LAB-QM-005 — Confidentiality Policy

1.0 Purpose

To establish and describe the Clinical Laboratory's confidentiality policy: to recognize and establish patient data as confidential information, to define the measures taken to protect the confidentiality of patient data, and to define the responsibility of every Clinical Laboratory employee regarding confidential data, to maintain compliance with applicable Philippine law and the accreditation and regulatory bodies whose standards TCH follows (DOH-Philippines, ISO 15189, WHO LQMS, JCI, CLSI, and other applicable privacy and laboratory standards).

To maintain in strictest confidence all patient and client information received and generated by the Laboratory.

2.0 Scope

This policy applies to all Medical Technologists and Laboratory Aides.

3.0 Definitions

• Confidentiality — the legally protected right afforded to (and duty required of) specifically designated healthcare professionals not to disclose information discerned or communicated during consultation with a patient.
• TCH — Tarangnan Community Hospital.
• DOH — Department of Health (Philippines).

4.0 Responsibility

4.1 Hospital Director

• Controls the signing and recording of confidentiality agreements (standing governance and policy approval duties are defined in Organization and Governance).

4.2 Pathologist

• Provides clinical and technical oversight regarding patient confidentiality and data protection (standing governance and policy review duties are defined in Organization and Governance).

4.3 Chief Medical Technologist / Laboratory Quality Manager

• Ensures the policy's compliance with applicable regulatory, accreditation, national, and international standards.
• Reviews this policy with new employees during orientation.
• Investigates any breach of confidentiality and recommends appropriate action to the Hospital Director.
• Ensures the timely removal of a departing employee's access credentials to any system containing patient information.

4.4 Medical Technologists

• Read, understand, and comply with this policy.
• Do not disclose any confidential information as described in this policy.
• Participate in all activities related to its full implementation (orientation, competency assessment, ongoing training).

4.5 Laboratory Aides

• Read, understand, and comply with this policy.
• Do not disclose any confidential information as described in this policy.
• Participate in all activities related to its full implementation (orientation, competency assessment, ongoing training).

4.6 Visitors, Authorized Service Personnel, and Contractors

• Do not disclose any confidential information encountered while on Laboratory premises.
• Sign the Confidentiality Agreement Form before being given access to areas or information covered by this policy.

5.0 Policy / Procedure

5.1 Policy Statement

• Patient information from any source and in any form (print medium, audio recording, electronic display) is confidential.
• It is the responsibility of every Laboratory employee to preserve and protect the confidentiality and privacy of TCH patients, in accordance with hospital policy and applicable Philippine law. Employees shall only read and use patient information as necessary for their job function. Repeating or otherwise disseminating patient information, except as permitted or required by law, is an unauthorized release of medical information, a serious offense, and may carry personal civil and/or criminal liability. Violation of this policy is grounds for disciplinary action, up to and including termination, and may carry criminal and civil liability under the Philippine Data Privacy Act of 2012 (RA 10173) — see Section 5.3.
• Special care must be exercised with information subject to additional legal protection (e.g., mental health records, substance abuse records, HIV test results, and other categories Philippine law treats as sensitive personal information).
• Personnel or systems with discretionary authority over particularly sensitive results (e.g., HIV test results) may require additional authorization/clearance for access, consistent with applicable law.
• When patient-identifiable data is to be destroyed, it must be disposed of in a way that protects the confidentiality of the information (e.g., shredding paper records; secure deletion of electronic records) so that the patient's identity cannot be associated with the data.
• Where TCH's systems (e.g., the Excel-integrated LIS) provide individual user access, access is controlled and, to the extent the system allows, attributable to the user who accessed it. Anyone allowing another person to use their access credentials, or otherwise inappropriately accessing patient information, may be subject to disciplinary action, including termination. TCH's Lab-LIS is an Excel-based system with automation (not a full hospital information system), accessible only to Medical Technologists and Laboratory Aides; it does not have individual per-user logins (i.e., no user-level audit trail is available from the system itself). Its functions include: serving as the result form used to input and print results; automatic tabulation by section (eliminating separate logbooks); statistical analysis and monthly reports; inventory management; staff scheduling; and machine QC (Levey-Jennings graphs). Because the system itself cannot attribute individual access, accountability for appropriate use rests on the general confidentiality obligations in this policy and on restricting physical/file access to Medical Technologists and Laboratory Aides only, rather than on a system-level audit log.
• Upon separation of any employee, their access credentials to any system containing patient information are removed. This is the responsibility of the Chief Medical Technologist / Laboratory Quality Manager.
• All employees sign a Confidentiality Agreement Form upon hire. Regardless of whether an employee has signed this form, they remain obligated to protect the confidentiality of patient information to which they have access, and to prevent its unauthorized disclosure.
• Adherence to this policy is the responsibility of each individual.

