Malaysia's Ministry of Health has introduced a more structured framework for how online healthcare services should operate, reflecting how quickly telemedicine, virtual consultations and digital health platforms have grown since the pandemic. The Guideline on Online Healthcare Services 2025, published by the Ministry's eHealth Planning Section, is intended to give platform providers and healthcare professionals clearer expectations around safety, quality, accountability, privacy and traceability.
The guideline comes at a time when medical consultations are no longer confined to physical clinics. Malaysia now has a growing mix of digital appointment platforms, telemedicine services, home-care coordination, online wellness services and e-pharmacy offerings. The Ministry acknowledges that many healthcare laws were written for an analogue environment and may not fully address the increasingly complex business models appearing in digital healthcare.
Online Healthcare Is Becoming Part of Mainstream Healthcare
The guideline identifies five broad categories of online healthcare already operating in Malaysia: information and appointment booking, telemedicine, home care, wellness services and e-pharmacy services. These can be delivered individually or combined within a broader digital healthcare platform.
The Ministry's concern is not that these services should be slowed down, but that innovation needs clearer boundaries. Online healthcare introduces new risks around patient identification, privacy, professional accountability, digital prescriptions and clinical appropriateness. Without a consistent framework, patients and healthcare providers may face uncertainty over what is acceptable and who is responsible when something goes wrong.
The Guideline Is Built Around Five Core Principles
The 2025 framework is based on five guiding principles for healthcare provision: Safety, Quality, Accountability, Privacy and Traceability. These principles sit behind the detailed requirements imposed on digital health platforms and the healthcare professionals who use them.
The Ministry also makes clear that this is not necessarily the final regulatory position. The guideline may be refined as more data and industry feedback become available, and it could eventually be used as the basis for amending existing laws or introducing new regulations for online healthcare services.
That makes the document important beyond immediate compliance. It provides an early indication of the direction Malaysia's future digital-health regulation may take.
Virtual Clinics Are a Major Focus
Although the guideline covers online healthcare more broadly, virtual clinic services receive particular attention. The Ministry describes a virtual clinic as a digital environment that moves healthcare away from purely facility-based delivery and enables services such as consultation, diagnosis, investigation and treatment to be provided remotely.
However, this does not mean that online consultations can operate to a lower standard than physical care. Virtual services must still meet the relevant professional standard of care, comply with professional codes and be delivered through specialised and secure digital platforms.
The underlying principle is simple: the technology may change, but the professional obligations do not.
Not Every Medical Case Belongs Online
One of the most practical sections of the guideline defines when online healthcare may and may not be appropriate. The Ministry allows online services for areas such as non-emergency cases, follow-up management of stable patients, selected group counselling services, specialist referrals and support services including medication supply, laboratory services and imaging.
At the same time, some situations are specifically excluded from online care:
This distinction is important because convenience should not become the deciding factor in whether treatment is delivered remotely. The clinical suitability of the patient and the nature of the condition remain more important than the availability of a video call.
The Medical Record Is Broader Than Just the Consultation Note
The guideline adopts a broad definition of the medical record in an online healthcare environment. It can include clinical notes, prescriptions, dispensing records, referral notes, laboratory and histopathology reports, imaging, photographs, consent forms, recordings, session transcripts, medical-device data and correspondence between healthcare professionals.
This is particularly significant for digital platforms because online consultations can create far more electronic artefacts than traditional face-to-face encounters. A platform may record consent, chat messages, video interactions, digital prescriptions and device readings during a single episode of care.
The guideline therefore treats record keeping as a core clinical function rather than simply an administrative feature of the platform.
Platform Providers Must Be Proper Malaysian Businesses
The Ministry places clear organisational requirements on companies operating online healthcare platforms. Platform providers must be properly incorporated and registered with the Companies Commission of Malaysia, and they must maintain a physical place of business in Malaysia with their online healthcare operations based locally.
