Cap 625 - Electronic Health Record Sharing System Ordinance 1

Chapter: 625 Electronic Health Record Sharing System Ordinance Gazette Number Version Date

Long Title L.N. 197 of 2015 02/12/2015


An Ordinance to provide for the establishment of the Electronic Health Record Sharing System, the sharing and using
of data and information contained in the System, and the protection of the System, data and information; and to
provide for incidental and related matters.


[The Ordinance other than the following provisions- }

}
}
}
}
}
}
}


section 3(3)(e)
paragraphs (g) and (h) of the definition of

relevant time in section 3(5)


Division 4 of Part 2
section 29
Divisions 2 and 3 of Part 3 2 December 2015 L.N. 197 of 2015]
section 46
section 49(1)(g)
Division 2 of Part 6
section 58(c)


(Enacting provision omitted—E.R. 3 of 2015)

(Originally 15 of 2015)

Part: 1 Preliminary L.N. 197 of 2015 02/12/2015




Section: 1 Short title and commencement L.N. 197 of 2015 02/12/2015


(1) This Ordinance may be cited as the Electronic Health Record Sharing System Ordinance.
(2) This Ordinance comes into operation on a day to be appointed by the Secretary for Food and Health by notice

published in the Gazette.

Section: 2 Interpretation L.N. 197 of 2015 02/12/2015


(1) In this Ordinance—
Board (研委會) means the board established under section 54 with the name “Electronic Health Record Research

Board”;
Commissioner (專員) means the public officer appointed under section 48 to be the Commissioner for the Electronic

Health Record;
company (公司) means a company as defined by section 2(1) of the Companies Ordinance (Cap 622);
consent (同意), in relation to an individual, means an express consent of the individual;
data access request (查閱資料要求) has the meaning given by section 2(1) of the Privacy Ordinance;
data correction request (改正資料要求) has the meaning given by section 2(1) of the Privacy Ordinance;
data sharing (資料互通) means the act of providing or obtaining any sharable data of a registered healthcare

recipient through the System;
electronic health record (電子健康紀錄)—

(a) in relation to a registered healthcare recipient, means the record for the recipient that is kept under section
5(2); and



Cap 625 - Electronic Health Record Sharing System Ordinance 2

(b) in relation to a healthcare recipient who was once registered, but is no longer registered, means the record
for the recipient that was kept under section 5(2);

electronic medical record system (電子醫療紀錄系統), in relation to a healthcare provider, means an information
system used by the healthcare provider to keep the medical record of a healthcare recipient electronically for the
recipient’s healthcare purpose;

family member (家人), in relation to a healthcare recipient, means an individual who is related to the recipient by
blood, marriage, adoption or affinity;

health data (健康資料), in relation to a healthcare recipient, means the data or information relating to the health
condition of, or to the healthcare provided or to be provided to, the recipient;

healthcare (醫護服務), in relation to an individual, means an activity performed by a healthcare professional for the
individual for—
(a) assessing, recording, maintaining or improving the individual’s health;
(b) diagnosing the individual’s illness or disability; or
(c) treating the individual’s illness or disability, or suspected illness or disability;

healthcare professional (醫護專業人員) means a person specified in the Schedule;
healthcare provider (醫護提供者) means a person that provides healthcare;
healthcare recipient (醫護接受者) means an individual for whom healthcare has been performed, is performed, or is

likely to be performed in Hong Kong;
healthcare referral (醫護服務轉介), in relation to a registered healthcare recipient, means a recommendation made

by a prescribed healthcare provider for the provision of healthcare to the recipient by another prescribed
healthcare provider;

identifiable data (可識辨身分資料)—see subsection (2)(a);
identity card (身分證) has the meaning given by section 1A(1) of the Registration of Persons Ordinance (Cap 177);
index data (索引資料), in relation to a healthcare recipient, means the personal particulars of the recipient that

identify the recipient for the operation of the System;
joining consent (參與同意) means a consent given under section 7(1) or (2);
minor (幼年人) means a person below 16 years of age;
non-identifiable data (非可識辨身分資料)—see subsection (2)(b);
parent (家長), in relation to a child, means—

(a) the natural father or natural mother of the child (whether or not the natural father and natural mother are
married to each other);

(b) a parent of the child by adoption under, or recognized as valid by, law; or
(c) a stepfather or stepmother of the child;

prescribed healthcare provider (訂明醫護提供者) means—
(a) the Department of Health;
(b) the Hospital Authority; or
(c) a registered healthcare provider;

Privacy Commissioner (私隱專員) means the Privacy Commissioner for Personal Data established under section
5(1) of the Privacy Ordinance;

Privacy Ordinance (《私隱條例》) means the Personal Data (Privacy) Ordinance (Cap 486);
registered healthcare provider (登記醫護提供者) means—

(a) a healthcare provider that is registered as a healthcare provider for the System under section 20(1) for a
service location; or

(b) a Government department that is registered as a healthcare provider for the System under section 22(1);
registered healthcare recipient (登記醫護接受者) means a healthcare recipient who is registered under section 8(1);
registration (登記)—

(a) in relation to a healthcare recipient, means the registration of the healthcare recipient as a registered
healthcare recipient under section 8(1);

(b) in relation to a healthcare provider, means the registration of the healthcare provider as a healthcare



Cap 625 - Electronic Health Record Sharing System Ordinance 3

provider for the System under section 20(1) for a service location;
(c) in relation to a Government department, means the registration of the department as a healthcare provider

for the System under section 22(1),
and registered (登記) is to be construed accordingly;

Secretary (局長) means the Secretary for Food and Health;
sharable data (可互通資料), in relation to a registered healthcare recipient, means both of the following—

(a) the index data of the healthcare recipient;
(b) the health data of the healthcare recipient;

sharing consent (互通同意) means a consent given under section 12(1);
sharing restriction request (互通限制要求) means a request made under section 17(1)(a);
substitute decision maker (代決人)—see section 3;
System (互通系統) means the information infrastructure established under section 5(1) with the name “Electronic

Health Record Sharing System”;
use (使用、用), in relation to data or information contained in an electronic health record, includes disclose or

transfer the data or information.
(2) In this Ordinance—

(a) any data or information of a healthcare recipient is identifiable data if the identity of the healthcare
recipient is ascertainable from the data or information; and

(b) any data or information of a healthcare recipient is non-identifiable data if the identity of the healthcare
recipient is unascertainable from the data or information.

(3) In this Ordinance, a reference to a form specified by the Commissioner is a reference to a form so specified
under section 53.


Section: 3 Substitute decision maker L.N. 197 of 2015 02/12/2015


Remarks:
*Section 3(3)(e) and paragraphs (g) and (h) of the definition of relevant time in section 3(5) have not yet come into
operation.

(1) For the purposes of this Ordinance, a person is a substitute decision maker of a healthcare recipient if the person

is an eligible person under subsection (2) or (3).
(2) For a healthcare recipient who is a minor, the following are eligible persons for the purposes of subsection (1)—

(a) a parent of the healthcare recipient who accompanies the healthcare recipient at the relevant time;
(b) a guardian of the healthcare recipient appointed under or acting by virtue of the Guardianship of Minors

Ordinance (Cap 13), or otherwise appointed by the court, who accompanies the healthcare recipient at the
relevant time;

(c) a person appointed by the court to manage the affairs of the healthcare recipient who accompanies the
healthcare recipient at the relevant time;

(d) in the absence of the persons mentioned in paragraphs (a), (b) and (c), a family member of the healthcare
recipient, or a person residing with the healthcare recipient, who accompanies the healthcare recipient at the
relevant time;

(e) in the absence of the persons mentioned in paragraphs (a), (b), (c) and (d), the prescribed healthcare
provider that provides, or is about to provide, healthcare to the healthcare recipient at the relevant time.

