NPC PHE BULLETIN No. 7: Official Statement of the National Privacy Commission on Calls for Patients to Waive Privacy Rights, Publicly Disclose Health Status
Amid the public health crisis, we have been hearing calls from certain quarters for patients to temporarily set aside their data privacy rights, as though doing so makes for a robust weapon in overcoming this pandemic. In this war that is testing our humanity and values, it should be emphasized that protecting privacy rights is tantamount to protecting lives.
The Data Privacy Act of 2012 (DPA) is not a hindrance to the COVID-19 response. There are enough provisions in the law to allow contact tracing, treating patients, and addressing threats while guaranteeing the privacy that COVID-19 positive patients, persons under investigation (PUIs), and persons under monitoring (PUMs) expect.
Republic Act No. 11332 (An Act Providing Policies and Prescribing Procedures on Surveillance and Response to Notifiable Diseases, Epidemics, and Health Events of Public Health Concern) mandates patients, PUIs, and PUMs to be fully transparent and truthful to the Department of Health (DOH), our hospitals, and other pertinent public authority on the personal data (travel and medical history, etc.) requested from them. Such information will be material for health and local institutions to treat them and/or properly contain the spread of the infectious disease in a timely manner.
Where they may falter in cooperation, as when they refuse to provide details or conceal required information, patients can be penalized with imprisonment and hefty fines under RA 11332.
In addition, the DOH has set management protocols requiring every health institution to triage patients in emergency rooms according to their conditions. These protocols are in place and designed to keep our health workers safe.
On sharing with other authorized public authorities, the DOH may do so subject to the limitations that the sharing is (a) pursuant to a public function or a public service, (b) based on the constitutional or statutory mandate of the DOH and/or the other public authorities, (c) strictly following set protocols and processes, (d) ensuring the security of such shared information, and (e) upholding data subjects’ rights.
With respect to sharing medical information of individuals to private health institutions, the Health department would be in the best position to determine if such is consistent with the provisions of RA 11332 and other applicable protocols in a pandemic.
The joint plea of the Integrated Bar of the Philippines, Philippine Medical Association and Philippine College of Surgeons quoted a recent bulletin of the National Privacy Commission (NPC). We clarify that the statement was made in connection with our appeal for the release only of “trusted and verified information,” especially during an “unfamiliar global pandemic.” It was never meant to support any request for the voluntary waiver by COVID-19 patients, PUIs and PUMs of the confidentiality of their medical condition.
We remain firm in our stand that authorities and institutions should collect only what is necessary and share information only to the proper authority.
On the call for patients, PUIs and PUMs to share or consent to the sharing of personal data to the general public for contact tracing, we affirm our stand that doing so may not be as helpful to contact tracing interventions as this can only induce fear among these individuals given the multiple reports now on physical assaults, harassments, and discrimination endured by patients, PUIs, PUMs, and even health workers. These threats to their safety and security may discourage them to report their symptoms to public authorities, take confirmatory tests, and submit to treatments.
If a patient, PUI, or PUM himself or herself would want to disclose such information, as what some public figures have done, that is their personal choice.
On seeking consent, the DPA requires consent to be freely given, specific, and an informed indication of will that they indeed agree to the public disclosure. Informed consent requires that these patients, PUIs, or PUMs have been made aware of the risks that may arise from the disclosure, including the risk of being subjected to violent physical attacks as some COVID positive patients and their family members have experienced according to news reports.
To conclude, we want to reiterate that even in times of calamity or a state of a public health emergency, rules on patient privacy, the confidentiality of health records, medical ethics, and data subjects' rights remain in effect and upholding them equate to protecting lives.
# # #
