Konfidensialitas Medis

01Ethical and Legal Foundations

Medical confidentiality is not merely a courtesy. It is a legal obligation rooted in both ethical tradition and positive law.

The ethical origin traces back to the Hippocratic Oath, which pledges that anything learned during the care of patients will be kept secret. Medical confidentiality is one of the oldest professional obligations in medicine, first articulated in the Hippocratic tradition, and it remains a moral duty grounded in norms of decency and the dignity of the patient.

In the Indonesian context, the obligation is codified across multiple layers of regulation. The principle is straightforward: all data and information about a person's health obtained by healthcare workers during the performance of their duties constitutes a medical secret (rahasia kedokteran). Permenkes No. 36/2012 defines medical secrets as all data and information about a person's health acquired by healthcare workers in the course of carrying out their professional duties.

This obligation has both an ethical dimension (governed by the Indonesian Code of Medical Ethics, KODEKI) and a legal dimension (enforced through criminal, civil, administrative, and disciplinary sanctions). Violations of medical ethics, medical discipline, and law are interrelated domains; an ethics violation may simultaneously constitute a disciplinary violation and a violation of law.

A test-writer approaches this topic by testing whether you understand: (a) who is obligated, (b) what is protected, (c) how long the obligation lasts, (d) when confidentiality can legally be broken, and (e) what sanctions apply when it is breached. Each of these is a separate testable domain.

02Indonesian Legal Framework

03Scope of Medical Confidentiality

What exactly counts as a medical secret? The scope is broad.

According to Permenkes 36/2012 Pasal 3, medical secrets encompass data and information about: (a) patient identity; (b) patient health status including anamnesis results, physical examination, supporting investigations, diagnosis, treatment, and/or medical procedures; and (c) any other matters pertaining to the patient.

The sources of such information are not limited to what the patient tells the doctor. Data and information may come from the patient, the patient's family, the person accompanying the patient, referral or consultation letters, or other sources.

The obligation extends beyond what is written in the medical record. The confidential information a physician must protect is not limited to what is documented in the medical record file. Anything overheard, observed, or inferred during the clinical encounter falls under this protection.

Under UU No. 27/2022 (UU PDP), health data is classified as specific personal data (data pribadi yang bersifat spesifik), which requires a higher level of protection than general personal data. The Personal Data Protection Law identifies two categories of personal data: general data and specific data. Specific data includes health data and information, biometric data, genetic data, criminal records, child data, personal financial data, and other data as determined by law.

04Who Must Maintain Confidentiality

All parties involved in medical services or who use data and information about patients are obligated to maintain medical confidentiality.

The obligation persists forever, even after the physician no longer holds the position, and even after the patient has died. KODEKI Pasal 16 explains that every physician is obligated to protect all secrets related to the patient's illness, as well as other information learned about the patient's personal health, even after the patient has died.

05Confidentiality Can Be Legally Broken

This is the most heavily tested area. Exam questions frequently present a clinical or forensic scenario and ask whether the physician is permitted (or required) to disclose patient information.

The overarching rule: medical confidentiality is not absolute. The obligation to preserve medical confidentiality has evolved to be non-absolute, because under certain conditions, the obligation may be set aside.

Under Permenkes 36/2012 Pasal 5(1), medical secrets may be disclosed only for the following purposes: the patient's health interests, fulfilling a law enforcement request for legal proceedings, the patient's own request, or as mandated by other legislation.

For patient health interests, Permenkes 36/2012 Pasal 6 further specifies two subcategories:

Disclosure of medical secrets for the patient's health care purposes, including treatment, recovery, and nursing, requires patient consent. Disclosure for administrative purposes, insurance payment, or health financing guarantee also requires patient consent, which may be given in writing or through electronic information systems. Such consent is deemed to have been given at the time the patient registers at the healthcare facility.

When the patient is not competent to give consent (minors, unconscious patients, mentally incapacitated patients), consent may be given by the closest family member or legal guardian.

6. Verschoningsrecht vs. Spreekplicht

This is a classic exam topic that tests whether you understand the tension between two legal obligations.

