Health Information Policy

Heartology's Commitment to Patient Privacy and Data Security

At Heartology Cardiovascular Hospital, we understand that your health information is a highly personal and sensitive matter. We are committed to protecting the confidentiality, integrity, and security of your medical data in accordance with the legal and ethical standards that apply in Indonesia, as well as global best practices.

This Health Information Policy page is designed to provide transparency about:

• How we collect, use, and protect your health data.
• Your rights as a patient regarding access to, updating of, or restriction of the use of your medical information.
• Our obligations in complying with data protection regulations, including cooperation with third parties involved in your care.

This policy applies to all Heartology services, both offline (in-person consultations, physical medical records) and digital (website, app, telemedicine).

By accessing our services, you agree to the terms set out in this policy. We are always open to questions or feedback through the contacts provided at the end of this page.

This Health Information Policy applies to all data and medical records managed by Heartology Cardiovascular Hospital, whether in electronic, physical, or verbal form, including but not limited to:

1. Types of Data Covered
   • Patient Medical Records: Health history, diagnoses, lab results, prescriptions, surgical reports, and consultation notes.
   • Administrative Data: Identity information (name, address, national identity card (KTP) number), insurance details, and payments.
   • Digital Data: Activity on Heartology platforms (website, app, telemedicine), including login history, online consultations, and document uploads.
   • Health Research Data: Patient information used for medical research (with explicit consent).
2. Parties Bound by the Policy: this policy governs all parties that interact with Heartology patient data, such as:
   • Medical & Non-Medical Personnel: Doctors, nurses, administrative staff, and contractors.
   • Healthcare Service Partners: Laboratories, pharmacies, referral hospitals, or insurance providers.
   • Technology Vendors: IT service providers, cloud storage, or supporting applications (example: EMR/Electronic Medical Record systems).
3. Data Storage Media
   • Electronic: Hospital databases, official email, the Heartology app, and telemedicine platforms.
   • Physical: Paper documents, printouts (CT scan, MRI), or consultation recordings.
   • Verbal Communication: Discussions among medical personnel or with patients (recorded in the medical record).
4. Special Situations Covered
   • Data Security Scanning: Periodic audits to prevent security violations (data breaches).
   • Cross-Border Data Transfers: If an international patient needs a referral abroad, the data will be protected in accordance with applicable law.
   • Emergency Exceptions: In an emergency, information may be shared without consent to save a life (in accordance with Article 57 of the Health Law, UU Kesehatan).
5. What Is Not Covered
   • Anonymous Data: Information that cannot be traced to a patient's identity (example: research statistics without personal details).
   • Patient Activity Outside Heartology Platforms: For example, search history on Google or personal social media.

At Heartology Cardiovascular Hospital, we recognize that you have full rights over your personal health information. Below are the details of your rights and how to exercise them:

1. Right of Access to Medical Records
   • You are entitled to obtain a copy of your medical records in the form of:
     • Physical documents (printed)
     • Digital files (PDF, CD, or through the Heartology app)
   • Request process:
     • Fill out an access request form at the Heartology Medical Records department.
     • Free of charge for the first copy (administrative fees may apply to additional requests). [KONFIRMASI]
     • Processed within a maximum of 7 working days (in accordance with Article 46 of the Health Law). [KONFIRMASI]
2. Right to Correct Inaccurate Data
   • If you find an error in your medical records (for example: an unrecorded allergy, an incorrect diagnosis), you can:
     • Submit a correction request in writing.
     • Attach supporting evidence (example: your latest lab results).
   • Our team will:
     • Verify the request within 3 working days. [KONFIRMASI]
     • Provide written confirmation after the update.
3. Right to Confidentiality (Privacy)
   • Your health information will not be shared without your consent, except for:
     • Medical emergencies.
     • Legal obligations (for example: reporting infectious diseases to the Ministry of Health).
   • You may request a list of the parties that have received your information in the last 2 years.
4. Right to Restrict Data Use
   • You may request restrictions on:
     • Marketing: Declining to receive promotions/non-medical notifications.
     • Health Research: Choosing not to take part in medical research.
   • How to submit a request:
     • Inform the administrative staff during registration.
     • Or contact the Data Protection Officer by email: info@heartology.id. [KONFIRMASI]
5. Right to Withdraw Consent (Consent Withdrawal)
   • If you previously agreed to data sharing (for example: for a referral to another doctor), you can:
     • Withdraw your consent at any time in writing.
     • The withdrawal only applies to future use of the data.
6. Right to File a Complaint
   • If your rights are not fulfilled, you are entitled to:
     • Report to the Heartology Compliance Officer (compliance@heartology.id). [KONFIRMASI]
     • File a complaint with the Ministry of Health of the Republic of Indonesia through its reporting system.

