Legal Analysis of Electronic Medical Record Interoperability with the SATUSEHAT Platform: A Case Study of Padjajaran Network Clinic
DOI:
https://doi.org/10.15575/jis.v6i4.58527Keywords:
data privacy, Electronic Medical Records (EMR), health law, interoperability, legal review, personal data protectionAbstract
Indonesia’s healthcare sector is undergoing a major digital transformation with the introduction of SATUSEHAT, a national platform designed to unify patient data and enable interoperability among health facilities. The enactment of Permenkes No. 24/2022 on Medical Records has made electronic medical records (EMRs) mandatory and requires their integration with SATUSEHAT, supported by broader regulations such as the Health Law and the Personal Data Protection Law (UU No. 27/2022). This article examines the legal framework governing EMR–SATUSEHAT integration and analyzes its real-world implementation in Klinik Jejaring Padjadjaran (KJP), a network of primary care clinics in West Java. Using a mixed-method approach, doctrinal legal analysis of statutes and regulations, alongside a qualitative case study of KJP’s implementation, the study explores compliance challenges, legal risks, and practical benefits. Findings indicate that while KJP achieved regulatory compliance through system upgrades, data standardization, interoperability testing, and reinforced privacy safeguards, the process required significant investment in resources and staff training. The case highlights tensions between older regulations and new integration mandates, as well as the need for further clarity on patient consent under the data protection regime. Ultimately, KJP’s experience illustrates both the opportunities and complexities of Indonesia’s digital health transformation, offering a model for other healthcare providers navigating EMR interoperability and data governance.
References
Al-Ruithe, M., Benkhelifa, E., & Hameed, K. (2019). A systematic literature review of data governance and cloud data governance. Personal and Ubiquitous Computing, 23(5–6), 839–859. https://doi.org/10.1007/s00779-017-1104-3
Amenta, E., & Ramsey, K. M. (2010). Institutional Theory (pp. 15–39). https://doi.org/10.1007/978-0-387-68930-2_2
Arabi, Y. M., Al Ghamdi, A. A., Al-Moamary, M., Al Mutrafy, A., AlHazme, R. H., & Al Knawy, B. A. (2022). Electronic medical record implementation in a large healthcare system from a leadership perspective. BMC Medical Informatics and Decision Making, 22(1), 66. https://doi.org/10.1186/s12911-022-01801-0
Asyfia, A., Zaid, Mahendika, D., & Setyowati, M. (2023). Medical Record Digitization Policy: Overview of the Health Minister Regulation Number 24 of 2022. Consilium Sanitatis: Journal of Health Science and Policy, 1(2), 54–61. https://doi.org/10.56855/jhsp.v1i2.227
Bender, D., & Sartipi, K. (2013). HL7 FHIR: An Agile and RESTful approach to healthcare information exchange. Proceedings of the 26th IEEE International Symposium on Computer-Based Medical Systems, 326–331. https://doi.org/10.1109/CBMS.2013.6627810
Benneh Mensah, G., & Dutta, P. K. (2024). Evaluating if Ghana’s Health Institutions and Facilities Act 2011 (Act 829) Sufficiently Addresses Medical Negligence Risks from Integration of Artificial Intelligence Systems. Mesopotamian Journal of Artificial Intelligence in Healthcare, 2024, 35–41. https://doi.org/10.58496/MJAIH/2024/006
Compton, J. R., & Benedetti, P. (2010). LABOUR, NEW MEDIA AND THE INSTITUTIONAL RESTRUCTURING OF JOURNALISM. Journalism Studies, 11(4), 487–499. https://doi.org/10.1080/14616701003638350
Creswell, J. W., & Creswell, J. D. (2018). Research Design: Qualitative, Quantitative, and Mixed Method Approaches, Fifth Edition. SAGE Publications Asia-Pacific Pte. Ltd.
Custers, B., Sears, A. M., Dechesne, F., Georgieva, I., Tani, T., & van der Hof, S. (2019). EU Personal Data Protection in Policy and Practice (Vol. 29). T.M.C. Asser Press. https://doi.org/10.1007/978-94-6265-282-8
Darnela, L., & Rusdiana, E. (2025). Public Legal Awareness and the Effectiveness of Indonesia’s Personal Data Protection Law: Bridging Normative Framework and Privacy Paradox. Supremasi Hukum: Jurnal Kajian Ilmu Hukum, 14(1), 1–28. https://doi.org/10.14421/2gg2rp29
de Vaujany, F.-X., Fomin, V. V., Haefliger, S., & Lyytinen, K. (2018). Rules, Practices, and Information Technology: A Trifecta of Organizational Regulation. Information Systems Research, 29(3), 755–773. https://doi.org/10.1287/isre.2017.0771
Dobbin, F. (2021). The New Economic Sociology : A Reader. Princeton University Press CN - HB.
