Lesson 8. Policies, Laws and Guidelines in Nursing Informatics
Lesson 8. Policies, Laws and Guidelines in Nursing Informatics
Lesson 8. Policies, Laws and Guidelines in Nursing Informatics
TRADEMARKn
• A trademark is a tool used to differentiate services • The data privacy encompasses the rights of
and goods from one another. individuals and obligations of organization with
• Form of a word or a group of words; a sign, logo, or respect to the collection, storage, use, disclosure,
symbol or a combination of those above. retention and disposal of personal data (across the
• The following are its importance: data lifecycle).
o Essential in marketing products or services
o It will help consumers identify brand TWO MOST IMPORTANT PROVISIONS OF RA 10173n
o The owner of the trademark would have 1. Criteria for Lawful Processing of Personal
exclusive rights & it will ensure that no one else Information [Section 12 of Data Privacy Act]
can use the same 9 If an organization is given a confidential
information about a client, then that
COPYRIGHT organization shall not share it to others.
• It refers to the protection given to the owner of an 2. Sensitive Personal Information and Privileged
original work covering literary works, musical Information [Section 13 of Data Privacy Act]
pieces, paintings, and computer programs, among
others. WHAT DOES IT PROTECT?
• Once the owner receives the rights to his work, PERSONAL DATA
unauthorized third parties are prohibited from PERSONAL INFORMATION
selling or distributing the works, especially for trade • Any information whether recorded in a material
purposes. form or not, from which the identity of an individual
is apparent or can be reasonably and directly
ECONOMIC RIGHTS ascertained by the entity holding the information or
• It enables the creator to receive profit gains should when put together with other information would
his works be distributed by third parties. directly and certainly identify an individual.
Note.
• All processing of sensitive and personal
information is prohibited except:
o Consent of the data subject
o Pursuant to law that does not require consent
SENSITIVE PERSONAL INFORMATION (BASED ON IRR)n • Photocopiers re-sold without wiping the hard drives
• Social security number • Password hacked/revealed -
• License or its denials, suspension or revocation • Accidentally sent an email attachment –
• Tax returns Unauthorized Disclosure
• Other personal information issued by government
agencies OTHER VIOLATIONS/DATA PRIVACY ACT PRINCIPLES
• Bank and credit/debit card numbers • No Data Sharing Agreement (DSA)
• Websites visited • No Privacy Notice
• Materials downloaded • No Sub-contracting Agreement
• Any other information reflecting preferences and • No Breach Drill
behaviors of an individual • Profiling of customers of malls – Targeted Marketing
• Grievance information • Unjustifiable collection of personal data of a school
• Discipline information – Principle of Proportionality
• Leave of absence reason
DATA PRIVACY PRINCIPLES IN THE PHILIPPINESn
POTENTIAL PENALTIES LISTED IN THE DATA PRIVACY ACT TRANSPARENCY (THE “CONSENT” REGIME)
• A data subject must be aware of the nature, purpose,
and extent of the processing of his or her personal
data, including the risks and safeguards involved,
the identity of personal information controller, his
or her rights as a data subject, and how these can be
exercised. Any information and communication
relating to the processing of personal data should be
easy to access and understand, using clear and plain
language.
o The data subject must know ther risks and
EXAMPLES OF POTENTIAL BREACHES AND SECURITYn benefits of the agreement to be made.
nINCIDENTS INVOLVING PERSONAL INFORMATIONn
POTENTIAL BREACHES LEGITIMATE PURPOSEn
• Bank – Consent form • The processing of information shall be compatible
• Hospital and School Records – Storage and Disposal with a declared and specified purpose, which must
Policy not be contrary to law, morals, or public policy.
• Student transferred - Without Consent
PROPORTIONALITY
• Clinical record of a student to disclose with her
• The processing of information shall be adequate,
parents - Consent
relevant, suitable, necessary, and not excessive in
• List of top students/passers - Consent
relation to a declared and specified purpose.
• Cedula in Malls – Disposal Policy/Improper Disposal
Personal data shall be processed only if the purpose
• Security issues in buildings – logbook
of the processing could not reasonably be fulfilled
• Use of re-cycled papers – Disposal Policy / Access
by other means.
due to negligence
• Hard drives sold online –Disposal Policy Note.
• Use of CCTV – Privacy Issues • Avoid this mentality:
• Use of USB/CD/Personal laptop – Encryption issue o “Just in case we need it.”
o “This is what we always do.”
