Health Privacy Code Specifying the Joint A.O. No.

2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Guided by the Philippine eHealth Strategic Framework and Plan, one of the identified eHealth
Project is the implementation of the Philippine Health Information Exchange (PHIE). The PHIE
is the first major collaborative and convergence endeavor of the Health Cluster, and represents
the initial step towards the realization of the National eHealth vision.

The PHIE will enable electronic transmission of healthcare-related data among health facilities,
health care providers, health information organizations and government agencies, in accordance
DEPARTMENT OF HEALTH with national standards. It will allow different applications to exchange data with each other
DEPARTMENT OF SCIENCE AND TECHNOLOGY without loss of semantics and will enable health facilities particularly rural health units, health
PHILIPPINE HEALTH INSURANCE CORPORATION centers, hospitals, DOH and PhilHealth to communicate with each other effectively and to
collaborate with the health care providers in the care of the patients. The development and
HEALTH PRIVACY CODE IMPLEMENTING THE JOINT implementation of the PHIE will enable a patient’s medical or health information to follow the
ADMINISTRATIVE ORDER NO. 2016-0002 “PRIVACY GUIDELINES patient wherever health care services are provided. Health care providers will be able to
exchange patient’s medical or health information securely to improve health care delivery and
FOR THE IMPLEMENTATION OF THE PHILIPPINE HEALTH
decision making.
INFORMATION EXCHANGE”.
2. Title.
WHEREAS, Joint Administrative Order No. 2016-0002 entitled “PRIVACY
GUIDELINES FOR THE IMPLEMENTATION OF THE PHILIPPINE HEALTH This shall be known and cited as the Health Privacy Code of Joint Administrative Order No.
INFORMATION EXCHANGE” was approved on January 20, 2016 and took 2016-0002, otherwise known as “Privacy Guidelines for the Implementation of the Philippine
Health Information Exchange” (Code).
effect on _____, _____ days after its complete publication in a major newspaper of
national circulation in the Philippines, implementing Republic Act No. 10173 also 3. Purpose.
known as the Data Privacy Act of 2012.
This Code is hereby promulgated to prescribe the procedures and guidelines that ensure the
NOW THEREFORE, the following rules are hereby promulgated: protection of the privacy of a patient.

4. Scope of Application.

Part 1: Preliminary This code shall apply to the PHIE system, Health Facilities, Health Care Providers, and any
natural or juridical person involved in the processing of health information within the PHIE
1. Introduction. framework.

Pursuant to the state policy enshrined in the Constitution to provide quality health care to the 5. Definition of Terms.
Filipino people while protecting and promoting the right to privacy, the Department of Health
(DOH), in cooperation with the Department of Science and Technology (DOST), Philippine Access Instruction to, communication with, storing data in, or retrieving data
Health Insurance Corporation (PhilHealth), University of the Philippines-Manila (UPM) and the from, a computer system or communication network, or any process
Commission on Higher Education (CHED), established the National eHealth Program (NeHP) or operation that makes use of any resources of such system or
that envisions widespread information-technology (IT)-enabled health services by 2020. network.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Addressable Flexible specifications allowing the health facility or health care 2012.
provider to perform one of the following actions: Data Processor In relation to personal data, means any person (other than an
a) Implement the addressable implementation specification; employee of the data controller) who processes the data on behalf of
b) Implement one or more alternative security measures to the data controller.
accomplish the same purpose; or Data Sharing The disclosure or transfer to a third party of personal data under the
c) Not implement either an addressable implementation custody of a personal information controller or personal information
specification or an alternative. processor. In the case of the latter, such disclosure or transfer must
Alteration Modification or change, in form or substance, of an existing have been upon the instructions of the personal information
computer data or program. controller concerned. The term excludes outsourcing, or the
Authentication Process of verifying that an individual, entity or software program disclosure or transfer of personal data by a personal information
accessing the PHIE is the authorized user the individual, entity or controller to a personal information processor.
program claims to be. Decryption Process of transforming data rendered unreadable by encryption back
Authorization Process that determines whether a user has the right to access the to its unencrypted form.
PHIE and establishes the privileges associated with such access. De-identification Removal of identifiers to protect against inappropriate disclosure of
Breach The unauthorized or impermissible acquisition, access, use, or personal data.
disclosure of information and can be in the context of the patient Digital Signature A specific type of electronic signature based on public-key
and/or institutions. cryptography, which is used within a framework known as public-
Cache A special high-speed storage mechanism which cans either be a key infrastructure.
reserved section of the main memory or an independent high-speed Discharge The release of a patient from a healthcare provider’s care, and
storage device. usually refers to the date when a patient checks out of a health
Caching The process of storing data in a cache. facility or hospital.
Computing and Related Computer network, as well as, telecommunications and peripheral Electronic Medical A medical or health record which is received, recorded, transmitted,
equipment equipment that support the data processing activities of Record stored, processed, retrieved or produced electronically through a
organizations. computer or any other electronic device.
Confidentiality A duty to protect personal data against unauthorized disclosure. Electronic Signature Any representation in electronic form that can be used to express
Consent Any freely-given, specific, informed indication of will, whereby an intent, including a printed name at the bottom of an e-mail, a
individual agrees to the collection and processing of personal digitized copy of a handwritten signature, a biometric mark, a sound,
information relating to him or her. Consent shall be evidenced by or digital structure.
written, electronic or recorded means. It may also be given on behalf Emergency Unforeseen combination of circumstances that calls for immediate
of the individual by a lawful guardian or an agent specifically life-preserving or quality-of-life preserving actions (e.g., to preserve
authorized by the individual to do so. sight in one or both eyes, hearing in one or both ears, extremities at
Data Subject An individual whose personal, sensitive personal, or privileged or above the ankle or wrist).
information is processed. Encryption The use of an algorithmic process to transform data into another form
Data Processing System The structure and procedure by which personal data is collected and such that there is a low probability of assigning meaning thereto
further processed in an information and communications system or without use of a confidential process or key.
relevant filing system, including the purpose and intended output of Health Care A public or private entity that performs any of the following
the processing; Clearinghouse functions:
Data Protection Officer An individual who is accountable for ensuring compliance with (1) Processes or facilitates the processing of health information
applicable laws and regulations relating to data privacy and security. received from another entity in a nonstandard format or containing
Data Privacy Act or DPA Republic Act No. 10173, also known as the Data Privacy Act of nonstandard data into standard data elements or a standard
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

transaction. Interception Listening to, recording, monitoring or surveillance of the content of