Engle, C. R., van Senten, J., Clark, C., & Boldt, N. (2023). Has the Regulatory Compliance Burden Reduced Competitiveness of the U.S. Tilapia Industry? Fishes, 8(3), 151. https://doi.org/10.3390/fishes8030151
Faisal, K. (2023). Applying the Purpose Limitation Principle in Smart-City Data-Processing Practices: A European Data Protection Law Perspective. Communication Law and Policy, 28(1), 67–97. https://doi.org/10.1080/10811680.2023.2180266
Fitri, R. D., Hilman, M., & Yazid, S. (2025). Improving password policy strategies: a government employee perspective. Information & Computer Security, 33(4), 547–572. https://doi.org/10.1108/ICS-12-2024-0335
Forgó, N., Hänold, S., & Schütze, B. (2017). The Principle of Purpose Limitation and Big Data (pp. 17–42). https://doi.org/10.1007/978-981-10-5038-1_2
Goswami, S. S., & Mondal, S. (2025). Data Security and Privacy Concerns in Digitized Medical Services: Implications for Malpractice Risk Management. Spectrum of Decision Making and Applications, 3(1), 212–242. https://doi.org/10.31181/sdmap31202643
Hariharan, S., Jonnalagadda, R., Walrond, E., & Moseley, H. (2006). Knowledge, attitudes and practice of healthcare ethics and law among doctors and nurses in Barbados. BMC Medical Ethics, 7(1), 7. https://doi.org/10.1186/1472-6939-7-7
Helén, I., & Tarkkala, H. (2024). Adjusting expectations actionable: Personalised treatment plan in anticipation of data-driven healthcare. Big Data & Society, 11(4). https://doi.org/10.1177/20539517241285384
Hulkower, R., Penn, M., & Schmit, C. (2020). Privacy and Confidentiality of Public Health Information (pp. 147–166). https://doi.org/10.1007/978-3-030-41215-9_9
Hurmelinna-Laukkanen, P., & Nätti, S. (2018). Orchestrator types, roles and capabilities – A framework for innovation networks. Industrial Marketing Management, 74, 65–78. https://doi.org/10.1016/j.indmarman.2017.09.020
Isibor, E. (2024). Regulation of Healthcare Data Security: Legal Obligations in A Digital Age. https://doi.org/10.2139/ssrn.4957244
Jimenez, G., Spinazze, P., Matchar, D., Koh Choon Huat, G., van der Kleij, R. M. J. J., Chavannes, N. H., & Car, J. (2020). Digital health competencies for primary healthcare professionals: A scoping review. International Journal of Medical Informatics, 143, 104260. https://doi.org/10.1016/j.ijmedinf.2020.104260
Julia, F., & Aulianto, D. R. (2025). Focused Analysis of Article 29 of Indonesian Minister of Health Regulation No. 24/2022: Data Security Implementation of Electronic Medical Records at Sindangwangi Health Center, Pangandaran, West Java. Lentera Pustaka: Jurnal Kajian Ilmu Perpustakaan, Informasi Dan Kearsipan, 11(1), 61–74. https://doi.org/10.14710/lenpust.v11i1.70518
Kellermann, A. L., Saultz, J. W., Mehrotra, A., Jones, S. S., & Dalal, S. (2013). Primary Care Technicians: A Solution To The Primary Care Workforce Gap. Health Affairs, 32(11), 1893–1898. https://doi.org/10.1377/hlthaff.2013.0481
Khanna, V., & Kotwal, A. (2025). Examining the significance of the digital personal data protection act, 2023 in the context of the healthcare industry: a comprehensive analysis. Discover Public Health, 22(1), 381. https://doi.org/10.1186/s12982-025-00757-6
Khatri, V., & Brown, C. V. (2010). Designing data governance. Communications of the ACM, 53(1), 148–152. https://doi.org/10.1145/1629175.1629210
Kotter, J. P. (1996). Leading Change. Harvard Business Review Press.
