Cap. 625

An Ordinance to provide for the establishment of an information infrastructure for keeping and sharing electronic health records and for providing support in connection with, or facilitating, the provision of healthcare or health management, the sharing and using of data and information contained in the information infrastructure, and the protection of the information infrastructure, data and information; and to provide for incidental and related matters.(Amended 36 of 2025 s. 3)[2 December 2015] (Enacting provision omitted—E.R. 3 of 2015) Part 1 Preliminary 1. Short title and commencement (1) This Ordinance may be cited as the Electronic Health System Ordinance. (Amended 36 of 2025 s. 4)(2) This Ordinance comes into operation on a day to be appointed by the Secretary for Health by notice published in the Gazette. (Amended L.N. 144 of 2022) 2. Interpretation (1) In this Ordinance—2025 Amendment Ordinance (《2025年修訂條例》) means the Electronic Health Record Sharing System (Amendment) Ordinance 2025 (36 of 2025); (Added 36 of 2025 s. 5)advance medical directive (預設醫療指示) has the meaning given by section 2(1) of the Advance Decision on Life-sustaining Treatment Ordinance (Cap. 651); (Added 36 of 2025 s. 5)Board (研委會) means the board established under section 54 with the name “Electronic Health Record Research Board”;Commissioner (專員) means the public officer appointed under section 48 to be the Commissioner for the Electronic Health Record;company (公司) means a company as defined by section 2(1) of the Companies Ordinance (Cap. 622);consent (同意), in relation to an individual, means an express consent of the individual;data access request (查閱資料要求) has the meaning given by section 2(1) of the Privacy Ordinance;data correction request (改正資料要求) has the meaning given by section 2(1) of the Privacy Ordinance;data sharing (資料互通) means the act of providing or obtaining any sharable data of a registered healthcare recipient through the eHealth System; (Amended 36 of 2025 s. 5)eHealth System (醫健通系統) means the information infrastructure maintained under section 5 with the name “Electronic Health System”; (Added 36 of 2025 s. 5)electronic health record (電子健康紀錄)—(a) in relation to a registered healthcare recipient, means the record for the recipient that is kept under section 5(2); and(b) in relation to a healthcare recipient who was once registered, but is no longer registered, means the record for the recipient that was kept under section 5(2);enforcement notice (執行通知) means a notice given under section 26R(1); (Added 36 of 2025 s. 5)family member (家人), in relation to a healthcare recipient, means an individual who is related to the recipient by blood, marriage, adoption or affinity;fixed penalty (定額罰款) means the fixed penalty under section 2(a) of Schedule 4; (Added 36 of 2025 s. 5)HA subsidiary (醫管局附屬法團) means a body corporate established by the Hospital Authority under section 5(n) of the Hospital Authority Ordinance (Cap. 113); (Added 36 of 2025 s. 5)health data (健康資料), in relation to a healthcare recipient, means the data or information relating to— (Amended 36 of 2025 s. 5)(a) the health condition of, or the healthcare provided or to be provided to, the recipient; or(b) (if applicable) any life-sustaining treatment that is not to be provided to the recipient as stated in an instruction in an advance medical directive of the recipient; (Amended 36 of 2025 s. 5)healthcare (醫護服務), in relation to an individual, means an activity performed by a healthcare professional for the individual for—(a) assessing, recording, maintaining or improving the individual’s health;(b) diagnosing the individual’s illness or disability; or(c) treating the individual’s illness or disability, or suspected illness or disability;healthcare professional (醫護專業人員) means— (Amended 36 of 2025 s. 5)(a) a Hong Kong healthcare professional; or(b) a non-Hong Kong healthcare professional; (Amended 36 of 2025 s. 5)healthcare provider (醫護提供者) means a person that provides healthcare in Hong Kong or elsewhere; (Amended 36 of 2025 s. 5)healthcare recipient (醫護接受者) means an individual for whom healthcare has been performed, is performed, or is likely to be performed in Hong Kong or elsewhere; (Amended 36 of 2025 s. 5)healthcare referral (醫護服務轉介), in relation to a registered healthcare recipient, means a recommendation made by a prescribed healthcare provider for the provision of healthcare to the recipient by another prescribed healthcare provider;Hong Kong healthcare professional (香港醫護專業人員) means—(a) a person specified in Part 2 of Schedule 1; or(b) a person specified in Part 3 of Schedule 1 who—(i) provides healthcare in a healthcare facility that is managed or controlled by—(A) the Government;(B) the Hospital Authority; or(C) an HA subsidiary; or(ii) is engaged by a healthcare provider specified under section 53A; (Added 36 of 2025 s. 5)identifiable data (可識辨身分資料)—see subsection (2)(a);identity card (身分證) has the meaning given by section 1A(1) of the Registration of Persons Ordinance (Cap. 177);index data (索引資料), in relation to a healthcare recipient, means the personal particulars of the recipient that identify the recipient for the operation of the eHealth System; (Amended 36 of 2025 s. 5)joining consent (參與同意) means a consent given under section 7(1) or (2);minor (幼年人) means a person below 16 years of age;non-Hong Kong healthcare professional (非香港醫護專業人員) means an individual who is licensed or otherwise permitted to provide healthcare in a place outside Hong Kong under the law of that place; (Added 36 of 2025 s. 5)non-Hong Kong healthcare provider (非香港醫護提供者) means a healthcare provider that provides healthcare in a place outside Hong Kong; (Added 36 of 2025 s. 5)non-Hong Kong information infrastructure (非香港資訊基建設施) means an information infrastructure operated in a place outside Hong Kong; (Added 36 of 2025 s. 5)non-identifiable data (非可識辨身分資料)—see subsection (2)(b);parent (家長), in relation to a child, means—(a) the natural father or natural mother of the child (whether or not the natural father and natural mother are married to each other);(b) a parent of the child by adoption under, or recognized as valid by, law; or(c) a stepfather or stepmother of the child;penalty notice (罰款通知) means a notice given under section 47B(1); (Added 36 of 2025 s. 5)prescribed healthcare provider (訂明醫護提供者) means—(a) the Department of Health;(b) the Hospital Authority; (Amended 36 of 2025 s. 5)(ba) the Primary Healthcare Commission; (Added 36 of 2025 s. 5)(bb) a healthcare facility managed or controlled by—(i) the Government;(ii) the Hospital Authority; or(iii) an HA subsidiary; or (Added 36 of 2025 s. 5)(c) a registered healthcare provider;Privacy Commissioner (私隱專員) means the Privacy Commissioner for Personal Data established under section 5(1) of the Privacy Ordinance;Privacy Ordinance (《私隱條例》) means the Personal Data (Privacy) Ordinance (Cap. 486);recognition (認可)—(a) in relation to a non-Hong Kong healthcare provider, means the recognition of the healthcare provider as a healthcare provider for the eHealth System under section 26A(1); or(b) in relation to a non-Hong Kong information infrastructure, means the recognition of the information infrastructure for connection to the eHealth System under section 26E(1); (Added 36 of 2025 s. 5)recognized non-Hong Kong healthcare provider (認可非香港醫護提供者) means a non-Hong Kong healthcare provider that is recognized as a healthcare provider for the eHealth System under section 26A(1); (Added 36 of 2025 s. 5)recognized non-Hong Kong public health record system (認可非香港公共健康紀錄系統) means a non-Hong Kong information infrastructure that is recognized under section 26E(1); (Added 36 of 2025 s. 5)registered healthcare provider (登記醫護提供者) means—(a) a healthcare provider that is registered as a healthcare provider for the eHealth System under section 20(1) for a service location; or(b) a Government department that is registered as a healthcare provider for the eHealth System under section 22(1); (Amended 36 of 2025 s. 5)registered healthcare recipient (登記醫護接受者) means a healthcare recipient who is registered under section 8(1);registration (登記)—(a) in relation to a healthcare recipient, means the registration of the healthcare recipient as a registered healthcare recipient under section 8(1);(b) in relation to a healthcare provider, means the registration of the healthcare provider as a healthcare provider for the eHealth System under section 20(1) for a service location;(c) in relation to a Government department, means the registration of the department as a healthcare provider for the eHealth System under section 22(1), (Amended 36 of 2025 s. 5)and registered (登記) is to be construed accordingly;relevant healthcare provider (相關醫護提供者) means—(a) a prescribed healthcare provider; or(b) a recognized non-Hong Kong healthcare provider; (Added 36 of 2025 s. 5)Secretary (局長) means the Secretary for Health; (Amended L.N. 144 of 2022)sharable data (可互通資料), in relation to a registered healthcare recipient, means all of the following— (Amended 36 of 2025 s. 5)(a) the index data of the healthcare recipient;(b) the health data of the healthcare recipient;(c) any other data or information of the healthcare recipient that is, in the Commissioner’s opinion, necessary for the proper functioning of the eHealth System; (Added 36 of 2025 s. 5)sharing consent (互通同意) — (Amended 36 of 2025 s. 5)(a) in relation to a relevant healthcare provider, means a consent given under section 12(1)(a); or(b) in relation to a recognized non-Hong Kong public health record system, means a consent given under section 12(1)(b); (Amended 36 of 2025 s. 5)sharing restriction request (互通限制要求) means a request made under section 17(1)(a);specified health data (指明健康資料) means the health data specified in section 26Q(3); (Added 36 of 2025 s. 5)specified healthcare provider (指明醫護提供者) means a healthcare provider described in section 26Q(1); (Added 36 of 2025 s. 5)substitute decision maker (代決人)—see section 3;use (使用、用), in relation to data or information contained in an electronic health record, includes disclose or transfer the data or information.(Amended 36 of 2025 s. 5)(2) In this Ordinance—(a) any data or information of a healthcare recipient is identifiable data if the identity of the healthcare recipient is ascertainable from the data or information; and(b) any data or information of a healthcare recipient is non-identifiable data if the identity of the healthcare recipient is unascertainable from the data or information.(3) In this Ordinance, a reference to a form specified by the Commissioner is a reference to a form so specified under section 53. 3. Substitute decision maker (1) For the purposes of this Ordinance, a person is a substitute decision maker of a healthcare recipient if the person is an eligible person under subsection (2) or (3).(2) For a healthcare recipient who is a minor, the following are eligible persons for the purposes of subsection (1)—(a) a parent of the healthcare recipient who accompanies the healthcare recipient at the relevant time;(b) a guardian of the healthcare recipient appointed under or acting by virtue of the Guardianship of Minors Ordinance (Cap. 13), or otherwise appointed by the court, who accompanies the healthcare recipient at the relevant time;(c) a person appointed by the court to manage the affairs of the healthcare recipient who accompanies the healthcare recipient at the relevant time;(d) in the absence of the persons mentioned in paragraphs (a), (b) and (c), a family member of the healthcare recipient, or a person residing with the healthcare recipient, who accompanies the healthcare recipient at the relevant time;(e) in the absence of the persons mentioned in paragraphs (a), (b), (c) and (d), the prescribed healthcare provider that provides, or is about to provide, healthcare to the healthcare recipient at the relevant time.(3) For a healthcare recipient who is aged 16 or above and who is of any of the following descriptions, the persons specified in subsection (4) are eligible persons for the purposes of subsection (1)—(a) being mentally incapacitated as defined by section 2(1) of the Mental Health Ordinance (Cap. 136);(b) being incapable of managing his or her own affairs;(c) being incapable of giving a joining consent at the time referred to in paragraph (a), (b) or (c) of the definition of relevant time in subsection (5);(d) being incapable of giving a sharing consent at the time referred to in paragraph (d) or (f) of the definition of relevant time in subsection (5); (Amended 36 of 2025 s. 6)#(e) being incapable of making a sharing restriction request at the time referred to in paragraph (g) or (h) of the definition of relevant time in subsection (5).(4) The following are persons specified for the purposes of subsection (3)—(a) a person appointed under the Mental Health Ordinance (Cap. 136) to be the guardian of the healthcare recipient who accompanies the healthcare recipient at the relevant time;(b) if the healthcare recipient is placed under the guardianship of the Director of Social Welfare or any other person under section 44A(1)(i) of that Ordinance, the Director of Social Welfare or that other person;(c) if the guardianship of the healthcare recipient is vested in the Director of Social Welfare under section 44B(2A) or 59T(1) of that Ordinance, the Director of Social Welfare;(d) if the functions of guardian of the healthcare recipient are to be performed by the Director of Social Welfare or any other person under section 44B(2B) or 59T(2) of that Ordinance, the Director of Social Welfare or that other person;(e) a person appointed by the court to manage the affairs of the healthcare recipient who accompanies the healthcare recipient at the relevant time;(f) in the absence of the persons mentioned in paragraphs (a), (b), (c), (d) and (e), a family member of the healthcare recipient, or a person residing with the healthcare recipient, who accompanies the healthcare recipient at the relevant time;(g) in the absence of the persons mentioned in paragraphs (a), (b), (c), (d), (e) and (f), the prescribed healthcare provider that provides, or is about to provide, healthcare to the healthcare recipient at the relevant time.(5) In this section—relevant time (有關時間) means—(a) in relation to an application that is made under section 6(1) for the healthcare recipient to be registered as a registered healthcare recipient, the time at which the application is made;(b) in relation to a joining consent that is required under section 7(1) or (2) for such an application, the time at which the joining consent is required;(c) in relation to a healthcare recipient’s registration that is withdrawn from the eHealth System by the operation of section 9, the time at which the request for withdrawal is made; (Amended 36 of 2025 s. 6)(d) in relation to a sharing consent that is given under section 12(1), the time at which the sharing consent is given;(e) (Repealed 36 of 2025 s. 6)(f) in relation to a sharing consent that is revoked under section 15(1), the time at which the revocation of the sharing consent is made;#(g) in relation to a sharing restriction request that is made under section 17(1)(a), the time at which the request is made;#(h) in relation to a request to remove a restriction that is made under section 17(1)(b), the time at which the request is made.