Legal risks of telemedicine in China and its prevention

Legal and policy frameworks

Key instruments include the Law on Doctors of the PRC, Law on the Promotion of Basic Medical and Health Services of the PRC, Regulations on the Administration of Medical Institutions, Measures for the Administration of Internet Diagnosis and Treatment (Trial), and Management Specifications for Telemedical Services (Trial) (see Table 1, Figure 1). These instruments establish the normative foundation for analyzing telemedicine regulation.

OPEN IN VIEWER

Figure 1.

Statistics on the number of laws, regulations, and policy documents related to telemedicine issued by the central and local governments in China.

OPEN IN VIEWER

Table 1.

List of special policies on telemedicine issued by the central people's government of China and its departments.

No	Name of the policy document	Formulation body	Date of implementation
1	The 14th Five-Year Plan for the Development of Traditional Chinese Medicine	State Council	March 29, 2022
2	Guiding Opinions on Deepening the Comprehensive Reform of Public Hospitals	National Health Commission	August 21, 2025
3	Notice on Further Strengthening the Capacity Building of the Telemedicine Network	General Office of the Ministry of Industry and Information Technology and General Office of the National Health Commission	October 22, 2020
4	Notice on Developing National Tele-consultation of Critical Patients of COVID-19 in National Tele-medical and Internet Medical Center.	General Office of the National Health Commission	February 21, 2020
5	Notice on the Investigation on the Development of Telemedicine in Traditional Chinese Medicine Hospitals in Poverty-stricken Counties Assisted by Tertiary Hospitals	National Administration of Traditional Chinese Medicine	August 14, 2018
6	Measures for the Administration of Internet Diagnosis and Treatment (Trial Implementation)	National Health Commission National Administration of Traditional Chinese Medicine	July 17, 2018
7	Measures for the Administration of Internet Hospitals (Trial Implementation)	National Health Commission National Administration of Traditional Chinese Medicine	July 17, 2018
8	Telemedicine Service Management Specification (Trial)	National Health Commission National Administration of Traditional Chinese Medicine	July 17, 2018
9	Notice on Issuing 7 Health Industry Standards, such as Basic Function Specification of Telemedicine Information System.	National Health Commission	June 1, 2017
10	Notice on Approving the Pilot Work of Telemedicine Policy in Ningxia, Yunnan, and Other 5 Provinces and Regions	General Office of the National Development and Reform Commission and General Office of the National Health and Family Planning Commission	January 15, 2015
11	Notice on Issuing Technical Guidelines for Telemedicine Information System Construction	General Office of the National Health and Family Planning Commission	August 21, 2014
12	Opinions on Promoting Telemedicine Service in Medical Institutions	National Health and Family Planning Commission	August 21, 2014
13	Notice on Organizing and Launching the Pilot Work of Telemedicine Policy for Old-age Institutions	National Development and Reform Commission, Ministry of Civil Affairs, National Health and Family Planning Commission	June 16, 2014
14	Notice on Organizing and Launching the Pilot Work of Provincial-Hospital Cooperative Telemedicine Policy	National Development and Reform Commission, National Health and Family Planning Commission	March 11, 2014
15	Notice of the Ministry of Health on Strengthening the Management of Telemedicine Consultation	Former Ministry of Health	January 4, 1999
16	Notice on Issuing the Measures for the Administration of Medical Consortium (for Trial Implementation)	National Health Commission and Chinese Medicine Administration	August 1, 2020

Scholarly literature

Systematic searches across international (Web of Science, PubMed) and Chinese (CNKI, Wanfang Data) databases yielded extensive academic articles and research reports addressing telemedicine's legal dimensions. This corpus provides multifaceted theoretical perspectives on risk identification and mitigation strategies.

Empirical legal analysis

Examination of Chinese telemedicine-related judicial cases—including medical disputes and information disclosure proceedings (see Figure 2)—and online referee documents provides grounded insights into practical legal challenges.

OPEN IN VIEWER

Figure 2.

Statistics on telemedicine cases accepted by local courts in China.

