<p>This study constructs a tripartite evolutionary game model involving healthcare data management authorities (DMAs), healthcare data operating departments (DODs), and data-related entities (DEs) within a triple principal-agent framework. We analyze dynamic interactions among these stakeholders in healthcare data governance, focusing on privacy security, moral hazard, and interest alignment. Results indicate that strategic instability arises under conditions of ambiguous data property rights and asymmetric risk responsibilities. However, the system converges to compliance-oriented equilibria when critical thresholds are surpassed. Notably, DMAs’ strong incentive strategies are pivotal in resolving regulatory paradoxes, while DODs’ risk behaviors exhibit nonlinear sensitivity to penalty intensity and revenue levels. We further demonstrate that a dual “penalty-compensation” mechanism mitigates economic losses from data breaches, and synergistic government reputation mechanisms with financial incentives reduce regulatory costs. Policy implications include a tiered dynamic regulatory system, a revenue-risk linked distribution mechanism, and a collaborative governance ecosystem driven by technology and credibility constraints.</p>