Peru's healthcare system is facing heightened scrutiny over patient privacy following reports that national health regulator Susalud registered 38 leaks of sensitive medical data across public hospitals and private clinics between 2023 and 2025.
In the most recent incident, lawmaker Christian Aranda of the conservative Renovación Popular party published confidential medical records on social media identifying a woman who requested a therapeutic abortion at the Hospital Regional de Abancay in southern Peru.
Aranda released the document containing the patient's full name to publicly question the procedure, which has been recognized as a legal right under Article 119 of Peru's Penal Code since 1924. Although Aranda deleted the post and later uploaded a modified version omitting the name, journalist Cristian Rebosio had already captured the original document.
Aranda stated after the publication that he had achieved his objective and that a life had been saved. An editorial analysis of the case noted that exposing private medical documents exceeds legitimate parliamentary oversight and constitutes personal harassment.
High-profile medical privacy violations
The privacy breaches have impacted high-profile figures alongside ordinary citizens. Clinica Delgado, a private medical center operating in Lima, was fined 668,750 Peruvian soles by regulatory authorities after leaking the sensitive health records of Colombian citizen and international pop artist Shakira Isabel Mebarak Ripoll in February 2025.
The same medical facility received a subsequent penalty for handing over the clinical records of former Peruvian first lady Nadine Heredia to public prosecutors without authorization. While these cases involving prominent public figures drew widespread attention, regulatory findings indicate that far more cases involving anonymous patients occur without any sanctions being imposed.
Under Peruvian law, a patient's medical history is categorized as one of the most intimate personal documents, encompassing diagnoses, medical treatments, physical conditions, and personal health choices. Article 2 of the Constitution of Peru, alongside the General Health Law and the Personal Data Protection Law, strictly mandates that medical information is inviolable and may only be shared with the explicit consent of the individual concerned.
Structural vulnerabilities in healthcare data
Addressing the recurring privacy failures requires resolving a structural problem with two primary dimensions in Peru's health sector. The first dimension concerns weak cybersecurity infrastructure protecting digital medical information systems across both public hospitals and private clinics.
The second dimension involves inadequate confidentiality training for healthcare facility staff. Regulatory observations show that the most frequent medical data leaks are committed by non-medical administrative workers who distribute confidential information without considering the legal or personal consequences.
Peruvian legal principles dictate that the obligation of the state is to take all available preventative measures to protect fundamental rights before they are violated, rather than attempting to address them after confidential personal data has already been exposed.