Breakthrough of the geographical restrictions

Conventional healthcare models require patients to physically access medical facilities, creating significant barriers for individuals in remote regions or with mobility impairments. Telemedicine leverages information technology to overcome geographical constraints. This enables virtual consultations between patients and specialists across locations, allowing individuals to receive expert diagnoses and treatment recommendations from home or local facilities without long-distance travel, thereby substantially enhancing healthcare accessibility. ¹⁸ For instance, patients in remote mountainous regions utilize telemedicine platforms to transmit clinical data to urban specialists, who then develop diagnostic and therapeutic protocols, ensuring timely and effective care delivery. ¹⁵

Improving the medical efficiency

Telemedicine enables efficient transmission and sharing of medical data while reducing patient treatment delays. Conventional healthcare models often involve significant time expenditure for registration, queuing, and examinations, whereas telemedicine streamlines processes through online scheduling and remote diagnostics. Concurrently, the telemedicine system provides clinicians with immediate access to patient records and diagnostic reports, enhancing diagnostic accuracy and efficiency. In emergency scenarios, telemedicine facilitates real-time multidisciplinary consultations, enabling specialists across locations to collaboratively diagnose patients, develop optimized treatment protocols, and significantly reduce critical time-to-treatment. ¹⁹

Promoting medical resource sharing

Telemedicine facilitates widespread sharing of specialized medical resources. Through telemedicine platforms, specialists from tertiary hospitals deliver care to patients in primary care facilities while concurrently training and mentoring primary care physicians to enhance service quality. For instance, tertiary hospitals have established telemedicine centers and collaborative networks with numerous primary care facilities. These centers routinely facilitate telemedicine consultations, case reviews, and academic seminars, enabling knowledge transfer of medical expertise and reducing regional disparities in healthcare standards. ¹⁸

Promoting medical services diversification

E-medicine has facilitated diverse medical service modalities, including internet hospitals, online consultations, and remote monitoring. Patients select appropriate service modalities based on their clinical requirements. Internet hospitals enhance patient accessibility through services like online follow-ups and e-prescribing. Remote monitoring devices enable real-time tracking of patients’ vital signs—such as blood pressure and blood glucose—optimizing chronic disease management. These diversified service modalities expand healthcare service availability and enhance patient experience.^18,20

Issues in medical institution practice qualification

Telemedicine service providers often exhibit inconsistent credentialing standards. Certain internet hospitals operate without requisite institutional licensing or exceed their authorized scope of practice. ²¹ This includes purported internet hospitals established by third-party platforms that deliver remote care without regulatory approval. Such operations contravene medical institution regulations while introducing significant patient safety risks. Furthermore, current regulations lack explicit provisions regarding the institutional qualification requirements for emerging telemedicine service models, creating regulatory lacunae. ²²

Practice qualification of medical personnel and multi-point practice problem

Chinese laws and regulations explicitly restrict physicians to practice within registered medical institutions and geographic scopes following licensure. Telemedicine, however, requires physicians to serve patients across disparate locations, necessitating flexibility in practice location regulations. Despite existing provisions for multipoint practice, the filing and management mechanisms remain inadequate for telemedicine contexts. ²³ Some physicians fail to file for multipoint practice when delivering telemedicine services, raising questions about the legality of their practice. Furthermore, credential verification for foreign or Hong Kong, Macao, and Taiwan (HMT) physicians in telemedicine is complicated by regulatory disparities across jurisdictions, creating loopholes in qualification screening that compromise service quality and patient safety. ²⁴

Ownership of multisubject medical liability is unclear

Telemedicine involves multiple stakeholders, including patients, inviting medical institutions, invited medical experts, and third-party platforms. Liability attribution becomes complex when medical disputes arise. The 2009 Notice on Strengthening Telemedical Consultation Management, issued by the former Ministry of Health, stipulates that institutions initiating consultations bear liability for resulting disputes. This provision contradicts the Civil Code's liability attribution framework for diagnostic and treatment activities. Under the Civil Code, invited experts bear liability for patient harm resulting from erroneous diagnostic or treatment opinions. Conversely, the Notice may exempt invited experts from liability, creating regulatory ambiguity in responsibility assignment. Furthermore, regulatory gaps persist regarding third-party platforms’ liability for technical failures during data transmission—such as distortion or loss of information—that compromise diagnostic integrity and treatment outcomes. ²²

