Misplaced data privacy policy
The ongoing investigation by the National Bureau of Investigation of ghost claims for reimbursement with the Philippine Health Insurance Corp. (Philhealth) shows the scam may have been abetted by the refusal of the Philippine Statistics Authority (PSA) to share its data.
According to two former employees of WellMed Dialysis Center, their company made claims for reimbursement of medical expenses with the Philhealth for dead patients.
The Philhealth said it requested information from the PSA to verify the fact of death of patients involved in applications for reimbursement that were under investigation, but the latter refused because it has no memorandum of agreement with the Philhealth for sharing of data information.
In justifying its action, the PSA cited the agreements it entered into with various government offices for data sharing. Bottom line, without an agreement, the Philhealth will have to look for assistance elsewhere in its verification efforts.
The PSA’s zealous guarding of personal data in its custody is commendable, but it is misplaced in light of the law on the handling of personal information and the circumstances behind the Philhealth’s request for assistance.
Republic Act No. 10173 or the Data Privacy Act of 2012 provides, among others, the manner by which personal information gathered or collated by private companies and government offices shall be handled or shared with third parties.
Personal information refers “to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual.”
As the country’s central statistical authority on primary data collection, the PSA falls squarely within the coverage of that law.
While the law recognizes the sanctity of private information, it exempts from its application, among others, “information necessary in order to carry out the functions of public authority in accordance with a constitutionally or statutorily mandated function pertaining to law enforcement or regulatory function …”
The rationale behind the exemption is simple: The confidentiality of personal information cannot be invoked if it would hamper or impair the capability of a government office to properly perform its regulatory functions.
By way of analogy, the secrecy of bank deposits can be set aside at the instance of the Anti-Money Laundering Council if there is probable cause the deposits are related to an unlawful activity or money laundering offense.
Checking the authenticity of claims for reimbursement by accredited hospitals is an essential part of the Philhealth’s mandate to provide health insurance coverage to Filipinos who do not have the means to pay for their medical treatment.
When a hospital applies for reimbursement of the expenses it claims to have incurred in treating an indigent patient, the Philhealth is not obliged to make any payments without first verifying the authenticity of the application.
Since taxpayers’ money will be used to defray such payments, the Philhealth has to make sure the claim for reimbursement is valid or legitimate; otherwise the responsible officials would find themselves in trouble with the anti-graft law.
Thus, if the Philhealth has doubts about the identity or existence of the patient who supposedly underwent treatment, it should get in touch for that purpose with the government office that can provide undisputed information about it, and that is the PSA.
From the procedural point of view, the PSA’s demand for an agreement with the Philhealth before sharing data information may be appropriate.
But considering time was of the essence and there was sufficient legal cover for the PSA to accede to the Philhealth’s request without a formal agreement, the PSA should have promptly made available the information requested.
The PSA’s intransigence proved costly to the government and the taxpayers.