The organisation's leadership structure also matters. Senior management or the board must include at least one registered Malaysian medical practitioner holding a valid practising certificate. If e-pharmacy services are offered, the platform must also include a registered pharmacist within senior management or the board.
The Ministry is effectively saying that digital healthcare platforms should not operate solely as technology companies disconnected from clinical expertise.
Patient and Clinician Identity Must Be Verified
Online platforms are expected to establish proper registration and verification processes for both healthcare professionals and patients. Patient checks should cover identity, age and whether the person is suitable for online healthcare, while healthcare professionals must have their identity, credentials, regulatory registration and licence to practise verified.
The platform is also responsible for obtaining appropriate supporting documentation and making reasonable efforts to verify its authenticity before approving registration.
Consent is equally important. Platforms must obtain and record patients' written consent for the collection, use, processing and retention of confidential data, along with informed consent for the online healthcare service itself. That consent must be reproducible when required.
Secure Communication Must Stay Inside the Platform
The guideline requires platforms to provide secure and reliable communication channels, including options such as video, email, chat or messaging for online healthcare sessions. It also expects the system to support formal commencement and termination of sessions, including consent acknowledgement and automatic logout after prolonged inactivity.
For healthcare professionals, the rules become even stricter. Communications related to online healthcare services must take place through the platform's official channels, and professionals are specifically prohibited from conducting all or part of the consultation through ordinary phone calls or social messaging services such as WhatsApp, Telegram or Facebook Messenger.
That requirement is clearly designed around confidentiality and traceability. Keeping clinical interactions inside the official platform makes it easier to protect patient information and preserve a proper audit trail.
Digital Medical Records Must Be Secure and Accessible
Platforms must allow healthcare professionals to safely create, store and access medical records for each online healthcare session. Patients must also be given the ability to request access to their medical data and records for legitimate purposes and in good faith.
This creates an important balance between professional record keeping and patient access. The platform cannot simply function as a communication tool; it needs to support the record-management responsibilities that would ordinarily exist within a physical healthcare facility.
As Malaysia's wider health system moves toward more connected digital records, these requirements also become important for future interoperability.
Automated Matching Must Be Fair
Some online platforms automatically match patients with healthcare professionals based on speciality, availability or other preferences. The guideline permits this, but the matching must be performed fairly and without giving inappropriate preference to any particular healthcare professional.
This is a small section of the guideline, but it has broader relevance as health platforms increasingly use algorithms and AI to recommend clinicians. The expectation is that automated systems should not quietly become mechanisms for commercial favouritism or unfair professional promotion.
Healthcare Advertising Remains Tightly Controlled
Digital healthcare platforms cannot treat medical advertising like ordinary e-commerce. Medicine advertising must comply with approval requirements under Malaysia's existing medicines advertising laws, while advertisements involving clinics, hospitals and laboratories must meet the relevant regulatory conditions.
Platforms may display information about healthcare professionals, but they should avoid promotional language suggesting that one practitioner is superior to another. Healthcare professionals must also avoid activities that could be interpreted as promoting their skills, qualifications or services for professional advantage.
This reflects the Ministry's attempt to preserve professional healthcare advertising standards even when services are delivered through commercial digital platforms.
Healthcare Professionals Must Be Trained Before Going Online
Platform providers are expected to provide proper training so healthcare professionals understand how to use the platform effectively. Professionals should only begin delivering online healthcare services after successfully completing that training.
This is an important point because telemedicine is not simply an ordinary consultation performed through a camera. Clinicians need to understand how consent, documentation, privacy, patient identification and platform functionality work in a remote environment.
A platform may be technically easy to use, but the clinical and legal responsibilities surrounding it can still be complex.
Patients Must Have a Proper Complaints Channel
Every platform should also provide a formal grievance mechanism so patients can submit feedback or complaints relating to the service, healthcare professionals or the platform itself. Any issues raised should be addressed promptly.
The guideline also requires providers to maintain safeguards against unlawful activities, confidentiality breaches and persistent failure to correct platform defects or security vulnerabilities.
