DATA PRIVACY ACT Flashcards
(99 cards)
1
Q
What is included in a patient’s clinical record?
A
● Patient’s medical history
● Results of examinations
● Records of treatment
● Copies of diagnostic examinations
● Notation of all instructions given
● Copies of all prescriptions and notes on refill
authority
● Documentation of informed consent
● Any other pertinent data
2
Q
What are the uses of a patient’s clinical record?
A
● To provide the best medical care
● To supply statistical information
● To provide legal protection
3
Q
What are the steps to correct a handwritten entry on a record?
A
● Draw a line through the error
● Insert the correction above or immediately following
the statement
● In the margin, write “CORRECTION”, your initials,
and the date
4
Q
Why should correction fluid or tape not be used on medical records?
A
“There might be a superimposition on top of another correction.”
5
Q
Who owns hospital records?
A
“The hospital owns hospital records.”
6
Q
Why does the hospital own the original copy of records?
A
“The hospital owns it because they paid for the paper the ink, the storage etc.
7
Q
What is privileged communication in medical records?
A
“It ensures that the privacy of the patient’s record is protected unless waived by the patient or their authorized representative.”
8
Q
How long are hospital records stored?
A
“Legally there is no specific duration
9
Q
Under what circumstances are medical records admissible in court?
A
“When the entrant is not available to testify
10
Q
What type of subpoena requires medical records?
A
“Subpoena duces tecum.”
11
Q
Who has access to medical records?
A
“The hospital
12
Q
Can a patient possess the original medical records?
A
“No
13
Q
What are the types of medical records?
A
“Hospital medical records and physician’s private office records.”
14
Q
What can result from failure to maintain accurate and complete medical records?
A
“It can constitute medical malpractice.”
15
Q
What is the best evidence rule in documentary evidence?
A
“The original copy is the most reliable evidence.”
16
Q
What is the Data Privacy Act (RA No. 10173)?
A
“An act protecting individual personal information in information and communications systems and creating the National Privacy Commission.”
17
Q
What is the right to be informed under RA 10173?
A
“The right to be informed when personal data is collected
18
Q
What is the right to access under RA 10173?
A
“The right to know if an organization holds personal data and to obtain reasonable access to it
19
Q
When can you exercise the right to object to data processing?
A
“When processing is based on consent or legitimate interest unless required by subpoena
20
Q
What is the right to erasure or blocking?
A
“The right to suspend
21
Q
What is the right to damages under RA 10173?
A
“The right to claim compensation for damages due to inaccuracies
22
Q
Who can file a complaint with the National Privacy Commission (NPC)?
A
“Anyone who feels their data privacy rights have been violated
23
Q
What is the right to rectification under RA 10173?
A
“The right to correct inaccuracies or errors in personal data
24
Q
What is the right to data portability?
A
“The right to move
25
What is the transmissibility of data subject rights?
"The ability to assign data privacy rights to a legal assignee or heir
26
When do the limitations of data subject rights apply?
"When data is used solely for scientific/statistical research or investigations of criminal
27
What is a Data Subject in the context of the Data Privacy Act?
An individual whose personal information is being processed, such as patients.
28
Who is the Personal Information Controller?
The person or organization who controls the collection, holding, processing, or use of personal information, such as hospitals or physicians.
29
Who is the Personal Information Processor?
A natural or juridical person to whom the Personal Information Controller may outsource data processing, such as third-party apps or EMR systems.
30
What are the three principles of data privacy?
Transparency, Legitimate Purpose, and Proportionality.
31
What is the policy of the State under the Data Privacy Act?
To protect the fundamental human right of privacy of communication while ensuring free flow of information for innovation and growth.
32
What defines Personal Information under the Data Privacy Act?
Information that identifies an individual, such as name, ID numbers, or contact details.
33
What is De-identification in the context of data privacy?
Removing personal information to prevent identification of an individual, such as excluding names and specific geographic data.
34
What are examples of Sensitive Personal Information?
Information about race, ethnicity, marital status, health, education, and government-issued IDs.
35
Does the Data Privacy Act apply to personal information collected for journalistic purposes?
No, it does not apply to personal information processed for journalistic, artistic, literary, or research purposes.