(3) For a healthcare recipient who is aged 16 or above and who is of any of the following descriptions, the persons
specified in subsection (4) are eligible persons for the purposes of subsection (1)—
(a) being mentally incapacitated as defined by section 2(1) of the Mental Health Ordinance (Cap 136);
(b) being incapable of managing his or her own affairs;
(c) being incapable of giving a joining consent at the time referred to in paragraph (a), (b) or (c) of the

definition of relevant time in subsection (5);
(d) being incapable of giving a sharing consent at the time referred to in paragraph (d), (e) or (f) of the

definition of relevant time in subsection (5);
*[(e) being incapable of making a sharing restriction request at the time referred to in paragraph (g) or (h) of



Cap 625 - Electronic Health Record Sharing System Ordinance 4

the definition of relevant time in subsection (5).]
(4) The following are persons specified for the purposes of subsection (3)—

(a) a person appointed under the Mental Health Ordinance (Cap 136) to be the guardian of the healthcare
recipient who accompanies the healthcare recipient at the relevant time;

(b) if the healthcare recipient is placed under the guardianship of the Director of Social Welfare or any other
person under section 44A(1)(i) of that Ordinance, the Director of Social Welfare or that other person;

(c) if the guardianship of the healthcare recipient is vested in the Director of Social Welfare under section
44B(2A) or 59T(1) of that Ordinance, the Director of Social Welfare;

(d) if the functions of guardian of the healthcare recipient are to be performed by the Director of Social Welfare
or any other person under section 44B(2B) or 59T(2) of that Ordinance, the Director of Social Welfare or
that other person;

(e) a person appointed by the court to manage the affairs of the healthcare recipient who accompanies the
healthcare recipient at the relevant time;

(f) in the absence of the persons mentioned in paragraphs (a), (b), (c), (d) and (e), a family member of the
healthcare recipient, or a person residing with the healthcare recipient, who accompanies the healthcare
recipient at the relevant time;

(g) in the absence of the persons mentioned in paragraphs (a), (b), (c), (d), (e) and (f), the prescribed healthcare
provider that provides, or is about to provide, healthcare to the healthcare recipient at the relevant time.

(5) In this section—
relevant time (有關時間) means—

(a) in relation to an application that is made under section 6(1) for the healthcare recipient to be registered as a
registered healthcare recipient, the time at which the application is made;

(b) in relation to a joining consent that is required under section 7(1) or (2) for such an application, the time at
which the joining consent is required;

(c) in relation to a healthcare recipient’s registration that is withdrawn from the System by the operation of
section 9, the time at which the request for withdrawal is made;

(d) in relation to a sharing consent that is given under section 12(1), the time at which the sharing consent is
given;

(e) in relation to a sharing consent that is renewed under section 14(2), the time at which the sharing consent is
renewed;

(f) in relation to a sharing consent that is revoked under section 15(1), the time at which the revocation of the
sharing consent is made;

*[(g) in relation to a sharing restriction request that is made under section 17(1)(a), the time at which the
request is made;]

*[(h) in relation to a request to remove a restriction that is made under section 17(1)(b), the time at which
the request is made.]


Section: 4 Ordinance applies to Government L.N. 197 of 2015 02/12/2015


This Ordinance applies to the Government.

Part: 2 Electronic Health Record Sharing System L.N. 197 of 2015 02/12/2015




Part:
Division:

2
1

Establishment L.N. 197 of 2015 02/12/2015





Section: 5 Establishment of System L.N. 197 of 2015 02/12/2015


(1) The Commissioner must establish and maintain an information infrastructure with the name “Electronic Health
Record Sharing System” in English and “電子健康紀錄互通系統” in Chinese for—
(a) keeping the records required by subsection (2); and



Cap 625 - Electronic Health Record Sharing System Ordinance 5

(b) sharing and using data and information contained in those records.
(2) The System must keep a record of every registered healthcare recipient containing the following—

(a) the index data of the recipient;
(b) the health data of the recipient provided to the Commissioner in the form and manner specified by the

Commissioner;
(c) any other data or information of the recipient that is, in the Commissioner’s opinion, necessary for the

proper functioning of the System.

Part:
Division:

2
2

Registration of Healthcare Recipients L.N. 197 of 2015 02/12/2015





Section: 6 Application by healthcare recipients for registration L.N. 197 of 2015 02/12/2015


(1) Subject to subsections (2) and (3), a healthcare recipient to which this section applies, or a substitute decision
maker of a healthcare recipient, may apply to the Commissioner for the healthcare recipient to be registered as a
registered healthcare recipient.

(2) If the healthcare recipient is a minor, the application must be made by a substitute decision maker of the
healthcare recipient unless the Commissioner is satisfied that the recipient is capable of giving a joining consent.

(3) If the healthcare recipient is aged 16 or above and is incapable of giving a joining consent, the application must
be made by a substitute decision maker of the healthcare recipient.

(4) An application made by a substitute decision maker of a healthcare recipient is made on behalf of and in the
name of the recipient.

(5) In making an application, a substitute decision maker of a healthcare recipient must have regard to the best
interests of the recipient in the circumstances.

(6) An application—
(a) must be made in the form and manner specified by the Commissioner;
(b) must be accompanied by the information specified by the Commissioner; and
(c) must be accompanied by a joining consent.

(7) This section applies to a healthcare recipient—
(a) who holds an identity card; or
(b) who does not hold an identity card but holds—

(i) a certificate of registration of birth issued under the Births and Deaths Registration Ordinance (Cap
174);

(ii) a proof of identity as defined by section 17B(1) (other than an identity card) of the Immigration
Ordinance (Cap 115);

(iii) a certificate of exemption as defined by section 17G(1) of the Immigration Ordinance (Cap 115); or
(iv) any other identification document specified by the Commissioner.


Section: 7 Giving of joining consent L.N. 197 of 2015 02/12/2015


(1) For an application made by a healthcare recipient under section 6(1), the recipient must give a consent specified
in subsection (3).

(2) For an application made by a substitute decision maker of a healthcare recipient under section 6(1), the substitute
decision maker must give a consent specified in subsection (3) on behalf of and in the name of the recipient.

(3) The consent is for the Commissioner—
(a) to obtain from, and to provide to, a prescribed healthcare provider to which the healthcare recipient has

given a sharing consent any sharable data of the recipient; and
(b) if the prescribed healthcare provider has made a healthcare referral to another prescribed healthcare

provider, to obtain from, and to provide to, that other prescribed healthcare provider any sharable data of
the recipient relevant to the healthcare referral,

for the operation of the System after the registration of the recipient.
(4) A joining consent must be given in the form and manner specified by the Commissioner.
(5) A joining consent is revoked if—



Cap 625 - Electronic Health Record Sharing System Ordinance 6

(a) the healthcare recipient’s registration is withdrawn from the System by the operation of section 9; or
(b) the healthcare recipient’s registration is cancelled under section 11(1).


Section: 8 Registration of healthcare recipients by Commissioner L.N. 197 of 2015 02/12/2015


(1) On receiving an application made under section 6(1), the Commissioner, if satisfied that, on the face of it, the
application complies with section 6(6), may—
(a) register the healthcare recipient as a registered healthcare recipient; and
(b) impose the conditions that the Commissioner considers appropriate for registering the healthcare recipient.

(2) However, the Commissioner must not register the healthcare recipient if the Commissioner is satisfied that doing
so may impair the security or compromise the integrity of the System.

(3) After approving or refusing an application, the Commissioner must notify the healthcare recipient in writing of
the decision and—
(a) if the application is approved—the date on which the registration takes effect and the conditions for the

registration; or
(b) if the application is refused—the reasons for the refusal.