(2) Receives a standard transaction from another entity and processes communications, including procuring the content data, either
or facilitates the processing of health information into nonstandard directly, through access and use of a computer system or indirectly,
format or nonstandard data content for the receiving entity. through the use of electronic eavesdropping or tapping devices, at the
same time that the communication is occurring.
It may include a billing service, repricing company, community Interpersonal Violence Violence that occurs between family members, intimate partners,
health management information system or community health friends, acquaintances and strangers, and includes child
information system, or any other “value-added” networks and maltreatment, youth violence, sexual violence and elder abuse.
switches. Medical Privacy or Right to the protection of a person’s health information, which
Health Care Provider A health care institution devoted primarily to the management, Health Privacy includes personal data, information about a patient’s condition as
treatment and care of patients, or a health care professional, who is contained in medical records, and communications between
any doctor of medicine, nurse, midwife, dentist, or other health care healthcare provider and a patient.
practitioner. Medical Record or Primary repository of information concerning patient healthcare,
Health Data Warehouse A repository of the country’s de-identified health information within Health Record which consists of a compilation of pertinent facts regarding a
the framework of the Philippine Health Information Exchange. patient’s life history including past and present illnesses and
Health Facility treatments entered by a health professional contributing to the
Health Information Personal information and sensitive personal information that relates patient’s care.
to an individual’s past, present or future physical or mental health National Privacy An independent government agency created under the DPA to
condition, including demographic data, diagnosis and management, Commission or NPC administer and implement the provisions of the law, and to monitor
medication history, health financing record, cost of services and any and ensure compliance of the Philippines with international standards
other information related to an individual’s total well-being. For set for data protection.
purpose of A.O. 2016-0002, health information refers to personal Outpatient A patient who receives medical care or healthcare services without
health information which is individually identifiable information or being admitted and does not occupy a bed for any length of time. It
de-identified health information. may also refer to a patient who consults and receives healthcare
Information and Hardware, software, firmware of computers, telecommunications and services in the healthcare facility without being admitted.
Communication network equipment or other electronic information handling systems Participating Health Care Health care providers whose application to participate in the PHIE is
Technology (ICT) and associated equipment. Provider (PHCP) approved in accordance with Joint DOH-DOST-PhilHealth A.O.
systems 2016-0001 (Implementation of the PHIE), and any other procedure
Individually Identifiable Refers to information that contains data that an directly identify the that may be promulgated by the DOH for participation.
individual or could reasonably be used to identify an individual. Patient or Client A person availing of medical consultation, diagnostic examinations,
Information System Application, service, information technology asset, or any other treatment or health care services from a health care provider.
information handling component. Patient Registry Organization and processes supporting a patient register
Infrastructure Facilities and equipment that enable the ICT service, including but Patient Register A set of patient records systematized around a particular disease,
not limited to power supply, telecommunications connections and condition or exposure, and serving “one or more predetermined
environmental controls. scientific, clinical or policy purposes”.
Inpatient A patient admitted to a health facility or hospital to receive Personal Information Any information whether recorded in a material form or not, from
healthcare services, including room, board and continuous nursing which the identity of an individual is apparent or can be reasonable
services in a unit area of the facility. and directly ascertained by the entity holding the information, or
Issuances Official write-up or documentation of statements, notices, when put together with other information would directly and
announcements, and communications. certainly identify an individual
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Personal Data Breach A breach of security leading to the accidental or unlawful incidents or permanent long-term disability.
destruction, loss, alteration, unauthorized disclosure of, or access to, Required Specifications that must be implemented.
personal data transmitted, stored, or otherwise processed. Security The organization, technical and physical measures to ensure the
Personal Information A person or organization that controls the collection, holding, safety and protection of the health information.
Controller processing or use of personal information, including a person or Security Incident An event or occurrence that affects or tends to affect data protection,
organization that instructs another person or organization to collect, or may compromise the availability, integrity and confidentiality of
hold, process, use, transfer or disclose personal information on his or personal data. It includes incidents that would result to a personal
her behalf. data breach, if not for safeguards that have been put in place.
Sensitive Personal Personal information:
This term excludes: Information
(a) A person or organization who performs such functions as (a) About an individual’s race, ethnic origin, marital status, age,
instructed by another person or organization; and color, and religious, philosophical or political affiliations;
(b) An individual who collects, holds, processes or uses personal (b) About an individual’s health, education, genetic or sexual life of a
information in connection with the individual’s personal, family or person, or to any proceeding for any offense committed or alleged to
household affairs. have been committed by such person, the disposal of such
Personal Information Any natural or juridical person or any other body to whom a personal proceedings, or the sentence of any court in such proceedings;
Processor information controller may outsource or instruct the processing of (c) Issued by government agencies peculiar to an individual which
personal data pertaining to a data subject. includes but not limited to, social security numbers, previous or
Privacy The right of a person to be free from intrusion or disturbance in one’s current health records, licenses or its denials, suspension or
personal and intimate life or affairs. It includes data privacy, which revocation, and tax returns;
refers to the right of an individual not to have his or her personal data (d) Specifically established by an executive order or an act of
disclosed using the ability to control what personal data is disclosed, Congress to be kept classified.
with whom, and for what purpose. Sharing The process that allows the PHCP to access a patient’s health
Privilege Conversation or working relationship which takes place between two information from the framework.
Communication parties within the context of a protective relationship such as Shared Health Record An operational, real-time, transactional data source that serves as a
between healthcare provider and a patient. means for allowing different services to share health information
Processing Any operation performed upon personal information including, but stored in a centralized data repository. It contains a subset of
not limited to, the collection, recording, organization, storage, normalized data for a patient from various systems such as but not
updating or modification, retrieval, consultation, use, consolidation, limited to, Electronic Medical Record (EMR).
blocking, erasure or destruction of data. Social Media Electronic communication, websites or applications through which
Publication The act or process of producing a book, magazine, etc., and users connect, interact, or share information or other content with
thereafter making it available to the public. other individuals who collectively form part of an online community.
Public Health All organized measures to prevent disease, promote health, and This includes Facebook, Twitter, Google+, Instagram, LinkedIn,
prolong life across the population. Its activities aim to provide Pinterest, Blogs, and other Social Networking Sites.
conditions in which people can be healthy. They focus on entire Third Party Any person, entity or institution other than the patient, healthcare
populations, not on individual patients or diseases. provider or health facility, or any other duly authorized personal
Public Health An occurrence or imminent threat of an illness or health condition, information processor or person desiring to have access to patient’s
Emergency cause by bio terrorism, epidemic or pandemic disease, or a novel and health information (i.e. HMOs, researchers, among others).
highly fatal infectious agent or biological toxin, that poses a
substantial risk of a significant number of human facilities or
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Part 2: Health Information Privacy Rules 1.5. The Consent Form.

The standard “Consent for Participation to PHIE” shall be used by participating health care
providers.
Rule 1
Collection and Processing of Health Information 1.6. Valid formats of consent.
Consent can either be in written, recorded, and/or in electronic form. It must be signed by the
1. Consent. patient, guardian, or authorized representative, in accordance with this code. If a patient is
The consent shall conform to the requirements or characteristics of a valid informed consent incapable of affixing his or her signature, a finger print, thumb mark, electronic signature, or
which consist of the following: other biometrics may be considered, provided that a witness of legal age and sound mind is
A. Competence- of sound mind, at least 18 years old, and not under the influence of drugs or present.
liquor;
B. Amount and Accuracy of Information- Relevant factual data about a procedure and/or 1.7. Revocation and Reinstating Consent.
treatments, its benefits, risks, and possible complications or outcomes; Where consent was previously given by an authorized representative on behalf of an unconscious
C. Patient Understanding- Education, language or dialect; or otherwise incapacitated patient, such consent may be subsequently revoked by the latter once
D. Voluntariness- Make an autonomous decision without force or intimidation, and he or she recovers consciousness or regains the capacity to give consent.
understands that he/she can withdraw consent anytime without consequence;
1.8. Exemptions for Consent.
1.1. For Persons with Disabilities (PWDs). Consent shall not be required for the processing of personal data in the PHIE under the following
Use of appropriate means of communication such as verbal or sign language. conditions:
(a) For purpose of medical treatment, carried out by a medical practitioner or a medical
1.2. Persons to Obtain Consent. treatment institution;
Consent shall be obtained by a duly authorized staff who shall be responsible for informing the (b) When necessary to protect the life and health of the patient or another person, and the
patients regarding the implementation of the PHIE, and the validation of patient information. patient is not legally or physically able to express his or her consent prior to the
processing;
1.3. Persons to Give Consent. (c) When processing is requires by existing law and regulation, such as, but not limited to:
Consent shall be given by a patient of legal age and sound mind, or otherwise incapacitated to (1) Act 3573: law of reporting of communicable diseases;
give consent, any of the following in the order stated hereunder, can give consent: (2) Administrative Order No. 2008-0009: Adopting the 2008 revised list of notifiable
(a) Immediate relatives within the 3rd degree of consanguinity based on hierarchy: provided, diseases, syndromes, health-related events and conditions.
that in the case of minors, either parent may give consent, unless the married, in which
case, preference shall be given to the mother; 2. Point of Collection of Information.
(b) Cohabitant partner for a minimum of one (1) year or actual and identified guardian of the
Collection of information shall start at the time of registration in the health facility and shall be
patient;
carried out in the admitting or registration section. Subsequent collection of information shall be
(c) Social worker;
undertaken at different points of the care provided to the patient.
(d) Attending physician.

3. Processing of Information.
Provided, that if a patient has a duly executed advance directive or power of attorney for
Processing of Health Information may be through an Electronic Medical Record (EMR) system
healthcare, the same shall be given effect.
or Health Facility Information System for service transactions within the coverage and capability
of the Health Facility Information System. If the health facility does not have an EMR system in
1.4. When to Get Consent.
place, encoding and processing of patient information will be coordinated through the medical
Upon order of discharge/prior to discharge from the health facility.
records section or health facility information management section.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

