Implementation of the Philippine Health Information Exchange

January 20, 2016

DOH-DOST-PHILHEALTH JOINT ADMINISTRATIVE ORDER NO. 2016-0001

 

I. Rationale

Two main challenges of today's health system are access to health care services, and access to real time information for decision making. At present, seventy percent of the population living in rural areas are still struggling with no or limited access to quality inpatient and outpatient care services. Recent health demographics studies showed that the segmented distribution of the health facilities and healthcare providers contribute largely to this alarming situation as exemplified by the fact that only 13% of healthcare providers and 40% of tertiary hospitals are situated in non-urban areas; let alone that on the average, the time it takes to travel to a local health facility usually takes around 39 minutes. Further, access to real time information for decision making is constrained with delayed availability of health statistics.

Consistent with the implementation of Universal Health Care or Kalusugan Pangkalahatan (UHC/KP), the health sector through the leadership of the Department of Health (DOH) recognizes the necessity of using information and communication technology (ICT) for health or eHealth as one of the enabling strategic instruments to support and facilitate the achievement of the national health system goals of better health outcomes, sustained health financing, and responsive health system. In its broadest sense, eHealth is concerned with improving the flow of information, through electronic means, to support and facilitate the delivery of quality and responsive health services and the management of health systems. It is envisioned that by 2020, eHealth will enable widespread access to health care services, health information, and securely share and exchange patient's information in support to a safer, quality health care, more equitable and responsive health system for all the Filipino people by transforming the way information is used to plan, manage, deliver and monitor health services.

Guided by the Philippine eGovernment Master Plan of linking government data centers and databases to create a secure network for government information systems, and harmonize information technology systems in the public sector through the Medium-Term Information and Communication Technology Harmonization Initiative (MITHI), the Department of Health, Philippine Health Insurance Corporation (PhilHealth) and Department of Science and Technology (DOST) joined hands together in the development and implementation of the Philippine eHealth Strategic Plan (PEHSP) 2014-2020. The Plan highlights the ongoing development and implementation of a harmonized National eHealth Program (NeHP), and the continuing finalization of the key milestones and strategic activities to ensure alignment and interoperability among various eHealth initiatives, programs and/or projects under the NeHP, and in accordance with the MITHI. The collaboration and partnership of the stakeholders are embodied in the issuance of the Joint DOH-DOST Department Memorandum (DM) No. 2013-0200 on the Creation of a Joint National Governance on eHealth (JNGeH), which later became the default MITHI eHealth Committee or Health Cluster, and later reconstituted in April 2015 through Joint DOH-DOST DM No. 2015-0097 and 2015-0098.

Guided by the PeHSP for UHC/KP, one of the identified critical eHealth projects is the Philippine Health Information Exchange (PHIE). The PHIE is a platform for secure electronic access and efficient exchange of health data and/or information among health facilities, health care providers, health information organizations, and government agencies in accordance with set national standards in the interest of public health. The PHIE is envisioned to become an integral component of the health care delivery system as part of health services available to all patients. It shall integrate and harmonize health data coming from different electronic medical record systems and hospital information systems. It shall provide an infrastructure for data/information sharing between health care providers, and support access to patients' records across providers in all geographic areas of the country; thereby, improving efficiency and reliability of communication among participating health care providers. In general, its implementation shall promote public health, improve total patient care and better decision making, while safeguarding the right to privacy of every individual.

The PHIE responds to the call of the national government to create a citizen-centric government, where on 17 March 2015, the Secretary of Health, Secretary of Science and Technology (DOST), President and Chief Executive Officer of PhilHealth, and Executive Director of Information and Communications Technology Office (ICTO) of DOST entered into a Memorandum of Agreement on its management and implementation, including other related eHealth projects. From the health sector standpoint, the implementation of PHIE supports the attainment of UHC/KP to foster good governance, strengthen accountability, increase transparency, and advance operational efficiency of various stakeholders in the health sector and to deliver quality services and make information available to various service providers and the people.

