Medical Records Retention in the Philippines
Retention periods for patient charts, PHIE requirements, legal claims, digitization, and secure disposal, with practical examples for doctors and hospitals.
Data Privacy & Medical Records
Practical guides, NPC rulings, and advisory opinions on medical records and data privacy.
No readings match your search. Try another topic or NPC reference.
Practical guides
Access & disclosure
Parents’ access to a deceased patient’s medical records
The NPC upheld the parents’ right to their deceased daughter’s complete medical records and rejected the hospital’s reliance on PHIE privacy guidelines.
Facts and context
In Sps. NSP and EOP v. PSHCI, the hospital withheld records of the couple’s deceased daughter, MAP, invoking privilege over doctors’ orders and consent from other care providers.
Ruling
The 16 January 2025 decision found a violation of section 16(c), in relation to section 17, of the Data Privacy Act, ordered release, and awarded ₱50,000 each in nominal and moral damages. The 3 July 2025 resolution denied reconsideration: the PHIE guidelines did not curtail statutory access rights.
Practice implications
For physicians
Refer requests to the hospital’s records office or privacy officer. Verify the requester’s entitlement and document the response; confidentiality alone does not justify refusal.
For lawyers
Identify the requester’s standing under section 17. Distinguish this access dispute from testimonial privilege in civil litigation; it does not authorize disclosure to every relative.
Patient access to clinical information
The NPC distinguished safeguards for telephone inquiries from a general requirement for physician approval. The cited DOH manual provision concerned telephone requests; it should not become a blanket restriction on a patient’s reasonable access to their information.
Practice implications For physicians and lawyers
For physicians
Give patients a clear route to request records. Verify identity or representative authority, identify the information requested, and arrange a secure release method. Do not automatically require attending-physician approval for every type of request merely because a telephone procedure requires it.
For lawyers
Identify the request channel and the actual reason for any restriction. Review whether the facility’s procedure facilitates access while protecting confidentiality. This opinion addresses the cited telephone procedure; it does not resolve every possible exception to access.
Employee access to annual physical examination results
The NPC said an employee may request copies of laboratory, ECG and X-ray results from an employer-sponsored annual physical examination, subject to the company’s access procedure. Employer payment for the examination did not extinguish the employee’s access right.
Practice implications For physicians and lawyers
For physicians
Give employees a clear route to obtain their own test results. Verify identity and release the requested report securely; explain abnormal findings through an appropriate clinical channel. Do not assume that employer sponsorship makes the results inaccessible to the person examined.
For lawyers
Review the access policy for identification, reasonable timing, secure delivery and any justified restriction. Distinguish the employee’s own examination results from confidential third-party material in a personnel file. The opinion addresses access, not unrestricted employer use of clinical findings.
Requests involving incapacity or death
The NPC explained the exercise of data-subject rights by lawful heirs and assigns after death or incapacity. The Data Privacy Act does not itself rank relatives in a hierarchy for receiving medical information.
Practice implications For physicians and lawyers
For physicians
Confirm the patient’s capacity and the requester’s identity and authority before disclosure. Record what was requested, the basis for release and what was disclosed. Refer competing family claims for review instead of assuming that the first relative to ask is entitled to the records.
For lawyers
Examine the relevant authorization, guardianship or succession basis together with privacy and ethical duties. Distinguish a relative’s relationship to the patient from legal authority to exercise access rights. Document the basis for any limitation or refusal.
Death certificates for insurance claims
For a veterans’ insurance claim, the NPC examined whether a full death certificate was necessary when a certificate confirming death might meet the purpose. It discussed possible lawful grounds, minimization, security, and accountability; the opinion does not make every insurer request automatically lawful.
Practice implications For physicians and lawyers
For physicians
When asked to release a death record, verify the requester and the stated purpose. Check whether proof of death is enough before disclosing the cause of death and other details. Route doubtful requests to the records or privacy officer.
