NPC Issuance Wiki

NPC BN 18-062: In re: VRP Medical Center

Issued Resolution

Resolution Text

IN RE: VRP MEDICAL CENTER

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is a breach notification submitted by VRP Medical Center (VRP) involving a falsified official receipt and statement of account.

Facts

On 27 April 2018, VRP received a letter from Metrocare Health Systems Inc. (Metrocare) verifying availments made by BL, a member of Metrocare.1 VRP also received a copy of the Official Receipt (OR) and the Statement of Account (SOA) that BL submitted.2

Upon checking its system, VRP discovered that BL had no transactions with VRP.3 It determined that the OR and SOA submitted by BL to Metrocare belonged to two different patients.4

VRP compared the falsified OR and SOA submitted by BL to the OR and SOA available on its record. VRP emphasized that the details on the falsified OR were handwritten.5 It further stated that while the falsified SOA followed VRP’s standard format and layout for statements of account, a different font type was used.6

VRP stated that “there has been some type of breach over the financial accounts of the real owners of the OR and SOA.”7 VRP stated, however, that it will still investigate the matter after obtaining consent from the involved patients.8

VRP further stated that it would inform Metrocare that BL had no transactions with VRP.9

On 02 May 2018, VRP notified the National Privacy Commission (NPC) of the breach.10

On 13 June 2022, the NPC, through its Complaints and Investigation Division (CID), ordered VRP to submit its full report.11

On 25 July 2022, VRP submitted its full report.12

VRP stated that the possible personal data involved were the patients’ names, IDs, and addresses.13 It explained that these, however, could not be validated because the information was falsified and VRP could not determine the source of the information.14

To address the breach, VRP stated that it took the following measures:

  • Metrocare has been informed that the member has no transactions with VRP Medical Center after this incident is reported to the NPC.
  • All official receipts are being scanned and archived for future references.
  • Issuance of receipts are printed and duly signed on by our respective cashiers (with printed name).
  • All statement of accounts issued to patients are also signed by our clerks.15

Issue

Whether the incident involves a personal data breach that requires mandatory notification under NPC Circular 16-03 (Personal Data Breach Management).

Discussion

The Commission resolves to close the matter. The incident does not involve a personal data breach. Thus, it is not subject to mandatory breach notification under NPC Circular 16-03.

Section 3 (F) of NPC Circular 16-03 defines a personal data breach as follows:

Section 3. Definition of Terms. For the purpose of this Circular, the following terms are defined, as follows:

…

F. “Personal data breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:

  1. An availability breach resulting from loss, accidental or unlawful destruction of personal data;
  2. Integrity breach resulting from alteration of personal data; and/or
  3. A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.16

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access to personal data transmitted, stored, or otherwise processed.17

VRP stated that there may have been a breach over the financial accounts of the real owners of the OR and SOA.18 VRP, however, explained that this could not be validated given that the information on the documents was falsified.19

The evidence presented does not show that BL was able to acquire or access the personal data from the OR and SOA on record.

The OR on record and the falsified OR only shared the same official receipt number.20 Further, as correctly observed by VRP, the details on the falsified OR were handwritten, as opposed to the OR on record wherein the details were typewritten.21 It must also be noted that the falsified OR does not make any reference to the SOA on record. Thus, the evidence is insufficient to show that BL had access to the personal data stated in the OR on record.

With regard to the SOA, while the SOA on record and the falsified SOA involved the same admission number, they used different templates and contained different entries.22 VRP also stressed that the falsified SOA used a different font type.23 Thus, the evidence is likewise insufficient to show that BL had access to the personal data in the SOA on record.

Given that there was no access to personal data, the incident does not involve a personal data breach. There was no accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access to personal data that would require mandatory breach notification.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-062 In re: VRP Medical Center is considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 05 June 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

VRG Data Protection Officer VRP Medical Center

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Initial Report, 02 May 2018, at 1, in In re: VRP Medical Center, NPC BN 18-062 (NPC 2018). ↩

  2. Id. ↩

  3. Id. at 2. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Initial Report, 02 May 2018, at 2, in In re: VRP Medical Center, NPC BN 18-062 (NPC 2018). ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Order (To submit Full Breach Report), 13 June 2022, at 1 in In re: VRP Medical Center, NPC BN 18-062 (NPC 2022). ↩

  12. Full Report, 25 July 2022, in In re: VRP Medical Center, NPC BN 18-062 (NPC 2022). ↩

  13. Id. at 1. ↩

  14. Id. ↩

  15. Id. ↩

  16. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 (NPC Circ. No. 16-03), § 3 (F) (15 December 2016). ↩

  17. Id. ↩

  18. Full Report, 25 July 2022, Annex 2, in In re: VRP Medical Center, NPC BN 18-062 (NPC 2022). ↩

  19. Id. at 1. ↩

  20. Initial Report, 02 May 2018, at 2, in In re: VRP Medical Center, NPC BN 18-062 (NPC 2018). ↩

  21. Id. ↩

  22. Id. Annexes 2-3. ↩

  23. Id. at 2. ↩

Backlinks

  • No backlinks found