Morocco health data bill sparks backlash from doctors over criminal liability

As the September 2026 legislative elections draw near, social issues remain at the forefront of political debate. On July 22, the Government Council adopted Bill 52.26, concerning the integrated national health information system, which continues to generate significant reactions from the medical community. Championed by the Ministry of Health and Social Protection, the bill aims to establish a legal framework for the digital centralization of patient data. However, it is this very aspect that raises concerns among healthcare professionals.

The primary apprehension lies in the potential criminal liability for protecting such sensitive information, a responsibility for which they haven’t been trained. The proposed legislation imposes penalties without differentiating between deliberate data breaches and accidental ones, including those stemming from cyberattacks or security flaws.

Medical Professionals Facing Criminal Liability

According to the bill, health professionals or heads of institutions who violate its provisions could face fines ranging from 50,000 to 300,000 dirhams. The same penalties apply if the deadline for integrating private practices or clinics with the national health information system within two years is missed.

The bill also stipulates prison sentences of six months to a year and fines between 50,000 and 200,000 dirhams, or one of these penalties, for «anyone who accesses, uses, or exchanges personal health data» in violation of medical confidentiality provisions. Similarly, a prison term of three months to a year and penalties up to 200,000 dirhams apply to those collecting or accessing shared medical records unlawfully.

The draft law references penalties outlined in Articles 263 and 267 of the Criminal Code for acts of violence, insults, or obstruction against the National Agency for the Regulation of the Health System. In the event of repeat offenses, penalties are doubled.

Dr. Saad Agoumi, founding president of the National Union College of Private Specialist Doctors (CSNMSP), told Yabiladi, «This law is welcome,» but emphasized that «doctors should not be under a constant threat; instead, they should be consulted to evaluate the risks and efficacy of the proposed measures.» On Monday, he pointed out that «nowhere does it specify penalties for practitioners who fall victim to criminal leaks of their patients’ data.»

Dr. Agoumi calls for the bill’s repeal, urging dialogue with professionals to resume, the removal of unjust penalties, and discussions of incentive measures, cautioning against the potential backlash that could obstruct the current draft.

Doctors Call for a Transition Period

Several other unions and professional organizations have voiced their concerns. The Moroccan Health Observatory proposed a «responsible, gradual, and consultative digital transformation.» Its co-founder, Dr. Ali Taleb, acknowledged the bill as «a crucial advancement» for the country but believes that «a doctor using a certified solution should not face legal repercussions for IT faults beyond their control.»

While backing the stance of other unions and supporting system interoperability to enhance care quality, the Observatory emphasizes that the reform’s success hinges on its technical foundation and the buy-in of the professionals tasked with its daily implementation. They advocate for «shared responsibility among the state, software providers, and healthcare professionals,» highlighting that «the security of a national health information system involves a chain of actors» with various responsibilities.

Another pressing issue is the need for training and financial support for healthcare professionals during the digital transition. Smaller practices, like large clinics, will need to invest in software, robust information systems, and maintenance services, and possibly hire additional staff.

The Observatory suggests a «realistic transition period» to enable a «gradual rollout» of the reform instead of a rushed two-year implementation, proposing «pilot phases, problem assessments, technical adjustments, user training, and then broad application.»

Practitioners agree that interoperability between public and private sectors is «a significant stride forward in enhancing patient care,» but assert that it «demands stringent safeguards.» They stress the necessity of protecting health data against any commercial exploitation.