For lawyers
Identify the precise entitlement and lawful basis for disclosure, then request only the fields needed for the claim. Document the release and safeguards. The NPC described a data-sharing agreement as an accountability measure, not a universal prerequisite.
Police and media requests for patient information
The NPC distinguished an authorized law enforcement investigation from a general request for medical records. Police have no blanket access to a hospital chart. The opinion also found no comparable duty to disclose patient information to the media.
Practice implications For physicians and lawyers
For physicians
Route requests to a designated privacy or records officer. Verify the officer, the investigation and the document relied on; release only what the lawful purpose requires. Keep a record of the request and response. Refer media inquiries to an authorized spokesperson.
For lawyers
Check the legal basis and scope of a police request, including any court order, subpoena, warrant or specific reporting duty. The opinion addresses different rules for basic personal information and sensitive health information. Do not treat section 13(f) as unrestricted police access.
Requests for a vaccination master list
In a request for a list of Dengvaxia recipients, the NPC distinguished access to a represented child’s information from wholesale disclosure of a sensitive registry. An agency’s public mandate did not, by itself, give blanket access to another agency’s identifiable health data; aggregate information could answer public inquiries.
Practice implications For physicians and lawyers
For physicians
Keep identifiable vaccination lists behind a controlled release process. Verify parental or representative authority for an individual record, and use aggregate figures when responding to general public or media questions.
For lawyers
Separate a client-specific request from a request for an entire register. Establish statutory authority or valid authorization, limit the data shared, and document the purpose and safeguards. This is a fact-specific 2018 opinion.
Medical records used to defend a legal claim
In JPV v. Souley MD Services, the NPC dismissed a patient’s unauthorized-disclosure complaint. The provider attached relevant treatment records to a cyberlibel complaint concerning allegations about its care; the NPC found a lawful basis under Section 13(f) for establishing a legal claim. It also rejected the idea that possessing the chart permits unrestricted use of the personal data within it.
Practice implications For physicians and lawyers
For physicians
Preserve an accurate, contemporaneous clinical record when treatment is disputed. If counsel later requests a chart for a claim, refer the request to the institution’s authorized legal and privacy process. Do not post or circulate records simply to answer public criticism.
For lawyers
Identify the specific legal claim and why each proposed record is necessary and proportionate. Limit recipients and exhibits, protect unrelated information, and document the Section 13(f) analysis. The dismissal on these facts is not blanket permission to use any patient record in any dispute.
Publicly naming a person’s health status
In JAA v. RB, the NPC held a barangay official liable for unauthorized disclosure after he identified a person and disclosed health-related details in a large Facebook group during the COVID-19 response. The NPC awarded nominal damages and recommended prosecution. A public-health purpose did not justify posting the person’s identity to a public-facing forum.
Practice implications For physicians and lawyers
For physicians
Use designated public-health reporting and contact-tracing channels. Share identifiable health information only with authorized personnel who need it for the defined response. Avoid naming patients in group chats, social media posts or public warnings, even when infection control is urgent.
For lawyers
Check the applicable reporting mandate, authorized recipients and minimum data needed. Separate confidential notification to health authorities from public messaging. Record the disclosure decision and use de-identified public information where it meets the purpose.
Hospital & workplace
Hospital privacy notices and consent
A hospital asked the NPC to review a combined notice and consent document. The NPC explained that a privacy notice informs patients about processing; it is not itself consent. It called for clearer purposes, recipients and retention periods, with a stated basis for those periods.
Practice implications For physicians and lawyers
For physicians
Make the notice readable at registration and explain who may receive information, why it is used and how patients exercise their rights. If a signature merely acknowledges receipt of the notice, label it that way. Seek a separate, purpose-specific consent when consent is the lawful basis.
For lawyers
Inventory each processing purpose and identify its lawful basis. Describe categories of data, recipients and retention in the notice. Verify any stated retention period against the relevant rule or policy; the periods in the hospital’s draft were not NPC-wide mandatory periods.