____________________Editorial Note:# Not yet in operation 4. Ordinance applies to Government This Ordinance applies to the Government. Part 2 Electronic Health System (Amended 36 of 2025 s. 8) Division 1 eHealth System (Amended 36 of 2025 s. 9) 5. eHealth System (Amended 36 of 2025 s. 10)(1) On and after 1 December 2025, the information infrastructure established and maintained under the former section 5(1) and known as “Electronic Health Record Sharing System” in English and “電子健康紀錄互通系統” in Chinese immediately before that date is to be known as—(a) “Electronic Health System” in English; and(b) “電子健康系統” in Chinese. (Replaced 36 of 2025 s. 10)(1A) The Commissioner must maintain the eHealth System for—(a) keeping the records required by subsection (2);(b) sharing and using the data and information contained in those records; and(c) providing support in connection with or facilitating—(i) the provision of healthcare to registered healthcare recipients; and(ii) health management by registered healthcare recipients. (Added 36 of 2025 s. 10)(2) The eHealth System must keep a record of every registered healthcare recipient containing the following— (Amended 36 of 2025 s. 10)(a) the index data of the recipient;(b) the health data of the recipient provided to the Commissioner in the form and manner specified by the Commissioner;(c) any other data or information of the recipient that is, in the Commissioner’s opinion, necessary for the proper functioning of the eHealth System. (Amended 36 of 2025 s. 10)(3) In subsection (1)—former section 5(1) (原有第5(1)條) means section 5(1) as in force immediately before 1 December 2025. (Added 36 of 2025 s. 10) Division 2 Registration of Healthcare Recipients 6. Application by healthcare recipients for registration (1) Subject to subsections (2) and (3), a healthcare recipient to which this section applies, or a substitute decision maker of a healthcare recipient, may apply to the Commissioner for the healthcare recipient to be registered as a registered healthcare recipient.(2) If the healthcare recipient is a minor, the application must be made by a substitute decision maker of the healthcare recipient unless the Commissioner is satisfied that the recipient is capable of giving a joining consent.(3) If the healthcare recipient is aged 16 or above and is incapable of giving a joining consent, the application must be made by a substitute decision maker of the healthcare recipient.(4) An application made by a substitute decision maker of a healthcare recipient is made on behalf of and in the name of the recipient.(5) In making an application, a substitute decision maker of a healthcare recipient must have regard to the best interests of the recipient in the circumstances.(6) An application—(a) must be made in the form and manner specified by the Commissioner;(b) must be accompanied by the information specified by the Commissioner; and(c) must be accompanied by a joining consent.(7) This section applies to a healthcare recipient—(a) who holds an identity card; or(b) who does not hold an identity card but holds—(i) a certificate of registration of birth issued under the Births and Deaths Registration Ordinance (Cap. 174);(ii) a proof of identity as defined by section 17B(1) (other than an identity card) of the Immigration Ordinance (Cap. 115);(iii) a certificate of exemption as defined by section 17G(1) of the Immigration Ordinance (Cap. 115); or(iv) any other identification document specified by the Commissioner. 7. Giving of joining consent (1) For an application made by a healthcare recipient under section 6(1), the recipient must give a consent specified in subsection (3).(2) For an application made by a substitute decision maker of a healthcare recipient under section 6(1), the substitute decision maker must give a consent specified in subsection (3) on behalf of and in the name of the recipient.(3) The consent is to, after the registration of the healthcare recipient, allow—(a) the Commissioner—(i) to obtain from a relevant healthcare provider any sharable data of the recipient;(ii) to obtain from a specified healthcare provider any specified health data of the recipient;(iii) to provide to a relevant healthcare provider to which the recipient has given a sharing consent any sharable data of the recipient; and(iv) if a prescribed healthcare provider has made a healthcare referral to another prescribed healthcare provider—to provide to that other prescribed healthcare provider any sharable data of the recipient relevant to the healthcare referral;(b) the Commissioner—(i) to obtain from a recognized non-Hong Kong public health record system any sharable data of the recipient; and(ii) to provide to a recognized non-Hong Kong public health record system in relation to which the recipient has given a sharing consent any sharable data of the recipient;(c) a relevant healthcare provider to provide to the eHealth System any sharable data of the recipient in the form and manner specified by the Commissioner; and(d) any sharable data of the recipient to be provided to the eHealth System from a recognized non-Hong Kong public health record system in the form and manner specified by the Commissioner. (Replaced 36 of 2025 s. 11)(4) A joining consent must be given in the form and manner specified by the Commissioner.(5) A joining consent is revoked if—(a) the healthcare recipient’s registration is withdrawn from the eHealth System by the operation of section 9; or (Amended 36 of 2025 s. 11)(b) the healthcare recipient’s registration is cancelled under section 11(1). 8. Registration of healthcare recipients by Commissioner (1) On receiving an application made under section 6(1), the Commissioner, if satisfied that, on the face of it, the application complies with section 6(6), may—(a) register the healthcare recipient as a registered healthcare recipient; and(b) impose the conditions that the Commissioner considers appropriate for registering the healthcare recipient.(2) However, the Commissioner must not register the healthcare recipient if the Commissioner is satisfied that doing so may impair the security or compromise the integrity of the eHealth System. (Amended 36 of 2025 s. 12)(3) After approving or refusing an application, the Commissioner must notify the healthcare recipient in writing of the decision and—(a) if the application is approved—the date on which the registration takes effect and the conditions for the registration; or(b) if the application is refused—the reasons for the refusal. 9. Withdrawal of healthcare recipient’s registration (1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered healthcare recipient, may request that the registration of the recipient be withdrawn from the eHealth System. (Amended 36 of 2025 s. 13)(2) If the healthcare recipient is a minor, the request must be made by a substitute decision maker of the healthcare recipient unless the Commissioner is satisfied that the recipient is capable of making the request.(3) If the healthcare recipient is aged 16 or above and is incapable of giving a joining consent, the request must be made by a substitute decision maker of the healthcare recipient.(4) A request made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in the name of the recipient.(5) In making a request, a substitute decision maker of a registered healthcare recipient must have regard to the best interests of the recipient in the circumstances.(6) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(7) After granting a request, the Commissioner must notify the requestor in writing of the date on which the request is granted. The withdrawal takes effect on that date. 10. Suspension of healthcare recipient’s registration (1) The Commissioner may suspend the registration of a healthcare recipient for a period of not more than 28 days if the Commissioner reasonably suspects that—(a) the application for registration did not comply with section 6(6);(b) the healthcare recipient holds none of the documents specified in section 6(7);(c) the healthcare recipient contravenes—(i) a provision of this Ordinance; (Amended 36 of 2025 s. 14)(ia) a provision of a code of practice issued under section 52; or (Added 36 of 2025 s. 14)(ii) a condition for the registration; or(d) the registration may impair the security or compromise the integrity of the eHealth System. (Amended 36 of 2025 s. 14)(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period of suspension under that subsection for a further period of not more than 28 days by notice in writing to the specified person.(3) After suspending the registration, the Commissioner must notify the specified person in writing of—(a) the suspension;(b) the date on which the suspension takes effect; and(c) the reasons for the suspension.(4) If the registration of a healthcare recipient is suspended— (Amended 36 of 2025 s. 14)(a) new data or information of the recipient may still be provided by a relevant healthcare provider or a specified healthcare provider, or be provided from a recognized non-Hong Kong public health record system, to the eHealth System during the period of suspension; but (Amended 36 of 2025 s. 14)(b) the Commissioner is to take appropriate measures to restrict access to the eHealth System so that, during the period of suspension, the electronic health record of the recipient—(i) is not to be made available to a relevant healthcare provider through the eHealth System; and(ii) is not to be provided to a recognized non-Hong Kong public health record system through the eHealth System. (Replaced 36 of 2025 s. 14)(5) After the Commissioner is satisfied that there are no longer any grounds for suspending the healthcare recipient’s registration, the Commissioner must notify the specified person in writing of—(a) the Commissioner’s decision; and(b) the date on which the suspension ceases to take effect.(6) In this section—specified person (指明人士) means—(a) if the healthcare recipient is a minor and the application for the healthcare recipient’s registration was made by a substitute decision maker, that substitute decision maker; (b) if the healthcare recipient is aged 16 or above and is, in the Commissioner’s opinion, incapable of giving a joining consent and the application for the healthcare recipient’s registration was made by a substitute decision maker, that substitute decision maker; or(c) in any other case—(i) the healthcare recipient; or(ii) the substitute decision maker of the healthcare recipient who made the application for the healthcare recipient’s registration. 11. Cancellation of healthcare recipient’s registration (1) The Commissioner may cancel the registration of a healthcare recipient if the Commissioner is satisfied that—(a) the application for registration did not comply with section 6(6);(b) the healthcare recipient holds none of the documents specified in section 6(7);(c) the healthcare recipient contravenes—(i) a provision of this Ordinance; (Amended 36 of 2025 s. 15)(ia) a provision of a code of practice issued under section 52; or (Added 36 of 2025 s. 15)(ii) a condition for the registration;(d) the registration may impair the security or compromise the integrity of the eHealth System; or (Amended 36 of 2025 s. 15)(e) the healthcare recipient has died.(2) Except for a cancellation under subsection (1)(e), the Commissioner must notify the specified person in writing of—(a) the date on which the cancellation is to take effect; and(b) the reasons for the cancellation.(3) The specified person may, within 14 days after the date of the notice (or such longer period as the Commissioner may allow), make representations to the Commissioner to object to the cancellation in the manner specified in the notice.(4) The Commissioner must not cancel the registration unless—(a) the specified person has not made any representations under subsection (3); or(b) the Commissioner has considered the representations and informed the specified person of the decision of cancellation.(4A) The Commissioner is to take appropriate measures to restrict access to the eHealth System so that, during the period after the notice under subsection (2) is given and before the date on which the cancellation takes effect—(a) no new data or information of the healthcare recipient may be provided by a relevant healthcare provider or a specified healthcare provider, or be provided from a recognized non-Hong Kong public health record system, to the eHealth System; and(b) the electronic health record of the healthcare recipient—(i) is not to be made available to a relevant healthcare provider through the eHealth System; and(ii) is not to be provided to a recognized non-Hong Kong public health record system through the eHealth System. (Added 36 of 2025 s. 15)(5) A cancellation under subsection (1)(e) takes effect on the date on which the Commissioner is satisfied that the healthcare recipient has died.(6) In this section—specified person (指明人士) means—(a) if the healthcare recipient is a minor and the application for the healthcare recipient’s registration was made by a substitute decision maker, that substitute decision maker;(b) if the healthcare recipient is aged 16 or above and is, in the Commissioner’s opinion, incapable of giving a joining consent and the application for the healthcare recipient’s registration was made by a substitute decision maker, that substitute decision maker; or(c) in any other case—(i) the healthcare recipient; or(ii) the substitute decision maker of the healthcare recipient who made the application for the healthcare recipient’s registration. Division 3 Sharing Consent 12. Giving of sharing consent (1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered healthcare recipient, may give either or both of the following consents— (Amended 36 of 2025 s. 16)(a) a consent specified in subsection (6) to a relevant healthcare provider that provides healthcare to the healthcare recipient;(b) a consent specified in subsection (6A) in relation to a recognized non-Hong Kong public health record system. (Amended 36 of 2025 s. 16)(2) If the healthcare recipient is a minor, the sharing consent must be given by a substitute decision maker of the healthcare recipient unless the Commissioner is satisfied that the recipient is capable of giving the sharing consent.(3) If the healthcare recipient is aged 16 or above and is incapable of giving a sharing consent, the sharing consent must be given by a substitute decision maker of the healthcare recipient.(4) A sharing consent given by a substitute decision maker of a registered healthcare recipient is given on behalf of and in the name of the recipient.(5) In giving a sharing consent, a substitute decision maker of a registered healthcare recipient must have regard to the best interests of the recipient in the circumstances.(6) For the purposes of subsection (1)(a), the consent is to allow—(a) the relevant healthcare provider—(i) to obtain from the eHealth System any sharable data of the healthcare recipient in the form and manner specified by the Commissioner; and(ii) if the relevant healthcare provider is a prescribed healthcare provider—to provide to a referral healthcare provider any sharable data of the healthcare recipient relevant to the healthcare referral and in the form and manner specified by the Commissioner; and(b) a referral healthcare provider to obtain from the eHealth System any sharable data of the healthcare recipient relevant to the healthcare referral and in the form and manner specified by the Commissioner. (Replaced 36 of 2025 s. 16)(6A) For the purposes of subsection (1)(b), the consent is to allow any sharable data of the healthcare recipient kept in the eHealth System to be provided to the recognized non-Hong Kong public health record system in the form and manner specified by the Commissioner. (Added 36 of 2025 s. 16)(7) A sharing consent must be given in the form and manner specified by the Commissioner.