Investment and management of private medical examination and treatment facilities in Vietnam are subject to various legal changes. For investors and chief medical officers, legal risks encompass administrative compliance, consistency of the operating license system, health insurance payment regulations, and data security. The promulgation of new legal documents effective directly from 2024 to 2026 requires medical facilities to review and consolidate their internal governance systems. This report analyzes current legal regulations for enterprises operating or preparing to establish private clinics and hospitals, updated to June 2026.

1. Primary Causes of Legal Risks in Operating Private Healthcare Facilities

Inspection practices reveal that private medical facilities are frequently penalized due to inconsistencies between actual business models and legal regulations. Currently, administrative fines have been increased under Decree 90/2026/ND-CP, directly affecting the finance and operations of enterprises.   

1.1. Inconsistency between Business Orientation and Legal Limits

Healthcare enterprises often expand high-profit margin services such as internal aesthetics, dermatology, or high-tech diagnostic services. However, commercializing these services before completing the procedures to supplement the technical portfolio is a violation that leads to operational suspension. State management agencies stipulate that all medical services are conditional business services and are only permitted to operate after undergoing appraisal and approval procedures. The gap between the speed of service deployment and the completion of administrative procedures creates legal risks for medical facilities.

1.2. Risks in Personnel Management and Professional Decentralization

The management of practicing personnel is a critical factor. Many clinics maintain the practice of borrowing personnel records to legitimize initial licensing conditions, while the actual practitioners are not present at the facility during their registered working hours. With the national database on medical practice, management agencies can easily detect cases where one person registers to work full-time at multiple facilities. Overlapping working hours is the basis for determining legal violations, leading to the revocation of the facility’s operating license and the individual’s practicing license. Assigning personnel to perform techniques beyond their trained professional scope is also a frequently detected violation.

1.3. Gaps in Internal Procedures and Evidence of Compliance

Legal compliance requires medical facilities to establish a system of internal records and documents to prove implementation. During inspections, the lack of standard operating procedures, equipment operation logs, or medical records lacking complete consultation and prescription steps will be deemed a violation of professional technical regulations. Internal procedures that are issued but not practically applied, without cross-monitoring mechanisms, will reduce the effectiveness of the internal legal risk management system.

2. Operating Licenses and Professional Scope

The licensing system of private medical facilities is directly regulated by Law 15/2023/QH15 and Decree 96/2023/ND-CP. Establishing the correct license structure right from the initial investment phase determines the long-term legality of the medical project.   

2.1. Evaluating the Alignment between Actual Capacity and the Operating License

Enterprises need to clearly define whether their operating model is a general clinic, a specialized clinic, or a hospital. Each model is governed by different specialized standards regarding floor area, personnel structure, medical equipment, and hazardous medical waste treatment systems. General clinics require a minimum number of specialties and more complex coordination compared to independent specialized clinics.

The principle of legal compliance is to only register a scope of professional practice that matches the actual capacity at the time of submitting the appraisal dossier. Registering an overly broad technical portfolio without corresponding equipment or qualified personnel will result in the management agency rejecting the license application. From a management perspective, maintaining a license with a broad technical portfolio creates significant compliance costs. Medical facilities must pay salaries to specialized doctors just to meet valid personnel conditions, even if those services generate no revenue. The optimal approach is to start with a core technical portfolio, then proceed with supplementary procedures according to the scale expansion roadmap.

2.2. Mandatory Cases for Adjusting the Operating License

According to Decree 96/2023/ND-CP, medical facilities must submit an application for operating license adjustment in the following situations. The provision of medical examination and treatment services is not permitted to continue if these changes have not been approved in writing:   

• Change of operating location: Medical facilities cannot arbitrarily move equipment to another location or expand the usable area of the current facility without reporting. All spaces providing medical services must undergo re-appraisal for radiation safety for X-ray rooms, fire prevention and fighting acceptance, and hygiene conditions evaluation for minor surgery and operating rooms.
• Change of the person in charge of professional and technical expertise: This is the key personnel position determining the legal status for the facility to operate. Medical facilities are not permitted to perform medical examination and treatment activities during the period when the position of the person in charge is vacant. The replacement must meet the conditions of practice time and professional scope suitable for the facility’s model.
• Supplementing the technical portfolio and expanding the scope of operation: When purchasing new medical equipment or implementing new treatment methods, enterprises must submit an application for approval to supplement the technical portfolio. The dossier must include labor contracts, practicing licenses of personnel operating the equipment, and documents proving the origin of the medical equipment.