That means cybersecurity weaknesses are not treated purely as technical problems. Persistent failure to address flaws or vulnerabilities can become a broader compliance issue.
E-Prescriptions Must Stay Inside Controlled Channels
The framework places detailed controls around digital prescriptions. E-prescriptions issued through a platform must be controlled, electronically delivered through the platform and available only to the partner pharmacy that will actually supply the medication. The dispensing pharmacist must properly endorse the prescription and record the supply so it can be audited and traced.
One particularly clear rule is that e-prescriptions must not be sent through personal email, text messaging or social media messaging platforms. Medication ordering and delivery also cannot begin before the patient has undergone an appropriate consultation and received a valid e-prescription.
This attempts to prevent digital prescribing from becoming an uncontrolled online shopping experience.
Cybersecurity Is a Core Platform Requirement
The guideline dedicates significant attention to platform security. Providers must maintain risk-based safeguards against inappropriate access, intrusion, hacking and misuse, while back-end access should be limited to authorised personnel whose roles genuinely require it.
Authentication should include appropriate identity verification such as passwords or biometrics, and user activity must be auditable. Platforms are also expected to conduct regular security checks, including penetration testing and security audits, while ensuring data is encrypted both in storage and during transmission.
This reflects the sensitivity of healthcare information. A telemedicine system is not merely another web application; it may contain medical histories, prescriptions, clinical recordings and highly sensitive personal data.
Cloud Providers Also Come Under Scrutiny
Platforms using third-party cloud services must ensure their cloud agreements address issues such as service availability, planned and unplanned downtime, liability, disaster recovery, security monitoring and breach notification. The guideline also points to ISO/IEC 19086-1 as a potential reference when preparing cloud-service agreements.
Providers are also expected to monitor system performance using metrics such as throughput, reliability, availability, latency, load balancing, durability, elasticity and responsiveness to changing demand.
The document therefore treats reliability as part of healthcare quality. A consultation platform that becomes unavailable at critical moments is not simply suffering an IT inconvenience; it may be interrupting patient care.
Business Continuity Is Mandatory
Online healthcare providers must maintain plans for business continuity, disaster recovery and backup, with testing, accountability and corrective actions built into those plans.
This requirement recognises that online healthcare services depend entirely on technology availability. In a physical clinic, a temporary IT outage may slow operations while clinicians continue some activities manually. In a fully virtual environment, a prolonged platform failure may effectively stop the service altogether.
Continuity planning is therefore part of clinical resilience.
Patient Data Must Be Protected Throughout Its Lifecycle
Part 6 of the guideline places extensive responsibilities on platform providers for confidential data. Providers must use administrative, physical and technical safeguards to protect confidentiality, accuracy and integrity, including data classification, encryption and strict access controls.
The document also states that confidential data collected and stored on the platform is subject to Malaysia's data sovereignty requirements and the Personal Data Protection Act 2010. Information must be protected while in transit, in use and at rest using recognised encryption and cryptographic practices.
Processes must also exist for managing and reporting data-loss events and security breaches.
Where Healthcare Data Is Hosted Also Matters
The Ministry expects confidential data to be stored in safe and secure environments. Cloud service providers or data centres should possess recognised security or cloud-related certifications, with examples including ISO/IEC 27017, ISO/IEC 27018, PCI DSS, Cloud Security Alliance controls and SOC-type standards.
This is particularly relevant as more Malaysian healthcare providers shift infrastructure into the cloud. The guideline makes clear that moving data to a third-party provider does not transfer responsibility away from the healthcare platform.
The platform provider remains accountable for ensuring the environment is appropriate for highly sensitive healthcare information.
Patients Remain Central to Data Ownership
The guideline distinguishes between ownership and custodianship of healthcare information. Medical data, except information obtained by healthcare professionals from third parties, is owned by the patient or guardian as the Data Owner. Medical records themselves are owned by the registered healthcare facility under MOH, while the platform provider acts as the Data Custodian responsible for recording and protecting patient information.