(8) (Repealed 36 of 2025 s. 16)(9) In this section—referral healthcare provider (獲轉介醫護提供者) means a prescribed healthcare provider to which a healthcare referral of the healthcare recipient is made by the prescribed healthcare provider to which the consent is given. 13. Term of sharing consent A sharing consent is in effect until—(a) the healthcare recipient’s registration is withdrawn from the eHealth System by the operation of section 9;(b) the healthcare recipient’s registration is cancelled under section 11(1); or(c) the consent is revoked under section 15(1).(Replaced 36 of 2025 s. 17) 14. (Repealed 36 of 2025 s. 18) 15. Revocation of sharing consent (1) Subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered healthcare recipient, may revoke a sharing consent given to a relevant healthcare provider or in relation to a recognized non-Hong Kong public health record system. (Amended 36 of 2025 s. 19)(2) If the healthcare recipient is a minor, the revocation must be made by a substitute decision maker of the healthcare recipient unless the Commissioner is satisfied that the recipient is capable of making the revocation.(3) If the healthcare recipient is aged 16 or above and is incapable of giving a sharing consent, the revocation must be made by a substitute decision maker of the healthcare recipient.(4) A revocation made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in the name of the recipient.(5) In making a revocation, a substitute decision maker of a registered healthcare recipient must have regard to the best interests of the recipient in the circumstances.(6) A revocation must be made in the form and manner specified by the Commissioner.(7) After the revocation is recorded in the eHealth System, the Commissioner must notify the person making the revocation in writing of the date on which the record is made. The revocation takes effect on that date. (Amended 36 of 2025 s. 19) 16. Sharing consent taken to be given (1) A healthcare recipient is taken to have given a sharing consent to each specified entity when the healthcare recipient gives a joining consent.(2) A substitute decision maker of a healthcare recipient is taken to have given a sharing consent on behalf of and in the name of the recipient to each specified entity when the substitute decision maker gives a joining consent.(3) A sharing consent taken to be given because of a joining consent is in effect as long as the joining consent is in effect.(4) Sections 12(7), 13 and 15 do not apply to a sharing consent taken to be given under this section.(5) In this section—specified entity (指明實體) means—(a) the Department of Health;(b) the Hospital Authority;(c) the Primary Healthcare Commission; or(d) a healthcare facility managed or controlled by—(i) the Government;(ii) the Hospital Authority; or(iii) an HA subsidiary. (Added 36 of 2025 s. 20)(Amended 36 of 2025 s. 20) Division 4 Sharing Restriction (Not yet in operation) 17. Request for sharing restriction (Not yet in operation)(1) Despite anything contained in sections 12 and 16 and subject to subsections (2) and (3), a registered healthcare recipient, or a substitute decision maker of a registered healthcare recipient, may in relation to the health data of the healthcare recipient make—(a) a request to restrict the scope of data sharing; or(b) a request to remove a restriction on the scope of data sharing.(2) If the healthcare recipient is a minor, the request must be made by a substitute decision maker of the healthcare recipient unless the Commissioner is satisfied that the recipient is capable of making the request.(3) If the healthcare recipient is aged 16 or above and is incapable of making the request, the request must be made by a substitute decision maker of the healthcare recipient.(4) A request made by a substitute decision maker of a registered healthcare recipient is made on behalf of and in the name of the recipient.(5) In making a request, a substitute decision maker of a registered healthcare recipient must have regard to the best interests of the recipient in the circumstances.(6) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(7) The Commissioner must notify the requestor in writing of the date on which the requested restriction, or the requested removal of restriction, takes effect. 18. Commissioner to specify sharing restriction (Not yet in operation)(1) The Commissioner must specify the types of restriction in respect of which a person may make a request under section 17(1).(2) The Commissioner must make copies of a document setting out the specified types of restriction available to the public (in hard copy or electronic form). Division 5 Registration as Healthcare Providers for eHealth System (Amended 36 of 2025 s. 21) 19. Application by healthcare providers for registration (1) A healthcare provider that provides healthcare at one service location in Hong Kong may apply to the Commissioner to be registered as a healthcare provider for the eHealth System for that location. (Amended 36 of 2025 s. 22)(2) A healthcare provider that provides healthcare at more than one service location in Hong Kong may apply to the Commissioner to be registered as a healthcare provider for the eHealth System for those locations as provided in subsection (3). (Amended 36 of 2025 s. 22)(3) For the purposes of subsection (2), a healthcare provider may apply for—(a) a single registration for all of the locations; or(b) a separate registration for each location that the healthcare provider chooses to register.(4) An application—(a) must be made in the form and manner specified by the Commissioner; and(b) must be accompanied by the information specified by the Commissioner.(5) For the purposes of this section, a healthcare provider provides healthcare at one service location if the healthcare provider—(a) is licensed under the Private Healthcare Facilities Ordinance (Cap. 633) in respect of one private healthcare facility; (Replaced 34 of 2018 s. 196 and E.R. 5 of 2018)(b) is registered under section 5(2) of the Medical Clinics Ordinance (Cap. 343) in respect of one clinic;(c) carries on the business of dentistry under section 12 of the Dentists Registration Ordinance (Cap. 156) at one premises;(d) holds a licence issued under section 8(2)(a) of the Residential Care Homes (Elderly Persons) Ordinance (Cap. 459) in respect of one residential care home, and engages a Hong Kong healthcare professional to perform healthcare at that home; (Amended 12 of 2023 s. 117; 36 of 2025 s. 22)(e) holds a licence issued under section 7(2)(a), or a certificate of exemption issued under section 11(2)(a), of the Residential Care Homes (Persons with Disabilities) Ordinance (Cap. 613) in respect of one residential care home for persons with disabilities, and engages a Hong Kong healthcare professional to perform healthcare at that home; or (Amended 36 of 2025 s. 22)(f) is a specified entity that engages a Hong Kong healthcare professional to perform healthcare at one premises. (Amended 36 of 2025 s. 22)(6) In subsection (5)—specified entity (指明實體) means—(a) an individual;(b) a company;(c) a partnership;(d) a statutory body;(e) a body corporate other than a company; or(f) a society, or a branch of a society, registered under section 5A(1), or exempted from registration under section 5A(2), of the Societies Ordinance (Cap. 151). 20. Registration of healthcare providers by Commissioner (1) On receiving an application made under section 19(1) or (2), the Commissioner, if satisfied that the healthcare provider complies with the requirements set out in subsection (2), may—(a) register the healthcare provider as a healthcare provider for the eHealth System for the service location for which the application is made; and(b) impose the conditions that the Commissioner considers appropriate for registering the healthcare provider.(2) The requirements are—(a) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; and(b) the system requirements on data sharing specified by the Commissioner.(3) However, the Commissioner must not register the healthcare provider if the Commissioner is satisfied that—(a) the service or business nature of the healthcare provider is not consistent with the purpose of the use of data and information specified in section 28; or(b) registering the healthcare provider may impair the security or compromise the integrity of the eHealth System.(4) After approving or refusing an application, the Commissioner must notify the healthcare provider in writing of the decision and—(a) if the application is approved—the date on which the registration takes effect and the conditions for the registration; or(b) if the application is refused—the reasons for the refusal.(Amended 36 of 2025 s. 23) 21. Amendment of registration (1) Subject to subsection (2), a healthcare provider registered under section 20(1) may request a registration be amended for—(a) a change in the particulars of a service location; and(b) a change of the service locations for which the healthcare provider is registered.(2) A healthcare provider must not request the registration be amended for a change of the service locations unless the healthcare provider would, after the change, still be registered for all of the service locations at which the healthcare provider provides healthcare in Hong Kong.(3) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(4) After granting a request, the Commissioner must notify the requestor in writing of the date on which the request is granted. The amendment takes effect on that date. 22. Registration of Government departments as healthcare providers (1) The Commissioner may register a Government department as a healthcare provider for the eHealth System if the Commissioner is satisfied that the department provides a Hong Kong healthcare professional to perform healthcare for any healthcare recipient. (Amended 36 of 2025 s. 24)(2) The reference of a department in subsection (1) does not include the Department of Health. 23. Withdrawal of healthcare provider’s registration (1) A registered healthcare provider may request that a registration of the healthcare provider be withdrawn from the eHealth System. (Amended 36 of 2025 s. 25)(2) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(3) After granting a request, the Commissioner must notify the healthcare provider in writing of the date on which the request is granted. The withdrawal takes effect on that date.(4) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the withdrawal takes effect. 24. Suspension of healthcare provider’s registration (1) The Commissioner may suspend a registration of a registered healthcare provider for a period of not more than 28 days if the Commissioner reasonably suspects that—(a) the healthcare provider contravenes—(i) a provision of this Ordinance;(ii) a provision of a code of practice issued under section 52; or(iii) a condition for the registration;(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;(c) the healthcare provider no longer complies with—(i) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; or (Amended 36 of 2025 s. 26)(ii) the system requirements on data sharing specified by the Commissioner;(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or(e) the registration may impair the security or compromise the integrity of the eHealth System. (Amended 36 of 2025 s. 26)(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period of suspension under that subsection for a further period of not more than 28 days by notice in writing to the healthcare provider.(3) After suspending a registration, the Commissioner must notify the healthcare provider in writing of—(a) the suspension;(b) the date on which the suspension takes effect; and(c) the reasons for the suspension.(4) If the registration of a healthcare provider (including a Government department) is suspended— (Amended 36 of 2025 s. 26)(a) subject to subsection (4A), new data or information of a registered healthcare recipient may still be provided by the healthcare provider to the eHealth System during the period of suspension; but (Replaced 36 of 2025 s. 26)(b) the Commissioner is to take appropriate measures to restrict access to the eHealth System so that the electronic health record of a registered healthcare recipient is not to be made available to the healthcare provider through the eHealth System during the period of suspension. (Replaced 36 of 2025 s. 26)(4A) If the registration of a healthcare provider (including a Government department) is suspended under subsection (1)(e), the Commissioner is to take appropriate measures to restrict access to the eHealth System so that no new data or information of a registered healthcare recipient may be provided by the healthcare provider to the eHealth System during the period of suspension. (Added 36 of 2025 s. 26)(5) After the Commissioner is satisfied that there are no longer any grounds for suspending the healthcare provider’s registration, the Commissioner must notify the healthcare provider in writing of—(a) the Commissioner’s decision; and(b) the date on which the suspension ceases to take effect. 25. Cancellation of healthcare provider’s registration (1) The Commissioner may cancel a registration of a registered healthcare provider if the Commissioner is satisfied that—(a) the healthcare provider contravenes—(i) a provision of this Ordinance;(ii) a provision of a code of practice issued under section 52; or(iii) a condition for the registration;(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;(c) the healthcare provider no longer complies with—(i) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; or (Amended 36 of 2025 s. 27)(ii) the system requirements on data sharing specified by the Commissioner;(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or(e) the registration may impair the security or compromise the integrity of the eHealth System. (Amended 36 of 2025 s. 27)(2) The Commissioner must notify the healthcare provider in writing of—(a) the date on which the cancellation is to take effect; and(b) the reasons for the cancellation.(3) The healthcare provider may, within 14 days after the date of the notice (or such longer period as the Commissioner may allow), make representations to the Commissioner to object to the cancellation in the manner specified in the notice.(4) The Commissioner must not cancel the registration unless—(a) the healthcare provider has not made any representations under subsection (3); or(b) the Commissioner has considered the representations and informed the healthcare provider of the decision of cancellation.(4A) The Commissioner is to take appropriate measures to restrict access to the eHealth System so that, during the period after the notice under subsection (2) is given and before the date on which the cancellation takes effect—(a) no new data or information of a registered healthcare recipient may be provided by the healthcare provider to the eHealth System; and(b) the electronic health record of a registered healthcare recipient is not to be made available to the healthcare provider through the eHealth System. (Added 36 of 2025 s. 27)(5) If a sharing consent is given to the healthcare provider, the sharing consent ceases to have effect once the cancellation takes effect. 26.