PHCPs shall share health information exclusively for continuity of medical services. Health
4. Patient Identifier. information shall be retained and shared only for purposes prescribed upon its collection.
A patient’s unique identifier shall be his or her PhilHealth Personal Identification Number.
10. Filing and Storage
A. All information collected at different levels of care shall be integrated into a common
5. Point of de-identification. file. An electronic archiving system shall be developed for the storage of electronic data.
Only de-identified health information shall be stored in the PHIE Data Warehouse. De- B. Health care providers shifting to electronic records shall ensure that their paper records
identification shall be performed upon contact with the Participating Health Care Provider are stored properly. Paper records shall be digitized for the purpose of preservation and
(PHCP). The PHCP shall transmit information from patients’ records to PHIE as shared health not destruction.
record or as part of PHIE’s data warehouse. If the patient consents, the patient’s health record, or C. Subject to existing regulations, all medical records, whether in electronic and/or paper
as part of the PHIE as a shared health record, or as part of the PHIE’s health data warehouse. format, shall be stored for fifteen (15) years. For medico-legal cases, records shall be
stored for a lifetime.
Where the consent of a patient has been obtained, his or her health record may be processed in D. Providers of electronic medical records shall have a filing and storage protocol.
the PHIE without the need for de-identification. Otherwise, health information must be de-
identified, leaving only those information necessary for immediate statistical reference.
Rule 2
6. Highly Communicable Disease and Special Conditions. Access of Health Information
For patients with special conditions and/or highly communicable diseases such as, but not
limited to, HIV, Ebola, MERS-COV, special codes shall be given. Additional documents shall 1. Access of Health Care Providers.
also be signed by the patient, attending physician and head of the facility. Upon patient consent, only a health care provider and authorized entities as defined in Article
IV, Section 1, shall have access to the patient’s health information.
7. Authorized personnel to amend data if required.
Data collection and processing shall be done by an authorized employee of the health facility 1.1. Accessible Information for Health Care Providers.
and shall ensure that Clinical Practice Guidelines are observed when changing data, specifically: For healthcare providers, accessible information shall consist of the following:
A. original entry must be visible; a. History of past illness;
B. change must be dated and countersigned, or logged; and b. Family history of illness;
C. reason for the change must be entered or specified. c. History of present illness;
The medical social worker or some equivalent personnel shall collect information, especially d. Clinical history, including immunization records, previous operations and treatment;
salient points such as family information, socio-economic profile, and other vital data. e. Allergies;
f. Medication history including adverse effects, if any;
8. Reportorial Requirements. g. Results of laboratory and diagnostic procedures;
In compliance with Act No. 3573 also known as the “Law on Reporting of Communicable h. Treatment outcome (Final diagnoses shall be included whether clinical or confirmed).
Diseases”, all notifiable diseases, syndromes, events and conditions shall be immediately
collected and reported to the local and national authorities. 1.2. Approval of Access.
The creation of user credentials for personnel that shall have access to electronic medical records
Conforming to Executive Order No. 292 (s.1987), relevant information on the country’s health must be requested based on the recommendation of the head of the medical record section or unit
situation shall be collected, analyzed and disseminated by appropriate authorities provided that of a health facility and subject to the approval of the head of the facility.
health information of patients shall be protected and shall statistical data shall only be provided.
2. Access of Patient or Client.
9. Information to be Shared.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Consenting patients or clients shall have rights to access on how their health information is used. d. Biological or chemical warfare;
The health facility shall ensure that disclosures and any subsequent changes are in accordance e. Emerging and re-emerging diseases;
with the law and are properly documented.
C. Continuing care to patients;
2.1. For Minors. D. Reporting of physical injury;
Either parent or a legal guardian shall have access to the child’s health information. Where legal E. Reporting of interpersonal violence to proper authorities;
custody has been granted to only one parent or where the child has no parent, only the parent F. Reporting of diseases as registered in the Philippine Integrated Diseases Surveillance and
with legal custody or the person appointed by the court as legal guardian of the minor shall be Response;
allowed access to the records. G. Mandatory reporting required by licensing and accreditation bodies (e.g., Department of
Health, Philippine Health Insurance Corporation, Department of Interior and Local
2.2. For the incapacitated. Government, Department of Social Welfare and Development, etc.).
Where the person requesting access to the health information is incapacitated, a person in whose
favor a special power of attorney has been executed shall be allowed access to the records. 1.1. Deceased Individuals.
Disclosure of health information of a deceased individual shall be made to the authorized
3. Access of Third Party. representative.
Any third party will be allowed access to health information of a patient in cases required by
law, or when such access is authorized under a valid contract to which the patient is a party. 1.2. Medico-legal cases.
In medico-legal cases, information may be disclosed to the authorized personnel in-charge upon
3.1. Third Party Use and Disclosure. authorization from the patient or authorized representative (in case the patient is deceased).
A third party shall not disclose health information unless provided in a contract or required by
law. It shall use appropriate safeguards to prevent use and disclosure of the health information 1.3. Legal Authorities and/or Government Agencies.
other than as provided by contract or as required by law. Disclosure of health information to any other government agency may only be allowed pursuant
to a lawful order of a court. However, in case of emergency, where time is of the essence,
Such third party shall report to the health care provider any unauthorized use or disclosure of disclosure may be made even without court order. This would refer to situations such as:
health information it becomes aware of, including personal data and security incidents.
(a) Where access is sought by virtue of a subpoena. Consent is not required from next of kin;
(b) For medical or financial assistance requesting abstracts or similar documents,
Rule III authorization of patient is required;
(c) For DOH programs and other government agencies providing financial public assistance
Use and Disclosure of Health Information
the said agency shall only disclose de-identified information.

1. Use and Disclosure. Without a court order, release of information shall be pursuant to hospital policy otherwise,
Use and disclosure of health information shall be limited to that covered by the consent given by patient records shall not be released or disclosed.
the patient, or his or her authorized representative, and shall only be for the following purposes:
A. Planning of quality services; When personal health information is released to a legal authority, a cover letter shall be sent to
B. Reporting of communicable, infectious and other notifiable diseases, including those that the latter emphasizing that health information must be handled in a confidential manner. A
pose a serious health and safety threat to the public such as, but not limited to: receiving copy shall be maintained by the health care provider for record purposes.
a. Meningitis;
b. Food Poisoning (Mass); 2. Privilege Communication.
c. Breakthrough epidemic of contagious disease;
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Where information qualifies as privileged communication, as defined in this Code, both the B. data management process, including methods for tracking and controlling records (e.g.,
consent of both the patient and physician must be secured prior to the use and/or disclosure of dates and time stamps), the type of data sent and received, and the individuals who have
patient information for whatever purpose. access to records;
C. description of the privacy and security programs of the third party;
3. Training Hospitals and Academic or Clinical Requirements Purposes. D. description of output reporting (e.g., electronically or in hard copy) that allows for the
PHCP’s shall draft guidelines for the retrieval of information necessary for complying with the viewing, monitoring, and/or reconciling of data;
requirements of the Professional Regulation Commission (PRC). E. periodic staff training in secure records-handling, and -providing, and appropriate
A nondisclosure clause shall be included in the contract of a school affiliated with a PHCP. document management tools;
Personnel and/or students of such a school that access data in the custody of the PHCP for F. staff responsibilities for ensuring compliance and allocation of sufficient job time to the
academic or clinical requirement purposes shall also sign a nondisclosure agreement. task; and
G. communication requirements regarding control deficiencies identified through internal or
external sources.
RULE 4
3. Authorization and Document Retention.
Organizational Security Measures
For identification and authorization purposes, the authorizing entity shall provide any of the
following:
1. Policies and Procedures.
Each health facility shall create its own privacy protocol. Privacy and security policies must be A. biometrics
documented, maintained and updated as appropriate. B. specimen signature
C. e-signature
1.1 The PHCP shall develop policies and establish procedures that specify the groups and
positions that require access to health information in order to perform their functions and The document retention policy issued by the National Archives of the Philippines shall be
responsibilities, as well as the type of health information to which they need access. followed. For archiving purposes, a PHCP can maintain an internal archiving system or
outsource such task to an archiving specialist.
1.2 PHCPs shall orient their employees and other personnel, particularly those involved in
information security, regarding their respective privacy and security policies. 4. The Information Technology Personnel.
Authorized personnel responsible for supporting the implementation of security guidelines must
1.3 PHCPs shall clearly define access rights and user roles among their employees and other adhere to the policy of confidentiality of medical records. They shall also be charged with the
personnel to ensure that only those people with the requisite authorization are able to conduct of system-related functions such as, but not limited to, troubleshooting.
access protected health information.
5. The Medical Records Officer.
1.4 For this purpose, the Chief of each PHCP shall issue a memorandum containing a list of The Medical Records Officer with the Privacy Officer has the authority to audit the patient’s
its authorized personnel, and thereafter furnish the DOH central office a copy thereof. shared health record of patients.

1.5 Each PHCP shall perform a regular privacy and security audit.
Rule 5
2. Contract with Third Party.
Contracts or agreements between a PHCP and a third party shall include: Physical Security

A. policies for document storage and disposal; 1. Inventory of Information Technology Physical Devices.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

The Information Technology (IT) personnel of a PHCP shall maintain and update an inventory of undertaken outside the health facility. Where devices are brought outside, proper documentation
all IT physical devices being used in the facility. The inventory shall include, but not be limited and security checks must be carried out. As a required minimum, the following security
to, on-premise server equipment, firewall and security devices, client workstations, network measures should be in place:
devices, mobile devices, biometric and authentication devices, as well as other present and future
IT devices that may be relevant to the purposes of PHIE. A. Hard disk encryption
B. Data encryption
2. Access to Physical Infrastructure. C. Wireless network
A health facility shall define the access system to its I.T. physical infrastructure and limit the D. Role-based access control
same to authorized personnel only. Any special access to such infrastructure shall be documented E. Anti-virus software for vulnerable operating systems
thoroughly. Any unauthorized access shall also be documented and escalated to the appropriate F. Password-protected user access that complies with facility password policies of the health
decision-maker for further investigation and action. facilities.
G. Encrypted portable devices such as, but not limited to, Flash Drives, secure digital (SD)
2.1. Server Access. card drives, rewritable compact discs (CDs), and other present and future devices.
A health facility may opt to have either an on-premise server, a cloud server environment, or
a combination of the two. Should it choose to maintain an on-premise server, it shall provide 4. Bring-your-own device (BYOD).
a designated area (i.e., server room) for the housing of servers or data centers. The area must Mobile and portable devices owned by the health facility personnel may be allowed by the health
be separated from the site for data collection and processing, and from the office of the IT facility, provided that the latter shall implement strict policies for the access, processing, storage,
personnel. It must also comply with the physical security ISO 27001 standards. transmission and output of data, given their possible implications on patient privacy and health
information security.
Cloud technology is discussed separately under the cloud services section of this document.
4.1. Agreement.
2.2. Computer Access. Prior to the use of a BYOD in the handling of health data and information, its owner must submit
Pre-deployment site assessment shall be conducted prior to installation of computer a signed usage agreement.
workstations in the health facility. Computers shall be accessible to authorized personnel, in
accordance with a role-based system access. Each user shall only have one account. A person 4.2. Training.
requesting access to a computer shall fill-out the prescribed request form. BYOD users shall undergo annual security training.