Section: 9 Withdrawal of healthcare recipient’s registration L.N. 197 of 2015 02/12/2015


(1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered
healthcare recipient, may request that the registration of the recipient be withdrawn from the System.

(2) If the healthcare recipient is a minor, the request must be made by a substitute decision maker of the healthcare
recipient unless the Commissioner is satisfied that the recipient is capable of making the request.

(3) If the healthcare recipient is aged 16 or above and is incapable of giving a joining consent, the request must be
made by a substitute decision maker of the healthcare recipient.

(4) A request made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in
the name of the recipient.

(5) In making a request, a substitute decision maker of a registered healthcare recipient must have regard to the best
interests of the recipient in the circumstances.

(6) A request must be made to the Commissioner in the form and manner specified by the Commissioner.
(7) After granting a request, the Commissioner must notify the requestor in writing of the date on which the request

is granted. The withdrawal takes effect on that date.

Section: 10 Suspension of healthcare recipient’s registration L.N. 197 of 2015 02/12/2015


(1) The Commissioner may suspend the registration of a healthcare recipient for a period of not more than 28 days if
the Commissioner reasonably suspects that—
(a) the application for registration did not comply with section 6(6);
(b) the healthcare recipient holds none of the documents specified in section 6(7);
(c) the healthcare recipient contravenes—

(i) a provision of this Ordinance; or
(ii) a condition for the registration; or

(d) the registration may impair the security or compromise the integrity of the System.
(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period

of suspension under that subsection for a further period of not more than 28 days by notice in writing to the
specified person.

(3) After suspending the registration, the Commissioner must notify the specified person in writing of—
(a) the suspension;
(b) the date on which the suspension takes effect; and
(c) the reasons for the suspension.

(4) When the registration of a healthcare recipient is suspended—
(a) new data or information of the recipient may still be provided by a prescribed healthcare provider to the

System; but



Cap 625 - Electronic Health Record Sharing System Ordinance 7

(b) the electronic health record of the recipient is not to be made available to a prescribed healthcare provider
through the System.

(5) After the Commissioner is satisfied that there are no longer any grounds for suspending the healthcare
recipient’s registration, the Commissioner must notify the specified person in writing of—
(a) the Commissioner’s decision; and
(b) the date on which the suspension ceases to take effect.

(6) In this section—
specified person (指明人士) means—

(a) if the healthcare recipient is a minor and the application for the healthcare recipient’s registration was
made by a substitute decision maker, that substitute decision maker;

(b) if the healthcare recipient is aged 16 or above and is, in the Commissioner’s opinion, incapable of giving a
joining consent and the application for the healthcare recipient’s registration was made by a substitute
decision maker, that substitute decision maker; or

(c) in any other case—
(i) the healthcare recipient; or
(ii) the substitute decision maker of the healthcare recipient who made the application for the healthcare

recipient’s registration.

Section: 11 Cancellation of healthcare recipient’s registration L.N. 197 of 2015 02/12/2015


(1) The Commissioner may cancel the registration of a healthcare recipient if the Commissioner is satisfied that—
(a) the application for registration did not comply with section 6(6);
(b) the healthcare recipient holds none of the documents specified in section 6(7);
(c) the healthcare recipient contravenes—

(i) a provision of this Ordinance; or
(ii) a condition for the registration;

(d) the registration may impair the security or compromise the integrity of the System; or
(e) the healthcare recipient has died.

(2) Except for a cancellation under subsection (1)(e), the Commissioner must notify the specified person in writing
of—
(a) the date on which the cancellation is to take effect; and
(b) the reasons for the cancellation.

(3) The specified person may, within 14 days after the date of the notice (or such longer period as the Commissioner
may allow), make representations to the Commissioner to object to the cancellation in the manner specified in
the notice.

(4) The Commissioner must not cancel the registration unless—
(a) the specified person has not made any representations under subsection (3); or
(b) the Commissioner has considered the representations and informed the specified person of the decision of

cancellation.
(5) A cancellation under subsection (1)(e) takes effect on the date on which the Commissioner is satisfied that the

healthcare recipient has died.
(6) In this section—
specified person (指明人士) means—

(a) if the healthcare recipient is a minor and the application for the healthcare recipient’s registration was
made by a substitute decision maker, that substitute decision maker;

(b) if the healthcare recipient is aged 16 or above and is, in the Commissioner’s opinion, incapable of giving a
joining consent and the application for the healthcare recipient’s registration was made by a substitute
decision maker, that substitute decision maker; or

(c) in any other case—
(i) the healthcare recipient; or
(ii) the substitute decision maker of the healthcare recipient who made the application for the healthcare

recipient’s registration.



Cap 625 - Electronic Health Record Sharing System Ordinance 8


Part:
Division:

2
3

Sharing Consent L.N. 197 of 2015 02/12/2015





Section: 12 Giving of sharing consent L.N. 197 of 2015 02/12/2015


(1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered
healthcare recipient, may give a consent specified in subsection (6) to a prescribed healthcare provider that
provides healthcare to the healthcare recipient.

(2) If the healthcare recipient is a minor, the sharing consent must be given by a substitute decision maker of the
healthcare recipient unless the Commissioner is satisfied that the recipient is capable of giving the sharing
consent.

(3) If the healthcare recipient is aged 16 or above and is incapable of giving a sharing consent, the sharing consent
must be given by a substitute decision maker of the healthcare recipient.

(4) A sharing consent given by a substitute decision maker of a registered healthcare recipient is given on behalf of
and in the name of the recipient.

(5) In giving a sharing consent, a substitute decision maker of a registered healthcare recipient must have regard to
the best interests of the recipient in the circumstances.

(6) The consent is for—
(a) the prescribed healthcare provider—

(i) to provide to the System any sharable data of the healthcare recipient in the form and manner specified
by the Commissioner;

(ii) to obtain from the System any sharable data of the healthcare recipient in the form and manner
specified by the Commissioner; and

(iii) to provide to a referral healthcare provider any sharable data of the healthcare recipient relevant to the
healthcare referral and in the form and manner specified by the Commissioner; and

(b) a referral healthcare provider—
(i) to provide to the System any sharable data of the healthcare recipient relevant to the healthcare referral

and in the form and manner specified by the Commissioner; and
(ii) to obtain from the System any sharable data of the healthcare recipient relevant to the healthcare

referral and in the form and manner specified by the Commissioner.
(7) A sharing consent must be given in the form and manner specified by the Commissioner.
(8) A sharing consent may be given for an indefinite term or a one-year term.
(9) In this section—
referral healthcare provider (獲轉介醫護提供者) means a prescribed healthcare provider to which a healthcare

referral of the healthcare recipient is made by the prescribed healthcare provider to which the consent is given.

Section: 13 Indefinite sharing consent L.N. 197 of 2015 02/12/2015


(1) This section applies to a sharing consent given for an indefinite term.
(2) The sharing consent is in effect until—

(a) the healthcare recipient’s registration is withdrawn from the System by the operation of section 9;
(b) the healthcare recipient’s registration is cancelled under section 11(1); or
(c) the consent is revoked under section 15(1).


Section: 14 One-year sharing consent L.N. 197 of 2015 02/12/2015


(1) This section applies to a sharing consent given for a one-year term.
(2) Subject to subsections (3) and (4), as long as the sharing consent is in effect, the registered healthcare recipient,

or a substitute decision maker of the healthcare recipient, may renew the sharing consent for another one-year
term.

(3) If the healthcare recipient is a minor, the sharing consent must be renewed by a substitute decision maker of the



Cap 625 - Electronic Health Record Sharing System Ordinance 9

healthcare recipient unless the Commissioner is satisfied that the recipient is capable of renewing the sharing
consent.