The fuzzy standard for determining liability for medical damage

Telemedicine diverges from traditional medical treatment in its diagnostic processes and operational environment, rendering existing medical malpractice liability standards inapplicable without modification. Technical variables—including device performance limitations and network transmission deficiencies—may compromise diagnostic accuracy in remote consultations. Current frameworks lack standardized criteria to distinguish between inaccuracies stemming from technological constraints versus medical negligence. Remote surgery necessitates distinct liability standards to evaluate: (1) surgical robot compliance with operational specifications, and (2) timely management of intraoperative emergencies. China's regulatory framework remains underdeveloped in this domain, consequently precipitating doctor-patient disputes over liability attribution following adverse medical events. ²⁵

Informed consent rights of patients violated

Informed consent in telemedicine encounters significant challenges. The technical complexity and specialized nature of telemedicine may impede patients’ comprehensive understanding of diagnostic procedures, treatment protocols, and associated risks. For instance, during diagnostic procedures utilizing advanced telemedicine devices, patients may lack comprehension of operational principles and precision metrics, while physicians may encounter limitations in fully explaining device functionality due to communication constraints or time restrictions. Moreover, telemedicine's multi-stakeholder framework and multi-stage processes create susceptibility to deviations or omissions during information transmission. Inadequacies in the referring institution's presentation of consulting experts’ credentials, consultation protocols, and procedural details may preclude patients from achieving fully informed consent. Furthermore, communication barriers inherent in telemedicine—compared to traditional in-person consultations—may delay patient notification and exclude them from real-time decision-making during treatment plan modifications, thereby violating informed consent rights.^17,26

Violation of the patient's right to privacy

Telemedicine necessitates network transmission and storage of patients’ personal information and medical records, elevating risks to privacy rights. Inadequate cybersecurity measures expose patient data to threats including unauthorized access, malware infiltration, and resultant breaches. ²⁷ Security vulnerabilities in telemedicine systems may permit unauthorized acquisition of sensitive data, including medical records and diagnostic reports. Concurrently, insufficient privacy protection awareness among healthcare personnel persists. Operational errors or protocol violations during telemedicine may precipitate unauthorized information disclosure. Moreover, the multi-stakeholder nature of telemedicine—with complex information flows between entities—lacks a comprehensive regulatory framework ensuring secure data storage and appropriate utilization by all parties. ²⁸

Obstacles caused by differences in legal and regulatory

Globalization has accelerated cross-border telemedicine adoption, yet significant jurisdictional fragmentation persists in medical laws and regulations. Practice qualification requirements vary substantially across jurisdictions, creating credential recognition barriers. Chinese physicians may encounter foreign non-recognition of their licensure when delivering telemedicine services internationally. Similarly, credential verification for foreign practitioners providing telemedicine services in China presents considerable administrative complexity. Medical liability determination faces further challenges due to divergent legal frameworks and judicial practices across jurisdictions. Jurisdictional complexity complicates applicable law selection in medical malpractice disputes. Disparities in liability attribution principles between China and other jurisdictions may produce inconsistent legal outcomes for patients. Moreover, inconsistencies in patient rights protections and cross-border data transfer regulations create significant regulatory impediments to global telemedicine expansion. ²⁹

Lack of supervision and difficult quality control problems

The absence of unified regulatory standards and oversight mechanisms characterizes cross-border telemedicine. Jurisdictional variations in access protocols, operational requirements, and supervisory frameworks create regulatory fragmentation, marked by both gaps and redundancies. Consequently, regulatory inconsistencies enable participation by unaccredited providers and personnel, complicating quality assurance. The transnational nature of service delivery—spanning multiple jurisdictions and stakeholders—further exacerbates quality control challenges. Service quality depends on technological infrastructure (equipment reliability, network stability) and provider competence. Without standardized quality benchmarks or monitoring protocols, patients face significant challenges in evaluating service safety and efficacy.^30,31

Explicit legal status and responsibilities of telemedicine topics

Specialized telemedicine regulations have been proposed, with scholars urging China to establish comprehensive telemedicine legislation that explicitly defines the legal status, rights, and obligations of all telemedicine stakeholders, including medical institutions, personnel, and third-party platforms. Such legislation must stipulate qualification standards and approval procedures for medical institutions, alongside telemedicine service protocols, diagnostic norms, and liability parameters. For medical personnel, regulations should refine multipoint practice provisions, specifying practice jurisdictions, scope, filing requirements, and telemedicine-specific liability standards. Third-party platforms must have clearly defined service provider responsibilities, encompassing network security obligations, data transmission integrity guarantees, and liability allocation protocols for system failures. Clarifying the legal status and responsibilities of all stakeholders would mitigate legal disputes in telemedicine. ³²

