NPC Issuance Wiki

NPC Advisory Opinion No. 2020-010 — Philippine Health Insurance Corporation Inspection And Monitoring Activities

Issued Advisory Opinion

Official opinion tags

Text

10 February 2020

Re: PHILIPPINE HEALTH INSURANCE CORPORATION INSPECTION AND MONITORING ACTIVITIES

Dear [Redacted],

We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify several matters in relation to the inspection and monitoring activities conducted by the Philippine Health Insurance Corporation (Philhealth).

Discussion

We understand that a representative of the Philhealth Regional Office VII visited your hospital to inspect and monitor the hospital’s compliance with Philhealth circulars on fraud prevention. Part of the process includes access to hospital logbooks containing patient information of both Philhealth and non-Philhealth members, Integrated Hospital Operations Management Information System (iHOMIS) and patients’ charts containing personal and sensitive personal information (collectively, personal data).

We further understand that per the hospital’s organizational security measure, the Philhealth employee was requested to sign a non-disclosure agreement (NDA) but was advised by Philhealth’s legal counsel not to sign the same.

From the foregoing, you seek clarification on the following:

  1. Are the inspection and monitoring activities of the Philhealth an exemption from the applicability of Section 5 (d) and the last paragraph thereof of the Implementing Rules and Regulations1 (IRR) of the Data Privacy Act of 20122 (DPA); 2) Is Philhealth exempt from signing an NDA if their staff performs monitoring and inspection; and 3) Is Philheatlh exempt from entering into a data sharing agreement (DSA) with the hospital.

Processing of Sensitive Personal Information; Regulatory Function of the Public Authority; Statutory Mandate

The DPA and its IRR provide for a list of specific information or special cases wherein the law and the rules are not applicable. Section 5(d) and the last paragraph of said section provides:

Information necessary in order to carry out the functions of public authority, in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function, including the performance of the functions of the independent, central monetary authority, subject to restrictions provided by law. Nothing in this Act shall be construed as having amended or repealed Republic Act No. 1405, otherwise known as the Secrecy of Bank Deposits Act; Republic Act No. 6426, otherwise known as the Foreign Currency Deposit Act; and Republic Act No, 9510, otherwise known as the Credit Information System Act (CISA).

xxx xxx xxx

Provided, that the non-applicability of the Act or these Rules do not extend to personal information controllers or personal information processors, who remain subject to the requirements of implementing security measures for personal data protection: Provided further, that the processing of the information provided in the preceding paragraphs shall be exempted from the requirements of the Act only to the minimum extent necessary to achieve the specific purpose, function, or activity.3

In order to apply, the following must be established:

  1. Information is necessary in order to carry out the law enforcement or regulatory function of a public authority; 2. Processing is for the fulfillment of a constitutional or statutory mandate; 3. Applies only to the minimum extent of collection, access, use, disclosure, or other processing necessary to the purpose; and 4. Strict adherence to all substantive and procedural processes.4

Republic Act (RA) No. 10606, otherwise known as the National Health Insurance Act of 2013, provides that Philhealth has the power to visit, enter and inspect facilities of health care providers and where applicable, secure copies of their medical, financial and other records and data pertinent to the claims, accreditation, premium contributions of the health care provider’s patients and employees.5 This is read together with the Philhealth’s power to

supervise the provision of health benefits and to set standards, rules, and regulations necessary to ensure quality of care, appropriate utilization of services, fund viability, among others.6

Given the above, the inspection and monitoring of the hospital’s logbooks and patient records may be necessary in the exercise of Philhealth’s regulatory mandate. The information necessary for such mandate is outside of the scope of the DPA but only to the minimum extent necessary to achieve Philhealth’s purpose, i.e. fraud prevention.

General Data Privacy Principles; Security Measures; Non-Disclosure Agreement; Data Sharing Agreement

Although Philhealth is allowed to process personal data pursuant to its mandate, as a personal information controller, it is still subject to the requirements of implementing security measures to protect personal data, adhering to the general data privacy principles of transparency, legitimate purpose and proportionality, and upholding data subjects’ rights.

While we are not privy to the provisions of the NDA of the hospital, we understand that this is part of its organizational security measures. With this, Philhealth and its authorized representatives are not prohibited from signing an NDA which ensures the confidentiality of the patients’ personal data as between the hospital and Philhealth.

As to whether or not Philhealth is exempt from entering into a data sharing agreement, NPC Circular No. 2016-02 provides that nothing in the Circular shall be construed as prohibiting or limiting the sharing or transfer of any personal data that is already authorized or required by law.7

For this purpose, we understand that there is already a Philhealth issuance on the matter – Philhealth Circular No. 013 – 2015 (Revisions in the Performance Commitment for Health Care Institutions and Professionals).8 You quoted the 2018 version of the Performance Commitment form, specifically Item E (35), to wit:

E. REGULAR SURVEYS/ADMINISTRATIVE INVESTIGATIONS/ DOMICILIARY VISITATIONS ON THE CONDUCT OF OPERATIONS IN THE EXERCISE OF THE PRIVILEGE OF ACCREDITATION

  1. That we shall extend full cooperation with duly recognized authorities of PhilHealth and any other authorized personnel and instrumentalities to provide access to patient records and submit to any orderly assessment conducted by PhilHealth relative to any findings, adverse reports, pattern of utilization and/or any other acts indicative of any illegal, irregular and/or unethical practices in our operations as an accredited HCI of the NHIP that may be prejudicial or tends to undermine the NHIP and make available all pertinent official records and documents including the provision of copies thereof; provided that our rights to private ownership and privacy are respected at all times.

Thus, the existing transfers or submissions of personal data from the hospitals to Philhealth is already authorized or required by this circular and commitment form, and thus, Philhealth is

not constrained or compelled into signing any NDAs nor DSAs.

Nonetheless, the DPA, its IRR, and issuances of the NPC do not prohibit Philhealth from entering into a separate DSA or a similar agreement with any hospital under its supervision, as may be necessary and appropriate in certain circumstances, i.e. in order to document other terms and conditions of the sharing or transfer arrangement which is not reflected in the current Philhealth issuance.

This opinion is based on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.

For your reference.

Very truly yours,

(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

Footnotes

  1. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩

  2. An Act Protecting the Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 (2012). ↩

  3. Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, § 5 (d) and last ¶ (2016). ↩

  4. See generally: National Privacy Commission, NPC Advisory Opinion No. 2018-079 (Oct. 23, 2018). ↩

  5. An Act Amending Republic Act No. 7875, Otherwise Known as the “National Health Insurance Act of 1995”, As Amended, And for Other Purposes [National Health Insurance Act of 2013], Republic Act No. 10606, § 10 (2013). ↩

  6. Id. ↩

  7. National Privacy Commission, Data Sharing Agreements Involving Government Agencies, Circular No. 16-02 [NPC Circular 16-02], § 1 (October 10, 2016). ↩

  8. Philippine Health Insurance Corporation, Revisions in the Performance Commitment for Health Care Institutions and Professionals, Philhealth Circular No. 013 – 2015 [Circular No. 013-2015] (June 15, 2015). ↩

Backlinks

  • No backlinks found