ACCESS CONTROL AND SECURITY POLICYn
• Personal Records stolen from home of an employee
- Security
nRECOMMENDATION: HOLDING DATA AND KEEPING IT UP-n
• Viewing of Student Records in Public – Physical
TO-DATEn
Security
• Carry out an information audit at least annually.
• Raffle stubs – Privacy Notice / Storage and Disposal
o Write a letter at the start of each school year
Policy
asking parents and students to check that their
• Universities and Colleges websites with weak
details are correct. This also helps prevent
authentication
emergency risks (e.g. if an old address or phone o Concise, transparent, intelligible and in and
number is on record). easily accessible forms using clear and plain
o Check that ‘live’ files are accurate and up to language.
date.
o Any time you become aware that information PRIVACY NOTICE (SAMPLE INTRODUCTION)n
needs amending, do so immediately • Your personal data and privacy are important to us,
o Any personal data that is out of date or no which is why we at (name of organization) would like
longer needed should be ‘destroyed’. This may our customers/clients/constituents to know
involve shredding documents or deleting through this notice how we handle and protect the
computer files securely so that they cannot be personal information you provide to us.
retrieved.
o Organizations must follow the disposal of CONSENTn
records schedule. This schedule states how • Consent of the data subject means: "any freely
long certain types of personal data can be held given, specific, informed and unambiguous
for until it must be destroyed. Some indication of the data subject's wishes by which he
stipulations are legal obligations while others or she, by a statement or by a clear affirmative
are best practice. action, signifies agreement to the processing of
personal data relating to him or her"
Remember! • The data subject agrees to the collection and
• You are violating the Data Privacy Act if you keep processing of personal information
any data for longer than it is needed. o Freely given
o Specific
PRIVACY NOTICE o Informed indication of will
• It is a front facing document that demonstrates an • Evidenced by written, electronic or recorded means:
organization's commitment to transparency and • signature
fairness when carrying out data processing o opt-in box/clicking an icon
activities. o sending a confirmation email
o The organization will somehow show a head- o oral confirmation(recorded)
ups or notice for consent in order for the client • Opt-in; silence, pre-ticked boxes or inactivity does
to know why a certain data is necessary. not constitute consent
• It is also known as privacy statement. • “Implied, implicit or negative consent is not
recognized under the law. Thus, a company policy
CONTENTS OF PRIVACY NOTICE that merely stipulates that the inputting of
1. Who is the entity in control of the processing (i.e., requested personal information amounts to consent
Personal Information Controller or PIC)? or a waiver by a data subject of his or her data
2. What personal data are being collected or generated privacy rights shall not be considered as valid
3. What is the purpose of the processing? consent, as required under the DPA”. (AdOp No.
4. Who has access to the data? 2017-007)
5. With whom are the data shared, if at all? • It is freely given, specific and informed.
6. How long will the data be retained? o Consent means giving data subjects genuine
9 In addition, it should also feature a statement choice and control over how a PIC uses their
on the rights of data subjects and how these data. This means data subjects must be able to
can be exercised. Then, of course, the contact refuse consent, and must be able to withdraw
information of the PIC should be right there in consent easily at any time.
the mix, too. o It also means consent should be unbundled
from other terms and conditions (including
PRIVACY NOTICE AND INFORMATION giving granular consent options for different
• You must give notice that: types of processing) wherever possible.
o Provides details of the grounds that are used to • In giving consent, it is very much important to take
justify processing in mind to know your risk in giving information
o Highlights that consent may be withdrawn, the o “The determination of the appropriate level of
existence of the data subject rights and the security under this section must take into
right to lodge a complaint with the Supervisory account the nature of the personal information
Authority to be protected, the risks represented by the
processing, the size of the organization and acquisition is likely to give rise to a real risk of
complexity of its operations, current data serious harm to any affected data subject.”
privacy best practices and the cost of security
implementation” [Section 20.C of DPA of 2012] SECTION 30n
• “Concealment of Security Breaches Involving
CONSENT OF DATA SUBJECT Sensitive Personal Information. –– The penalty of
• Express and Specific imprisonment of one (1) year and six (6) months to
• Time-bound five (5) years and a fine of not less than Five hundred
• Documented thousand pesos (Php500,000.00) but not more than
• Specifies the purpose One million pesos (Php1,000,000.00) shall be
• Confirms data sharing imposed on persons who, after having knowledge of
a security breach and of the obligation to notify the
EXAMPLES OF PROCESSING WHICH MAY NOT NEEDn Commission pursuant to Section 20(f), intentionally
CONSENTn or by omission conceals the fact of such security
breach.
