NPC Issuance Wiki

NPC Advisory Opinion No. 2020-009 — Deletion of Electronic Medical Records

Issued Advisory Opinion

Official opinion tags

Text

4 February 2020

Dear [Redacted],

Re: DELETION OF ELECTRONIC MEDICAL RECORDS

We write in response to your inquiry regarding the electronic medical records from pre-employment medical examination of job applicants and the concern on its removal or deletion from the database of Healthway Medical Inc. (Healthway) upon the request of its corporate clients who paid for such service.

We understand that Healthway is a network of mall-based clinics that offers medical examination and healthcare consultations. Healthway provides pre-employment medical examination services to the corporate clients’ potential employees.

It is stipulated in Healthway’s contract with such corporate clients that in case of termination of service, all records obtained or generated through the contract shall be returned to the corporate client. Such corporate clients likewise have the right to have the records removed and deleted from Healthway’s records or database.

You now request for clarification on the following matters:

  1. Is it allowable under the Data Privacy Act of 2012 (DPA) to have the medical records removed/deleted without the consent of the job applicants?
  2. Does the legitimate purpose principle have a period of effectivity, meaning that the purpose of the pre-employment examination has been served, therefore the corporate client has the discretion/right to have the personal data removed/deleted?
  3. Is Section 19(d)(1) of the Implementing Rules and Regulations (IRR) of the DPA applicable in this case?

Discussion

Scope of the DPA; personal information controller and processor; role of a PIC

The Data Privacy Act of 20121 (DPA) applies to the processing of all types of personal information and to any natural and juridical person involved in the processing of personal information.2

A personal information controller (PIC) refers to a person or organization who controls the collection, holding, processing or use of personal information,3 while a personal information processor (PIP) refers to any natural or juridical person to whom a PIC may outsource the processing of personal data pertaining to a data subject.4 There is control if the natural or juridical person or any other body decides on what information is collected, or the purpose or extent of its processing.5

In this scenario, the processing of personal data for the pre-employment medical examination of job applicants has been outsourced to Healthway by the corporate clients. The clinic thus acts under the instructions of its corporate clients as to the purpose of processing personal data, as well as the data subjects qualified to undergo the pre-employment medical examination.

However, in its truest sense, Healthway cannot be considered a mere PIP solely because the medical examination was outsourced and paid for by the corporate client. Nor will it make the corporate client the owner of the medical record for the fact remains that the medical record is still personal information pertaining to the job applicant.

Rather, between the job applicant and Healthway, the latter is a PIC since it determines what information from the job applicant is collected and determines the processing and extent of use of the job applicant’s personal information to effectively conduct the medical examination, depending on the specific medical purposes only the clinic may identify.

Rights of a data subject; retention of personal information for the fulfillment of the declared, specified, and legitimate purpose and in cases provided for by law

Each being a separate PIC in its own right, Healthway and the corporate client are both mandated by law to uphold the rights of data subjects as provided for in Section 16 of the DPA. This includes among others, the right to access and the right to withdraw or order the blocking, removal or destruction of a data subject’s personal information if the same is no longer covered by any other grounds for lawful processing. Non-compliance will each make Healthway and the corporate client liable to the data subject.

Considering that Healthway and the corporate client may have different and separate purposes for the collection, use and retention of a data subject’s information, each PIC then must assess the period within which it is necessary for them to maintain health records, hinging its assessment on the legitimate purpose for which the data subject’s information was processed and not merely based on who commissioned or paid for the service.

In the case of the corporate clients, the determination of the retention period of health records and the decision to delete the same may stem from Section 19 of the IRR of the DPA which provides as follows:

Section 19. General principles in collection, processing and retention. The processing of personal data shall adhere to the following general principles in the collection, processing, and retention of personal data:

xxx xxx xxx

d. Personal data shall not be retained longer than necessary.

  1. Retention of personal data shall only for as long as necessary: a) for the fulfillment of the declared, specified, and legitimate purpose, or when the processing relevant to the purpose has been terminated; b) for the establishment, exercise or defense of legal claims; or c) for legitimate business purposes, which must be consistent with standards followed by the applicable industry or approved by appropriate government agency.
  2. Retention of personal data shall be allowed in cases provided by law.
  3. Personal data shall be disposed or discarded in a secure manner that would prevent further processing, unauthorized access, or disclosure to any other party or the public, or prejudice the interests of the data subjects.

On the other hand, aside from the circumstance provided for in Section 19 (d) of the IRR of the DPA, Healthway, a healthcare facility, may also anchor their retention period to the applicable provisions of the Departments of Health’s Department Circular No. 70 series of 1996,6 providing for the retention period of various health records.

Thus, while it is ideal to get the consent of the data subject prior to deletion of their information, such consent is not a requisite if the PIC determines that retention falls within any of the circumstances under Section 19 (d) of the IRR. What the law mandates is for each PIC to inform its data subjects through appropriate means the time frame for the retention and deletion of the health records in order to ensure that the latter’s right to access and erasure are upheld.

This opinion is being rendered based on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner and Chairman

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  2. Data Privacy Act of 2012, § 4. ↩

  3. Id., § 3 (h). ↩

  4. Id., § 3 (i). ↩

  5. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 3 (m) (2016). ↩

  6. Department of Health, The Revised Disposition Schedule of Medical Records Amending Ministry Circular 77 s. 1981, [Department Circular No. 70 s. 1996] (1996). ↩

Backlinks

  • No backlinks found