As the global race to adopt medical artificial intelligence accelerates, South Korea finds itself in an uncomfortable position: government ministries are pushing hard for AI-driven healthcare transformation, but the foundational legislation needed to enable it safely remains stalled in a National Assembly committee. The growing gap between policy ambition and legal reality is threatening to delay benefits that could reach both clinicians and patients.
Medical Benefit — What the Law Would Unlock
The core of the pending Digital Healthcare Act is a framework that extends personal data portability rights — specifically, an individual’s right to request transfer of their medical information to third parties — tailored to the sensitivity of health data. Once enacted, this would provide the legal backbone for AI-assisted diagnostics, personalized treatment programs, and telemedicine services. It would also legitimize initiatives like the “Health Information Highway,” a project aimed at safely integrating medical data fragmented across hospitals and public institutions, under the auspices of the Korea Health Information Service.
Patient Safety — The Scraping Problem
The most immediate risk created by the legislative vacuum is the continued practice of medical data scraping — the automated collection of personal information by accessing health-related websites. Although the medical My-Data framework has been introduced at the policy level, the absence of clear statutory prohibitions means scraping-based services remain active in the market, posing risks including credential theft and unauthorized data collection. More recently, generative AI-powered scraping methods have begun to emerge, raising the stakes for patient data protection. A Ministry of Health and Welfare official acknowledged that without clear legal standards, the government lacks effective tools to act against such practices.
Accessibility — Legal Uncertainty as a Health Equity Issue
Conflicting definitions between two existing laws — the Personal Information Protection Act’s concept of “pseudonymization” and the Bioethics Act’s use of “anonymization” — have created overlapping and sometimes contradictory standards for medical data use. Non-binding ministerial guidelines have been issued to help navigate this, but they carry no legal force. In practice, both companies and healthcare institutions have defaulted to conservative interpretations of permissible data use, limiting the potential of medical big data. As global technology companies rapidly expand AI-enabled medical services on the back of integrated health data, South Korean patients risk falling behind in access to next-generation care.
Adoption Status — Policy Racing Ahead of Law
The Ministry of Health and Welfare is actively pursuing public healthcare AI transformation (referred to locally as “AX”) and a range of medical data utilization programs. However, the Digital Healthcare and Health Data Utilization Act — which would also formalize the legal establishment and operational scope of the Korea Health Information Service — has seen no meaningful parliamentary progress, even as other priority legislation passed full plenary votes. Medical professionals and industry observers warn that without a stable legal foundation, South Korea’s ambition to build a prevention-centered, AI-powered healthcare system will remain structurally constrained.