Kovan, A. (2025). Digital Fatigue within the Family: Psychosocial Reflections of Constant Connectedness. Afyon Kocatepe Üniversitesi Sosyal Bilimler Dergisi, 27(Aile Özel Sayısı), 333–350. https://doi.org/10.32709/akusosbil.1722337
Kulp, L., Sarcevic, A., Zheng, Y., Cheng, M., Alberto, E., & Burd, R. (2020). Checklist Design Reconsidered: Understanding Checklist Compliance and Timing of Interactions. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, 1–13. https://doi.org/10.1145/3313831.3376853
Lambert, P. (2016). The Data Protection Officer. Auerbach Publications. https://doi.org/10.1201/9781315396743
Lestari, E., & Rasji, R. (2024). Legal Study On Personal Data Protection Based On Indonesian Legislation. Awang Long Law Review, 6(2), 471–477. https://doi.org/10.56301/awl.v6i2.1206
López, O. (2020). Ensuring the Integrity of Electronic Health Records. Productivity Press. https://doi.org/10.4324/9781003105695
Lubello, V., & Vedaschi, A. (2015). Data Retention and its Implications for the Fundamental Right to Privacy. Tilburg Law Review, 20(1), 14–34. https://doi.org/10.1163/22112596-02001005
Lustig, N., Pessino, C., & Scott, J. (2014). The Impact of Taxes and Social Spending on Inequality and Poverty in Argentina, Bolivia, Brazil, Mexico, Peru, and Uruguay. Public Finance Review, 42(3), 287–303. https://doi.org/10.1177/1091142113506931
Lyu, G. (2025). Data-driven decision making in patient management: a systematic review. BMC Medical Informatics and Decision Making, 25(1), 239. https://doi.org/10.1186/s12911-025-03072-x
Mahmoudi, E., Kamdar, N., Kim, N., Gonzales, G., Singh, K., & Waljee, A. K. (2020). Use of electronic medical records in development and validation of risk prediction models of hospital readmission: systematic review. BMJ, m958. https://doi.org/10.1136/bmj.m958
Mansur, A. Al, & Zaman, T. (2023). User Behavior Analytics in Advanced Persistent Threats: A Comprehensive Review of Detection and Mitigation Strategies. 2023 7th International Symposium on Innovative Approaches in Smart Technologies (ISAS), 1–6. https://doi.org/10.1109/ISAS60782.2023.10391553
Muinga, N., Magare, S., Monda, J., English, M., Fraser, H., Powell, J., & Paton, C. (2020). Digital health Systems in Kenyan Public Hospitals: a mixed-methods survey. BMC Medical Informatics and Decision Making, 20(1), 2. https://doi.org/10.1186/s12911-019-1005-7
Naili, Y. T., Afrilies, M. H., Garunja, E., & Purwono, P. (2024). Protection of patient data privacy on IoT devices for healthcare in the era of smart cities: a health law perspective. Jurnal Hukum Novelty, 15(1), 87. https://doi.org/10.26555/novelty.v15i1.a28457
NE Varuhas, J. (2023). Mapping doctrinal methods. In Researching Public Law in Common Law Systems (pp. 70–103). Edward Elgar Publishing. https://doi.org/10.4337/9781789904383.00009
Nurmaidah, N., Kustiningsih, N., & Rahayu, S. (2024). Change management strategy in the implementation of electronic medical record system in the era of digital transformation: Case study at Rahman Rahim Hospital. Gema Wiralodra, 15(1), 228–238. https://doi.org/10.31943/gw.v15i1.656
Osborn, A. G., Louis, D. N., Poussaint, T. Y., Linscott, L. L., & Salzman, K. L. (2022). The 2021 World Health Organization Classification of Tumors of the Central Nervous System: What Neuroradiologists Need to Know. American Journal of Neuroradiology, 43(7), 928–937. https://doi.org/10.3174/ajnr.A7462
Pallocci, M., Treglia, M., Passalacqua, P., Tittarelli, R., Zanovello, C., De Luca, L., Caparrelli, V., De Luna, V., Cisterna, A. M., Quintavalle, G., & Marsella, L. T. (2023). Informed Consent: Legal Obligation or Cornerstone of the Care Relationship? International Journal of Environmental Research and Public Health, 20(3), 2118. https://doi.org/10.3390/ijerph20032118
Prang, K.-H., Canaway, R., Bismark, M., Dunt, D., & Kelaher, M. (2018). The use of public performance reporting by general practitioners: a study of perceptions and referral behaviours. BMC Family Practice, 19(1), 29. https://doi.org/10.1186/s12875-018-0719-4
Rindfleisch, A. (2000). Organizational Trust and Interfirm Cooperation: An Examination of Horizontal Versus Vertical Alliances. Marketing Letters, 11(1), 81–95. https://doi.org/10.1023/A:1008107011529
Saeed, S. A., & Masters, R. M. (2021). Disparities in Health Care and the Digital Divide. Current Psychiatry Reports, 23(9), 61. https://doi.org/10.1007/s11920-021-01274-4
Sarabdeen, J., & Mohamed Ishak, M. M. (2025). A comparative analysis: health data protection laws in Malaysia, Saudi Arabia and EU General Data Protection Regulation (GDPR). International Journal of Law and Management, 67(1), 99–119. https://doi.org/10.1108/IJLMA-01-2024-0025
