NPC Issuance Wiki

NPC Advisory Opinion No. 2018-045 — Right to Access Clinical Information of Patients

Issued Advisory Opinion

Text

13 August 2018

Re: RIGHT TO ACCESS CLINICAL INFORMATION OF PATIENTS

Dear [Redacted],

We write in response to your inquiry received by the National Privacy Commission (NPC) which sought to clarify whether the approval of the attending physician is required before a patient can be given access to their clinical information. Specifically, you are asking for clarification whether the following provisions in Department of Health (DOH) Hospital Health Information Management Manual 3rd Edition1 is consistent with the provisions of the Data Privacy Act of 2012 (DPA):2

“From a Patient

  • Ask the patient for identifying information and find out what he wishes to know.
  • Only the following data can be given directly to the patient without the approval of the attending physician: admission and discharge dates, name of the attending physician, and other demographic data except any clinical information.
  • If an approval has been obtained from the attending physician, the patient may have the right to access all the clinical information needed.”

We understand that the above provisions refer to the procedures for the release of information over the phone.

Discussion

Data subject’s right to access

Under Section 16(c) of the DPA, the data subject is entitled to reasonable access to, upon demand, the following:

  1. Contents of his or her personal information that were processed;
  2. Sources from which personal information were obtained;
  3. Names and addresses of recipients of the personal information;
  4. Manner by which such data were processed;
  5. Reasons for the disclosure of the personal information to recipients;
  6. Information on automated processes where the data will or likely to be made as the sole basis for any decision significantly affecting or will affect the data subject;
  7. Date when his or her personal information concerning the data subject were last accessed and modified; and
  8. The designation, or name or identity and address of the personal information controller.

The healthcare provider/institution may prescribe the procedure and form to facilitate the efficient handling of such access requests, taking into consideration other existing laws, policies, and guidelines. We note also that as part of the organizational security measures, personal information controllers (PICs) are required to develop, implement and review policies and procedures for data subjects to exercise their rights under the DPA.3

The personal data relevant to the request must be provided by the PIC to the data subject or his authorized representative through a written document, or by any other format practicable to the PIC, including, where appropriate, by electronic means.4

To reiterate the provision that you referred to from the DOH Manual, it is important to note that the said provision pertains specifically to the handling of telephone inquiries. Hence, the condition should not be inferred to as a general statement or standard procedure in handling all types of access requests. Thus, there is no incompatibility between the DOH’s rule in handling telephone inquiries and the DPA.

Healthcare facilities may prescribe the manner through which access requests may be made. In implementing reasonable and appropriate organizational, technical, and physical security measures to ensure the confidentiality, integrity and availability of personal data, PICs should consider measures which uphold the data subject’s right to access.

The provisions you have cited serves as a security measure to protect the sensitive personal information of the patient, such as health/clinical information, from unauthorized access, especially when the information is being requested over the phone where the identity of the caller is not apparent.

This opinion is based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. National Center for Health Facility Development (NCHFD), Hospital Health Information Management Manual - Third Edition (formerly Hospital Medical Records Management Manual) (2010). ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  3. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 26(e)(4) (2016). ↩

  4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Article 12 (2016). ↩

Backlinks

  • No backlinks found