NPC Issuance Wiki

NPC Advisory Opinion No. 2018-016 — Compliance of Resident Physicians to Diplomate Board Exam and Accreditation Requirements

Issued

Text

12 April 2018

RE: COMPLIANCE OF RESIDENT PHYSICIANS TO THE REQUIREMENT OF PROFESSIONAL SOCIETIES FOR DIPLOMATE BOARD EXAM AND ACCREDITATION

Dear [Redacted]:

This refers to your inquiry received by the National Privacy Commission (NPC) on 27 February 2018 regarding the compliance of your resident physicians with the requirements of the Philippine College of Surgery (PCS) and Philippine Obstetrics and Gynecology Society (POGS) for diplomate board exam and accreditation. We understand that one of the requirements is to submit a report on the actual cases that they have handled during their residency.

We understand further that some of these cases date back to January 2015 and were not covered by the revised consent for admission.

The information that the PCS and POGS require include the following:

  1. Name of patient;
  2. Date of admission;
  3. Date of operation;
  4. Hospital number; and
  5. Attending physician/consultant.

You are seeking guidance on how Capitol Medical Center (CMC) can resolve the issue without violating Republic Act No. 10173,1 also known as the Data Privacy Act of 2012 (DPA), given that consent from the patients was not obtained by CMC.

Discussion

Criteria for Lawful Processing of Personal Data

The processing of personal, sensitive personal and privileged information (collectively, personal data) shall be allowed, subject to the compliance with the requirements of the DPA, and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.2

Specifically, personal data must be collected for specified and legitimate purposes determined and declared before, or as soon as reasonably practicable after collection, and later processed in a way compatible with such declared, specified and legitimate purposes only, and processed fairly and lawfully.3

Given these requirements, the patient, as the data subject, should have been informed of the purpose of the processing of his or her data, and the processing thereof should be proportionate to the purpose.

CMC’s disclosure of the patients’ data for purposes of fulfilling the resident physicians’ submission requirements for diplomate board exam and accreditation to the PCS and POGS may be allowed under the DPA provided that the patient has provided consent.4

The NPC understands that patients’ personal data are necessary in order to avoid fraud cases. An option to consider is to pseudonymize the patients’ data prior to disclosing the same. Pseudonymization consists of replacing one attribute (typically a unique attribute) in a record by another.5 While pseudonymization lessens the risks, personal data which have undergone pseudonymization remains to be personal data,6 hence, consent is still necessary.

In the event that the CMC can no longer obtain consent from the patients, there should be design methods and techniques wherein the PCS and POGS can validate that the cases handled by the resident physicians are true and correct without involving disclosure of personal data to the said professional societies. This may be in form of a certification from the CMC.

Another option is to anonymize the data. Note that the DPA is not applicable to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.7

We wish to emphasize that the DPA mandates that personal information controllers (PICs), such as CMC, must uphold the rights of data subjects and implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful disclosure, as well as against any other unlawful processing.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. RA No. 10173, §11. ↩

  3. RA 10173 § 11; IRR § 20(b). ↩

  4. RA No. 10173, §3(b) – Consent of the data subject refers to any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so. ↩

  5. Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques, 10 April 2014. ↩

  6. See: General Data Protection Regulation, recital 26. ↩

  7. Id. ↩

Backlinks