Sick-leave hotlines and employee diagnoses
The NPC considered an employer hotline that collected the reason for sick leave. A project lead would see the absence and its duration, while a health team might receive specific conditions. Health data require a Section 13 basis, a stated purpose, limited access and a proportionate collection process; the opinion did not give employers general permission to demand every diagnosis.
Practice implications For physicians and lawyers
For physicians
For a work-absence request, ask what the employer actually needs: dates, a fitness assessment, or a reportable condition. Keep diagnosis details within an authorized clinical or occupational-health channel. Explain to the patient what a certificate will disclose and avoid sending a full chart to a supervisor.
For lawyers
Map each requested field and recipient to a purpose and a lawful basis for sensitive data. Check any applicable leave, occupational-health or disease-reporting rule. Give employees a clear privacy notice, limit access by role, set retention and assess whether a less intrusive certificate will suffice.
Workplace psychiatric evaluations
The NPC considered a proposal to require psychiatric assessment of all agency personnel and send results to the executive director. A draft agreement with a treatment center did not itself establish authority for compulsory testing or unrestricted receipt of full results. The opinion examined voluntariness, a lawful basis, and whether a fitness certificate would suffice.
Practice implications For physicians and lawyers
For physicians
Before conducting an employment-related assessment, clarify its clinical and occupational purpose, what the employer actually needs, and who receives the result. Avoid routine delivery of a full psychiatric report when a limited fitness finding can serve the purpose.
For lawyers
Assess the specific legal basis for both the examination and disclosure of sensitive results. A service agreement alone is not a lawful basis. Draft clear participation, access, retention, and limited-reporting terms; other statutory grounds may matter in different facts.
Posting staff test results in a group chat
A health office proposed posting a list of employees with positive COVID-19 tests in a 250-person work chat. The NPC advised against it: a majority vote did not authorize disclosure of others’ results, and workplace consent was a poor substitute for the defined contact-tracing procedure.
Practice implications For physicians and lawyers
For physicians
Notify exposed staff through the approved occupational-health pathway without broadcasting a named test-result list. Keep clinical results with authorized personnel and provide practical exposure guidance to those who need it. Do not use a staff poll as permission to disclose a colleague’s diagnosis.
For lawyers
Apply the relevant public-health rules and identify who may receive identifiable results. Design a narrow notification process, limit group-chat membership and avoid relying on consent where a power imbalance calls its freedom into question. The opinion concerns the COVID-19 procedure and stated facts.
Employer access and HMO billing reviews
The NPC emphasized proportionality in internal audits. A fitness certificate may meet an employer’s purpose without disclosure of the full clinical record. Paying HMO premiums does not, by itself, justify access to employees’ health information; itemized charges can also reveal health details.
Practice implications For physicians and lawyers
For physicians
For a fitness inquiry, consider whether a focused certification meets the request. Do not routinely send the complete chart to HR or an auditor. Route requests for detailed clinical or billing information through an authorized review process.
For lawyers
Identify the applicable basis for processing sensitive information and limit access to what the purpose requires. For the billing review described, the NPC suggested employee consent or employee confirmation of the amount charged. Build defined access permissions into audit procedures; an unrestricted audit clause is insufficient.
HMO brokers and identifiable utilization data
Brokers requested employee diagnoses, procedures and confinement details for utilization analysis. The NPC said a broker pursuing its own purposes may be a separate personal information controller. Processing identifiable health data needs an appropriate Section 13 basis and transparency; aggregate statistics may meet the analysis purpose without patient-level disclosure.
Practice implications For physicians and lawyers
For physicians
Before releasing utilization reports, ask whether the recipient needs patient-level diagnoses or whether aggregate figures answer the question. Route identifiable requests to the HMO or privacy team. Do not assume a broker’s accreditation or a corporate client’s request authorizes access to clinical details.
