Healthcare Data Governance and Electronic Health Records

A hospital compliance lead receives what sounds like a simple request: show who can access a patient-data repository, why they can use it, where its information comes from, who receives it, and which safeguards govern an external connection.

The electronic medical record team can explain the application. Security can produce access logs. Privacy has a processing inventory. The clinical department knows who owns the workflow. A technology partner holds the interface documentation. Yet nobody can assemble one coherent answer without calling a meeting.

That is the healthcare data-governance problem in miniature. The information exists, but its accountability is fragmented.

Vietnam's Decree 102/2025/NĐ-CP makes that fragmentation harder to ignore. Issued on 13 May 2025 and effective from 1 July 2025, the decree is an active healthcare-sector overlay led by the Ministry of Health. It addresses the access, quality, sharing, and interoperability of health data across organizations within its scope.

It does not replace the Personal Data Protection Law, the broader Data Law, or cybersecurity obligations. It adds healthcare-specific operating questions above them. A patient-data activity can therefore require sector evidence while also depending on separate personal-data and security work.

My view is that healthcare organizations should resist the temptation to answer this with another compliance spreadsheet. The better objective is a governed record that connects a health-data domain to its owner, database context, data flows, access decisions, sharing arrangements, safeguards, and review evidence.

ComplianceOne does not replace the EHR, EMR, hospital information system, identity platform or cybersecurity stack. It provides the governance layer connecting health-data activities to accountable owners, access decisions, recipients, sharing arrangements, safeguards, exceptions, cross-framework obligations and reviewable evidence.

The electronic health record is part of that picture. It is not the whole picture.

Why the Application View Is Too Narrow

Healthcare teams often organize data governance around applications. This is understandable. Applications have contracts, administrators, technical owners, and visible user interfaces.

Health data does not respect those boundaries.

A patient journey may touch registration, clinical documentation, diagnostics, pharmacy, billing, insurance, referrals, research, reporting, and patient-facing services. Information can move between national, specialised, and shared healthcare databases. A medtech provider or health-app service may create or receive information outside the core clinical record.

If governance begins and ends with the name of an application, important questions remain unanswered:

• Which health-data domain does the information belong to?
• Which organizational unit is accountable for the record?
• What are the sources, recipients, and storage locations?
• Which access and use decisions have been approved?
• What connection or sharing arrangement moves the information?
• Which security safeguards apply to that arrangement?
• Which horizontal privacy, data, and cybersecurity evidence also supports it?

An application inventory can support these questions, but it cannot substitute for them. Healthcare data governance must describe information in its clinical and institutional context, not only its software container.

The Cost of Unlinked Evidence

Fragmented evidence creates more than administrative inconvenience. It makes accountability difficult to test.

An access log may show that a user opened a record, while the organization cannot quickly locate the authorization basis for that role. A data-sharing agreement may name a recipient, while the current safeguards are maintained elsewhere. A privacy assessment may describe sensitive health data, while the healthcare database owner has no link to it. An integration project may have technical test results but no durable readiness record owned by compliance.

This produces a pattern I see often: every team can prove its own activity, but the organization cannot prove the relationship between those activities.

The regulator-facing question is rarely limited to whether a document exists. It is whether the organization can connect the document to the relevant database, data domain, owner, approval, recipient, safeguard, and review period.

Evidence should therefore be designed around relationships, not folders.

Use the Full Supported Health-Data Stack

Decree 102 remains the healthcare-sector anchor. The supported personal-data layer includes Law 91/2025/QH15, Decree 356/2025/NĐ-CP and relevant administrative procedures in Decision 778/QĐ-BCA. Patient-data inventory, rights work, processing assessments, transfer evidence and retention decisions should connect to the healthcare records they concern. A Decree 102 record alone does not settle the privacy basis for access, sharing or continued retention.

The broader data layer includes the Data Law, Decree 165/2025 and Decision 20/2025 on important and core data. For organizations supplying regulated data products or services, Decree 169/2025 must be read with its Decree 347/2026 amendments. Decree 314/2026 governs data-exchange/data-marketplace operations (sàn dữ liệu), rather than every clinical software application commercially described as a platform. Ordinary patient-data processing does not by itself establish either specialist role.

Where an organization operates, maintains or participates in national, specialised or public-sector database infrastructure, the supported national-database and data-sharing framework should also be scoped separately. 

The security layer includes Cybersecurity Law 116/2025/QH15, Decree 333/2026 on implementation, Decree 331/2026 on information-system protection and Decree 330/2026 on cybersecurity and personal-data penalties. Decree 331 requires a scope assessment: mandatory coverage concerns systems serving state-agency operations and online services to citizens and businesses, while other operators are encouraged to apply it. Preserve any relevant transition attached to an earlier system-level approval. Decree 363/2026 on data-sector penalties is supported as upcoming until 11 November 2026, rather than as a current penalty basis before commencement.