Anti-glare filters on computer monitors shall be installed. Apart from reducing glare, they 4.3. Configuration.
also provide additional security by preventing, or at least minimizing, unauthorized and/or The IT personnel of the health facility shall establish a mechanism that creates an audit trail of
accidental viewing of the computer screen. the system activity by the BYOD user, including log-in attempts, security incidents, and attempts
to access files containing personally identifiable information. The mechanism shall also have a
2.3. Computer Loss. provision for remote access by the IT personnel, in such events that privacy of health data and
In case of computer loss, the accounts in the computer system shall be reset and deactivated until information are compromised.
it is retrieved or reported. The Data Protection Officer shall implement security incident
procedures and contingency plans for such events. 4.4. Device Requirements.
Before a BYOD is certified as being allowed for use when accessing health information, the
3. Bringing of devices outside the health facility. privacy officer shall first approve a checklist of requirements, which shall, as a minimum,
Devices registered with the health facility shall not be brought outside its premises, unless the require that the device have the following:
point of patient encounter is outside the health facility, such as but not limited to the following a. hard disk encryption.
scenarios: vaccinations, remote visits, and other similar or related community-oriented activities b. data encryption
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

c. wireless network encryption

d. role-based access control 1. Access Controls.
e. anti-virus software for vulnerable operating systems. Technical policies and procedures for electronic information systems that maintain electronic
f. password-protected user access that complies with facility password policies. protected health information to allow access only to persons or software programs that have been
g. encrypted portable devices such as but not limited to flash drives, secure digital (SD) card granted access rights:
drives, rewritable CD, and other present and future devices.
1.1. Information Access Management (Required).
Mobile devices used for job responsibilities are subject to audits even if owned by an employee
of the health facility. (a) Isolating health care clearinghouse functions (Required). If a healthcare clearinghouse is
part of a larger organization, the clearinghouse shall implement policies and procedures
Taking photos of patient data through the use of camera phones and bringing of unauthorized that protect the electronic protected health information from unauthorized access by a
electronic devices such as cellular phones, laptops, tablets, and cameras inside the medical larger organization.
records area is prohibited.
(b) Access authorization (Addressable). Policies and procedures for granting access to
5. Business continuity and Disaster recovery. electronic health information, such as those that relate to workstation access, transaction,
The health facility shall implement policies for business continuity and disaster recovery. program, process, and/or other mechanisms shall be implemented by the PHCP.
Guidelines on the access to health information are provided on Article III of this Code.
5.1. Physical backup.
A data backup plan has to be implemented to create and maintain exact copies of the system (c) Access establishment and modification (Addressable). Policies and procedures of an
for handling health information. The backup medium must be defined, and the interval of establishment, including those that relate to the documentation, review and modification
backup stated. The backup must also be tested for data validity and integrity. Physical of a user’s rights to workstation access, transaction, program or process shall be
backups shall be encrypted and stored outside the health facility and additional physical implemented based on the access authorization policy of the data controller and/or data
security measures shall be in place for accessing and securing the physical backups. In the processor.
event of a disaster, the Data Protection Officer must have a protocol in place for data
recovery and a disaster recovery team that can be organized within a short period of time. 1.2. User Identification (Required).
A process for unique user identification shall be made within the policy and procedure of the
5.2. Business Continuity. PHCP.
Business continuity must be ensured even in the event of a disaster. The Data Protection A. There shall be a user name and/or number for identifying user identity throughout all
Officer shall have identified a minimum set of data requirements for the maintenance of the levels of the organization.
processes of a health facility necessary for the delivery of services. The health facility shall B. User identity shall not be shared, delegated or assigned to a group or individual.
also have the ability to transition from “emergency-mode” services, to full services. For this C. User identity that was previously used shall not be reused for new and/or existing users.
purpose, policies for encoding data outside the “full services” mode must be in place.
1.3. Emergency Access Procedure (Required).
Events that take place during disaster recovery and business continuity shall be documented Procedures for obtaining necessary electronic health information during an emergency.
and reviewed. Updates implemented according to best practices and lessons learned during
the disaster period. (a) The PHCP shall identify, define, and describe the situations when emergency access to
health information may be authorized.
(b) Personnel who are authorized to access health information during emergency situations
Rule 6 must be identified.
Technical Safeguards
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

(c) Procedures for obtaining necessary health information during emergency situations shall
be established and implemented. 3. Integrity Controls.
(d) Policies and procedures for governing access to health information shall be established. Protection of Health Information from improper alteration or destruction.

1.4. Automatic Log-off (Addressable). 3.1. Mechanism to Authenticate Electronic Health Information (Addressable).
Electronic procedures that terminate and electronic session after a predetermined time of There shall be a mechanism in place that confirms that electronic health information has not
inactivity. been altered or destroyed in an unauthorized manner.

(a) A policy and procedure regarding the use of automatic log-off shall be created. 3.2. Digital Signatures (Required).
(b) A predetermined time shall be documented within the policy based on the application. Digital signatures shall be used to verify the authenticity of the entry in an electronic system.

1.5. Encryption and Decryption (Addressable). 3.3. Sum Verification (Required).

The method of converting an original message of regular text into encoded text using an Sum verification shall be used to determine if the input data matches source data.
algorithm.
A. For encryption in transit, the standard security technology shall be SSL (Secure Sockets 3.4. Anti-virus Software (Required).
Layer). Computers shall have an industry-standard anti-virus software with its automatic update
B. Minimum standard requirement for encryption shall be AES (Advanced Encryption feature turned on. The software shall be configured regularly and shall automatically
Standard) 128. download updates to ensure its ability to address the latest threats.
C. For encryption in storage, the standard shall be TKE (Trusted Key Entry).
3.5. Data Storage Encryption (Required).
1.6. Multi-factor Authentication (Addressable). Data storage and transmission shall be encrypted. For websites, https encryption shall be
For systems that have been identified as having significant risks (e.g. servers, unified threat used. Article VII, section 1.5 provides standards for encryption and decryption.
management), policy, operational, and technical mechanisms that use multi-factor authentication
shall be put in place. 3.6. Transmission Encryption (Required).
Data transmission via wireless networks or the internet shall always be encrypted.
2. Audit Controls.
Relative to a particular computer system, there shall be a record of those who have access 3.7. Proper Handling of Mechanical Components (Addressable).
thereto, when it was accessed and what operations were performed. Users of electronic systems shall be trained on the proper use and handling of central
processing units (CPUs), servers, flash drives, and external hard drives.
2.1. Recording of Information (Required).
Recorded information must include, but is not limited to, unique user identified, data and 3.8. Offline Modes and Caching (Addressable).
time of use/access, location (if applicable). Electronic systems shall have online and offline modes.

2.2. Audit Data Life Span (Addressable). 3.9. Interface Integration of Information Systems (Addressable).
The PHCP shall establish a policy that specifies the period within which data must be stored, Data transmission from electronic medical records shall follow a standard for integration and
and the method for its destruction or disposal. interfacing in order to facilitate interoperability and data compatibility.

2.3 Access to Audit Data (Addressable). 4. Transmission Security.

The Medical Records Officer alongside with the Data Protection Officer shall be authorized
to audit the shared health record.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Technical security measures to guard against unauthorized access to electronic health A. The healthcare provider retains ownership over all its data;
information that is being transmitted over an electronic communications network shall be B. The cloud service provider acquires no rights or licenses from the agreement, including
implemented. intellectual property rights or licenses to use the health care provider’s data for its own
purposes; and
5. Identity Authentication. C. The cloud service provider does not acquire and may not claim any interest in the data.
Procedures necessary to verify the identity of a person or entity seeking access to electronic
health information is the one claimed shall be implemented. 2.2 Service agreements should also:
A. Provide means through which a PHCP can assess the performance of the cloud service
6. Storage Security. provider over time, including the security controls and processes it employs. Whenever
Data stored in a portable data storage device (e.g. flash drive, portable hard drives, etc.) and/or in possible, the PHCP shall have such information (e.g., threshold for alerts and
cloud storage services (e.g. Dropbox, OneDrive, Google Drive, etc.) must be encrypted. notifications, level of detail and schedule of reports, etc.) that is proportionate to its
needs.

Rule 7 B. Clarify the types of metadata collected by the cloud service provider, the protection
Cloud Services provided thereon, and the organization’s rights over metadata including ownership,
opting out of collection or distribution and fair use.
1. Cloud Services.
Where applicable, a PHCP must familiarize itself with the technologies being used by its cloud 3. Composite Services.
serviced provider in delivering its services, including the implications that technical controls Where cloud services themselves use third-party service providers as regards one or more of
have on the security and privacy of the system throughout its lifecycle. their services, they should specify the scope of control of the third parties, their responsibilities,
and the remedies and recourse available in case problems occur. These arrangements shall, in all
For cloud service providers, there shall be in place: cases, comply with the requirements set out in the DPA regarding the outsourcing or
1.1 appropriate audit mechanisms and tools capable of determining how data is stored, subcontracting of data processing.
protected, and used, and of validating services and policy enforcement;
1.2 a risk management program that is flexible enough to deal with the continuously
evolving and shifting risk landscape; and Rule 8
1.3 adequate and secure network communications infrastructure. Use of Social Media

The cloud service provider’s electronic discovery capabilities and processes must not 1. Definition of Social media.
compromise the privacy or security of the data and applications of the PHCPs. At the same time, This refers to electronic communication, websites or applications through which users connect,
the PHCP must also be familiar with the cloud service provider’s security measures in order for interact or share information or other content with other individuals, collectively form part of an
it to conduct proper risk management. online community. This includes such online platforms as Facebook, Twitter, Google+,
Instagram, LinkedIn, Pinterest, Blogs, Social Networking Sites.
The PHCP should understand the privacy and security controls of the cloud service. It must
establish adequate arrangements in the service agreement that allow for necessary adjustments 2. Unauthorized posting of personal data of patients in social media, including pictures, shall be
and effective compliance monitoring of said controls with the terms of the service agreement. penalized in accordance with the provisions of the DPA.

