices are used and the service recipients are provided with all necessary details of the processes prior to the provision of telemedicine services.

In light of the above, we view that this area of law is new and developing. Therefore, we can expect to see additional guidelines and standards in the future.

Are there specific fields of healthcare in relation to which telehealth services are currently available, and do they involve the use of proprietary technology or platforms?

The use of telemedicine has been increasing rapidly especially during the COVID-19 pandemic and is available for various healthcare services, such as general practice, psychology and ophthalmology. The general practice we have seen in the market is the provision of healthcare services via videoconferencing applications such as facetime, LINE or in-app chat / messenger.

There have been telemedicine services already provided in various cases in Thailand, e.g.:

• for diabetes patients in Pattani Province, the Southern part of Thailand;
• online services provided by various hospitals; and
• applications provided by licensed private hospitals and other platform providers.

Currently, the use of telemedicine has been restricted to the provision of medical knowledge for treatment and not as a platform for a sale of drugs / medicines. This is to avoid the wrongful advertisement or prescription of dangerous or specially controlled drugs (e.g. drugs for mental health) to the public without proper diagnosis by, and consultation with, the medical practitioner / pharmacist.

Does the public health system include telehealth services, and if so, are such services free of charge, subsidised or reimbursed? Where the public health system does not include telehealth services, are such services covered by private health insurance?

There is yet to be a clear guideline or development in this area. How the public health system in Thailand makes use of this fast growing technology is something to watch in the future.

Similarly, whether or not such services are covered by private health insurance would depend on the terms of the insurance and the agreement between the insurer and the insured (e.g. whether or not "healthcare service" includes telemedicine). We have also seen cooperation between a hospital and an insurer in developing an application to provide telemedicine services to the patients / insured.

Do specific privacy and/or data protection laws apply to the provision of telehealth services?

There is no specific privacy / data protection law that applies to the provision of telehealth services. Therefore, the general Personal Data Protection Act B.E. 2562 (2019) ("PDPA") (came fully into force on 1 June 2022) will apply. The PDPA governs how personal data are regulated in Thailand.

The term "personal data" means "any data pertaining to a natural person that enables the identification of that person, whether directly or indirectly, but specifically excluding the data of the deceased". "Sensitive personal data" refers to personal data under Section 26 of the PDPA such as health data and biometric data. As sensitive personal data are sensitive in nature and are susceptive to abuse, it is given a higher level of protection than personal data.

For the majority of the cases, explicit consent is required in the collection, use and disclosure of sensitive personal data. The relevant lawful basis of processing personal data (as opposed to sensitive personal data) in the context of telemedicine without an individual’s consent include but are not limited to: (i) performance of a contract; and (ii) legitimate interest as prescribed under the PDPA. For processing of sensitive data, the relevant lawful basis would include (i) vital interest (where the individual is incapable of giving consent by whatever reason); and (ii) legal compliance to achieve certain purposes such as public interest in public health or employment protection.

Additionally, the Notification puts emphasis on the confidentiality of data. Therefore, service providers must ensure that both the transmitter and recipient are aware of such obligation, and the service provider themselves must ensure that there are no loss or unauthorised disclosure of data during transmission. The IT system used for telemedicine must also be in line with the standards set out in the Electronic Transactions Act B.E. 2562 (2019),the PDPA, and the Notification of the Personal Data Protection Committee on Security Measures of Data Controller B.E. 2565 (2022).

How should the cross-border transfer of personal information collected and processed in the course of telehealth services be carried out to ensure compliance with applicable privacy laws?

The cross-border transfer of personal data is governed by the PDPA requiring that the destination country that receives such telehealth data must have adequate data protection standard in the views of the Personal Data Protection Committee and such transfer must be carried out in accordance with the sub-ordinated regulation to be issued under the PDPA.

The above requirement may not apply if such transfer falls under any exemption prescribed under the PDPA, including where the consent of the individual has been obtained, provided that he / she has been informed of the inadequate personal data protection standards of the destination country international organisation.

Are any specific laws, regulations, or self-regulatory instruments expected to be adopted in the near future?

Although there is currently no specific draft bill in relation to telehealth in place, the rise of COVID-19 cases in Thailand does provide a push to the regulators to issue additional guidelines as businesses in the health sector continue to thrive throughout the pandemic. Therefore, we can expect that this area will be further regulated in the near future.