Anyone examining how to handle medical information inevitably runs into the term 'three-ministry, two-guideline' framework. Many on the ground know the name but have not clearly organized which ministries and documents it refers to, or what a healthcare organization concretely needs to do.
This article organizes the overall picture of the framework, the compliance points healthcare organizations should grasp, and viewpoints for a self-check list. Because the guidelines are revised repeatedly, read on the premise that you will always confirm the latest content against primary sources such as the relevant ministries.
In recent years, cyberattacks targeting healthcare have become a real threat, and use of EHRs and cloud services has spread. Against this changing backdrop, the level of safety management the guidelines require has become more concrete year by year. Understanding must advance from merely knowing the name to translating it into practice.
What the framework is
The 'three-ministry, two-guideline' framework is a common name for the set of guidelines issued by three ministries to handle medical information safely. Its characteristic is that it combines two strands from different standpoints: guidance for healthcare organizations and guidance for the businesses entrusted with medical information.
The naming has shifted over its revision history, at times called 'three-ministry, three-guideline,' and the exact current composition and titles differ by period. In practice, rather than being pulled along by the nickname, start by confirming the official titles and latest editions of the guidelines currently in force against primary sources.
- MHLW: safety-management guidance for healthcare organizations
- METI and MIC: guidance for businesses that handle medical information
- Grasp the whole by combining the healthcare-side and business-side guidance
The role of each ministry's guidance
The MHLW guidance sets out the thinking and measures for hospitals and clinics themselves to manage and operate medical information systems safely. It covers a broad range, including organizational responsibility and technical, personnel, and physical safeguards.
The METI and MIC guidance sets out safety-management thinking for businesses entrusted by healthcare organizations to store or process information, such as cloud service providers. When a healthcare organization selects a service, whether it complies with these is an important thing to check.
These two strands are not in opposition but, so to speak, two wheels of a cart for healthcare organizations and businesses to protect information by dividing roles. Only when the organization fulfills its responsibility scope and the business fulfills its entrusted scope is information protected consistently. Leaving it entirely to either side lets risk arise from the gap.
The standing of the latest edition and how to confirm it
These guidelines are revised repeatedly to keep pace with technological progress and increasingly sophisticated cyberattacks. As editions advance, the required level of measures, wording, and scope are updated, so operating on an understanding of an old edition can fall short of current requirements.
In practice, the surest approach is to confirm the latest main text along with the accompanying commentary, Q&A, and reference materials as primary sources. Vendor materials and explainer articles help understanding, but always base final compliance judgments on the original text and set up a routine to periodically review for revisions.
Revisions sometimes include transitional measures, so a sense of deadlines — what must be met by when — is also important. Even if you cannot address new requirements all at once, organizing priorities and deadlines and setting a policy of planned, phased response avoids rushed, inadequate handling.
- Confirm the latest main text, commentary, and Q&A as primary sources
- Establish a routine to periodically review for revisions
Compliance points for healthcare organizations
Compliance on the healthcare side is not only about technology. Organizational arrangements — who can access information, who is responsible, and how to act during an incident — form the foundation. Technical measures build on top of that, and effectiveness arises only when both work together.
Often overlooked are access-privilege management, preservation of logs, and management of outsourcing partners. It must be documented as operational rules that you can trace who viewed what, and that your organization's responsibility remains even when processing is entrusted externally.
Compliance is not finished once met but maintained continuously through daily operations. Granting and revoking privileges as staff join and leave, periodic review of rules, and recording check results — such steady operations underpin effectiveness. Only when both the mechanism and its operation run does it become substantive compliance, not just form.
- Set access privileges to the minimum appropriate for each role
- Capture and preserve operation logs so activity is traceable
- Verify partners' safety management and clarify responsibility boundaries in contracts
- Continue staff training so rules do not become a dead letter
Three safeguards: technical, personnel, and physical
Organizing safety management into three areas — technical, personnel, and physical — helps prevent gaps. Hardening technology alone fails if human operations are loose, and conversely fine rules do not function without matching configurations. Designing all three in balance is important.
In practice, it is efficient to first take stock of your current state in these three categories and act first on the missing areas. Because budget and staff are limited, a risk-based weighting mindset — thickening measures in order of how large the impact would be if an incident occurred — is helpful.
- Technical: authentication, encryption, access control, logging, vulnerability handling
- Personnel: training, granting and revoking privileges, handling leavers, disseminating rules
- Physical: access control for server rooms and terminals, protection against theft and disasters
Cybersecurity self-check list
To grasp your organization's state, listing check items and self-assessing periodically is effective. The following is an example of the thinking; conduct the actual check along the items of the latest guidelines or published checklists, and record what is and is not in place together with concrete evidence.
Rather than aiming for perfection in one pass, the value of checks lies in repeating them periodically and watching the differences. Continuously confirming that previously in-place measures have not eroded through operational change, and that you can handle new threats, prevents them from becoming a dead letter. Keeping records makes the improvement history material for the next decision.
- Are OS and software updates (patches) applied without delay?
- Is authentication hard to guess, and are measures like multi-factor authentication considered?
- Are backups of critical data taken, and has restoration actually been tested?
