NPC 21-357: Sps. NSP and EOP vs. PSHCI

Source

Reference: NPC 21-357
Official PDF: http://privacy.gov.ph/wp-content/uploads/2026/05/NPC-21-357-Sps.-NSP-and-EOP-vs.-PSHCI.pdf
Source page: http://privacy.gov.ph/resolutions/
Issue date: July 3, 2025
Source PDF timestamp: Mon, 18 May 2026 07:56:11 GMT
Pages: 8

Resolution Text

SPS. NSP AND EOP,

Complainant,

-versus-

PSHCI,

Respondents.

NPC 21-357

For: Violation of the Data Privacy Act of 2012

x----------------------------------------------------x

RESOLUTION

DE JESUS, D.P.C.;

Before the Commission is a Motion for Reconsideration filed by PSHCI. (Respondent) on the Decision dated 16 January 2025.

Facts

In the assailed Decision, the Commission found Respondent liable for violation of Section 16(c) in relation to Section 17 of Republic Act No. 10173, or the Data Privacy Act of 2012 (DPA), when it denied Complainants Sps. NSP and EOP (Complainants), their right to access the medical records of their deceased daughter, MAP.¹ The dispositive portion of the above Decision provides:

WHEREFORE, premises considered, this Commission hereby resolves to:

FIND Respondent PSHCI LIABLE for violation of the Complainants Sps. NSP and EOP’s right to access under Section 16(c) in relation to Section 17 of the Data Privacy Act of 2012;

ORDER the Respondent PSHCI to furnish the Complainants the complete medical records of the late MAP from 09 December 2020 until her demise on 17 January 2021 and to SUBMIT proof of compliance to the Compliance and Monitoring Division within fifteen (15) days from receipt of this Decision; and

AWARD nominal damages in the amount of Fifty Thousand Pesos (PhP 50,000.00) and moral damages in the amount of Fifty Thousand Pesos (PhP 50,000.00) to the Complainants for violation of their right to access under Section 16(c) in relation to Section 17 of the DPA.

SO ORDERED.

On 22 April 2025, both Complainants and Respondent received an electronic copy of said Decision through their respective counsels.²

Subsequently, Respondent filed a Motion for Reconsideration on 07 May 2025, reiterating, among others, that Complainants are not entitled to “a complete copy of the daily medical records of the late MAP during her stay” at Respondent’s hospital from 09 December 2020 to 17 January 2021.³

Respondent argues that the medical records of MAP not only contain personal data of the patient, but also “Privilege Communication or conversation or working relationship which takes place between two parties within the context of a protective relationship not only between healthcare provider and a patient but also between healthcare providers, like doctors’ orders addressed to fellow doctors or nurses as defined under the Health Privacy Code Specifying the Joint A.O. No. 2016-0002 otherwise known as ‘Privacy Guidelines for the Implementation of the Philippine Health Information Exchange’.”⁴

Respondent posited that, according to Joint A.O. No. 2016-0002, “the demand for a copy of all the pages of the medical record of the patient without the consent of the other parties involved in the care of the patient is not in order.”⁵

Respondent argues that for the release of, or access to, sensitive personal information and privileged information contained in medical records, all parties to the exchange of information must have given their consent, according to Sec. 13 of the DPA, to wit:⁶

SEC. 13. Sensitive Personal Information and Privileged Information. –

The processing of sensitive personal information and privileged information shall be prohibited, except in the following cases:

(a) The data subject has given his or her consent, specific to the purpose prior to the processing, or in the case of privileged information, all parties to the exchange have given their consent prior to processing;⁷

Lastly, Respondents reiterated that Complainants’ request for medical records “is not the right of reasonable access contemplated under the Data Privacy Act of 2012 and its implementing rules and regulations.”⁸

On 21 May 2025, Complainants, through counsel, filed an Opposition/Comment to the Motion for Reconsideration.⁹

According to the Complainants, Respondent’s motion must be denied as it does not allege or show on its face that it complied with the twin requirements for filing a motion for reconsideration, pursuant to NPC Circular No. 2023-01.¹⁰

Moreover, Complainants stated that the arguments raised in the motion are a mere rehash of the issues already carefully and thoroughly considered by the Commission in the Decision.¹¹

Issue

Whether the Respondent’s Motion for Reconsideration dated 07 May 2025 should be granted.

Discussion

The Commission resolves to deny the Respondent’s Motion for Reconsideration dated 07 May 2025 for lack of merit.

A review of the motion reveals that Respondent merely reiterated its arguments and issues that have already been considered and passed upon by the Commission in the assailed Decision.