(4) If the healthcare recipient is aged 16 or above and is incapable of giving a sharing consent, the sharing consent
must be renewed by a substitute decision maker of the healthcare recipient.

(5) A sharing consent renewed by a substitute decision maker of a registered healthcare recipient is renewed on
behalf of and in the name of the recipient.

(6) In renewing a sharing consent, a substitute decision maker of a registered healthcare recipient must have regard
to the best interests of the recipient in the circumstances.

(7) If a sharing consent is renewed for a one-year term under subsection (2), that term is to commence on the date of
the renewal.

(8) The sharing consent is in effect during its term until—
(a) the healthcare recipient’s registration is withdrawn from the System by the operation of section 9;
(b) the healthcare recipient’s registration is cancelled under section 11(1); or
(c) the consent is revoked under section 15(1).


Section: 15 Revocation of sharing consent L.N. 197 of 2015 02/12/2015


(1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered
healthcare recipient, may revoke a sharing consent given to a prescribed healthcare provider.

(2) If the healthcare recipient is a minor, the revocation must be made by a substitute decision maker of the
healthcare recipient unless the Commissioner is satisfied that the recipient is capable of making the revocation.

(3) If the healthcare recipient is aged 16 or above and is incapable of giving a sharing consent, the revocation must
be made by a substitute decision maker of the healthcare recipient.

(4) A revocation made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in
the name of the recipient.

(5) In making a revocation, a substitute decision maker of a registered healthcare recipient must have regard to the
best interests of the recipient in the circumstances.

(6) A revocation must be made in the form and manner specified by the Commissioner.
(7) After the revocation is recorded in the System, the Commissioner must notify the person making the revocation

in writing of the date on which the record is made. The revocation takes effect on that date.

Section: 16 Sharing consent taken to be given L.N. 197 of 2015 02/12/2015


(1) A healthcare recipient is taken to have given a sharing consent to the Department of Health and to the Hospital
Authority when the healthcare recipient gives a joining consent.

(2) A substitute decision maker of a healthcare recipient is taken to have given a sharing consent on behalf of and in
the name of the recipient to the Department of Health and to the Hospital Authority when the substitute decision
maker gives a joining consent.

(3) A sharing consent taken to be given because of a joining consent is in effect as long as the joining consent is in
effect.

(4) Sections 12(7) and (8), 13, 14 and 15 do not apply to a sharing consent taken to be given under this section.

Part:
Division:

2
4

Sharing Restriction



Remarks:
Not yet in operation


Section: 17 Request for sharing restriction


Remarks:
Not yet in operation




Cap 625 - Electronic Health Record Sharing System Ordinance 10

(1) Despite anything contained in sections 12 and 16 and subject to subsections (2) and (3), a registered healthcare
recipient, or a substitute decision maker of a registered healthcare recipient, may in relation to the health data of
the healthcare recipient make—
(a) a request to restrict the scope of data sharing; or
(b) a request to remove a restriction on the scope of data sharing.

(2) If the healthcare recipient is a minor, the request must be made by a substitute decision maker of the healthcare
recipient unless the Commissioner is satisfied that the recipient is capable of making the request.

(3) If the healthcare recipient is aged 16 or above and is incapable of making the request, the request must be made
by a substitute decision maker of the healthcare recipient.

(4) A request made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in
the name of the recipient.

(5) In making a request, a substitute decision maker of a registered healthcare recipient must have regard to the best
interests of the recipient in the circumstances.

(6) A request must be made to the Commissioner in the form and manner specified by the Commissioner.
(7) The Commissioner must notify the requestor in writing of the date on which the requested restriction, or the

requested removal of restriction, takes effect.

Section: 18 Commissioner to specify sharing restriction


Remarks:
Not yet in operation

(1) The Commissioner must specify the types of restriction in respect of which a person may make a request under

section 17(1).
(2) The Commissioner must make copies of a document setting out the specified types of restriction available to the

public (in hard copy or electronic form).

Part:
Division:

2
5

Registration as Healthcare Providers for System L.N. 197 of 2015 02/12/2015





Section: 19 Application by healthcare providers for registration L.N. 197 of 2015 02/12/2015


(1) A healthcare provider that provides healthcare at one service location in Hong Kong may apply to the
Commissioner to be registered as a healthcare provider for the System for that location.

(2) A healthcare provider that provides healthcare at more than one service location in Hong Kong may apply to the
Commissioner to be registered as a healthcare provider for the System for those locations as provided in
subsection (3).

(3) For the purposes of subsection (2), a healthcare provider may apply for—
(a) a single registration for all of the locations; or
(b) a separate registration for each location that the healthcare provider chooses to register.

(4) An application—
(a) must be made in the form and manner specified by the Commissioner; and
(b) must be accompanied by the information specified by the Commissioner.

(5) For the purposes of this section, a healthcare provider provides healthcare at one service location if the
healthcare provider—
(a) is registered under section 3(4) of the Hospitals, Nursing Homes and Maternity Homes Registration

Ordinance (Cap 165) in respect of one hospital or one maternity home;
(b) is registered under section 5(2) of the Medical Clinics Ordinance (Cap 343) in respect of one clinic;
(c) carries on the business of dentistry under section 12 of the Dentists Registration Ordinance (Cap 156) at one

premises;
(d) holds a certificate of exemption issued under section 7(2), or a licence issued under section 8(2)(a), of the

Residential Care Homes (Elderly Persons) Ordinance (Cap 459) in respect of one residential care home, and
engages a healthcare professional to perform healthcare at that home;



Cap 625 - Electronic Health Record Sharing System Ordinance 11

(e) holds a licence issued under section 7(2)(a), or a certificate of exemption issued under section 11(2)(a), of
the Residential Care Homes (Persons with Disabilities) Ordinance (Cap 613) in respect of one residential
care home for persons with disabilities, and engages a healthcare professional to perform healthcare at that
home; or

(f) is a specified entity that engages a healthcare professional to perform healthcare at one premises.
(6) In subsection (5)—
specified entity (指明實體) means—

(a) an individual;
(b) a company;
(c) a partnership;
(d) a statutory body;
(e) a body corporate other than a company; or
(f) a society, or a branch of a society, registered under section 5A(1), or exempted from registration under

section 5A(2), of the Societies Ordinance (Cap 151).

Section: 20 Registration of healthcare providers by Commissioner L.N. 197 of 2015 02/12/2015


(1) On receiving an application made under section 19(1) or (2), the Commissioner, if satisfied that the healthcare
provider complies with the requirements set out in subsection (2), may—
(a) register the healthcare provider as a healthcare provider for the System for the service location for which the

application is made; and
(b) impose the conditions that the Commissioner considers appropriate for registering the healthcare provider.

(2) The requirements are—
(a) the requirements specified by the Commissioner for connecting the healthcare provider to the System; and
(b) the system requirements on data sharing specified by the Commissioner.

(3) However, the Commissioner must not register the healthcare provider if the Commissioner is satisfied that—
(a) the service or business nature of the healthcare provider is not consistent with the purpose of the use of data

and information specified in section 28; or
(b) registering the healthcare provider may impair the security or compromise the integrity of the System.

(4) After approving or refusing an application, the Commissioner must notify the healthcare provider in writing of
the decision and—
(a) if the application is approved—the date on which the registration takes effect and the conditions for the

registration; or
(b) if the application is refused—the reasons for the refusal.


Section: 21 Amendment of registration L.N. 197 of 2015 02/12/2015


(1) Subject to subsection (2), a healthcare provider registered under section 20(1) may request a registration be
amended for—
(a) a change in the particulars of a service location; and
(b) a change of the service locations for which the healthcare provider is registered.

(2) A healthcare provider must not request the registration be amended for a change of the service locations unless
the healthcare provider would, after the change, still be registered for all of the service locations at which the
healthcare provider provides healthcare in Hong Kong.