Supplementary provision to sections 24, 25 and 51 A reference in sections 24, 25 and 51 to the service location to which a registration relates includes each of the service locations covered by a single registration of a healthcare provider under section 19(3)(a). Division 6 Recognition of Non-Hong Kong Healthcare Providers (Division 6 added 36 of 2025 s. 28) 26A. Recognition of non-Hong Kong healthcare providers (1) The Commissioner may, if satisfied that a non-Hong Kong healthcare provider complies with the requirements set out in subsection (2)—(a) recognize the healthcare provider as a healthcare provider for the eHealth System; and(b) impose the conditions that the Commissioner considers appropriate for recognizing the healthcare provider.(2) The requirements are—(a) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; and(b) the system requirements on data sharing specified by the Commissioner.(3) However, the Commissioner must not recognize the healthcare provider if the Commissioner is satisfied that—(a) (where the healthcare provider provides healthcare in a place outside Hong Kong) the healthcare provider is not licensed or otherwise permitted to provide healthcare in that place under the law of that place; or(b) recognizing the healthcare provider may impair the security or compromise the integrity of the eHealth System.(4) After deciding to recognize a non-Hong Kong healthcare provider, the Commissioner must notify the healthcare provider in writing of—(a) the decision;(b) the date on which the recognition takes effect; and(c) the conditions for the recognition. 26B. Withdrawal of non-Hong Kong healthcare provider’s recognition (1) A recognized non-Hong Kong healthcare provider may request that the recognition of the healthcare provider be withdrawn.(2) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(3) After granting a request, the Commissioner must notify the healthcare provider in writing of the date on which the request is granted and the withdrawal takes effect on that date.(4) A sharing consent (if any) given to the healthcare provider ceases to have effect once the withdrawal takes effect. 26C. Suspension of non-Hong Kong healthcare provider’s recognition (1) The Commissioner may suspend the recognition of a non-Hong Kong healthcare provider for a period of not more than 28 days if the Commissioner reasonably suspects that—(a) the healthcare provider contravenes a condition for the recognition;(b) the healthcare provider no longer complies with—(i) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; or(ii) the system requirements on data sharing specified by the Commissioner;(c) the healthcare provider is no longer licensed or otherwise permitted to provide healthcare in the place outside Hong Kong to which the recognition relates under the law of that place; or(d) the recognition may impair the security or compromise the integrity of the eHealth System.(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period of suspension under that subsection for a further period of not more than 28 days by notice in writing to the healthcare provider.(3) After suspending the recognition of a non-Hong Kong healthcare provider, the Commissioner must notify the healthcare provider in writing of—(a) the suspension;(b) the date on which the suspension takes effect; and(c) the reasons for the suspension.(4) If the recognition of a non-Hong Kong healthcare provider is suspended—(a) subject to subsection (5), new data or information of a registered healthcare recipient may still be provided by the healthcare provider to the eHealth System during the period of suspension; but(b) the Commissioner is to take appropriate measures to restrict access to the eHealth System so that the electronic health record of a registered healthcare recipient is not to be made available to the healthcare provider through the eHealth System during the period of suspension.(5) If the recognition of a non-Hong Kong healthcare provider is suspended under subsection (1)(d), the Commissioner is to take appropriate measures to restrict access to the eHealth System so that no new data or information of a registered healthcare recipient may be provided by the healthcare provider to the eHealth System during the period of suspension.(6) After the Commissioner is satisfied that there are no longer any grounds for suspending the recognition of the healthcare provider, the Commissioner must notify the healthcare provider in writing of—(a) the Commissioner’s decision; and(b) the date on which the suspension ceases to take effect. 26D. Revocation of non-Hong Kong healthcare provider’s recognition (1) The Commissioner may revoke the recognition of a non-Hong Kong healthcare provider if the Commissioner is satisfied that—(a) the healthcare provider contravenes a condition for the recognition;(b) the healthcare provider no longer complies with—(i) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; or(ii) the system requirements on data sharing specified by the Commissioner;(c) the healthcare provider is no longer licensed or otherwise permitted to provide healthcare in the place outside Hong Kong to which the recognition relates under the law of that place; or(d) the recognition may impair the security or compromise the integrity of the eHealth System.(2) The Commissioner must notify the healthcare provider in writing of—(a) the date on which the revocation is to take effect; and(b) the reasons for the revocation.(3) The healthcare provider may, within 14 days after the date of the notice (or such longer period as the Commissioner may allow), make representations to the Commissioner to object to the revocation in the manner specified in the notice.(4) The Commissioner must not revoke the recognition unless—(a) the healthcare provider has not made any representations under subsection (3); or(b) the Commissioner has considered the representations and informed the healthcare provider of the decision of revocation.(5) The Commissioner is to take appropriate measures to restrict access to the eHealth System so that, during the period after the notice under subsection (2) is given and before the date on which the revocation takes effect—(a) no new data or information of a registered healthcare recipient may be provided by the healthcare provider to the eHealth System; and(b) the electronic health record of a registered healthcare recipient is not to be made available to the healthcare provider through the eHealth System.(6) A sharing consent (if any) given to the healthcare provider ceases to have effect once the revocation takes effect. Division 7 Recognition of Non-Hong Kong Information Infrastructures (Division 7 added 36 of 2025 s. 28) 26E. Recognition of non-Hong Kong information infrastructures (1) The Commissioner may, if satisfied that a non-Hong Kong information infrastructure complies with the requirements set out in subsection (2)—(a) recognize the information infrastructure for connection to the eHealth System; and(b) impose on the operator of the information infrastructure the conditions that the Commissioner considers appropriate for recognizing the information infrastructure.(2) The requirements are—(a) the requirements specified by the Commissioner for connecting the information infrastructure to the eHealth System; and(b) the system requirements on data sharing specified by the Commissioner.(3) However, the Commissioner must not recognize the information infrastructure if the Commissioner is satisfied that—(a) the information infrastructure does not meet any of the following descriptions—(i) the information infrastructure is operated by the government or an authority of a place outside Hong Kong or a person authorized by that government or authority for that purpose;(ii) the information infrastructure is being used or to be used to keep—(A) the personal particulars of healthcare recipients who receive healthcare in that place; and(B) the health data of the healthcare recipients;(iii) the information infrastructure enables the data and information kept in it to be used and shared for facilitating the provision of healthcare to the healthcare recipients; or(b) recognizing the information infrastructure may impair the security or compromise the integrity of the eHealth System.(4) After deciding to recognize the information infrastructure, the Commissioner must notify the operator of the information infrastructure in writing of—(a) the decision;(b) the date on which the recognition takes effect; and(c) the conditions for the recognition. 26F. Withdrawal of recognition of non-Hong Kong information infrastructure (1) The operator of a non-Hong Kong information infrastructure recognized under section 26E(1) may request that the recognition of the information infrastructure be withdrawn.(2) A request must be made to the Commissioner in the form and manner specified by the Commissioner.(3) After granting a request, the Commissioner must notify the operator of the information infrastructure in writing of the date on which the request is granted and the withdrawal takes effect on that date.(4) A sharing consent (if any) given in relation to the information infrastructure ceases to have effect once the withdrawal takes effect. 26G. Suspension of recognition of non-Hong Kong information infrastructure (1) The Commissioner may suspend the recognition of a non-Hong Kong information infrastructure for a period of not more than 28 days if the Commissioner reasonably suspects that—(a) the operator of the information infrastructure contravenes a condition for the recognition;(b) the information infrastructure no longer complies with—(i) the requirements specified by the Commissioner for connecting the information infrastructure to the eHealth System; or(ii) the system requirements on data sharing specified by the Commissioner;(c) the information infrastructure no longer meets one or more of the descriptions set out in section 26E(3)(a); or(d) the recognition may impair the security or compromise the integrity of the eHealth System.(2) Despite subsection (1), if the Commissioner considers it appropriate, the Commissioner may extend the period of suspension under that subsection for a further period of not more than 28 days by notice in writing to the operator of the information infrastructure.(3) After suspending the recognition of a non-Hong Kong information infrastructure, the Commissioner must notify the operator of the information infrastructure in writing of—(a) the suspension;(b) the date on which the suspension takes effect; and(c) the reasons for the suspension.(4) If the recognition of a non-Hong Kong information infrastructure is suspended—(a) subject to subsection (5), new data or information of a registered healthcare recipient may still be provided from the information infrastructure to the eHealth System during the period of suspension; but(b) the Commissioner is to take appropriate measures to restrict access to the eHealth System so that the electronic health record of a registered healthcare recipient is not to be provided to the information infrastructure through the eHealth System during the period of suspension.(5) If the recognition of a non-Hong Kong information infrastructure is suspended under subsection (1)(d), the Commissioner is to take appropriate measures to restrict access to the eHealth System so that no new data or information of a registered healthcare recipient may be provided from the information infrastructure to the eHealth System during the period of suspension.(6) After the Commissioner is satisfied that there are no longer any grounds for suspending the recognition of the information infrastructure, the Commissioner must notify the operator of that information infrastructure in writing of—(a) the Commissioner’s decision; and(b) the date on which the suspension ceases to take effect. 26H. Revocation of recognition of non-Hong Kong information infrastructure (1) The Commissioner may revoke the recognition of a non-Hong Kong information infrastructure if the Commissioner is satisfied that—(a) the operator of the information infrastructure contravenes a condition for the recognition;(b) the information infrastructure no longer complies with—(i) the requirements specified by the Commissioner for connecting the information infrastructure to the eHealth System; or(ii) the system requirements on data sharing specified by the Commissioner;(c) the information infrastructure no longer meets one or more of the descriptions set out in section 26E(3)(a); or(d) the recognition may impair the security or compromise the integrity of the eHealth System.(2) The Commissioner must notify the operator of the information infrastructure in writing of—(a) the date on which the revocation is to take effect; and(b) the reasons for the revocation.(3) The operator of the information infrastructure may, within 14 days after the date of the notice (or such longer period as the Commissioner may allow), make representations to the Commissioner to object to the revocation in the manner specified in the notice.(4) The Commissioner must not revoke the recognition unless—(a) the operator of the information infrastructure has not made any representations under subsection (3); or(b) the Commissioner has considered the representations and informed the operator of the information infrastructure of the decision of revocation.(5) The Commissioner is to take appropriate measures to restrict access to the eHealth System so that, during the period after the notice under subsection (2) is given and before the date on which the revocation takes effect—(a) no new data or information of a registered healthcare recipient may be provided from the information infrastructure to the eHealth System; and(b) the electronic health record of a registered healthcare recipient is not to be provided to the information infrastructure through the eHealth System.(6) A sharing consent (if any) given in relation to the information infrastructure ceases to have effect once the revocation takes effect. Division 8 Medical Documents, and Signatures on Medical Documents, in Electronic Form, etc. (Division 8 added 36 of 2025 s. 28) 26I. Interpretation of Division 8 of Part 2 In this Division—electronic record (電子紀錄) has the meaning given by section 2(1) of the Electronic Transactions Ordinance (Cap. 553);issue (發出), in relation to a medical document, includes making or giving the document;medical document (醫療文件) means—(a) a document issued by a healthcare professional or healthcare provider that relates to the health condition of, or to the healthcare provided or to be provided to, a healthcare recipient; or(b) an advance medical directive. 26J. Requirement for writing is satisfied through eHealth System (1) If an Ordinance requires, or is regarded to have required, a medical document to be in writing (requirement for writing), the requirement for writing is also satisfied if the medical document is in the form of an electronic record that is issued or authenticated through the eHealth System.(2) However, if the effect of subsection (1) is such that any requirement (other than the requirement for writing) in that Ordinance, or a related Ordinance, cannot be complied with due to the operation of subsection (1), then subsection (1) does not apply to that Ordinance and that related Ordinance (if applicable) with respect to the requirement for writing.(3) For the purposes of subsection (1), an Ordinance is regarded to have required a medical document to be in writing if the Ordinance provides for the consequences for the medical document not being in writing. 