NPC Issuance Wiki

NPC Advisory Opinion No. 2018-072 — Review of Consent Form

Issued Advisory Opinion

Text

5 October 2018

Re: Review of Consent Form

Dear [Redacted],

We write in response to your request received by the National Privacy Commission (NPC) to review the National Kidney Transplant Institute’s (NKTI) Consent Form template regarding its compliance with the Data Privacy Act of 2012.1 Please see the template below with our comments:

Discussion

NKTI Patient Consent FormRemarks
Personal information required in the form:When processing personal data, it should be considered that the processing shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.2
• Patient’s Name (Last, First, Middle)
• SexThere is a need to review if all the listed personal information to be collected is necessary for the purpose. Note that some of the items being asked are sensitive personal information (age and civil status).3
• Age
• Civil Status
CONSENT TO TREATMENT:
I hereby authorize NKTI, its physicians and staff to perform diagnostic and treatment procedures that my/the patient’s condition requires, except those procedures that need a specific written consent. I have been given an opportunity to ask questions and have them fully answered.No comment
I do not authorize to [sic] the conditions stated above and understand the consequences
ACCESS TO PATIENT’S INFORMATION:Please clarify how NKTI can act as the agent of the patient and have the authority to obtain information from other physicians, hospitals, or clinics without disclosing the patient’s identity.
As long as my/the patient’s identity is not disclosed, I hereby designate NKTI to be my/the patient’s agent and authorize the latter to obtain information from other physicians, hospitals or clinics which are necessary for the patient’s treatment and care while in NKTI. General information or data which may be gathered by NKTI during the course of my/the patient’s treatment may be used for training purposes. I have been given an opportunity to ask questions and have fully answered.If the health information will be used for training purposes, consent which is specific for the purpose must be obtained. Therefore, we recommend that there be a separate provision for trainings and an enumeration of the types of training covered in the consent form.
I do not authorize to [sic] the conditions stated above and understand the consequencesAdditionally, please clarify the consequences of the patient choosing not to authorize NKTI.
CONSENT TO BE INCLUDED TO PATIENT REGISTRY:To clarify, the processing of information necessary for the DOH and PhilHealth to fulfill their respective mandates is anchored on existing laws and regulations and not based on consent. Hence, a patient’s consent may not be required in these instances.
As long as my/the patient’s identity is not disclosed, I hereby agree that all information or data gathered during the course of my/the patient’s treatment, may be accessed in compliance with the regulatory requirements of government agencies, including but not limited to DOH, and PhilHealth for statistical and research purposes. I have been given an opportunity to ask questions and have fully answered.Nevertheless, the patient should be duly informed about the processing for such purposes, pursuant to the right of data subjects to be informed on whether personal data pertaining to him or her shall be, are being, or have been processed.
I do not authorize to [sic] the conditions stated above and understand the consequencesWhere processing is for statistical and research purposes, we understand that NKTI is mandated to conduct fact-finding investigations on kidney diseases and to report, publish and disseminate information on kidney and allied diseases, among others. Statistical data, if anonymized, is outside the scope of the DPA, provided that the anonymity of the individual data subject can be guaranteed.4
Nonetheless, NKTI must still abide by existing rules and regulations on health research and research involving human participants such as the 2017 National Ethical Guidelines for Health and Health-Related Research.5
Finally, we wish to emphasize that the patient has the right to refuse to participate in the research or withdraw his or her participation therein without having to give any reason, and without penalty or loss of benefits to which he or she is entitled.6
AUTHORIZATION FOR RELEASE OF MEDICAL RECORDS:
I hereby authorize NKTI to make a copy/ies of the result of my/the patient’s clinical laboratory tests, radiological examination, and other medical records, procedures, treatment, etc. to be incorporated in my/the patient’s records, except (if applicable) and release such copy/ies to my/the patient’s authorized representatives. I hereby hold NKTI free from all liability that may arise from the release of the said medical records. I have been given an opportunity to ask questions and have them fully answered.No comment
I do not authorize to [sic] the conditions stated above and understand the consequences
If you want to withdraw your consent to use your data or amend any information, submit your Letter of Intent to the Unit Head Nurse or Admitting OfficerWe recommend that the contact details of the Unit Head Nurse, Admitting Officer, or the Data Protection Officer of NKTI be provided to the patient to give them an effective and efficient mode of reaching the concerned officers for any questions regarding the form.