2. Contract between health care provider and cloud service provider. 3. Administrative Responsibilities.
2.1 The health facility’s ownership rights over the data must be firmly established in its Health facilities shall provide for guidelines regarding the use of social media. In line with this,
service contract with the cloud service provider should clearly state that: the social media activity of all facility personnel, whether temporary or permanent, shall be
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

monitored for any privacy breaches. For this purpose, “facility personnel” shall include: (a) professional maintains the same social media account for both his professional and personal
physicians; (b) employees; (c) other healthcare providers; (d) students; (e) and residents in lives.
training, practicing their profession, working, or fulfilling academic and clinical requirements
within the health facility. 6.4 refrain from using the name, log, or any other symbol of the health facility in his or her
social media activity, without proper authorization. An individual shall also not identify
Unprofessional behavior or misinformation witnessed in social media that violates patient himself or herself in social media as a representative of the facility absent any authority to do
privacy or privacy of other individuals shall be reported to appropriate authorities. so.

4. Responsible Social Media Use of Health Care Professionals. 6.5 refrain from posting, sharing, or using photos or videos taken within the facility that will
Health care professionals shall always be mindful of their duties to their patients, community, violate their right to privacy.
their profession and their colleagues thus they must take into account that any content, once
posted online, may be easily disseminated to others and is essentially irreversible.
Rule 9
5. Health Education and Promotion. Human Resources
Caution must be observed when sharing health-related information, education, and promotion for
advocacy purposes. 1. On-boarding of employees of the health care facilities.
All candidates for employment, contractors and third parties shall be screened properly by the
Only general opinions may be shared in social media. Specific medical diagnosis, advice, concerned personnel of the health facility, particularly those being considered for sensitive posts.
treatment or projection shall not be dispensed with therein. Accordingly, social media use,
whenever appropriate, shall always include statements reminding the public that they should not As part of his or her security roles and responsibilities, an individual shall:
rely on advice given online, and that medical concerns are best addressed in the appropriate
settings. A. implement and comply with the health facility’s information security policies;
B. protect assets from unauthorized access, disclosure, modification, destruction or
For social media use to crowd source support, identity of the patient can only be revealed to the interference;
support group upon patient’s consent. Confidentiality of data shall still be upheld by removing C. execute security processes of specific activities;
any information or features that are easily identifiable to the patient. D. ensure responsibility is assigned to an individual for actions taken; and
E. report security events or potential events or other security risks to the organization.
6. Professional Guidelines for Social media Use for Persons Involved in the PHIE.
A health care professional shall: These functions shall be clearly defined and communicated to the personnel concerned.

6.1 strive to develop, support and maintain a privacy culture in the health facility. He or she Background verification checks on all candidates for employment, contractors, and third parties
shall abide by the social media use policy of the facility. shall be carried out in accordance with relevant laws, regulations and ethics, and shall be
proportional to the business requirements, the classification of the information to be accessed,
6.2 advise the patients of their privacy rights and encourage them not to post in social media and the perceived risks. Procedures shall define criteria and limitations (e.g., who is eligible to
any activity or confidential information that may put them at risk, such as, but not limited to conduct screening, manner by which screening shall be carried out, etc.) for verification checks.
medical diagnosis and laboratory results.
A screening process shall be carried out for contractors, and third parties. In the case of
6.3 conduct himself or herself in social media or online the same way that he or she would in personnel of third parties processing health information for or in behalf of a health facility, or
person for this purpose, he or she shall act in a manner befitting his or her profession, thereby where the services of contractors are secured by such facility through an agency, the contract
inspiring trust in the service he or she provides. This is particularly the case if said with the third party or agency shall clearly specify the latter’s responsibilities vis-à-vis the
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

screening process as well as the notification procedure it needs to follow if screening is not b. are provided with guidelines that identify the security expectations from their respective
completed or if the results thereof give cause for doubt or concern. In the same way, the roles and responsibilities;
agreement with the third party should clearly specify all responsibilities and notification c. are motivated to fulfill the security policies of the health facility;
procedures for screening. d. achieve a significant level of awareness regarding information security that is relevant to
their roles and responsibilities;
Personnel of the health facility, the latter’s contractors, and third parties processing health e. conform to the terms and conditions of their employment or engagement, which includes
information for the facility, shall agree to and sign the terms and conditions of their employment the health facility’s information security policy and appropriate methods for working; and
contracts. Such terms and condition must reflect the health facility’s security policy, and shall f. have the skills and qualifications necessary for the fulfilment of their respective roles and
clarify the following: responsibilities.
A. All personnel of the facility, its contractors, and third parties processing health
information for the facility, who are given access to personal data shall sign a 2.2. Awareness and Training.
confidentiality or non-disclosure agreement prior to being given such access; An adequate level of awareness, education, and training in security procedures and the
B. Rights and responsibilities (e.g., copyright laws or data protection legislation) of all correct use of data processing facilities should be provided to all personnel of a health
personnel involved; facility, including those of its contractors and other third parties it conducts business with. A
C. Responsibilities for the classification of information and management of organizational formal disciplinary process for handling security breaches must also be established.
assets associated with information systems and services handled by all personnel
involved, contractor or third party user; Awareness training shall commence with a formal induction process designed to introduce
D. Responsibilities of each personnel as regards the handling of personal data received from the health facility’s security policies and expectations before access to data or services is
other companies or external parties; granted to the concerned personnel.
E. Responsibilities of the organization for the handling of personal data, including that
created as a result of, or in the course of, a person’s work in the organization; The security awareness, education, and training activities should be suitable and relevant to
F. Responsibilities that are extended outside the organization’s premises and outside regular the person’s role, responsibilities and skills, and should include information on known
working hours; threats, who to contact for further security advice and the proper channels for reporting
G. Actions to be taken if the organization’s security requirements are disregarded by a personal data breaches and security incidents.
specific individual.
2.3. Disciplinary Process.
2. Employment Period. There shall be a formal disciplinary process for personnel charged with having committed a
No personnel shall disclose any personal data relating to a patient without the latter’s consent. personal data breach or security incident, or, by the negligence, allowed such breach or
This prohibition shall subsist even after such personnel’s employment or engagement with the incident to occur.
health facility.
For this purpose, a health facility shall accord due process to the personnel involved.
2.1. Management Responsibilities.
Management responsibilities should be properly defined to ensure that security is applied all For government-owned health facilities, any disciplinary or termination process shall be in
throughout an individual’s employment or engagement with the health facility. accordance with the Civil Service Rules.

Management responsibilities shall ensure that personnel of the facility, including those of its Regarding administrative liability, a graduated response that takes into consideration various
contractors and other third parties: factors (i.e., nature and gravity of breach and its impact on business, whether or not it is a
a. are properly briefed regarding their information security roles and responsibilities prior to first or repeat offence, whether or not the violator was properly trained, relevant legislation,
being given access to sensitive personal information or information systems; business contracts, etc.) shall be provided.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

3. Termination or Off-boarding of Employees. a. whether the termination or change is initiated by the employee, contractor or third party,
Responsibilities for performing employment termination or change of employment shall be or by management, and the reason for termination;
clearly defined and assigned. Responsibilities and duties still valid after termination of b. current responsibilities of the employee, contractor, or any other user;
employment shall be contained in the employee’s, contractor, or third party’s contracts. c. value of the assets currently accessible.

The communication of termination shall include ongoing security requirements and legal In certain circumstances access rights may be allocated on the bases of being available to more
responsibilities contained within any confidentiality agreement, and the terms and conditions of people than the departing employee, contractor or third party (e.g. group IDs). In such instances,
employment continuing for a defined period after the end of the employee’s, contractor or third departing individuals shall be removed from any group access list and arrangements shall be
party’s engagement. made to advice other employees, contractors and third parties involved to no longer share this
information with the person departing.
The Human Resources function is generally for the overall termination process and works
together with the supervising manager of the person leaving, the IT manager to manage the
security aspects of the relevant procedures in relation to health information access. In the case of Rule 10
a contractor, the termination responsibility process may be undertaken by an agency responsible Health Research
for the contractor, or be handled by their organization.

1. Research Subject.
3.1. Return of Assets.
Research participant shall be made to understand that he or she can opt-out of the study or have
All employees, contractors and third parties shall return all of the health care facility’s assets
his or her personal data deleted from the project’s database if they relay such request in writing.
in their possession upon termination of their employment, contract or agreement.
A. Acceptable recruitment methods. Acceptable methods for recruiting research subjects
The termination process shall be formalized to include the return of all previously issued
may include: advertisements, notices, media (social or tri-media), websites, letter or
software, corporate documents, and equipment. Other organizational assets such as mobile
email to colleagues or healthcare staff that may be distributed to potentially eligible
computing devices, access cards, software, manuals, and information stored on electronic
individuals.
media must also be returned.
B. Unacceptable recruitment methods. Unacceptable recruitment methods for recruiting
In cases where an employee, contractor or third party has information that is important to
research subjects include: (1) searching through medical records or databases (e.g.,
ongoing operation, such information shall be documented and relayed to the organization.
patient registry) for qualified subjects and having a researcher with no prior contact
with potential subject recruit; (2) recruiting subjects immediately prior to sensitive or
3.2. Access Rights.
invasive procedure (e.g. in pre-op room); (3) retaining sensitive personal information
The access rights of all employees, contractors and third parties to data and data processing
obtained during screening without the consent of those who either failed to qualify or
facilities shall be removed upon termination of their employment, contract or agreement, or
refused to participate in any possible future study.
adjusted upon change.

