The Regulation Amending the Regulation on Personal Health Data (the "Amending Regulation"), published in the Official Gazette dated 4 July 2026 and numbered 33300, introduces amendments to the existing framework governing the correction of personal health data and, for the first time, establishes the procedures and principles for the reassessment of previous diagnoses based on an individual's current health status.
The Amending Regulation primarily clarifies the extent to which previous medical diagnoses that no longer reflect an individual's current health condition may be taken into account in various administrative and legal processes, particularly during employment-related processes. Importantly, the Regulation does not establish a mechanism for deleting or amending historical health records. Instead, under certain conditions, it requires that a current status medical board report reflecting the individual's present health condition be taken into consideration in procedures carried out on the basis of such historical records.
In particular, the Regulation introduces an important change whereby, in administrative and legal procedures in which medical reports are relied upon—especially employment-related processes—a medical board report reflecting the individual's current health status may be taken as the basis instead of previous diagnoses.
Background of the Amendment
The Regulation on Personal Health Data, published in the Official Gazette dated 21 June 2019 and numbered 30808, sets out the procedures and principles governing the processing, protection and management of personal health data by healthcare service providers.
In practice, certain historical diagnoses have continued to remain in health records despite subsequent changes in an individual's medical condition. As a result, outdated diagnoses that no longer reflected the individual's current health status could nevertheless be taken into account in recruitment, professional admission and similar administrative processes, giving rise to significant legal and practical concerns. The amendments clarify the applicable procedure in this respect and introduce a new mechanism designed to ensure that an individual's current health condition is taken into consideration. www.oa-ao.com
The Title of Chapter Four Has Been Amended
The title of Chapter Four of the Regulation has been amended to "Concealment, Correction, Reassessment, Destruction and Transfer of Personal Health Data." This amendment systematically incorporates the newly introduced reassessment mechanism into the structure of the Regulation.
Procedure for the Correction of Personal Health Data Has Been Updated
The amendment to Article 13(2) expressly provides that corrections made by the General Directorate in relation to personal health data shall also be implemented in the database of the relevant healthcare service provider, limited to the relevant application.
However, whether corresponding updates will be made in the databases of other institutions or organisations processing the same data will continue to be assessed by those institutions under their own applicable legislation.
Accordingly, the amendment does not provide that corrections to personal health data will automatically produce effects across all databases. Rather, each data controller remains responsible for assessing whether any corresponding updates are required under its own legal obligations.
A New Reassessment Mechanism Has Been Introduced
The newly introduced Article 13/A enables previously diagnosed medical conditions to be reassessed on the basis of an individual's current health status.
Accordingly:
• diagnoses made by a single physician will be reassessed by a three-member medical board; and
• diagnoses previously made by a medical board may only be reassessed by a fully constituted medical board.
Following such reassessment, a medical board report confirming the individual's current health status will be issued. www.oa-ao.com
Where the reassessment concludes that the relevant diagnosis is no longer applicable in light of the individual's current health status, administrative and legal procedures conducted on the basis of that diagnosis shall rely on the newly issued medical board report rather than the previous diagnosis.
The Amending Regulation further provides that, without prejudice to specific provisions under other legislation, previous diagnoses may not, on their own, constitute the sole basis for assessment, particularly in employment-related processes.
Practical Implications
The amendments introduce important practical implications for, among others:
• employers;
• human resources departments;
• occupational physicians;
• healthcare service providers; and
• public institutions and private organisations processing personal health data.
In particular, where a reassessment results in the issuance of a current medical board report, previous diagnoses can no longer serve as the sole criterion for evaluation in recruitment and similar processes.
Healthcare service providers should also ensure that their data correction procedures comply with the amended Regulation. Likewise, other organisations processing personal health data should review their own data update procedures under the legislation applicable to them and assess in which systems corresponding updates are required.
Conclusion
The amendments constitute an important development aimed at strengthening the principle that personal health data should accurately reflect an individual's current health status and at limiting the adverse consequences that outdated diagnoses may produce where they no longer correspond to the individual's present medical condition.
That said, the Regulation does not introduce a mechanism for deleting or amending historical health records. Instead, subject to any specific provisions under other applicable legislation, it provides that the medical board report issued following the reassessment process shall be relied upon in place of previous diagnoses for the relevant administrative or legal procedures. www.oa-ao.com
Healthcare service providers should therefore review their data management processes, while organisations processing personal health data may wish to review their recruitment and similar practices to ensure compliance with the amended framework.