2.1. Legal repetition: clarity enhancer or source of confusion?

Unauthorised disclosure of healthcare information in China is clearly prohibited under Article 92 of the BHL (2020). However, it is not an isolated provision as it aligns with overlapping protections in other statutes. Article 28 of the PIPL (2021) prohibits “processing”Footnote ²¹ of one’s “sensitive personal information,”Footnote ²² including health data, without explicit consent. Article 1032 of the Civil Code (2020) enshrines privacy rights, barring the disclosure of private matters. Article 1226 of the Civil Code (2020) strengthens this by explicitly forbidding the unauthorised sharing of medical records or personal health data. In short, all three statutes strictly prohibit the disclosure of a patient’s healthcare information. While these provisions collectively reinforce the sanctity of healthcare privacy, their redundancy raises questions about legislative coherence. However, such repetition may serve strategic purposes under the rule of law, as articulated below.

Firstly, it may enhance accessibility of legal protections. Legal repetition mitigates the risk of oversight by ensuring citizens encounter protections across multiple statutes. For instance, individuals unfamiliar with the Civil Code, a sprawling 1,260-article document, may still learn their rights through the more accessible BHL.Footnote ²³ This redundancy mirrors the principle of promulgation, which emphasises that laws must be publicised and understandable to those they bind. By embedding key protections in diverse legal instruments, China enhances public awareness and accessibility, fulfilling a core tenet of the rule of law (Kohl, Reference Kohl2005, p. 27; Raz, Reference Raz2009, p. 214).

Secondly, it may attain cognitive reinforcement through repetition. Psychological studies indicate that repeated exposure to information improves retention, a principle applicable to legal norms (Guthrie and Powers, Reference Guthrie, Powers, Guthrie and Powers1950, pp. 93–95; Haleem et al., Reference Haleem, Khan, Sufia, Chaudhry, Siddiqui and Khan2016; Hartley, Reference Hartley1998, p. 17). When citizens encounter prohibitions against healthcare data misuse in the Civil Code, PIPL, and BHL, the likelihood of internalising these rights increases. This “imprinting effect” strengthens legal clarity by embedding norms into public consciousness, reducing ambiguity about permissible conduct (Guthrie and Powers, Reference Guthrie, Powers, Guthrie and Powers1950, pp. 93–95; Haleem et al., Reference Haleem, Khan, Sufia, Chaudhry, Siddiqui and Khan2016; Hartley, Reference Hartley1998, p. 17). For example, repeated references to “explicit consent” across statutes remind both individuals and institutions of essential privacy safeguards.

Lastly, it may signal legislative priority to administrative bodies. Legal repetition in itself also serves as a tool to signal the state’s prioritisation of healthcare data protection, compelling administrative agencies to align enforcement practices with legislative intent. When multiple laws echo the same mandate, as seen in the anti-disclosure provisions, they create a unified directive for regulators. This consistency curbs arbitrary interpretations, ensuring that local health bureaus or medical institutions cannot plausibly claim ignorance of the law. The National Health Commission’s (NHC) guidelines on data breaches (2022), which cite all three statutes, exemplify how repetition fosters cohesive regulatory action.

Nonetheless, this paper argues that, in the context of the BHL, legal repetition undermines the very clarity it purports to serve.

Firstly, the BHL’s repetition generates confusion and negatively contributes to the rule of law in respect of clarity (Golden, Reference Golden2016, p. 633). To elaborate, reference can again be made to the right against disclosure of an individuals’ healthcare information in the BHL, PIPL, and the Civil Code. Despite the fact that all three of the above-mentioned statute prohibits such disclosure, it is only the BHL which did not provide that such prohibition is subjected to the consent of the individual patient. Specifically, Article 29 of the PIPL (2021) and Article 1226 of the Civil Code (2020) provide that an individuals’ healthcare information may be disclosed if consent from the said individual to do so has been obtained.

This is problematic because, as previously stated, one benefit to legal repetition is its ability to improve the accessibility to a particular law. However, in this scenario, such repetition has created a scenario whereby a crucial aspect of the right against the disclosure of an individuals’ healthcare information was omitted (Golden, Reference Golden2016, p. 633). This omission not only undermines the accessibility rationale but also generates genuine legal ambiguity (Golden, Reference Golden2016, p. 633). Individuals and institutions face conflicting standards, eroding clarity, a core tenet of the rule of law. For instance, a hospital disclosing data under Civil Code’s “express consent” might unknowingly violate the BHL, which lacks such exceptions.