TYPES OF BREACH
• According to Section 20(A) of RA 10173, “The
personal information controller must implement
reasonable and appropriate organizational,
physical and technical measures intended for the
protection of personal information against any
accidental or unlawful destruction, alteration and
disclosure, as well as against any other unlawful
processing.
Note. Please check SLIDE 36-37 for visual examples of AVAILABILITY BREACH
consent. • Due to loss, accidental or unlawful destruction of
personal data
DATA SHARING
• It is the disclosure or transfer to a third party of CONFIDENTIALITY BREACHn
personal data under the control or custody of a • Due to the unauthorized disclosure of, or access to,
Personal Information Controller (PIC) personal data
SALIENT FEATURES
SECTION 6-13
• It gives legal recognition of electronic data
messages, electronic documents, and electronic
signatures.
SECTION 16n
• Allows the formation of contracts in electronic form.
• Makes banking transactions done through ATM
switching networks absolute once consummated.
SECTION 24
• Parties are given the right to choose the type and
level of security methods that suit their needs.
SECTION 25-26n
• Provides the mandate for the electronic
implementation of transport documents to facilitate
WHAT HAPPENS IN AN INTERNET MINUTE (2019)n carriage of goods (airport, road, rail, inland
waterway, courier, post receipts, transport
documents issued by freight forwarders,
marine/ocean bill of lading, etc.) [section 25 and 26]
SECTION 27
• Mandates the government to have the capability to
do e-commerce within 2 years or before June 19,
2002.
SECTION 28n
• Mandates RPWeb to be implemented (strategy that
intends to connect all government offices to the
Internet and provide universal access to the general
public thru the DOTC [now DICT]
• Made cable, broadcast, and wireless physical
infrastructure within the activity of
telecommunications.
SECTION 29 • To replay the same for any other person or persons;
• Empowers the DTI to supervise the development of or to communicate the contents thereof, either
e-commerce in the country. verbally or in writing, or to furnish transcriptions
thereof, whether complete or partial, to any other
SECTION 30n person.
• Provided guidelines as to when a service provider
can be liable. CYBERCRIME PREVENTION ACT OF 2012 (RA 10175)
• It is an act defining cybercrime, providing for the
SECTION 31-32 prevention, investigation, suppression and the
• Authorities and parties with the legal right can only imposition of penalties therefor and for other
gain access to electronic documents, electronic data purposes
messages, and electronic signatures [confidentiality • It specifically criminalizes computer crime
purposes]. • To address legal issues concerning online
interactions and the Internet in the Philippines.
SECTION 33n • Among the cybercrime offenses: cybersquatting,
• Hacking or cracking (unauthorized access including cybersex, child pornography, identity theft, illegal
the introduction of computer viruses - punishable by access to data and libel.
fine & imprisonment). • Former laws did not provide a legal basis for
• Piracy through the use of telecommunication criminalizing crimes committed on a computer in
networks, such as the Internet, that infringes general.
intellectual property rights is punishable. o For example: Onel de Guzman, the computer
• All existing laws such as the Consumer Act of the programmer charged with purportedly writing
Philippines also applies to e-commerce the ILOVEYOU computer worm, was ultimately
transactions. not prosecuted by Philippine authorities due to
a lack of legal basis
ANTI WIRETAPPING LAW [1965] (RA 4200)n
• It is an act to prohibit and penalize wiretapping and OFFENSESn
other related violations of the privacy of • Illegal access (hacking)
communication, and for other purposes • Data interference
• With mobile technology, the average person can • Device misuse
now record a documentary, or even an explosive • Cybersquatting
exposé, merely using one’s mobile phone, with • Computer-related offenses such as computer fraud
crystal clear picture and sound • Content-related offenses such as cybersex and
• If conversation was intended to be between you and spam, and other offenses.
that person only (or between the two persons to the • It reaffirms existing laws against child pornography
conversation only), and without his or her (or both (offense under RA 9775 - Anti-Child Pornography Act
parties’) express consent, you may be liable for of 2009)
wiretapping. • Libel, an offense under Section 355 of the Revised
Penal Code (RPC), also criminalizing them when
SECTION 1 AND 4 committed using a computer system.
