Takafumi Ochiai
Atsumi & Sakai, Tokyo
takafumi.ochiai@aplaw.jp

Introduction

Between December 2025 and April 2026, the Japanese Diet and Cabinet enacted or approved several measures relevant to health data, Artificial Intelligence (AI), and clinical research. The Comprehensive Reform Act for Healthcare Service Delivery and related laws were amended on 5 December 2025. On 7 April 2026, the Cabinet approved bills amending the Personal Information Protection Act (APPI),¹ and the Digital Administration Act and the Act on the Promotion of Information Processing.² In parallel, the AI Promotion Act (2025), the evolving Software as a Medical Device (SaMD) framework, and a Good Clinical Practice (GCP) Ordinance revision setting staged Single Institutional Review Board (IRB) targets are also advancing.

The direction for the first group – the APPI, the Comprehensive Reform Act for Healthcare Service Delivery, and the Digital Administration Act – was set by the Basic Policy on Data Utilisation Systems (Cabinet Decision of 13 June 2025), which examined data-utilisation regimes with reference to comparators including the EU's European Health Data Space (EHDS) Regulation.³ The AI Promotion Act, the SaMD framework, the FY2026 reimbursement revision, and the GCP Ordinance revision are not themselves within the scope of the Basic Policy, but run in parallel. Reform is accordingly proceeding across the APPI, public-database access rules, research ethics frameworks, and standardisation involving public and private actors. The legal position is best understood by viewing these tracks together. A further structural feature is that data-protection rules are evolving in different directions for primary use (provision of medical care) and secondary use (research, drug development, and other industrial applications). Each requires separate analysis.

April 2026 APPI amendment Cabinet Decision

The bill contains four elements relevant to health data, operating across primary- and secondary-use contexts.

First, a new statistical-processing exception (proposed article 30-2) permits, subject to public disclosure of the contents of the statistical data and a written agreement with the recipient third party on the use of the data for statistical purposes, the acquisition and onward provision of publicly available sensitive personal information without individual consent, where the purpose is confined to statistical or general-purpose analytical outputs not relating to identified individuals. For personal information and personally referable information (which may include cookies and similar identifiers), third-party provision is also permitted without consent, regardless of whether the source is publicly disclosed. The provision is sometimes described as the personal-data analogue to the 'flexible right-limitation provision' in article 30-4 of the Copyright Act for AI development. In the medical sector, it has the potential to be used widely in secondary-use contexts.

Second, the life-and-body-protection exceptions (articles 18(3)(ii), 27(1)(ii), and others) and public-health exceptions (articles 18(3)(iii), 27(1)(iii), and others) are relaxed. The current 'difficult to obtain consent' threshold is supplemented by a new ground: where there is 'reasonable ground' not to obtain consent. Both matter for healthcare – the life-and-body ground for clinical situations involving the protection of individual health, and the public-health ground for activities such as pandemic response and large-scale public-health research where consent-based models have proved unworkable.

Third, a new exception covers cases where processing is clearly necessary for performance of a contract with the data subject, or where acquisition circumstances otherwise show that processing does not run counter to the data subject's intent or harm their rights or interests, in cases specified by Personal Information Protection Commission (PPC) rules (new articles 18(3)(vii), 27(1)(viii), and others). It operates alongside existing grounds – processing based on law, outsourcing, joint use, and succession of business.

Fourth, the academic-research exception is clarified. Amended article 16(9) expressly provides that 'academic research institutions, etc' include hospitals under the Medical Care Act and other institutions whose purpose is the provision of medical care, resolving a long-standing question on hospital-based clinical research.

While the amendment shifts away from the prior emphasis on consent acquisition, the broader APPI reform package – including the introduction of administrative surcharges and strengthened protection of children's personal information and biometric data – together moves the regime closer to the GDPR in supervisory intensity, while preserving flexibility for innovation.