The 2020 case of Feng Mou [anonymised party surnamed Feng] v. Liaoyuan Second People’s Hospital illustrates both the potential and pitfalls of legal repetition.Footnote ²⁴ In this case, the Claimant’s healthcare information was disclosed by the Liaoyuan Second People’s Hospital for the purposes of dispelling a suspicion that the Claimant had obtained a mental disorder diagnosis through a personal connection. It is important to first note that despite the disclosure had occurred on 13 July 2020, the Court had not made any references to the Article 92 of the BHL (2020)Footnote ²⁵ and had instead only relied on the Civil Code to adjudicate this decision. While this demonstrates that overlapping laws can protect rights, it also reveals a critical risk: had the court applied only the BHL, which lacks consent exceptions, the hospital’s liability might have been misjudged. Specifically, the Courts decide that obtaining consent of the individual patient does not preclude the disclosing party from a liability under Article 92 of BHL (2020). This underscores how inconsistent repetition breeds judicial unpredictability, contradicting the principle that laws must provide clear guidance.

Secondly, the purported benefits of imprinting and signalling arising from legal repetition in the BHL are fundamentally illusory. To unpack this assertion, two foundational premises must be clarified. (1) Imprinting: While repetition theoretically reinforces public awareness of rights (e.g. privacy protections), conflicting legal standards across statutes—such as divergent consent requirements for healthcare data disclosure—undermine this goal. Citizens confronted with contradictory rules (e.g. Civil Code allowing “express consent” vs. BHL omitting consent exceptions) face cognitive dissonance, eroding clarity rather than enhancing it. (2) Signalling: Legal repetition ostensibly signals legislative priorities to ensure consistency. However, inconsistencies in core definitions (e.g. “consent” thresholds in the PIPL vs. Regulations of Shenzhen Special Economic Zone on Health) reveal a fractured legal landscape. For instance, the Shenzhen Regulations permit anonymisation as an alternative to consent, while the Civil Code does not, a contradiction that destabilises administrative coherence. Thus, the BHL’s repetition fails to achieve its theoretical benefits, as overlapping but conflicting provisions prioritise quantity of legislation over quality of governance.

The premise that legal repetition inherently fosters clarity and coherence relies on an unrealistic expectation of legislative perfection (Guthrie and Powers, Reference Guthrie, Powers, Guthrie and Powers1950, p. 94). Legislators would need to draft laws with absolute consistency, free of contradictions or ambiguities, across all statutes, a standard rendered implausible by the dynamic and multifaceted nature of legal systems. This challenge is starkly evident in China’s fragmented approach to regulating healthcare information disclosure, exemplified by four conflicting legal standards. Article 92 of the BHL (2020) categorically prohibits unauthorised disclosure of healthcare data without acknowledging consent as a valid exemption. This omission creates ambiguity, as other statutes explicitly permit disclosure under consent-based conditions. While Article 28 of PIPL (2021) permits processing sensitive health data only with separate consent, a stricter threshold requires explicit, context-specific authorisation.

These inconsistencies reveal a systemic flaw: overlapping laws intended to reinforce protections instead generate contradictions, undermining both public understanding and administrative compliance. For instance, a hospital adhering to the PIPL’s “separate consent” requirement might inadvertently violate the BHL’s blanket prohibition, exposing institutions to legal risks and individuals to arbitrary enforcement. Such fragmentation illustrates how legislative repetition, far from signalling coherence, entrenches confusion and erodes trust in the rule of law.

China’s Civil Code (2020) permits the disclosure of healthcare information with express consent, a broad term encompassing both oral and written authorisation (Satyanarayana Rao, Reference Satyanarayana Rao2008, p. 33).Footnote ²⁶ Shenzhen Regulations adopts a bifurcated approach: disclosure is permissible either through written consentFootnote ²⁷ or by anonymising the data to remove personal identifiers. The Civil Code and the Shenzhen Regulations diverge because anonymisation and consent operate differently: the former removes identifying characteristics from the data, while the latter requires the patient’s authorisation before disclosure (Han, Reference Han2024). These divergent standards exemplify the fragmented legal landscape governing healthcare data, which undermines clarity and predictability.

More specifically, the dimensions of legal conflict may be trifold. Firstly, Article 92 of the BHL prohibits unauthorised disclosure without clarifying the role of consent, whereas the PIPL, Civil Code, and Shenzhen Regulations expressly permit disclosure under specified consent-based conditions. Secondly, these instruments adopt different consent thresholds. The PIPL requires separate consent, the Civil Code recognises express consent, and the Shenzhen Regulations require written consent or anonymisation. These standards are not equivalent, creating uncertainty regarding the level of authorisation required for lawful disclosure. Thirdly, the Shenzhen Regulations permit disclosure through anonymisation without obtaining consent, departing from the autonomy-based approach reflected in the Civil Code and PIPL. Together, these inconsistencies create uncertainty regarding the circumstances under which healthcare information may lawfully be disclosed.

