Privacy Wiki

• Use and disclosure of health information shall only be to the extent of consent given by the patient and for the following purposes:
  a. For planning of quality services.
  b. DOH reporting intervention and disease prevention.
  c. Continuing care to patients.
  d. Requirements and reporting for communicable and notifiable diseases as well as those with serious health and safety threat to the public such as, but not limited to:
  Meningitis
  Food poisoning (mass)
  Breakthrough epidemic of contagious disease
  Biological or chemical warfare
  Anthrax
  Emerging and re-emerging diseases
  Ebola
  e. Reporting of serious and less serious physical injury.
  f. Reporting of maltreated or abused child to proper authorities.
  g. Mandatory reporting required by licensing and accreditation bodies (DOH, PhilHealth, etc). A list of mandatory requirements shall be stipulated.
  
• In the context of privilege communication, both patient and physician must provide consent for its use and disclosure otherwise, information shall not be released.
  
• After discharge from the hospital the following information can be disclosed:
  a. Clinical abstract
  b. Laboratory result
  c. Doctor's order
  d. Discharge summary
  
• The PHCP has the authority to disclose information upon patient request for his legitimate personal use such as:
  a. Release of insurance/HMO required medical record;
  b. For patients who are U.S. war veterans, they should come with a signed consent to release medical records;
  c. However, there should be a clear agreement/contract made between HMO and patient to stipulate the consent of the patient enrolled in the HMO.
  

Use and disclosure of health information by a 3rd party:

• A specified person/staff in DOH shall be appointed to issue the order for the use and disclosure of health information.
  
• Before a disclosure is made to any other government agency, there must be a court order. It is only in cases of emergency such as that provided in Sec. 15, where disclosure can be done without court order. This would be situations where time is of the essence such as:
  

a. For PNP subpoena, obtain consent of patient before death otherwise, consent should be obtained from next of kin.
b. For medical/financial assistance requesting abstracts or similar documents, authorization of patient is required.

• Patient records shall not be released or disclosed without a valid court order. Without a court order, release of information shall be pursuant to hospital policy.
  
• Disclosure of health information of a deceased individual shall be to the authorized legal representative.
  
• A process on how to disclose medico-legal cases should be defined. PNP Duces Tecum shall be honored and complied with if signed by the head of the agency.
• All research protocols pertaining to patient condition shall pass thru strict review by the Institutional Review Board to safeguard patient information. Protocols for requesting and accessing aggregate and de-identified information for research, both public and private, should be clearly defined.
  
• Guidelines for retrieval of information for purposes of PRC requirements shall be made.
  
• A non-disclosure clause shall be included in the contract of the schools with affiliations to a health facility.
• For facilities not participating in PHIE, they shall:
  

a Make a workflow and a notification protocol for reporting requirements (Suggestion: to use the present epidemiologic surveillance framework).
b. Immediately notify the RESU (using the present framework) then the DOH will notify the EMR, the EMR to the facility. The EMR must have codes which gives them the signal to release the information.

• Patient orientation regarding data privacy disclosure shall be done.

• Consolidated Workshop Outputs