Hospitals hold detailed information about their patients, and marketing teams naturally want to use it. The PDPA draws a firm line between caring for patients and marketing to them.
Health data is sensitive data
Under the Personal Data Protection Act B.E. 2562 (2019), health information is sensitive personal data. Collecting or using it generally requires the patient’s explicit consent unless a specific legal exception applies. The exceptions that allow hospitals to use health data for treatment do not extend to promoting new services.
Communication versus marketing
Appointment reminders, test results and follow-up care are part of providing the service. Promoting a new health-check package to patients with a particular condition is marketing, and it relies on sensitive data to target the message.
If the message depends on what you know about a patient’s health, assume you need explicit consent to send it.
Getting consent right
Consent for marketing should be separate from consent to treatment, specific about what the hospital will do, and as easy to withdraw as it was to give. Pre-ticked boxes and consent bundled into admission paperwork are unlikely to stand up.
Confidentiality obligations under the National Health Act apply alongside the PDPA, so hospitals should also check that marketing activities never disclose a patient’s health information to third parties.
This article is for general information only and does not constitute legal advice. For advice on your circumstances, please contact our team.