The coexistence of conflicting provisions thus defeats the rationale for repetition (Reed, Reference Reed1946, p. 76). For example, an individual relying on the BHL might believe that disclosure is universally prohibited, unaware that other statutes permit it under varying conditions. Similarly, administrators face conflicting directives: anonymisation (Shenzhen) vs. consent (PIPL). Such contradictions breed confusion, eroding trust in the legal system. To rectify this, China must harmonise consent standards and clarify hierarchical relationships between laws, ensuring that repetition serves coherence not confusion. The fragmentation is not merely a technical drafting failure but also a social condition in which the formal guarantees of the law in books become unreliable guides to the law in action, and in which the citizen’s nominal entitlements diverge from what can in practice be claimed or enforced (Pound, Reference Pound1910).

2.2. Systematic interpretation: complexity harmoniser or confusion catalyst?

The existence of an interpretive solution does not eliminate the rule of law concerns identified in Section 2.1. The issue is not whether legal experts can ultimately reconcile conflicting provisions through systematic interpretation, but whether ordinary citizens, healthcare institutions, and lower-level administrators can reasonably identify their rights and obligations without undertaking complex legal analysis. A framework that requires extensive interpretive reconstruction may remain formally coherent while nevertheless falling short of the rule of law’s requirements of accessibility and clarity. While the BHL, Civil Code, PIPL, and Shenzhen Regulations appear to conflict on healthcare data disclosure, this paper contends that these contradictions can be resolved through systematic interpretation. To harmonise these laws, the following three-step framework may be adopted.

The first step is to reconcile the BHL’s Ambiguity. Article 92 of the BHL (2020) prohibits “illegal” disclosures but does not explicitly define lawful exceptions. The term “illegal” implies that lawful disclosures exist, contingent on other statutes. This interpretation is supported by the case Xu Mou [anonymised party surnamed Xu] v. Hospital (2023), where a court ruled that unauthorised sharing of patient records violated the law, citing Article 1226 of Civil Code (2020) and Article 28 of PIPL (2021). The ruling affirmed that disclosures without consent are unlawful, indirectly validating consent as a legitimate exception under the BHL.

The second step is to resolve Civil Code v. Shenzhen Regulations. The Civil Code permits disclosure with express consent, oral or written, while the Shenzhen Regulations require either written consent or anonymisation. To reconcile this, Article 29 of the PIPL (2021), which grants precedence to specialised regulations, may justify applying the Shenzhen standard within the Shenzhen Special Economic Zone as a more specific regulatory requirement. Thus, the stricter requirement of written consent applies, effectively modifying the Civil Code’s general rule in this jurisdiction.

And the third step is to clarify “Separate Consent” Under the PIPL. The PIPL mandates separate consent, a requirement that consent be specific, informed, and unbundled from other permissions. This standard can coexist with the Civil Code’s “express consent” if interpreted cumulatively, i.e. firstly obtain express consent (oral/written authorisation) and then ensure that consent is separate (not tied to unrelated agreements). For example, a hospital seeking to share data must first secure explicit patient approval (express consent) and ensure that approval pertains solely to the intended disclosure (separate consent).

Applying this framework to Shenzhen yields a harmonised threshold: “separate written consent”Footnote ²⁸ for healthcare data disclosure. This standard integrates the PIPL’s requirement for specificity (separate consent), the Shenzhen Regulations’ emphasis on formal authorisation (written consent), and the Civil Code’s foundational principle of patient autonomy (express consent). By resolving ambiguities through hierarchical and cumulative interpretation, China’s legal system can transform fragmentation into coherence and advance towards a unified standard.

While the preceding analysis demonstrates that the BHL, Civil Code, PIPL, and Shenzhen Regulations are theoretically reconcilable,Footnote ²⁹ it also reveals the inherent complexity of the BHL. As illustrated, Article 92 of the BHL (2020) operates only through awareness of interlocking statutes, yet it fails to specify which ones. This ambiguity complicates compliance and judicial interpretation. Furthermore, this paper argues that Article 92 appears capable of increasing the length and complexity of court judgements addressing unauthorised disclosures of healthcare information, as seen in comparative case law. For example, the case Xu Mou v. Hospital (2023), which referenced the Civil Code, PIPL, and BHL, produced a far lengthier ruling than the earlier case Feng Mou v. Hospital (2021), which solely relied on the Civil Code. This divergence underscores how legal intricacy escalates with the number of statutes involved.