For lawyers
Document each party’s role and each purpose, including analytics, research, overseas sharing and insurance sales. Identify the Section 13 basis; if consent is the only available basis, ensure it is informed and specific. Negotiate data minimization and safeguards rather than relying on an unrestricted broker request.
Employee laboratory results for LGU health permits
Addressing one part of an opinion that also covers cross-border certification, the NPC said employers should examine the actual LGU requirement before collecting employee health data. If proof of passing an examination suffices, a complete laboratory report may be excessive. The employer and LGU are separate controllers for information each handles.
Practice implications For physicians and lawyers
For physicians
When issuing a health certificate, distinguish the conclusion needed for the permit from underlying results. Confirm what the LGU actually requires and avoid routing extra clinical findings through HR. Use a secure channel for any necessary records and tell the employee what will be submitted.
For lawyers
Read the particular ordinance or permit rule and identify a lawful basis for sensitive data; the opinion did not decide whether the unspecified local requirement satisfied Section 13. Limit collection to required evidence, record who receives it, and allocate security and retention duties between employer and LGU.
Clinical photographs and hospital CCTV
The NPC treated clinical photographs as sensitive health information and CCTV images of identifiable people as personal information. Clinical images taken for medical treatment may be processed under the treatment ground if adequate protection is ensured. The opinion recommends specific policies for photographs and CCTV.
Practice implications For physicians and lawyers
For physicians
Use an approved clinical-image workflow. Define when images may be taken, who may access them and how they are transmitted. Keep treatment images out of personal messaging or social accounts. Tell patients where CCTV operates and route footage requests through the privacy team.
For lawyers
Distinguish treatment images from secondary uses such as teaching or publication, which require their own lawful basis. Review access and transfer controls, surveillance notices and requests for footage that also identifies other people; masking may be appropriate.
Breaches & security
Hospital breach: when patients must be notified
After unauthorized copying of a hospital family-planning registry, the NPC denied the hospital’s request to avoid notifying affected patients. It ordered notification, proof of notice and additional remedial measures. This is an order on a breach-notification request, not a general finding of liability for every aspect of the incident.
Practice implications For physicians and lawyers
For physicians
If a registry or chart extract is lost or copied without authority, report it immediately through the hospital’s incident process. Preserve what is known about affected patients and data fields, stop further access and help the privacy team identify patients who may need notice. A confidentiality agreement alone does not replace a response plan.
For lawyers
Apply the breach-notification criteria to the actual data, access and risk of serious harm. Preserve the investigation and evidence of safeguards, document any exemption request, and plan workable patient notification. Missing contact details alone did not justify withholding notice in this case.
A photographed hospital record and documented response
A photograph of a patient’s hospital-system screen, including diagnosis, appeared in a Facebook group. Asian Hospital investigated chart access, notified the patient and NPC, documented remedial measures and provided proof of patient notice. The NPC found the response sufficient and closed the breach matter.
Practice implications For physicians and lawyers
For physicians
Report suspected screen photographs or chart leaks immediately. Preserve access logs and identify who could view or capture the record. Help the privacy team explain the exposure and available assistance to the patient; routine staff confidentiality promises are no substitute for investigating a concrete incident.
For lawyers
Create an incident record that ties the exposure to access logs, investigation steps, patient notice, proof of delivery and corrective measures. Assess notification against the governing criteria. This resolution closed a documented breach response on its facts; it does not make every similar exposure harmless.
Misaddressed annual-exam results and breach duties
A MediCard clinic emailed employees’ annual physical examination results to unintended recipients without its stated encryption and password safeguards. In the consolidated breach matter, the NPC rejected MediCard’s low-risk rationale for not notifying affected employees and directed a compliance check, although it closed the breach proceedings.
Practice implications For physicians and lawyers
For physicians
Treat annual-exam reports as sensitive even when sent within one employer’s workforce. Verify each recipient, use approved secure delivery, and report a misdirected email promptly. Help identify exactly which results went to whom; asking recipients to delete an email does not by itself resolve notification duties.