Confidential information generally cannot be released to a third party without appropriate written consent from the patient or guardian and, where applicable, the relevant healthcare professional.
This establishes an important principle: hosting the data does not mean owning the patient's information.
Clinical Standards Must Match In-Person Care
Healthcare professionals using online platforms must be properly registered with their relevant Malaysian professional regulatory body and hold a valid practising certificate. The guideline also recommends appropriate liability protection for malpractice risks.
More importantly, technology must not lower the standard of professional care. Healthcare professionals are expected to provide care comparable to an in-person session and remain subject to the same ethical, professional and legal responsibilities.
At the beginning of an online session, clinicians must identify themselves, confirm the patient's identity, explain their role, discuss the limitations and risks of online healthcare and obtain consent.
Clinicians Must Know When to Stop the Online Consultation
Perhaps one of the most clinically important requirements is the obligation to decide whether online care remains appropriate. Healthcare professionals can terminate a session if the patient's problem requires an in-person consultation, if a minor or mentally unsound patient lacks an appropriate guardian, or if poor connectivity or technical performance makes the consultation unreliable.
A session can also be stopped when the patient is unable to participate effectively or their surroundings do not allow appropriate healthcare delivery. In these cases, the clinician should explain the situation and may arrange another online consultation, recommend an in-person session or trigger a refund where appropriate.
This reinforces the idea that telemedicine should never continue simply because the technology technically allows it.
Consent Must Be Renewed for Each Consultation
Healthcare professionals must obtain, review and confirm valid informed written consent at each consultation session in accordance with professional and legal requirements.
That requirement makes consent an active part of care rather than a one-time registration checkbox. Patients need to understand what online healthcare involves, what its limitations are and what they are agreeing to during each interaction.
For platform designers, this also means consent workflows need to be built into the consultation experience rather than hidden inside general terms and conditions.
Privacy Responsibilities Extend to the Clinician's Environment
The guideline recognises that privacy is not only a technical issue. Healthcare professionals must make sure they are in an appropriate location where patient information cannot be overheard or exposed during an online consultation.
Their duty of confidentiality covers not only information directly provided by the patient but also professional conclusions and opinions formed during care. Disclosure should generally occur only when required by law or supported by proper written consent, and even then should be limited to the minimum information necessary.
This matters increasingly as clinicians work remotely and consultations happen outside traditional clinic rooms.
The Bigger Message: Online Healthcare Is Healthcare
The most important theme running throughout the Ministry's 2025 guideline is that digital delivery does not create a separate category of healthcare with weaker expectations. The medium may change, but professional responsibility, patient safety, privacy and accountability remain intact.
Platforms need to be secure, traceable and professionally governed. Healthcare professionals need to know who they are treating, maintain proper records, obtain consent and recognise when remote treatment is no longer appropriate. Patient data must be protected throughout its entire lifecycle.
The document also makes clear that these requirements sit alongside existing laws, professional codes and regulatory obligations rather than replacing them.
Final Thoughts
Malaysia's Guideline on Online Healthcare Services 2025 represents an important step toward bringing greater consistency to a sector that has expanded rapidly over the past few years. Telemedicine and virtual clinics are no longer temporary solutions used mainly during a pandemic; they are becoming part of the country's longer-term healthcare landscape.
The guideline does not attempt to stop that transformation. Instead, it creates clearer expectations around who can provide online healthcare, which patients are suitable, how platforms should operate, where data can be stored, how prescriptions are handled and when clinicians should insist on an in-person consultation.
For healthcare technology companies, the message is equally clear: building a video consultation feature is no longer enough. A serious online healthcare platform needs clinical governance, secure infrastructure, proper record management, identity verification, data protection, business continuity and professional accountability built into the service from the beginning.
Ultimately, Malaysia's direction appears to be moving toward a simple principle: healthcare delivered online should be just as safe, accountable and professionally governed as healthcare delivered inside a clinic.
Comments 0