The law prescribes strict penalties for providing services beyond the scope of the issued operating license. Based on Decree 90/2026/ND-CP, the act of providing medical examination and treatment services beyond the approved professional scope is subject to a maximum fine of 100,000,000 VND for violating organizations, accompanied by the additional penalty of time-limited revocation of the operating license.   

3. Practicing Personnel and Medical Practicing Licenses

Under Law 15/2023/QH15, the term “practicing certificate” has been replaced by “practicing license”. This regulation links practicing capacity with periodic competency assessment exams and continuous medical education requirements.   

3.1. Transitioning and Maintaining Practicing Licenses under New Regulations

Medical enterprises must review their personnel participating in the medical examination and treatment process to ensure all medical staff possess valid Practicing Licenses. Decree 96/2023/ND-CP clearly states the mandatory practice time requirement before licensing. For doctors, the practice time is set at 12 months, including 09 months of specialized medical practice and 03 months of intensive care practice.   

The licensing procedure is also specified for distinct titles such as traditional medicine practitioners, owners of family remedies, or owners of traditional healing methods. These individuals carry out procedures to request new issuance, re-issuance, or extension of practicing licenses under Decree 96/2023/ND-CP. Enterprises need to establish procedures to verify the legality of diplomas and licenses through the national information portal.   

3.2. Managing Actual Registered Practicing Time

Management agencies are stepping up the cross-checking between the list of personnel registered with the Department of Health and the actual duty rosters and timesheets at medical facilities. The law defines a full-time practitioner as an employee who has been granted a practicing license and registers to practice during the entire administrative working hours of the medical facility.   

This regulation binds the exclusivity of administrative time. If a medical expert works full-time at a state facility, they only have the right to register to work outside administrative hours or on days off at a private clinic. Private clinics must build a personnel management dossier including labor contracts, detailed task assignment decisions, publicly posted work schedules, and signed timesheets. A doctor signing a medical record during a time frame when they are registered to work at another facility constitutes grounds for determining a violation. The Social Security Agency will refuse to pay costs arising from those records, and the inspection agency will impose administrative fines on both the individual practitioner and the medical facility.

3.3. Assigning Work in Strict Compliance with the Scope of Practice

A common error at private clinics is cross-functional personnel usage, such as duties belonging to rehabilitation technicians being performed by nurses, or general practitioners performing in-depth specialized procedures without valid supplementary training certificates. The Chief Medical Officer must issue internal task assignment documents, clearly specifying which individual is permitted to perform which medical technical service codes. This assignment is based on the professional scope on the individual’s Practicing License and continuous training certificates.

4. Operational Compliance Framework and Administrative Penalties in the Healthcare Sector

Under Decree 90/2026/ND-CP, effective from May 15, 2026, the administrative penalty framework in the healthcare sector has been increased. State management agencies apply high financial penalties to ensure patient safety.   

4.1. Internal Documentation System Demonstrating Compliance

To comply with legal requirements during inspections, private medical facilities must establish a comprehensive compliance management system. This system is stored in written form with clear audit trails, demonstrating continuous operation.

The standard compliance documentation set includes:

• Infrastructure legal records: Original operating license, decision approving the technical portfolio, environmental impact assessment record or environmental protection plan, fire prevention and fighting design and acceptance record, hazardous medical waste collection and treatment contract, radiation safety inspection certificate.
• Medical personnel records: Certified copies of Practicing Licenses, labor contracts, practitioner registration documents, appointment decisions for the person in charge of professional and technical expertise, and continuous medical education certificates.
• Clinical quality management procedures: Standard operating procedures on infection control, emergency drug and supply management procedures, emergency triage procedures, reception and handling procedures for medical incidents according to Ministry of Health guidelines.
• Inspection reception procedures: Internal guidelines for staff on reception procedures, providing documents, and working with inspection teams to ensure the provision of accurate information.

4.2. Analysis of the Penalty Framework under Decree 90/2026/ND-CP

Decree 90/2026/ND-CP comprehensively regulates violations ranging from medical examination and treatment, preventive medicine, pharmaceuticals, medical equipment management to health insurance and population. The maximum fine for individuals violating regulations in medical examination, treatment, pharmaceuticals, cosmetics, and medical equipment is 100,000,000 VND. The fine for organizations is twice the fine for individuals, equating to a maximum of 200,000,000 VND.   