For lawyers
Map the employer and clinic’s controller roles and their separate response obligations. Assess serious-harm risk and notification with evidence, not an unsupported “internal recipient” assumption. Document containment, affected persons, timing and corrective controls; the resolution criticized the provider’s delayed notice.
Wrong-recipient drug test results and a safer release workflow
MyHealth sent another client’s employees’ drug test results in a report. The NPC closed the breach matter after reviewing notification, recipient deletion, and a revised release process that included encrypted PDFs, recipient and attachment checks, a release log, and acknowledgement of receipt. Closure reflected the response shown on this record.
Practice implications For physicians and lawyers
For physicians
Treat every emailed result as a final clinical release: confirm the patient, employer or recipient, attachment, and permitted scope before sending. If an error occurs, escalate immediately so affected people can be notified and the recipient asked to delete the data.
For lawyers
Build a documented release checklist and incident trail, including who received the file, containment steps, notices, and proof of corrective action. The closure does not mean that a recall alone cures a breach or that every similar incident is non-reportable.
A falsified billing document without proven data access
VRP Medical Center reported falsified receipts and statements of account used for an HMO claim. After comparing the documents, the NPC found insufficient evidence that the falsifier accessed the real patients’ personal data. It concluded that this record did not establish a personal data breach requiring notification and closed the matter.
Practice implications For physicians and lawyers
For physicians
Escalate a suspicious billing or insurance document, but preserve the original and system record before assuming a chart leak. Compare identifiers, templates and access logs. A fraud investigation and a privacy-breach assessment may reach different conclusions and both need documentation.
For lawyers
Test whether there is evidence of loss, alteration, unauthorized disclosure or access to actual personal data. Record why a document match or mismatch does or does not establish access. Do not treat every forged hospital form as a notifiable breach, or dismiss an incident without investigating the data path.
Records & research
Imaging records during a hospital–vendor dispute
A radiography-system vendor restricted hospital access to patient records amid a payment dispute. The NPC declined to decide the parties’ contract rights, but explained that controller and processor roles depend on their actual arrangement and that patient access to medical information must remain workable, with vendor cooperation where applicable.
Practice implications For physicians and lawyers
For physicians
Know how to retrieve images and reports when a system or vendor relationship fails. Escalate blocked access promptly where a delay could affect care, and maintain a practical route for patients to obtain their information.
For lawyers
In imaging and EMR contracts, define controller and processor roles, access permissions, export formats, continuity, termination, and deletion. A vendor may acquire controller duties if it independently determines data use; the opinion did not adjudicate this particular contract.
Electronic medical records and secondary use
An EMR vendor providing a treatment platform may be a processor for that service but a controller when it decides to use patient data for its own research or statistics. The NPC emphasized patient information, a lawful basis for secondary processing, security measures and genuine anonymization before unrestricted sharing.
Practice implications For physicians and lawyers
For physicians
Ask vendors what happens to information entered in the EMR beyond care delivery. Check how access, encryption, backups and data exports work. Do not assume a physician’s agreement permits a vendor to reuse patients’ identifiable information for research.
For lawyers
Map the vendor’s role separately for treatment hosting and any independent analytics. Address secondary use, patient-facing information, lawful basis, retention and security in the contracts and assessment. Data remain regulated before anonymization and whenever individuals can still be identified.
Medical records when a corporate contract ends
In the pre-employment examination arrangement considered, the clinic was a personal information controller for its clinical processing. Employer payment did not make it the owner of the records. Each controller needed to assess retention against its own lawful purposes and applicable requirements.
Practice implications For physicians and lawyers
For physicians
Before returning or deleting records at a client’s request, check the clinic’s retention schedule, continuing clinical purpose and applicable recordkeeping duties. Tell patients how long their information will be kept and arrange secure disposal when retention is no longer justified.