Health data involving state secrets requires separate treatment. Decree 102 expressly excludes health data related to state secrets from its scope. Where that classification is relevant, the applicable State Secrets Protection Law and Decree 63/2026 requirements should be assessed separately rather than treating the Decree 102 record as the governing framework.

Electronic records, signatures and identity need their own evidence. Supported Electronic Transactions Law and Decree 23/2025 trust-services content can inform review of signed records; the identity stack includes Identity Law 26/2023/QH15, Decree 69/2024/NĐ-CP and Decree 320/2026/NĐ-CP. Linking that content does not mean ComplianceOne signs clinical records, verifies national identity or connects to production EHR or identity services.

Healthcare AI introduces another decision record. The AI Law, Decree 142/2026, Circular 05/2026 and Decision 33/2026 support a separate assessment of the deployed system, its category, conditions, exclusions and human-approved classification. A healthcare setting alone does not make every AI system high risk. Its classification, oversight and incident evidence should remain traceable to the relevant health-data activity.

The healthcare record supplies sector context, while each applicable framework retains its own owner, decision and evidence. No single approval, readiness template or shared attachment proves compliance with the whole stack.

Who Needs to Treat Decree 102 as an Operating Layer

Decree 102 has broad subject coverage. It applies to Vietnamese agencies, organizations and individuals, as well as relevant foreign organizations and individuals in Vietnam or involved with digital health data in Vietnam.

In practice, this can include hospitals and other healthcare facilities, diagnostic providers, health insurers and processors, healthcare technology providers, health applications, health-data platforms and other organizations participating in Vietnam's health-data ecosystem.

The specific obligations still depend on the organization's role, activities, databases and health-data flows.

ComplianceOne supports direct operation for organizations that declare themselves in scope. Organizations outside that declared scope can review the overlay in reference mode without generating deadlines, automated workflows, or compliance-score effects. That distinction helps teams learn from the framework without turning browsing into an operational commitment.

A Six-Part Model for Health-Data Governance

A useful operating model connects six disciplines: inventory, domain mapping, database ownership, access and use authorization, connection and sharing evidence, and cross-framework traceability.

These disciplines should reinforce each other. The inventory identifies what exists. Domain mapping supplies healthcare context. Database governance assigns accountable control. Access records explain permitted use. Sharing records explain external movement. Cross-framework links prevent the organization from documenting the same underlying safeguard repeatedly.

1. Build the Inventory Around Data Flows

A strong health-data inventory does more than list categories. It records the organizational unit, scope, data elements, sources, recipients, storage locations, responsible person, review date, and status.

The source and recipient fields are especially important. A static list tells you what an organization says it holds. A flow-oriented inventory helps explain how information enters, moves through, and leaves the organization.

For each governed entry, teams should be able to answer:

• What health information is in scope?
• Which unit is responsible for the activity?
• Where does the information originate?
• Which internal or external recipients receive it?
• Where is it stored or made available?
• Who owns the record and when is it reviewed?
• Which related evidence supports the entry?

The goal is not to reproduce every database field. It is to create enough structure for access, sharing, quality, privacy, and security reviews to refer to the same health-data activity.

2. Map Healthcare Context Explicitly

ComplianceOne maps governed health-data activities to the applicable areas within Decree 102's 24 health-data fields. The value of domain mapping is not the number itself. It is the ability to place a data flow within a recognized healthcare context rather than leaving it as a generic label such as "medical information."

Generic labels hide material differences. Diagnostic images, prescription information, insurance-related records, and operational healthcare data can have different sources, users, sharing patterns, and quality concerns. Domain mapping makes those differences visible to reviewers.

The mapping should remain connected to ownership and evidence. A taxonomy without accountable records becomes another reference list. A governed mapping helps teams ask whether each domain has a responsible unit, documented flows, current access rules, and relevant safeguards.

3. Keep Database Governance Specific

National, specialised, and shared healthcare databases should not collapse into one undifferentiated control statement. Each can have a distinct purpose, owner, implementation, access model, and risk profile.

A specific governance record should identify the database context, accountable owner, control description, implementation evidence, and review history. This allows an oversight team to see where the same control is implemented differently and where a shared statement no longer reflects reality.

This approach also improves change management. If a connection, owner, access rule, or safeguard changes for one database, the organization can review the affected record without pretending that every healthcare database changed with it.