Section 10, Rule XIII of the 2021 NPC Rules of Procedure provides that the Rules of Court shall apply in a suppletory character and whenever practicable and convenient.¹²

In line with the above, reference can be made to Section 1, Rule 37 of the Rules of Court, which provides for the grounds for filing a motion for reconsideration, to wit:

Within the same period, the aggrieved party may also move for reconsideration upon the grounds that the damages awarded are excessive, that the evidence is insufficient to justify the decision or final order, or that the decision or final order is contrary to law.¹³

Applying the foregoing provision, in MFS vs. RJJ et.al.,¹⁴ the Commission denied Complainant’s Motion for Reconsideration based on the following explanation:

xxx

Motion for reconsideration must be sufficient in form and in substance

Rule 37, Section 1 of the Rules of Court provides for the grounds for filing a motion for reconsideration, applicable provision to wit:

X X X X X X X X

Within the same period, the aggrieved party may also move for reconsideration upon the grounds that the damages awarded are excessive, that the evidence is insufficient to justify the decision or final order, or that the decision or final order is contrary to law

A motion for reconsideration must satisfy the requirements of Rule 37 of the Rules of Court. A motion for reconsideration that does not comply with those requirements will be treated as pro forma intended merely to delay the proceedings.

In his Motion for Reconsideration, Complainant merely reiterates his arguments and assertions. He enumerates in the said motion his verbal communication dated 27 February 2017 with BPI AB Branch Assistant Manager VA, text message exchange with Complainant MFS’ mother RS and Respondent RJJ, paragraph 23 of the Joint Counter-Affidavit of Respondents and the fact that he is not a depositor of BDO where Respondent SJJ is connected as circumstantial evidence to prove that Respondents committed a violation under the Data Privacy Act of 2012.

These pieces of evidence have already been presented to this Commission and have been considered, weighed, and resolved adversely to him when the Commission rendered its Decision dated 19 March 2018.

xxx

Notably here, the Motion for Reconsideration filed by Respondent presents no new matter or substantial ground that would warrant a reversal or modification of the Decision dated 16 January 2025. The Motion for Reconsideration was a mere repetition of arguments previously passed upon by the Commission in the said Decision.

Furthermore, the Joint A.O. No. 2016-0002 or the Privacy Guidelines for the Implementation of the Philippine Health Information Exchange (PHIE) finds no application in this case.

The Joint A.O. No. 2016-0002 was issued jointly by the Department of Health (DOH), Department of Science and Technology (DOST) and Philippine Health Insurance Corporation (PhilHealth), to provide guidelines on the protection of the privacy of health data and/or information under the health information system among health facilities, health care providers, health information organizations and government agencies under a framework called Philippine Health Information Exchange (PHIE).¹⁵

In other words, the Joint A.O. No. 2016-0002 applies only to the sharing and/or exchange of health information among the DOH, DOST, and PhilHealth, as well as other government organizations through the PHIE platform. Joint A.O. No. 2016-0002 does not in any way curtail any of the rights of a data subject enshrined in the DPA.

Furthermore, paragraphs 2 and 2.1, Rule 2 of Joint A.O. No. 2016-0002 ensures the patient or client’s access to health information, to wit:

xxx

2. Access of Patient or Client.

Consenting patients or clients shall have rights to access on how their health information is used. The health facility shall ensure that disclosures and any subsequent changes are in accordance with the law and are properly documents.

2.1. For Minors.

Either parent or a legal guardian shall have access to the child’s health information. Where legal custody has been granted to only one parent or where the child has no parent, only the parent with legal custody or the person appointed by the court as legal guardian of the minor shall be allowed access to the records.¹⁶

xxx

As such, even assuming that the Joint A.O. No. 2016-0002 applies in this instance, the provisions of the DPA, being a special law, shall prevail in case of conflict or inconsistencies.¹⁷

Considering the foregoing, the assailed Decision dated 16 January 2025 stands.

WHEREFORE, premises considered, the Commission resolves to DENY the Motion for Reconsideration dated 07 May 2025 for lack of merit.

SO ORDERED.

City of Quezon, Philippines.

03 July 2025.

NERISSA N. DE JESUS

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

JOSE AMELITO S. BELARMINO II

Deputy Privacy Commissioner

Copy furnished:

SPOUSES NSP and EOP

Complainants

No. 1 x-1xx , S. V xxxxxx , L xxx -xx , C xxx

[]

Counsel for Complainants

[]

PSHCI

Respondent

[]

Counsel for Respondent

c/o []

[]

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

Decision dated 16 January 2025. ↩
Delivery Receipt dated 22 April 2025 at 5:00 PM to cxxxxxxx@yxxxx.com; Delivery Receipt dated 22 April 2025 at 5:00 PM to attyxxxx@xxxx.com. ↩
Motion for Reconsideration dated 07 May 2025. ↩
Id. ↩
Id. ↩
Id. ↩
Id. ↩
Id. ↩
Comment/Opposition to Motion for Reconsideration dated 19 May 2025. ↩
Id. ↩
Id. ↩
2021 Rules of Procedure of the National Privacy Commission (as amended). ↩
Section 1, Rule 37, 1997 Rules of Civil Procedure (as amended). ↩
NPC Case No. 17-003, 25 July 2019. ↩
Joint Administrative Order No. 2016-0003, Adoption of the Philippine Health Information Exchange (PHIE) Lite. ↩
Id. ↩
Butuan Sawmill, Inc. v. City of Butuan, No. L-21516, April 29, 1966, 16 SCRA 755. ↩

NPC Issuance Wiki

Corpus