Data Sharing, Consent and Privacy in Social Prescribing in Viet Nam: What Should Healthcare and Community Partners Share?

Data Sharing, Consent and Privacy in Social Prescribing in Viet Nam: What Should Healthcare and Community Partners Share?

Category: Viet Nam Context

An older adult has become increasingly isolated after a prolonged illness. During a hospital visit, a healthcare professional learns that the person would like to reconnect with others and suggests a nearby community activity. The individual is interested, and the hospital considers making a referral. The community organization needs a name, a way to make contact and perhaps some information about accessibility. But does it also need to know the person's diagnosis, treatment history, financial difficulties or family circumstances?

This everyday situation raises an important question for social prescribing: how can healthcare and community partners share enough information to provide appropriate support without disclosing more than necessary?

Social prescribing connects people with non-clinical services and community resources that may help address social needs and support health and well-being. These connections sometimes involve exchanging personal information between healthcare professionals, social workers, care navigators and community organizations. Yet the information each participant needs can be very different. A hospital may require detailed clinical records to provide treatment, while a community activity provider may need only a few practical details to help someone participate.

In Viet Nam, this distinction has become particularly relevant following the introduction of a new personal data protection framework in 2026. Healthcare organizations and community partners exploring social-prescribing pathways need to understand not only how information can improve coordination, but also when it should remain confidential. Better community-connected care should not come at the expense of the individual's privacy.

A referral can reveal more than we intend

Information sharing in social prescribing is not limited to medical records. A referral may involve details about loneliness, financial difficulties, family relationships, disability, mental health, employment or problems managing everyday life. Some of this information falls within legally defined categories of sensitive personal data. Other information may still be deeply private, even when it does not meet a particular legal classification.

Sometimes the referral itself reveals something about the person. A referral to a mental-health support organization may suggest psychological difficulties. A referral to a service supporting people affected by domestic violence may disclose circumstances that could create additional risks if revealed inappropriately. Even a relatively ordinary community referral can expose information the individual has not chosen to share with relatives, employers or others.

This is why privacy needs to be considered before information leaves the referring organization. The question is not simply whether the information is accurate or potentially useful. It is whether the intended recipient genuinely needs it for a specific and legitimate purpose.

The World Health Organization's 2022 social prescribing toolkit provides a useful framework for developing connections between healthcare and community services. However, establishing a referral pathway also requires decisions about information sharing that cannot be resolved simply by identifying an appropriate community activity. Those decisions need to reflect the legal environment, professional responsibilities and organizational arrangements in which the pathway operates.

Does information need to be shared at all?

Not every community connection requires personal information to move from one organization to another. Some people may prefer to receive information about local services and contact the provider themselves. Others may want a navigator to make an introduction but prefer to explain their circumstances directly to the receiving organization.

Someone interested in joining a local cultural or recreational activity, for example, might need only the venue's contact details, schedule and accessibility information. If the person can arrange participation independently, a formal referral containing personal information may add little value. In such circumstances, simple signposting may be sufficient, even though signposting alone should not automatically be equated with a complete social-prescribing pathway.

However, self-referral is not appropriate for everyone. People experiencing communication difficulties, limited digital access, mobility problems or complex social circumstances may need more active assistance. Requiring them to arrange every connection independently could reinforce the barriers that social prescribing is intended to help address.

A more appropriate approach is to match the level of navigation and information sharing to the person's needs and preferences. Some connections may require no disclosure between organizations, while others may need carefully coordinated communication. The amount of information shared should follow from what is genuinely necessary to make the connection work, not from the number of fields available in a referral form.

Different participants need different information

A social-prescribing pathway may involve a healthcare professional, hospital social worker, care navigator and community organization. Each has a different function, and those functions should guide what information is appropriate to receive.

Healthcare professionals may need information about diagnoses, treatment, medications and clinical risks. Navigators may need to understand the person's goals, social circumstances, practical barriers and preferences. Community organizations may need much more limited information about the support requested, contact arrangements, eligibility and accessibility.

