Public health authorities collect large amounts of personal information from medical institutions through name-based reporting; this collection is facilitated by public health surveillance and medical subsidy plans. Public health surveillance involves the continual, general, and systematic collection of personal information. Collected information is not only used in efforts to achieve immediate public health goals but also preserved for long-term usage such as policy evaluation and research. In this study, we observed 28 name-based-reporting systems used in public health surveillance in Taiwan. Ostensibly, all these systems are legally authorized; however, three have not been mentioned in any legal articles. Only the six of these systems state the purposes for data collection in the authorization provisions. Most of the authorization laws do not include required details regarding system regulation. On the other hand, public health authorities offer subsidies to medical institutions and patients through contracts and receive enormous amounts of personal medical information from reimbursement. Under the Personal Information Protection Act in Taiwan, the government agencies possess the authority to collect and process people's personal information from organization laws. In the absence of specific regulations, government agencies may legally use collected data of relevant individuals without informed consent for purposes not specified in the data collection terms. For example, information may be used to establish a database for academic research. This study explored the regulations and practices of name-based reporting in Taiwan by conducting interviews and analyzing the relevant laws and regulations. The results of this study suggest that the government should revise the Personal Information Protection Act to establish comprehensive regulations for name-based reporting.