26K. Requirement for signing is satisfied through eHealth System (1) If an Ordinance requires, or is regarded to have required, the signature of a person on a medical document (requirement for signing), the requirement for signing is also satisfied if the signature is an electronic signature of the person.(2) However, if the effect of subsection (1) is such that any requirement (other than the requirement for signing) in that Ordinance, or a related Ordinance, cannot be complied with due to the operation of subsection (1), then subsection (1) does not apply to that Ordinance and that related Ordinance (if applicable) with respect to the requirement for signing.(3) For the purposes of subsection (1), an Ordinance is regarded to have required the signature of a person on a medical document if the Ordinance provides for the consequences for not having such signature on the medical document.(4) In subsection (1)—electronic signature (電子簽署) means a signature—(a) that is an electronic signature as defined by section 2(1) of the Electronic Transactions Ordinance (Cap. 553); and(b) that is authenticated or approved by the eHealth System. 26L. Requirement for original form is satisfied through eHealth System (1) If an Ordinance requires, or is regarded to have required, a medical document to be presented in its original form (requirement for original form), the requirement for original form is also satisfied by presenting the medical document in the form of an electronic record that is issued or authenticated through the eHealth System for viewing from an electronic device.(2) However, if the effect of subsection (1) is such that any requirement (other than the requirement for original form) in that Ordinance, or a related Ordinance, cannot be complied with due to the operation of subsection (1), then subsection (1) does not apply to that Ordinance and that related Ordinance (if applicable) with respect to the requirement for original form.(3) For the purposes of subsection (1), an Ordinance is regarded to have required a medical document to be presented in its original form if the Ordinance provides for the consequences for the medical document not being so presented. 26M. Requirement for retention is satisfied through eHealth System (1) If an Ordinance requires, or is regarded to have required, a medical document to be retained in a form that is stipulated in the Ordinance (requirement for retention), the requirement for retention is also satisfied by retaining, in the eHealth System, the medical document in the form of an electronic record that is issued or authenticated through the eHealth System.(2) However, if the effect of subsection (1) is such that any requirement (other than the requirement for retention) in that Ordinance, or a related Ordinance, cannot be complied with due to the operation of subsection (1), then subsection (1) does not apply to that Ordinance and that related Ordinance (if applicable) with respect to the requirement for retention.(3) For the purposes of subsection (1), an Ordinance is regarded to have required a medical document to be retained in a form that is stipulated in the Ordinance if the Ordinance provides for the consequences for the medical document not being so retained. 26N. Sections 26J, 26K, 26L and 26M prevail over Electronic Transactions Ordinance to the extent of conflict or inconsistency If section 26J, 26K, 26L or 26M (Cap. 625 provision) is in conflict or is inconsistent with a provision of the Electronic Transactions Ordinance (Cap. 553) (Cap. 553 provision), the Cap. 625 provision prevails over the Cap. 553 provision to the extent of the conflict or inconsistency. 26O. Certain medical documents invalid if not issued through eHealth System (1) A medical document specified in Part 1 of Schedule 2 issued in the form of an electronic record is invalid unless it is issued through the eHealth System.(2) A medical document specified in Part 2 of Schedule 2 is invalid if it is—(a) not in the form of an electronic record; or(b) not issued through the eHealth System. Part 2A Provision of Specified Health Data to eHealth System by Specified Healthcare Providers (Part 2A added 36 of 2025 s. 29) 26P. Interpretation of Part 2A In this Part—former section 12 (原有第12條) means section 12 as in force immediately before 1 December 2025;relevant joining consent (相關參與同意) means a joining consent given by a registered healthcare recipient under section 7 as amended by section 11 of the 2025 Amendment Ordinance on or after 1 December 2025;relevant sharing consent (相關互通同意), in relation to a specified healthcare provider, means a sharing consent given to the healthcare provider by a registered healthcare recipient under the former section 12 before 1 December 2025. 26Q. Provision of specified health data to eHealth System by specified healthcare providers (1) This section applies if a healthcare provider described in column 4 of Schedule 3—(a) provides healthcare in Hong Kong; and(b) is in possession of the health data specified in subsection (3) of a registered healthcare recipient who—(i) has given a relevant sharing consent to the healthcare provider; or(ii) has given a relevant joining consent.(2) The specified healthcare provider must provide to the eHealth System, in the form and manner specified by the Commissioner and within the period specified in subsection (4), the health data referred to in subsection (1)(b), unless the healthcare recipient has given the healthcare provider a notice, in the form and manner specified by the Commissioner, stating that the healthcare recipient does not consent to the provision of the health data to the eHealth System.(3) For the purposes of subsection (1)(b), the health data is the data described in column 2 of Schedule 3 opposite to the description of the healthcare provider.(4) For the purposes of subsection (2), the period is, for any data described in column 2 of Schedule 3, the period specified in column 3 of that Schedule opposite to the data. 26R. Enforcement notice (1) If the Commissioner, after making such enquiry as the Commissioner considers necessary, is satisfied that a specified healthcare provider has contravened section 26Q(2), the Commissioner may give the healthcare provider a notice in writing, directing the healthcare provider to provide the specified health data stated in the notice by the date, and in the form and manner, stated in the notice.(2) An enforcement notice under subsection (1) must—(a) state that the Commissioner is satisfied that the specified healthcare provider has contravened section 26Q(2) and the reason for being so satisfied;(b) state—(i) the specified health data to which the contravention of section 26Q(2) relates; and(ii) the registered healthcare recipient to whom the health data relates;(c) state the date by which, and the form and manner in which, the health data must be provided; and(d) be accompanied by a copy of this section.(3) The date stated under subsection (2)(c) must be a date that is not earlier than the expiry of the period specified in section 56(3) within which an appeal against the notice may be made under section 56(1).(4) The Commissioner may cancel an enforcement notice by another notice in writing given to the specified healthcare provider. Part 2B Provision and Obtainment of Sharable Data by Registered Healthcare Recipients and Related Persons (Part 2B added 36 of 2025 s. 29) Division 1 Preliminary 26S. Interpretation of Part 2B (1) In this Part—related person (關連人士), in relation to a registered healthcare recipient, means—(a) a relevant person of the healthcare recipient; or(b) a person who is authorized by the healthcare recipient under section 26W(1);relevant person (有關人士) has the meaning given by section 2(1) of the Privacy Ordinance.(2) For the purposes of the definition of relevant person in subsection (1), a reference to a minor in the Privacy Ordinance is a reference to a person below 16 years of age. Division 2 Provision and Obtainment of Sharable Data 26T. Registered healthcare recipients and related persons may provide sharable data A registered healthcare recipient, or a related person of the healthcare recipient, may provide any sharable data of the healthcare recipient to the eHealth System in the form and manner specified by the Commissioner. 26U. Registered healthcare recipients and related persons may obtain sharable data A registered healthcare recipient, or a related person of the healthcare recipient, may obtain from the eHealth System any sharable data of the healthcare recipient in the form and manner specified by the Commissioner. Division 3 Authorization of Persons 26V. Application of Division 3 This Division applies to a registered healthcare recipient who is aged 16 or above and who is not—(a) mentally incapacitated as defined by section 2(1) of the Mental Health Ordinance (Cap. 136); or(b) incapable of managing his or her own affairs. 26W. Authorization of persons (1) A registered healthcare recipient may authorize a person for the purposes of this Part.(2) The authorization must be made in the form and manner specified by the Commissioner.(3) After the authorization is recorded in the eHealth System, the Commissioner must notify the registered healthcare recipient and the person authorized in writing of the date on which the record is made and the authorization takes effect on that date.(4) The authorization is in effect until—(a) the registration of the registered healthcare recipient is withdrawn from the eHealth System by the operation of section 9;(b) the registration of the registered healthcare recipient is cancelled under section 11(1); or(c) the authorization is revoked by the registered healthcare recipient under section 26X. 26X. Revocation of authorization (1) A registered healthcare recipient may revoke an authorization made by the healthcare recipient under section 26W(1).(2) The revocation must be made in the form and manner specified by the Commissioner.(3) After the revocation is recorded in the eHealth System, the Commissioner must notify the registered healthcare recipient and the person whose authorization is revoked in writing of the date on which the record is made and the revocation takes effect on that date. Part 3 Electronic Health Record Division 1 Use of Electronic Health Record 27. General rule The data and information contained in an electronic health record may not be used except as provided in section 28, 28A, 29, 30, 30A, 30B, 30C or 31.(Amended 36 of 2025 s. 30) 28. Use for improvement of healthcare The data and information contained in the electronic health record of a registered healthcare recipient may be used for improving the efficiency, quality, continuity or integration of the healthcare provided, or to be provided, to the healthcare recipient. 28A. Use in connection with advance medical directives (1) The data and information contained in the electronic health record of a registered healthcare recipient may be used—(a) for ascertaining whether the healthcare recipient has made an advance medical directive; or(b) if the healthcare recipient has made an advance medical directive—(i) for assessing whether an instruction in the directive is valid and applicable; or(ii) for following a valid and applicable instruction in the directive.(2) In this section—applicable (適用), in relation to an instruction in an advance medical directive, has the meaning given by section 17 of the Advance Decision on Life-sustaining Treatment Ordinance (Cap. 651);valid (有效), in relation to an instruction in an advance medical directive, has the meaning given by section 16 of the Advance Decision on Life-sustaining Treatment Ordinance (Cap. 651).(Added 36 of 2025 s. 31) 29. Use for research and statistics (Not yet in operation)(1) The data and information contained in an electronic health record may be used for carrying out research, or preparing statistics, that are relevant to public health or public safety.(2) However, the results of the research or the resulting statistics must not be made available in a form that would enable a healthcare recipient to be identified. 30. Use for disease control and surveillance etc. (1) The data and information contained in an electronic health record may be used by a person specified in subsection (2)—(a) for the prevention or control of disease; or(b) for the enhancement of disease surveillance or investigation.(2) The person is—(a) the Department of Health;(b) the Hospital Authority; or(c) a health officer as defined by section 2 of the Prevention and Control of Disease Ordinance (Cap. 599). 30A. Use for emergency situations etc. The data and information contained in an electronic health record may be used by a prescribed healthcare provider for or in connection with the carrying out of emergency rescue operations or the provision of emergency relief services.(Added 36 of 2025 s. 33) 30B. Use of identifiable data for Government-authorized health care programmes Identifiable data of a healthcare recipient contained in an electronic health record may be used by the Government, or a person authorized by the Commissioner under section 37A(a)(i)—(a) for enrollment of the healthcare recipient in any health care programme authorized by the Government in which the healthcare recipient has consented to participate;(b) for administration of such a programme; or(c) for evaluation of such a programme.(Added 36 of 2025 s. 33) 30C. Use of non-identifiable data for formulation of public policies Non-identifiable data of a healthcare recipient contained in an electronic health record may be used by the Government, or a person authorized by the Commissioner under section 37A(a)(ii), for the formulation of public policies.(Added 36 of 2025 s. 33) 31. Use permitted by or under any other law The data and information contained in an electronic health record may be used as permitted by, or under, any other law. Division 2 Procedures for Use of Identifiable Data under Section 29 (Not yet in operation) 32. Application to Secretary for use for research or statistics purpose (Not yet in operation)(1) A person may apply to the Secretary for using identifiable data of a healthcare recipient contained in an electronic health record for carrying out research, or preparing statistics, that are relevant to public health or public safety.(2) An application—(a) must be made in the form and manner specified by the Commissioner; and(b) must be accompanied by a proposal specified in subsection (3).(3) The proposal is a written proposal setting out—(a) the nature and objectives in respect of the research or statistics;(b) the public or scientific benefit of the research or statistics that the applicant anticipates; and(c) any other information relating to the research or statistics as specified by the Commissioner. 33. Recommendation by Board (Not yet in operation)(1) The Secretary may refer an application made under section 32(1) to the Board for a recommendation on whether the application should be approved or refused.(2) When making a recommendation, the Board must have regard to—(a) whether it is ethical to carry out the research or prepare the statistics;(b) whether the objectives in respect of the research or statistics are only achievable by using the identifiable data;(c) whether it is practicable to obtain the consent of the healthcare recipient concerned for the use;(d) whether, at the time the research is carried out or the statistics are prepared, adequate safeguards are in place to preserve the confidentiality of the identifiable data;(e) the weighing of—(i) the public interest in carrying out the research or preparing the statistics; and(ii) the public interest in protecting the privacy of the healthcare recipient concerned; and(f) the resource implication in providing the identifiable data.