Such complexity, this paper argues, undermines the clarity essential to the rule of law. Two critical points justify this position. Firstly, clarity reduces enforcement costs (Waye, Reference Waye2008, p. 279). Clear laws enable lawyers to confidently advise clients, empowering citizens to assert their rights and deterring arbitrary abuses of power. Conversely, complex or ambiguous lawsFootnote ³⁰ inflate enforcement costs (de Lucio and Mora-Sanguinetti, Reference de Lucio and Mora-Sanguinetti2022) by prolonging litigation and increasing legal fees (Friedman, Reference Friedman1989, pp. 20–21; Maurer, Thomas and DeBooth, Reference Maurer, Thomas and DeBooth1999, pp. 322–323). This financial burden risks discouraging individuals from pursuing legitimate claims, eroding public trust in China’s legal system (Friedman, Reference Friedman1989, pp. 20–21), even where substantive protections for healthcare privacy exist. Secondly, the BHL’s complexity is unnecessary.Footnote ³¹ Unlike the PIPL, which introduced novel safeguards like “separate consent,” the BHL merely reiterates the Civil Code’s prohibition against unauthorised disclosures.Footnote ³² It adds no substantive protections, instead layering procedural ambiguity.

In sum, the BHL’s legal complexity represents a systemic failure to align with the rule of law’s foundational demand for clarity, a principle enshrined in legal philosophy and indispensable for just governance. By weaving redundancies into China’s healthcare data regime and layering ambiguities onto existing statutes like the Civil Code and PIPL, the BHL undermines both its own efficacy and the broader legitimacy of China’s legal system. It hinders enforcement of rights against unauthorised data disclosures without enhancing individual protections. Simplification, not proliferation, should guide future reforms as simplification is not a retreat from rigour but a recommitment to the rule of law’s core promise: that justice, to be just, must be knowable. The availability of a coherent interpretive framework for specialists does not resolve the underlying rule of law concern. Law’s social significance lies in how it is experienced and acted upon by those it governs; a statutory scheme that requires expert reconstruction before it can be understood is, by that measure, already failing the citizens it purports to protect (Cotterrell, Reference Cotterrell2005).

2.3. The publication of BHL decisions: a need for transparency of rules

The enforcement of China’s BHL, while a legislative milestone in modernising healthcare governance, is marred by systemic deficiencies that undermine the rule of law’s foundational principles of clarity and transparency. This section critically examines two interrelated flaws in its implementation: the asymmetrical publicity of administrative decisions and the absence of rigorous legal reasoning within such rulings. By situating these issues within the theoretical framework of legality and contrasting them with global best practices, this analysis demonstrates how opaque enforcement mechanisms perpetuate ambiguity, erode public trust, and risk institutionalising arbitrary power.

Fuller’s principles of legality hold that, for a legal system to function coherently, laws must be public, clear, and applied consistently. Administrative decisions, which interpret and enforce statutory provisions, are pivotal in translating abstract legal norms into actionable standards. However, in China, administrative rulings under the BHL lack the systematic publicity accorded to judicial decisions,Footnote ³³ creating a chasm between legislative intent and practical enforcement. A case in point is Article 101 of the BHL, which requires medical healthcare institutes to ensure that their medical information security system is sound and imposes penalties on healthcare institutions for two distinct categories of failure, i.e. First Limb: Deficiencies in medical quality management systems, technology protocols, or safety measures,Footnote ³⁴ and Second Limb: Inadequate information security safeguards leading to data breaches.Footnote ³⁵

While the administrative ruling in A Ju, B Gongsi [Bureau A and Company B] (2024) clarifies the First Limb’s scope, fining institutions for procedural lapses such as incomplete medical records or prescriptions,Footnote ³⁶ no equivalent guidance exists for the Second Limb. This asymmetry leaves healthcare providers and regulators alike in a state of uncertainty.Footnote ³⁷ For instance, what constitutes an “unsound” security system under the Second Limb? How are penalties calibrated to reflect breach severity? Without published precedents, compliance becomes a speculative endeavour, and enforcement risks devolving into subjective discretion.

Contrast this with the European Union’s General Data Protection Regulation (GDPR), which mandates the publication of enforcement decisions, complete with detailed rationales for penalties. The European Data Protection Board maintains a public register of cases, enabling stakeholders to discern patterns in regulatory priorities and compliance expectations. This transparency not only enhances legal clarity but also fosters a culture of proactive adherence to data protection norms.

China’s opacity contravenes such global benchmarks. As a WTO member, China is obligated under the Trade Policy Review Mechanism to ensure transparency in trade-related regulations. Yet, the selective publication of administrative rulings under the BHL undermines this commitment, perpetuating a legal environment where stakeholders operate in the dark. The principle of congruence between declared rules and official action is thus violated, as the gap between statutory text and enforcement practice widens.

Even when administrative decisions are accessible, they often lack the rigorous legal reasoning characteristic of judicial rulings. The BHL does not mandate authorities to document evaluations of arguments presented by the accused, resulting in opaque and conclusory outcomes. In A Ju, B Gongsi (2024), for example, the administrative body imposed fines under Article 101’s First Limb without addressing the defendant’s submissions or explaining how procedural lapses violated statutory requirements. This omission contravenes the requirement that legal rules be applied consistently and in a manner congruent with their stated purposes. In common law jurisdictions like the United Kingdom, administrative tribunals are required to issue written decisions detailing evidence, legal standards, and analytical reasoning, a practice upheld in landmark cases such as R (Cart) v. Upper Tribunal (2011). These documents serve as public records that elucidate the logic behind enforcement, enabling stakeholders to align their conduct with legal expectations. By contrast, China’s administrative rulings resemble executive decrees, devoid of the transparency necessary to demystify enforcement logic.