Heartology Cardiovascular Hospital uses and shares patient health information only for legitimate medical, legal, and operational purposes, under the principle of using only what is necessary (minimum necessary). The details are as follows:

A. Use of Information for Health Services

1. For Medical Care (Treatment)
   • Sharing data among doctors at Heartology for:
     • Accurate diagnosis (example: lab results are discussed with a specialist).
     • Care coordination (for example: the surgical & anesthesia teams access the patient's allergy history).
   • Practical example: Your ECG results can be accessed by the cardiologist and the ward nurses to monitor your condition.
2. For Payment Purposes (Payment)
   • Insurance claim administration:
     • Sharing diagnoses & procedures with insurance companies.
     • Only relevant data (no psychological notes unless necessary).
   • Self-payment verification: Credit card numbers are stored only by the encrypted financial system.
3. For Hospital Operations (Healthcare Operations)
   • Improving service quality:
     • Medical record audits by the QA team.
     • Staff training (data is de-identified when used for case studies).
   • Facility management: Patient visit data is anonymized to analyze outpatient clinic crowding.

B. Disclosure to Third Parties

1. With Patient Consent
   • Referrals to other doctors/specialists: “A referral letter to an internal medicine specialist only includes relevant information.”
   • Participation in medical research:
     • A separate consent form that explains the purpose of the research.
2. Without Consent (Based on Legal Obligations)
   • Mandatory reporting:
     • Infectious diseases (reported to the local health office).
     • Suspected violence or substance abuse.
   • Court orders: Heartology is required to provide data if there is an official letter from a judge.
3. Medical Emergency Situations
   • If a patient is unconscious and needs immediate treatment: Drug allergy information may be shared with the Emergency Room (ER) without consent for the patient's safety.

C. Non-Medical Use of Data

1. Health Promotion
   • Heart disease prevention newsletter (only for patients who subscribe).
   • Easy opt-out via a link in the email or app.
2. Technology Development
   • Anonymous data for:
     • Training diagnostic AI (example: analysis of hundreds of ECGs without patient identities).

D. Limits & Safeguards

• Minimum Necessary Principle: Billing staff only see the total cost, not psychotherapy details.
• Confidentiality Agreements: All vendors (example: external labs) are required to sign an NDA.
• Access Monitoring: System logs record who opens your medical records and when.

Regulatory Explanation

• Legal Basis:
  • Law No. 36 of 2009 on Health, Articles 57 to 59, for medical emergencies.
  • Law No. 27 of 2022 on Personal Data Protection (UU PDP), for the protection of personal data.
• Sanctions: Violations by stakeholders will be subject to sanctions in accordance with hospital regulations and applicable law.

Measures to Protect Patient Health Information

Heartology Cardiovascular Hospital applies world-class data security standards to protect patient health information. The following are our comprehensive security protocols:

1. Electronic Data Protection
   • Advanced Encryption:
     • All electronic data is protected with AES-256 encryption.
     • Data transmission uses the TLS 1.3 protocol for secure connections.
   • Multi-Factor Authentication:
     • The staff login system requires a combination of password + OTP.
     • Access to sensitive data requires additional biometric verification.
   • 24/7 Monitoring:
     • Intrusion detection systems (IDS/IPS) that continuously monitor for suspicious activity
     • Daily security checks by a dedicated IT team.
2. Strict Access Control
   • Principle of Least Privilege:
     • Staff can only access the data they need for their duties.
     • Doctors only see the medical records of the patients they treat.
   • Detailed Audit Logs:
     • The system records all access to patient data (who, when, and for what purpose).
     • Monthly audit log reviews by the compliance officer.
   • Identity Management:
     • Access is revoked immediately when staff resign or move to another division.
     • Periodic access permission updates every 3 months.
3. Physical Security
   • Protected Data Center:
     • Servers are equipped with an automatic fire suppression system.
     • Server rooms with biometric access control.
   • Physical Document Security:
     • Paper medical records are stored in steel cabinets with restricted access.
     • Document destruction procedures using certified shredders.
4. Protection Against Cyber Threats
   • Layered Defense:
     • Latest-generation firewalls with daily updates.
     • Enterprise anti-malware systems updated in real time.
   • Disaster Recovery:
     • Daily data backups to a geographically separate location.
     • A disaster recovery plan (DRP) that is tested every 6 months.
   • Security Testing:
     • Penetration testing by a third party every year.
     • Monthly vulnerability assessments.
5. Staff Training & Awareness
   • Regular Training Program:
     • Mandatory data security certification for all new employees.
     • Refresher training every 6 months with the latest case studies.
   • Attack Simulations:
     • Periodic phishing tests to increase vigilance.
     • Security incident reporting without consequences to encourage transparency.
6. Security Incident Management
   • Emergency Response Procedures:
     • A cyber incident response team (CSIRT) on standby 24 hours a day.
     • Mandatory escalation within 1 hour if a data breach is detected.
   • Patient Notification:
     • Transparent communication if patient data may have been affected.
     • Mitigation steps offered to affected patients.
7. Compliance & Certification
   • International Standards:
     • Meets ISO 27001 requirements for information security management.
     • Tier III certification for the data center.
   • External Audits:
     • Annual reviews by independent auditors.
     • Ministry of Health certification for the electronic medical record system.
8. Patient Rights & Responsibilities
   • System User Obligations:
     • Patients are responsible for keeping their login credentials confidential.
     • Prompt reporting of any suspected unauthorized activity.
   • Patient Security Features:
     • Option to log out automatically after 5 minutes of inactivity.
     • Real-time notifications of new access to medical records.