4. Separate Access Evidence From Access Technology

Access technology answers whether a user or service could connect. Governance evidence answers why that access was authorized, what use was permitted, who approved it, and which accountable owner stands behind the decision.

Both are necessary, but they are not interchangeable.

ComplianceOne records and justifies access-and-use decisions and preserves their approval history. It does not replace identity systems, clinical applications, or technical access controls. This boundary keeps the claim credible. A governance record can connect the decision to technical evidence without pretending to enforce every login.

Healthcare teams should examine access at more than one level:

• Role design: which job functions require access?
• Individual assignment: who currently holds the role?
• Purpose: what use of the information is authorized?
• Database context: which repository or shared service is involved?
• Review: who confirms that the decision remains appropriate?
• Evidence: which logs, approvals, and control records support the conclusion?

This structure helps when a technically valid login raises a governance question. The organization can compare observed activity with the documented purpose and authorization rather than assuming authentication alone proves appropriate use.

5. Treat Connection and Sharing as Governed Decisions

Healthcare interoperability creates value by making relevant information available across organizational and technical boundaries. It also creates accountability questions that cannot be answered by an interface diagram alone.

A connection and sharing record should identify the recipient, the purpose and scope of the arrangement, the responsible owner, and the safeguards associated with the exchange. The evidence may include agreements, approvals, technical descriptions, review records, and other material appropriate to the arrangement.

The record should not claim that documentation guarantees secure transmission. It should show that the organization identified the recipient and safeguards, assigned accountability, and retained the evidence needed for review.

This becomes particularly useful when connections evolve. A recipient may change its service, the data scope may expand, or a new integration path may be introduced. A governed record provides a place to evaluate whether the original decision and safeguards still describe the current exchange.

6. Link Frameworks Without Flattening Them

Health data can also be personal data, sensitive data, regulated data, and information subject to cybersecurity safeguards. One activity may therefore generate evidence relevant to several legal layers.

The wrong response is to duplicate the activity in separate registers until each legal team has its own copy. Duplication increases drift and makes it unclear which record owns the underlying facts.

The other wrong response is to merge every obligation into a generic "data compliance" statement. That erases the distinct role of the healthcare-sector overlay and can obscure which requirement a reviewer is testing.

The more defensible pattern is to keep the records distinct but connected. Healthcare-specific inventory, database, access, quality, and sharing evidence stays attached to Decree 102 operations. Relevant evidence can also point to the separate Personal Data Protection Law, Data Law, Decree 165, and cybersecurity work it supports.

One piece of evidence can serve more than one review without pretending that the legal obligations are identical.

When a Hospital Connects a New Diagnostic Service

Consider a hospital introducing an external diagnostic service that will receive patient information and return results to the clinical environment.

The project team begins by updating the health-data inventory. It records the responsible unit, relevant data elements, source systems, external recipient, storage context, owner, and review date. The activity is mapped to the relevant healthcare domain rather than described only as a vendor integration.

The database governance record identifies which healthcare repositories participate and who owns their controls. Access-and-use decisions document the roles and purposes involved. The connection and sharing record names the recipient and the safeguards established for the arrangement.

Privacy evidence addresses the personal and sensitive data questions through the appropriate horizontal framework. Security evidence addresses technical protection through its own control process. Links connect those records back to the healthcare activity.

No single document proves the entire arrangement compliant. Together, the governed records show that the organization identified the flow, assigned ownership, considered access and sharing, connected relevant safeguards, and established review points.

If the diagnostic provider, data scope, or interface changes, the organization can identify which evidence needs review. That is far stronger than discovering during an inspection that the current technical diagram no longer matches the signed agreement.

Govern Electronic Health Record and VNeID Integration Evidence

Decree 102 creates concrete health-data connection, sharing and interoperability obligations for medical facilities in relation to the electronic health record integrated with the national identity application. ComplianceOne does not perform that production integration. It governs the evidence around the obligation: accountable owner, scope, source systems, implementation evidence, technical and security review, unresolved gaps, approvals and review history.

The evidence may draw from technical testing, architecture, security review, operational acceptance, and governance approval. The platform organizes and links that material. The responsible organization decides what the evidence demonstrates.

Reconstructing an Access Decision

Now consider a request for expanded access to a shared healthcare database. The requester explains the role and intended use. The accountable owner reviews whether the scope is appropriate. Supporting evidence is attached or linked, and the approval history is retained.

Months later, an audit asks why that role could use the database. The team can retrieve the access-and-use decision with its justification, ownership, and review record, then connect it to the relevant database controls and technical logs.

This does not eliminate professional judgment. It gives judgment a durable record.

That difference is central to healthcare accountability. A platform should not silently decide whether every use is lawful or clinically appropriate. It should make the organization's decision visible, attributable, and reviewable.