The lack of documented rationale perpetuates legal ambiguity in three critical ways:

1. 1. Inconsistent Enforcement: Without clear benchmarks, penalties may vary arbitrarily across jurisdictions. A hospital in Shanghai might face fines for minor documentation errors, while a similar institution in Chengdu escapes penalty despite comparable infractions.

2. 2. Erosion of Accountability: Officials are not compelled to justify decisions, insulating enforcement practices from public scrutiny and judicial review.

3. 3. Stifled Compliance: Institutions cannot discern regulatory priorities, fostering a compliance culture driven by risk aversion rather than ethical governance.

This systemic opacity aligns with scholarly critique of China’s administrative law framework, where “the rule of law is often subordinated to political objectives” (Peerenboom, Reference Peerenboom2002), producing a regulatory environment in which legal predictability is subordinated to administrative convenience.

3.1. Data-processing objection rights absence

Objection rights serve as indispensable safeguards against the abuse of institutional power, for two interconnected reasons. Firstly, privacy as autonomy. Articles 33 and 49 of the BHL (2020) establish healthcare institutions’ duty to protect patient privacy but paradoxically omit individual control mechanisms. This creates a unilateral obligation structure where institutions determine data use without patient recourse. As philosopher Alan Westin theorised, privacy constitutes “the claim of individuals to determine what information about themselves is communicated to others” (Westin, Reference Westin1968). The BHL’s framework thus contravenes the core purpose of privacy protection by denying agency. Secondly, sensitivity-governance nexus. Healthcare data’s inherently sensitive nature, capable of revealing genetic predispositions, mental health conditions, or infectious diseases, demands heightened safeguards. Article 21 of the European Union’s GDPR recognises this by mandating objection rights,Footnote ³⁸ acknowledging that uncontrolled processing enables discrimination, stigmatisation, and exploitation (Paterson and McDonagh, Reference Paterson and McDonagh2018, pp. 22–23). China’s statutory silence on objections disregards this universal principle despite ratifying WHO guidelines affirming “individuals should exercise control over their health data” (World Health Organization, 2017).

The BHL’s deficiency becomes acute when contrasted with the PIPL as illustrated in Table 1.

Table 1.

Deterrence frameworks in Chinese data law: PIPL and BHL contrasted

Table 1. Long description

A table comparing deterrence frameworks in Chinese data laws PIPL and BHL. The table has three rows and three columns. Column headers are Objection Rights, Enforcement Mechanism, and Liability Deterrence. Row labels are PIPL (2021) and BHL (2020). Row 1: Objection Rights, PIPL (2021): Explicit (Article 44), BHL (2020): Absent. Row 2: Enforcement Mechanism, PIPL (2021): Individual litigation pathway, BHL (2020): Institutional self-regulation. Row 3: Liability Deterrence, PIPL (2021): Direct citizen empowerment, BHL (2020): Top-down administrative control.

This legislative misalignment generates systemic risks, including (a) asymmetric obligations, i.e. healthcare institutions bear duty-bound responsibilities under Article 33 of BHL (2020) but face no countervailing citizen enforcement tools; (b) deterrence collapse, i.e. without the right to object, the “threat of liability” essential to constrain power evaporates; and (c) regulatory arbitrage, i.e. institutions may prioritise BHL compliance over PIPL standards, exploiting the weaker accountability framework and increasing the possibility of an abuse of power (Auby, Reference Auby1970, p. 553; Boughey, Reference Boughey2022, p. 144).

Critics arguing PIPL suffices overlook institutional path dependency.Footnote ³⁹ As evidenced in the Feng Mou case (2021), courts frequently apply sector-specific laws, e.g. BHL in isolation from general statutes PIPL. When the BHL lacks objection rights, judges default to its limited provisions, precisely the scenario in Feng Mou, where the court applied Civil Code remedies but ignored BHL’s institutional dutyFootnote ⁴⁰ and PIPL’s objection frameworkFootnote ⁴¹ . The Feng Mou precedent illustrates how the BHL’s omission enables Abuse of Power as institutional breach incurred financial liability but no systemic correction, enabling repeat violations. This reflects the warning that when laws lack “congruence between official action and declared rule” (Fuller, Reference Fuller1969), accountability becomes illusory. By not embedding objection rights, the BHL permits administrative bodies to process data under “public health” justifications without challenge, forces citizens into post-breach litigation rather than preventative control, and creates regulatory safe havens where institutional convenience overrides patient autonomy.

