Text
15 February 2022
RE: DISCLOSURE OF INCAPACITATED PATIENTS AND DECEASED PATIENTS’ MEDICAL INFORMATION
Dear [Redacted],
We write in response to your request for an Advisory Opinion received by the National Privacy Commission (NPC) to provide guidance on the disclosure of the medical information of incapacitated patients and deceased patients.
We understand from your letter that St. Luke’s Medical Center (SLMC), in providing medical and healthcare services, encounters cases wherein a patient is unconscious or otherwise unable to give consent. Furthermore, you provided that SLMC is faced with issues whenever the said patient’s relatives, other than his or her spouse, common-law spouse or child who is already transacting with SLMC, ask for updates about the patient’s medical condition and request for the medical records of the patient.
You now seek guidance and clarification on the relatives who can give consent on behalf of the patient in the above scenario. Specifically, you asked the following:
-
Who has the right to receive (i) medical documents; and (ii) status updates regarding an incapacitated patient?
a. Can any heir or relative of the patient request for medical documents and status updates from the hospital? b. Can other relatives be excluded by next-of-kin from receiving medical documents and status updates? c. Who should be our default recipient of medical documents and status updates?
-
In case relatives disagree on the issue of disclosing the status of patient’s medical condition and documents, what is the hierarchy on knowing who to follow?
a. Do we follow the spouse first, then children, then parents? What if the spouse and the children disagree? b. For children of legal age who disagree on a decision of sharing medical condition and documents of the patient, do we follow the eldest or do we put it to a vote? Do we have the obligation to reach out to absent children of legal age?
-
Do we have the obligation to search for an absent next-of-kin to give status updates?
-
Will the answers to queries above change if the patient expires? Does the existence of legal heirs exclude other relatives from securing medical documents from the hospital (e.g., a parent requesting medical records of a deceased son/daughter who has predeceased his or her spouse and children)?
Discussion
Rights of data subjects; right to access; transmissibility of rights
Data subjects are entitled to various rights under the Data Privacy Act of 20121 (DPA) and its Implementing Rules and Regulations2 (IRR). One of the rights granted is the right of reasonable access to, upon demand, the contents of one’s personal data that have been processed, among other information relating to the processing of his or her personal information and sensitive personal information (collectively, personal data).3
This right to access, however, may be limited in certain instances. In the current scenario, the following provision of NPC Advisory No. 2021-01 on Data Subject Rights may be taken into consideration:
“SECTION 8. Right to Access. — x x x
C. The following instances, where applicable, may limit the right to access: x x x
- Consideration of the safety of the data subject. In exceptional cases and subject to any applicable ethical guidelines, limitations on the right to access may apply if in the professional evaluation and determination of the PIC, providing access to the requested information may cause serious harm to the physical, mental, or emotional health of the data subject.”4
Otherwise, the personal information controller (PIC) is obliged to grant the request of the data subject.
The right to access, along with the other rights of data subjects, must be read together with Section 17 of the DPA on transmissibility of rights. The provision states that the lawful heirs and assigns of the data subject may invoke the rights of the data subject for which he or she is an heir or assignee at any time after the death of the data subject or when the data subject is incapacitated or incapable of exercising the rights under the DPA.5
Please take note that the DPA does not distinguish nor identify the persons considered to be the “lawful heirs and assigns of the data subject”. Hence, the determination of such matter may be guided by the general laws on the hierarchy of legal heirs provided under several provisions of the Civil Code of the Philippines on the laws of succession and the rules on guardianship of incompetent persons.
Incapacitated and deceased data subjects; legal heirs and assigns
As to the determination of the heir or relative who has the right to receive medical documents and status updates of an incapacitated patient, we reiterate that the DPA does not distinguish the legal heirs and assigns of an incapacitated data subject. The DPA may not be the appropriate law to be used as basis under this circumstance. With this, reference may be made to the general laws on the hierarchy of heirs and legal assigns identified under various provisions of the Civil Code or the rules on guardianship over incompetent persons6 under the Rules of Court on Special Proceedings,7 whichever may be applicable to the particular scenario and subject further to such other laws, regulations, and guidelines as may be applicable.
We note that this does not preclude SLMC, as a PIC, from crafting policies on the classification of relatives, the exclusion of other types of relatives and the designation of a default relative who may receive medical documents and status updates. Likewise, due regard must be given to ethical guidelines that may apply.
The above shall also apply in case of disagreement among relatives on the issue of disclosing the status of a patient’s medical condition. To reiterate, SLMC may refer to the hierarchy of heirs provided by the Civil Code on the laws of succession or the rules of guardianship over incompetent persons under the Rules of Court on Special Proceedings, whichever may be applicable, in the crafting of its policies on the disclosure of a patient’s medical condition and records.
With regard to SLMC’s obligation to search for an absent next-of-kin, the DPA does not require PICs to do this. The NPC is also not privy to any laws or regulations which require healthcare providers to exhaust all means to search for an absentee next-of-kin. As far as the DPA is concerned, an incapacitated data subject still has the right to exercise his or her rights under the law through a legal heir or assign. If an incapacitated person does not have any other heir to whom status updates may be provided, SLMC may consider searching for the said heir through reasonable efforts.
Lastly, as to the applicability of the above discussions to deceased patients, we wish to reiterate our position. The rights of deceased data subjects, similar to incapacitated data subjects, can still be exercised through the transmissibility of rights under Section 17 of the DPA. Similarly, the DPA does not distinguish on whether a different set of rules and procedure would apply to deceased and incapacitated data subjects. The DPA may not be the appropriate law for this circumstance, and accordingly, SLMC may refer to the laws on succession, and the laws on testate succession in case the deceased left a will and designated a person to attend to his or her medical records. Moreover, it may be more appropriate to refer to the said law with regard to the strict application of the rules on the exclusion of other relatives.
We emphasize that, as far as the DPA is concerned, the rights of data subjects including those who are deceased, incapacitated or otherwise incapable of exercising such rights, are respected. Although, the DPA does not distinguish the groups of relatives who may exercise the same, the rights of the deceased or incapacitated data subjects are still existent and may be exercised by his or her lawful heirs and assigns, subject to existing laws on succession and guardianship, whichever may be applicable. The foregoing laws referred to above may be considered, guided by applicable rules and ethical guidelines and considerations that the health sector is subject to.
It is the responsibility of the PIC to establish policies on addressing issues on disclosures to relatives, subject to the applicable laws and rules. SLMC must still implement appropriate and reasonable security measures in the disclosure of medical information to legal heirs and assigns. For example, SLMC may implement policies on properly identifying the heirs of deceased and incapacitated patients by requiring the presentation of certain documents to prove their identities. Further, the fact of disclosure to the heir must be documented (i.e., the heir may be asked to sign certain documents to record such disclosure). In the establishment of these policies, SLMC should also consider the inclusion of policies and mechanisms on ensuring that the requesting party, acting on behalf of the data subject, is clearly informed of the reason in case of the limitation or denial of the request, as required under Section 14 of NPC Advisory No. 2021-01.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) IVY GRACE T. VILLASOTO OIC – Director IV, Privacy Policy Office
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173 (2016). ↩
-
Data Privacy Act of 2012, § 16 (c) (2012). ↩
-
National Privacy Commission, Data Subject Rights NPC Advisory No. 2021-01, § 8 (c) (4) (29 Jan 2021). ↩
-
SPECIAL PROCEEDINGS, Rule 92, § 2. ↩
-
Id., Rule 93, § 1. ↩