(3) If the Board recommends that the Secretary approves the application, the Board may also make recommendations on the conditions of the approval. 34. Decisions of Secretary (Not yet in operation)(1) After approving or refusing an application made under section 32(1), the Secretary must notify the applicant in writing of the decision and—(a) if the application is approved—the conditions of the approval; or(b) if the application is refused—the reasons for the refusal.(2) If the application is approved, the identifiable data is to be made available to the applicant in the form and manner specified by the Commissioner after the applicant has paid the administrative costs for processing the application. Division 3 Procedures for Use of Non-identifiable Data under Section 29 (Not yet in operation) 35. Application to Commissioner for use for research or statistics purpose (Not yet in operation)(1) A person may apply to the Commissioner for using non-identifiable data of a healthcare recipient contained in an electronic health record for carrying out research, or preparing statistics, that are relevant to public health or public safety.(2) An application—(a) must be made in the form and manner specified by the Commissioner; and(b) must be accompanied by a proposal specified in subsection (3).(3) The proposal is a written proposal setting out—(a) the nature and objectives in respect of the research or statistics;(b) the public or scientific benefit of the research or statistics that the applicant anticipates; and(c) any other information relating to the research or statistics as specified by the Commissioner. 36. Decisions of Commissioner (Not yet in operation)(1) Before approving or refusing an application made under section 35(1), the Commissioner must have regard to—(a) whether it is ethical to carry out the research or prepare the statistics; and(b) the resource implication in providing the non-identifiable data.(2) After approving or refusing an application made under section 35(1), the Commissioner must notify the applicant in writing of the decision and—(a) if the application is approved—the conditions of the approval; or(b) if the application is refused—the reasons for the refusal.(3) If the application is approved, the non-identifiable data is to be made available to the applicant in the form and manner specified by the Commissioner after the applicant has paid the administrative costs for processing the application. Division 4 Safeguards for Access to Electronic Health Record 37. Prescribed healthcare provider’s duties to restrict access to health data (1) This section applies if a prescribed healthcare provider is given a sharing consent by a registered healthcare recipient or a substitute decision maker of a registered healthcare recipient.(2) The healthcare provider must take reasonable steps to ensure that—(a) access to any health data of the healthcare recipient is restricted to a Hong Kong healthcare professional of the healthcare provider who may perform healthcare for the recipient; and(b) the access is restricted to the health data that may be relevant for performing healthcare for the recipient.(3) However, for complying with a data access request or data correction request under Part 5 of the Privacy Ordinance, the healthcare provider is not to be treated as contravening the requirements under subsection (2) even if access to the health data is granted to a person other than the Hong Kong healthcare professional.(Amended 36 of 2025 s. 36) Division 5 Miscellaneous (Division 5 added 36 of 2025 s. 37) 37A. Authorization of persons The Commissioner may—(a) authorize a person for the purposes of—(i) section 30B; or(ii) section 30C; and(b) impose conditions that the Commissioner considers appropriate. Part 4 Application to Data or Information that is Personal Data under Privacy Ordinance 38. Data or information to which this Part applies This Part applies to data or information that is personal data as defined by section 2(1) of the Privacy Ordinance. 39. Privacy Commissioner’s performance of functions or exercise of powers in relation to data or information (1) If the Privacy Commissioner performs a function or exercises a power under the Privacy Ordinance in relation to data or information contained in the eHealth System, the Privacy Commissioner must do so subject to the conditions specified in subsection (2). (Amended 36 of 2025 s. 38)(2) The conditions are—(a) a word or an expression used in this Part, and defined or otherwise explained in section 2 of the Privacy Ordinance, has the same meaning as in that section; and(b) despite paragraph (a), a reference to a minor in the Privacy Ordinance is a reference to a person below 16 years of age.(3) Subsection (2)(a) does not apply to the word “Commissioner”. 40. Commissioner’s further duty in certain circumstances (1) This section applies if—(a) a person is required to comply with section 23(1) of the Privacy Ordinance in relation to the data or information of a registered healthcare recipient that was provided to the eHealth System by the person as a prescribed healthcare provider; and (Amended 36 of 2025 s. 39)(b) the person—(i) is no longer a prescribed healthcare provider;(ii) no longer has the sharing consent of the healthcare recipient; or(iii) fails to respond to a data correction request in compliance with the Privacy Ordinance.(2) The Commissioner must make a note, whether annexed to the data correction requested or elsewhere, of the matters in respect of which the data is considered by the requestor to be inaccurate.(3) The note must be made in such a way that the data cannot be used by a person without the note being drawn to the attention of, and being made available for inspection by, the person. 41. Contravention of requirement under Privacy Ordinance For the purposes of the Privacy Ordinance, a contravention of a requirement under a provision of that Ordinance that has effect subject to this Part is to be regarded as a contravention of a requirement under that Ordinance. Part 5 Offences 41A. Offence relating to purporting or holding out to be eHealth System to mislead others (1) A person commits an offence if the person—(a) without the written consent of the Commissioner, establishes or maintains an information infrastructure that purports or holds itself out—(i) to be the eHealth System or any part of it; or(ii) to be in any way associated with the eHealth System; and(b) does so with intent to mislead any person into believing, or being reckless as to whether any person would be misled into believing, that the information infrastructure is—(i) the eHealth System or any part of it; or(ii) in any way associated with the eHealth System.(2) A person who commits an offence under subsection (1) is liable on summary conviction to a fine at level 6.(Added 36 of 2025 s. 40) 41B. Offence relating to use of title of Electronic Health System etc. to mislead others (1) A person commits an offence if the person—(a) establishes or maintains an information infrastructure that uses any of the titles specified in subsection (2); and(b) does so with intent to mislead any person into believing, or being reckless as to whether any person would be misled into believing, that the information infrastructure is—(i) the eHealth System or any part of it; or(ii) in any way associated with the eHealth System.(2) The titles are—(a) “Electronic Health System”;(b) “eHealth System”;(c) “eHealth”;(d) “電子健康系統”;(e) “醫健通系統”;(f) “醫健通”; and(g) a title in any language that closely resembles any of the titles set out in paragraph (a), (b), (c), (d), (e) or (f).(3) A person who commits an offence under subsection (1) is liable on summary conviction to a fine at level 6.(Added 36 of 2025 s. 40) 42. Offences relating to accessing, damaging or modifying data or information (1) A person commits an offence if the person knowingly causes a computer to perform a function so as to obtain unauthorized access to data or information contained in an electronic health record.(2) A person who commits an offence under subsection (1) is liable on summary conviction to a fine at level 6.(3) For the purposes of subsection (1), access by a person to data or information is unauthorized if—(a) the person is not entitled to control that access;(b) the person has not been authorized by another person who controls that access to obtain that access;(c) the person does not believe that the authorization has been given; and(d) the person does not believe that, even if the person had applied to the appropriate authority, the authorization would have been given.(4) A person commits an offence if the person, without lawful excuse, knowingly damages data or information contained in an electronic health record.(5) A person who commits an offence under subsection (4) is liable on summary conviction to imprisonment for 2 years.(6) A person commits an offence if—(a) the person knowingly—(i) causes access to data or information contained in an electronic health record;(ii) causes modification of data or information contained in an electronic health record; or(iii) causes impairment to the accessibility, reliability, security or processing of data or information contained in an electronic health record; and(b) the person causes the access, modification or impairment—(i) with intent to commit an offence;(ii) with a dishonest intent to deceive;(iii) with a view to dishonest gain for the person or for another; or(iv) with a dishonest intent to cause loss to another,whether on the same occasion as the person causes the access, modification or impairment or on any future occasion.(7) A person who commits an offence under subsection (6) is liable on conviction on indictment to imprisonment for 5 years.(8) For the purposes of subsection (6)(b)—(a) a reference to gain includes—(i) a gain in money or other property;(ii) a temporary gain or a permanent gain;(iii) a gain by keeping what one has; and(iv) a gain by getting what one has not; and(b) a reference to loss includes—(i) a loss in money or other property;(ii) a temporary loss or a permanent loss;(iii) a loss by not getting what one might get; and(iv) a loss by parting with what one has.(9) In this section—computer (電腦) means a device for storing, processing or retrieving data or information. 43. Offences relating to impairment to eHealth System (Amended 36 of 2025 s. 41)(1) A person commits an offence if the person knowingly impairs the operation of the eHealth System. (Amended 36 of 2025 s. 41)(2) A person who commits the offence is liable on conviction on indictment to imprisonment for 10 years. 44. Offences relating to data access requests and data correction requests (1) A person commits an offence if the person, with intent to evade a data access request or data correction request in relation to any data or information contained in an electronic health record—(a) alters, falsifies, conceals or destroys the data or information; or(b) directs another person to do anything mentioned in paragraph (a).(2) A person who commits the offence is liable on summary conviction to a fine at level 6. 45. Offences relating to untrue statements (1) A person commits an offence if the person knowingly makes an untrue statement to enable the person to give a joining consent or sharing consent.(2) A person who commits the offence is liable on summary conviction to a fine at level 6. 46. Offences relating to contravening conditions for research or statistics purpose (Not yet in operation)(1) A person commits an offence if the person knowingly contravenes a condition imposed under section 34(1)(a).(2) A person who commits the offence is liable on summary conviction to a fine at level 6. 47. Offences relating to direct marketing (1) A person commits an offence if the person uses another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.(2) A person who commits an offence under subsection (1) is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years.(3) A person commits an offence if, for gain, the person provides to others another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.(4) A person who commits an offence under subsection (3) is liable on conviction on indictment to a fine of $1,000,000 and to imprisonment for 5 years.(5) A person commits an offence if, not for gain, the person provides to others another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.(6) A person who commits an offence under subsection (5) is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years.(7) This section does not apply in relation to the use or provision of data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, by a person if, not for gain, the person uses or provides the data or information, or the copy, for a purpose specified in subsection (8).(8) The purpose is the offering, or the advertising of the availability, of—(a) social services run, subvented or subsidized by the Social Welfare Department;(b) health care services provided or administered by— (Amended 36 of 2025 s. 42)(i) the Department of Health;(ii) the Hospital Authority;(iii) the Primary Healthcare Commission; or(iv) a healthcare facility managed or controlled by—(A) the Government;(B) the Hospital Authority; or(C) an HA subsidiary; (Amended 36 of 2025 s. 42)(ba) health care services provided under any health care programme authorized by the Government; or (Added 36 of 2025 s. 42)(c) any other social or health care services that, if not provided, would be likely to cause serious harm to the physical or mental health of—(i) the individual to whom the services are intended to be provided; or(ii) any other individual.(9) In this section—direct marketing (直接促銷) has the meaning given by section 35A(1) of the Privacy Ordinance;health care services (醫護服務) has the same meaning as in sections 35B and 35I of the Privacy Ordinance. 47A. Offence relating to enforcement notice (1) A person commits an offence if the person does not comply with an enforcement notice given to the person.(2) A person who commits an offence under subsection (1) is, subject to section 47B, liable on summary conviction—(a) to a fine at level 5; and(b) if the offence continues after the conviction, to a further fine of $1,000 for every day during which the offence continues after the conviction.(3) It is a defence for a person charged with an offence under subsection (1) to establish that the person had exercised all due diligence to prevent the commission of the offence.(4) A person is taken to have established a matter that needs to be established for a defence under subsection (3) if—(a) there is sufficient evidence to raise an issue with respect to that matter; and(b) the contrary is not proved by the prosecution beyond reasonable doubt.(5) A prosecution for an offence under subsection (1) may not be started after 2 years after the date on which the offence was committed. Note— This replaces the time limit under section 26 of the Magistrates Ordinance (Cap. 227). (Added 36 of 2025 s. 43) 47B. Penalty notice to be given before proceedings taken for offence under section 47A(1) (1) Before any proceedings are taken against a person for an offence under section 47A(1), the Commissioner must give the person a penalty notice for payment of a fixed penalty described in section 2 of Schedule 4, offering the person an opportunity to discharge liability for the offence by complying with subsection (2)(a) and (b).(2) If the person—(a) has paid the fixed penalty in accordance with Schedule 4;

