Text
7 August 2018
RE: REQUEST FOR INFORMATION FROM RIZAL MEDICAL CENTER
Dear [Redacted],
We write in response to your email dated 3 August 2018 received by the National Privacy Commission (NPC), attaching a handwritten request for advisory opinion on the above captioned matter, specifically, on the request addressed to Rizal Medical Center (RMC) to release the following information:
- Actual date/time of alcohol test conducted;
- Actual date/time of drug test conducted; and
- Names of doctors/lab personnel for tests.
This is also with reference to the previous report dated 17 July 2018 sent by the Contact Center ng Bayan of the Civil Service Commission (CSC) through email. Said report (Request for Assistance – For Immediate Action) provided details on your letter request dated 20 June 2018 addressed to the RMC for “an Official Copy of the Alcohol and Drug Test Results” of a certain [Redacted], and the RMC’s letter reply dated 6 July 2018.
We understand that the RMC denied the request on the basis of patient confidentiality and the provisions of the Data Privacy Act of 2012 (DPA).1
Discussion
Legitimate purpose; Lawful processing; Disclosure to a third party of personal data held by a hospital should have patient’s consent or should be authorized under existing laws and regulations.
The NPC has been requested to issue an advisory opinion on whether a hospital can disclose the fact that diagnostic exams or chemical tests have been performed on an individual in the health facility. In this particular case, a third party asks a public hospital to disclose whether an alleged suspect in a vehicular accident, reported to have resulted in the loss of human life, had an alcohol test or drug test performed in the health facility. It is not clear whether the alleged suspect is a patient of the facility, and whether cases have been brought against him.
For purposes of this advisory opinion, we took note of the letter of the RMC addressed to the requesting party. This letter was received by NPC from the CSC on July 17, 2018. The said letter informed the requesting party that the hospital “cannot release or share medical records because we are bound by patient confidentiality and provisions of RA No. 10173 or the Data Privacy Act.” This letter is considered in addition to the information provided by requesting party through telephone conversations.
Based on the present inquiry, the information on the alcohol test or drug test is being requested for the purpose of finding out if the provisions of R.A. No. 105862 have been complied with. The relevant provisions in the said law are:
Section 7. Mandatory Alcohol and Chemical Testing of Drivers Involved in Motor Vehicular Accidents. – A driver of a motor vehicle involved in a vehicular accident resulting in the loss of human life or physical injuries shall be subjected to chemical tests, including a drug screening test and, if necessary, a drug confirmatory test as mandated under Republic Act No. 9165, to determine the presence and/or concentration of alcohol, dangerous drugs and/or similar substances in the bloodstream or body.
Section 8. Refusal to Subject Oneself to Mandatory Tests. – A driver of a motor vehicle who refuses to undergo the mandatory field sobriety and drug tests under Sections 6, 7 and 15 of this Act shall be penalized by the confiscation and automatic revocation of his or her driver’s license, in addition to other penalties provided herein and/or other pertinent laws.3
As a general rule, the DPA applies to the processing of all types of personal information and to any natural and juridical person involved in personal information processing.4 It allows the processing of personal information, subject to compliance with the requirements of the DPA and other laws allowing disclosure of information to the public and adherence to the principles of transparency, legitimate purpose and proportionality.5
These provisions mean that a hospital, whether private or public, is covered by the DPA, and the provisions of the law apply to the processing of personal information, sensitive personal information and privileged information in the health care facility.
In this inquiry, a third party is asking the hospital to disclose personal information, which is any information which relates to an identified or identifiable person. The identity of the patient and the fact that a particular diagnostic test has been performed, are personal information.
Information about whether a diagnostic test has been performed is already information with clinical value because it is no longer limited to just the general information like name of patient, address, attending physician and admission and discharge dates.6
The fact of ordering a diagnostic test or chemical test may already disclose information about a patient’s medical condition. This already goes into the differential diagnosis of a physician, which is based on a patient’s history, presenting symptoms, physical examination, and the professional judgment of the physician. This information is already part of the physician-patient relationship, the medical management, and involves advice, treatment and information acquired in the course of attending to a patient. There is no information available to evaluate whether the requested information falls under any category of information other than that which may have been acquired by the hospital in the context of provision of healthcare.7
The processing of all types of personal information will be allowed if the processing, such as disclosures to third party, complies with the requirements of the DPA, including the mandatory requirement of meeting at least one of the criteria for lawful processing.
Under Sections 12 and 13 of the DPA:
Section 12. Criteria for Lawful Processing of Personal Information. – The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists:
(a) The data subject has given his or her consent;
(b) The processing of personal information is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract;
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject;
(d) The processing is necessary to protect vitally important interests of the data subject, including life and health;
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or
(f) The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller or by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.
Section 13. Sensitive Personal Information and Privileged Information. – The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:
(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;
(c) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;
(d) The processing is necessary to achieve the lawful and noncommercial objectives of public organizations and their associations: Provided, That such processing is only confined and related to the bona fide members of these organizations or their associations: Provided, further, That the sensitive personal information are not transferred to third parties: Provided, finally, That consent of the data subject was obtained prior to processing;
(e) The processing is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured; or
(f) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.8
Based on the information provided in this particular inquiry, the requested disclosure of personal information to a third party does not meet any of the criteria provided by the DPA in Sections 12 and 13. It should be emphasized that the request for disclosure in this instance is from a third party, an individual other than a patient or a patient’s authorized representative. The request is also not being made by a public authority for the fulfillment of their functions, nor does it proceed from a duly issued subpoena or court order. The information requested also pertains to a patient’s health, with clinical value, and is considered sensitive and privileged in nature, the processing of which is prohibited except under specific circumstances.