Schmidt, J., Schutte, N. M., Buttigieg, S., Novillo-Ortiz, D., Sutherland, E., Anderson, M., de Witte, B., Peolsson, M., Unim, B., Pavlova, M., Stern, A. D., Mossialos, E., & van Kessel, R. (2024). Mapping the regulatory landscape for artificial intelligence in health within the European Union. Npj Digital Medicine, 7(1), 229. https://doi.org/10.1038/s41746-024-01221-6
Setyani, S. A., & Mahendro, P. K. (2025). Application of Heuristic Algorithm in Medical Informatics System for Patient Data Management in Southeast Asia. Indonesian Journal of Electronics, Electromedical Engineering, and Medical Informatics, 7(1), 64–76. https://doi.org/10.35882/7ygpx615
Sijabat, H. H., & Tridewiyanti, K. (2022). Feminism criticism of abortion provisions of rape victims according to law number 36 the year 2009 on health. Linguistics and Culture Review, 6, 205–215. https://doi.org/10.21744/lingcure.v6nS5.2139
Suchman, M. C. (1995). Managing Legitimacy: Strategic and Institutional Approaches. Academy of Management Review, 20(3), 571–610. https://doi.org/10.5465/amr.1995.9508080331
Sugiarti, I. (2020). Legal Protection of Patient Rights to Completeness and Confidentiality in Management of Medical Record Documents. The Proceedings of the 2nd Bakti Tunas Husada-Health Science International Conference (BTH-HSIC 2019). https://doi.org/10.2991/ahsr.k.200523.045
Teramoto, A., Sakamaki, K., Shoji, S., & Uemura, K. (2024). Win ratio analysis of short-term clinical outcomes of focal therapy and robot-assisted radical prostatectomy for the patients with localized prostate cancer. Scientific Reports, 14(1), 17019. https://doi.org/10.1038/s41598-024-67592-8
Tilaar, T. S., & Sewu, P. L. S. (2023). Review of Electronic Medical Records in Indonesia and its Developments Based on Legal Regulations in Indonesia and its Harmonization with Electronic Health Records (Manual for Developing Countries). Daengku: Journal of Humanities and Social Sciences Innovation, 3(3), 422–430. https://doi.org/10.35877/454RI.daengku1662
Tourani, R., Misra, S., Mick, T., & Panwar, G. (2018). Security, Privacy, and Access Control in Information-Centric Networking: A Survey. IEEE Communications Surveys & Tutorials, 20(1), 566–600. https://doi.org/10.1109/COMST.2017.2749508
Ugbaja, U. S., Nwabekee, U. S., Owobu, W. O., & Abieba, O. A. (2023). Conceptual Framework for Role-Based Network Access Management to Minimize Unauthorized Data Exposure Across IT Environments. International Journal of Social Science Exceptional Research, 2(1), 211–221. https://doi.org/10.54660/IJSSER.2023.2.1.211-221
van Rest, J., Boonstra, D., Everts, M., van Rijn, M., & van Paassen, R. (2014). Designing Privacy-by-Design (pp. 55–72). https://doi.org/10.1007/978-3-642-54069-1_4
VanGestel, R., & Micklitz, H.-W. (2011). Revitalizing Doctrinal Legal Research in Europe: What About Methodology? SSRN Electronic Journal. https://doi.org/10.2139/ssrn.1824237
Vedder, A., & Spajić, D. (2023). Moral autonomy of patients and legal barriers to a possible duty of health related data sharing. Ethics and Information Technology, 25(1), 23. https://doi.org/10.1007/s10676-023-09697-8
Von Bertalanffy, L. (1968). General system theory. New York, 41973(1968), 40.
Webster, A., & Gardner, J. (2019). Aligning technology and institutional readiness: the adoption of innovation. Technology Analysis & Strategic Management, 31(10), 1229–1241. https://doi.org/10.1080/09537325.2019.1601694
Winter, J. S., & Davidson, E. (2019). Big data governance of personal health information and challenges to contextual integrity. The Information Society, 35(1), 36–51. https://doi.org/10.1080/01972243.2018.1542648
Xiao, D., Song, C., Nakamura, N., & Nakayama, M. (2021). Development of an application concerning fast healthcare interoperability resources based on standardized structured medical information exchange version 2 data. Computer Methods and Programs in Biomedicine, 208, 106232. https://doi.org/10.1016/j.cmpb.2021.106232
Yeng, P. K., Fauzi, M. A., Sun, L., & Yang, B. (2022). Assessing the Legal Aspects of Information Security Requirements for Health Care in 3 Countries: Scoping Review and Framework Development. JMIR Human Factors, 9(2), e30050. https://doi.org/10.2196/30050
Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. PublicAffairs.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Tya Amelia
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgment of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).