Text
11 February 2022
Re: PHILHEALTH’S PUBLICATION OF THE LIST OF HEALTH CARE PROVIDERS WITH DENIED OR RETURN-TO-HOSPITAL CLAIMS
Dear [Redacted],
We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) seeking clarification on whether the publication of the list of health care facilities with denied or return-to-hospital (RTH) claims, including the reasons thereof, violates the provisions of the Data Privacy Act of 20121 (DPA), its Implementing Rules and Regulations2 (IRR) and other issuances of the NPC.
You stated in your letter that the Philippine Health Insurance Corporation (PhilHealth), in the interest of transparency and right to information of the public, is considering the publication of the abovementioned list. The proposed publication emanated from allegations that the PhilHealth still owes certain amounts of money when, upon verification, most of such pending claims were actually denied or RTH claims.
Claims are denied when the same are violative of existing PhilHealth laws, rules and regulations (e.g., fraudulent claims, medical condition or procedure is not compensable under the All Case Rate policy or filed beyond the prescribed period) or returned to health care facilities for correction of deficiencies (e.g., incomplete attachments, improperly filled out claim forms) and to be refiled once corrected.
We further understand from your letter that the PhilHealth is mandated to establish a mechanism for feedback aimed at improving the quality of service and to periodically inform the public of the performance of accredited health care providers, including accreditation that has been suspended or revoked by PhilHealth.3
You now ask whether such publication is allowed under the DPA.
Discussion
Scope of the DPA; health care providers
The DPA applies to the processing of all types of personal information and sensitive personal information (collectively, personal data) and to any natural or juridical person involved in the processing of personal data.4
This means that the scope of the DPA, with regard to the subject matter, is limited only to the processing of personal data or data pertaining to natural persons or individuals. Data pertaining to juridical entities (e.g., company name, address, financial information, etc.) are not covered by the DPA.
With this, we refer to the definition of health care institution under the revised IRR of the National Health Insurance Act of 2013, as amended:
Health Care Institution — refers to health facilities that are accredited with Philhealth which includes, among others, hospitals, ambulatory surgical clinics, TB-DOTS, freestanding dialysis clinics, primary care benefits facilities, and maternity care package providers.5
From the foregoing, health care institutions are therefore juridical persons. We wish to clarify that publications involving the details of juridical entities, do not fall within the ambit of the DPA. We emphasize that the DPA is only limited to the processing of personal data or information of natural persons.6
We wish to clarify further that should the terms “health care institution” or “health care facility” include health care professionals who are natural persons and there will be publications involving the details of the said natural persons, the provisions of the DPA shall apply.7
Lawful processing; legal obligation; functions of public authority; law or regulation
In case the publication will involve personal data as discussed above, such processing by PhilHealth may be based on the applicable criterion under Sections 12 or 13 of the DPA, for the processing of personal information and sensitive personal information, respectively.
Specifically, Section 12 (c) and (e) or Section 13 (b) may be applicable:
SECTION 12. Criteria for Lawful Processing of Personal Information. — The processing of personal information shall be permitted only if not otherwise prohibited by law, and when at least one of the following conditions exists: x x x
(c) The processing is necessary for compliance with a legal obligation to which the personal information controller is subject; x x x
(e) The processing is necessary in order to respond to national emergency, to comply with the requirements of public order and safety, or to fulfill functions of public authority which necessarily includes the processing of personal data for the fulfillment of its mandate; or x x x
SECTION 13. Sensitive Personal Information and Privileged Information. — The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases: x x x
(b) The processing of the same is provided for by existing laws and regulations: x x x.
The above is read in relation to the IRR of Republic Act (RA) No. 7875, as amended, otherwise known as the National Health Insurance Act of 2013, which mandates PhilHealth to establish a mechanism for feedback to inform the public about the performance of accredited health care providers, to wit:
SECTION 79. Mechanism for Feedback. — A mechanism aimed at improving quality of service shall be established by the Corporation to periodically inform health care providers, program administrators and the public of the performance of accredited health care providers. The Corporation shall make known to the general public information on the performance of accredited health care providers, including the release of names of those of good standing as well as those whose accreditation has been suspended or revoked by the Corporation.
In pursuit of informed choice as enunciated in the Act, feedback reports shall include information on the amount reimbursed by the Corporation vis-a-vis the actual charges billed by the accredited health care provider.8
The publication of personal data may be allowed since such processing is necessary for PhilHealth’s compliance with its legal obligation, as the agency tasked to implement universal health coverage in the country, to inform the public about the performance of accredited health care providers which includes those with denied or RTH claims. The publication of personal data is also in recognition of PhilHealth’s fulfillment of its mandate under the revised IRR of the National Health Insurance Act of 2013 to provide a mechanism for feedback to improve the quality of service.
General data privacy principles; proportionality; sensitive personal information; anonymization
But as a personal information controller (PIC), PhilHealth must still adhere to the general data privacy principles of transparency, legitimate purpose, and proportionality.9 Specific to the principle of transparency, PhilHealth should ensure that the health care providers involved are informed about the details of this type of processing (i.e., publication of the list of health care providers with denied or RTH claims).
This may be achieved through a privacy notice that will explain the purpose for posting the list (i.e., to periodically inform health care providers, program administrators and the public of the performance of accredited health care providers). The privacy notice should also state the means for the data subjects to correct any inaccurate information and other details upon posting of the initial list which will help them exercise their rights under the DPA.
For proportionality, this requires that the processing of personal data shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.10 In this regard, PhilHealth should consider indicating a specific period in its publication (e.g., “as of December 2021”) to ensure its accuracy.
Philhealth must assess what particular personal data should be published in relation to its purpose of informing the general public about health care providers with denied and RTH claims.
Sensitive personal information of doctors, nurses, midwives, dentists, pharmacists or other health care professionals or practitioners such as their license numbers, other government-issued identification numbers, marital status, date of birth, among others, should not be published as these may already be deemed irrelevant to the declared and specified purpose. From Philhealth’s 15 December 2021 letter, we note that the purpose for the publication or processing of personal data is to inform the public about health care providers with denied or RTH claims. This purpose can be achieved by processing only the necessary personal information (i.e., posting the list of names of health care professionals) since the names would already identify the parties concerned. Publication of the above sensitive personal information would be excessive in relation to such purpose.
Lastly, we note that the reasons for the denied or RTH claims will also be published. Philhealth must ensure that no personal data of patients shall be included in the publication. The general reasons as stated by Philhealth, e.g., fraudulent claims, medical condition or procedure is not compensable under the All Case Rate policy, filed beyond the prescribed period, should already suffice. Any other detailed disclosure of the reasons behind why certain claims are denied or returned are only relevant and necessary for the information of the health care facilities only and not the public.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Rules and Regulations Implementing the National Health Insurance Act of 2013, Republic Act No. 7875 as amended, § 79 (2004). ↩
-
Rules and Regulations Implementing the National Health Insurance Act of 2013, as amended, § 3 (w). ↩
-
Data Privacy Act of 2012, § 4 in relation to § 3 (g) and 3 (l). ↩
-
Ibid. ↩
-
Id. § 79. ↩