Consider someone who wants to join a community walking group following a period of illness. The organizer may need to know that the person requires a shorter route or regular opportunities to rest. Knowing the diagnosis responsible for these limitations may not be necessary. If participation raises significant clinical safety concerns, those concerns should be assessed through an appropriate healthcare pathway rather than leaving an activity facilitator to make clinical decisions beyond their competence.

Similarly, an organization providing general social or financial assistance may need to understand the type of help being requested without receiving the person's medical history or unrelated family details.

The distinction becomes particularly important when information moves from a healthcare setting, where extensive records may be available, into a community environment where staff and volunteers have different responsibilities and professional competencies.

The information needed to provide healthcare is not automatically the information needed to provide community support.

What does Vietnamese law require?

Viet Nam's Law No. 91/2025/QH15 on Personal Data Protection, effective from 1 January 2026, provides the principal legal framework for protecting personal data. Article 3 establishes principles including lawful processing for specific and clearly defined purposes, accuracy, appropriate retention and protective measures. These principles are directly relevant to social prescribing because a referral may involve several organizations processing information for different purposes.

Article 9 sets out requirements for consent. Consent must be voluntary and informed, expressed clearly and specifically, and associated with the relevant purposes of processing. Individuals must be informed about the categories of personal data being processed, the purposes of processing, the responsible data controller or controller-processor, and their rights and obligations. Silence or failure to respond cannot be treated as consent.

The Law also distinguishes between different activities involving personal data. Article 15 addresses the provision of personal data, while Article 17 regulates personal data transfers. These distinctions matter when a hospital provides information to a community partner, transfers data for further processing or engages another organization to process information on its behalf. The legal characterization depends on the actual arrangement, rather than simply on whether information is sent by email, uploaded to a platform or included in a referral form.

Article 19 identifies circumstances in which personal data may be processed without consent, subject to the conditions established by law. These include certain urgent situations involving the protection of life, health or other legally protected interests, as well as other specified circumstances. Such exceptions should not be interpreted as general permission to share information whenever obtaining consent is inconvenient.

Health information receives additional protection under Article 26. The provision requires consent for collecting and processing personal data relating to health, except in the circumstances specified under Article 19(1). Article 26(2) also establishes a particular restriction on entities operating in the health sector providing personal data to third parties that offer healthcare services or specified health- and life-insurance services, unless the individual makes a written request or a relevant statutory exception applies.

This provision requires careful interpretation. It should not automatically be applied in the same way to every non-clinical community organization. A community walking group, an organization providing social assistance and a licensed healthcare provider may have different legal statuses and responsibilities. The applicable requirements must be assessed according to the actual recipient, the information involved and the proposed disclosure.

Decree No. 356/2025/ND-CP, also effective from 1 January 2026, provides further implementation requirements and replaced the earlier Decree No. 13/2023/ND-CP. Article 4 identifies categories of sensitive personal data, including health status and information concerning private life, personal secrets and family secrets. It also requires organizations processing sensitive personal data to establish appropriate access restrictions, procedures and security measures.

Article 7 of Decree 356 provides more detailed requirements concerning personal data transfers. For transfers under Points a, c and d of Article 17(1) of the Law, the transferring and receiving parties must establish a data-transfer agreement covering matters such as purpose, categories of data, legal basis, retention, protection responsibilities and the handling of violations. The Decree also specifies additional protective measures for transfers involving sensitive personal data.

Importantly, Article 7(6) distinguishes the provision of personal data under Article 15(2), based on specific requests from data subjects, from transfers governed by that article of the Decree. Such provision is not treated as a data transfer for the purposes of Article 7. This means that a disclosure made in response to an individual's specific request and an ongoing transfer arrangement between a hospital and community organization may require different legal assessments. Neither should be treated as automatically exempt from other applicable data protection requirements.