(3) A request must be made to the Commissioner in the form and manner specified by the Commissioner.
(4) After granting a request, the Commissioner must notify the requestor in writing of the date on which the request

is granted. The amendment takes effect on that date.

Section: 22 Registration of Government departments as healthcare

providers
L.N. 197 of 2015 02/12/2015



(1) The Commissioner may register a Government department as a healthcare provider for the System if the
Commissioner is satisfied that the department provides a healthcare professional to perform healthcare for any



Cap 625 - Electronic Health Record Sharing System Ordinance 12

healthcare recipient.
(2) The reference of a department in subsection (1) does not include the Department of Health.

Section: 23 Withdrawal of healthcare provider’s registration L.N. 197 of 2015 02/12/2015


(1) A registered healthcare provider may request that a registration of the healthcare provider be withdrawn from the
System.

(2) A request must be made to the Commissioner in the form and manner specified by the Commissioner.
(3) After granting a request, the Commissioner must notify the healthcare provider in writing of the date on which

the request is granted. The withdrawal takes effect on that date.
(4) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the

withdrawal takes effect.

Section: 24 Suspension of healthcare provider’s registration L.N. 197 of 2015 02/12/2015


(1) The Commissioner may suspend a registration of a registered healthcare provider for a period of not more than
28 days if the Commissioner reasonably suspects that—
(a) the healthcare provider contravenes—

(i) a provision of this Ordinance;
(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;

(b) the healthcare provider no longer provides healthcare at the service location to which the registration
relates;

(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System;

or
(ii) the system requirements on data sharing specified by the Commissioner;

(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use
of data and information specified in section 28; or

(e) the registration may impair the security or compromise the integrity of the System.
(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period

of suspension under that subsection for a further period of not more than 28 days by notice in writing to the
healthcare provider.

(3) After suspending a registration, the Commissioner must notify the healthcare provider in writing of—
(a) the suspension;
(b) the date on which the suspension takes effect; and
(c) the reasons for the suspension.

(4) When the registration of a healthcare provider (including a Government department) is suspended—
(a) new data or information of a registered healthcare recipient may still be provided by the healthcare provider

to the System; but
(b) the electronic health record of a registered healthcare recipient must not be made available to the healthcare

provider through the System.
(5) After the Commissioner is satisfied that there are no longer any grounds for suspending the healthcare

provider’s registration, the Commissioner must notify the healthcare provider in writing of—
(a) the Commissioner’s decision; and
(b) the date on which the suspension ceases to take effect.


Section: 25 Cancellation of healthcare provider’s registration L.N. 197 of 2015 02/12/2015


(1) The Commissioner may cancel a registration of a registered healthcare provider if the Commissioner is satisfied
that—
(a) the healthcare provider contravenes—

(i) a provision of this Ordinance;



Cap 625 - Electronic Health Record Sharing System Ordinance 13

(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;

(b) the healthcare provider no longer provides healthcare at the service location to which the registration
relates;

(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System;

or
(ii) the system requirements on data sharing specified by the Commissioner;

(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use
of data and information specified in section 28; or

(e) the registration may impair the security or compromise the integrity of the System.
(2) The Commissioner must notify the healthcare provider in writing of—

(a) the date on which the cancellation is to take effect; and
(b) the reasons for the cancellation.

(3) The healthcare provider may, within 14 days after the date of the notice (or such longer period as the
Commissioner may allow), make representations to the Commissioner to object to the cancellation in the manner
specified in the notice.

(4) The Commissioner must not cancel the registration unless—
(a) the healthcare provider has not made any representations under subsection (3); or
(b) the Commissioner has considered the representations and informed the healthcare provider of the decision

of cancellation.
(5) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the

cancellation takes effect.

Section: 26 Supplementary provision to sections 24, 25 and 51 L.N. 197 of 2015 02/12/2015


A reference in sections 24, 25 and 51 to the service location to which a registration relates includes each of the service
locations covered by a single registration of a healthcare provider under section 19(3)(a).

Part: 3 Electronic Health Record L.N. 197 of 2015 02/12/2015




Part:
Division:

3
1

Use of Electronic Health Record L.N. 197 of 2015 02/12/2015





Section: 27 General rule L.N. 197 of 2015 02/12/2015


The data and information contained in an electronic health record may not be used except as provided in section 28,
29, 30 or 31.

Section: 28 Use for improvement of healthcare L.N. 197 of 2015 02/12/2015


The data and information contained in the electronic health record of a registered healthcare recipient may be used for
improving the efficiency, quality, continuity or integration of the healthcare provided, or to be provided, to the
healthcare recipient.

Section: 29 Use for research and statistics


Remarks:
Not yet in operation

(1) The data and information contained in an electronic health record may be used for carrying out research, or

preparing statistics, that are relevant to public health or public safety.



Cap 625 - Electronic Health Record Sharing System Ordinance 14

(2) However, the results of the research or the resulting statistics must not be made available in a form that would
enable a healthcare recipient to be identified.


Section: 30 Use for disease control and surveillance etc. L.N. 197 of 2015 02/12/2015


(1) The data and information contained in an electronic health record may be used by a person specified in
subsection (2)—
(a) for the prevention or control of disease; or
(b) for the enhancement of disease surveillance or investigation.

(2) The person is—
(a) the Department of Health;
(b) the Hospital Authority; or
(c) a health officer as defined by section 2 of the Prevention and Control of Disease Ordinance (Cap 599).


Section: 31 Use permitted by or under any other law L.N. 197 of 2015 02/12/2015


The data and information contained in an electronic health record may be used as permitted by, or under, any other
law.

Part:
Division:

3
2

Procedures for Use of Identifiable Data under Section 29



Remarks:
Not yet in operation

Section: 32 Application to Secretary for use for research or statistics

purpose




Remarks:
Not yet in operation

(1) A person may apply to the Secretary for using identifiable data of a healthcare recipient contained in an

electronic health record for carrying out research, or preparing statistics, that are relevant to public health or
public safety.

(2) An application—
(a) must be made in the form and manner specified by the Commissioner; and
(b) must be accompanied by a proposal specified in subsection (3).

(3) The proposal is a written proposal setting out—
(a) the nature and objectives in respect of the research or statistics;
(b) the public or scientific benefit of the research or statistics that the applicant anticipates; and
(c) any other information relating to the research or statistics as specified by the Commissioner.


Section: 33 Recommendation by Board


Remarks:
Not yet in operation

(1) The Secretary may refer an application made under section 32(1) to the Board for a recommendation on whether

the application should be approved or refused.
(2) When making a recommendation, the Board must have regard to—

(a) whether it is ethical to carry out the research or prepare the statistics;
(b) whether the objectives in respect of the research or statistics are only achievable by using the identifiable

data;
(c) whether it is practicable to obtain the consent of the healthcare recipient concerned for the use;



Cap 625 - Electronic Health Record Sharing System Ordinance 15

(d) whether, at the time the research is carried out or the statistics are prepared, adequate safeguards are in
place to preserve the confidentiality of the identifiable data;

(e) the weighing of—
(i) the public interest in carrying out the research or preparing the statistics; and
(ii) the public interest in protecting the privacy of the healthcare recipient concerned; and

(f) the resource implication in providing the identifiable data.
(3) If the Board recommends that the Secretary approves the application, the Board may also make

recommendations on the conditions of the approval.

Section: 34 Decisions of Secretary


Remarks:
Not yet in operation

(1) After approving or refusing an application made under section 32(1), the Secretary must notify the applicant in

writing of the decision and—
(a) if the application is approved—the conditions of the approval; or
(b) if the application is refused—the reasons for the refusal.

(2) If the application is approved, the identifiable data is to be made available to the applicant in the form and
manner specified by the Commissioner after the applicant has paid the administrative costs for processing the
application.


