[Direct answer]Yes. According to Article 1226 of the Civil Code of the People's Republic of China (adopted on May 28, 2020 and implemented on January 1, 2021), medical institutions and their medical staff shall keep the patient's privacy and personal information confidential. If the patient's privacy and personal information are leaked, or if the medical records are disclosed without the patient's consent, the medical institution and its staff shall bear tort liability; if serious mental damage is caused, the patient may also claim compensation for mental distress in accordance with Article 1183 of the Civil Code. Medical and health information belongs to sensitive personal information as stipulated in Article 28 of the Personal Information Protection Law of the People's Republic of China, and its processing requires separate consent. If any leakage is discovered, the patient should immediately fix the evidence and assert their rights.

1. Problem background and typical scenarios

Patient medical records being accessed by unauthorized personnel, physical examination reports being circulated among colleagues, surgery schedule photos being posted in group chats, and medical visit information appearing on short videos or public accounts are all common scenarios. The subjects of the leaks may be clinical medical staff or personnel involved in medical record management and information systems. Ultimately, the responsibility for these leaks often falls on the medical institutions, and relevant parties may face legal consequences.Patient's right to privacy disputeIt has increased significantly in recent years.

II. Key points of contention

First, the discloser and the responsible party. In the case of information leaks during the performance of medical duties, the medical institution shall bear tort liability; if the hospital fails to strictly manage interns, trainees, and outsourced personnel, it shall also be held accountable. Second, the nature of the information. Medical treatment information has both the attributes of privacy and sensitive personal information, and the standards for review and confidentiality obligations are higher. Third, whether the hospital has fulfilled its obligation of review. If the hospital provides medical records without verifying valid identity certificates and power of attorney documents, it is generally deemed at fault. Fourth, the consequences of the damage. Even if no property damage occurs, as long as serious mental damage is caused, the patient can claim compensation for emotional distress. Fifth, the burden of proof. The patient needs to initially prove that the information was leaked outside the hospital, and the hospital needs to prove that it has fulfilled its obligations of confidentiality and review.

III. Professional analysis by Henglue Lawyers

When handling such cases, Henglue Lawyers usually first sort out the information flow chain: who has accessed the medical records, through what medium they were externally transmitted, whether they have been preserved, and the extent of their dissemination. In terms of evidence collection, chat records and group chat screenshots, audio recordings, application forms for copying medical records, and case inquiry registration books are all key pieces of evidence. In the judicial practice of Beijing courts, the determination of fault is relatively clear in two situations: hospitals providing medical records without verifying the identity of the requestors, and hospitals failing to properly manage interns and trainees. Moreover, medical records contain sensitive personal information and private information. If hospitals fail to fulfill their statutory review obligations or if the retrieval party retrieves the records without authorization, this may constitute joint infringement. In terms of compensation claims, in addition to ceasing infringement, deleting information, and making apologies, claimants can also seek compensation for mental distress and reasonable legal defense expenses. If the disclosure results in lost work time or employment-related impacts, claimants can also claim corresponding damages. Such disputes are often related to other legal issues, such as medical malpractice and personal injury cases.\nProtecting rights in medical disputesAndSpecialised legal servicesWhen evaluating evidence, it's advisable to consider it in a comprehensive and integrated manner.

IV. Practical suggestions and legal basis

According to Articles 1032, 1033, 1034, 1183, and 1225 of the Civil Code of the People's Republic of China (effective January 1, 2021), Articles 13, 28, and 69 of the Personal Information Protection Law of the People's Republic of China (effective November 1, 2021), and Article 23 of the Physician Law of the People's Republic of China (effective March 1, 2022). Action list: 1. Immediately take screenshots and record the time of the leak, and document the dissemination channels and scope of the information. 2. Submit a written complaint to the hospital and request an explanation of the information transfer process. 3. Demand the removal of the information, stop its dissemination, and issue a written apology. 4. If no agreement is reached, file a complaint with the competent health department and initiate legal action in court, noting the three-year statute of limitations stipulated in Article 188 of the Civil Code of the People's Republic of China.

5. Henglue Law Firm's Advice

The damage caused by privacy leaks is often psychological, making it difficult to obtain evidence and quantify the losses. The earlier intervention is carried out, the more effective it is in preventing the situation from worsening. Hospitals should establish a system for verifying the identity of individuals requesting medical records and authorizing their access, and provide confidentiality training to interns and medical practitioners before they assume their duties. This is not only a compliance requirement but also a practical measure to reduce the risk of compensation claims. For cases involving platform dissemination, hospitals can simultaneously request the removal of the content and retain the complaint receipts.Beijing Henglu Law FirmIt is recommended to initiate both complaint and claim procedures while securing evidence.