The healthcare context adds another layer. Law No. 15/2023/QH15 on Medical Examination and Treatment, particularly Articles 10 and 69, protects the confidentiality of medical records and private information provided by patients, subject to applicable legal exceptions. Hospital-based pathways should also consider existing social-work arrangements under Circular No. 51/2024/TT-BYT, effective from 1 March 2025, which regulates social-work activities in medical examination and treatment establishments licensed to operate as hospitals.

The regulatory environment has continued to develop. Decree No. 330/2026/ND-CP, effective from 19 August 2026, establishes administrative penalties for violations in cybersecurity and personal data protection.

Taken together, these laws and regulations do not establish a national social-prescribing data-sharing model for Viet Nam. They do establish obligations that healthcare and community partners must consider when designing pathways that involve personal information.

Consent should be a meaningful choice

Consent is sometimes treated as a form that someone signs before receiving a service. In social prescribing, this approach can overlook important differences between agreeing to participate in an activity, agreeing to be contacted and agreeing to share particular personal information.

A person who accepts a referral to a community activity has not necessarily agreed to disclose their diagnosis or treatment history. Someone who agrees to speak with a navigator has not automatically authorized the navigator to distribute information about their family, finances or mental health to several organizations.

Consent should therefore relate to a clearly understood purpose. Individuals should know what information is proposed for sharing, who will receive it, why it is needed and what choices are available. Where several processing purposes are involved, the requirements applicable to each purpose must be respected. Agreement to receive community support should not be used to justify unrelated publicity, fundraising, marketing or research activities.

Article 6 of Decree 356 recognizes several methods of recording consent, including written forms, recorded telephone calls, text-message confirmation and specified electronic methods, provided the relevant requirements for verification are satisfied. Where consent is required, the responsible organization must be able to demonstrate that valid consent was obtained. For sensitive personal data, individuals must also be informed of the sensitive nature of the information being processed.

The method of obtaining consent should reflect the legal requirements and the person's circumstances. Some people may need information in accessible language, assistance with communication or additional time to understand their options. Where legally recognized representation is required, the applicable arrangements must be respected.

Consent is important, but it does not remove the responsibility to determine whether a disclosure is lawful, necessary and proportionate. A person may agree to share information that the receiving organization does not actually need. Responsible organizations should still avoid unnecessary collection and disclosure.

What should a community organization actually receive?

There is no universal dataset suitable for every social-prescribing referral. The information needed by a community exercise group may be very different from what is needed by an organization offering individualized social assistance, transportation or another specialized service.

For a relatively straightforward connection, appropriate information might include the person's preferred name, agreed contact details, preferred communication method, requested service and relevant accessibility needs. Where necessary and lawful, an appropriate contact may also be identified to help resolve difficulties with the referral.

Additional information should have a clear reason for being included. If someone requires wheelchair access, the receiving organization may need to know about that requirement rather than the diagnosis responsible for it. If someone needs communication assistance, the organization may need to understand how best to communicate without receiving unrelated clinical details.

Sometimes additional information is necessary, particularly where a service has specific eligibility or safety requirements. Those requirements should be identified before disclosure, and the receiving organization should have the competence and authority to use the information appropriately.

A practical risk arises when it is easier to forward an existing clinical document than to prepare a limited referral. A hospital discharge summary or consultation note may contain considerable information unrelated to the community service. Sending the entire document can create unnecessary privacy risks, even when the intention is to help the individual.

Referral forms should therefore encourage relevant, factual and proportionate information. Free-text fields deserve particular attention because they can become places where sensitive details, subjective judgments or unnecessary personal histories are recorded.

A useful referral should communicate what the receiving organization needs to do, without automatically transferring everything the referring organization knows.

Community partners need clearly defined responsibilities

A community organization may work closely with a hospital without becoming part of the hospital's internal information system. It may be a charity, social enterprise, association or another service provider with its own governance, employees, volunteers and administrative arrangements.