Enterprises must note specific fines for violation groups during clinical operations:

• Violations of medical record regulations: Failure to create medical records, creating incomplete medical records, or failing to comply with medical record storage regulations is fined from 1,000,000 VND to 3,000,000 VND for individuals, equivalent to 2,000,000 VND to 6,000,000 VND for organizations.   
• Violations of emergency professional responsibilities: Failure to transfer emergency patients to an appropriate medical facility when the patient’s condition exceeds the facility’s technical capacity is fined from 10,000,000 VND to 15,000,000 VND for individuals. This requires private clinics to build appropriate emergency triage, diagnosis, and transfer procedures.   
• Violations regarding aesthetic interventions: Performing invasive aesthetic interventions such as surgery, injection, orthopedics, or tattooing using injectable anesthetics at facilities that are not hospitals with an aesthetic department or specialized aesthetic clinics with an appropriate scope is fined from 20,000,000 VND to 30,000,000 VND for individuals. Additional penalties include time-limited operational suspension and confiscation of violating exhibits.   
• Violations of public health environment: Forcing others to smoke illegally is fined from 500,000 VND to 1,000,000 VND.   

Besides the Department of Health Inspectorate, Decree 90/2026/ND-CP decentralizes sanctioning authority to the Chairperson of the Commune People’s Committee, with fines up to 15,000,000 VND for population-related administrative violations and 25,000,000 VND for certain violations in other sectors.   

4.3. Mechanism for Handling Violations in the Electronic Environment

Decree 90/2026/ND-CP regulates the mechanism for handling administrative violations in the healthcare sector within the electronic environment. Violations committed via digital platforms and electronic systems will be subject to penalties based on digital evidence collection mechanisms. Data from official websites, clinic social media pages, online health consultation messages, or data extracted from clinic management software hold legal validity for authorities to issue administrative violation records. This requires the executive board to establish strict content control mechanisms for communications and online customer care departments, ensuring the legality of medical information in cyberspace.   

5. Legal Risk Management in Healthcare Service Advertising

Medical examination and treatment services fall under the special service category. The asymmetry of medical information between practitioners and patients requires the state to apply strict censorship regulations on advertising activities. Enterprises must ensure compliance with advertising laws in communication campaigns.

5.1. Mandatory Requirement for Advertising Content Confirmation and Jurisdictional Changes

Pursuant to Circular 09/2015/TT-BYT and Decree 181/2013/NĐ-CP, advertising materials for medical services deployed on any media must be approved by state management agencies before publication. The Certificate of Advertising Content Confirmation certifies that the communication content strictly aligns with the professional technical portfolio and the facility’s operating license.   

From July 1, 2026, under Resolution 21/NQ-CP, the Ministry of Health transferred the authority to issue advertising content confirmations for medical services to the specialized health agencies under the Provincial People’s Committees. This jurisdictional shift allows localities to proactively manage and handle violations. The application dossier requires medical facilities to submit detailed advertising scripts, design templates, dialogue descriptions, and clearly display mandatory information such as facility name, exact address on the operating license, along with necessary medical warnings.   

5.2. Prohibited Boundaries in Advertising Content and Penalties

Common violations in advertising content include the use of absolute adjectives such as committing to a complete cure, asserting the method is unique, or providing before-and-after treatment comparison images. Using personal images or videos of a patient’s treatment process without written voluntary consent constitutes a privacy violation.

If a medical facility advertises without being granted content confirmation, or broadcasts content deviating from the approved dossier, the enterprise will be subject to administrative penalties. The fine for improperly advertising medical services ranges from 15,000,000 VND to 25,000,000 VND, forcing the remedial measure of removing the violating content.   

5.3. Legal Responsibilities Regarding Influencers and Third-Party Platforms

From a legal perspective, statements by individuals regarding the clinic’s service quality, if paid for, sponsored with products, or provided with free services by the clinic, are defined as advertising acts for which the clinic bears responsibility.

Communication cooperation contracts with third parties must stipulate legal responsibilities. Third parties are only permitted to post information based on the script approved in the advertising content confirmation. If a third party arbitrarily makes false commitments leading to the clinic being penalized, the contract should contain clauses requiring the third party to compensate for damages. Medical facilities need to periodically review online platforms to detect and promptly remove user-generated advertising content that violates legal regulations.