What an Evidence Review Should Test

A useful review should test relationships and freshness, not merely document presence.

Reviewers can ask:

1. Does each material health-data activity have an accountable owner and current review date?
2. Are sources, recipients, and storage locations consistent with the actual flow?
3. Do national, specialised, and shared databases have specific control records?
4. Can access-and-use decisions be connected to both approvals and technical evidence?
5. Do sharing arrangements name recipients and the safeguards in use?
6. Is EHR and VNeID integration evidence clearly distinguished from clinical functionality or completed integration?
7. Are healthcare records linked to relevant privacy, data, and cybersecurity evidence without duplicating them?

Organizations should also be careful with official-form language. No official form has been verified against the checked Decree 102 Gazette text, appendices, or linked Ministry of Health procedure references. The nine templates available in ComplianceOne are internal working documents for organizing evidence, not government forms.

This distinction protects the integrity of the evidence package. A useful internal template should never acquire official status through repetition.

The same caution applies to monetary penalties. ComplianceOne does not record fine amounts for this instrument. Organizations should confirm penalty questions against authoritative legal sources and qualified advice rather than borrowing an unsourced figure from a compliance summary.

The Shift From Recordkeeping to Governed Relationships

Healthcare data programs often begin by collecting lists: systems, datasets, vendors, agreements, controls, and users. Lists are necessary, but they do not explain how the organization governs the relationships between them.

Decree 102 operations become more manageable when teams connect the list of health data to domains, owners, databases, access decisions, sharing arrangements, safeguards, and review history. The organization can then examine a patient-data activity as a living set of accountable relationships rather than a row waiting for an annual update.

This is the real value of structured compliance operations. The objective is not a perfect dossier assembled once. It is an operating record that becomes stronger each time a team maps a flow, approves access, reviews a connection, or updates evidence.

The electronic medical record remains critical, but compliance readiness depends on the governance around it: who owns the data, why it moves, who can use it, where it is shared, which safeguards apply, and how those decisions are preserved.

Healthcare organizations do not need another isolated source of truth. They need a way to connect healthcare-specific evidence to daily ownership and to the separate privacy, data-governance, and cybersecurity work it depends on.

To see how governed inventories, access decisions, sharing records, and audit history can support that operating model, explore AesirX ComplianceOne.

Ronni K. Gothard Christiansen
Technical Privacy Engineer and CEO, AesirX.io

Laws and instruments referenced

Decree 102/2025/NĐ-CP, effective 1 July 2025, provides the healthcare-sector framework for health-data governance discussed in this article.

Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/NĐ-CP provide the personal-data protection layer for processing health and other personal data.

Decision 778/QĐ-BCA provides relevant administrative procedures under the personal-data protection framework.

Data Law 60/2024/QH15 and Decree 165/2025/NĐ-CP form part of the broader data-governance framework.

Decision 20/2025/QĐ-TTg identifies categories of important data and core data for classification purposes.

Decree 169/2025/NĐ-CP, as amended by Decree 347/2026/NĐ-CP, applies where an organization carries out regulated data-product or data-service activities.

Decree 314/2026/NĐ-CP concerns data exchanges and is relevant where an organization falls within that specific framework.

Cybersecurity Law 116/2025/QH15,Cybersecurity Law 116/2025/QH15, Decree 333/2026/NĐ-CP, Decree 331/2026/NĐ-CP and Decree 330/2026/NĐ-CP provide the current cybersecurity framework referenced in this article.

Decree 363/2026/NĐ-CP concerns data-sector penalties and becomes effective on 11 November 2026.

Electronic Transactions Law 20/2023/QH15 and Decree 23/2025/NĐ-CP are relevant where electronic records and trust services are involved.

Identity Law 26/2023/QH15, Decree 69/2024/NĐ-CP and Decree 320/2026/NĐ-CP provide the identity framework relevant to digital-identity integration.

AI Law 134/2025/QH15, Decree 142/2026/NĐ-CP, Circular 05/2026 and Decision 33/2026 apply separately where AI systems are used in the healthcare context.

Decree 194/2025 and the supported national-database and data-sharing framework may apply separately where an organization operates, maintains or participates in relevant national, specialised or public-sector database infrastructure.

Disclaimer

This article provides general operational and compliance information and does not constitute legal, medical, cybersecurity or other professional advice. Applicability depends on the organization, healthcare activity, systems, data processed, role in healthcare information flows and other circumstances. Organizations should assess their specific obligations and seek qualified Vietnamese legal and compliance advice where appropriate.

Frequently Asked Questions About Healthcare Data Governance and Electronic Medical Records