II. Declaration of Policies

1. Operational and summary data strengthens health systems and improves efficiency and outcomes in health service delivery. The operational data documents routine activities at the health provider level, whereas the summary data is used to manage national health resources, develop policies, assess performance, and determine major investments, technical assistance and programs needed to achieve national health goals. Thus, information need to be made available when needed.

2. Health data standards for interoperability must be complied in all health facilities to gain a true picture of the Philippine Health System, e.g., health status of the Filipino people, health issues, concerns and/or problems that can be readily addressed by the health sector, and others. CAIHTE

3. Health Enterprise Architecture provides a holistic view of the country's health processes/systems, information, information technology assets, and interoperability standards. It serves the guide in the development of health information systems to meet the country's requirements and support improvements in the health systems; helps describe the state of the health information system in the country; as well as provide the roadmap for continuing growth.

4. This Joint Administrative Order shall complement the following issuances, resolutions or provisions:

4.1. National Laws

4.1.1. 1987 Philippine Constitution Article II Section 15 and Article 13, Section II.

4.1.2. Republic Act 8792 or the "e-Commerce Act of 2000."

4.1.3. Republic Act 10173 or the "Data Privacy Act of 2012."

4.2. National Strategy Guidelines

4.2.1. Philippine Development Plan 2011-2016.

4.2.2. Philippine Digital Strategy 2011-2016.

4.2.3. eGovernment Master Plan 2013-2016.

4.2.4. Philippine eGovernment Interoperability Framework.

4.2.5. Integrated Government Philippines (iGovPhil).

4.2.6. Philippine eHealth Strategic Plan 2014-2020.

4.2.7. Department of Health's Health Enterprise Architecture.

4.2.8. Philippine Health Insurance Corporation's Health Enterprise Architecture.

4.3. Issuances

4.3.1. Executive Order No. 265 or the Government Information Systems Plan (GISP).

4.3.2. Joint Memorandum Circular No. 2012-01 on the Government-Wide Information and Communication Technology Harmonization Initiative (MITHI) for FY 2014-2016.

4.3.3. Memorandum Circular No. 2014-09001 on the Approval of the Philippine Electronic Government Interoperability Framework (PeGIF) Version 1.0 for Implementation by Government Agencies.

4.3.4. Joint Department of Health and Department of Science and Technology Department Memorandum 2015-0097 on the Reorganization of the National eHealth Steering Committee as the MITHI Health Cluster Steering Committee.

4.3.5. Joint Department of Health and Department of Science and Technology Department Memorandum 2015-0098 on the Reorganization of the National eHealth Technical Working Group.

4.4. International Commitments: The Philippines is a signatory to a number of global agreements such as the Millennium Development Goals, the Geneva Declaration on the World Summit on Information Society, and the 58th and 66th World Health Assembly.

III. Objectives

This Joint Administrative Order aims to institutionalize the adoption and implementation of the Philippine Health Information Exchange as an integral component of the health care delivery system to support and facilitate the attainment of Universal Health Care.

Detailed objectives are as follows:

1. Set direction and define the policies to guide decisions and achieve rational outcomes in the implementation of the PHIE.

2. Provide the operational mandate and management guidelines for the implementation of PHIE based on the agreed upon policies and protocols.

IV. Scope of Application

This Joint Order shall apply to all DOH Central and Regional Offices, Philippine Health Insurance Corporation Central and Regional Offices, other DOH attached agencies, Department of Science and Technology Central Office, public and private health facilities, health care providers, and software developers and providers of electronic medical record systems (EMRS) and health information systems (HIS). DETACa

V. Definition of Terms

For purposes of this Order, the following terms are defined as follows:

1	Authentication	The process for verifying that an individual, entity or software program
		accessing the PHIE is the authorized user the person, entity or program
		claims to be.
2	Authorization	The process of determining whether a user has the right to access the
		PHIE and determining the privileges associated with such access.
3	Authorized User or	An individual who has met the requirements of the PHIE policy for
	User	obtaining access authority.
3 n	Consent	Freely given, specific, informed indication of will, whereby a patient agrees
		to the collection and processing of personal information about and/or relating
		to him/her. It is evidenced by signing the written Patient Consent Form. It may
		also be given in behalf of the patient's by his/her authorized representative.
4	Governing	Set of principles that provide foundation for the development and
	Principles	implementation of the PHIE policies and procedures.
5	Health Facility	Government and private health facilities, in particular rural health units
		(RHUs), health centers and hospitals.
6	Health Information	Allows different applications to exchange data with each other without
	Exchange	loss of semantics and allowing health facilities to communicate with each
		other effectively and collaborate in the care of patients and providers.
7	Incident	An event involving an unauthorized activity related to sensitive personal
		information like unauthorized access, use or disclosure whether hardcopy,
		electronic or oral.
8	Incident Response	Specifies requirements for ensuring and managing the security of the PHIE.
	and Mitigation
9	Limitation	A definite extent beyond which action may be discontinued.
10	Operation Center	Central command and control facility responsible for carrying out the
		principles of PHIE.
11	Opt-in	The patient has permitted to disclose health data information via inquiry
		through the PHIE.
12	Opt-out	Temporary cancellation/restriction of the patient's permission to disclose
		health data information via inquiry through the PHIE.
13	Opt-back	The patient will reinstate the permission to disclose health data, information
		after opting-out.
14	Participating	Health Care Providers whose application to the PHIE is approved.
	Health Care
	Providers
15	Personal	Any information, whether recorded in a material or not, from which the
	Information	identity of an individual is apparent or can be reasonably and directly
		ascertained by an entity holding the information, or when put together
		with other information would directly and certainly identify an
		individual as defined in RA 10173 (Data Privacy Act of 2012).
16	Reinstatement	Reactivation of a participating health care provider's (PHCP)
		participation in the PHIE.
17	Sensitive Personal	Refers to personal information as defined in RA 10173, specifically
	Information	focusing on (2) About an individual's health . . . for purpose of this
		Administrative Order.
18	Stakeholders	External Stakeholders: Partners, Suppliers, Shareholders, Regulators/
		Government, External Users, Clients, Standard Organizations, External
		Auditors, Consultants, others.
19	Suspension	Temporary deactivation of a PHCP's participation in the PHIE.
20	Tamang Serbisyo	PhilHealth benefit package which includes the following 3 main provisions:
	Para sa Kalusugan	a) primary preventive services b) diagnostic examinations c) drugs and
	ng Pamilya	medicines for certain diseases. Formerly known as Primary Care Benefit
	(TSeKAP)	1 Package.

VI. General Guidelines

1. The PHIE shall be:

a) An integral component of the health care delivery system. Its implementation shall promote public health, improve total patient care and better decision making, while safeguarding the right to privacy of every individual; and

b) Administered by a governance and management structure as agreed upon by the participating agencies through the National eHealth Steering Committee (NeHSC) and the National eHealth Technical Working Group (TWG). Select best management practices shall be used in order to achieve the overall objectives of PHIE.

2. The implementation of PHIE shall be:

a) Conducted by the appointed governance and management structure in collaboration with eHealth Program Management Office (PMO), other eHealth Experts Groups and Teams (eHG/T), public and private health facilities, regional and provincial health offices, software developers of EMRS and HIS, and other stakeholders, under the guidance of the NeHSC and the TWG. Participation and collaboration with stakeholders shall be purposive, coordinative, harmonized and productive;

b) Essentially grounded on respect for universal principles of ethics, legal standards, and guiding principles on primacy of human rights and protection of health information privacy as defined by Philippine laws, international instruments, and other applicable policies; and

c) Operationally governed by the principles of specification of purpose; universal principle of ethics; limitation of information; quality and integrity; security controls; individual rights; and transparency and openness.

