ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
human oversight when AI systems are trained on sen - sitive data. 1.4 Processing of Personal Data for Research and Development Purposes Anonymisation of Patient Data for Product Development and Research Under the Ministry of Health Circular 1/2018, com - panies serving Israeli healthcare providers can anonymise patient data for product development or research. This interim guidance sets out the frame - work until comprehensive regulation is established. Key requirements The circular favours anonymised data, requiring healthcare organisations to use it whenever possible. Identifiable patient data for secondary purposes is only accessible with legal authorisation or patient con - sent; otherwise, only anonymised data may be used. Until unified standards exist, organisations should follow expert advice and best practices to ensure anonymisation is irreversible and re-identification is not possible. Permitted uses Anonymised data can support product development, quality improvement, research and statistics. Organi - sations must prove robust anonymisation and minimal re-identification risk. Impact of European Health Data Space As of early 2026, Israel’s functional equivalent to the European Health Data Space (EHDS) is the Health Information Mobility Law, 5784-2024 (enacted July 2024). Key similarities The law reflects the EHDS “primary use” objectives by mandating health data portability between Health Maintenance Organisations (HMOs), hospitals and pri - vate clinics, via a centralised Ministry of Health system enabling real-time patient access management. Main differences • The Israeli framework currently excludes second - ary use for research and innovation, which remains
governed by the Patient’s Rights Law and Circular 1/2018. • Most operational obligations will enter into force in July 2027, whereas EHDS implementation began in early 2025. • Both regimes require high interoperability, with Israel adopting the Fast Healthcare Interoperability Resources (FHIR) standard to ensure compatibility with European systems. 1.5 Processing of Personal Data in the Context of Artificial Intelligence As of early 2026, Israel’s regulatory framework for AI has matured significantly. While no single “AI Act” equivalent exists, the PPA and the Ministry of Inno - vation, Science and Technology have established a comprehensive regime through binding guidance and the full implementation of Amendment No 13. In addition, specific sectors have developed their own AI guidelines, notably, the Bank of Israel inter-ministerial team report addressing AI in the financial sector. Primary Legal Framework and Specific Guidance The use of personal data in AI is governed by the PPL, as amended by Amendment No 13, and sup - plemented by the draft 2025 PPA Guidelines on the application of the PPL to AI systems. Key legal pillars include • Applicability to the life cycle: Privacy obligations apply across all stages of AI use, including collec - tion, training, deployment and inference. • Inferred data: AI-generated conclusions (such as health or credit predictions) qualify as personal data and are subject to full protection. • Scraping prohibited: Unauthorised scraping of personal data for AI training is prohibited, in the absence of a valid legal basis or explicit consent. Risk-Based Regime and Automated Decision- Making Israel follows a sectoral, risk-based approach rather than a horizontal framework: • High-impact decisions – AI systems materially affecting individuals (eg, hiring, insurance pric - ing, or medical diagnosis) are treated with greater scrutiny.
184 CHAMBERS.COM
Powered by FlippingBook