The purpose for requesting the information should be examined. Hospitals are bound by reporting requirements in many instances, where disclosures are provided by law and regulation.
At the onset, it should be clear that nothing in the Anti-Drunk and Drugged Driving Act of 2013 or its Implementing Rules and Regulations (IRR) provide for the reporting requirement on the part of hospitals to disclose information relevant to diagnostic tests it performs in its facilities.
Likewise, Section 7 of the Anti-Drunk and Drugged Driving Act of 2013 does not impose the obligation to conduct mandatory alcohol and chemical testing of drivers on the hospital.
On the other hand, Section 6 of the same law provides, “If the law enforcement officer has probable cause to believe that a person is driving under the influence of dangerous drugs and/or other similar substances, it shall be the duty of the law enforcement officer to bring the driver to the nearest police station to be subjected to a drug screening test and, if necessary, a drug confirmatory test as mandated under Republic Act No. 9165.”9
Furthermore, Rule IV of the IRR of R.A. No. 10586 provides:
RULE IV – MANDATORY ALCOHOL AND DRUG TESTING
Section 1. Mandatory Alcohol and Chemical Testing of Drivers Involved in Motor Vehicular Accidents
a. A driver of a motor vehicle involved in a vehicular accident resulting in the loss of human life or physical injuries shall be subjected to on site field sobriety test and ABA testing, whenever practicable, and, thereafter chemical tests, including a drug screening test and, if necessary, a drug confirmatory test as mandated under Republic Act No. 9165, to determine the presence and/or concentration of alcohol, dangerous drugs and/or similar substances in the bloodstream or body. A LEO may use other alcohol testing equipment, such as Gas Chromatography-Mass Spectroscopy (GCMS), whenever the use of an ABA is not practicable under prevailing circumstances.
b. A driver of a motor vehicle who refuses to undergo the mandatory testing as required shall be penalized by the confiscation and automatic revocation of his or her driver’s license, in addition to other penalties provided herein and/or other pertinent laws.10
The term LEO “refers to law enforcement officers of the LTO or authorized officer trained and deputized by the Land Transportation Office to enforce the provisions of this Act.”11 Under said law, the duty to ensure that the provision is complied with attaches to the law enforcement officers, depending on the circumstances of the case.
No similar duty has been imposed on the hospital under the Anti-Drunk and Drugged Driving Act of 2013 or its IRR. More so, the disclosure by the hospital to a third party of such personal data is not provided for by existing laws and regulations. In fact, if abovementioned Section 7 is read together with Section 8 of R.A. No. 10586, it will likewise be clear that an individual may refuse to undergo the mandatory field sobriety and drug tests, but he or she will be subjected to penalties. This means that should the individual refuse to comply with the mandatory requirement, corresponding penalties are imposed by the law on the individual refusing the tests. The penalty is not imposed on hospitals.
The purpose of the request is to determine whether the provisions of R.A. No. 10586 have been complied with. This may be accomplished by other means, without unnecessarily overturning the duty of confidentiality of healthcare providers, and the rule on privileged communications.
The information requested by the third party may be obtained from the hospital, either with consent of the patient, or when authorized by law or regulation. The duty of confidentiality on the part of healthcare providers is more than a legal obligation but also an ethical one. This is fundamental to a physician-patient relationship, which is fiduciary in nature and dependent on trust.
Disclosures of health information are allowed but only under specific circumstances, considering the identity of the requesting party, the purpose of the request, and any applicable legal obligations. Disclosures must be based on law and regulation and cannot be arbitrarily made.
In the absence of clear legal requirements authorizing the disclosure of the requested information under the circumstances of this inquiry, the hospital is not obligated to release any health information to the requesting party, including the fact of whether any diagnostic or chemical tests have been done.
This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩
-
An Act Penalizing Persons Driving Under the Influence of Alcohol, Dangerous Drugs, and Similar Substances, and for Other Purposes [Anti-Drunk and Drugged Driving Act of 2013] Republic Act No. 10586 (2013). ↩
-
Anti-Drunk and Drugged Driving Act of 2013, §§ 7-8. ↩
-
DOH Health Information Manual (2013), p. 37. ↩
-
It should be noted that even under the Dangerous Drugs Board Regulation No. 2 Series of 2003, Subject: Implementing Rules and Regulations Governing Accreditation of Drug Testing Laboratories in the Philippines: 15.4. Access to laboratory test results – the drug test result and the records shall be confidential subject to the usual accepted practices to protect the confidentiality of the test results. ↩
-
RA No. 10586, §6. ↩
-
Rules and Regulations Implementing the Anti-Drunk and Drugged Driving Act of 2013, Republic Act No. 10586, Rule IV, § 1. ↩
-
Id., Rule I, § 3 (n). ↩