To develop a unified liability standard for medical damage

Specialized standards for identifying medical damage liability in telemedicine must be established, accounting for its unique operational characteristics. Determinations of medical failure must comprehensively evaluate the impact of equipment performance, network transmission quality, and other technical factors on diagnostic and treatment outcomes. Liability for medical damage resulting from equipment failure or network interruption should be assessed based on the contractual obligations of medical institutions and third-party platforms regarding equipment maintenance and network reliability. Compensation liability determinations must holistically consider patient harm severity, the degree of fault among all parties, and contributory factors. Concurrently, a formal telemedicine liability identification mechanism should be established, comprising specialized assessment institutions and qualified personnel to conduct impartial, scientifically rigorous evaluations of medical damage. This framework would provide an objective basis for determining responsibility and resolving disputes. ²⁴

Establishing strict access and exit mechanisms

Health administrative departments must implement stringent access controls for telemedicine institutions and service personnel. Medical institutions must rigorously evaluate their operational capacity, including scope of medical services, qualified technical personnel, and IT security infrastructure, before providing telemedicine services. ³³ Personnel qualifications and practice credentials must be formally verified and documented. Third-party platforms require assessment of technical capabilities and security assurance protocols. A credit rating system for telemedicine providers and personnel must be established. Entities demonstrating regulatory non-compliance or substandard service quality should face escalating sanctions: formal warnings, financial penalties, practice suspension, and ultimately license revocation. Non-compliant entities must be blacklisted and permanently barred from re-entering the telemedicine market. Strict entry and exit mechanisms are essential to ensure telemedicine service quality and safety.^25,32

Strengthen the supervision of the entire telemedicine process

Implementing information technology requires establishing a telemedicine supervision platform capable of real-time monitoring throughout the diagnostic and treatment process. This platform must incorporate monitoring capabilities for patient data security, medical conduct compliance, service quality metrics, and other critical aspects. For instance, real-time monitoring of patient data security during transmission and storage prevents information breaches; it supervises healthcare professionals’ adherence to clinical protocols and detects regulatory violations; and evaluates service quality through diagnostic accuracy and treatment efficacy metrics. ³⁴ Concurrently, enhanced surveillance of cross-border telemedicine is necessary, requiring information-sharing frameworks and collaborative protocols with international regulatory counterparts to ensure compliance and standardization of transnational telemedicine services.^22,30

Protecting the informed consent of patients

A standardized telemedicine informed consent template should be developed to comprehensively inform patients about service contents, procedural protocols, potential risks, and the qualifications of participating medical institutions and healthcare providers. Healthcare providers must deliver detailed, comprehensible explanations of consent documentation, verifying patient comprehension prior to service initiation. Supplementary educational resources, including specialized videos and materials, should be provided to elucidate complex telemedicine technologies and equipment. Information technology should facilitate bidirectional communication channels between patients and healthcare providers. Patients must have real-time access to healthcare providers for clarification during service delivery to ensure voluntary and informed participation.^26,35

Ways to strengthen the protection of patient privacy

Patient information access is strictly limited to authorized personnel with legitimate work-related purposes, with comprehensive audit trails maintained for traceability. Mandatory privacy protection training programs are implemented for all medical personnel to enhance data security awareness, standardize operational protocols, and prevent inadvertent privacy breaches resulting from negligence. ²⁷

A structured patient information security management system must be established, defining clear responsibilities for departments and personnel regarding data protection, implementing periodic security self-assessments, and ensuring prompt identification and remediation of vulnerabilities. All medical data containing protected health information must comply with regulatory requirements, with enhanced safeguards mandated for highly sensitive data, including HIV/AIDS status and mental health records.^27,36

Implement rigorous oversight of third-party collaborators through enforceable confidentiality agreements that explicitly define their obligations and responsibilities regarding patient information utilization and protection. Periodic audits and evaluations of third-party information security protocols must be conducted to verify effective patient privacy safeguards. Any breach of agreement necessitates immediate termination of partnership and initiation of legal liability proceedings. ³⁷

