Almost everything a health provider holds is sensitive personal information, and the lawful bases for it are narrower than most clinics assume.

Why health is different

Under the Data Privacy Act, health information is sensitive personal information. That matters more than it sounds, because sensitive personal information is governed by Section 13, not Section 12 — and Section 13 is considerably narrower.

The consequence that surprises people most: performance of a contract is not a lawful basis for processing sensitive personal information. A clinic cannot rely on "we need it to treat the patient" the way a retailer relies on "we need it to ship the order". The basis has to come from the Section 13 list.

Two clocks, not one

A notifiable breach starts the 72-hour clock to the National Privacy Commission. Health-sector reporting obligations run in addition to that, on their own timetable.

Notifying the NPC does not discharge a separate obligation to notify a sector regulator, and the two deadlines are rarely the same.

What the overlay covers

• Lawful bases mapped to Section 13 rather than Section 12, per processing activity
• Medical record retention — 15 years, and effectively lifetime where there is medico-legal exposure
• Encryption standards for records at rest and in transit
• Laboratory tiering obligations under DOH AO 2022-0007
• Telemedicine consent and platform assessment under Joint AO 2021-0001
• PhilHealth eClaims record retention
• Consent handling for research, teaching files and case photography
• CCTV in clinical areas, under NPC Circular 2024-02