December 2025 Comprehensive Reform Act for Healthcare Service Delivery revision for medical-data infrastructure

The amendments to the Medical Care Act, the Comprehensive Reform Act for Healthcare Service Delivery, and other related laws under the jurisdiction of the Ministry of Health, Labour and Welfare (MHLW), enacted on 5 December 2025,⁴ advance two priorities relating to primary use: medical digital transformation, including electronic medical records, and expansion of online medical care. They build on the nationwide deployment of the electronic medical record information-sharing service developed by the Digital Agency under the Comprehensive Reform Act for Healthcare Service Delivery. The service enables medical institutions to share three documents (health-checkup result reports, referral letters, and discharge summaries) and six categories of information (diagnoses, examinations, etc) electronically. Patients can also view their health-checkup result reports and the six categories of information on their My Number Portal accounts. Patient consent is not required for provision under an exception to the APPI, although consent remains required for review of the information by other medical institutions. The reform aims to achieve approximately 100 per cent electronic medical record adoption by 31 December 2030.

These measures form part of a broader policy of integrated development of public databases and private-sector standardisation around the three documents and six categories of information. Nine public databases are in place, including the NDB (National Database of Health Insurance Claims), the KDB (Japanese Long-term Care Database), and the cancer registry database (which accumulates nationwide cancer data under the Cancer Registry Act). These databases are being developed to permit the use and provision of pseudonymously processed information, including linked analysis with other pseudonymously processed data and with pseudonymously processed medical information generated under the Next Generation Medical Infrastructure Act. The electronic medical record information-sharing service is being further developed and is scheduled to be added as a further public database, generating standardised clinical data through electronic clinical record information that serves both primary care coordination and secondary analytical use.

Secondary use has been governed principally by the APPI and the Act on Anonymously Processed Medical Information (Next Generation Medical Infrastructure Act). However, with the introduction of the statistical-use provisions in the APPI and the recent Comprehensive Reform Act for Healthcare Service Delivery amendments, the legal frameworks for using statistical information and pseudonymously processed information are evolving rapidly.

Digital Administration Act amendment

The bill⁵ introduces a certification regime for 'State Data Utilisation Business'. The Prime Minister adopts guidelines on priority areas and data safety (Article 26); competent ministers may certify private-sector business plans using data held by national administrative bodies. Certified operators may request specified government data (article 29); certification incorporates a mechanism through which the views of the PPC and other authorities are obtained on APPI compliance, providing a framework for preventing legal violations (article 27(5), (6)).

The bill does not alter the legal bases for use of hospital or patient data under the APPI or the Next Generation Medical Infrastructure Act. Its significance for the health sector is to provide a structured route through which government-held data can be combined with private-sector analytical capabilities under a defined legal and governance framework.

AI Promotion Act, the SaMD framework, and medical AI guidance

The AI Promotion Act (2025) establishes a principles-based framework, supplemented by the AI Business Operator Guidelines (Version 1.2, updated 31 March 2026, which newly includes risk analysis of AI agents)⁶ and the IP Transparency Principles and Code. The Principles and Code combine a comply-or-explain approach modelled on the Corporate Governance Code with elements of the EU's transparency-related initiatives. Following the public-comment process in December 2025,⁷ the Principles and Code have generated substantial debate, and the final version has not yet been determined.

In relation to medical data, MHLW's Guidelines on the Utilisation of Medical Digital Data for AI Research and Development (notice of 30 September 2024)⁸ set out the basis for using medical information by stage of research and development, together with procedures for creating and operating pseudonymously processed information reflecting the characteristics of medical data. Information-security governance is addressed through the 'three-ministry, two-guideline' framework – MHLW guidelines on safety management of medical information systems and the METI/MIC guidelines for system providers, both updated by March 2025.

The Pharmaceuticals and Medical Devices Act governs SaMD classification and review, supported by MHLW guidelines on the determination of whether programs qualify as medical devices. A two-step approval process for SaMD (the IDATEN scheme) has been introduced, enabling continuous post-market improvement and updating of SaMD performance. Reimbursement is a further important lever. Adoption of AI-enabled medical devices and digital therapeutics depends significantly on inclusion in the National Health Insurance benefit schedule. SaMD-related fee-schedule treatment has been progressively improved, and the FY2026 Fee Schedule revision⁹ identifies promotion of ICT, AI, and IoT (Internet of Things) utilisation as a named priority. The revised Physician Clerical Work Support System Addition links AI Business Operator Guidelines compliance directly to reimbursement-based incentives.

