A clinic or hospital leaked my medical information in Malaysia. What can I do?

Health information is among the most sensitive information about a person. Examples of leaks include a nurse sharing a patient's diagnosis in a WhatsApp group, a clinic sending test results to the wrong person, an employer being told about an employee's condition without consent, or a hospital system being hacked.

What duty of confidentiality do doctors owe?

• Doctors owe patients a duty of confidence, recognised in law and in medical ethics.
• The Malaysian Medical Council's Code of Professional Conduct treats improper disclosure of information obtained in confidence as a matter of professional conduct.
• Exceptions are limited. They typically include the patient's consent, disclosures required by law (for example notifiable diseases or court orders), and in narrow cases disclosures needed to protect others from serious harm.

Does the Personal Data Protection Act apply?

• The Personal Data Protection Act 2010 (PDPA) regulates processing of personal data in commercial transactions. Private clinics and hospitals are generally covered. The Federal and State Governments are excluded, so government hospitals are treated differently.
• Health information is "sensitive personal data" under the PDPA, which generally requires explicit consent for processing, subject to exceptions.
• The Personal Data Protection (Amendment) Act 2024 came into force in phases in 2025. Under P.U.(B) 522/2024, the provisions on data breach notification and data protection officers came into operation on 1 June 2025. Data controllers must notify the Commissioner of a personal data breach, and notify affected individuals where the breach causes or is likely to cause significant harm.

Have a question about your own situation? Ask on WhatsApp

What should I do first?

1. Keep evidence: screenshots of messages, emails, social media posts, or the misdirected document, with dates.
2. Write down who told you about the leak and what they saw.
3. Write to the provider asking what happened, what was disclosed, to whom, and what they are doing about it.
4. Ask for removal of any posts where your information appears.
5. Get advice before posting about the leak yourself, as that can spread the information further.

Where can I complain?

• The Department of Personal Data Protection (JPDP) for PDPA matters involving private providers.
• The Malaysian Medical Council for a doctor's professional conduct. See complaining to the MMC.
• The Ministry of Health for regulatory concerns about a private facility.

Can I claim compensation?

Possibly. Depending on the facts, claims may be based on breach of confidence, breach of contract, or negligence. Where the disclosure was false or distorted, defamation may also be relevant. Damages depend on the harm proved, such as distress, loss of employment or harm to relationships.

Common mistakes

• Deleting messages in anger before saving them.
• Assuming a complaint to JPDP will produce compensation; regulatory action and civil claims are separate.
• Reposting the leaked information to complain about it.

When to speak to a lawyer

If a leak caused you serious distress, job loss or other harm, or the provider will not explain or fix it. You can contact us; every case depends on its facts.

Frequently asked questions

Can my employer get my medical report?

Generally only with your consent, unless a law requires it. Consent forms in employment or insurance should be read carefully.

My doctor discussed my case with my family. Is that a breach?

It may be, unless you consented or there was a recognised exception. Context matters.

Does the PDPA apply to government hospitals?

The PDPA excludes the Federal and State Governments. Duties of confidence and professional rules still apply to doctors.

The leak was a hacking incident. Is the clinic still responsible?

Possibly, if its security was inadequate. It may also have notification duties.

Can I ask for posts containing my information to be removed?

Yes. Ask the poster and the platform, and get advice on legal steps if they refuse.

Sources & fact check

Legal points in this article were checked against the primary sources below. The law can change; this is general information, not legal advice.

1. Malaysian Medical Council, Code of Professional Conduct 2019
2. Department of Personal Data Protection: Personal Data Protection Act 2010 (Act 709) and Amendment Act 2024 (Act A1727)
3. P.U.(B) 522/2024: commencement of the Personal Data Protection (Amendment) Act 2024 (1 January, 1 April and 1 June 2025)
4. Medical Act 1971 (Act 50), Malaysian Medical Council copy

Fact-checked on 17 Oct 2026