3. The implementation of the PHIE shall follow a use case/scenario approach, with the initial implementation essentially focusing on the PHIE Lite, the harmonization of applications and health information systems of DOH and PhilHealth. Other use cases/scenarios such as electronic delivery of examination results from a laboratory to the ordering health care provider, sending continuity of care document from one health care provider to another, and sending of requested medical documentation from one health care provider to another shall be eventually introduced and integrated into PHIE for implementation as duly prioritized by the NeHSC and the TWG through the PHIE Governance and Management Structure (GMS).

4. All individuals and organizations involved in the implementation of the PHIE, particularly the PHIE officers and personnel, participating health care providers, software developers/vendors of electronic medical record systems and health information systems, public and private health facilities, and other implementers and end-users, shall be required to comply with all applicable Philippine laws and regulations including, but not limited to, protecting the confidentiality and security of sensitive personal information, implementing privacy rights of an individual, policies and procedures of the PHIE and not for any unlawful or discriminatory purpose. aDSIHc

5. The success of the PHIE shall be measured by the progress made in: a) ensuring financial risk protection through expansion in health insurance enrolment and benefit, prioritizing the poor; b) improving access to quality hospitals and health facilities; and c) attainment of the health-related Millennium Development Goals through implementation of the High Impact Five (HI5) strategic interventions.

6. The consent of the patient for participation in the PHIE shall be obtained prior to the processing of their health information, including their sensitive personal information.

7. All standards (i.e., PHIE Manual of Operations, other policy guidelines, and PHIE solutions) for the implementation of the PHIE shall be developed and made updated as needed by the appointed PHIE GMS in collaboration with the eHealth PMO, and shall require approval of the NeHSC through the TWG.

8. The approved PHIE Manual of Operations shall serve as the canonical implementing procedures and guidelines for the continuous development/enhancement, implementation and/or expansion, and operational maintenance of the PHIE.

VII. Specific Guidelines

1. Governance and Management

1.1. The NeHSC shall establish vision and strategic priorities, provide executive direction, oversight, and decision making for the PHIE, and manage the PHIE governance and management structure through the TWG and eHealth PMO.

1.2. The TWG shall provide tactical guidance and input, develop goals and objectives, provide management oversight of collaboration among the PHIE governance and management structure, the various eHealth experts groups and teams, participating agencies, private partners, academe, and other stakeholders for the implementation of the PHIE.

1.3. The eHG/T shall provide direction and tactical input on specific PHIE subject matter area coverage from expert resources from participating agencies, private partners, academe, and other relevant stakeholders.

1.4. The eHealth PMO shall provide the overall management in the planning, development, implementation, and operation of the PHIE in collaboration with the appointed PHIE governance and management structure through ensuring engagement of and collaboration among the appropriate governance components, and efficient PHIE operations.

1.5. The PHIE GMS shall be composed of business process owners, IT officers, and other support personnel from select stakeholder agencies as duly appointed by the NeHSC through the TWG.

1.6. Selected best management practices shall be used to achieve increased value creation, obtain user satisfaction, achieve compliance with relevant laws, regulations and policies, improve relation between users and information technology, increase governance over enterprise information technology, and connect and align with other major frameworks and standards for the implementation and sustainability of the PHIE. The approved management practices shall serve as basis for the NeHSC and TWG in defining the duties and responsibilities of the PHIE GMS.

2. Participation

2.1. Participating Health Care Providers

Application

a. Health care providers shall be required to apply to the PHIE to avail of its data sharing and exchange services. Participation shall be based on the approved PHIE application by the appointed PHIE Governance and Management Structure.

b. Application shall be made by submission of the accomplished application form with the following data: Name (Last Name, First Name, Middle Name); Sex; Date of Birth; Complete Address; Contact number; Email Address; Professional Regulation License Number; and PhilHealth Accreditation Number.