The paper deems that incorporating objection rights into the BHL would align China’s healthcare governance with global standards while curbing Abuse of Power, while actions may include (a) legislative amendment, e.g. inserting Article 33bis: “Patients retain the right to object to processing of their healthcare information, subject to PIPL Article 44 standards.”; (b) enforcement synergies, for example, require healthcare institutions to implement objection portals in electronic health systems and mandate provincial health bureaus to report objection rates in annual transparency audits; (c) judicial safeguards, for instance, adopt a hierarchical application principle instructing courts to “Apply BHL provisions in conjunction with PIPL’s rights framework, prioritising specialised statutes only where they enhance, not diminish, individual protections.” However, scholars and institutions caution that the theoretical underpinnings of objection rights warrant careful consideration. As Humerick argues, permitting objections may inadvertently hinder innovation by restricting access to comprehensive datasets needed for research breakthroughs (Humerick, Reference Humerick2018). More critically, and of greater ethical significance, these rights risk generating systemic bias in outcomes. When individuals exercise objections, their exclusion creates data gaps that distort analytical results. The World Health Organization emphasises that such missing data structurally skews findings, producing non-representative samples that compromise validity (World Health Organization, 2023). This selection bias disproportionately impacts marginalised groups who may distrust data-sharing mechanisms, thereby exacerbating inequities. Consequently, while autonomy protections are essential, policymakers must weigh these trade-offs: unchecked objection rights may undermine both scientific progress and equitable results through self-censorship and fragmented data landscapes. Balancing individual agency with collective research integrity thus emerges as a pivotal challenge.

To render the proposed objection right practically effective rather than merely declaratory, the BHL amendment should specify a concrete procedural mechanism. Concretely, a patient wishing to object to the processing of their healthcare information should be able to submit a written or electronic objection form, available both at hospital registration desks and through the institution’s official patient portal, identifying the data category, the processing activity objected to, and the grounds for objection. Upon receipt, the healthcare institution should be required to acknowledge the objection within five working days and issue a substantive written response within thirty calendar days, either granting the objection and suspending the relevant processing or refusing it with documented reasons referencing the specific statutory basis under the BHL or PIPL. Where the institution refuses the objection, or where no response is received within the prescribed period, the patient should be entitled to escalate the matter to the relevant provincial Health Commission through a standardised administrative review procedure under Articles 6 and 47 of the Administrative Review Law of the People’s Republic of China (2023). Such administrative review should be free of charge, accessible without legal representation, and concluded within 60 days. Should administrative review prove unsatisfactory, patients should retain the right to initiate administrative litigation before the competent People’s Court pursuant to the Administrative Litigation Law (2017), with courts expressly instructed, consistent with the judicial safeguard proposed above, to apply PIPL Article 44’s rights framework in conjunction with the BHL. This tiered mechanism, combining institutional responsiveness, administrative oversight, and judicial recourse, would ensure that the objection right constitutes a meaningful, low-barrier channel for contesting data processing rather than a formal entitlement of no practical effect.

Moreover, the BHL’s exclusion of data-processing objection rights constitutes more than a legislative oversight, and it actively enables institutional overreach by disrupting the rule of law’s accountability feedback loop. Nevertheless, without remedial integration of PIPL’s safeguards, healthcare governance risks degenerating into a system where privacy duties exist on paper but vanish in practice. As China advances its “Healthy China 2030” agenda, aligning sectoral laws with foundational rights protections remains imperative to prevent well-intentioned frameworks from becoming instruments of arbitrary power.

3.2. Use-case governance deficits

Despite the provision of an obligation on healthcare institutions to protect its patient’s privacy, the BHL fails to codify binding use-case provisions (World Health Organization, 2023, pp. 21–23), explicit parameters governing permissible healthcare data applications, and constitutes a critical legislative void. This omission fundamentally sabotages Article 49’s mandate to integrate AI into healthcare while enabling institutional overreach. Without statutory constraints defining how data may be processed, China’s health governance framework violates core rule of law principles: transparency, accountability, and congruence between legislative intent and operational practice.

Use-case provisions establish three core safeguards: (a) purpose specification, limiting processing to defined objectives like epidemiological research; (b) methodology constraints, requiring anonymisation or algorithmic audits; and (c) beneficence requirements, mandating measurable public health outcomes.Footnote ⁴² Their absence contravenes the congruence principle, which demands alignment between the BHL’s stated goal of health rights protection and its operational rules. In practice, Article 49’s AI mandate may create scope for experimental profiling absent adequate safeguards when detached from purpose limitations. This may expand institutional discretion over the use of sensitive health data that is capable of revealing, for example, genetic predispositions or mental health conditions.

