Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Health data › Saudi Health Information Exchange Policies (IS0303 v1.0)

Saudi Health Information Exchange Policies (IS0303 v1.0)

Consent, breach and secondary-use rules for health information exchange

Type	Instrument
Code	IS0303
Issuing authority	Ministry of Health (MOH)
Framework	Health data
Tier	Rules, controls & standards
Legal status	In force
Instrument number	IS0303 · Saudi Health Council (National Health Information Center); originally MoH eHealth
Issued	2016-04-21
Version	1.0
Dates	v1.0; NHIC copy issued by the Saudi Health Council (21 April 2016); original MoH eHealth (22 February 2015)
Last verified	2026-10-20

The Saudi Health Information Exchange Policies (IS0303, version 1.0) govern the exchange of patient information between participants in the Saudi Health Information Exchange (SeHE). The NHIC copy was issued by the Saudi Health Council on 21 April 2016; the original MoH eHealth version is dated 22 February 2015.

• Consent: opt-out model, with break-glass emergency access.
• Breach chain: staff tell their privacy or security officer within 2 business days; the participant reports to SeHE within 2 business days; SeHE notifies participants within 10 business days; individuals are notified within 30 days.
• Secondary use: only with ethics approval, a data use agreement and de-identification.
• The 30-day notice to individuals may sit uneasily with the PDPL duty to notify data subjects without undue delay.
• The current status of SeHE is being verified.

Sector rules and the PDPL. Health data is sensitive data under the PDPL, so the registration trigger in draft Art 34 of the October 2026 amendments to the PDPL Implementing Regulation (IR) would capture most health providers. Sector hosting and sample rules (NHIC telehealth, research ethics) apply alongside PDPL transfer rules; a PDPL-compliant transfer does not lift them.

Documents

• Hosted official text (PDF, English)
• Official source (nhic.gov.sa)

In this framework

• Law of Ethics of Research on Living Creatures and its Implementing Regulations
• Regulations and Requirements for Conducting Clinical Trials on Drugs (v4.0)
• MoH internal Data Governance Policy (v0.1)
• Saudi eHealth Security and Privacy Interoperability Specification (IS0101)
• Telehealth Application Guidelines
• Guidance on AI/ML-Enabled Medical Devices (MDS-G010)
• Guidance on Pre-Market Cybersecurity of Medical Devices (MDS-G38)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21