Duties and Responsibilities

In participating in PHIE, the PHCPs shall be required to exercise the following functions, among others:

a. At all times be aware of the most recent provisions and updates of existing laws and regulations, policies and procedures of the PHIE through keeping themselves abreast of policy revisions issued by the DOH, PhilHealth, DOST, PHIE and other regulatory agencies, and subsequently maintaining the most updated versions of these documents. ETHIDa

b. Maintain compliance with the requirements of the PHIE policies and procedures in order to retain participation. A PHCP shall use the PHIE only for treatment and care coordination purposes. Violations shall be dealt with in accordance to established policy.

c. Secure authorization from patients regarding the latter's participation in the PHIE. The PHCPs shall inform their patients about the PHIE and its standard protocols for collecting, storing, and processing of their sensitive personal information, and their rights (i.e., opt-in, opt-out, and opt-back) as information owners to enable them to willingly and rightfully decide on participation. Patients shall be informed of the list of information that will be collected, stored, and processed via the PHIE.

d. Strictly prohibited from using and processing sensitive personal information for fund raising or any form of marketing, to sell such information to other parties for commercial gain, for purposes not necessary for their functions, or for any other unlawful or discriminatory purposes.

e. Responsible in correcting or editing information in the PHIE as requested for amendment by the patient or PHCPs through the PHIE Management Group, and duly reviewed and accepted for editing by the PHCPs. The PHCPs shall also be responsible in correcting the paper or electronic copies of the incorrect information received via the PHIE.

f. Report to the appointed PHIE Management Group in the soonest possible time any issues, concerns, and/or problems that may arise during their use and access to PHIE such as incorrect patient match, wrong information about the patient, erroneous entries, or any other unusual occurrences.

g. Develop and implement appropriate operating policies and procedures, compliant with applicable Philippine laws and regulations and the PHIE protocols, at their reporting health facility to ensure and maintain data integrity, security and confidentiality in all their PHIE transactions.

2.2. Patients

a. Patients shall be required to accomplish the Patient's Informed Consent regarding individual participation in the PHIE. If a patient agrees to participate in the PHIE, all sensitive personal information shall be made available for query to all participating PHCPs through the PHIE.

b. For request for amendment of sensitive personal information, patients shall be required to submit the accomplished PHIE Request for Amendment form to the PHIE Management Group for their endorsement to the concerned PHCP that provided the sensitive personal information for appropriate action.

3. Access Management

3.1. The standard procedures and guidelines on access management shall be in accordance with the approved IT security and access policies and standard requirements contained in the approved PHIE Manual of Operations as duly approved by the NeHSC through TWG.

3.2. All individuals involved in the implementation of the PHIE, particularly the PHIE officers and personnel, PHCPs, patients, and other end-users shall comply with and act in accordance with the approved standard procedures and guidelines on access management for PHIE.

4. Sharing and Exchange of Health Data/Information

The standard protocol for sharing and exchange of health data/information for PHIE shall be in accordance with the operational guidelines and requirements for sharing and exchange of health information contained in the approved PHIE Manual of Operations, taking into utmost consideration the relevant and applicable Philippine laws, particularly to the following provisions of Republic Act 10173:

4.1. Chapter III: Processing of Personal Information

4.2. Chapter IV: Rights of the Data Subjects

4.3. Chapter V: Security of Personal Information

4.4. Chapter VI: Accountability for Transfer of Personal Information

4.5. Chapter VII: Security of Sensitive Personal Information in Government cSEDTC

5. Appropriate Use and Disclosure

5.1. Sensitive personal information must be used for treatment and care coordination purposes only or to the extent necessary and permitted by applicable Philippine laws and regulations and policies of the PHIE.