2. Research Protocol.
If a departing employee, contractor or third party is in possession of passwords to accounts
Study protocols shall incorporate data protection measures. Protocols shall describe how the
that will remain active; these shall be changed upon termination or change of employment,
participant’s privacy will be protected in the entire research process and shall also include
contract or agreement.
provisions on how to protect data and samples during use and subsequent storage.
Access rights to data assets and data processing facilities shall be limited or removed before
A letter of request addressed to the Local Chief Executive or the Head of the Facility shall be
the employment terminates or changes, depending on the evaluation of risk factors such as:
made and shall be subject for approval. The letter of request shall contain the objective of the
study, the type of data to be collected, and the method of data gathering.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

duly-constituted ethics committee. The risk of re-identification of study participants or

Individuals, organizations or third parties who may access health information shall be identified data subjects should be low to none.
in the study protocol and in the registration information to be provided to the concerned review
body.
Rule 11
3. Research Projects. Patient Registries
A research project involving one thousand (1,000) or more data subjects shall register with the
National Privacy Commission and/or its duly deputized body (for health research, possibly the
1. Registry Design.
Health Privacy Board).
Any give registry shall be developed with a clearly-defined purpose (i.e., disease condition,
health service registry, disease outcome, etc.) to avoid both ethical and compliance issues that
A personal data breach reporting protocol shall be followed and researchers must ensure data
may undermine the attainment of such purpose.
protection during the entire research process (e.g., recruitment, study proper, close-out, etc.) and,
where applicable, even after the conduct of study.
A governance framework for registries shall be formalized to: (a) ensure accountability; (b)
oversee resource application; (c) provide focus; and (d) optimize output from said registries. All
All personnel involved in the study will be required to sign agreements to protect the privacy,
personnel involved in the use of these registries must be familiar and abide with the
security and confidentiality of the health information before they are granted access to any
administrative and legal requirements set out in such framework.
personal data or research participant.
Methods involved in the registry such as but not limited to data collection, data reporting, and
A copy of the completed research study or project shall be provided to the health facility.
addressing of outliers shall be documented.

4. Research Data.
A security assessment approach shall be employed to identify measures that need to be adopted
Data or specimen collected from research shall be de-identified or destroyed only when deemed
to address security gaps.
appropriate. Identifiers will be removed from study-related information, whenever feasible.

2. Informed Consent.
A. Paper-based records. Paper-based records are to be kept in a secure location and shall
Health facilities shall declare the patient registries that they are managing. Registry participants
only be made accessible to personnel involved in the study.
or their next of kin shall be made aware of the collection of data for the use of or storage in such
registries.
B. Electronic records. Computer-based files will be encrypted and made available to
personnel involved in the study through the use of access privileges and passwords.
3. Registry Data.
Data elements shall conform to standard definitions, terminologies and specifications. It must be
C. Audio and video collection. Audio or video recording of research participants will be
used to enable meaningful comparisons and allow maximum benefit to be gained from linkage to
transcribed and thereafter destroyed to eliminate audible or visual identification.
other registries and/or databases. Registry reports shall be produced according to a strict
Collection of visual images shall be subject to patient’s consent and identification of data.
timeline.
Collection of visual images shall be subject to patient’s consent and identifiable
information shall be removed or obscured.
Data dictionaries shall be established to ensure that a systematic identical approach is taken
during data collection and data entry.
D. Data Sharing. Where the health information of a research participant shall be subject to a
data sharing arrangement, his or her consent must be obtained specifically for such
For data previously collected, the privacy conditions under which they were collected shall be set
purpose. Data sets that will be disclosed to the public must have undergone thorough
as the minimum privacy conditions.
technical anonymization procedures and shall have been cleared for public access by a
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Audit of registry data shall be done frequently (depending on facility protocol) to promptly 2. Site Privacy Policy.
identify data quality lapses.
A. For facilities maintaining public-facing websites:
4. Data Collection. a. Any information that may compromise the privacy of the patient shall not be posted in
Collection of data shall be done as close as possible to the time and place of care by the website.
appropriately trained data collectors. It shall be done in a systematic approach, with identical b. Any data collected by the website shall be treated with utmost confidentiality.
approaches used at different institutions ensuring that it shall not be an unreasonable burden to c. Where applicable, the health facility operating the website shall declare that it uses
patients, nor incur any cost. cookies to manage authentication, navigation, and other functions. It shall also actively
request a site user to agree that these types of cookies can be placed on one’s device.
5. Registry Data for Research.
Health information registries for research shall incorporate an appropriate design and data
elements, written operating procedures, and documented methodologies, as necessary, to ensure Rule 13
the fulfillment of a valid scientific purpose. Health Privacy Board
Where an authorization for the use and disclosure of registry data for future research does not
1. Rationale.
exist, health care provider or health insurance plan maintaining the registry shall need to obtain
The Health Privacy Board is a broad sectoral response to health information privacy needs. It
additional authorization for the research from individuals or seek a waiver of authorization from
will support the health sector in complying with issuance and administrative orders relating the
an Institutional Review Board, Ethics Review Board or Health Privacy Board.
health information privacy and further the development of policy and practice for health data
protection.
6. Registries for Vulnerable Population.
Registries compiling health information from vulnerable population such as but not limited to
pregnant women, human fetuses, neonates, prisoners, children, and patient having rare diseases
shall employ special effort to protect identities of these subjects.

2. Composition.
7. Linking of Registries.
The Health Privacy Board shall be composed of the Chairperson who shall be assisted by two
If a dataset is going to be linked to another, an independent review of privacy risks (i.e re-
Board Members, one to be responsible for Training and Capacity Building and one to be
identification, fraud) involved must be conducted.
responsible for Compliance and Planning.

2.1. Appointment of full-time Board Members with salary grade not lower than 26 shall be done
Rule 12 by the Steering Committee of PHIE. They shall be provided with office and administrative staff.
Publication and Public Communication
3. Competencies and Qualifications.
1. Publication of Privacy Policy. Members of the Board shall have the following competencies and qualifications:
Privacy protocols of health facilities shall be available both in written and electronic forms and
shall be distributed to all employees. a) Background in law, education, clinical or public health, a bachelor’s degree in
management, information systems, human resources, health administration, or other
Health facilities shall ensure that appropriate signage indicating the availability of protocols are relevant fields.
posted. Privacy protocols of health facilities shall be updated and submitted to the Health Privacy b) Minimum 5 years’ experience in health care.
Board and in so far as practicable, be made available online in its own website. c) Demonstrate mastery of regulatory development and compliance, including standards,
laws and regulations concerning information security and privacy.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