For lawyers
Draft termination clauses around the parties’ actual control of processing, patient rights and justified retention. Address legal claims and applicable healthcare requirements rather than prescribing automatic deletion at contract end. This opinion does not establish one retention period for every kind of medical record.
Using clinical data in research
A researcher asked the NPC to permit use of stroke-patient data. The NPC said it does not grant access on behalf of a hospital. It suggested requesting data without identifying information, obtaining consent where personal data are needed, and submitting the protocol for ethics review.
Practice implications For physicians and lawyers
For physicians
Before a chart review, agree with the hospital on the precise fields needed and whether a truly anonymous extract will answer the study question. Seek the required institutional and ethics approvals. Limit access to the approved dataset and protocol.
For lawyers
Identify whether the proposed extract can reasonably identify a patient, including through combined fields. Document the basis for any identifiable-data processing, the hospital’s authorization, ethics review and data-handling terms. NPC advice alone is not permission to inspect records.
Genetic samples and research safeguards
Asked about alleged collection and transfer of genetic material from indigenous participants, the NPC explained that a research purpose does not dispense with applicable ethics, consent, and legal safeguards. Its discussion addressed a reported scenario; it was not a finding that the alleged misconduct occurred.
Practice implications For physicians and lawyers
For physicians
Before collecting specimens or using identifiable genetic or health data, confirm ethics approval, participant information and consent, and the approved plan for storage, secondary use, and transfer. Do not treat research status as permission to bypass those steps.
For lawyers
Check the research protocol, ethics review, applicable indigenous-peoples requirements, material-transfer terms, and data-protection basis before collection or export. Keep the opinion’s fact-specific allegations separate from proven findings.
Resident case logs for specialty accreditation
A hospital asked whether resident physicians could send identifiable case logs to specialty societies for board examination or accreditation. The NPC advised consent for the proposed disclosure and suggested hospital certification of case counts or genuinely anonymous data instead. Replacing names with codes is not necessarily anonymization when patients can still be identified.
Practice implications For physicians and lawyers
For physicians
Plan the external case-log format before cases are collected. Ask whether the society needs patient names, hospital numbers and dates or merely verified experience. Use a hospital-approved certification or genuinely anonymous summary where it meets the requirement; do not export a patient list from the chart by default.
For lawyers
Review the society’s exact fields and the hospital’s authority for disclosure. If identifiable information is needed, design a specific consent and controlled transfer. Treat coded records as personal data if a key or combination of fields still allows identification.
Web-based training accreditation and patient identifiers
The NPC examined a pulmonary fellowship accreditation platform receiving hospital case details. It distinguished anonymous statistics from pseudonymized records: a retained hospital number could reconnect a record to a patient. For the proposed identifiable transfer, the NPC advised obtaining consent rather than treating it as internal hospital quality management.
Practice implications For physicians and lawyers
For physicians
Before entering cases in a training portal, inspect the mandatory fields and ask if an anonymous case summary or hospital verification would satisfy accreditation. Do not assume removing a name makes a hospital-numbered case anonymous. Use only the approved institutional workflow.
For lawyers
Assess who operates the portal, what fields can identify a patient and whether the training purpose differs from clinical care. For the arrangement described, the NPC advised consent; document the basis, disclosures, access controls and deletion or retention terms for the actual system.
Medical records for cancer registries
The NPC considered requests from two population-based cancer registries under the National Integrated Cancer Control Act. It found that relevant health information could be shared under the law without patient consent, while still requiring transparency, proportionality and secure handling.
Practice implications For physicians and lawyers
For physicians
When a registry requests records, confirm its authority and the required data fields. Arrange controlled review or extraction, protect unrelated chart material and communicate the purpose through the hospital’s privacy notice.
For lawyers
Match the registry request to its statutory mandate and limit the dataset to what is necessary. Set procedures for researcher access, secure transmission and confidentiality. This opinion concerns the named registries and statutory framework; it is not a blanket research exemption.