The Department of Health (“DOH”) and the National Privacy Commission (“NPC”) issued Joint Memorandum Circular No. 2020-0002 providing for guidelines on the application of data protection and data privacy principles in the collection, processing, and disclosure of COVID-19 data. This alert sets forth its salient features.

Scope and Coverage

The Joint Memorandum Circular applies to the implementation of the COVID-19 disease surveillance and response and shall cover the following:

  • All public and private, national and local healthcare providers regulated by the DOH and Philippine Health Insurance Corporation
  • National and local public health authorities
  • DOH partner agencies involved in the collection and processing of COVID-19-related data
  • All COVID-19 cases
  • All individuals identified as close contacts*

* A close contact is any person who may have come into contact with the probable or confirmed case 2 days prior to onset of illness of the confirmed COVID-19 case until the time that said cases test negative on laboratory confirmation or other approved laboratory test.

General Guidelines

  1. The implementation of COVID-19 disease surveillance and response shall promote public health action to contain and/or prevent the spread of COVID-19 and help mitigate the effects and impact of the disease to the people and communities, while safeguarding the data privacy rights of every individual.
  2. The processing of personal health information of COVID-19 cases and identified close contacts is allowed:
    • to outline a true picture of the country’s COVID-19 health situation;
    • to build a repository of real-time COVID-19 related data as basis of evidence-informed health policy and intervention measures;
    • to support case investigation and management, contact tracing and monitoring, quarantine and isolation, mandatory reporting to national and local public health authorities, and other disease surveillance-related activities;
    • to improve response activities, including the quality and accessibility of health services and other related interventions for COVID-19; and
    • to allow information sharing and exchange between and among healthcare providers, public health authorities, and other government authorities for treatment coordination, and/or surveillance and response purposes.
  3. The right to privacy of health information shall be protected at all times. The processing of personal health information of COVID-19 cases and identified close contacts shall be in accordance with RA 10173 or the Data Privacy Act, its IRR, and other relevant issuances from the NPC, and shall adhere to the principles of transparency, legitimate purpose, and proportionality:
    • Patients/close contacts (data subjects) shall have the right to adequate information on matters relating to the processing of their health information, including the nature, purpose, and intended use of processing.
    • Health information shall be processed fairly and lawfully.
    • The processing of health information shall involve only the minimum extent of personal data necessary to the declared and specified purpose at the time of collection.
  4. All national and local public health authorities, concerned healthcare providers and DOH partner agencies involved in the collection and processing of COVID-19 related data shall put in place the minimum organizational, physical, and technical security measures and standards for data protection as set by the NPC and Department of Information and Communications Technology, and shall uphold and protect the data privacy rights of every individual at all times.
  5. The Circular shall serve as the privacy notice of national and local public health authorities, and DOH partner agencies in the collection, processing, and disclosures of COVID-19-related data in pursuit of disease surveillance and response.

Specific Guidelines

A. Processing of Health Information

The processing of personal health information on COVID-19 cases and identified close contacts is allowed in the following cases:

  • National and local public health authorities — pursuant to its constitutional and statutory mandate under RA 11332, the Data Privacy Act, and other laws.
  • Healthcare providers — if necessary for the purposes of case investigation and management, contact tracing and monitoring, quarantine and isolation, mandatory reporting to public health authorities, or treatment and coordination purposes.
  • DOH partner agencies and their authorized personnel — pursuant to a Data Sharing Agreement involving government agencies and subject to the signing of a Non-Disclosure Agreement by all personnel authorized by DOH partner agencies to collect and process personal heath information.
  • Personal information are pseudonymized or anonymized.

In processing personal health information, the following must be observed:

  • Data subjects must be informed of the nature and purpose of the collection and processing;
  • The manner of processing shall be in accordance with the guidelines under DOH AO 2020-0013 and DOH DM 2020-0189 (see the note on referenced issuances below); and
  • Personal health information of all COVID-19 cases and close contacts as identified by concerned healthcare providers, public health authorities, and DOH partner agencies during case investigation and contract tracing must be reported to the DOH and its designated/deputized public health authorities.

B. Access to Health Information

The following may access personal health information of COVID-19 cases and identified close contacts:

  • Concerned healthcare providers
  • Public health authorities
  • DOH partner agencies and their authorized personnel

All entities and individuals with access to the personal health information shall be bound by the duty to protect the personal health information pursuant to these Guidelines.

C. Use of Health Information

  • The use of personal health information shall be limited to the purposes specified in the General Guidelines.
  • The use of personal information for other purposes not indicated in the General Guidelines shall be prohibited.
  • All concerned healthcare providers, public health authorities, and DOH partner agencies and their authorized personnel shall be responsible for limiting the use of personal health information stored within their location to the purpose specified at the time of collection.

D. Disclosure of Health Information

Personal health information may only be disclosed to authorized entities, officers, personnel, and concerned individuals pursuant to the purposes provided under the General Guidelines.

  • Disclosure to the public, the media, or any other public-facing platform without the written consent of the patient or his authorized representative or next of kin, is prohibited.
  • Any disclosure by national and local public health authorities to third parties shall be embodied in a Data Sharing Agreement.
  • DOH partner agencies must secure the prior written consent of the DOH to disclose personal health information to third parties, and the disclosure must be embodied in a Data Sharing Agreement.

The following information may be disclosed for a legitimate purpose:

  • Aggregate health information, pseudonymized or anonymized detailed health information for pubic communication; and
  • Mandatory reporting requirements, which must only be disclosed to national/local public health authorities and DOH partner agencies.

Registration

All Information and Communications Technologies (ICT) solutions and technologies used for collection and processing of personal health information of COVID-19 cases and/or identified close contacts shall be registered with the NPC.

They must likewise comply with the COVID-19 surveillance and response protocols and data requirements.

Penal Provisions

  • Non-cooperation of any individual to disclose truthful and accurate information regarding their health condition and exposure to public health authorities and/or DOH partner agencies, or of any individual or entity that should report and/or respond to COVID-19 surveillance, or any similar action insofar as they relate to the provisions of the Joint Memorandum Circular shall be penalized in accordance with RA 11332, RA 11469 and other applicable laws, rules and regulations.
  • Any privacy violation, personal data breach or security incident shall be penalized in accordance with the Data Privacy Act an other applicable laws, rules, and regulations.

Note on Referenced Issuances

DOH Administrative Order No. 2020-0013 and DOH Department Memorandum No. 2020-0189

Public health authorities, healthcare providers, and DOH partner agencies must follow DOH Administrative Order No. 2020-0013 in reporting COVID-19 cases. The administrative order provides for the guidelines on the mandatory reporting to the DOH of COVID-19 cases.

DOH Department Memorandum No. 2020-0189 on the other hand provides for guidelines on contact tracing of close contacts of confirmed COVID-19 cases. Contact tracing is defined as the identification, listing, and follow-up of persons who may have come into close contact with a confirmed COVID-19 case.

Originally published on DFDL.