and(b) has provided to the eHealth System, in the form and manner stated in the enforcement notice to which the offence relates, the specified health data stated in the notice within 21 days after the date of the penalty notice,the person is not liable to be prosecuted or convicted for the offence.(3) Schedule 4 has effect in relation to a penalty notice.(4) However, if the person wishes to dispute liability for the offence, the person must give the Commissioner a notification in the form specified by the Commissioner within 21 days after the date of the penalty notice to indicate the wish.(5) Accordingly, Part 3 of Schedule 4 has no effect in relation to the person giving the notification as mentioned in subsection (4).(Added 36 of 2025 s. 43) 47C. Failure to provide specified health data after giving penalty notice (1) This section applies if—(a) a penalty notice has been given to a person for payment of the fixed penalty; and(b) within 21 days after the date of the penalty notice, the person—(i) has not given the Commissioner a notification mentioned in section 47B(4) to indicate the wish to dispute liability for the offence to which the penalty notice relates; and(ii) has not provided to the eHealth System, in the form and manner stated in the enforcement notice to which the penalty notice relates, the specified health data stated in the enforcement notice, regardless of whether the person has paid the fixed penalty (or any part of it) under the penalty notice.(2) Proceedings may be taken against the person for an offence under section 47A(1) on the expiry of 21 days after the date of the penalty notice.(3) Once proceedings have been taken under subsection (2), the penalty notice is taken to have been withdrawn.(Added 36 of 2025 s. 43) Part 6 Administrative and Miscellaneous Provisions Division 1 Administration 48. Appointment of Commissioner (1) The Secretary may appoint a public officer to be the Commissioner for the Electronic Health Record.(2) The appointment is to be notified in the Gazette. 49. Functions and powers of Commissioner (1) The Commissioner has the following functions—(a) to establish, operate, maintain and develop the eHealth System;(b) to regulate and supervise the sharing and using of data and information contained in the eHealth System;(c) to supervise the compliance with this Ordinance;(d) to promote the eHealth System to healthcare recipients, healthcare providers and the public;(e) to devise and promote, and encourage among healthcare providers, proper standards of conduct, and sound and prudent practices, in data sharing;(f) to advise the Secretary on matters relating to the eHealth System;#(g) to deal with applications for use of data and information contained in an electronic health record under section 29; and(h) to devise a mechanism for handling complaints relating to the operation of the eHealth System. (Amended 36 of 2025 s. 44)(2) The Commissioner may do anything necessary for, or incidental or conducive to, the performance of a function of the Commissioner.(2A) Without limiting subsection (2), the Commissioner may do any of the following—(a) request from a body of persons specified in Schedule 5 or a Government department information in respect of any healthcare provider that provides healthcare in Hong Kong or any Hong Kong healthcare professional for the operation of the eHealth System;(b) request from a prescribed healthcare provider information in respect of any Hong Kong healthcare professional engaged by the healthcare provider for the operation of the eHealth System;(c) take any action to safeguard the integrity and security of the eHealth System, including removing any data kept in the eHealth System that may impair the security or compromise the integrity of the eHealth System. (Added 36 of 2025 s. 44)(3) The Commissioner may appoint in writing a person to assist the Commissioner in performing a function and exercising a power.____________________Editorial Note:# Not yet in operation 50. Commissioner to keep registers (Amended 36 of 2025 s. 45)(1) The Commissioner must, for the purposes of this Ordinance, establish and maintain—(a) a register of prescribed healthcare providers;(b) a register of recognized non-Hong Kong healthcare providers; and(c) a register of recognized non-Hong Kong public health record systems. (Replaced 36 of 2025 s. 45)(2) A register referred to in subsection (1) may be kept in a form, and may contain information, that the Commissioner considers appropriate. (Amended 36 of 2025 s. 45)(3) The register referred to in subsection (1)(a) must be made available for a member of the public to ascertain— (Amended 36 of 2025 s. 45)(a) whether a healthcare provider is registered as a healthcare provider for the eHealth System under section 20(1); and (Amended 36 of 2025 s. 45)(b) the service location for which the healthcare provider is registered.(4) A register referred to in subsection (1) must be made available for public inspection free of charge— (Amended 36 of 2025 s. 45)(a) through the Internet; and(b) at the office of the Commissioner, or any other Government offices as the Commissioner may direct, during normal office hours. 51. Commissioner to require production of records or documents in certain circumstances (1) If it appears to the Commissioner that there are circumstances suggesting the happening of an event specified in subsection (2), the Commissioner may in writing require a prescribed healthcare provider to produce the record or document—(a) that is or may be relevant to the event; and(b) that is in the possession or under the control of the healthcare provider.(2) The event is that—(a) the healthcare provider contravenes—(i) a provision of this Ordinance;(ii) a provision of a code of practice issued under section 52; or(iii) a condition for the registration;(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;(c) the healthcare provider no longer complies with—(i) the requirements specified by the Commissioner for connecting the healthcare provider to the eHealth System; or (Amended 36 of 2025 s. 46)(ii) the system requirements on data sharing specified by the Commissioner;(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or(e) the registration may impair the security or compromise the integrity of the eHealth System. (Amended 36 of 2025 s. 46)(3) The requirement must specify the manner in which the record or document must be produced. 52. Commissioner to issue code of practice (1) The Commissioner may issue a code of practice—(a) indicating the manner in which the Commissioner proposes to perform a function or exercise a power; or(b) providing guidance on the operation of a provision of this Ordinance.(2) The Commissioner—(a) must publish the code of practice in a manner appropriate to bringing it to the notice of persons affected by it; and(b) must make copies of the code of practice available to the public (in hard copy or electronic form).(3) The Commissioner may amend or revoke the code of practice. Subsections (2) and (4) apply to an amendment or revocation of the code of practice in the same way as they apply to the code of practice.(4) A code of practice issued under this section is not subsidiary legislation. 53. Commissioner to specify forms (1) The Commissioner may specify the form of a document required for the purposes of this Ordinance.(2) The Commissioner may specify more than one form of the document, whether as alternatives or to provide for different circumstances.(3) A form specified under this section—(a) must be completed in accordance with the directions and instructions that are specified in the form; and(b) if the completed form is required to be provided to the Commissioner or any other person, must be so provided in the manner specified in the form. 53A. Commissioner to specify healthcare providers The Commissioner may, for the purposes of paragraph (b)(ii) of the definition of Hong Kong healthcare professional in section 2(1), specify a healthcare provider that participates in any health care programme authorized by the Government.(Added 36 of 2025 s. 47) Division 2 Electronic Health Record Research Board (Not yet in operation) 54. Establishment of Board (Not yet in operation)(1) A board is established with the name “Electronic Health Record Research Board” in English and “電子健康紀錄研究委員會” in Chinese.(2) The Board is to consist of the following members—(a) the Permanent Secretary for Health, as ex officio member and chairman; (Amended L.N. 144 of 2022)(b) the Commissioner, or a person nominated by the Commissioner as representative, as ex officio member; and(c) not more than 10 other members appointed by the Secretary.(3) A person may be appointed as a non-ex officio member only if the person is, in the Secretary’s opinion, a person—(a) having expertise or experience in healthcare, privacy protection, statistics, research, law or information technology;(b) representing the interests of healthcare recipients; or(c) having other experience that would render the person suitable for the appointment.(4) A non-ex officio member may hold office for a term of not exceeding 5 years and on the terms specified in his or her letter of appointment by the Secretary.(5) A non-ex officio member is eligible for reappointment on the expiry of a term.(6) A non-ex officio member may resign from the Board by notice in writing to the Secretary.(7) The Secretary may terminate the office of a non-ex officio member if satisfied that—(a) the member has ceased to be of the capacity because of which he or she was appointed; or(b) the member is otherwise unable or unfit to perform the functions of a member of the Board.(8) Every appointment or termination under this section is to be notified in the Gazette.(9) Except as provided in this Ordinance, the Board may regulate its procedure and may make standing orders for that purpose.(10) In this section—non-ex officio member (非當然委員) means a member of the Board appointed under subsection (2)(c). 55. Function of Board (Not yet in operation)The function of the Board is to make recommendations to the Secretary—(a) for deciding whether to approve or refuse an application made under section 32(1); and(b) for imposing conditions on approving an application made under that section. Division 3 Miscellaneous Provisions 56. Right of appeal—against decisions of Commissioner (1) A person who is aggrieved by any of the Commissioner’s decisions set out in subsection (2) may appeal to the Administrative Appeals Board.(2) The decisions are—(a) to refuse to register a healthcare recipient under section 8(1);(b) to suspend the registration of a healthcare recipient under section 10(1);(c) to cancel the registration of a healthcare recipient under section 11(1);(d) to refuse to register a healthcare provider as a healthcare provider for the eHealth System under section 20(1); (Amended 36 of 2025 s. 48)(e) to suspend a registration of a registered healthcare provider under section 24(1); (Amended 36 of 2025 s. 48)(f) to cancel a registration of a registered healthcare provider under section 25(1); and (Amended 36 of 2025 s. 48)(g) to give an enforcement notice. (Added 36 of 2025 s. 48)(3) An appeal may only be made within 28 days after the aggrieved person receiving notice of the decision.(4) An appeal does not suspend the decision unless the Commissioner decides otherwise. 57. Access to card face data of healthcare recipient (1) This section applies if the Commissioner or a relevant healthcare provider gains access to the card face data of the identity card of a healthcare recipient by using facilities provided by or with the approval of the Government.(2) The Commissioner or the relevant healthcare provider is to be regarded as having lawful authority to gain access to the card face data of the identity card of the healthcare recipient for the purposes of regulation 12(1A) of the Registration of Persons Regulations (Cap. 177 sub. leg. A).(3) In this section—card face data (證面數據), in relation to the identity card of a healthcare recipient, means the following data stored in the chip embodied in the identity card— (Amended 36 of 2025 s. 49)(a) the data of the healthcare recipient specified in paragraph 1(a), (c), (d), (e) and (f) of Schedule 1 to the Registration of Persons Regulations (Cap. 177 sub. leg. A); and(b) the sex of the healthcare recipient. (Amended 36 of 2025 s. 49)(Amended 36 of 2025 s. 49) 58. Limitation of public liability The Government or a public officer does not incur any civil liability only because—(a) data or information contained in an electronic health record is used in accordance with this Ordinance; (b) the participation of a healthcare recipient or healthcare provider in the eHealth System is subject to the approval by a public officer; or (Amended 36 of 2025 s. 50)#(c) the use of data and information contained in an electronic health record referred to in section 29 is subject to the approval of the Secretary or the Commissioner.____________________Editorial Note:# Not yet in operation 59. Protection of public officers etc. (1) A person to whom this section applies is not civilly liable for an act done or omitted to be done by the person in good faith—(a) in performing a function or purportedly performing a function under this Ordinance; or(b) in exercising a power or purportedly exercising a power under this Ordinance.(2) Subsection (1) does not affect the liability of the Government for the act or omission.(3) This section applies to—(a) a public officer; and(b) an employee of the Hospital Authority, or an employee of an HA subsidiary, appointed by the Commissioner under section 49(3). (Amended 36 of 2025 s. 51) 60. Service of notice etc. A notice or document required to be given or sent under this Ordinance is, in the absence of evidence to the contrary, given or sent if—(a) for an individual—(i) it is addressed to and delivered personally to the individual;(ii) it is sent to the individual by post addressed to the individual at the individual’s last known address in Hong Kong or elsewhere;(iii) it is sent to the individual by an electronic mail transmission addressed to the individual at the individual’s last known electronic mail address; or(iv) it is sent to the individual by a text message addressed to the individual at the individual’s last known telephone number;(b) for a company—(i) it is addressed to the company and delivered to an officer of the company by hand;(ii) it is addressed to the company and left at or sent by post to the registered office of the company in Hong Kong or elsewhere;(iii) it is sent to the company by post addressed to the company at the company’s last known address in Hong Kong or elsewhere; or(iv) it is sent to the company by an electronic mail transmission addressed to the company at the company’s last known electronic mail address; (Added 36 of 2025 s. 52)(c) for a partnership—(i) it is addressed to the partnership and delivered to a place in Hong Kong or elsewhere at which the partnership carries on business, and given to a person apparently concerned in the management of, or apparently employed by, the partnership by hand;(ii) it is sent to the partnership by post addressed to the partnership at the partnership’s last known address in Hong Kong or elsewhere; or(iii) it is sent to the partnership by an electronic mail transmission addressed to the partnership at the partnership’s last known electronic mail address; or (Added 36 of 2025 s. 52)(d) for a statutory body, a body corporate other than a company, or an unincorporated body of persons other than a partnership—(i) it is addressed to the body and delivered to a place in Hong Kong or elsewhere at which the body carries on business, and given to a person apparently concerned in the management of, or apparently employed by, the body by hand;(ii) it is sent to the body by post addressed to the body at the body’s last known address in Hong Kong or elsewhere; or(iii) it is sent to the body by an electronic mail transmission addressed to the body at the body’s last known electronic mail address. (Added 36 of 2025 s. 52)(Amended 36 of 2025 s. 52) 60A. Transitional provisions for 2025 Amendment Ordinance The transitional provisions specified in Schedule 6 have effect.