A further issue concerns Article 17 of the Medical Practitioners Act, under which diagnosis lies within the exclusive competence of qualified physicians. As AI image-reading tools are considered for roles beyond decision support – for example, in the ongoing reconsideration of the physician dual-reading rule for municipal cancer screening – the possibility of partial substitution of physician work by AI image-reading is under discussion.

Single IRB reform under the GCP Ordinance

Japan's utilisation of Single IRB review in multi-site trials has historically been low – approximately 1.3 per cent, according to a 2025 survey by the Japan Pharmaceutical Manufacturers Association and others. The revised GCP Ordinance sets staged targets – 30 per cent at three years, 50 per cent at five years, and 80 per cent at eight years from entry into force – together with measures on sponsor-led IRB designation, narrowing of IRB review scope, simplification of institutional-head review for minor protocol amendments, and standardisation of forms and documents.

For international sponsors, the reform addresses a long-standing constraint on Japan's participation in multi-site global trials.

Outlook

The 2025-2026 reforms do not replicate the EU's single-statute approach under the EHDS Regulation. Japan is instead aligning several tracks in parallel: under the Basic Policy on Data Utilisation Systems, the APPI, the Comprehensive Reform Act for Healthcare Service Delivery, and the Digital Administration Act provide the data-governance and infrastructure backbone; and separately, the AI Promotion Act, the SaMD framework, reimbursement, and Single IRB reform advance alongside them. The distinction between primary and secondary use remains material. Building on the Basic Policy, further discussion on the development of medical-data legislation is ongoing within the Cabinet Office's Healthcare Policy Office. For international practitioners, interoperability and regulatory alignment with Japan are best approached track by track, in light of how the tracks are intended to fit together under the Basic Policy and how the adjacent AI and reimbursement tracks interact with them.

The views expressed are those of the author and do not necessarily reflect the positions of any organisation with which the author is affiliated.

Notes

1     Personal Information Protection Commission, Summary of the Bill to Amend the Act on the Protection of Personal Information and Related Statutes (Cabinet Decision of 7 April 2026); www.ppc.go.jp/news/press/2026/260407 (in Japanese), accessed 1 May 2026.

2     Cabinet Secretariat, materials relating to the Bill to Amend the Digital Administration Act and the Act on the Promotion of Information Processing: www.cas.go.jp/jp/houan/221.html (in Japanese), accessed 1 May 2026.

3     Cabinet Secretariat, Basic Policy on Data Utilisation Systems (Cabinet Decision of 13 June 2025): www.cas.go.jp/jp/seisaku/digital_gyozaikaikaku/pdf/data_houshin_honbun.pdf (in Japanese), accessed 1 May 2026.

4     Ministry of Health, Labour and Welfare, Bill to Amend the Medical Care Act, etc (enacted 5 December 2025): https://www.mhlw.go.jp/stf/topics/bukyoku/soumu/houritu/217.html (in Japanese), accessed 1 May 2026.

5     See note 2.

6     Ministry of Internal Affairs and Communications and Ministry of Economy, Trade and Industry, AI Business Operator Guidelines (Ver 1.2, 31 March 2026): www.soumu.go.jp/main_sosiki/kenkyu/ai_network/02ryutsu20_04000019.html (in Japanese; English provisional translation also available), accessed 1 May 2026.

7     Cabinet Office Intellectual Property Strategy Headquarters, related public consultation on AI and IP (December 2025): https://public-comment.e-gov.go.jp/servlet/Public?CLASSNAME=PCMMSTDETAIL&id=095251270&Mode=0 (in Japanese), accessed 1 May 2026.

8     Ministry of Health, Labour and Welfare, Guidelines on the Utilisation of Medical Digital Data for AI Research and Development (notice of 30 September 2024): www.mhlw.go.jp/content/001310044.pdf (in Japanese), accessed 1 May 2026.

9     Ministry of Health, Labour and Welfare, FY2026 National Health Insurance Fee Schedule Revision Materials: www.mhlw.go.jp/content/12400000/001685766.pdf (in Japanese), accessed 1 May 2026.