1. Medical institutions that disclose patients' privacy and personal information shall bear tort liability;
2. Whoever constitutes a crime of infringing citizens' personal information shall be investigated for criminal responsibility according to law, and may be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also or only be fined.
legal ground
One of the 253rd articles of the Criminal Law of People's Republic of China (PRC).
Whoever, in violation of the relevant provisions of the state, sells or provides personal information of citizens to others, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention and shall also or only be fined; If the circumstances are especially serious, he shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years and shall also be fined.
Whoever, in violation of the relevant provisions of the state, sells or provides others with personal information of citizens obtained in the course of performing their duties or providing services shall be given a heavier punishment in accordance with the provisions of the preceding paragraph.
Whoever steals or illegally obtains citizens' personal information by other means shall be punished in accordance with the provisions of the first paragraph.
Where a unit commits the crimes mentioned in the preceding three paragraphs, it shall be fined, and the persons who are directly in charge and other persons who are directly responsible shall be punished in accordance with the provisions of the preceding three paragraphs.
Article 1226 of the Civil Code of People's Republic of China (PRC)
Medical institutions and their medical staff shall keep patients' privacy and personal information confidential. Anyone who divulges the privacy and personal information of patients or their medical records without the consent of patients shall bear tort liability.