NPC Issuance Wiki

NPC Advisory Opinion No. 2018-018 — Publication of Decisions on PhilHealth Website

Issued

Text

12 April 2018

Re: PUBLICATION OF DECISIONS ON PHILHEALTH WEBSITE

Dear [Redacted]:

This is in response to your request for opinion addressed to the Department of Information and Communications Technology (DICT) which was forwarded to and received by the National Privacy Commission (NPC) on 20 March 2018.

You inquired on whether the posting of decisions on the PhilHealth website under the proposed “CAAC Webpage” of administrative cases of health care providers appealed to and decided by the Committee on Appealed and Administrative Cases (CAAC) and the PhilHealth Board of Directors (Board), which may disclose patient and health information, is violative of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA).1

Discussion

At the outset, it must be established that the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information.2 Processing includes the collection, recording, organization, storage, updating or modification, retrieval, consultation, use, consolidation, blocking, erasure or destruction of data.3

We understand that during the course of the investigation, deliberation and resolution of an administrative case, the CAAC and the Board may be processing personal information of the patients and other interested parties.

Insofar as the health care provider4 involved in a case decided by the CAAC and the Board is a (1) healthcare institution, (2) health maintenance organization (HMO), or (3) community-based health care organization (CBCHO), the corporate or business information pertaining to them, as entities, are not covered by the DPA since they are juridical persons. As such, processing of information pertaining to such juridical entities, including publication thereof, is not governed by the DPA.

On the other hand, as to the health care providers who are individuals, i.e. a health care professional, who is any doctor of medicine, nurse, midwife, dentist, pharmacist or other health care professional or practitioner duly licensed to practice in the Philippines and accredited by PhilHealth,5 the processing of their information, which includes publication, of any proceeding for any offense committed or alleged to have been committed by such person and the disposal of such proceedings, is prohibited except in cases enumerated in Section 13 of the DPA.

Specifically, Section 13(b) of the DPA allows the processing of sensitive personal information when the same is provided for by existing laws and regulations and the statute does not require the consent of the data subject in processing the personal data. However, the regulatory enactment must guarantee the protection of the sensitive personal information being processed.

Also, as to the processing of personal data pertaining to patients involved in the resolution of cases, Section 13(b) of the DPA may likewise be applicable.

We recognize that the quasi-judicial provisions of the Implementing Rules and Regulations of RA No. 10606 requires the posting of decisions in the PhilHealth Corporate Website, to wit:

Section 141. Posting of Decisions in the PhilHealth Corporate Website.

All Decisions of the Arbitration Office or the PhilHealth Board which have been deemed Final and Executory shall be posted in the PhilHealth Website.

The Board may thus publish its decisions which have become final and executory pursuant to the foregoing provision and in accordance with Section 13(b) of the DPA.

While the NPC recognizes such mandate, PhilHealth also has obligations under the principle of proportionality in relation to public disclosures of sensitive personal information. This principle requires that “the processing of information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose. Personal data shall be processed only if the purpose of the processing could not reasonably be fulfilled by other means.”6

With this, it is proper for the CAAC and the Board to judiciously evaluate and determine whether the publication of the decisions on the website is indispensable in achieving its purpose. The Board can consider redaction of sensitive personal information, such as the identity of patients and their health information, which may not be necessary for purposes of posting in the website.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes, “Data Privacy Act of 2012” (15 August 2012). ↩

  2. See: Republic Act No. 10173, § 4. ↩

  3. Id., §3(j). ↩

  4. IRR of Republic Act No. 10606, § 3(y). ↩

  5. Id., §3(y)(2). ↩

  6. IRR of the DPA of 2012, § 13(c). ↩

Backlinks