6. Health Insurance, Pricing Policies, and Risks in Payment Settlement

Participating in the provision of health insurance medical services entails legal regulations and the electronic assessment process of the Social Security Agency. Data discrepancies in dossiers can lead to the medical facility’s costs being refused payment (health insurance claim disallowance).

6.1. Changes in Payment Structure under Law 51/2024/QH15

The legal framework governing health insurance activities changed when Law 51/2024/QH15 took effect on July 1, 2025. The concept of administrative medical facility levels including commune, district, provincial, and central levels is being replaced by a synchronized technical-professional grading system comprising three levels: primary, basic, and intensive.   

Private medical facilities need to determine their positioning within this new technical grading to accurately apply cross-level payment rates. The facility’s hospital management software must update the latest technical portfolio and drug list codes to synchronize with the electronic assessment portal of Vietnam Social Security. The Law expands the scope of payment to include telehealth and home healthcare costs for certain subjects, while increasing the benefit rate to 100% of costs for individuals aged 70 to under 75 belonging to near-poor households. The issuance of electronic health insurance cards is mandated to be completed within a maximum of 05 working days from the receipt of a complete dossier.   

6.2. Expanding Covered Subjects and Insurance Premium Rates

Law 51/2024/QH15 expands the mandatory health insurance participant groups, including foreign workers working in Vietnam under contracts, registered household business owners, religious workers, and village health workers. Private medical enterprises have an obligation to pay health insurance for their personnel. The maximum contribution rate is set at 6% of the monthly salary serving as the basis for compulsory social insurance contributions. The payment method allows for monthly, quarterly, or bi-annual payments, with the latest deadline being the last day of the payment cycle.   

6.3. Controlling Claim Disallowance Risks and Penalties for Health Insurance Violations

The primary reasons for health insurance claims being disallowed often stem from a lack of logic in administrative paperwork. Common errors include prescribing high-tech tests without noting medical reasons in the medical record; system recording service execution times prior to admission times; or doctor signatures on prescription slips mismatching duty rosters. The assessment system scans for these anomalies and automatically denies payment. Private clinics and hospitals must build control measures within their management software, establishing alerts if prescriptions exceed treatment protocols, and organizing internal assessment departments to review dossiers.

Under Decree 90/2026/ND-CP, evading health insurance payments for employees, late payments, falsifying dossiers, or profiteering from the health insurance fund are fined from 70,000,000 VND to 100,000,000 VND. Late health insurance payments are penalized based on the number of personnel and the late amount (fines up to 35,000,000 VND), simultaneously compelling the full payment of the late amount plus interest equal to 0.03%/day calculated on the late amount. Lending a health insurance card to another person for medical treatment is fined from 1,000,000 VND to 2,000,000 VND, and fined from 3,000,000 VND to 5,000,000 VND if the act appropriates health insurance funds below the threshold for criminal prosecution. Authorities apply remedial measures forcing the full refund of the appropriated amount.   

6.4. Managing Healthcare Service Prices and Promotional Programs

For on-demand medical services not registered for health insurance payment, private medical facilities must comply with pricing regulations. Technical service costs, bed charges, and examination fees must be publicly listed at the reception area and on the website. Collecting additional surcharges requires prior notification and written consent from the patient. Communicating medical service packages as promotional forms must ensure consistency between listed pricing policies, service provision contracts, and communication messages.

7. Healthcare Digital Transformation: Electronic Medical Records and Personal Data Management

The digitization process of management workflows in the healthcare system is governed by Circular 13/2025/TT-BYT guiding the implementation of electronic medical records and Decree 13/2023/ND-CP on personal data protection.

7.1. Mandatory Roadmap for Implementing Electronic Medical Records

Circular 13/2025/TT-BYT, effective from July 21, 2025, regulates the roadmap for applying electronic medical records. Medical examination and treatment facilities licensed as hospitals must complete the implementation of the electronic medical record system no later than September 30, 2025. Other medical facilities providing inpatient, day-case, and outpatient treatment must complete implementation no later than December 31, 2026.   

For paper medical records created before the document’s effective date, the head of the medical facility decides on converting the storage format from paper to data messages in compliance with electronic transaction regulations. Electronic medical records created, displayed, digitally signed, and stored via electronic means meeting the Ministry of Health’s technical standards hold equivalent legal validity to paper medical records.   

7.2. Infrastructure Technical Standards and Identity Authentication Requirements

Medical facilities must be equipped with data processing servers, workstations, network connectivity systems, and data storage solutions including backup options.   