36
What is considered Privileged Information?
Confidential communications, such as between husband and wife, attorney and client, or doctor and patient.
37
What are the requirements for Personal Information collection?
It must be for specified and legitimate purposes, processed fairly and lawfully, and accurate and relevant.
38
How long should personal information be retained?
Only as long as necessary for its purpose or for legal claims, or as provided by law.
39
What is the Right to Privacy as described in the Hippocratic Oath?
The commitment to keep secret anything seen or heard professionally or privately that ought not to be divulged.
40
What is the role of a physician regarding patient data protection?
To ensure privacy and security of patient information and avoid unnecessary disclosure.
41
What should a prescription pad include under the Data Privacy Act?
Physician's name, specialty, clinic hours, and contact number for clarifications.
42
What is the burden of proof under the Data Privacy Act?
It lies with the data processor or party claiming the act's non-applicability.
43
What are examples of Personal Information identifiers?
Name, social security number, medical record number, and biometric data.
44
What is the purpose of de-identification in medical records?
To protect patient privacy by removing or anonymizing identifying details.
45
What is the difference between Personal Information and Sensitive Personal Information?
Personal Information identifies an individual, while Sensitive Personal Information includes data like race, health, or government IDs.
46
What is the importance of consent in data collection?
Personal data cannot be collected, processed, or stored without explicit consent unless provided by law.
47
What is the Right to Data Portability?
The right to obtain and securely transfer personal data for further use.
48
What does the principle of Proportionality in data privacy mean?
Data collected should not be excessive and must be adequate for its purpose.
49
Can a patient access their own medical record under the Data Privacy Act?
Yes, but they may only obtain a certified true copy, not the original.
50
What is considered the Best Evidence Rule for personal data?
The original copy of a document is the most reliable evidence.
51
How should errors in medical records be corrected under the Data Privacy Act?
Draw a line through the error, write the correction above, and annotate with 'Correction,' your initials, and the date.
52
Does the Data Privacy Act apply to public officials’ employment information?
No, it excludes information related to their position, salary, and responsibilities.
53
What is the penalty for violating patient privacy?
Liability for damages or other penalties depending on the nature of the violation.
54
What is the Right to Erasure or Blocking under the Data Privacy Act?
The right to request removal, blocking, or destruction of incomplete, outdated, or unlawfully obtained data.
55
What is the role of hospitals as Personal Information Controllers?
To collect, use, and store patient data while ensuring compliance with data privacy laws.
56
What are the three General Data Privacy Principles?
Transparency, Legitimate Purpose, and Proportionality.
57
What does Transparency in data privacy entail?
The data subject must be aware of the nature, purpose, and extent of the processing of their personal data, including risks, safeguards, identity of the personal information controller, their rights, and how these can be exercised.
58
What is the principle of Legitimate Purpose?
The processing of information must be compatible with a declared and specified purpose and must not be contrary to law, morals, or public policy.
59
When is consent required for processing personal data?
Consent is required for training purposes, research (in general), publication, disclosure of data to anyone other than the patient, marketing purposes, and sharing data with affiliates or mother companies.
60
When is consent NOT required for processing personal data?
Consent is not required in emergencies, for medical treatment, for generating statistical data, or when reporting is mandated by law or regulation.
61
What is the core idea of the Proportionality principle in data privacy?
The processing of information must be adequate, relevant, suitable, necessary, and not excessive in relation to its purpose.
62
What security measures are essential when processing personal data?
Ensuring physical security, technical measures to protect data confidentiality, maintaining data integrity, and ensuring data is accessible only when needed.
63
What is data processing?
Data processing involves the collection, storage, usage, access, transfer, and even the destruction of data.
64
What must establishments with CCTV do to comply with data privacy laws?
They must display signage informing individuals that they are being recorded in real-time.
65
Why is taking pictures of data records prohibited?
To ensure the confidentiality and security of sensitive information.
66
What penalty did Huping Zhou face for unauthorized access to medical records?
He was sentenced to four months in prison and fined $2,000.
67
What precautions should be taken when posting pictures of patients online?
Obtain explicit consent, explain the purpose, and ensure the patient understands how the photos will be used.
