Abstract: It is not advisable to broadly define medical and health information as private or sensitive personal information, which can easily lead to confusion in the application of law in judicial practice. In practice, the information categories of medical and health information are diverse. Based on determining the relationship between private information and sensitive personal information, we should analyze the underlying value logic of different information categories and use the typological method in legal methodology to divide the legal attributes of medical and health information into four categories: private information, sensitive personal information, both private and sensitive personal information, and neither private nor sensitive personal information. Among them, the identification of private information can draw inspiration from the theory of reasonable expectations of privacy. The identification of sensitive personal information should distinguish between the first level of protection based on personal dignity and the second level of protection based on personal information self-determination, which realizes the correction function during data processing. Only in this way can we find the most accurate private law protection approach for different types of medical and health information based on the privacy rules in the Civil Code, the general provisions in the Personal Information Protection Law, and the special provisions on sensitive personal information. For medical and health information that belongs to both private and sensitive personal information, the scenario analysis methods should also be used to distinguish different levels of processing behavior: the first level applies both of the privacy rules and the sensitive personal information rules, and the second level directly applies the sensitive personal information rules.

Key words: medical and health information, private information, sensitive personal information, The Civil Code, The Personal Information Protection Law