A physician summoned by a court faces a dilemma: on one hand, the physician is obligated to maintain medical confidentiality (as required under the criminal law), but on the other hand, the physician is required by law to give testimony when called as a witness (as required under the Code of Criminal Procedure).

There are two competing duties:

• Verschoningsrecht (Right of Refusal): The physician's right to decline giving testimony in court to protect the patient's medical secrets. This is grounded in the criminal procedure code (KUHAP Pasal 170), which allows certain professionals to refuse testimony on the basis of professional secrecy.

• Spreekplicht (Duty to Speak): The legal obligation to give testimony when summoned by a court. Refusal to testify when legally obligated can itself be a criminal offense.

In this dilemma, the physician may petition the presiding judge regarding which aspects of medical confidentiality may be disclosed in court proceedings and which must be withheld (as provided under KUHAP Pasal 170). This is called the physician's right of professional privilege.

07Sanctions for Breach of Medical Confidentiality

This is the section exam questions use to test your knowledge of the penalty framework. There are five layers of sanctions that can apply simultaneously.

Summary Table of Sanctions

Important Notes on Sanctions

Under the new KUHP (UU 1/2023), the provision for disclosing professional secrets is now Pasal 443, not the old Pasal 322. Pasal 443 of UU 1/2023 governs the offense of disclosing secrets, and its explanatory notes clarify that the physician's obligation to keep patient information confidential is one of the examples of professional secrecy covered by this provision.

A critical nuance: Pasal 443(2) makes this a delik aduan (complaint-based offense) when it concerns another person's secrets. This means prosecution requires the aggrieved patient (or their representative) to file a formal complaint. Without the complaint, the state cannot prosecute on its own initiative.

Under UU PDP, the sanctions are significantly heavier because health data is classified as specific personal data deserving heightened protection. The UU PDP provides that violations involving specific personal data carry a risk of more severe sanctions. If the breach is committed by a corporation (e.g., a hospital), the fine imposed on a corporation may be up to 10 times the maximum individual fine.

08Differential Diagnosis & Distractors

09Traps & High-Yield Pearls

Trap 1: Citing repealed laws. The most common mistake is citing Pasal 322 of the old KUHP or Pasal 48 of UU 29/2004 as the legal basis for confidentiality. As of January 2, 2026, the old KUHP has been replaced by UU 1/2023 (Pasal 443), and UU 29/2004 was repealed by UU 17/2023. Exam answers that cite repealed provisions will be marked wrong. Always cite the currently valid statute.

Trap 2: Assuming confidentiality is absolute. A vignette may present a situation where a patient has a dangerous communicable disease and ask whether the physician can disclose. Students who answer "never, because of confidentiality" will miss the point. Confidentiality can be broken under the statutory exceptions outlined in Permenkes 36/2012 Pasal 5, especially for public health interest and law enforcement.

Trap 3: Confusing the verschoningsrecht with blanket refusal to testify. When a physician is called to court, the correct answer is never "refuse entirely." The physician has the right to petition the judge regarding which information should remain confidential, not the right to ignore a court summons.

Trap 4: Forgetting that UU PDP now applies to health data. Since 2022, health information is classified as specific personal data under UU 27/2022. This adds a separate layer of sanctions beyond the traditional medical secrecy framework. Exam questions may test whether you recognize that a breach of patient data can trigger sanctions under both health law and data protection law simultaneously.

Trap 5: Overlooking who is bound. A question may ask about a hospital receptionist or a medical records officer who leaks patient information. Students may think only doctors are liable. In fact, all parties who gain access to patient information are bound by the obligation of confidentiality.

Trap 6: Consent deemed given at registration. For administrative and insurance-related disclosures, consent is considered to have been given at the time of patient registration. This is a subtle but testable detail from Permenkes 36/2012 Pasal 6(4). Students who answer "separate written consent is always required" for every type of disclosure will lose marks.

The core competency being tested is your ability to balance the patient's right to privacy against legitimate competing interests (public health, law enforcement, the patient's own care), and to sequence your legal reasoning correctly: first identify the general rule (confidentiality is mandatory), then identify whether an exception applies, and finally determine what the proper procedure for disclosure is (consent, court order, formal request, or statutory mandate).