Privacy Policy

This Privacy Notice explains how the National Health Security Office collects, uses, discloses and protects the personal data of beneficiaries, contracted health service units and the general public, in line with the Personal Data Protection Act B.E. 2562 (2019).

National Health Security Office

Privacy Notice for Universal Coverage Beneficiaries, Contracted Health Service Units and Networks of Health Service Units under the Universal Coverage Scheme, and the General Public

The National Health Security Office ("NHSO") has prepared and published this Privacy Notice to explain how it collects, uses or discloses the personal data of Universal Coverage beneficiaries, contracted health service units and networks of health service units under the Universal Coverage Scheme, and the directors, representatives, authorized persons or personnel acting on behalf of such units and networks, as well as members of the general public. This Notice also sets out the measures NHSO takes to protect personal data and the manner in which such data is appropriately managed, in accordance with the Personal Data Protection Act B.E. 2562 (2019).

NHSO will review this Privacy Notice and may amend it from time to time as appropriate, to ensure that the personal data of data subjects remains adequately protected. Should this Privacy Notice be materially amended, NHSO will inform data subjects by publishing the revised Notice through appropriate channels.

1. Definitions

"Personal Data" means any information relating to a natural person which enables the identification of such person, whether directly or indirectly, but does not include the information of deceased persons in particular.

"Sensitive Personal Data" means personal data as prescribed in Section 26 of the Personal Data Protection Act B.E. 2562 (2019), namely data pertaining to racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which may affect the data subject in a similar manner as prescribed by the Personal Data Protection Committee.

"Network of Health Service Units" means health service units that have joined together and registered as a network of health service units under the National Health Security Act B.E. 2545 (2002).

"Data Subject" means a natural person who is the owner of the personal data collected, used or disclosed by NHSO.

"Public Health Services" means medical and public health services provided directly to individuals for health promotion, disease prevention, diagnosis, medical treatment and rehabilitation as necessary for health and living, including Thai traditional medicine and alternative medicine services under the law governing the practice of the healing arts.

"Health Facility" means a public health facility of the State, the private sector or the Thai Red Cross Society, a service unit for the practice of the healing arts in various branches, and any other public health facility as additionally prescribed by the National Health Security Board.

"Health Service Unit" means a health facility that has been registered under the National Health Security Act B.E. 2545 (2002).

2. Purposes of the Collection, Use or Disclosure of Personal Data

2.1 Legal Bases for the Collection, Use or Disclosure of Personal Data

NHSO will process personal data only to the extent necessary and within the scope of this Privacy Notice in the following cases.

2.1.1 General Personal Data

Where NHSO has obtained the consent of the data subject, in cases where the law requires consent to be obtained;
To prevent or suppress a danger to the life, body or health of a person;
Where it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
Where it is necessary for the performance of a task carried out in the public interest by NHSO, or for the exercise of official authority vested in NHSO;
Where it is necessary for the legitimate interests of NHSO or of any other person or juristic person, except where such interests are overridden by the fundamental rights of the data subject in respect of his or her personal data;
Where it is necessary for NHSO's compliance with the law.

2.1.2 Sensitive Personal Data

In the course of its operations, NHSO may need to collect sensitive personal data of data subjects. In such cases, NHSO will always obtain the explicit consent of the data subject beforehand, except where an exemption from the explicit consent requirement applies under the Personal Data Protection Act B.E. 2562 (2019), for example:

To prevent or suppress a danger to the life, body or health of a person, where the data subject is incapable of giving consent for whatever reason;
Where the data has been disclosed to the public with the explicit consent of the data subject;
Where it is necessary for the establishment, compliance with, exercise or defense of legal claims;
Where it is necessary for compliance with the law to achieve purposes relating to national health security, preventive or occupational medicine, the provision of health or social care services, health management, social welfare systems and services, public interest in public health, substantial public interest, and other purposes as specified under the Personal Data Protection Act B.E. 2562 (2019).

2.2 Purposes of Collection for the Use or Disclosure of Personal Data

NHSO collects the personal data of data subjects for various purposes, depending on the nature of the relationship between the data subject and NHSO, as follows.

