Privacy Wiki

• Use and disclosure of health information shall only be to the extent of consent given by the patient and for the following purposes:
  a. For planning of quality services.
  b. DOH reporting intervention and disease prevention.
  c. Continuing care to patients.
  d. Requirements and reporting for communicable and notifiable diseases as well as those with serious health and safety threat to the public such as, but not limited to:
  Meningitis
  Food poisoning (mass)
  Breakthrough epidemic of contagious disease
  Biological or chemical warfare
  Anthrax
  Emerging and re-emerging diseases
  Ebola
  e. Reporting of serious and less serious physical injury.
  f. Reporting of maltreated or abused child to proper authorities.
  g. Mandatory reporting required by licensing and accreditation bodies (DOH, PhilHealth, etc). A list of mandatory requirements shall be stipulated.
  
• In the context of privilege communication, both patient and physician must provide consent for its use and disclosure otherwise, information shall not be released.
  
• After discharge from the hospital the following information can be disclosed:
  a. Clinical abstract
  b. Laboratory result
  c. Doctor's order
  d. Discharge summary
  
• The health facility shall continue keeping the patient's health records and shall have the power to limit access regarding the data to be disclosed.
  
• The PHCP has the authority to disclose information upon patient request for his legitimate personal use such as:
  a. Release of insurance/HMO required medical record;
  b. For patients who are U.S. war veterans, they should come with a signed consent to release medical records;
  c. However, there should be a clear agreement/contract made between HMO and patient to stipulate the consent of the patient enrolled in the HMO.
  

Use and disclosure of health information by a 3rd party:

• The person to issue the order for the use and disclosure of health information to DOH shall be identified.
  
• A process on how to disclose medico-legal cases should be defined. PNP Duces Tecum shall be honored and complied with, if signed by the head of the agency.
  
• As a general rule, before a disclosure is to be made to any other government agency, there must be a court order. It is only in cases of emergency such as that provided in Sec.15, where disclosure can be done without court order. This would be situations where time is of the essence. The situations contemplated are:
  

a. For PNP subpoena, obtain consent of patient before death otherwise, consent should be obtained from next of kin.
b. For medical/financial assistance requesting abstracts or similar documents; authorization of patient is required.

• Unless there is a valid court order, patient records shall not be released or disclosed. Without a court order, release of information shall be pursuant to hospital policy.
  
• All research protocols pertaining to patient condition shall pass thru strict review by the IRB (Institutional Review Board) to safeguard patient information. Protocols for requesting and accessing aggregate and de-identified information for research, both public and private, should be clearly defined.
  
• Guidelines for retrieval of information for purposes of PRC requirements for application abroad should be made.
• For facilities that are not participating in PHIE, they shall:

a. Make a workflow and a notification protocol for reporting requirements. (Suggestion: to use the present epidemiologic surveillance framework)
b. Immediately notify the RESU (using the present framework) then the DOH will notify the EMR, the EMR to the facility. The EMR must have codes which gives them the signal to release the information.

• A non-disclosure clause shall be included in the contract of the schools with affiliations to a health facility.
  

Others:

• There should be an orientation for patients regarding data privacy disclosure.
  
• In case of a deceased patient separated with his/her partner but not legally separated and the partner is requesting for patient's health record for purposes of claims, what is the rule for disclosure?
  

(Disclosure of health information of a deceased shall be to the authorized legal representative.)

• Consolidated Workshop Outputs