AI systems operationalise the “garbage in, garbage out” dynamics: training data (inputs) directly determines algorithmic outputs. Absent use-case rules, healthcare institutions may deploy irrelevant data streams with impunity. Consider a diagnostic tool trained on mental health records to predict cancer, a mismatch generating clinically invalid and discriminatory outputs. A recent systematic review found that, among 390 clinical AI/ML studies, 84% of global models did not report the racial composition of their training data and 31% did not report gender data, raising concerns about the transparency, generalisability, and fairness of clinical AI systems (Otokiti, Shih and Williams, Reference Otokiti, Shih and Williams2025). Such outcomes directly violate Article 33’s privacy protections and the International Covenant on Economic, Social and Cultural Rights (Article 12). Concrete manifestations include vaccine distribution algorithms prioritising affluent postcodes when fed financial data or pharmaceutical firms commercialising unconsented genetic data. These are not hypotheticals; they represent foreseeable risks associated with unconstrained processing.

Statutory use-case frameworks constrain power through three mechanisms: establishing bright-line boundaries for lawful processing, creating liability triggers for ultra vires exploitation, and enabling judicial review via measurable compliance standards. Contrast this with the PIPL, where Article 17’s purpose disclosure requirement lacks sector-specific constraints for healthcare. This deficiency creates enforcement silos, evidenced in the Feng Mou case, where courts applied the Civil Code in isolation from PIPL safeguards. A hypothetical illustrates the stakes: provincial authorities repurposing pregnancy records to predict “social stability risks.” Without use-case rules, victims have no judicial recourse for such mission creep. With such rules, courts could issue automatic ultra vires rulings against non-medical data applications.

Effective models exist to rectify this deficit. The EU’s GDPR Article 5(1)(b) mandates ex ante purpose specification, compatibility assessments for data repurposing, and documentation proving alignment. Similarly, NHS England’s Care Data Framework institutes independent ethics review panels, public project dashboards, and algorithmic impact assessments (Department of Health and Social Care, 2021). These systems recognise that health data processing, particularly AI-driven applications, demands purpose-led governance to ensure that the deployment of technology does not override applicable ethical and legal constraints. China’s current framework places comparatively greater emphasis on innovation objectives than on ex ante accountability mechanisms.

China’s statutory silence on use-case governance leaves open the possibility of unconstrained data exploitation, inconsistent with both the BHL’s own privacy protections and the rule of law’s demand that the exercise of institutional power be bounded and purposive. Explicit use-case provisions would close this gap.

Therefore, this paper proposes that amending Article 49 to incorporate use-case governance would align the BHL with global standards, which may be worded as “Health data processing for AI development shall: (a) Serve defined public health objectives enumerated in Annex 7; (b) Undergo independent algorithmic bias audits biannually; (c) Prohibit derivative use beyond original consent scope.” Furthermore, complementary enforcement mechanisms should include citizen challenge rights, e.g. 30-day objection windows for non-compliant projects, public algorithmic registries disclosing training datasets, and mandatory conformity with WHO’s Ethics and Governance of AI for Health guidelines. These steps would bring the BHL into conformity with the rule of law’s requirement that institutional power be both bounded and purposive, the condition that Locke regarded as the only reliable check on its abuse.

3.3. Auditing mechanism vacuum

The rule of law’s prohibition against abuse of power necessitates not merely the existence of rules but also effective operationalisation mechanisms (Dawood, Reference Dawood2008, p. 1435). China’s BHL undermines this principle by omitting mandatory auditing requirements for healthcare data collection and processing. The omission creates two related problems: it disables detection of algorithmic biases that may violate health rights, and it removes a significant deterrent against unlawful data exploitation. While Article 33 BHL promises privacy protection, the absence of verification mechanisms renders that guarantee declaratory rather than operative, and leaves healthcare institutions without external accountability for their data practices.

Operationalising the framework necessitates audits as systemic congruence enforcers. Effective audits verify compliance through documented assessments of data practices, generate corrective feedback by identifying violations before harm materialises, and create institutional accountability loops. The BHL’s void eliminates these safeguards, directly contradicting its mandate to integrate AI into healthcare.Footnote ⁴³ AI systems inherently propagate biases through flawed data provenance, such as training sets underrepresenting rural populations or proxy discrimination that correlates postal codes with health outcomes. Without audits, these distortions become undetectable public health threats (Humerick, Reference Humerick2018, p. 408). This danger is illustrated in China by the wide deployment of IBM’s Watson for Oncology across hundreds of Chinese hospitals from 2016. Trained exclusively on data from a US elite cancer centre, the system exhibited severe structural bias: peer-reviewed studies found that its treatment recommendations aligned with Chinese clinical practice in only 12% of gastric cancer cases, China’s most prevalent cancer, because the algorithm had no exposure to Eastern disease profiles, locally available pharmaceuticals, or Chinese clinical guidelines (Zhou et al., Reference Zhou, Zhang, Lv, Hao, Li, Zhu, Zhu and Jiang2019; Tian et al., Reference Tian, Liu, Wang, Cao, Liu, Ji, Li and Sun2020). The patients bearing the greatest burden of these failures were those at lower-tier and rural hospitals, precisely the populations with least specialist oversight to correct the algorithm’s errors, and those already excluded from equitable resource allocation by China’s urban–rural structural divide. Chinese medical scholars have themselves identified that such algorithmic bias leads to unequal distribution of healthcare resources and damages health equity, yet the system operated without mandatory equity audits or independent regulatory review. Such outcomes violate Article 12 of the International Covenant on Economic, Social and Cultural Rights (1976), discriminating against vulnerable groups while evading scrutiny behind proprietary, opaque systems.