Under Vietnamese data protection law, organizations need to determine their actual roles in processing personal data. A data controller determines the purposes and means of processing, while a data processor processes information on behalf of a controller or controller-processor through the relevant contractual arrangement. The Law also recognizes controller-processors and third parties.

A community organization does not automatically become a data processor simply because it receives referrals from a hospital. If it independently determines how information is used to deliver its own services, its legal role may differ from that of a technology vendor processing information solely according to the hospital's instructions.

These distinctions affect responsibilities for lawful processing, security, retention and responding to requests from individuals. Where agreements are required by law, they must satisfy the applicable requirements. Even where a particular arrangement does not require the same formal agreement, documenting responsibilities can help prevent misunderstanding.

This is particularly important when community services operate with limited administrative resources or rely on volunteers. A small organization may not have the same technical capabilities as a hospital, but that does not make confidentiality less important. The safeguards should be appropriate to the information being handled and the organization's actual role.

Partnership should not mean that a larger organization transfers sensitive information and leaves a smaller organization to manage the associated risks without adequate preparation.

Everyday communication creates everyday privacy risks

Practical coordination in Viet Nam may involve telephone calls, email, messaging applications such as Zalo, spreadsheets, online forms or paper records. These tools can make communication convenient, but familiarity with a method does not establish that it is appropriate for sharing personal or sensitive information.

A navigator might send referral details through a group chat containing several staff members or volunteers. A community facilitator might store participants' contact information on a personal phone. A spreadsheet originally intended for a small team might later be shared more widely. An online registration form might request information that has little relevance to the activity being offered.

Privacy can also be affected by seemingly minor decisions. Adding someone to a messaging group may reveal their telephone number to other participants. A notification from an identifiable support organization might reveal information about the assistance being sought if another person sees the message.

These situations illustrate how privacy risks can emerge through ordinary working practices rather than deliberate misconduct. Organizations should therefore assess their communication methods, restrict access to those who need the information and provide appropriate guidance to employees and volunteers. Relevant safeguards may include approved communication channels, secure storage, access permissions, authentication, encryption and clear procedures for handling information when responsibilities change.

Cloud services and overseas technology providers require additional attention. Article 20 of the Personal Data Protection Law regulates specified forms of cross-border personal data transfer, including certain circumstances involving overseas storage, recipients or platforms used to process data collected in Viet Nam. Whether an impact assessment is required, or an exemption applies, depends on the actual data flows and legal conditions. The fact that an application is widely used does not, by itself, establish compliance.

Digital tools can make navigation easier, but they should not determine what information is collected or how widely it is disclosed.

Family involvement should respect the individual's privacy

Family members can play an important role in helping people access healthcare and community support in Viet Nam. They may provide transportation, arrange appointments, assist with communication or accompany relatives to activities. Such involvement can be particularly valuable for older people or those experiencing functional limitations.

However, family involvement does not automatically create unrestricted access to personal information. A spouse, adult child or other relative may have a legitimate supporting role without needing to know every diagnosis, personal disclosure or detail of the individual's interactions with community services.

This becomes particularly relevant when social prescribing addresses family difficulties, psychological distress or other sensitive circumstances. A person may welcome practical assistance from a relative while preferring to discuss certain matters privately with a professional or navigator.

Caregiver support also requires attention to whose information is being processed. A caregiver seeking assistance may disclose information about themselves and the person receiving care. Those details concern different individuals and may require different legal considerations.

Where someone has a legally recognized representative or requires support in decision-making, the applicable legal requirements should be followed. Age, disability or diagnosis alone should not be treated as sufficient reason to disregard the person's preferences.

A person-centered approach therefore asks how the individual wishes family members to be involved, what information may be shared and which legal arrangements apply.

What information should come back to healthcare?