2.2.1 Purposes relating to Universal Coverage Beneficiaries

To enable individuals to exercise their entitlement to public health services under the National Health Security Act B.E. 2545 (2002), including registration of Universal Coverage entitlement, arrangements for individuals to have a primary health service unit, requests to change the primary health service unit, and any other related actions under the National Health Security Act B.E. 2545 (2002) and other relevant laws.
To maintain registers of service recipients, health service units and networks of health service units for the provision of public health services, and to carry out actions necessary for NHSO's role as the central agency administering the national register of medical benefit entitlements under its powers and duties pursuant to the National Health Security Act B.E. 2545 (2002) and other relevant laws, including verifying and administering service recipients' entitlements to public health services and other rights, coordinating with relevant parties, and carrying out related internal administration within NHSO.
To operate and administer the Universal Coverage Scheme so that the public receives standardized, efficient and comprehensive public health services, including at the local or area level.
To provide and publicize information on the Universal Coverage Scheme, public health services, health service units and networks of health service units, as well as NHSO's missions, through various channels, both online and offline.
To examine documentary evidence supporting claims for public health service expenses submitted by health service units, as well as documentary evidence of work delivered or performance reports for projects funded by NHSO and carried out by other organizations or persons to whom NHSO has delegated activities within its powers and duties.
To establish and develop the Birth Registry system linking health service units under the Universal Coverage Scheme with the registration offices of the Ministry of Interior.
To consider applications and conduct assessments for the registration of health service units, and to prepare contracts or agreements for the provision of public health services, as well as agreements or juristic acts for projects to which NHSO has delegated activities within its powers and duties.
To use NHSO's information technology systems for Universal Coverage operations.
To supervise, audit, evaluate, inspect and control the quality and standards of public health services.

2.2.2 Purposes relating to Health Service Units and Networks of Health Service Units under the Universal Coverage Scheme

To register health service units and networks of health service units under the Universal Coverage Scheme pursuant to NHSO's powers and duties under the National Health Security Act B.E. 2545 (2002) and other relevant laws, including the submission of registration applications, examination of documents and qualifications, approval of registration, collection of baseline data, self-assessment by health service units, establishment and upgrading of service capacity levels, supervision, quality and standards control, coordination, the receipt and dispatch of documents, and related internal administration within NHSO.
To enter into juristic acts and contracts with NHSO relating to national health security, to perform such juristic acts and contracts, to monitor and review performance and operations, to evaluate projects, and to develop NHSO's various projects, as well as related internal administration within NHSO.
To supervise health service units and networks of health service units in providing public health services in accordance with the standards prescribed by the National Health Security Board, and to facilitate the submission of complaints; this includes auditing, evaluating, inspecting and controlling the quality of their service delivery; supporting and promoting the provision of public health services to the public; arranging for the public to have a primary health service unit and processing changes of primary health service unit for service recipients; ensuring comprehensive public access to public health services under Universal Coverage entitlement; paying compensation for public health services to health service units; and verifying the accuracy of reimbursement claims according to service recipients' medical benefit entitlements, pursuant to NHSO's powers and duties under the National Health Security Act B.E. 2545 (2002) and other relevant laws. This further includes creating user accounts for health service units or networks of health service units, establishing public health service information systems, controlling access to data in NHSO systems, coordination, organizing and attending meetings on matters relating to public health services, and related internal administration within NHSO.
To carry out other missions of NHSO within its powers and duties under the National Health Security Act B.E. 2545 (2002), including producing, publishing and publicizing educational media and information to enhance public knowledge and understanding of the Universal Coverage Scheme, public health services, health service units and networks of health service units, and NHSO's missions.

