Dear PAO,

I have been closely monitoring recent news about the diseases affecting our country. I am curious why the identities of the infected patients are not being disclosed. Perhaps it would greatly help the contact tracing of other possible close contacts if the identities of the patients are published. Is it legal to disclose these details?

Jasmine

Dear Jasmine,

The State acknowledges that epidemics and other public health emergencies pose risks to public health and national security, potentially disrupting the social, economic, and political functions of the State. The government continuously works to protect the population from public health threats by implementing efficient and effective disease surveillance for notifiable diseases.

Republic Act (RA) 11332, otherwise known as the Law on Reporting of Communicable Diseases, outlines the roles of the Department of Health (DoH) and other institutions in the monitoring of these diseases. However, a balance must be struck between the right of the public to know and the right of the patients against unauthorized disclosure of confidential information. Section 9 of the said law enumerates the prohibited acts, particularly:

“Section 9. Prohibited Acts. -The following shall be prohibited under this Act:

“(a) Unauthorized disclosure of private and confidential information pertaining to a patient’s medical condition or treatment;

“(b) Tampering of records or intentionally providing misinformation;

“(c) Non-operation of the disease surveillance and response systems;

“(d) Non-cooperation of persons and entities that should report and/or respond to notifiable diseases or health events of public concern; and

“(e) Non-cooperation of the person or entities identified as having the notifiable disease, or affected by the health event of public concern.

“Disclosure of confidential information will not be considered violation of this Act under this section if the disclosure was made to comply with a legal order issued by a court of law with competent jurisdiction.”

To answer your question directly, it is explicitly prohibited by law to disclose the private and confidential information pertaining to a patient’s medical condition or treatment to the public. This information includes the identity of the patient unless it is given permission by the patient himself or herself. However, this prohibition shall not apply if there is a court order directing the disclosure of such information.

Any violation committed by a person found to be guilty of any of the above-mentioned prohibited acts may result in imposition of appropriate fines or imprisonment and other penalties. According to Section 10 of the same law:

“Section 10. Penalties. -Any person or entity found to have violated Section 9 of this Act shall be penalized with a fine of not less than Twenty thousand pesos (P20,000.00) but not more than Fifty thousand pesos (P50,000.00) or imprisonment of not less than one (1) month but not more than six (6) months, or both such fine and imprisonment, at the discretion of the proper court.

“The Professional Regulation Commission shall have the authority to suspend or revoke the license to practice of any medical professional for any violation of this Act.

“The Civil Service Commission shall have the authority to suspend or revoke the civil service eligibility of a public servant who is in violation of this Act.

“If the offense is committed by a public or private health facility, institution, agency, corporation, school, or other juridical entity duly organized in accordance with law, the chief executive officer, president, general manager, or such other officer in charge shall be held liable. In addition, the business permit and license to operate of the concerned facility, institution, agency, corporation, school, or legal entity shall be cancelled.”

Moreover, under Section 3(l)(2) of the Data Privacy Act of 2012 ( Republic Act No. 10173) health information is considered as sensitive personal information and under Sections 31 and 32 of the said law Malicious and Unauthorized Disclosure of sensitive personal information is punishable with imprisonment and fine.

We hope that we were able to answer your queries. This advice is based solely on the facts you have narrated and our appreciation of the same. Our opinion may vary when other facts are changed or elaborated.

Editor’s note: Dear PAO is a daily column of the Public Attorney’s Office. Questions for Chief Acosta may be sent to [email protected]