Thailand's digital health records system has revealed a troubling problem: more than 10,000 residents have submitted verification requests after discovering phantom medical treatments in their digital health profiles through the Mor Prom app. These individuals discovered procedures they never underwent, medications they never took, and hospital visits to facilities they've never entered. The issue has prompted more than 10 affected residents to petition the Thailand Ministry of Public Health with requests for investigation and correction.
Why This Matters
• Your medical history could contain errors. Thousands of Mor Prom app users have found inaccurate treatment records that could affect future diagnoses, insurance claims, and prescription decisions.
• Residents are seeking accountability. Affected individuals have petitioned the Thailand Ministry of Public Health requesting credible answers and have invoked their rights under the PDPA (Personal Data Protection Act) and administrative law.
• This reveals a systemic data quality issue. The problem stems from human error at data entry points—inconsistent data entry practices, insufficient verification protocols, and the challenges of managing records across fragmented healthcare facilities—rather than cybersecurity breaches.
Understanding the Scope
Verification requests totaling over 13,000 have been submitted to the Digital Health Office, though the exact number of individuals affected remains unclear as some residents filed multiple reports. Additionally, scattered complaints emerged earlier through various channels as residents discovered discrepancies in their Mor Prom app records. Even with uncertainty about precise numbers, the pattern is significant: thousands of Thailand residents now question the accuracy of their medical records.
The discrepancies paint a concerning picture. Some patients discovered entire hospital visits logged at facilities they'd never visited. Others found medications recorded that they never took. A smaller subset reported procedures billed to the national health fund that they did not undergo. The consistent pattern: what's written in the digital record contradicts their lived reality.
Why the System Had Vulnerabilities—And Why It Matters
The Thailand Health Link platform is technically sound. It connects over 10,000 public and private medical facilities and manages records for more than 64 million individuals. The infrastructure uses internationally recognized standards: Fast Healthcare Interoperability Resources (FHIR) protocols, 128-bit SSL encryption, and firewalls. The technology itself performed as designed. The data governance processes did not.
The vulnerabilities appear rooted in operational challenges. Hospital staff navigating separate workflows across different facilities, insufficient quality assurance at data entry points, and the absence of real-time verification mechanisms created conditions where errors could propagate. A mistyped patient identification number, a treatment recorded without proper verification, a transcription error—any of these propagates instantly across the networked system, reaching every provider that later consults that patient's file.
Thailand's fragmented healthcare landscape contributed to the problem. Provincial health offices, regional hospitals, and community clinics operated on separate systems and protocols. When the National Health Security Fund billed for treatments, discrepancies between paper records and digital uploads often went unnoticed for months until patients themselves discovered errors while reviewing their Mor Prom profiles.
The Thailand Ministry of Public Health has clarified: this is not a cybersecurity breach. No unauthorized access has been confirmed. The systems remain encrypted and auditable. The vulnerability was operational—involving data entry practices, insufficient verification protocols, and inadequate quality assurance across a decentralized system.
The Real Stakes for Patients
The consequences extend beyond bureaucratic inconvenience. A patient consulting their medical record before surgery might see phantom procedures, potentially leading to unnecessary duplication or incorrect treatment protocols. Someone with an allergy listed incorrectly faces risks if a doctor prescribes a related medication without questioning the entry.
Financially, the implications are concrete. Thailand-based insurers increasingly incorporate digital health summaries into underwriting decisions. A record flagged with suspicious or numerous treatments could affect insurance eligibility or premium calculations. For employees with company health benefits, inaccurate records could influence their organization's insurance negotiations.
The identity-related dimension adds another concern. Some entries may represent attempts at fraudulent access to subsidized care. Victims could bear financial liability or reputational complications until investigations clarify intent. The Thailand Ministry of Public Health has not disclosed how many cases represent deliberate fraud versus administrative error.
Under the Personal Data Protection Act (PDPA), residents hold the right to correct inaccurate personal data. Yet hospitals retain custodianship of medical records, creating ambiguity when disputes arise. If a hospital's records indicate a procedure occurred and a patient disputes this, determining truth becomes complex. The ministry's response will shape how these conflicts are resolved going forward.
What You Can Do Right Now
For anyone using public healthcare in Thailand, checking your digital health record is now a practical necessity. The Thailand Ministry of Public Health has designated official channels for verification and correction:
Via the Mor Prom app: Navigate to the "Verify and Correct Information" menu. Submit a dispute form with supporting evidence—receipts, appointment cards, or statements from witnesses if needed.
At your registered hospital: Visit the medical records office in person with your national ID card. Bring any documentation proving the discrepancy. This route is often effective for straightforward corrections.
Through your provincial health office: File a formal complaint at the Samnak Ngan Satharan Suk Changwat (Provincial Public Health Office) in your jurisdiction. This escalation path is advisable if the hospital proves unresponsive.
The Thailand Ministry of Public Health has committed to investigate upon receipt of verification requests. Corrected records should reflect changes within reasonable timelines, though cases involving multiple facilities may require longer processing.
Moving Toward Systemic Improvement
The Thailand Digital Health Office has acknowledged the issue and indicated that corrective measures are under consideration, including improved audit trails and enhanced data verification protocols. The Office of the Personal Data Protection Committee (OPDPC) has been engaged to review data governance practices. These responses signal recognition of the problem's seriousness, though implementation details remain to be announced.
The broader challenge involves building the administrative safeguards that prevent—or at minimum catch and correct—data entry errors before they propagate across the system. The technology has proven capable. What requires strengthening are the governance structures, quality assurance processes, and training protocols that ensure accuracy at the point of data entry.
The Broader Implications for Digital Health Adoption
The Thailand Ministry of Public Health has positioned the Mor Prom app as a cornerstone of expanding digital health services—consolidating multiple government health applications into a unified interface. The vision is compelling: residents accessing consolidated medical records, checking insurance eligibility, and coordinating care seamlessly.
Yet public trust is foundational to that vision. Residents reasonably expect that the official records of their medical history are accurate. When significant numbers discover inaccuracies, confidence in the system is undermined. This directly affects adoption of more advanced digital health services that residents would need to trust with sensitive information.
The digital divide also merits consideration. Urban residents in Bangkok and major cities possess the digital literacy and internet access to audit their Mor Prom profiles. Elderly patients or those in less connected provinces may never discover errors until a medical emergency forces consultation of their records. This creates vulnerability for residents with less access to digital tools.
What Comes Next
The situation underscores an important reality: successful digital health systems require more than technology. They demand robust governance, adequate training, quality assurance mechanisms, and genuine accountability. For Thailand, addressing these dimensions will be essential to rebuilding resident confidence in the Mor Prom platform and enabling the broader digital health transformation the ministry envisions.
For now, the practical advice remains clear: if you use public healthcare in Thailand, reviewing your Mor Prom profile is prudent self-care. Until systemic improvements take hold, regular verification of your digital health record helps protect you from the consequences of errors you might otherwise never discover. The technology intended to simplify healthcare has instead revealed how critical accurate data governance is to public health systems. Addressing this challenge properly will require sustained commitment to the oversight and quality assurance structures that should have been in place from the beginning.