Furthermore, a comprehensive breach response protocol must be established to enable rapid mitigation of damages following patient privacy incidents. This protocol must encompass incident reporting procedures, immediate containment measures, patient notification frameworks, remediation strategies, and compensation mechanisms. Concurrently, patients must receive timely notification of incidents, transparent explanations of remedial actions and outcomes, and guaranteed rights to information access and decisional involvement. ³⁷

Integrating these multifaceted approaches establishes a robust, multilayered privacy protection framework that comprehensively safeguards patients’ rights and interests within telemedicine ecosystems. ³⁸

Formulation and promotion of telemedicine technical standards

Establish unified telemedicine technical standards encompassing performance parameters, data transmission formats, interface specifications, and other critical equipment requirements. For instance, standards specifying image resolution and data acquisition precision for remote diagnostic equipment must be defined to ensure interoperability and seamless data exchange across systems. Concurrently, telemedicine service providers and equipment manufacturers must rigorously adhere to these standards to enhance technological standardization across the telemedicine sector. Unified technical standards mitigate medical risks stemming from technological incompatibility or equipment non-compliance, thereby providing a foundational guarantee for telemedicine quality and safety. ²⁹

Data security and technical support system construction

A comprehensive telemedicine data security management system must be established to govern the entire lifecycle of patient data, including acquisition, transmission, storage, and utilization. A dedicated data security management department should be created to develop security protocols, contingency plans, and conduct regular evaluations, testing, and risk mitigation. Increased investment in R&D is essential to develop proprietary telemedicine security technologies—including data desensitization and access control—to enhance data protection. Additionally, a technical support team must be established to deliver prompt maintenance and operational support to telemedicine service providers, ensuring system stability. ¹⁷

Legal and operational training for medical personnel

Telemedicine medical personnel must receive comprehensive legal training to ensure familiarity with relevant laws, regulations, and policies governing telemedicine, thereby enhancing their legal literacy and accountability. Regular operational training should be provided to enhance personnel's proficiency with telemedicine technologies and equipment, strengthen clinical communication skills, and elevate diagnostic and treatment capabilities. Training curricula should cover telemedicine diagnostic and treatment protocols, patient rights protection, and medical dispute resolution mechanisms. This training ensures compliance with legal and regulatory requirements during telemedicine service delivery while mitigating risks associated with operational errors or insufficient legal knowledge.^26,31

Self-discipline and regulatory role of industry associations

Industry associations should spearhead telemedicine self-regulation by establishing industry-wide self-discipline conventions, clearly defined codes of conduct, and ethical standards to guide compliance among telemedicine providers and practitioners. These associations should conduct systematic quality assessments of telemedicine services, recognize exemplary institutions and individuals through public commendation, and impose informed criticism and disciplinary measures on entities violating self-regulation standards. Concurrently, industry associations must enhance collaboration with governmental bodies, promptly report sectoral challenges and developmental needs, and provide expert recommendations to foster sustainable telemedicine industry growth.^30,39

Establishment of diversified dispute resolution channels

Diversified telemedicine dispute resolution channels—including consultation, mediation, arbitration, and litigation—should be established. Parties should be encouraged to resolve disputes through consultation; if unsuccessful, they may seek mediation from a medical dispute mediation committee. A specialized telemedicine arbitration institution should be established, with arbitration rules tailored to telemedicine's unique characteristics, providing efficient and accessible arbitration services for all parties. ⁴⁰ For litigation, specialized medical dispute tribunals should be created to enhance the efficiency and quality of remote medical case adjudication. These diversified resolution mechanisms expand options for stakeholders while enabling efficient and timely resolution of telemedicine disputes. ⁷

Settlement mechanism for cross-border telemedicine disputes

A cross-border telemedicine dispute resolution mechanism must be established to address the unique characteristics of such disputes. Judicial cooperation should be strengthened through mutual legal assistance agreements with other jurisdictions, clearly defining jurisdictional boundaries and applicable laws for cross-border telemedicine disputes. ⁴¹ A specialized cross-border mediation institution, comprising international legal and medical experts, should be established to deliver professional mediation services for these disputes. Furthermore, the international community should develop uniform standards for managing cross-border telemedicine disputes to promote fair and efficient resolution. ²⁸