AI Regulation Tracker  /  Draft rule

Vietnam Health Ministry drafts rules to gate AI use of patient data via a National Medical Database

Vietnam's Ministry of Health is drafting a decree that would require its authorization before hospitals, device makers, and health-AI vendors collect, share, or reuse patient data. As proposed, the secondary use of medical data to train or run AI would need explicit sign-off.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Vietnam's Ministry of Health is drafting a decree that would put the country's clinical data behind a government gate. According to analysis by Baker McKenzie published in February 2026, the ministry is preparing rules on medical data management, anchored by a National Medical Database under its oversight, that would require its authorization before hospitals, device makers, and health-AI vendors collect or share patient records, device data, and medical images. As proposed, the same authorization requirement would extend to a specific and consequential use case: reusing medical data to train or operate artificial intelligence.

The instrument is a consultation draft. It is not binding, no decree number has been confirmed, and no effective date has been set. What follows is a description of what is coming, based on the proposal as reported, not a statement of current law.

What the draft proposes

At its center is a National Medical Database that the Ministry of Health would oversee. Rather than leaving patient records, imaging, and connected-device data scattered across individual hospitals and vendors, the proposal points toward a more centralized medical-data commons, with the ministry as the authorizing authority for who may collect it, who may share it, and on what terms.

The provision that matters most for technology teams is the treatment of secondary use. Data collected to treat a patient is one thing. Reusing that same data to build a diagnostic model, validate an algorithm, or run an AI product is a second, distinct purpose, and the draft would require explicit authorization for it. That reframes clinical data reuse from an internal decision into a step that needs the ministry's sign-off.

The scope reaches wider than hospital records alone. As reported, the proposal covers patient records, connected medical-device data, and medical images, the three feeds that most diagnostic and imaging AI depends on. A device maker collecting telemetry from installed equipment, and a vendor assembling an imaging training set, would both fall inside the authorization perimeter, not just the hospital that generated the underlying encounter.

Why the timing points to preparation, not panic

The draft does not stand alone. It sits atop Vietnam's Law on Artificial Intelligence, which took effect on March 1, 2026 and gives the health sector the longest compliance runway in the statute, a grace period that runs to September 1, 2027. Health, education, and finance were given until that date to bring existing systems into line, while most other sectors face an earlier 2027 deadline.

That combination, a draft medical-data decree plus the longest AI-Law grace period, is why the sensible posture is preparation rather than reaction. Nothing here is enforceable today. But an organization that maps its clinical data flows now, and documents where patient records and images feed its models, will be positioned to slot in an authorization step if and when the decree is finalized, instead of retrofitting one under deadline pressure.

The practical work is unglamorous and worth starting early. It means knowing which datasets came from Vietnamese patients, which were reused beyond direct care, and which consent or authorization basis each one rests on. That inventory is useful regardless of how the final text lands, because it is the same record the ministry's proposed authorization channel would ask for, and the same record that Vietnam's broader data and privacy laws already reward organizations for keeping.

What it does not do

The draft does not create an obligation you can breach today, because it is not in force. It does not carry a confirmed number, penalty schedule, or effective date, and none of those should be assumed from the proposal. It also is not the AI Law itself; it is a sector-specific instrument that would layer health-data authorization on top of the general AI framework already in effect. Treat any specific figure or deadline you see attached to it as unconfirmed until the Ministry of Health publishes final text.

The cross-border read

For a US reader, the useful comparison is the European Health Data Space, the EU framework that sets rules for the secondary use of health data across member states. Vietnam's draft moves in a similar direction: a centralized, government-supervised medical-data commons where reuse for research and AI runs through a defined authorization channel rather than ad hoc consent. A US health-AI company operating in or sourcing data from Vietnam would inherit that authorization burden directly, and the broader pattern, governments asserting control over clinical-data reuse for AI, is one that US firms should expect to see repeated in other markets.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.