Information sharing may continue after a community organization receives a referral. A healthcare team or navigator may reasonably need to know whether contact was made, whether the referral was accepted or whether additional assistance is required.

That does not mean every conversation or activity within the community service should be reported back to the hospital. For many referrals, limited feedback may be sufficient. The receiving organization might confirm that the person was contacted, accepted or declined the service, or requested further assistance. Where a new concern requires professional attention, additional communication may be justified according to the circumstances and applicable legal requirements.

By contrast, detailed accounts of personal conversations, relationships or activities within a community group may have little relevance to the referring healthcare team.

The distinction also matters for evaluation. A social-prescribing program may wish to understand participation, accessibility and outcomes. However, monitoring program performance does not automatically justify collecting identifiable information about every aspect of a person's community life.

Aggregated or appropriately anonymized information may be sufficient for some evaluation purposes. Nevertheless, small groups and unusual combinations of characteristics can create re-identification risks. Removing a person's name alone does not necessarily make information anonymous.

The underlying principle is that information needed to support an individual and information needed to evaluate a program serve different purposes. Each purpose should be defined and assessed appropriately.

International guidance offers useful reference points. NHS England's guidance on sharing information with voluntary-sector organizations, updated in May 2026, emphasizes confidentiality, appropriate consent, transparency and limiting information to what non-clinical services require. The NHS Social Prescribing Information Standard, DAPB4066, provides a framework for consistent information recording across referrals, link-worker records and communication back to referrers.

These references need to be understood within their own context. The current phase of the NHS information standard focuses on consistent information capture rather than establishing an operational mechanism that automatically authorizes data exchange. Similarly, English requirements concerning confidentiality and consent should not be assumed to satisfy Vietnamese law.

Retention, withdrawal and incidents require clear arrangements

Privacy responsibilities continue after a referral is completed. A community organization may no longer need certain information once its involvement ends, while a healthcare provider may have separate legal obligations to retain medical records. A navigator may need limited documentation for continuity or accountability.

There should not be an arbitrary retention period applied to all information across every organization. Retention should reflect the processing purpose, applicable legal requirements and the responsibilities of the organization holding the data.

The Personal Data Protection Law recognizes rights relating to information, consent, withdrawal, access, correction, deletion and restriction, subject to legal conditions. Article 5 of Decree 356 establishes procedures and time limits for responding to relevant requests. Organizations should distinguish among these rights rather than treating every request as an immediate requirement to delete all records.

Withdrawal of consent does not automatically invalidate processing that lawfully occurred before withdrawal. Nor does it necessarily eliminate independent statutory retention obligations. Organizations therefore need procedures to distinguish information that should no longer be processed from information that remains subject to lawful retention.

Partners also need to know what happens if information is sent to the wrong recipient, accessed without authorization or disclosed more widely than intended. Article 23 of the Personal Data Protection Law establishes notification and response obligations for personal-data-protection violations. Under Article 23(1), qualifying violations that may cause the specified harms to national security, public safety or individuals' protected interests must be reported to the competent specialized personal data protection authority within 72 hours of detection. Article 23 also addresses other circumstances requiring notification. Organizations should therefore assess both the applicable reporting duty and any deadline, rather than assuming that every incident follows one identical notification rule.

A community organization should not be left to determine these matters without clear responsibilities, appropriate guidance and an agreed escalation process.

What could responsible information sharing look like in Viet Nam?

A Vietnamese social-prescribing initiative does not need an elaborate technology platform to begin developing responsible information-sharing practices. It can start by examining one clearly defined referral pathway and identifying what information genuinely needs to move through it.

Consider a hospital working with a community organization to help selected patients reconnect with local activities. The hospital could retain detailed clinical information within its existing systems, while a navigator accesses only the information necessary to understand the person's goals and coordinate support. The receiving organization could receive a more limited referral containing agreed contact details, the requested activity and relevant practical requirements.

