The rapid advancement of digital health technology has transformed medical record management, making the legal protection of Electronic Medical Record (EMR) data increasingly critical. This study analyzes EMR data protection within digital-based health information systems in Indonesia, focusing on regulatory inconsistencies and their implications for data security and patient confidentiality. The research addresses a gap in current legal studies: the lack of comprehensive analysis integrating legal norms, institutional practices, and technological safeguards in EMR governance. It examines how existing legal frameworks ensure EMR data protection amid increasing digitalization and what structural weaknesses hinder implementation. Using a normative juridical approach with literature-based research, the study examines primary data from documented cases and EMR management reports, alongside secondary data including legal texts, academic literature, and prior studies. Data were analyzed through content analysis to identify legal inconsistencies, enforcement challenges, and systemic vulnerabilities. Findings reveal that primary legal issues lie in fragmented regulatory enforcement, absence of uniform institutional standards, and insufficient integration between legal provisions and technological systems. These gaps result in weak legal certainty and increased risk of data breaches. Existing regulations have not fully adapted to digital health system complexity, particularly regarding accountability and data protection mechanisms. This research contributes to legal scholarship by proposing harmonization of regulations, strengthening of enforcement mechanisms, and alignment between legal, institutional, and technological frameworks to ensure legal certainty, enhance patient data protection, and support sustainable development of digital health systems in Indonesia.