[01]
Live Tamper-resistant audit trail
Medical-record operations are logged to a SHA-256 hash-chain audit trail, so data changes are traceable and hard to alter silently.
Regulatory Guide · UU 27/2022 PDP
Medical RecordData Security
Health data is the most sensitive personal data there is. Here is a concrete explanation of the security controls — not just 'secure & encrypted' — mapped to the obligations of UU 27/2022 on Personal Data Protection, complete with an honest boundary of responsibility.
Legal standing
The hospital is the personal-data controller.
Patient health data qualifies as specific (sensitive) personal data under UU 27/2022 on Personal Data Protection. A hospital generally acts as the data controller — responsible for the lawful basis of processing, security, fulfilment of data-subject rights, and handling of breach incidents.
A good information system does not remove that responsibility, but provides the technical controls that make it achievable and provable. Here is what Adievia provides — as it is.
Source note: the official copy of PP 33/2026 was not yet available on peraturan.go.id or the BPK legal database as of 8 November 2026. Article numbers on this page are matched against the text circulating in legal databases, and one database records the promulgation date as 15 July 2026, not 16 July. PDP Agency status: ANTARA, 4 November 2026 (in Indonesian).
Technical controls
Concrete, with honest status
Every control is labeled with its status as it is — Live, Partial, or Maturing. We do not mark everything "done".
[02]
Partial Field-level AES-256-GCM encryption
Sensitive data is encrypted at the column level at rest; transport is secured with TLS 1.2/1.3. Full coverage across every sensitive field is still being matured.
[03]
Live Granular RBAC
Access rights per role and per module, kept in sync between the application and the database — supporting the need-to-know principle over patient data.
[04]
Live MFA (TOTP/WebAuthn)
Multi-factor authentication with TOTP (RFC 6238), passkey/WebAuthn, and backup codes. Privileged accounts must set it up before they can use the system, and cannot switch it off themselves.
An honest boundary
Technology handles the controls; organizational compliance still belongs to the hospital.
Appointing a DPO, drafting data-protection policies, the lawful basis of processing (consent), and the obligation to notify the authority and data subjects of a breach are the hospital's responsibility as the data controller. Adievia provides the audit trail, encryption, and access controls that support meeting those obligations — not a replacement for them. An honest vendor does not promise that "PDP compliance is handled automatically".
FAQ
Questions about data security & the PDP Law.
Because hospitals process patient data, including health data that qualifies as specific (sensitive) personal data. Under UU 27/2022, a hospital generally acts as the personal-data controller — responsible for the lawful basis of processing, security, fulfilment of data-subject rights, and incident handling.
Not just "secure and encrypted": a tamper-resistant SHA-256 hash-chain audit trail, field-level AES-256-GCM encryption for sensitive data at rest, TLS 1.2/1.3 in transit, and granular RBAC. MFA (TOTP, passkey/WebAuthn, backup codes) is live and mandatory for privileged accounts. Full encryption coverage is still being formalized ahead of the third-party audit (Q1–Q2 2027) — we state this as it is.
The system supports logging and traceability (audit trail) that help detect and investigate incidents. However, the legal obligation to notify the authority and data subjects of a breach, within 3×24 hours (PP 33/2026 Article 114), along with appointing a personal data protection officer, remains the hospital's responsibility as the data controller. We provide the technical controls, not a replacement for organizational compliance.
PP 33/2026, the implementing regulation of UU 27/2022, was promulgated on 16 July 2026 according to the circulating text, and takes effect on 16 January 2027 (Article 225). For hospitals as data controllers, the obligations become measurable: record all personal data processing activities (Article 74), set a retention policy (Article 75), respond to data subject requests within 3×24 hours (including Articles 71 and 77), notify personal data protection failures within 3×24 hours (Article 114), and carry out an impact assessment before high-risk processing — including processing health data (Articles 120–121). Transfers outside Indonesia, including through cloud or messaging services, need a lawful basis. The Personal Data Protection Agency that will oversee this had not yet been formed as of 8 November 2026: according to Komdigi, the draft Presidential Regulation establishing it is final and has been submitted to the President through the Ministry of State Secretariat (4 November 2026). Until the agency exists, its function is carried out by the Ministry of Communication and Digital Affairs.
For patient data, an HMS vendor generally acts as a data processor working on the hospital's instructions. The hospital must ensure its processor also records its processing activities (Article 74), and the relationship is set out in a data processing agreement. Adievia provides the technical controls and supporting documentation — decisions on the basis for processing, retention periods, and incident notification remain the hospital's as controller.
Yes. The PDP Law gives patients, as data subjects, the right to obtain their personal data in a commonly used or machine-readable format and to transmit it to another controller (Article 13). Adievia lets you export data to standard formats (CSV, FHIR R4 JSON, SQL) at any time — with no vendor lock-in.
Next step