NPC Issuance Wiki

NPC Advisory Opinion No. 2018-083 — Collection of Health Information by the Department of Health

Issued Advisory Opinion

Official opinion tags

Text

26 November 2018

Re: COLLECTION OF HEALTH INFORMATION BY THE DEPARTMENT OF HEALTH

Dear [Redacted],

Discussion

We write in response to your request for an advisory opinion regarding processing of health information by the Department of Health (DOH) related to its conduct of disease surveillance, epidemic investigation, contact tracing, survey research and disease registry, among others, at the national and regional level as part of its mandate aimed at providing accurate and complete health information for its policies, programs, and interventions.

During a clarificatory meeting, we were informed about the difficulty that the DOH encounters when collecting health information from healthcare providers1 due to apprehensions on the implications of the Data Privacy Act of 2012 (DPA).2 We understand that there are some healthcare providers claiming that the DOH is collecting excessive amounts of personal information. You have explained that collection of both personal information and sensitive information is necessary to minimize double counting of reportable health information, and allows for epidemic investigation and contact tracing when required by the circumstances. Monitoring of disease conditions, health outcomes and effects of intervention also require personal data.

The DPA is not meant to prevent government institutions from processing personal data when necessary to fulfill their mandates. Rather, it aims to protect the right to information privacy while ensuring free flow of information. What the DPA does is to promote fair, secure, and lawful processing of such information. In this case, the DPA does not prohibit the DOH from collecting and processing personal data for purposes necessary to its mandate, with the concomitant responsibility of complying with the requirements of the DPA, its Implementing Rules and Regulations (IRR), and other issuances of the National Privacy Commission (NPC).

In the meeting between representatives of the DOH and the NPC, the constitutional and statutory mandate of the DOH were discussed in relation to its personal data processing activities. The Philippine Constitution mandates the protection and promotion of the right to health of the people and the adoption of an integrated and comprehensive approach to health development.3 This mandate is exercised by the DOH as the government agency primarily responsible for the formulation, planning, implementation, and coordination of the policies and programs in the field of health.4 With this, the DOH processes personal data in order to perform the following functions as mandated in the Revised Administrative Code of 1987:

  1. Define the national health policy and formulate and implement a national health plan within the framework of the government’s general policies and plans, and present proposals to appropriate authorities on national issues which have health implications; 2. Provide for health programs, services, facilities and other requirements as may be needed, subject to availability of funds and administrative rules and regulations; 3. Coordinate or collaborate with, and assist local communities, agencies and interested groups including international organizations in activities related to health; 4. Administer all laws, rules and regulations in the field of health, including quarantine laws and food and drug safety laws; 5. Collect, analyze and disseminate statistical and other relevant information on the country’s health situation, and require the reporting of such information from appropriate sources; 6. Propagate health information and educate the population on important health, medical and environmental matters which have health implications; 7. Undertake health and medical research and conduct training in support of its priorities, programs and activities; 8. Regulate the operation of and issue licenses and permits to government and private hospitals, clinics and dispensaries, laboratories, blood banks, drugstores and such other establishments which by the nature of their functions are required to be regulated by the Department; 9. Issue orders and regulations concerning the implementation of established health policies; and 10. Perform such other functions as may be provided by law.5

In addition, the DOH, through its offices and staff support services, also has the mandate to conduct studies and research on various disease conditions, to fulfill health intelligence services, and to maintain effective and comprehensive health information systems.6

The DPA should not be an obstacle to the collection and further processing of personal data by DOH as long as the same is necessary for the fulfillment of its mandate. In this case, the use of personal information and sensitive personal information for policy development, monitoring of health programs, and provision of better health care services is recognized as being necessary for DOH to perform its functions.

The processing of personal data by DOH finds support in the DPA. The DOH is a public authority performing regulatory functions, and is permitted to process personal data to the extent necessary for the fulfillment of these functions.7 DOH also processes personal data for research purpose.8 Furthermore, DOH may also rely on the provisions of the DPA in Sections 12 and 13 providing the criteria for lawful processing of personal information and sensitive personal information, respectively. For instance, Section 13 provides that the processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

xxx

(a) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information;

(b) The processing is necessary to protect the life and health of the data subject or another person, and the data subject is not legally or physically able to express his or her consent prior to the processing;

xxx

(c) The processing concerns such personal information as is necessary for the protection of lawful rights and interests of natural or legal persons in court proceedings, or the establishment, exercise or defense of legal claims, or when provided to government or public authority.9

While the DOH may have lawful basis in processing personal and sensitive personal information, it must, however, comply with its obligations as a personal information controller under the DPA, its IRR and related issuances. In processing personal data, DOH should be mindful of the rights of data subjects and ensure that it adheres to the principles of transparency, legitimate purpose and proportionality.10 The basis of its processing should be documented and made known to healthcare providers subject to the DOH reporting requirements. For their part, these healthcare providers should, in turn, inform their data subjects of the fact of such processing by the DOH and the scope, nature, extent, purpose, and basis for the same.

These reporting requirements should be reviewed to ensure that personal data being processed is adequate and not excessive in relation to the purposes for which they are collected and processed.11 There should also be existing procedures for data subjects to exercise their rights, and appropriate organizational, physical and technical safeguards for data protection.

The DOH should consider NPC Advisory No. 2017-03 on the Guidelines on Privacy Impact Assessments in order to systematically address the obligations previously mentioned. As a government agency, the DOH should also consider NPC Circular No. 16-01 on the Security of Personal Data in Government Agencies and NPC Circular No. 16-02 regarding the execution of a data sharing agreement between the DOH and the different healthcare providers, as may be necessary in certain circumstances.

This opinion is rendered based on the information provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For you reference.

Very truly yours,

(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office

Noted by:

(Sgd.) IVY D. PATDU Deputy Privacy Commissioner Officer-In-Charge

Footnotes

  1. Department of Health (DOH)-Department of Science and Technology (DOST)-Philippine Health Insurance Corporation (PhilHealth) Joint Administrative Order (JAO) 2016-0002, Annex 2.0, Definition of Terms, health care provider – a health care institution devoted primarily to management, treatment and care of patients OR a health care professional, who is any doctor of medicine, nurse, midwife, dentist, or other health care practitioner. ↩

  2. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  3. PHIL. CONST. art. 2, § 15, art. 13, § 11. ↩

  4. Instituting the Administrative Code of 1987 [Administrative Code of 1987], Executive Order 292, Title IX, § 2 (1987). ↩

  5. Id. Title IX, § 3. ↩

  6. Id. Title IX, §§10, 13-15. ↩

  7. Data Privacy Act of 2012, § 4. ↩

  8. Data Privacy Act of 2012, § 4. ↩

  9. Data Privacy Act of 2012, § 13. ↩

  10. Data Privacy Act of 2012, § 11. ↩

  11. Data Privacy Act of 2012, § 11 (d). ↩

Backlinks