Statement of Commitment:

Heartology continuously invests in the latest data security technology and training. This policy is reviewed and updated every year to address constantly evolving threats.

Protecting Patient Information in Healthcare Collaboration

Heartology Cardiovascular Hospital applies strict standards when sharing patient data with external parties to ensure that security and confidentiality are maintained.

1. Definition of Third Parties That May Receive Data

We work with various strategic partners who may need limited access to patient information:

• Medical Service Providers:
  • Diagnostic laboratories
  • Pharmacies and medical device providers
  • Referral hospitals
  • Consulting specialist doctors
• Non-Medical Partners:
  • Health insurance companies
  • Technology vendors (EMR system developers)
  • Certified cloud service providers
  • Quality assurance consultants

2. Basic Principles of Data Sharing

Every disclosure of information follows a strict protocol:

1. Explicit Consent
   • Except in emergencies, data is only shared after the patient signs a consent form
   • Consent covers: the purpose, the type of data, and the duration of data sharing
2. Confidentiality Agreement (NDA)
   • All partners are required to sign a legally binding contract
   • Example clause: “Lab providers are prohibited from using patient data for commercial purposes”
3. Minimum Necessary Principle
   • Only relevant information is shared (Example: For insurance claims, only the necessary diagnosis and procedures)

3. Third-Party Oversight Procedures

• Before Collaboration:
  • Verification of the partner's data security certifications
  • Due diligence on the company's background
• During the Partnership:
  • Periodic audits (at least once every 6 months)
  • Real-time monitoring of data access
• After the Contract Ends:
  • Mandatory deletion of data from the partner's systems
  • Written confirmation that the data has been destroyed

4. Access Levels Based on Need

5. Special Protection for Sensitive Data

The following data requires additional consent:

• Mental health history
• Genetic test results
• HIV/AIDS-related information

Procedure: Consent must be given separately through a dedicated form

6. Patient Rights and Options

Patients can:

1. Request a list of the partners that have received their data (annual report).
2. Withdraw consent to data sharing at any time via:
   • The Heartology app (in the Privacy Settings menu)
   • A withdrawal form at the Medical Records department
3. Choose not to share data with certain categories of partners.

7. Special Situations

• International Data Transfers:
  • Only carried out to countries with an equivalent level of data protection.
  • Using secure transfer mechanisms (example: EU Standard Contractual Clauses).
• Medical Emergencies:
  • Sharing data without consent is permitted for:
    • Emergency situations
    • Infectious disease outbreaks (in accordance with Article 59 of the Health Law)

8. Violation Reporting Mechanism

If a patient suspects misuse of data by a partner:

1. Report by email to: info@heartology.id [KONFIRMASI]
2. Our team will:
   • Complete the investigation within 14 working days [KONFIRMASI]
   • Provide compensation if necessary
3. Option to report to the Data Protection Authority if not satisfied

Statement of Commitment:

We periodically evaluate all partners and will not hesitate to end a partnership if we find a data protection violation.

