Legal protection of personal health information in medical AI applications in China: challenges and regulatory responses.

Medical artificial intelligence applies advanced AI technologies to enhance the efficiency and quality of clinical diagnosis and treatment. The extensive processing of personal health information in medical AI applications have further accelerated the digital transformation of healthcare services. However, medical AI also introduces new challenges for personal health information protection. In this context, health information faces not only continuous processing but also uncertain processing purposes, involvement of multiple processing entities, and accumulating algorithmic risks, all of which may weaken individuals' control over their health information and increase the risk of privacy infringement. Although China has established a preliminary legal framework for personal information protection, existing rules remain fragmented and insufficiently targeted. Specifically, the concept and scope of personal health information remain insufficiently defined, the legal bases for its processing require further clarification, and traditional informed consent rules are difficult to apply effectively in medical AI environments. Against this background, this article argues for the enactment of dedicated legislation on personal health information protection to establish a more systematic regulatory framework for defining health information and governing its processing. With respect to informed consent, the existing uniform requirement of separate consent should be refined through a tiered consent framework based on information classification and contextual risk assessment, complemented by dynamic consent mechanisms to enhance individuals' continuous control over their health information throughout the data-processing lifecycle. Furthermore, in response to emerging risks arising from the application of medical AI algorithms, a lifecycle governance framework covering algorithm design, training, and deployment should be established to enhance the accountability and safety of algorithmic processing.