In addition, in view of research being a part of the NKTI’s mandate, you inquired about the acceptability of informing the patient that his or her personal information may be included in a research project in lieu of a separate consent portion.

This is not possible. While Presidential Decree No. 1832, which created the NKTI, did include research as part of your institution’s mandate, the processing of personal and sensitive personal information for research is still subject to the requirements of existing laws and regulations governing research.

The Implementing Rules and Regulations (IRR) of the Data Privacy Act of 20127 (DPA) states that personal information that will be processed for research purposes, intended for a public benefit, subject to the requirements of applicable laws, regulations, or ethical standards, is outside of the scope of the law.8 But this exemption from the requirements of the DPA is only to the minimum extent of collection, access, use, disclosure or other processing necessary to the purpose, function, or activity concerned, and does not extend to personal information controllers who remain subject to the requirements of implementing security measures for personal data protection.

For health research and research involving human participants, we understand that the Department of Science and Technology — Philippine Council for Health Research and Development (DOST PCHRD) published the 2017 National Ethical Guidelines for Health and Health-Related Research (Guidelines), which was prepared by the Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guideline.

The said Guidelines state that an element of research ethics is informed consent, defined as a decision of a competent potential participant to be involved in research after receiving and understanding relevant information, without having been subjected to coercion, undue influence, or inducement.9

Further, the Guidelines require the consent of research participants, to wit:

“For all research involving humans, the researcher shall obtain the voluntary informed consent of the prospective research participant. In the case of an individual who is incapable of giving or who has diminished capacity to give informed consent, the researcher must exert effort to obtain his or her assent and the consent of a legally authorized representative (LAR), in accordance with applicable laws.”10

Similarly, under the Section 3(b) of the DPA, consent of the data subject is defined as any freely given, specific, informed indication of will, whereby the data subject agrees to the collection and processing of personal information about and/or relating to him or her. Consent shall be evidenced by written, electronic or recorded means. It may also be given on behalf of the data subject by an agent specifically authorized by the data subject to do so.

In addition to the responses to your inquiries, we recommend the following to enhance the adherence of your consent form to the spirit of the general principles of data privacy:

  • Provide introductory paragraphs which discusses the nature of NKTI as an institution;
  • Modify the format of the consent form to simplify the consent statement, i.e. enumerate all purposes where consent is required, such as use of health information for training purpose, accreditation, inclusion in registry, etc.
  • A tick box for each item may be useful to ensure that the patient or data subject explicitly consented to each processing, provided that distinct purposes are separated and not bundled together.
  • Processes that do not require consent, such as use of personal data for reportorial requirements covered by existing laws and regulations may be incorporated in the hospital’s privacy notice; and
  • Consider translating the language used in the consent form.

This opinion is rendered based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Officer-in-Charge and Deputy Privacy Commissioner for Policies and Planning

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  2. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 18(c) (2016). ↩

  3. Data Privacy Act § 3(i). ↩

  4. Opinion 05/2014 on Anonymisation Techniques of the Article 29 Data Protection Working Party of the European Commission provides an illustration on how a dataset would qualify as anonymous: “If an organisation collects data on individual travel movements, the individual travel patterns at event level would still qualify as personal data for any party, as long as the data controller (or any other party) still has access to the original raw data, even if direct identifiers have been removed from the set provided to third parties. But if the data controller would delete the raw data, and only provide aggregate statistics to third parties on a high level, such as ‘on Mondays on trajectory X there are 160% more passengers than on Tuesdays’, that would qualify as anonymous data.” ↩

  5. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines National Ethical Guidelines for Health and Health-Related Research 11-12 (2017). ↩

  6. Id. ↩

  7. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for other Purposes [DATA PRIVACY ACT OF 2012], Republic Act No. 10173 (2012). ↩

  8. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (2016). ↩

  9. Id. ↩

  10. Philippine Health Research Ethics Board Ad Hoc Committee for Updating the National Ethical Guidelines National Ethical Guidelines for Health and Health-Related Research 11-12 (2017). ↩

Backlinks

  • No backlinks found