68
How should examination records be properly disposed of?
By shredding them to prevent unauthorized access or misuse.
69
What happened in the medical group fined $140K for improper disposal of health records?
They discarded records of over 67,000 residents in a public dump without shredding or redacting them, exposing sensitive data.
70
What does the Rare Diseases Act (2015) require regarding patient data?
Healthcare practitioners must report diagnosed cases to the Rare Disease Registry while protecting patient privacy as per NIH guidelines.
71
What is the key rule for consent according to data privacy laws?
If it's not clear, it's not consent.
72
What is required of a Data Protection Officer (DPO)?
They must have specialized knowledge and demonstrate reliability in privacy policies, data processing operations, and sector-specific practices.
73
Give an example of data processing misuse during storage.
Allowing unauthorized access to records rooms or data centers.
74
What are the penalties for improperly accessing confidential data?
Penalties can include fines and prison sentences, as seen in the case of unauthorized celebrity record access.
75
What principle should guide the collection of personal data?
Collect only what is necessary and ensure the purpose is clear and legitimate.
76
What is the purpose of anonymizing patient data?
To prevent linkage to an individual's identity by separating data from direct identifiers.
77
What is pseudonymization in data privacy?
The separation of data from direct identifiers so linkage to an identity is not possible without additional information held separately.
78
Why should initials not be used to anonymize patient data?
Initials can still identify a patient's identity.
79
What should a privacy notice include?
Details on what personal data is collected, why it is processed, how it is handled, who processes it, and the rights of data subjects.
80
What are the key principles of data processing in a privacy notice?
Transparency, Legitimate Purpose, and Proportionality.
81
What should be reviewed in consent forms?
The inclusion of consent for training, research, confidentiality measures, and data use in training institutions.
82
Why is a record of processing activities important?
To document the basis of processing, track processes, and ensure compliance.
83
What is the purpose of a risk assessment cycle?
To identify where data might be lost or leaked and address potential risks.
84
What are the steps in a Privacy Impact Assessment?
Identify data flow, assess privacy risks, evaluate risk impact, and address risks to avoid negligence.
85
Why are Non-Disclosure Agreements (NDAs) important?
To prevent unauthorized disclosure of sensitive information.
86
What is the correct email etiquette for protecting privacy?
Use the BCC field to mask recipients' email addresses in group messages.
87
What are examples of physical security measures for data privacy?
Ensuring EMR monitors are not visible to unauthorized persons and arranging workspaces to provide privacy.
88
What steps can prevent data theft?
Encrypting data, using strong passwords, and ensuring devices are locked.
89
Why should contracts with service providers be reviewed?
To ensure they include privacy and security measures, address liability, and avoid unauthorized data use or breaches.
90
What should be done in case of a data breach?
Notify the National Privacy Commission and affected data subjects within 72 hours of knowledge or reasonable belief of the breach.
91
What does 'being a friend of mankind' imply in the medical profession?
Maintaining an honorable tradition, rapport with patients, and adherence to ethical principles.
92
What penalties are imposed for data privacy violations?
Imprisonment from 6 months to 7 years and fines ranging from ₱500,000 to ₱5 million.
93
What are prohibited acts under data privacy laws?
Unauthorized processing, improper disposal, negligence, breaches, malicious or unauthorized disclosure.
94
What are the top 5 cybercrime complaints in the Philippines?
Identity theft, unauthorized access, data breaches, phishing, and hacking.
95
How should sensitive personal data be protected in a nutshell?
Anonymize if possible, have a privacy notice, review consent forms, keep processing records, do risk assessments, use NDAs, implement privacy guidelines, and prepare for breaches.
96
What is the fine for unauthorized data disclosure?
₱500,000 to ₱2,000,000 and imprisonment of 3 to 5 years.
97
Why should email recipient addresses be placed in BCC?
To protect the privacy of recipients and prevent disclosure of their email addresses.
98
What should be considered when designing physical workspaces for data privacy?
Ensure that monitors and documents are not visible to unauthorized individuals.
99
What is the Canister Scandal of 2008 an example of?
A breach of data privacy that highlights the importance of protecting sensitive information.