Transparency in the Use of Digital Technology at Heartology Cardiovascular Hospital

Heartology Cardiovascular Hospital uses digital technology to improve the user experience while protecting your privacy. Here is a full explanation of our practices:

1. Types of Cookies We Use

2. Data We Collect Online

1. Automatically Collected Information:
   • IP address (anonymized after processing)
   • Device and browser type
   • Browsing history on the Heartology website
2. Data You Provide:
   • Online registration forms
   • Search history in the “Find a Doctor” feature
   • Interactions with our health chatbot
3. Special Sensitive Data:
   • Medical information through the patient portal (protected by special encryption)
   • Telemedicine consultation results (stored separately from regular tracking data)

3. Purposes of Data Collection

1. For Medical Services:
   • Making repeat logins to the patient portal easier.
   • Storing digital consultation history.
2. For Service Development:
   • Analyzing usage patterns of EMR features.
   • Fixing page errors (automatic reporting).
3. For Health Education:
   • Providing relevant content based on search history (Example: If you often read about heart stents, we will show you the latest articles about that procedure).

4. Online Data Protection

• Security Technology:
  • 256-bit SSL encryption for all data transmissions.
  • A tokenization system for online payments.
  • An enterprise-grade web application firewall (WAF).
• User Controls:
  • An easily accessible cookie management panel in the website footer
  • Opt-out options for all non-essential cookies
  • A “Delete My History” feature in the patient account

5. Third Parties Involved

• Analytics Partners:
  • Google Analytics (with IP anonymization)
  • Hotjar for UX research (without recording medical data)
• Advertising Platforms:
  • Meta Pixel (only for patients who interact with promotional content)
  • Google Ads (retargeting limited to 30 days)

Note: All partners have signed a Data Processing Agreement (DPA)

6. User Rights & Controls

You can:

1. Manage Cookie Preferences:
   • Through the pop-up banner when you first visit the website.
   • On our [Privacy Settings] page. [KONFIRMASI: halaman ini tidak ada; di situs lama juga tanpa tautan]
2. Delete Data:
   • Search history via the patient account.
   • Cookie deletion requests via the browser.
3. Access Data:
   • Download a record of your digital activity in CSV format (processing takes a maximum of 7 working days after the request). [KONFIRMASI]

7. Regulatory Compliance

• Indonesia's Personal Data Protection Law (UU PDP) No. 27 of 2022 (particularly Article 15 on data processing rights)
• GDPR (for international patients from Europe)
• Ministry of Health Guidelines on Hospital Information Systems

8. Contact for Questions

Heartology Data Protection Team:

• Email: info@heartology.id [KONFIRMASI]
• Phone: (021) 1500 258 [KONFIRMASI]

Operating hours: Monday to Friday, 08:00 to 17:00 WIB

Policy Enforcement Mechanisms and Communication Channels

Heartology Cardiovascular Hospital guarantees transparency in implementing its patient data protection policy. The complete structure for this section is as follows:

1. Regulatory Compliance Framework

1. Main Regulations We Comply With:
   • Law No. 27 of 2022 on Personal Data Protection (Articles 20 and 21 on processing rights)
   • Law No. 36 of 2009 on Health (Article 57 on the confidentiality of medical records)
   • Minister of Health Regulation (Permenkes) No. 24 of 2022 on Electronic Medical Records
   • ISO 27001 for Information Security Management Systems
2. Internal Compliance Mechanisms:
   1. Monthly audits by the Data Compliance Team
   2. Mandatory staff training every 3 months
   3. Annual certification of electronic systems

2. Oversight Structure

1. Data Protection Officer (DPO):
   • Full Name: Dr. Amanda Wijaya, S.Kom, CIPP/E [KONFIRMASI]
   • Qualifications:
     • Internationally certified (IAPP).
     • 10 years of experience in digital health.
   • Responsibilities:
     • Monitoring policy implementation.
     • Acting as the liaison with regulatory authorities.
2. Medical Ethics Committee:
   • Overseeing the use of data for research.
   • Ensuring that informed consent is obtained.

3. Sanctions for Violations

Violation Levels:

1. Minor (unauthorized access without malicious intent):
   • Written warning
   • Mandatory retraining
2. Moderate (negligence that causes a data leak):
   • Suspension for 1 to 3 months
   • Fines of up to Rp 50 million
3. Severe (sale of data/cybercrime):
   • Termination of employment
   • Reporting to the police

4. Coordination with Authorities

Heartology works with:

• Ministry of Health of the Republic of Indonesia (Hospital Information Systems Subdirectorate)
• Personal Data Protection Commission (KPDP)
• ID-SIRTII (Indonesia Security Incident Response Team)

Protocol for reporting serious incidents within 2×24 hours

5. Patient Rights in the Compliance Process

You are entitled to:

1. Request the annual compliance report.
2. Find out the status of a complaint via a ticket number.
3. Be represented by legal counsel in the investigation process.

Statement of Commitment:

“Heartology proactively updates its policies in line with the latest regulatory developments. This version of the policy will be reviewed every year.”