d) Familiar with business functions and operation of large institutions (preferably health- 4. Conduct training workshops and accommodate requests for public information on the
related). implementation of the privacy guidelines.
e) Strong organizational and problem-solving skills.
f) Work effectively with teams and stakeholders. 6. Board Member for Privacy Compliance and Planning.
g) Have the ability to communicate with clarity both orally and in writing. The Privacy Compliance and Planning functions of the Board shall be spearheaded by the Board
Member for Privacy Compliance and Planning. He or she shall:
4. General Roles and Functions.
1. Oversee the monitoring of privacy compliance in health facilities. It shall develop
1. The Board shall assist in the implementation of the Privacy Guidelines and related procedures for assessment of privacy practices in health facilities, in accordance with
issuance through Training and Capacity Building, and through Compliance Monitoring standards for organizational, physical and technical security measures in the Privacy
and Planning. Guidelines and related issuances. It shall also coordinate with licensing and accreditation
2. It shall coordinate with the licensing authority of the heath institution or other bodies to advocate inclusion of privacy standards in their evaluation of health facilities, in
accreditation bodies, when necessary, in order to perform its function. view of the requirement of existing laws.
3. The Board shall accept complaints, inquiries and requests for assistance from the health 2. Review privacy codes voluntarily adhered to by personal information controllers and
sector on matters related to the Privacy Guidelines and related issuance. processors in the health sector and make recommendations to meet standards for the
a. Complaints. It shall promulgate rules and procedures for receiving and processing protection of personal health information.
complaints. It shall mediate between parties to reach a compromise settlement, 3. Identify gaps in current standards for organizational, physical and technical security
without prejudice to reporting before the NPC or licensing and regulatory measures for protection of personal health information and make recommendation for its
authorities, matters contrary to law, in which case it shall make its improvement.
recommendation after proper evaluation. 4. Develop materials and documents such as templates for employment contracts and non-
b. Inquiries and Requests for Assistance. It shall assist persons or institutions on the disclosure agreements to serve as a guide for the health facilities.
interpretation of privacy regulations. It shall elevate to the Privacy Experts Group 5. Undertake regular planning activities to develop and recommend programs to support the
issues which in its discretion requires advisory assistance. implementation of the Privacy Guidelines.
4. It shall provide the Privacy Experts Group (PEG) a report of its activities, including case 6. Maintain a record of all compliance and monitoring reports.
reports of issues brought before it that are of importance or significant impact.
5. It shall make recommendations on change in policy or further policy development. It
shall coordinate with appropriate agencies to incorporate emerging technologies and new Rule 14
regulations in existing policies. The Privacy Team of a Health Facility
5. Board Member for Training and Capacity Building. 1. Rationale.
The Training and Capacity Building functions of the Board shall be spearheaded by the Board In so far as practicable, the Data Protection Officer (DPO) shall be designated at a health
Member for Training and Capacity Building. He or she shall: facility. The DPO’s identity shall be made known to any data subject upon request. It is
recommended that the DPO has to be on the Vice-president level (or equivalent) to have
1. Coordinate with other government agencies and the private sector on efforts to formulate sufficient authority to uphold privacy in the institution. Expected to have some personnel with
and implement plans and policies to strengthen the protection of personal information in specialized privacy roles are regional health units (RHUs) and bigger health facilities. In a
the health sector. facility where plantilla position for a Data Protection Officer could not be immediately secured, a
2. Develop and implement training modules for capacity building. Privacy-Officer-Designate shall be appointed.
3. Develop and implement programs to inform and educate the public of health information
privacy and to promote a privacy culture in the health sector including but not limited to 2. Appointment.
IEC materials that may be used by health information privacy advocates.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Hospitals with at least 300 authorized bed capacity shall employ a full time Data Protection g) Identifies how personal health information is created, stored or disclosed in paper and
Officer. Hospitals with less than 300 authorized bed capacity and other health facilities such as electronic format and maintains an inventory of how we use or disclose all personal
infirmaries, birthing homes, RHUs/BHS, OFW clinics, dialysis clinics, ambulatory-surgical health information.
clinic, psychiatric facilities, etc. may federate and designate a shared Data Protection Officer. h) Is the contact person responsible for receiving complaints and providing individuals with
further information about matters contained in the health facility’s privacy protocols.
The Development Management Officer (DMO) shall be assigned as the Data Protection Officer i) Maintains a record of complaints and brief description of how they were resolved.
Designate for Rural Health Units. This shall be in addition to their responsibilities as DMO. j) Distributes the health facility’s privacy protocols to all new patients and post the update
health facility’s privacy protocols on the institution’s website or on its public bulletin
3. Qualifications. boards.
The Data Protection Officer shall have the following qualifications: k) Continually updates the staff’s knowledge of privacy rule guidelines, developments, and
new regulations and must train workforce on these requirements. The PO shall update the
a) At least a bachelor’s degree in management, information systems, human resources, health facility’s privacy protocols, acknowledgement forms, authorization, consents, and
health administration, or other relevant field. other forms as required and ensures that the workforce adheres to the policies and
b) Minimum 5 years’ experience in health care. procedures, including imposing sanctions on workforce members that breach an
c) Familiar with regulatory development and compliance, including standards, laws and individual’s privacy.
regulations concerning information security and privacy. l) Effectively communicates technical and legal information to non-technical and non-legal
d) Familiar with business functions and operation of large institutions (preferably health- staff for employee training.
related). m) PO and privacy team shall account for devices used in facility and ensure devices
e) Strong organizational and problem-solving skills. containing electronic personal health information are encrypted as required by health
f) Work effectively with teams and stakeholders. facility’s privacy protocols.
g) Have the ability to communicate with clarity both orally and in writing. n) Reviews all business associate agreements or contracts for privacy compliance.
h) Must undergo data privacy and security training from reputable training providers. o) Consistently apply sanctions, in accordance with the facility’s policies and procedure.
p) Regularly communicates the status of legal complaints, risk, and sanctions imposed on
workforce members.
4. Roles and Functions. q) Serve as the practice’s resource for regulatory and accrediting bodies on matters relating
Ultimately, the Data Protection Officer is the person responsible for the privacy policy to privacy and security.
compliance at the health facility. The DPO sees to it that overall compliance is observed at the r) Perform system or quality data check, compliance on the reporting forma nd safekeeping
institution. Other roles of the DPO shall include: of backup data.
s) Coordinate privacy safeguards with the practice’s security officer to ensure consistency
a) Developing and implementing privacy policies and procedures. in development, documentation, and training for security and privacy requirements.
b) Assumes advocacy, capacity-building, and stake-holding functions. t) Coordinate and communicate to practice leaders and audits of the National Health
c) Manages the privacy aspect in the different areas of the operations. Privacy Board or any other governmental or accrediting organization.
d) PO and the privacy team shall identify the governance structure from national level down u) Coordinate with the institution’s Risk Manager (if any) to address privacy risks.
to RHU and align with them their facilities’ privacy goals and initiatives. v) Reports directly to the hospital director, president, board of directors.
e) Ascertains the authority and delegates data collection to staff. He or she regularly audits w) Represent the health facility in the event of an inquiry, inspection, or investigation by the
the quality and integrity of patient records. National Privacy Commission.
f) Ensures that the entire process of editing data is documented: request for editing, who did
the editing, the process followed in editing, and closing the editing. 5. Staff.
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

While the DPO is responsible for privacy management and compliance, He or She may delegate Notification during instances of breach shall be as follows:
responsibilities to others within the organization if they are trained and would communicate a. Each individual whose protected health information has been, or is reasonably believed
promptly with the privacy official on these matters. by the health care provider or the health facility to have been accessed, acquired or
disclosed as a result of breach shall be notified within 60 days upon discovery.
b. Health care providers shall have the burden of proof demonstrating that all notifications
Rule 15 were made.
Compliance, Incident Reporting, Response c. Notice shall be provided by the health facility or health care provider to the health
privacy board and elevated to the National Privacy Commission when necessary. If the
breach affects 500 or more individuals, notification must be provided immediately.
1. Compliance.
Health facilities involved in the PHIE are required to:
3.1. Forms of Notification.
a. Register their data processing systems involved in the PHIE process to the health privacy
Notification of privacy breach may be in the form of:
board, including the data processing system of contractors, employees and third parties
a. Individual notice;
entering into contracts with them that involves accessing or requiring sensitive personal
b. Media notice. Media notice shall only be applicable if the unsecured protected health
health information from one thousand (1,000) or more individuals;
information of more than 500 individuals is reasonably believed to have been accessed,
b. Notify the health privacy board of automatic processing operations being carried out by
acquired, or disclosed during the breach.
the health facility, its contractors and third parties;
c. Submit a copy of their privacy policy as well as the list of personnel having direct access
3.2. Content of Notification.
to health information to the health privacy board;
a. A brief description of what happened, including the date of breach and the date of
d. Submit an annual report on documented security incidents to the health privacy board;
discovery of the breach, if known.
e. Comply with other requirements that may be provided on their issuance issued by the
b. A description of the types of unsecured health information that were compromised in the
National Privacy Commission or the Health Privacy Board.
breach (such as full name, philhealth number, date of birth, home address)
c. Situations where individuals are at risk due to the breach and the steps that they should
2. Incident Reporting and Response.
take to protect themselves from potential harm resulting from the breach.
Processes and procedures established by DOST-ICTO for detecting and reporting the occurrence
d. A brief description of what the Health Care Provider or Health Facility involved is doing
of information security events (by human or automatic means) shall be implemented and
to investigate the breach, to mitigate losses, and to protect against any further breaches.
observed accordingly.
e. Contact procedures for individuals to ask questions or learn additional information, which
a. All reported incidents must be identified to immediate response actions to deal with the
shall include a telephone number, e-mail address, website or portal address.
information security incident.
f. Contact information of the National Privacy Commission. Email:
b. All information security incident report must be updated and collected into the
[email protected].
information security event/incident database by information security response team
g. Contact information of the National Bureau of Investigation (NBI) Office of
member and must notify the team leader/manager and others as necessary.
Cybercrime, the Philippine National Police Anti-Cybercrime Group (ACG).
c. All information security incidents that have been resolved or closed must be reviewed to:
i. Conduct further analysis, as required;
3.3. Delay of Notification.
ii. Identify the lessons learned from information security incidents;
If the health privacy board or the National Privacy Commission determines that a notification,
iii. Identify improvements to information security and safeguard the implementation;
notice, or posting would impede a criminal investigation or cause damage to national security,
iv. Identify the improvements to the information security response management plan
such notification, notice, or posting may be delayed.
as a whole to determine the effectiveness of the processes, procedures, reporting
forms and/or the organizational structure.