- Do you know all external connection paths and have you closed unnecessary ones?
- Are procedures for contact and response during an incident defined?
- Are accounts and privileges of leavers and transferees reviewed promptly?
Considerations when using cloud
Even when using cloud services, a healthcare organization's responsibility does not disappear. Safety management is shared between the provider and the using organization, and understanding where the provider's responsibility ends and yours begins is a prerequisite. This is called the responsibility boundary.
When selecting a service, check whether it complies with the business-side guidelines, whether it holds third-party assessments or certifications, and how the contract defines data handling, auditing, and incident response. Rather than the word 'compliant' alone, obtain backing in the contract and documentation.
You also want to confirm operations if communication is lost and whether you can extract your data at contract termination. Cloud is convenient but increases dependence on the provider. Leaving room to act on your own judgment when it matters connects to long-term safety and flexibility.
- Clarify the responsibility boundary between provider and hospital in the contract
- Confirm compliance with business-side guidelines and any third-party certifications
- Confirm arrangements for data location, auditing, and incident response
Building the governance structure
Making safety management the job of the IT department alone does not last. It functions only with a chain of roles: management owning the policy, each department having a point person, and frontline staff following daily rules. Clarifying who is responsible and backing them with authority and budget is key to effectiveness.
Small facilities may find it hard to assign a dedicated person. Even then, deciding on a responsible person and a contact point, and building a structure to run minimum checks and training while using external experts or partner support, is a realistic first step.
In building the structure, it is essential to decide not only peacetime operations but who acts and how when an incident occurs. Predefining contact routes, the initial decision-maker, and external consultation points prevents delayed initial response amid confusion. Routine checks and emergency response are designed as two wheels of the same structure.
Common misconceptions and how to avoid them
A common misconception is that once you rely on the cloud, safety management becomes the provider's job. In reality responsibility is shared, and loose operations on your side leave you exposed. Feeling safe merely from installing a product that claims compliance is the same trap.
Another pitfall is treating compliance as a special project. In reality it is an accumulation of daily operations, not something achieved by pushing hard only during a certain period. Building checks and training into normal duties, in a sustainable form, is the secret to lasting.
- Myth: cloud removes the need for safety management → Fix: understand the boundary and harden your operations
- Myth: writing rules completes it → Fix: sustain operations through training and checks
- Myth: complying once lasts forever → Fix: review periodically as guidelines are revised
Points of caution (as general guidance)
This article surveys the thinking behind the guidelines; what specifically must be met, and to what extent, varies with facility scale, system configuration, and the latest edition's requirements. Base individual compliance decisions on the original text and expert advice.
When selecting a foundation that handles medical information, such as our Sakigake Platform, we recommend carefully confirming compliance with business-side guidelines and the responsibility boundary through the contract and public materials. Asking for supporting documentation, not just claims, leads to safety.
Anticipated Q&A
Q. Do small clinics also need to address the guidelines? A. Regardless of scale, as long as you handle medical information, the thinking on safety management is commonly required. Confirm the specific level in the latest edition, and realistically start building your setup within a sustainable scope.
Q. Which checklist should we use? A. Following the latest published check items is surest. Vendor-provided formats also help, but confirm their correspondence to the original text and record your actual state with evidence.
An annual cycle to make operations stick
To keep compliance from ending as a one-off effort, it helps to run it as an annual operating cycle. Deciding a rhythm — confirming structure and rules at the start of the year, checks each quarter, training in the first and second halves, and a year-end review with next-year planning — makes operations less likely to break even when the person in charge changes.
Having such an annual template makes it easier to fold responses to sudden events — guideline revisions or incidents — into the existing cycle. Rather than launching a new special project, accumulating small improvements bit by bit as part of normal duties is the knack for sustaining it without strain.
- Start of year: confirm structure, owners, and rules, and set the annual plan
- Each quarter: check against the list and record differences from last time
- Year-end: review and identify improvements for the next year
A realistic approach for small facilities
For small clinics with limited staff and budget, demanding the same structure as a large hospital as-is is unrealistic. The starting point is to decide even one responsible person and one contact point, and begin with high-priority basic measures. Rather than trying to assemble everything at once, clarifying and recording what you can do leads to sustainable compliance.
Using external experts or partner support is also an effective option. Rather than shouldering everything alone, relying on outside help for part of checks and training lets even limited staff keep minimum operations running. Even when outsourcing, be aware that ultimate responsibility remains with your organization and avoid leaving it entirely to others.
- Decide at least a minimal responsible person and contact point
- Start with high-priority basic measures in phases
- Use external support while recognizing ultimate responsibility remains yours
Summary
The 'three-ministry, two-guideline' framework is a nickname for the structure that protects medical information by combining healthcare-side and business-side guidance. Healthcare organizations are asked to sustain access management, logging, partner management, and training on a foundation of technical, personnel, and physical safeguards.
Most important is the stance of not relying on the nickname or an old understanding, but confirming the latest edition against primary sources and continuing to review as it is revised. Even with cloud, remember responsibility is shared; build an effective structure suited to your organization while obtaining backing through contracts and documentation.
RELATED ARTICLES