The "Barrier" to Utilizing Medical Data and Expectations for "Pseudonymized Data"

The biggest challenge companies face in AI development is how to legally collect existing data held by medical institutions. There are two major barriers: 

① Purpose of Use Barrier: Past data was acquired for "medical treatment purposes," and consent for use for "AI development purposes" has not been obtained. 
② Third-Party Provision Barrier: In principle, patient consent is required to provide data from a medical institution to a private company, but it is difficult to obtain retrospective consent (opt-in).

As a practical solution to these challenges, the use of 'Pseudonymized Data' is gaining significant traction in the field.
Advantages of Pseudonymized Data "Pseudonymized Data," introduced in the amended Act on the Protection of Personal Information that came into effect in 2022, is information processed so that an individual cannot be identified unless it is considered together with other information. Unlike ordinary personal information, statutory restrictions on altering the purpose of use are relaxed. Therefore, even for data originally acquired for "medical treatment purposes," it is possible to change the purpose of use to "research and development of AI medical devices" by processing it into Pseudonymized Data.

Overcoming the Restriction on Third-Party Provision via the "Joint Utilization Scheme"

While Pseudonymized Data allows for changes in the purpose of use, it is, in principle, prohibited from being provided to "third parties." Therefore, it is not permissible for a medical institution to simply provide to a manufacturer Pseudonymized Data the medical institution has created. The legal logic that is effective in overcoming this "barrier of third-party provision" is the scheme of "Joint Utilization (Article 27, Paragraph 5, Item 3)" under the Act on the Protection of Personal Information.

Key Points of Joint Utilization Legally, when data is jointly utilized between specific entities (such as a medical institution and a manufacturer), it is treated as an exception to the restriction on third-party provision, provided that certain matters are publicly announced in advance. The important point is that in the joint utilization of Pseudonymized Data, the scope of joint users and the purpose of use can be flexibly set (changed), regardless of the original purpose of use or the circumstances at the time of acquisition by the source (medical institution). This enables data linkage without obtaining the individual's consent, provided that the medical institution and the manufacturer publicly announce (or notify) the joint utilization for the purpose of "AI development" and conclude an appropriate contract.

 

Caution Regarding "Additional" Regulations under the "Life Science/Medical Guidelines"

What legal professionals must pay particular attention to is the application of not only the Act on the Protection of Personal Information but also the "Ethical Guidelines for Medical and Health Research Involving Human Subjects (Ethical Guidelines)." Under the Act on the Protection of Personal Information, an opt-out procedure (notification to the individual and granting an opportunity to refuse) is not strictly required for changing the purpose of use when creating Pseudonymized Data. However, since AI development using medical information falls under the category of "research," the Ethical Guidelines apply.
 "Regarding the Application of Life Science/Medical Guidelines to the Development and Research of AI Image Diagnostic Equipment, etc., Conducted Using Only Medical Information that is Pseudonymized Data" (MHLW Administrative Communication dated March 31, 2022) (in Japanese)

Under the Ethical Guidelines, when "newly creating Pseudonymized Data from medical information," opt-out procedures and a prior review by an Institutional Review Board (IRB) are required. In practice, care must be taken to avoid a situation where a project is "legal under the Act on the Protection of Personal Information but lacks the necessary procedures under the Ethical Guidelines."

Trends relating to the 2026 Amendment of the Act and Guidelines Amendment of the Ethical Guidelines (Expected March 2026)

Currently, the public comment procedure (December 26, 2025 – January 25, 2026) for the amendment of the "Life Science/Medical Guidelines" is being conducted through joint meetings of the Ministry of Education, Culture, Sports, Science and Technology (MEXT), the Ministry of Health, Labour and Welfare (MHLW), and the Ministry of Economy, Trade and Industry (METI). In this amendment, which is expected to be promulgated and enforced after March 2026, the following points are major issues: 

• Review of IC and Opt-out Procedures: It is expected that Informed Consent (IC) procedures will be simplified or organized according to the risks of the research.
• Organization of Regulations on Foreign Transfers: Clarification of procedures regarding the provision of data to overseas entities is anticipated.

"So-called 3-Yearly Review" of the Act on the Protection of Personal Information
 
The Act on the Protection of Personal Information stipulates a review of the system every three years after its implementation. Given the evolution of AI technology and the increasing privacy risks, it is necessary to closely monitor the trends of discussions toward the next amendment, focusing on how to balance the need for data utilization with the protection of personal information. Please refer to this article for trends in the amendment of the Act on the Protection of Personal Information.

 

Pharmaceutical Approval and the Black Box Problem of Generative AI Medical Devices 

There are also AI-specific issues in the approval review process under the PMD Act. Deep learning-based AI has a "black box" algorithm, making it difficult to fully explain its logic.

Approach to Review
 
In current PMDA review practices, the focus of evaluation is not the algorithm itself, but the validity of the results—"whether the final model has the performance necessary to achieve its purpose." However, it is necessary to present the network structure and program outline from the design and development stage, and an outline of the detection algorithm must also be described in the package insert.

Reliability Investigation and SDV (Source Data Verification)
 
In the investigation of the reliability of approval application data, there are restrictions on manufacturers directly confirming source documents (raw data), such as medical records at medical institutions (SDV), from the perspective of personal information protection. However, regarding investigations by regulatory authorities (PMDA, et al.), the exception of "cases based on laws and regulations" under the Act on the Protection of Personal Information applies, clarifying the interpretation that viewing and verifying source documents is possible without the person's consent.

 "Regarding the Partial Amendment of 'Questions and Answers (Q&A) on the Handling of Performance Evaluation Tests for Diagnostic Medical Devices Using Existing Medical Image Data, etc., Not Involving Additional Invasion or Intervention'" (Administrative Communication dated March 17, 2025)  (in Japanese)

 

IDATEN System (Post-Approval Change Management Plan System)

For AI medical devices that continue to learn and change performance after being placed on the market, filing a partial change approval application every time a software version is upgraded, or additional learning is performed, is a significant burden. By utilizing the IDATEN system, if a future change plan is approved in advance, rapid improvement and implementation become possible with only notification, provided the improvement falls within the scope of the pre-confirmed change plan.

 

Expectations for the Next-Generation Medical Infrastructure Act

With the amendment of the Next-Generation Medical Infrastructure Act in 2024, "Pseudonymized Medical Information" was newly established. This enables multimodal AI development across multiple medical institutions and databases while retaining specific case data. Cases of certification acquisition by pharmaceutical companies have already emerged, making it a powerful option for the utilization of large-scale data. Compared to the scheme of developing AI medical devices using Pseudonymized Data under the Act on the Protection of Personal Information—where information processed by each medical institution inevitably becomes isolated or "siloed"—there are high expectations that the Next-Generation Medical Infrastructure Act will enable multimodal AI development across multiple medical institutions and databases.

Conclusion

In the development of generative AI medical devices, legal regulations are being developed at a rapid pace to keep up with technological evolution and facilitate early practical application. At the same time, it is necessary to quickly adapt to changing regulations and expedite product development while maintaining compliance. Deficiencies in data rights processing (contracts, consent, opt-outs) can become fatal risks in subsequent pharmaceutical approvals and business expansion.

Our firm provides support in formulating intellectual property and regulatory strategies from the early stages of development, based on these latest regulatory trends.

---

[Disclaimer]
The contents of this article are based on laws and practical information as of February 2026. For consultations regarding specific cases, please contact a lawyer individually.