3. Notification in the Case of Breach.

 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

Rule 16
Procedures in the Investigation of Complaints Filed Before the Health Privacy 1. Full names and complete addresses of the complainant and the respondent;
2. A brief narration of the material facts which show a violation of the privacy guidelines or
Board
related issuance, or the acts or omissions allegedly committed by the respondent
amounting to a privacy concern.
1. General Principles. 3. If the complainant contains personal and sensitive information involving third parties,
The Health Privacy Board does not have quasi-judicial powers or the power to impose penalties. which information will be disclosed to the Board, the complainant shall include proof that
Parties who voluntarily submit their complaints or issues for resolution may be assisted in consent of said parties have been obtained with regard to the use, access and disclosure of
clarifying the issues subject of the complaint, and in reaching an amicable settlement. To ensure said personal or sensitive information for purposes of resolving or adjudicating the
compliance with the Resolution of the Board, both parties must submit an undertaking under complaint, before appropriate bodies.
oath or embodies in an affidavit that the parties agree to be bound by the Resolution of the 4. If the Complainant is an institution, the complaint shall be accompanied by the incident
Board. report or relevant document showing the results of the investigation conducted within the
institution.
The Health Privacy Board does not have subpoena powers or powers of contempt. It relies on the 5. Certified true copies of documentary evidence, and the affidavit/s of witness/es if any.
documents and evidence voluntarily submitted by the parties. The investigations conducted by 6. An undertaking of the complaint, or in case of juridical person by a duly authorized
the Board shall be fact-finding and summary in nature, without prejudice, however, to the due representative, under oath or embodied in an affidavit, to the effect that the complainant
process of law, and recourse to the National Privacy Commission or proper courts, when agrees to abide by the final resolution of the National Health Privacy Board, without
necessary. prejudice to other legal remedies.

The Health Privacy Board may be able to assist the parties in clarifying privacy related 2.4. Number of Copies.
complaints in health facilities due to the fact that they have a deeper understanding and better The complainant, together with the documentary evidence and affidavit/s of witness/es, if any,
perspective of privacy issues concerning personal and sensitive health information. The shall be filed in such number as there are respondents, plus two (2) copies for the file. The
Resolution of the Health Privacy Board may also serve as support document of cases filed before affidavit/s required to be submitted shall state facts only of direct personal knowledge to the
the National Privacy Commission, or regular courts. affiant and shall show the competence of the affiant to testify to the matters stated therein. A
violation of the foregoing requirement shall be a ground for expunging the affidavit or portion
thereof from the record.

2. Procedure for Complaint and Investigation. 2.5. Where to File A Complaint.

A complaint may be filed at the office of the Health Privacy Board.
2.1. Complaint.
A complaint shall be in writing and under oath or embodied in an affidavit. 2.6. Evaluation of Complaint.
The Board shall evaluate the allegations of the complaint (1) to determine whether it involves a
2.2. Who May File. violation of the Privacy Guidelines or issues involving privacy of health information and (2) if
The complaint may be filed by any person, firm, partnership, association or corporation, through based on its allegations, there is reason to believe that there is a violation of the Privacy
its duly authorized representative. Guidelines or related issuances. If both conditions are not satisfied, the complaint shall be
dismissed.
2.3. Contents.
The complaint must be written in a clear, simple and concise language and shall contain the 2.7. Issuance of Requests to Appear.
following:
 Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

1. On the basis of the complaint, if there is reason to believe that there is a violation of the licensing regulatory or accrediting body, or to the National Privacy Commission, for
Privacy Guidelines, the Board shall request, in writing, the respondent to appear before it, appropriate action, if necessary.
furnishing the said respondent a copy of the complaint, and requiring the submission of a 9. The minutes of the proceeding shall be filed and maintained.
counter-affidavit within ten days from receiving the said request.
2. If the counter-affidavit contains personal and sensitive information involving third 2.9. Procedure if the Respondent does not Appear.
parties, which information will be disclosed to the Board, the respondent shall include If the Respondent does not appear before the Board, the Board shall resolve the complaint on the
proof that consent of said parties have been obtained with regard to the use, access and basis of the affidavits and documents submitted by the complainant. Its resolution, with
disclosure of said personal or sensitive information for purposes of resolving or supporting documents shall be submitted to the proper licensing regulatory or accrediting body,
adjudicating the complaint, before appropriate bodies. or to the National Privacy Commission, for appropriate action, if necessary.
3. If the respondent appears before the Board, the respondent, or in case of juridical person
by a duly authorized representative, shall be asked to sign and undertaking, under oath or 3. Resolution.
embodied in an affidavit, to the effect that the respondent agrees to abide by the final The Board shall furnish the parties with copies of its resolution.
resolution of the National Health Privacy Board, without prejudice to other legal
remedies.
Rule 17
2.8. Procedure if the Respondent Appears.
Penalty Clause
1. The Board shall set a date to convene the parties involved in the complaint, sending
notices to the parties, and requesting for them to appear before the National Health Data 1. Penalties to be imposed shall be in accordance with the Penalty Clause provided in the Joint
Privacy Board, with their witnesses, if any. DOH-DOST-PhilHealth Administrative Order on the Privacy Guidelines for the Implementation
2. The Board shall ensure that before it convenes the parties: of the Philippine Health Information Exchange.
3. Both complainant and respondent have signed and undertaking that they agree to be
bound by the Resolution of the Board.
4. Proof that consent have been obtained from third parties when the affidavits or submitted
evidence includes their personal and sensitive information, for purposes of resolving or
adjudicating the complaint, before appropriate bodies.
5. The Board may ask clarificatory questions when necessary.
6. The Board shall identify the issues for resolution and mediate in order for the parties to
reach an amicable settlement. In case the parties reach an amicable settlement, the Board ANNEX 1.0
shall issue a resolution on the agreement between parties, which shall be binding in view REFERENCES:
of their undertaking. Even if the parties have reached an amicable settlement, but the
Board finds that the complaint constitutes a violation of law, it shall prepare a report and  AO 2016-0002- Privacy Guidelines for the Implementation of the Philippine Health
recommendation, and submit the same to the proper licensing regulatory or accrediting Information Exchange
body, or to the National Privacy Commission.  Data Protection Act of 1998
7. In case the parties are unable to reach an amicable settlement, the complaint shall be  HIPAA Privacy Rule
submitted for resolution. The Board may request the parties to submit a memorandum  Philippine eHealth Strategic Framework and Plan
containing their arguments on the facts and issues for resolution.  Philippine Health Information Exchange Architecture
8. The Board shall adjudicate on the issues and issue a resolution containing its  R.A. 10173- Data Privacy Act of 2012
recommendation. The resolution shall be binding on the parties in view of their  Aguilar, R. (2015). Social Media and Medical Professionalism: A Manifesto from
undertaking. Its resolution, with supporting documents shall be submitted to the proper #HealthXPh. Retrieved from http://healthxph.net/manifesto
Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the Health Privacy Code Specifying the Joint A.O. No. 2016-0002, “Privacy Guidelines for the
Implementation of the Philippine Health Information Exchange.” Implementation of the Philippine Health Information Exchange.”

 Australian Commission on Safety and Quality in Health Care, Framework for Australian  Wiles,R., Prosser,J., Bagnoli A., Clark A., Davies K., Holland, S., Renold E., (2008).
clinical quality registries. Sydney. ACSQHC, March 2014. Visual Ethics: Ethical Issues in Visual Research. Retrieved from
 British Medical Association. Using Social Media: Practice and Ethical Guidance for http://eprints.ncrm.ac.uk/421/1/MethodsReviewPaperNCRM-011.pdf
Doctors and Medical Students. Retrieved from http://www.bma.org.uk/support-at-
work/ethics/medical-students-ethics-tool-kit/students-and-social-media
 Department of Health, NCHFD. (2010). Hospital Health Information Management
Manual 3rd Edition, Manila, PH : Department of Health.
 C.Evans., D. Laggui., A. Salvador., (2013). Information Security Incident Response
Manual DOST-ICTO.
 Gliklich, RE. Dreyer, NA. eds. (2007) Registries for Evaluating Patient Outcomes: A
User’s Guide. AHRQ Publication No. 07- EHC001-1. Rockville, MD: Agency for
Healthcare Research and Quality.
 Grance, T., Jansen, W. (2011). Guidelines on Security and Privacy in Public Cloud
Computing. Retrieved from
http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-144.pdf
 Grant Thornton (2013). Third-Party Relationships and Your Confidential Data. Assessing
Risk and Management Oversight Processes. Retrieved from
https://www.grantthornton.com/~/media/content-page-files/health-care/pdfs/2013/HC-
2013-AIHA-wp-HIPAA-rule-data-control-concerns.ashx
 Health Information Technology for Economic and Clinical Health Act. (2009). Retrieved
from
https://www.healthit.gov/sites/default/files/hitech_act_excerpt_from_arra_with_index.pdf
 Herold R., Beaver K. (2015). The Practical Guide to HIPAA Privacy and Security
Compliance. 2nd edition. Boca Raton, FL: CRC Press.
 Hosek S., Straus S. (2013). Patient Privacy, Consent and Identity Management in Health
Information Exchange. Issues for the Military Health System. Santa Monica, CA: RAND
Corporation.
 National Council of State Boards of Nursing. A Nurse's Guide to the Use of Social
Media. Retrieved from https://www.ncsbn.org/NCSBN_SocialMedia.pdf
 Newton, J., Garner, S., Disease Registers in England. (Feb 2002). Institute of Health
Sciences,
 Office of Civil Rights Headquarters. Health Information Privacy. Retrieved from
http://www.hhs.gov/hipaa/index.html.
 Patdu, I. (2016). Recommendations for Social Media Use in Hospitals and Health Care
Facilities. Philippine Journal Of Otolaryngology Head And Neck Surgery, 31(1), 6-9.
doi:10.3860/pjohns.v31i1.3548
 PHIC Human Resources Security document.
 World Health Organization. Definition and Typology of Violence. Retrieved from
http://www.who.int/violenceprevention/approach/definition/en/