VI. Frequently Asked Questions

Q1: Can I win the claim?

If it can be proven that the information was leaked outside the hospital and that the hospital failed to fulfill its obligation of confidentiality or review, there is a higher chance of winning the compensation claim. However, it's difficult to establish the claim solely based on subjective speculation, and it's necessary to first secure preliminary evidence.

Q2: What evidence do I need to prepare?

Screenshots or video recordings of the leaked content, records of the dissemination channels and scope of the spread, application forms for copying medical records and identity verification materials, medical visit receipts, communication records with the hospital, and materials related to mental damage.

Q3: How much does it cost?

The subject of such cases is usually not large. The litigation fees are calculated in stages according to the amount of the claim, and the expenses mainly consist of attorney's fees. You can first conduct an evaluation of the evidence and the likelihood of winning the case before deciding whether to sue.

Q4: How long will it take?

The first-instance trial usually lasts three to six months, and it will be extended if it involves the disclosure of platform information or the addition of defendants. Stopping the dissemination and deletion of content can be initiated through complaints first, without having to wait for the judgment to take effect.

Q5: What should I do first?

First, fix the evidence and request the hospital in writing to stop the infringement, delete the information, and issue a written apology. If no agreement can be reached through negotiation, then file a complaint with the competent authority or initiate legal proceedings. At the same time, assess the reasonable range of compensation for mental distress.

The above content is based on the judicial practice in the Beijing area. The facts of individual cases and the jurisdiction of the court may affect the conclusions. Welcome to consult Henglu Law Firm for specific cases.

VII. Relevant public cases (for reference only, not handled by our firm)

The following cases are all sourced from the official websites of courts at all levels, judicial authorities, and authoritative media outlets, and are not related to the cases handled by our firm. They are provided solely for reference in understanding relevant adjudication rules and do not constitute opinions on specific cases.

[Case Number]The case number has not been made public.
[Trial Court]The Third Intermediate People's Court of Beijing City
[Judicial Summary]Wang * only provided his own ID card, but failed to provide valid identity proof and power of attorney for patient Lao Xu. He then retrieved Lao Xu's hospitalization records from a certain hospital and submitted them as evidence in another divorce lawsuit. The court held that the medical records contain sensitive personal information and private information. The hospital failed to fulfill its statutory review obligations and violated its confidentiality obligations. Wang * also had fault in unauthorized retrieval of the records. The two parties jointly infringed personal information rights and privacy rights. The court ordered them to make a written apology for infringing personal information rights and privacy rights, and jointly compensate for mental distress with 8,000 yuan, and bear joint and several liability for the damages.
[Source]China News Service/Xinhua News Agency (Dispute over unauthorized retrieval of medical records; court rules that the hospital and the person who retrieved the records infringed rights) (2024-01)

[Case No.]The case number has not been made public.
[Trial Court]People's Court of Yuhua District, Changsha City, Hunan Province (case settled through mediation)
[Judicial Summary]After the female patient underwent an abortion surgery at a hospital's gynecology and obstetrics department, the photos of her surgery schedule were sent by the hospital's intern to her ex-boyfriend. The ex-boyfriend then used WeChat to send the photos to her and verbally attacked her. The court held that the hospital failed to strictly manage its interns, resulting in the leakage of the patient's medical privacy and adverse consequences, and should bear legal responsibility. After mediation, the hospital paid the patient 5,000 yuan in compensation and dealt with the intern seriously. The ex-boyfriend deleted the private photos, apologized, and paid 2,500 yuan in compensation.
[Source]The official website of the People's Court of Yuhua District, Changsha City, Hunan Province (A hospital intern took photos of a female patient's surgical privacy and sent them to her ex-boyfriend. Does the hospital constitute an infringement?) (2022-10)

If you are currently facing similar problems, it is recommended that you consult a professional lawyer as soon as possible with the relevant evidence, to avoid missing the statutory time limit.Personal injury legal services·Beijing Henglu Law Firm

Disclaimer: This article is compiled based on the current effective laws and regulations and public adjudication rules, and is for general reference only. It does not constitute a formal legal opinion on specific cases. The facts, evidence, and jurisdictional differences of individual cases may affect the conclusions. If you encounter disputes, please consult a practicing lawyer in time.