International legal regulation of the protection of personal medical data of a patient in cross-border medical insurance systems

In the context of digitalization of healthcare and the growth of cross-border mobility of patients, the protection of personal medical data in international health insurance systems is becoming increasingly relevant. Leading international organizations such as WHO, OECD, and the European Union are developing global standards for digital healthcare management based on the principles of confidentiality, transparency, and legal compatibility. The purpose of the study is to identify international legal mechanisms for protecting patients’ medical data in cross-border insurance and to propose ways to adapt them to the legislation of Kazakhstan. The methodological framework includes comparative legal, institutional, and system-structural approaches. The empirical basis was formed by an analysis of key documents: supranational (GDPR, Council of Europe Convention No. 108+, EHDS draft) and Kazakhstani (Law “On Personal Data and their Protection”, Code “On Public Health and the Healthcare System”). The implementation of the provisions of Conventions No. 108+ and GDPR into national legislation, the creation of a separate supervisory authority for the circulation of medical personal information, as well as the conclusion of agreements on mutual recognition of medical information security standards within the EAEU are proposed as priority areas for legal modernization. The implementation of these measures will allow Kazakhstan to bring domestic law in line with international obligations and strengthen the regulatory framework for digital healthcare.

1. Council of Europe. Convention 108+ for the Protection of Individuals with regard to Automatic Processing of Personal Data. Strasbourg: Council of Europe, 2018. URL: Convention 108+ (official Council of Europe page (accessed: 30.03.2026). (In English)

2. European Commission. Proposal for a Regulation on the European Health Data Space (EHDS). Brussels: European Commission, 2025. URL: European Health Data Space (EHDS) – European Commission (accessed: 30.03.2026). (In English)

3. WHO. Global Strategy on Digital Health 2020–2025. Geneva: World Health Organization, 2023. 102 p. (In English)

4. OECD. Health at a Glance: Europe 2024 – Digital Health and Data Governance. Paris: OECD Publishing, 2024. 210 p. (In English)

5. Tlembaeva Zh.U. (2025) Strahovanie professional’noj otvetstvennosti medicinskih rabotnikov kak mehanizm zashhity prava na ohranu zdorov’ja // Vestnik Instituta zakonodatel’stva i pravovoj informacii Respubliki Kazahstan. V. 80. No. 3. P. 317–326. (In Russian)

6. Razieva D.B. (2025) Protivopravnost’ kak jelement disciplinarnogo prostupka medicinskih rabotnikov // Vestnik Instituta zakonodatel’stva i pravovoj informacii Respubliki Kazahstan. V. 80. No.1. P. 114–121. (In Russian)

7. Dahanova Zh.O. (2019) QR-dağy densaulyq saqtau salasynyñ qūqyqtyq retteluınıñ mañyzy // Vestnik KazNU. Serija juridicheskaja. V. 54(2). P. 52–54. (In Kazakh)

8. Ibraeva A.S. (2023) Pravovoe regulirovanie zashhity personal’nyh dannyh v zdravoohranenii Respubliki Kazahstan // Vestnik ENU im. L.N. Gumiljova. Serija juridicheskaja. No. 4(145). P. 88–95. (In Russian)

9. Baimbetov N.S. (2019) K voprosu o pravovom obespechenii finansovyh riskov v sfere okazanija medicinskih uslug // Vestnik KazNU. Serija juridicheskaja. No. 51(1). P. 43–48. (In Russian)

10. Spankulova L.S., Beljanin A.V., Bukatov E.B. (2023) Ocenka modeli jekonomicheskogo povedenija naselenija pri potreblenii opekaemyh blag s uchjotom neodnorodnosti predpochtenij // Vestnik Karagandinskogo universiteta. Serija jekonomika. No. 4(112). P. 204–212. (In Russian)

11. Gostin L.O., Meier B.M. (2020) Global Health Law: Governance, Rights, and Duties. Oxford: Oxford University Press. 410 p. (In English)

12. Bygrave L.A., Trotter A. (2022) Data Privacy Law: International Dimensions. Oxford: Oxford University Press. 310 p. (In English)

13. Kuner C. (2021) Transborder Data Flows and Data Privacy Law. Oxford: Oxford University Press. 398 p. (In English)

14. Tzanou M. (2020) Health Data Privacy under the GDPR: Big Data Challenges and Regulatory Responses. New York: Routledge. 272 p. (In English)

15. Den Exter A. (ed.). (2017) European Health Law. Antwerp: Maklu. 502 p. (In English)

16. Greer S., Jarman H., Baeten R. (2021) Patient Mobility and EU Law // Journal of European Social Policy. Vol. 31. No. 4. P. 389–406. (In English)

17. Costa J., Tzanou M. (2021) The Legal Architecture of Health Data Governance in the EU // European Journal of Health Law. Vol. 28. No. 3. P. 229–252. (In English)

18. Mostert M. (2018) From Privacy to Data Protection in the EU: Implications for Big Data Health Research // European Journal of Health Law. Vol. 25. No. 1. P. 43–61. (In English)

19. Meier B.M., Mori L. (2021) Universal Health Coverage and the Law // Health and Human Rights Journal. Vol. 23(2). P. 15–34. (In English)