The identity authentication process requires medical staff, patients, or their legal representatives to electronically sign and confirm via legal digital signatures, personal biometric techniques, or other electronic confirmation methods. Patients’ medical data must be linked to the personal identification numbers of Vietnamese citizens and foreigners. The electronic medical record system allows authorities to extract access logs to verify the time medical operations were performed.   

7.3. Protecting Personal Healthcare Data

Medical records contain sensitive information about patients’ pathologies. Under Decree 13/2023/ND-CP, this is sensitive personal data requiring a high level of protection. Private medical enterprises participating in collecting and managing this data hold the legal status of Personal Data Controllers and Processors.   

Collecting, transferring, or processing medical data strictly requires the data subject’s consent after they are provided with information regarding the purpose and processing method. Automatically collecting or trading patient data without consent is a legal violation. Transferring personal data to organizations abroad must meet regulatory requirements.   

Medical facilities need to integrate personal data processing consent agreements at the initial patient reception stage. When signing contracts with software providers, enterprises must stipulate responsibilities for information confidentiality, system access decentralization, and limitations on compensation liability for the software provider in case of data incidents.

8. Internal Legal Compliance Review Criteria

To ensure compliance, the executive board of private medical facilities needs to establish periodic self-inspection mechanisms. Review criteria include:

• Evaluating Operating License Compatibility: Is the facility providing any medical services not listed in the technical portfolio approval decision issued by the Department of Health? Are any medical devices operating without being included in the approved appraisal list ?
• Evaluating Personnel Practicing Records: Do all personnel performing professional tasks hold valid Medical Practicing Licenses? Does the professional scope on the license cover the medical prescription codes currently being executed? Are there discrepancies between actual duty rosters and work schedules submitted to the Department of Health ?
• Evaluating Advertising Control Procedures: Does the person in charge of professional and technical expertise review advertising content before publication? Does the facility possess Advertising Content Confirmations for current campaigns? Does the actual communication content match the approved drafts ?
• Evaluating Health Insurance Payment Risks: Has the internal management software set up alerts when doctors prescribe services deviating from treatment protocols? Do medical records contain full clinical progression rationale before data is transferred to the payment portal ?
• Evaluating Digital Transformation and Data Protection: Has the private hospital completed the electronic medical record system application according to the September 2025 schedule ? Has the private clinic prepared to meet the electronic medical record deadline of December 2026? Does the reception process require patients to sign consent for personal data processing ?

Upon detecting violations, enterprises must promptly implement corrective measures, prioritizing: standardizing the operating license system, completing professional personnel legal records, censoring advertising activities, and upgrading IT systems for electronic medical records.

9. Frequently Asked Questions in Healthcare Legal Practice

9.1. Delays in the Operating License Application Procedure

Prolonged appraisal of operating license applications impacts business plans. The primary cause is enterprises submitting an overly broad registered technical portfolio that exceeds the actual capacity of the floor area or equipment system. Lacking environmental and fire safety acceptance documents from specialized agencies prior to submission to the Department of Health also stalls the procedure.

9.2. Legal Management of Telehealth Service Models

Telehealth models require defining professional liability limits when doctors do not conduct direct clinical examinations. If consultations based on incomplete data lead to patient consequences, compensation liability extends jointly to the individual doctor and the medical facility. Conducting online consultations requires enterprises to establish data security systems to protect patients’ pathological information.

9.3. Decisions on Partial Suspension of Professional Operations

During inspections, if management agencies discover a functional department or service group failing to meet personnel or equipment standards, authorities will issue a decision to partially suspend the medical facility’s operations. The facility must seal the suspended area, remove related advertising content, and cease providing that medical service until violations are rectified and written approval to resume operations is obtained from the management agency.

10. Conclusion

Operating private medical facilities up to mid-2026 requires enterprises to maintain professional medical excellence while ensuring legal compliance. Establishing transparent operational procedures helps enterprises mitigate penalty risks, protect brand reputation, and maintain stable operations. Meeting new legal requirements regarding electronic medical record systems and health insurance payments is currently mandatory for the private healthcare system.

This article is for informational purposes only and does not replace professional legal advice. For support tailored to your situation, please contact HMLF lawyers.

• Email:[email protected]
• Website: https://hmlf.vn
• Address: M floor, 391 Dien Bien Phu, Ban Co Ward, HCMC, Vietnam