Before implementing the pathway, the partners would need to establish the applicable legal basis, determine whether each information flow constitutes provision or transfer of data, define their processing roles and meet any relevant consent, agreement, security and impact-assessment obligations. They would also need to determine what feedback is appropriate and how individuals can exercise their data protection rights.

Where sensitive personal data is involved, organizations should pay particular attention to Decree 356. Article 41 provides certain exemptions from specified formal obligations for qualifying small businesses, startups, microenterprises and household businesses, subject to conditions and exceptions. In particular, the exemptions do not apply in the same way where an organization directly processes sensitive personal data or meets other specified conditions. An organization's small size should therefore not be assumed to remove its responsibilities.

Practical arrangements also need to reflect how people access services. Some may prefer a telephone introduction, others may use online registration, and some may need assistance from a family member or navigator. Alternative methods should be considered where feasible, with appropriate confidentiality and documentation.

One useful exercise is to follow a typical referral from beginning to end and examine what each participant actually needs to know. Who first learns about the person's social needs? What information is recorded? What does the individual understand and agree to? Who receives the referral? What happens if the person changes their mind or the original community service is unavailable? What information, if any, should return to the healthcare team?

These questions can reveal unnecessary data collection, unclear consent procedures, excessive access permissions or situations in which information could be shared more simply.

The purpose is not to create administrative complexity. It is to make information sharing deliberate, understandable and proportionate from the beginning.

Better community connection should not require unnecessary disclosure

Social prescribing aims to help people access meaningful support beyond clinical care. Sometimes this requires coordination and carefully managed information sharing. At other times, the most appropriate approach may be to provide information, assist with an introduction or allow the person to contact a community organization independently.

A referral should not become an opportunity to transfer someone's entire medical or social history simply because the information is available. Nor should privacy requirements be interpreted so rigidly that they prevent appropriate and lawful support, particularly when individuals need assistance navigating services.

For Viet Nam, responsible information sharing in social prescribing should begin with a clear distinction between what healthcare needs to know, what navigation needs to know and what community partners genuinely need to provide their services.

The central question is not whether sharing more information could make a referral easier. It is whether each disclosure serves a clear purpose, has an appropriate legal basis and is supported by sufficient safeguards, while respecting the individual's needs and preferences.

Better connections between healthcare and community resources should help people participate more fully in everyday life. They should not require people to give up more of their privacy than is necessary to receive that support.

References

1. National Assembly of Viet Nam. Law No. 91/2025/QH15 on Personal Data Protection. Enacted 26 June 2025. Effective 1 January 2026.

2. Government of Viet Nam. Decree No. 356/2025/ND-CP detailing certain articles and measures for implementation of the Law on Personal Data Protection. Issued 31 December 2025. Effective 1 January 2026.

3. Government of Viet Nam. Decree No. 330/2026/ND-CP on administrative penalties in cybersecurity and personal data protection. Issued and effective 19 August 2026.

4. National Assembly of Viet Nam. Law No. 15/2023/QH15 on Medical Examination and Treatment. Enacted 9 January 2023. Effective 1 January 2024.

5. Ministry of Health of Viet Nam. Circular No. 51/2024/TT-BYT on the implementation of social work in medical examination and treatment establishments. Issued 31 December 2024. Effective 1 March 2025.

6. World Health Organization Regional Office for the Western Pacific. A toolkit on how to implement social prescribing. Manila: WHO Regional Office for the Western Pacific; 2022.

7. NHS England. Sharing information with the voluntary sector. Information Governance Guidance. Updated 7 May 2026.

8. NHS England. Social Prescribing Information Standard (DAPB4066). Phase 1 published 16 January 2023. NHS Standards Directory, page updated 30 March 2026.

This article provides an educational and implementation-focused overview of information sharing, consent and privacy in social prescribing. It does not constitute legal advice. The requirements applicable to a particular organization or referral arrangement should be assessed according to the relevant circumstances and current Vietnamese law.