Part:
Division:

3
3

Procedures for Use of Non-identifiable Data under Section
29





Remarks:
Not yet in operation

Section: 35 Application to Commissioner for use for research or

statistics purpose




Remarks:
Not yet in operation

(1) A person may apply to the Commissioner for using non-identifiable data of a healthcare recipient contained in

an electronic health record for carrying out research, or preparing statistics, that are relevant to public health or
public safety.

(2) An application—
(a) must be made in the form and manner specified by the Commissioner; and
(b) must be accompanied by a proposal specified in subsection (3).

(3) The proposal is a written proposal setting out—
(a) the nature and objectives in respect of the research or statistics;
(b) the public or scientific benefit of the research or statistics that the applicant anticipates; and
(c) any other information relating to the research or statistics as specified by the Commissioner.


Section: 36 Decisions of Commissioner


Remarks:
Not yet in operation

(1) Before approving or refusing an application made under section 35(1), the Commissioner must have regard to—

(a) whether it is ethical to carry out the research or prepare the statistics; and
(b) the resource implication in providing the non-identifiable data.

(2) After approving or refusing an application made under section 35(1), the Commissioner must notify the



Cap 625 - Electronic Health Record Sharing System Ordinance 16

applicant in writing of the decision and—
(a) if the application is approved—the conditions of the approval; or
(b) if the application is refused—the reasons for the refusal.

(3) If the application is approved, the non-identifiable data is to be made available to the applicant in the form and
manner specified by the Commissioner after the applicant has paid the administrative costs for processing the
application.


Part:
Division:

3
4

Safeguards for Access to Electronic Health Record L.N. 197 of 2015 02/12/2015





Section: 37 Prescribed healthcare provider’s duties to restrict access to
health data

L.N. 197 of 2015 02/12/2015



(1) This section applies if a prescribed healthcare provider is given a sharing consent by a registered healthcare
recipient or a substitute decision maker of a registered healthcare recipient.

(2) The healthcare provider must take reasonable steps to ensure that—
(a) access to any health data of the healthcare recipient is restricted to a healthcare professional of the

healthcare provider who may perform healthcare for the recipient; and
(b) the access is restricted to the health data that may be relevant for performing healthcare for the recipient.

(3) However, for complying with a data access request or data correction request under Part 5 of the Privacy
Ordinance, the healthcare provider is not to be treated as contravening the requirements under subsection (2)
even if access to the health data is granted to a person other than the healthcare professional.


Part: 4 Application to Data or Information that is Personal Data

under Privacy Ordinance
L.N. 197 of 2015 02/12/2015





Section: 38 Data or information to which this Part applies L.N. 197 of 2015 02/12/2015


This Part applies to data or information that is personal data as defined by section 2(1) of the Privacy Ordinance.

Section: 39 Privacy Commissioner’s performance of functions or

exercise of powers in relation to data or information
L.N. 197 of 2015 02/12/2015



(1) If the Privacy Commissioner performs a function or exercises a power under the Privacy Ordinance in relation to
data or information contained in the System, the Privacy Commissioner must do so subject to the conditions
specified in subsection (2).

(2) The conditions are—
(a) a word or an expression used in this Part, and defined or otherwise explained in section 2 of the Privacy

Ordinance, has the same meaning as in that section; and
(b) despite paragraph (a), a reference to a minor in the Privacy Ordinance is a reference to a person below 16

years of age.
(3) Subsection (2)(a) does not apply to the word “Commissioner”.

Section: 40 Commissioner’s further duty in certain circumstances L.N. 197 of 2015 02/12/2015


(1) This section applies if—
(a) a person is required to comply with section 23(1) of the Privacy Ordinance in relation to the data or

information of a registered healthcare recipient that was provided to the System by the person as a
prescribed healthcare provider; and

(b) the person—
(i) is no longer a prescribed healthcare provider;



Cap 625 - Electronic Health Record Sharing System Ordinance 17

(ii) no longer has the sharing consent of the healthcare recipient; or
(iii) fails to respond to a data correction request in compliance with the Privacy Ordinance.

(2) The Commissioner must make a note, whether annexed to the data correction requested or elsewhere, of the
matters in respect of which the data is considered by the requestor to be inaccurate.

(3) The note must be made in such a way that the data cannot be used by a person without the note being drawn to
the attention of, and being made available for inspection by, the person.


Section: 41 Contravention of requirement under Privacy Ordinance L.N. 197 of 2015 02/12/2015


For the purposes of the Privacy Ordinance, a contravention of a requirement under a provision of that Ordinance that
has effect subject to this Part is to be regarded as a contravention of a requirement under that Ordinance.

Part: 5 Offences L.N. 197 of 2015 02/12/2015




Section: 42 Offences relating to accessing, damaging or modifying data
or information

L.N. 197 of 2015 02/12/2015



(1) A person commits an offence if the person knowingly causes a computer to perform a function so as to obtain
unauthorized access to data or information contained in an electronic health record.

(2) A person who commits an offence under subsection (1) is liable on summary conviction to a fine at level 6.
(3) For the purposes of subsection (1), access by a person to data or information is unauthorized if—

(a) the person is not entitled to control that access;
(b) the person has not been authorized by another person who controls that access to obtain that access;
(c) the person does not believe that the authorization has been given; and
(d) the person does not believe that, even if the person had applied to the appropriate authority, the

authorization would have been given.
(4) A person commits an offence if the person, without lawful excuse, knowingly damages data or information

contained in an electronic health record.
(5) A person who commits an offence under subsection (4) is liable on summary conviction to imprisonment for 2

years.
(6) A person commits an offence if—

(a) the person knowingly—
(i) causes access to data or information contained in an electronic health record;
(ii) causes modification of data or information contained in an electronic health record; or
(iii) causes impairment to the accessibility, reliability, security or processing of data or information

contained in an electronic health record; and
(b) the person causes the access, modification or impairment—

(i) with intent to commit an offence;
(ii) with a dishonest intent to deceive;
(iii) with a view to dishonest gain for the person or for another; or
(iv) with a dishonest intent to cause loss to another,

whether on the same occasion as the person causes the access, modification or impairment or on any future
occasion.

(7) A person who commits an offence under subsection (6) is liable on conviction on indictment to imprisonment
for 5 years.

(8) For the purposes of subsection (6)(b)—
(a) a reference to gain includes—

(i) a gain in money or other property;
(ii) a temporary gain or a permanent gain;
(iii) a gain by keeping what one has; and
(iv) a gain by getting what one has not; and

(b) a reference to loss includes—
(i) a loss in money or other property;



Cap 625 - Electronic Health Record Sharing System Ordinance 18

(ii) a temporary loss or a permanent loss;
(iii) a loss by not getting what one might get; and
(iv) a loss by parting with what one has.

(9) In this section—
computer (電腦) means a device for storing, processing or retrieving data or information.

Section: 43 Offences relating to impairment to System L.N. 197 of 2015 02/12/2015


(1) A person commits an offence if the person knowingly impairs the operation of the System.
(2) A person who commits the offence is liable on conviction on indictment to imprisonment for 10 years.

Section: 44 Offences relating to data access requests and data

correction requests
L.N. 197 of 2015 02/12/2015



(1) A person commits an offence if the person, with intent to evade a data access request or data correction request
in relation to any data or information contained in an electronic health record—
(a) alters, falsifies, conceals or destroys the data or information; or
(b) directs another person to do anything mentioned in paragraph (a).

(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

Section: 45 Offences relating to untrue statements L.N. 197 of 2015 02/12/2015


(1) A person commits an offence if the person knowingly makes an untrue statement to enable the person to give a
joining consent or sharing consent.

