• Basic Policy Regarding Protection of Personal Information (Privacy Policy)
• Control Rules for the Protection of Personal Information
• Handling joint use of personal information
• Providing Personal Information to Third Parties
• Disclosure of purpose of use of personal information held by the Health Insurance Society

Basic Policy Regarding Protection of Personal Information (Privacy Policy)

The MSD Health Insurance Society takes the following measures to appropriately safeguard information concerning individual members (“personal information” hereinafter).

• The Health Insurance Society implements appropriate safety measures to safeguard the personal information it obtains on its members against leaks, loss, damage, or improper access.
• The Health Insurance Society uses the personal information provided by members solely for purposes considered beneficial for members, such as health maintenance and promotion. In addition, it uses Individual Numbers only within the scope of the purposes specified in the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedure.
• Except when it has obtained advance consent from the member, the Health Insurance Society will not provide personal information on a member to any third party. Additionally, it will not provide personal information containing Individual Numbers (“identifying personal information” hereinafter), whether or not the individual has consented, except in the cases specified in the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedure. However, in the cases that personal information is not specific personal information under each item of Article 27, Paragraph 1 of the “Act on the Protection of Personal Information” (May 30, 2003, Law No. 57), it may provide personal information on members other than identifying personal information to third parties without obtaining advance consent from members:
• In addition to training and raising awareness among employees regarding personal information protection, the Health Insurance Society will strive to manage personal information appropriately by assigning persons responsible for such management at each section that handles personal information.
• When subcontracting its business operations, the Health Insurance Society will carry out reviews and implement improvements to strengthen personal information protection measures. When concluding business subcontracting agreements, it will carefully examine the competence of subcontractors and consider issues relevant to personal information protection in the content of such agreements.
• A member who wishes to review, revise, or otherwise access his or her personal information may contact the Health Insurance Society’s Privacy Contact. The contact there will respond swiftly to such requests to the extent reasonable.
• In addition to complying with laws, regulations, and other standards concerning the handling of members’ personal information, the Health Insurance Society continually reviews and strives to improve the content of this Privacy Policy.

Control Rules for the Protection of Personal Information

Control Rules for the Protection of Personal Information

Personal information held by the Society for business purposes

Purposes of use of personal information

Handling joint use of personal information

The Act on the Protection of Personal Information requires prior notification or announcement to the individuals in question regarding joint use of personal data with employers in connection with health screening and other activities on the following information: (1) purpose of joint use of personal data; (2) items of personal data subject to joint use; (3) scope of parties involved in the joint use; (4) purpose of use for those using the data; and, (5) names or titles of the parties responsible for data administration.

The Health Insurance Society announces the details of information subject to joint use through this document, through posts in Society offices, and through publication on its website and in Society publications such as bulletins.

Details of joint use of personal data by the Society with the employer are described below

• Purpose of joint use of personal data
  Personal data is shared because joint implementation of health screening and follow-up guidance by the employer and the Society is required to effectively promote health management for insured persons, dependents and others.

• Items of personal data subject to joint use
  （1）Health examination service
  The information about personal information such as name, sex, age, etc., and medical inquiries, health examination results, and health guidance results which acquired by periodical health checkups, specified health checkups, and specific health guidance.

  （2）Collaboration health service

  • ● Employer retained data

  Personnel data: The information about employment management of the employees such as employee number, organization, type of job, working hours, e-mail address, etc.
  Decedent's information: The information about decedent such as cause of death, date of death, etc.
  Long-term absence information: The information about long-term absentee such as reason of absence, leave period, etc.
  Health checkup results of specified health checkups for age 40 and above and periodical health checkups for below age 40: The information about health examination such as date, medical inquiries, health examination results, work permission determination, etc.
  The information about employee who did not take health examination.
  Questionnaire results of employees: The information about respondent, response of questionnaire which carried out by the company.

  • ●Health Insurance Society retained data

  Members’ data: The information about personal attribute information of members (insured persons and dependents) of the Health Insurance Society such as code/number, name, date of birth, etc.
  Injury and sickness allowance data: The information about injury and sickness allowance of insured person such as disease name, amount of injury and sickness allowance, additional amounts of invalidity benefit, injury and sickness allowance additional sum, etc.
  Specified health checkups and specific health guidance data: The information about specified health checkups such as date, medical inquiries, judgment of syndrome, etc. and the information about specific health guidance such as health guidance contents, results, etc.
  Health activities data: The information about health activities (various programs) which operated by the Health Insurance Society, such as members who participated or applied, amount of a subsidy, etc.

• Scope of parties involved in joint use
  Employer, the Health Insurance Society, Industrial Physicians

• Purpose of use for those using the data
  For health screenings and follow-up health guidance to maintain and improve the health of insured persons and dependents; for use in health consultations and other services; for evaluations and analyses of services; for exchange of information with industrial physicians and employer

• Names or titles of parties responsible for data administration
  Employer: MSD K.K. General Industrial Physician, Mihoko Yamamoto
  Employer: Nihon MSD G.K. General Industrial Physician, Mihoko Yamamoto
  Employer: MSD Animal Health K.K. Industrial Physician, Manabu Isojima
  Employer: Organon K.K. Industrial Physician, Mihoko Yamamoto
  Health Insurance Society: MSD Health Insurance Society Jomu-Riji, Kunihiko Komune

Providing Personal Information to Third Parties

Under the Act on the Protection of Personal Information, any business operators handling personal information (including MSD-HIS) may not provide personal information to third parties without the prior consent of the individual in question. However, for purposes of use of personal information required in the undertaking of day-to-day operations beneficial to the members (insured person and dependents) and those for which obtaining the explicit consent would impose a significant burden on the business operators and may be unreasonable from the point of view of the members, the Act grants “implied consent” when no explicit objection or reservation has been lodged by the members after the organization in question first discloses such purpose of use. The Society considers the following items and “Disclosure of purpose of use of personal information held by the Health Insurance Society” to qualify for such use. Any member not consenting to such uses should notify the MSD-HIS.

• For High-Cost Medical Care Benefits provided through the employer without application by the individual in question
• For additional benefits and other benefits provided through the employer without application by the individual in question
• For providing the insured person with medical care cost information for the entire household
• For providing notification of benefit decisions (Notices of Health Insurance Benefit Amounts) through the employer
• For entrusting the analysis of the medical expenses, illness, medical receipt, health checkups data to the analyzing companies in order to implement the PDCA (Plan-Do-Check-Act) cycle of the “Data Health Plan” which contribute to the maintenance and promotion of health for the insured persons and their dependents.