The rapid expansion of digital health systems in Indonesia has raised critical concerns regarding patient data privacy and institutional compliance with emerging legal standards. This study explores how healthcare facilities implement data protection practices within the framework of Indonesia’s Personal Data Protection Law (Law No. 27/2022). Employing a qualitative methodology, data were gathered through semi-structured interviews with healthcare professionals, policymakers, and IT specialists, alongside field observations and document analysis from selected hospitals and clinics. Findings indicate that many healthcare personnel lack familiarities with legal data protection principles and tend to rely primarily on professional ethics. Patient information is often accessed using shared credentials, with limited technical safeguards in place. At the policy level, institutions generally lack standardized guidelines and internal audit mechanisms to ensure compliance. Regulatory authorities acknowledged the absence of detailed technical directives and noted inconsistent implementation across facilities.