Text
September 5, 2019
Re: ACCESS TO AND PROCESSING OF MEDICAL RECORDS FOR CANCER REGISTRIES
Dear [Redacted],
We write in response to your letter request for an advisory opinion on whether St. Luke’s Medical Center – Bonifacio Global City (SLMC-BGC) and St. Luke’s Medical Center, Quezon City (SLMC- QC) (collectively, SLMC) are allowed under the Data Privacy Act of 20121 (DPA) to provide access to patient medical records and collection of information from said records by the Department of Health (DOH) – Rizal Cancer Registry of the Rizal Medical Center (RMC) and the Philippine Cancer Society, Inc. (PCS) – Manila Cancer Registry.
In its letter to SLMC-BGC, RMC is requesting access to and collection of pertinent data involving cancer cases occurring among residents of Metro Manila and Rizal Province for the years 2013- 2017 gathered from death certificates for the purpose of determining the true incidence of cancer in the population, and for RMC to gather incidence magnitude of the cancer problem and enable to better formulate and evaluate the cancer control program. RMC cited Ministry of Health Circular No. 126-A dated 12 December 1983.2
To implement the request, research assistants will be sent to SLMC-BGC to review and extract data not only from the chart of patients who died at SLMC-BGC but also relevant Medical Records, Out-Patient Records, Autopsy Records and records of the Department of Pathology, Cytology, Hematology, Radiology, Ultrasound, Nuclear Medicine, CT Scan, MRI and Tumor Registry Board.
On the other hand, PCS requested for access and collection of SLMC-QC’s cases of cancer diagnosed from residents of Manila, Pasay, Caloocan, and Quezon cities, the municipalities of Metro Manila and the Rizal Province for the years 2014-2017. PCS will review the chart of patients who died at SLMC-QC collected through death certificates. Pertinent information will be collected from Medical Records, Out-Patient Records, Department of Pathology, Hematology, Radiotherapy and Tumor Registry or Board, wherever appropriate.
You now inquire whether SLMC should allow access and provide the requested data to RMC and PCS given the limitations of the DPA.
Discussion
Processing of Health Information Allowed Based on Law and Regulation
Medical records, out-patient records, autopsy records, records from the Department of Pathology, Cytology, Hematology, Radiology, Ultrasound, Nuclear Medicine, CT Scan, MRI and Tumor Registry Board contain health information of SLMC patients. As mandated by our data privacy law, any information about an individual’s health is classified as sensitive personal information, and the processing of such is prohibited, except in cases stipulated in Section 13 of the DPA. For processing to be lawful, the law requires that at least one of the criteria for processing must exist.
Particularly, Section 13 (b) of the DPA states:
(b) The processing of the same is provided for by existing laws and regulations: Provided, That such regulatory enactments guarantee the protection of the sensitive personal information and the privileged information: Provided, further, That the consent of the data subjects are not required by law or regulation permitting the processing of the sensitive personal information or the privileged information.
We understand that there is already a law which requires the establishment of a National Cancer Registry and Monitoring System. Republic Act No. 11215 or the National Integrated Cancer Control Act was signed last February 14, 2019.
Section 28 thereof requires the DOH to establish a national cancer registry and monitoring system, which shall be a population-based system, while Section 29 requires hospitals to have their own cancer registries, whereby cancer registry data shall be submitted to the DOH as a requirement for renewal of license to operate a hospital. Both sections of the law recognize explicitly that the processing of the personal data for such registries shall be in accordance with the DPA.
The law’s Implementing Rules and Regulations (IRR) specifically provides that the national cancer registry shall include existing quality population-based cancer registries and shall expand to other strategically defined geographical areas.3
We understand that the RMC and PCS,4 a government institution and a private institution, respectively, are existing population-based cancer registries in the Philippines. The DOH Rizal Cancer Registry and the PCS Manila Cancer Registry are responsible for collecting and analyzing the cancer data in their respective areas.5
From the foregoing, both RMC and PCS may be allowed to collect the relevant health information from SLMC in order to administer their respective population-based cancer registries and in accordance with the provisions of the National Integrated Cancer Control Act.
Since Section 13 (b) allows the processing of sensitive personal information when the same is provided by law and regulation, the consent of the patients or data subjects is no longer necessary.
With the above, it is worth noting that while consent may not be required, by virtue of the principle of transparency, SLMC should make the necessary steps in ensuring that patients are aware their health information is being accessed by the DOH, RMC, and PCS, the purpose and extent of such processing, and how the patient can exercise his or her rights as a data subject. This may be accomplished through a privacy notice.
Furthermore, SLMC should bear in mind the principle of proportionality, such that the processing of health information is adequate, relevant, suitable necessary and not excessive in relation to the declared and specific purpose of the cancer registry. Should SLMC believe that the registries are collecting excessive information, it may seek clarification from RMC and PCS. SLMC should also develop processes and policies to ensure that health information not related to the said purpose is not unduly accessed, collected or processed.
Lastly, it is essential for SLMC to implement reasonable and appropriate organizational, technical and physical security measures to ensure that the personal data to be collected by the research assistants and/or other personnel of RMC and PCS shall receive an adequate level of protection against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
SLMC, together with RMC and PCS, should develop and implement policies and procedures on the method of reviewing and extracting personal data, and the means of securely transmitting these to RMC and PCS. SLMC may also require the mandatory execution of non-disclosure agreements with these research assistants and/or other personnel who shall be processing the medical records.
This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC-Director IV, Privacy Policy Office
Noted by:
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩
-
Ministry of Health, Population-Based Cancer Registry a. Central Tumor Registry of the Philippines and b. Cancer Control Program in the Rizal Medical Center, Ministry of Health Circular No. 126-A [Ministry Circular No. 126-A] (December 12, 1983). ↩
-
Rules and Regulations Implementing the National Integrated Cancer Control Act, Republic Act No. 11215, § 28 (2019). ↩
-
We understand PCS-MCR was formerly the “Central Tumor Registry of the Philippines” which is the registry mentioned in Ministry of Health Circular No. 126-A, s. 1983. See: Philippine Cancer Society, Local Publications, available at http://www.philcancer.org.ph/learn-about-cancer/local-publications/ (last accessed May 21, 2019). ↩
-
Ministry of Health, Ministry Circular No. 126-A, s. 1983 (Dec. 12, 1983). ↩