### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

43. Offences relating to impairment to System
(1) A person commits an offence if the person knowingly impairs the operation of the System.
(2) A person who commits the offence is liable on conviction on indictment to imprisonment for 10 years.

44. Offences relating to data access requests and data correction requests
(1) A person commits an offence if the person, with intent to evade a data access request or data correction request in relation to any data or information contained in an electronic health record—
(a) alters, falsifies, conceals or destroys the data or information; or
(b) directs another person to do anything mentioned in paragraph (a).
(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

45. Offences relating to untrue statements
(1) A person commits an offence if the person knowingly makes an untrue statement to enable the person to give a joining consent or sharing consent.
(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

46. Offences relating to contravening conditions for research or statistics purpose
(Not yet in operation)(1) A person commits an offence if the person knowingly contravenes a condition imposed under section 34(1)(a).
(2) A person who commits the offence is liable on summary conviction to a fine at level 6.

### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

47. Offences relating to direct marketing
(1) A person commits an offence if the person uses another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.
(2) A person who commits an offence under subsection (1) is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years.
(3) A person commits an offence if, for gain, the person provides to others another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.
(4) A person who commits an offence under subsection (3) is liable on conviction on indictment to a fine of $1,000,000 and to imprisonment for 5 years.
(5) A person commits an offence if, not for gain, the person provides to others another person’s data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, for direct marketing.
(6) A person who commits an offence under subsection (5) is liable on conviction on indictment to a fine of $500,000 and to imprisonment for 3 years.
(7) This section does not apply in relation to the use or provision of data or information contained in an electronic health record, or a copy (in whatever format) of the data or information, by a person if, not for gain, the person uses or provides the data or information, or the copy, for a purpose specified in subsection (8).
(8) The purpose is the offering, or the advertising of the availability, of—
(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided or administered by the Department of Health or the Hospital Authority; or
(c) any other social or health care services that, if not provided, would be likely to cause serious harm to the physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.
(9) In this section—
direct marketing (直接促銷) has the meaning given by section 35A(1) of the Privacy Ordinance;
health care services (醫護服務) has the same meaning as in sections 35B and 35I of the Privacy Ordinance.

48. Appointment of Commissioner
(1) The Secretary may appoint a public officer to be the Commissioner for the Electronic Health Record.
(2) The appointment is to be notified in the Gazette.

### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

49. Functions and powers of Commissioner
(1) The Commissioner has the following functions—
(a) to establish, operate, maintain and develop the System;
(b) to regulate and supervise the sharing and using of data and information contained in the System;
(c) to supervise the compliance with this Ordinance;
(d) to promote the System to healthcare recipients, healthcare providers and the public;
(e) to devise and promote, and encourage among healthcare providers, proper standards of conduct, and sound and prudent practices, in data sharing;
(f) to advise the Secretary on matters relating to the System;
#(g) 

50. Commissioner to keep register of prescribed healthcare providers
(1) The Commissioner must establish and maintain a register of prescribed healthcare providers for the purposes of this Ordinance.
(2) The register may be kept in a form, and may contain information, that the Commissioner considers appropriate.
(3) The register must be made available for a member of the public to ascertain—
(a) whether a healthcare provider is registered as a healthcare provider for the System under section 20(1); and
(b) the service location for which the healthcare provider is registered.
(4) The register must be made available for public inspection free of charge—
(a) through the Internet; and
(b) at the office of the Commissioner, or any other Government offices as the Commissioner may direct, during normal office hours.

51. Commissioner to require production of records or documents in certain circumstances
(1) If it appears to the Commissioner that there are circumstances suggesting the happening of an event specified in subsection (2), the Commissioner may in writing require a prescribed healthcare provider to produce the record or document—
(a) that is or may be relevant to the event; and
(b) that is in the possession or under the control of the healthcare provider.
(2) The event is that—
(a) the healthcare provider contravenes—
(i) a provision of this Ordinance;
(ii) a provision of a code of practice issued under section 52; or
(iii) a condition for the registration;
(b) the healthcare provider no longer provides healthcare at the service location to which the registration relates;
(c) the healthcare provider no longer complies with—
(i) the requirements specified by the Commissioner for connecting the healthcare provider to the System; or
(ii) the system requirements on data sharing specified by the Commissioner;
(d) the service or business nature of the healthcare provider is no longer consistent with the purpose of the use of data and information specified in section 28; or
(e) the registration may impair the security or compromise the integrity of the System.
(3) The requirement must specify the manner in which the record or document must be produced.

### Electronic Health Record Sharing System Ordinance 《電子健康紀錄互通系統條例》

52. Commissioner to issue code of practice
(1) The Commissioner may issue a code of practice—
(a) indicating the manner in which the Commissioner proposes to perform a function or exercise a power; or
(b) providing guidance on the operation of a provision of this Ordinance.
(2) The Commissioner—
(a) must publish the code of practice in a manner appropriate to bringing it to the notice of persons affected by it; and
(b) must make copies of the code of practice available to the public (in hard copy or electronic form).
(3) The Commissioner may amend or revoke the code of practice. Subsections (2) and (4) apply to an amendment or revocation of the code of practice in the same way as they apply to the code of practice.
(4) A code of practice issued under this section is not subsidiary legislation.

53. Commissioner to specify forms
(1) The Commissioner may specify the form of a document required for the purposes of this Ordinance.
(2) The Commissioner may specify more than one form of the document, whether as alternatives or to provide for different circumstances.
(3) A form specified under this section—
(a) must be completed in accordance with the directions and instructions that are specified in the form; and
(b) if the completed form is required to be provided to the Commissioner or any other person, must be so provided in the manner specified in the form.