(Added 36 of 2025 s. 53) 61. Amendment of Schedules (1) The Secretary may by notice published in the Gazette amend Schedule 1, 2, 3 or 4.(2) The Commissioner may by notice published in the Gazette amend Schedule 5.(Replaced 36 of 2025 s. 54) Part 7 (Omitted as spent—E.R. 1 of 2016) 62. (Omitted as spent—E.R. 1 of 2016) 63. (Omitted as spent—E.R. 1 of 2016) Schedule 1 [ss. 2 & 61]Hong Kong Healthcare Professionals (Renumbered 36 of 2025 s. 55)(Amended 36 of 2025 s. 55) Part 1 Interpretation (Part 1 added 36 of 2025 s. 55) 1. In this Schedule—accredited register (認可名冊) means a register maintained—(a) under The Accredited Registers Scheme for Healthcare Professions (Scheme) established by the Government; and(b) by a healthcare professional body that is accredited under the Scheme. Part 2 Persons Specified for Purposes of Paragraph (a) of Definition of Hong Kong healthcare professional in Section 2(1) (Added 36 of 2025 s. 55) 1. A registered pharmacist within the meaning of the Pharmacy and Poisons Ordinance (Cap. 138). 2. A registered dentist within the meaning of the Dentists Registration Ordinance (Cap. 156). 3. An enrolled dental hygienist within the meaning of the Ancillary Dental Workers (Dental Hygienists) Regulations (Cap. 156 sub. leg. B). 4. A registered medical practitioner within the meaning of the Medical Registration Ordinance (Cap. 161). 5. A registered midwife within the meaning of the Midwives Registration Ordinance (Cap. 162). 6. A registered nurse or enrolled nurse within the meaning of the Nurses Registration Ordinance (Cap. 164). 7. A registered medical laboratory technologist within the meaning of the Medical Laboratory Technologists (Registration and Disciplinary Procedure) Regulations (Cap. 359 sub. leg. A). 8. A registered occupational therapist within the meaning of the Occupational Therapists (Registration and Disciplinary Procedure) Regulations (Cap. 359 sub. leg. B). 9. A registered optometrist within the meaning of the Optometrists (Registration and Disciplinary Procedure) Regulation (Cap. 359 sub. leg. F). (Amended 33 of 2025 s. 209) 10. A registered radiographer within the meaning of the Radiographers (Registration and Disciplinary Procedure) Regulation (Cap. 359 sub. leg. H). 11. A registered physiotherapist within the meaning of the Physiotherapists (Registration and Disciplinary Procedure) Regulation (Cap. 359 sub. leg. J). 12. A registered chiropractor within the meaning of the Chiropractors Registration Ordinance (Cap. 428). 13. A listed or registered Chinese medicine practitioner within the meaning of the Chinese Medicine Ordinance (Cap. 549). 14. A person whose name is listed on an accredited register. (Added 36 of 2025 s. 55) Part 3 Persons Specified for Purposes of Paragraph (b) of Definition of Hong Kong healthcare professional in Section 2(1) (Part 3 added 36 of 2025 s. 55) 1. An audiology technician. 2. A chiropodist or podiatrist. 3. A dental surgery assistant. 4. A dental technician or dental technologist. 5. A dental therapist. 6. A dispenser. 7. A mould laboratory technician. 8. An orthotist or prosthetist. 9. An orthoptist. 10. A scientific officer (medical). 11. A bioinformatician. 12. A genetic counsellor. 13. A Chinese medicine pharmacy practitioner. 14. A Chinese medicine pharmacy dispenser or technician. 15. A medical social worker. 16. A speech therapist. 17. An audiologist. 18. A dietitian. 19. An educational psychologist. 20. A clinical psychologist. Schedule 2 [ss. 26O & 61]Medical Documents Specified for Purposes of Section 26O (Schedule 2 added 36 of 2025 s. 56) Part 1 Medical Documents Specified for Purposes of Section 26O(1) Part 2 Medical Documents Specified for Purposes of Section 26O(2) Schedule 3 [ss. 26Q & 61]Provision of Specified Health Data to eHealth System (Schedule 3 added 36 of 2025 s. 56) Column 1 Column 2 Column 3 Column 4 Item Health Data Period for Provision of Health Data Healthcare Provider Schedule 4 [ss. 2, 47B & 61]Penalty Notice (Schedule 4 added 36 of 2025 s. 56) Part 1 Interpretation 1. Interpretation In this Schedule—fixed penalty (定額罰款) means the fixed penalty under section 2(a) of this Schedule;recovery order (追討令) means an order made under section 4(2) of this Schedule. Part 2 Penalty Notice 2. Penalty notice A penalty notice must be in writing and must state—(a) that the person who has been given the penalty notice is required to pay a fixed penalty of $1,500 within 21 days after the date of the penalty notice;(b) if the person wishes to dispute liability for the offence under section 47A(1)—that the person must give the Commissioner a notification in the form specified by the Commissioner within 21 days after the date of the penalty notice to indicate the wish;(c) that the person is required to provide to the eHealth System, in the form and manner stated in the enforcement notice given to the person, the specified health data stated in the enforcement notice;(d) that if, within 21 days after the date of the penalty notice, the person—(i) has not given the Commissioner a notification mentioned in paragraph (b) to indicate the wish to dispute liability for the offence to which the penalty notice relates; and(ii) has not provided to the eHealth System, in the form and manner stated in the enforcement notice to which the penalty notice relates, the specified health data stated in the enforcement notice, regardless of whether the person has paid the fixed penalty (or any part of it) under the penalty notice,proceedings may be taken against the person for the offence under section 47A(1), and the person may be liable to the fines mentioned in section 47A(2); and(e) any other related matters, including payment instructions for payment of the fixed penalty. 3. Withdrawal of penalty notice (1) The Commissioner may withdraw a penalty notice given for an offence under section 47A(1)—(a) at any time before a recovery order is made; or(b) (if applicable) at any time before any proceedings for the offence commence.(2) If a penalty notice is withdrawn—(a) the Commissioner must give notice of the withdrawal on the person on whom the penalty notice has been given; and(b) on the person’s application, the Commissioner must refund, through the Director of Accounting Services, any amount paid by the person for the fixed penalty. Part 3 Recovery of Fixed Penalty 4. Recovery of fixed penalty (1) This section applies if a person on whom a penalty notice has been given—(a) fails to pay the fixed penalty in accordance with the penalty notice; and(b) (if applicable) fails to notify the Commissioner in accordance with the penalty notice that the person wishes to dispute liability for the offence.(2) On application made in the name of the Secretary for Justice and on production of a certificate under section 5 of this Schedule, a magistrate must order the person to pay, within 14 days after the date of service of notice of the order—(a) the fixed penalty;(b) an additional penalty equal to the amount of the fixed penalty; and(c) $300 by way of cost.(3) A magistrate must cause notice of a recovery order to be served on the person against whom it is made and it may be served by sending it by post to the person’s last known address.(4) An application may be made in the absence of the person and the Secretary for Justice may appoint another person to make an application. 5. Evidentiary certificate (1) A certificate in the form specified by the Commissioner stating the matters in subsection (2) and purporting to be signed by or for the Commissioner is admissible in evidence in any proceedings under this Schedule.(2) The matters are—(a) that the person specified in the certificate had not, before the date of the certificate, paid the fixed penalty; and(b) that the person specified in the certificate had not, before the date of the certificate, notified the Commissioner that the person wished to dispute liability for the offence.(3) Unless there is evidence to the contrary—(a) it is presumed that the certificate was signed by or for the Commissioner; and(b) the certificate is evidence of the facts stated in it. 6. Consequences of compliance with recovery order or failure to do so (1) This section applies to a person against whom a recovery order is made.(2) The person is not liable to be prosecuted or convicted for the offence to which the order relates if the person has complied with the recovery order and has provided to the eHealth System, in the form and manner stated in the enforcement notice concerned, the specified health data stated in the notice.(3) If the person fails to comply with the recovery order, the person—(a) is to be regarded, for the purposes of section 68 of the Magistrates Ordinance (Cap. 227), as having failed to pay the sum adjudged to be paid by a conviction; and(b) is liable to be imprisoned under that section. 7. Application for review of recovery order (1) A person against whom a recovery order is made may apply to a magistrate for review of the order.(2) An application must be made within 14 days after the date on which the recovery order first came to the notice of the applicant.(3) The applicant must give reasonable notice of the application to the Commissioner.(4) An application may be made in person or by counsel or solicitor.(5) For securing the attendance of witnesses and generally for conducting the proceedings, the magistrate has all the powers of a magistrate hearing a complaint under the Magistrates Ordinance (Cap. 227). 8. Outcome of review (1) On application under section 7 of this Schedule, a magistrate may rescind a recovery order if satisfied that the penalty notice did not come to the notice of the applicant without any fault of the applicant.(2) If the magistrate rescinds a recovery order, and the applicant wishes to dispute liability for the offence to which the order relates, the magistrate must give leave to that effect.(3) If the magistrate rescinds a recovery order, and the applicant does not wish to dispute liability for the offence to which the order relates, the magistrate must order that—(a) the applicant must pay the fixed penalty within 10 days after the date of an order made under this paragraph; and(b) (if the applicant fails to pay the fixed penalty within that period) the applicant must immediately pay—(i) the fixed penalty;(ii) an additional penalty equal to the amount of the fixed penalty; and(iii) $300 by way of costs.(4) Despite section 26 of the Magistrates Ordinance (Cap. 227), if a magistrate gives leave under subsection (2), proceedings may be commenced within 2 years after the date on which the magistrate gives the leave.(5) If the applicant fails to comply with the order under subsection (3)(b), the applicant—(a) is to be regarded, for the purposes of section 68 of the Magistrates Ordinance (Cap. 227), as having failed to pay the sum adjudged to be paid by a conviction; and(b) is liable to be imprisoned under that section. Part 4 Proceedings if Liability is Disputed 9. Dispute of liability for offence (1) This section applies if—(a) a person has given the Commissioner a notification mentioned in section 2(b) of this Schedule to indicate the wish to dispute liability for an offence under section 47A(1); or(b) a person has been given leave under section 8(2) of this Schedule to dispute liability for such an offence.(2) A summons in any proceedings against the person for the offence may be served on the person in accordance with section 8 of the Magistrates Ordinance (Cap. 227).(3) If—(a) the person appears in any proceedings in answer to a summons served under subsection (2); and(b) the person is convicted of the offence after having offered no defence or a defence that is frivolous or vexatious,the magistrate before whom the proceedings are heard must, in addition to the fixed penalty under the penalty notice and any other penalty and costs, impose an additional penalty equal to the amount of the fixed penalty.(4) Any proceedings commenced against a person falling within subsection (1)(a) must terminate if the person—(a) pays in accordance with subsection (5)—(i) the fixed penalty;(ii) an additional penalty equal to the amount of the fixed penalty; and(iii) $500 by way of costs; and(b) provides to the eHealth System, in the form and manner stated in the enforcement notice to which the offence relates, the specified health data stated in the notice before the day specified in the summons for the person’s appearance.(5) Payment under subsection (4)(a) must be made at any magistrates’ court not less than 2 days before the day specified in the summons for the person’s appearance, and the summons must be produced at the time of the payment.(6) Neither a Saturday nor a public holiday may be included in the computation of the 2 days’ period mentioned in subsection (5). Part 5 General Provisions for Proceedings 10. Power to rescind order on application by Commissioner At any time, a magistrate may for good cause, on application by the Commissioner, rescind—(a) an order for the payment of the fixed penalty; and(b) any other order made under this Schedule in the same proceedings. Schedule 5 [ss. 49 & 61]Bodies of Persons Specified for Purposes of Section 49(2A)(a) (Schedule 5 added 36 of 2025 s. 56) 1. Medical Council of Hong Kong 2. Dental Council of Hong Kong 3. Nursing Council of Hong Kong 4. Midwives Council of Hong Kong 5. Allied Health Professions Council (Replaced L.N. 218 of 2025) 6. Chiropractors Council 7. Pharmacy and Poisons Board 8. The Chinese Medicine Council of Hong Kong 9. A healthcare professional body that is accredited under The Accredited Registers Scheme for Healthcare Professions established by the Government Schedule 6 [s. 60A]Transitional Provisions for 2025 Amendment Ordinance (Schedule 6 added 36 of 2025 s. 56) 1. Transitional arrangement relating to joining consent (1) Subject to subsection (2), if a joining consent is given before 1 December 2025, the former section 7(3) continues to apply to the consent on or after that date as if the former section 7(3) had not been amended by the 2025 Amendment Ordinance.(2) If a registered healthcare recipient has given a joining consent before 1 December 2025 and also gives a sharing consent on or after that date, the joining consent is to be treated as a consent specified in section 7(3) from the date on which the sharing consent is given.(3) In subsection (1)—former section 7(3) (原有第7(3)條) means section 7(3) as in force immediately before 1 December 2025. 2. Transitional arrangement relating to sharing consent (1) If a sharing consent is given before 1 December 2025, the former relevant provisions continue to apply in relation to the consent on or after that date as if the former relevant provisions had not been amended by the 2025 Amendment Ordinance.(2) In subsection (1)—former relevant provisions (原有相關條文) means section 3 and Division 3 of Part 2 as in force immediately before 1 December 2025.