(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

Section: 46 Offences relating to contravening conditions for research

or statistics purpose




Remarks:
Not yet in operation

(1) A person commits an offence if the person knowingly contravenes a condition imposed under section 34(1)(a).
(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

Section: 47 Offences relating to direct marketing L.N. 197 of 2015 02/12/2015


(1) A person commits an offence if the person uses another person’s data or information contained in an electronic
health record, or a copy (in whatever format) of the data or information, for direct marketing.

(2) A person who commits an offence under subsection (1) is liable on conviction on indictment to a fine of
$500,000 and to imprisonment for 3 years.

(3) A person commits an offence if, for gain, the person provides to others another person’s data or information
contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct
marketing.

(4) A person who commits an offence under subsection (3) is liable on conviction on indictment to a fine of
$1,000,000 and to imprisonment for 5 years.

(5) A person commits an offence if, not for gain, the person provides to others another person’ s data or
information contained in an electronic health record, or a copy (in whatever format) of the data or information,
for direct marketing.

(6) A person who commits an offence under subsection (5) is liable on conviction on indictment to a fine of
$500,000 and to imprisonment for 3 years.

(7) This section does not apply in relation to the use or provision of data or information contained in an electronic
health record, or a copy (in whatever format) of the data or information, by a person if, not for gain, the person



Cap 625 - Electronic Health Record Sharing System Ordinance 19

uses or provides the data or information, or the copy, for a purpose specified in subsection (8).
(8) The purpose is the offering, or the advertising of the availability, of—

(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided or administered by the Department of Health or the Hospital Authority; or
(c) any other social or health care services that, if not provided, would be likely to cause serious harm to the

physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.

(9) In this section—
direct marketing (直接促銷) has the meaning given by section 35A(1) of the Privacy Ordinance;
health care services (醫護服務) has the same meaning as in sections 35B and 35I of the Privacy Ordinance.

Part: 6 Administrative and Miscellaneous Provisions L.N. 197 of 2015 02/12/2015




Part:
Division:

6
1

Administration L.N. 197 of 2015 02/12/2015





Section: 48 Appointment of Commissioner L.N. 197 of 2015 02/12/2015


(1) The Secretary may appoint a public officer to be the Commissioner for the Electronic Health Record.
(2) The appointment is to be notified in the Gazette.

Section: 49 Functions and powers of Commissioner L.N. 197 of 2015 02/12/2015


Remarks:
*Section 49(1)(g) has not yet come into operation.

(1) The Commissioner has the following functions—

(a) to establish, operate, maintain and develop the System;
(b) to regulate and supervise the sharing and using of data and information contained in the System;
(c) to supervise the compliance with this Ordinance;
(d) to promote the System to healthcare recipients, healthcare providers and the public;
(e) to devise and promote, and encourage among healthcare providers, proper standards of conduct, and sound

and prudent practices, in data sharing;
(f) to advise the Secretary on matters relating to the System;
*[(g) to deal with applications for use of data and information contained in an electronic health record

under section 29; and]
(h) to devise a mechanism for handling complaints relating to the operation of the System.

(2) The Commissioner may do anything necessary for, or incidental or conducive to, the performance of a function
of the Commissioner.

(3) The Commissioner may appoint in writing a person to assist the Commissioner in performing a function and
exercising a power.


Section: 50 Commissioner to keep register of prescribed healthcare

providers
L.N. 197 of 2015 02/12/2015



(1) The Commissioner must establish and maintain a register of prescribed healthcare providers for the purposes of
this Ordinance.

(2) The register may be kept in a form, and may contain information, that the Commissioner considers appropriate.
(3) The register must be made available for a member of the public to ascertain—

(a) whether a healthcare provider is registered as a healthcare provider for the System under section 20(1); and



Cap 625 - Electronic Health Record Sharing System Ordinance 20

(b) the service location for which the healthcare provider is registered.
(4) The register must be made available for public inspection free of charge—

(a) through the Internet; and
(b) at the office of the Commissioner, or any other Government offices as the Commissioner may direct, during

normal office hours.

Section: 51 Commissioner to require production of records or

documents in certain circumstances
L.N. 197 of 2015 02/12/2015



(1) If it appears to the Commissioner that there are circumstances suggesting the happening of an event specified in
subsection (2), the Commissioner may in writing require a prescribed healthcare provider to produce the record
or document—
(a) that is or may be relevant to the event; and
(b) that is in the possession or under the control of the healthcare provider.

(2) The event is that—
(a) the healthcare provider contravenes—

(i) a provision of this Ordinance;
(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;

(b) the healthcare provider no longer provides healthcare at the service location to which the registration
relates;

(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System;

or
(ii) the system requirements on data sharing specified by the Commissioner;

(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use
of data and information specified in section 28; or

(e) the registration may impair the security or compromise the integrity of the System.
(3) The requirement must specify the manner in which the record or document must be produced.

Section: 52 Commissioner to issue code of practice L.N. 197 of 2015 02/12/2015


(1) The Commissioner may issue a code of practice—
(a) indicating the manner in which the Commissioner proposes to perform a function or exercise a power; or
(b) providing guidance on the operation of a provision of this Ordinance.

(2) The Commissioner—
(a) must publish the code of practice in a manner appropriate to bringing it to the notice of persons affected by

it; and
(b) must make copies of the code of practice available to the public (in hard copy or electronic form).

(3) The Commissioner may amend or revoke the code of practice. Subsections (2) and (4) apply to an amendment or
revocation of the code of practice in the same way as they apply to the code of practice.

(4) A code of practice issued under this section is not subsidiary legislation.

Section: 53 Commissioner to specify forms L.N. 197 of 2015 02/12/2015


(1) The Commissioner may specify the form of a document required for the purposes of this Ordinance.
(2) The Commissioner may specify more than one form of the document, whether as alternatives or to provide for

different circumstances.
(3) A form specified under this section—

(a) must be completed in accordance with the directions and instructions that are specified in the form; and
(b) if the completed form is required to be provided to the Commissioner or any other person, must be so

provided in the manner specified in the form.




Cap 625 - Electronic Health Record Sharing System Ordinance 21

Part:
Division:

6
2

Electronic Health Record Research Board



Remarks:
Not yet in operation

Section: 54 Establishment of Board


Remarks:
Not yet in operation

(1) A board is established with the name “Electronic Health Record Research Board” in English and “電子健

康紀錄研究委員會” in Chinese.
(2) The Board is to consist of the following members—

(a) the Permanent Secretary for Food and Health (Health), as ex officio member and chairman;
(b) the Commissioner, or a person nominated by the Commissioner as representative, as ex officio member;

and
(c) not more than 10 other members appointed by the Secretary.

(3) A person may be appointed as a non-ex officio member only if the person is, in the Secretary’s opinion, a
person—
(a) having expertise or experience in healthcare, privacy protection, statistics, research, law or information

technology;
(b) representing the interests of healthcare recipients; or
(c) having other experience that would render the person suitable for the appointment.

(4) A non-ex officio member may hold office for a term of not exceeding 5 years and on the terms specified in his or
her letter of appointment by the Secretary.

(5) A non-ex officio member is eligible for reappointment on the expiry of a term.
(6) A non-ex officio member may resign from the Board by notice in writing to the Secretary.
(7) The Secretary may terminate the office of a non-ex officio member if satisfied that—

(a) the member has ceased to be of the capacity because of which he or she was appointed; or
(b) the member is otherwise unable or unfit to perform the functions of a member of the Board.

(8) Every appointment or termination under this section is to be notified in the Gazette.
(9) Except as provided in this Ordinance, the Board may regulate its procedure and may make standing orders for

that purpose.
(10) In this section—
non-ex officio member (非當然委員) means a member of the Board appointed under subsection (2)(c).