2.2.3 Other Purposes

To collect and analyze data relating to the operation of public health services within NHSO's powers and duties under the National Health Security Act B.E. 2545 (2002) and other relevant laws.
To carry out other missions of NHSO within its powers and duties under the National Health Security Act B.E. 2545 (2002), including entering into juristic acts and contracts with NHSO relating to national health security, performing such juristic acts and contracts, monitoring and reviewing performance, evaluating projects, and related internal administration within NHSO.
To produce public relations media and activities disseminating knowledge or information about NHSO's meetings, missions, training sessions, seminars and activities to the public through various channels, which may involve photographs or audio recordings taken during participation in such meetings, training sessions, seminars and activities; to respond to public enquiries concerning the Universal Coverage Scheme; to organize e-Learning activities; to host visits and study tours of NHSO's operations; to provide NHSO library services; and to carry out other necessary related actions, such as registration, correspondence, the receipt or dispatch of documents, and internal and external coordination.
To promote and develop educational opportunities for members of the public by selecting qualified individuals to pursue further study, training, study visits or research abroad, as well as other necessary related actions, such as project application, selection, and the preparation of related contracts (if any).
To conduct public consultations with service recipients, service providers, stakeholders, academics or relevant experts in order to improve the quality and standards of public health services under the Universal Coverage Scheme, including matters concerning public health service expenses for health service units and networks of health service units under the National Health Security Act B.E. 2545 (2002) and other relevant laws.
To disclose information to other government agencies as necessary under the Official Information Act B.E. 2540 (1997), for the purposes of analysis and operational planning by the requesting agency, including research in the public interest.
To carry out actions necessary for preparing documents in support of applications for fuel cards or expressway toll cards.
To compile facts and legal provisions in order to consider and respond to consultations or enquiries received from units within and outside NHSO.
To plan, report, evaluate and analyze data for NHSO's operations or internal administration, including the management of systems relating to public health service operations within NHSO's powers and duties under the National Health Security Act B.E. 2545 (2002) and other relevant laws.
For risk management, prevention and auditing, and internal organizational administration, such as NHSO's internal audit, the detection and prevention of fraud or any other unlawful acts, and the review of requests to use NHSO's internal information systems.
To carry out necessary actions relating to the examination, investigation and inquiry into complaints or petitions within NHSO's powers and duties under the National Health Security Act B.E. 2545 (2002) and other laws, including cases of infringement of rights in the use of public health services; damage arising from medical treatment by health service units; failure by health service units to comply with prescribed public health service standards; service recipients not receiving reasonable convenience or services in accordance with their entitlements; damage suffered by service providers in health service units as a result of providing public health services; and applications by members of the public for preliminary financial assistance relating to NHSO's missions; as well as coordination with relevant parties, and the provision of remedies and assistance to injured persons, persons whose rights have been infringed, affected service recipients or such complainants.
To conduct investigations and inquiries in accordance with legal processes and other regulations, to comply with the law, and to report information to government agencies as required by law or upon receipt of a summons or writ of execution from police officers, government agencies, courts or other law enforcement authorities, as well as for the establishment, compliance with, exercise or defense of legal claims.
To maintain security within NHSO's buildings and premises, including recording images within such buildings and premises by means of closed-circuit television (CCTV), and verifying and authenticating identity for entry to and exit from NHSO's buildings and premises.

Where the personal data collected by NHSO as described above is necessary for NHSO to comply with applicable laws or to perform a contract, and the data subject does not provide such necessary personal data, NHSO may incur legal liability and/or may be unable to administer or manage the contract or provide facilitation to the data subject.

3. Personal Data Collected

3.1 Personal Data Collected by NHSO

NHSO collects the personal data of data subjects, including the following:

3.1.1 Identification data, such as first name, surname, national identification card number, passport number, driving licence number, social security number, date of birth, gender, age, weight, height, nationality, marital status, photograph and signature.
3.1.2 Contact data, such as previous address, current address, telephone number, email address and social media contact details.
3.1.3 Financial or transaction data, such as bank account number, debit or credit card number, tax-related information, salary, insurance policy information and insurance claims history.
3.1.4 Data relating to the use of NHSO information systems or other technical data, such as IP address, device identifier, data collected through cookies or similar technologies, computer traffic data (logs), records of access to NHSO websites and systems, and user account data for NHSO information systems.
3.1.5 Education and employment data, including training, such as educational and employment history, training history, work permit information, performance appraisal information, professional licence information, employment status, name of workplace, job title, length of service, working hours, absence and leave records, employment start and end dates, and disciplinary records.
3.1.6 Data on communications with NHSO, such as image or audio recordings made when contacting NHSO.
3.1.7 Data on participation in NHSO activities, such as still images, video or audio recordings.
3.1.8 Other personal data, such as military conscription status, family member information, referee information, emergency contact information, geolocation data, travel history, purchase history, records of personal assets, traffic tickets or court summonses relating to driving, background check information, information on the health service unit where public health services were received, and details of bullying and harassment (where these constitute criminal record or health data).

In certain cases, NHSO may collect sensitive personal data, such as race, religion, blood type, criminal records, health data, body temperature, olfactory perception data, procedure codes, disease treatment codes, voice recognition data, vein patterns, sleep behavior, facial recognition data, gait patterns, keystroke patterns, iris scans, disabilities or specific conditions, political affiliations or participation in political activities (where these reveal political opinions), sexual orientation, sexual behavior, trade union membership, genetic sequences, biometric data, drug test results, fingerprint data, and health and safety reports. Such data is collected with the explicit consent of the data subject or as permitted by law.

3.2 Personal Data of Minors, Incompetent Persons and Quasi-Incompetent Persons

In certain cases, NHSO may collect the personal data of data subjects who are minors, incompetent persons or quasi-incompetent persons. In such cases, NHSO will comply with the laws governing the processing of personal data of minors, incompetent persons and quasi-incompetent persons, including obtaining consent from the statutory representative or the person exercising parental power as required by law, where NHSO has no lawful basis other than consent for the collection, use or disclosure of such data.

3.3 Sources of Personal Data

NHSO may collect the personal data of data subjects from the following sources:

3.3.1 Directly from the data subject, for example, when the data subject makes enquiries to NHSO; registers for entitlement to public health services; registers to select or change a primary health service unit; applies to register as a health service unit or network of health service units under the Universal Coverage Scheme; completes questionnaires or other registrations; submits claims or petitions to exercise rights with NHSO; contacts NHSO through various channels (such as telephone or email); or participates in NHSO activities (such as through photographs or video recordings). NHSO may also collect data automatically, for example, when the data subject uses NHSO's information technology systems or visits NHSO's websites.
3.3.2 From other sources, such as health service units, networks of health service units, projects carrying out Universal Coverage activities as assigned by NHSO, the data subject's affiliated organization, the Social Security Office, hospitals, official government documents, NHSO's agents or service providers, government agencies, or other public sources (such as the website of the data subject's affiliated organization or information available on the internet).

4. Retention Period of Personal Data

NHSO will retain the personal data of data subjects for as long as necessary to fulfil the purposes of collection, use or disclosure specified in this Privacy Notice. The criteria used to determine the retention period include the period during which NHSO maintains a relationship with the data subject. NHSO may further retain the data for such period as necessary to comply with the law or applicable statutes of limitation; for the establishment, compliance with, exercise or defense of legal claims; or for other reasons in accordance with NHSO's internal policies and requirements.

5. Disclosure of Personal Data

5.1 Categories of Persons or Entities to Whom Collected Personal Data May Be Disclosed

In carrying out the purposes specified in this Privacy Notice, NHSO may disclose the personal data of data subjects to the following third parties:

5.1.1 Health service units and networks of health service units under the Universal Coverage Scheme.
5.1.2 Organizations carrying out Universal Coverage activities to which NHSO has delegated activities within its powers and duties.
5.1.3 Hospitals.
5.1.4 Government agencies, regulatory authorities, independent organizations or other agencies as required by law, including officials exercising powers or performing duties under the law, such as the courts, the police, the Legal Execution Department, the Office of the Attorney General, the Revenue Department, the Department of Provincial Administration, the Ministry of Commerce, the Ministry of Transport, the Ministry of Finance, the Ministry of Public Health, the Ministry of Interior, the Ministry of Labour, the Ministry of Digital Economy and Society, the Department of Special Investigation, the Department of Disease Control, the Department of Mental Health, the Department of Corrections, the Department of Empowerment of Persons with Disabilities, the Comptroller General's Department, the National Cancer Institute, Provincial Administrative Organizations, local administrative organizations, the Social Security Office, Provincial Public Health Offices, the Government Pharmaceutical Organization, the National Office of Buddhism, the Division of Health Economics and Health Security, the Office of the Prime Minister, the Office of the Public Sector Development Commission, the Office of the National Anti-Corruption Commission, the Office of the Official Information Commission, the Office of the Personal Data Protection Committee, and other government agencies.
5.1.5 Foundations, associations, institutes or external organizations involved in the provision of public health services or research, such as the Thai Network of People Living with HIV/AIDS, the Diabetes Association of Thailand, universities and the Thai Casemix Centre.
5.1.6 Agents, service providers, contractors and/or subcontractors performing any operations for NHSO, such as delivery service providers, document storage and destruction service providers, printing houses, information technology system development and maintenance contractors, auditors, lawyers, legal and tax advisers, and other consultants.
5.1.7 Commercial banks and financial institutions, for the payment of expenses, public health service compensation and NHSO's preliminary financial assistance.
5.1.8 Other third parties with your consent, under the terms of a contract, or as required by law, as the case may be, including through various channels such as public media and online media.

5.2 Cross-Border Transfer of Personal Data

In certain cases, NHSO may send or transfer personal data abroad. In doing so, NHSO will ensure that the destination country or international organization receiving the personal data has adequate personal data protection standards. NHSO will also put in place appropriate protection and security measures and comply with the Personal Data Protection Act B.E. 2562 (2019), including obtaining the consent of the data subject for the cross-border transfer of personal data where required by law.

6. Rights of the Data Subject

Data subjects have the rights prescribed under the Personal Data Protection Act B.E. 2562 (2019), including the following.

Data subjects have the right to withdraw the consent given to NHSO for the collection, use or disclosure of their personal data at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits the data subject.

The withdrawal of consent shall not affect the lawfulness of any processing of personal data carried out on the basis of consent previously given by the data subject to NHSO.

6.2 Right of Access

Data subjects have the right to access and obtain a copy of their personal data under NHSO's responsibility, and to request NHSO to disclose how such personal data was obtained where the data subject did not give consent.

6.3 Right to Data Portability

Where NHSO has made personal data available in a format that is readable or commonly usable by automated tools or devices and can be used or disclosed by automated means, data subjects have the right to receive their personal data from NHSO, and to request NHSO to send or transfer such data in that format to another data controller, as prescribed by law.

6.4 Right to Object

Data subjects have the right to object to the collection, use or disclosure of their personal data as prescribed by law.

6.5 Right to Erasure

Data subjects have the right to request NHSO to erase or destroy their personal data, or to anonymize it so that it can no longer identify the data subject, on the grounds prescribed by law.

6.6 Right to Restriction of Processing

Data subjects have the right to request NHSO to restrict the use of their personal data on the grounds prescribed by law.

6.7 Right to Rectification

Data subjects have the right to request NHSO to rectify their personal data so that it is accurate, up to date, complete and not misleading.

6.8 Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with the competent official under the Personal Data Protection Act B.E. 2562 (2019) if NHSO violates or fails to comply with that Act.

Where a data subject submits a request to exercise any right under the Personal Data Protection Act B.E. 2562 (2019), NHSO will act on the request within the period prescribed by law. NHSO reserves the right to refuse or not to act on such a request where permitted by law.

7. Personal Data Security Measures

NHSO has put in place appropriate and stringent security measures to safeguard personal data against loss, and against unauthorized or unlawful access, use, alteration, modification or disclosure.

Where NHSO engages any other person to process personal data on its instructions or on its behalf, NHSO will appropriately supervise such person to ensure that the security of the data subject's personal data is maintained in accordance with the Personal Data Protection Act B.E. 2562 (2019).

Announced on 25 May B.E. 2565 (2022).