실손의료보험 청구 간소화 제도의 법적 쟁점에 관한 연구 – 전송대행기관을 중심으로 –

초록

This study aims to analyze the legal structure of the transmission agency introduced under the simplified claims process for indemnity health insurance and to examine the legal issues concerning personal information protection, while exploring directions for institutional improvement. The current system adopts a multi-layered information processing structure involving medical institutions, a transmission agency, and insurance companies. However, this structure may lead to several concerns, including the proliferation of data processing stages, ambiguity in the allocation of legal responsibility, and the weakening of the data subject’s control over personal information. In particular, the legal status of the transmission agency remains unclear, as it does not clearly fall within the categories of a data processor (outsourcee), third party, or joint controller under the Personal Information Protection Act, resulting in uncertainty regarding the attribution of liability during the data processing flow. This study reviews the legislative background of the simplified claims process and the rationale for introducing the transmission agency system. Furthermore, it examines the legal nature and liability structure of the agency through a comparative analysis of the right to personal information portability and designated intermediary institutions under the Personal Information Protection Act. The findings suggest that a direct transmission model between medical institutions and insurance companies represents the most desirable framework from a data protection perspective, as it minimizes processing stages, clarifies legal responsibilities, and strengthens the data subject’s control over personal information. Nevertheless, practical constraints, including the costs of establishing information networks, standardization requirements, and operational burdens, limit its full-scale implementation in the short term. Accordingly, at the present stage, it is necessary to maintain the transmission agency system while clarifying its legal status and liability structure regarding personal information processing. Specifically, because it is difficult to categorize the transmission agency under the current categories of the Personal Information Protection Act, it should be legally stipulated as a 'special personal information processing subject' under the Insurance Business Act to impose strict data protection obligations. Furthermore, the operating entity should be redesigned around a public institution independent from the interests of the insurance industry. In this regard, the Health Insurance Review and Assessment Service (HIRA) presents a realistic and viable alternative. However, strict technical and institutional safeguards—such as the physical separation of networks and the immediate destruction of data post-transmission—must be implemented as essential prerequisites to mitigate the risks of nationwide medical data concentration. Accordingly, at the present stage, it is necessary to maintain the transmission agency system while clarifying its legal status and liability structure regarding personal information processing. Furthermore, the operating entity should be redesigned around a public institution independent from the interests of the insurance industry. In this regard, the Health Insurance Review and Assessment Service (HIRA), which possesses a nationwide electronic network integrated with medical institutions and an established public oversight framework, presents a realistic and viable alternative.

키워드