Section: 55 Function of Board


Remarks:
Not yet in operation

The function of the Board is to make recommendations to the Secretary—

(a) for deciding whether to approve or refuse an application made under section 32(1); and
(b) for imposing conditions on approving an application made under that section.


Part:
Division:

6
3

Miscellaneous Provisions L.N. 197 of 2015 02/12/2015





Section: 56 Right of appeal—against decisions of Commissioner L.N. 197 of 2015 02/12/2015


(1) A person who is aggrieved by any of the Commissioner’s decisions set out in subsection (2) may appeal to the



Cap 625 - Electronic Health Record Sharing System Ordinance 22

Administrative Appeals Board.
(2) The decisions are—

(a) to refuse to register a healthcare recipient under section 8(1);
(b) to suspend the registration of a healthcare recipient under section 10(1);
(c) to cancel the registration of a healthcare recipient under section 11(1);
(d) to refuse to register a healthcare provider as a healthcare provider for the System under section 20(1);
(e) to suspend a registration of a registered healthcare provider under section 24(1); and
(f) to cancel a registration of a registered healthcare provider under section 25(1).

(3) An appeal may only be made within 28 days after the aggrieved person receiving notice of the decision.
(4) An appeal does not suspend the decision unless the Commissioner decides otherwise.

Section: 57 Access to card face data of healthcare recipient L.N. 197 of 2015 02/12/2015


(1) This section applies if the Commissioner or a prescribed healthcare provider gains access to the card face data of
the identity card of a healthcare recipient by using facilities provided by or with the approval of the Government.

(2) The Commissioner or the prescribed healthcare provider is to be regarded as having lawful authority to gain
access to the card face data of the identity card of the healthcare recipient for the purposes of regulation 12(1A)
of the Registration of Persons Regulations (Cap 177 sub. leg. A).

(3) In this section—
card face data (證面數據) means the data specified in paragraph 1(a), (c), (d) and (e) of Schedule 1 to the

Registration of Persons Regulations (Cap 177 sub. leg. A) that are stored in the chip embodied in an identity
card.


Section: 58 Limitation of public liability L.N. 197 of 2015 02/12/2015


Remarks:
*Section 58(c) has not yet come into operation.

The Government or a public officer does not incur any civil liability only because—

(a) data or information contained in an electronic health record is used in accordance with this Ordinance;
(b) the participation of a healthcare recipient or healthcare provider in the System is subject to the approval by

a public officer; or
*[(c) the use of data and information contained in an electronic health record referred to in section 29 is subject

to the approval of the Secretary or the Commissioner.]

Section: 59 Protection of public officers etc. L.N. 197 of 2015 02/12/2015


(1) A person to whom this section applies is not civilly liable for an act done or omitted to be done by the person in
good faith—
(a) in performing a function or purportedly performing a function under this Ordinance; or
(b) in exercising a power or purportedly exercising a power under this Ordinance.

(2) Subsection (1) does not affect the liability of the Government for the act or omission.
(3) This section applies to—

(a) a public officer; and
(b) an employee of the Hospital Authority, or an employee of a body corporate established by the Hospital

Authority under section 5(n) of the Hospital Authority Ordinance (Cap 113), appointed by the
Commissioner under section 49(3).


Section: 60 Service of notice etc. L.N. 197 of 2015 02/12/2015


A notice or document required to be given or sent under this Ordinance is, in the absence of evidence to the contrary,
given or sent if—

(a) for an individual—



Cap 625 - Electronic Health Record Sharing System Ordinance 23

(i) it is addressed to and delivered personally to the individual;
(ii) it is sent to the individual by post addressed to the individual at the individual’s last known address;
(iii) it is sent to the individual by an electronic mail transmission addressed to the individual at the

individual’s last known electronic mail address; or
(iv) it is sent to the individual by a text message addressed to the individual at the individual’s last known

telephone number;
(b) for a company—

(i) it is addressed to the company and delivered to an officer of the company by hand;
(ii) it is addressed to the company and left at or sent by post to the registered office of the company; or
(iii) it is sent to the company by post addressed to the company at the company’s last known address;

(c) for a partnership—
(i) it is addressed to the partnership and delivered to a place in Hong Kong at which the partnership

carries on business, and given to a person apparently concerned in the management of, or apparently
employed by, the partnership by hand; or

(ii) it is sent to the partnership by post addressed to the partnership at the partnership’s last known
address; or

(d) for a statutory body, a body corporate other than a company, or an unincorporated body of persons other
than a partnership—
(i) it is addressed to the body and delivered to a place in Hong Kong at which the body carries on

business, and given to a person apparently concerned in the management of, or apparently employed
by, the body by hand; or

(ii) it is sent to the body by post addressed to the body at the body’s last known address.

Section: 61 Amendment of Schedule L.N. 197 of 2015 02/12/2015


The Secretary may by notice published in the Gazette amend the Schedule.

Part: 7 Amendment to Administrative Appeals Board Ordinance L.N. 197 of 2015 02/12/2015




Section: 62 Administrative Appeals Board Ordinance amended L.N. 197 of 2015 02/12/2015


The Administrative Appeals Board Ordinance (Cap 442) is amended as set out in section 63.

Section: 63 Schedule amended L.N. 197 of 2015 02/12/2015


The Schedule—
Add

“74
.

Electronic Health
Record Sharing
System Ordinance
(Cap 625)

A decision of the Commissioner for the Electronic Health Record—

(a) to refuse to register a healthcare recipient under section 8(1);

(b) to suspend the registration of a healthcare recipient under section 10(1);

(c) to cancel the registration of a healthcare recipient under section 11(1);

(d) to refuse to register a healthcare provider as a healthcare provider for the
Electronic Health Record Sharing System under section 20(1);

(e) to suspend a registration of a registered healthcare provider under section
24(1);

(f) to cancel a registration of a registered healthcare provider under section
25(1).”.

(Amended E.R. 3 of 2015)




Cap 625 - Electronic Health Record Sharing System Ordinance 24

Schedule: Schedule L.N. 197 of 2015 02/12/2015


[sections 2 & 61]

Healthcare Professionals


1. A registered pharmacist within the meaning of the Pharmacy and Poisons Ordinance (Cap 138).

2. A registered dentist within the meaning of the Dentists Registration Ordinance (Cap 156).

3. An enrolled dental hygienist within the meaning of the Ancillary Dental Workers (Dental Hygienists)

Regulations (Cap 156 sub. leg. B).

4. A registered medical practitioner within the meaning of the Medical Registration Ordinance (Cap 161).

5. A registered midwife within the meaning of the Midwives Registration Ordinance (Cap 162).

6. A registered nurse or enrolled nurse within the meaning of the Nurses Registration Ordinance (Cap 164).

7. A registered medical laboratory technologist within the meaning of the Medical Laboratory Technologists

(Registration and Disciplinary Procedure) Regulations (Cap 359 sub. leg. A).

8. A registered occupational therapist within the meaning of the Occupational Therapists (Registration and

Disciplinary Procedure) Regulations (Cap 359 sub. leg. B).

9. A registered optometrist within the meaning of the Optometrists (Registration and Disciplinary Procedure)

Regulation (Cap 359 sub. leg. F) whose name has been entered in Part I of the register as defined by section 2 of
that Regulation.


10. A registered radiographer within the meaning of the Radiographers (Registration and Disciplinary Procedure)

Regulation (Cap 359 sub. leg. H).

11. A registered physiotherapist within the meaning of the Physiotherapists (Registration and Disciplinary

Procedure) Regulation (Cap 359 sub. leg. J).

12. A registered chiropractor within the meaning of the Chiropractors Registration Ordinance (Cap 428).

13. A listed or registered Chinese medicine practitioner within the meaning of the Chinese Medicine Ordinance

(Cap 549).