← Data Privacy & Medical Records

Access & disclosure · NPC decision

Publicly naming a person’s health status

Reference
NPC Decision 21-085
Date
8 February 2024

Overview

In JAA v. RB, the NPC held a barangay official liable for unauthorized disclosure after he identified a person and disclosed health-related details in a large Facebook group during the COVID-19 response. The NPC awarded nominal damages and recommended prosecution. A public-health purpose did not justify posting the person’s identity to a public-facing forum.

Practice implications

Parao Law practice guidance

For physicians

Use designated public-health reporting and contact-tracing channels. Share identifiable health information only with authorized personnel who need it for the defined response. Avoid naming patients in group chats, social media posts or public warnings, even when infection control is urgent.

For lawyers

Check the applicable reporting mandate, authorized recipients and minimum data needed. Separate confidential notification to health authorities from public messaging. Record the disclosure decision and use de-identified public information where it meets the purpose.