• Unlawful for any person, not being authorized by all • Act includes a "catch-all" clause, making all offenses
the parties to any private communication or spoken currently punishable under the RPC also punishable
word, to tap any wire or cable, or by using any other when committed using a computer
device or arrangement, to secretly overhear,
intercept, or record such communication or spoken RULES OF NETIQUETTE
word by using a device commonly known as a • Netiquette, or network etiquette, is concerned with
dictaphone or dictagraph or detectaphone or the "proper" way to communicate in an online
walkie-talkie or tape recorder. environment.
• Unlawful for any person, be he a participant or not
in the act or acts penalized in the next preceding [RULE 1] REMEMBER THE HUMAN
sentence, to knowingly possess any tape record, • When communicating electronically, whether
wire record, disc record, or any other such record, or through email, instant message, discussion post,
copies thereof, of any communication or spoken text, or some other method, practice the Golden
word.
Rule: “Do unto others as you would have others do [RULE 6] SHARE EXPERT KNOWLEDGE
unto you”. • The Internet offers its users many benefits; one is the
o Remember, your written words are read by real ease in which information can be shared or accessed
people, all deserving of respectful and in fact, this "information sharing" capability is
communication. one of the reasons the Internet was founded.
• Before you press "send" or "submit," ask yourself, o So, in the spirit of the Internet's "founding
"Would I be okay with this if someone else had fathers," share what you know.
written it?" • When you post a question and receive intelligent
answers, share the results with others
[RULE 2] ADHERE TO THE SAME STANDARDS OF BEHAVIORn o Post resources and references about your
nONLINE THAT YOU FOLLOW IN REAL LIFE subject matter.
• While it can be argued that standards of behavior
may be different in the virtual world, they certainly [RULE 7] HELP KEEP FLAME WARS UNDER CONTROL
should not be lower. • "Flaming is what people do when they express a
• You should do your best to act within the laws and strongly held opinion without holding back any
ethical manners of society whenever you inhabit emotion."
"cyberspace." o Flame war is a lengthy exchange of angry or
abusive messages between users of an online
[RULE 3] KNOW WHERE YOU ARE IN CYBERSPACE forum or other discussion area
• "Netiquette varies from domain to domain." (Shea, • When two or three people exchange angry posts
1994) between one another, must be controlled or the
• Depending on where you are in the virtual world, the camaraderie of the group could be compromised.
same written communication can be acceptable in • Don't feed the flames; extinguish them by guiding
one area, where it might be considered the discussion back to a more productive direction.
inappropriate in another.
• What you text to a friend may not be appropriate in [RULE 8] RESPECT OTHER PEOPLE'S PRIVACY
an email to a classmate or colleague. • Depending on what you are reading in the virtual
world, be it an online class discussion forum,
[RULE 4] RESPECT OTHER PEOPLE'S TIME ANDn Facebook page, or an email, you may be exposed to
nBANDWIDTHn some private or personal information that needs to
• Electronic communication takes time: time to read be handled with care.
and time in which to respond. • Just as you expect others to respect your privacy, so
• Most people today lead busy lives, just like you do, should you respect the privacy of others.
and don't have time to read or respond to frivolous
emails or discussion posts. [RULE 9] DON'T ABUSE YOUR POWER
o As a virtual world communicator, it is your • Just like in face-to-face situations, there are people
responsibility to make sure that the time spent in cyberspace who have more "power" than others.
reading your words isn't wasted. • Just remember, knowing more than others do or
• Make your written communication meaningful and having more power than others may have does not
to the point, without extraneous text or superfluous give you the right to take advantage of anyone.
graphics or attachments that may take forever to
download. [RULE 10] BE FORGIVING OF OTHER PEOPLE'S MISTAKES
• Not everyone has the same amount of experience
[RULE 5] MAKE YOURSELF LOOK GOOD ONLINE working in the virtual world.
• One of the best things about the virtual world is the • If it's a minor "offense," you might want to let it slide.
lack of judgment associated with your physical • If you feel compelled to respond to a mistake, do so
appearance, sound of your voice, or the clothes you in a private email
wear
• Keep the following tips in mind:
o Always check for spelling and grammar errors
o Know what you're talking about and state it
clearly
o Be pleasant and polite