<![CDATA[The development of information technology in health service delivery has encouraged the extensive use of electronic systems, particularly electronic medical records, which position patient health data as an integral component of modern healthcare services. While digitalization enhances efficiency and service quality, it simultaneously increases the risk of data breaches and misuse of sensitive patient health information. This study aims to analyze the legal framework governing the protection of patient health data in Indonesia and to formulate a concept of legal liability for healthcare service providers concerning data security. This research employs a normative legal research method using statutory and conceptual approaches, supported by a literature review of laws and regulations, legal doctrines, and relevant national and international journal articles. The findings reveal that although Indonesia has established a legal framework through Law Number 17 of 2023 on Health and Law Number 27 of 2022 on Personal Data Protection, the regulation of legal liability for patient health data breaches remains fragmented and predominantly oriented toward individual responsibility. This study argues that patient health data breaches should be understood as a structural legal issue, requiring the construction of institutional liability for healthcare service providers as data controllers. This research is expected to contribute theoretically to the development of health law and personal data protection law, as well as practically to strengthening legal certainty and patient rights protection in the digital healthcare era.]]>