5.2 Orientation and Agreement Procedure

• Orient the new employee to this policy.
• Orient authorized vendor service personnel, visitors, or contractors if they will spend time in the Laboratory for training, installations, or evaluations, or will receive specific confidential data.
• Prepare or print the Confidentiality Agreement Form.
• Discuss and explain the form in relation to this policy, and allow an interactive question-and-answer period for clarification, if needed.
• Ask the concerned employee, individual, or entity to sign the agreement form.
• Keep the signed agreement form in the employee's individual file (for employees) or in a designated Confidentiality binder/folder (for non-employees/visitors).

5.3 Philippine Data Privacy Act of 2012 (RA 10173) Compliance

• Sensitive personal information. Under RA 10173, an individual's health information — including "previous or current health records" — is classified as Sensitive Personal Information, a category that receives stricter protection than ordinary personal information. All patient laboratory results and records fall within this category.
• Lawful basis for processing. Processing of sensitive personal information such as patient results requires either the patient's specific consent prior to processing, or reliance on the recognized exception for processing "necessary for purposes of medical treatment, ... carried out by a medical practitioner or a medical treatment institution" — which covers the Laboratory's ordinary diagnostic-testing function.
• Security measures (RA 10173, Section 20). The Laboratory, as part of the hospital, must apply reasonable and appropriate organizational, physical, and technical measures to protect patient data against accidental or unlawful destruction, alteration, or disclosure. This includes safeguards against unauthorized system access, a formal security policy, and a process for identifying and responding to vulnerabilities and incidents — consistent with Section 5.1 item 6 above regarding TCH's LIS access controls.
• Data subject rights. Patients may request access to their own medical records, information on who their data has been disclosed to, and correction of inaccurate data; they may also dispute inaccuracies and request destruction of data no longer necessary for its purpose. Medical Technologists and Laboratory Aides who receive such a request from a patient shall refer it to the Chief Medical Technologist / Laboratory Quality Manager and the hospital's designated Data Protection Officer (see item 5).
• Data Protection Officer (DPO). RA 10173 requires every personal information controller (which includes TCH as a whole, not the Laboratory alone) to designate an individual accountable for the organization's compliance with the Act, whose identity is disclosed to data subjects upon request. This is a hospital-wide role, not a Laboratory-level one, and is not automatically the Laboratory Quality Manager's role to hold — NPC guidance expects the DPO (or, for smaller organizations, a Compliance Officer for Privacy) to sit at an administrative/oversight level without conflicting operational duties, and to report directly to the head of the organization. Confirm with hospital administration who TCH's designated DPO/Compliance Officer for Privacy is (or, if none has been designated yet, raise this as a facility-level compliance gap for administration to close), and how the Laboratory should route DPO-related matters (data subject requests, potential breaches) to that person once confirmed.
• Data breach notification. If a personal data breach involving patient information is suspected or discovered (e.g., a lost unencrypted device, unauthorized access, or accidental disclosure), Medical Technologists and Laboratory Aides shall immediately notify the Chief Medical Technologist / Laboratory Quality Manager, who shall escalate to the hospital's Data Protection Officer without delay. Under current NPC requirements, the Commission and any affected patients must be notified within seventy-two (72) hours of the hospital's becoming aware of a breach reasonably believed to involve sensitive personal information, with a fuller report to follow the NPC within five (5) days of that notification. No delay in notification is permitted where the breach affects 100 or more individuals or involves sensitive personal information capable of causing harm.

6.0 Records

Implementation of this policy generates the following records/forms.

Signed agreement forms are retained per Section 5.2 item 6 above and Control of Records.

7.0 References

• DOH-Philippines QMS Tool, Section 6 — Information Management System
• DOH Administrative Order No. 2021-0037, Annex A — General Guidelines; Annex B1 — Technical Standards for Clinical Laboratories
• ISO 15189:2022, Section 4 — General Requirements
• WHO LQMS Handbook, Chapter 17 — Information Management
• Republic Act No. 10173, Data Privacy Act of 2012 and National Privacy Commission Implementing Rules and Regulations

Companion policies:

• Orientation Policy — staff orientation where confidentiality agreements are executed
• Control of Records — retention and protection of signed confidentiality agreements
• Laboratory Information Management Policy — electronic access controls and laboratory information security