This audit deficit simultaneously collapses deterrence against unlawful data exploitation. Audits generate accountability through three channels: raising detection certainty via proactive reviews, enabling precise liability attribution through documentary trails, and imposing reputational costs that incentivise compliance. The BHL’s omission dismantles this architecture, reducing enforcement to reactive patient complaints rather than systemic oversight. Shanghai’s 2025 incident, where nearly 40,000 newborn records of over ten hospitals were sold to various marketers (China News, 2025; QQ News, 2025), surfaced only through whistleblowers because no routine audit mechanism existed to detect it. Where no credible prospect of detection exists, institutional incentives to comply with data protection obligations are correspondingly reduced.

Globally, robust frameworks demonstrate rectifiable pathways. The NHS Data Audit Framework mandates biannual independent reviews of algorithmic processing, while Australia’s My Health Records Act empowers a National Audit Office to conduct unannounced system inspections. GDPR Article 30 further requires detailed processing logs subject to regulatory scrutiny. China can integrate these models through a targeted BHL amendment: The law should mandate annual independent audits assessing PIPL compliance, algorithmic bias mitigation, and breach response protocols. Implementation requires auditor accreditation programmes, standardised metrics aligned with WHO’s AI ethics guidelines, and cross-referenced enforcement tying audit compliance to hospital licencing.

For this audit framework to achieve genuine independence within the Chinese institutional context, greater specificity is required on three operational dimensions. Firstly, regarding the identity of the supervising regulatory body, primary oversight responsibility should be vested in the NHC, which already exercises licencing authority over healthcare institutions under the BHL, acting in coordination with the Cyberspace Administration of China (CAC) for AI-specific data-processing issues falling within the CAC’s jurisdiction under the PIPL. This dual-authority structure mirrors the coordinated approach adopted in the EU, where national supervisory authorities cooperate with the European Data Protection Board on cross-border matters and would prevent enforcement silos of the kind evidenced in the Feng Mou litigation discussed above. A standing inter-agency Joint Audit Coordination Committee, composed of NHC and CAC representatives together with two independent academic experts appointed by the state Council, should be established to issue binding audit standards, resolve jurisdictional disputes, and produce an annual consolidated enforcement report.

Secondly, concerning auditor independence, direct structural conflicts of interest must be addressed. Third-party auditors should be drawn exclusively from firms accredited by the China National Accreditation Service for Conformity Assessment under criteria that preclude any firm from auditing an institution to which it has provided paid consulting services within the preceding three years. Auditors should be subject to mandatory rotation on a maximum five-year cycle per institution, and individual audit team members should be barred from subsequent employment with any audited institution for a period of two years following the audit. Financial independence should be secured by channelling audit fees through a centrally administered NHC escrow fund rather than permitting direct payment from the audited institution to the auditor, thereby removing the financial dependency that has undermined audit independence in comparable regulatory contexts globally.

Thirdly, with respect to the synthesis and public communication of audit results, institutions should be required to publish a standardised Annual Data Governance Summary on their official websites and on a centralised NHC public register within 90 days of audit completion. This summary should include, at minimum, the overall compliance rating on a four-tier scale, a non-technical description of identified algorithmic bias findings and the corrective measures required, the status of any prior-year recommendations, and the timeline for remediation of outstanding deficiencies. Redactions should be permitted only where disclosure would constitute a direct security risk, as assessed by the Joint Audit Coordination Committee, and the fact and scope of any redaction must itself be publicly noted. This structure would ensure that audit results function not merely as internal compliance records but also as genuine instruments of public accountability, enabling patients, civil society, and the research community to monitor institutional behaviour over time and assess whether China’s healthcare data governance is, in practice, congruent with the protections declared in the BHL.

This reform also addresses Antonin Scalia’s warning against “the rule of law as a law of rules” (Scalia, Reference Scalia1989) deficiency, where procedural gaps undermine substantive rights. Without independent audit mechanisms, China’s stated commitment to AI-enabled healthcare cannot be reconciled with its obligations under the rule of law, which requires that the exercise of power over individuals be both verifiable and accountable.