5.2. The standard procedural protocol for appropriate use and disclosure of health information under PHIE shall be in accordance with the operational guidelines and requirements for use and disclosure of health information contained in the approved PHIE Manual of Operations, taking into utmost consideration the Guidelines for the Use and Disclosure of Health Information provided in Joint DOH-DOST-PhilHealth Administrative Order on the Privacy Guidelines for the Implementation of the Philippine Health Information Exchange, and the following provisions of Republic Act 10173:

5.2.1. Chapter III: Processing of Personal Information

5.2.2. Chapter IV: Rights of the Data Subjects

5.2.3. Chapter V: Security of Personal Information

5.2.4. Chapter VI: Accountability for Transfer of Personal Information

5.2.5. Chapter VII: Security of Sensitive Personal Information in Government

5.3. Use case/scenario-specific procedural guidelines on appropriate use and disclosure of health information shall be developed and made updated as needed.

6. Security Protocols

The standard security protocol for the implementation of PHIE shall be in accordance with the Guidelines on Data Security provided in Joint DOH-DOST-PHIC Administrative Order on the Privacy Guidelines for the Implementation of the Philippine Health Information Exchange, and largely, with the appropriate provisions of Republic Act 10173.

7. Infrastructure and Hosting Requirements

7.1. The infrastructure and hosting requirements for the implementation of PHIE shall be in accordance with the provisions provided in the Presidential Administrative Order No. 39 Series of 2013 — Mandating Government Agencies to Migrate to the Government Web Hosting Service of the Department of Science and Technology — Information and Communications Technology Office (DOST-ICTO).

7.2. Specific procedural and service guidelines shall be in accordance with the signed Memorandum of Agreement between DOH, PhilHealth and DOST-ICTO.

8. Incident Response and Mitigation

The procedure for breach notification and management, including termination, revocation of rights or privileges to PHIE and imposition of other penalties, shall be in accordance with the Incident Response and Mitigation Guidelines contained in the approved PHIE Manual of Operation.

9. System Maintenance and Sustainability

The maintenance and sustainability of the PHIE shall be a principal joint undertaking among DOH, PhilHealth, and DOST in collaboration with external partners such as the UP Manila — National TeleHealth Center, World Health Organization, academe, medical societies and stakeholder organizations, among others.

10. System Operations and Monitoring

10.1. The standard operating procedures, including implementation resources and other operational requirements shall be in accordance with the systems operations and monitoring guidelines contained in the approved PHIE Manual of Operations.

10.2. A PHIE Management Group, duly appointed by the NeHSC through TWG, shall be responsible for the day-to-day operations and compliance monitoring of the PHIE with approved policies and procedural guidelines.

VIII. Roles and Responsibilities

1. Department of Health, Philippine Health Insurance Corporation, Department of Science and Technology, Commission on Higher Education and University of the Philippines Manila

a. Jointly provide the overall direction, technical guidance, necessary resources and assistance to support the adoption, continuous development/enhancement and implementation of the PHIE, and its component registries and various use cases. SDAaTC

b. Establish coordination and networking with concerned agencies and other stakeholders in the continuous development/enhancement implementation, quality assurance, monitoring and evaluation of PHIE, and its component registries and various use cases.

c. Jointly review and approve the identified delivery, service, support and other requirements for the operationalization of the PHIE and its component registries and various use cases.

d. Provide relevant training to build capacity or capability to the TWG, the national eHealth experts group and teams, and pertinent government and private institutions involved in the adoption, continuous development/enhancement and implementation of the PHIE.

2. DOH Attached Agencies, other Government Agencies, Academe, Medical and Civil Society Organizations and other Private and Non-Government Institutions

a. Provide technical expertise and subject matter inputs pertaining to the adoption, continuous development/enhancement and implementation of the PHIE, and its component registries and various use cases as informed by the TWG and the NeHSC.

b. Participate in all requests for assistance, and response and work significantly with the appropriate national eHealth experts groups and teams in the adoption, continuous development/enhancement and implementation of the PHIE, and its component registries and various use cases as informed by the TWG and the NeHSC.

3. Stakeholders (DOH Hospitals, Health Care Providers, Local Health Facilities, Software Developers and Providers of EMRS and HIS, Public and Private Sector)

a. Comply with the approved and applicable delivery, service and support requirements, and operational mechanisms of the PHIE and its component registries and various use cases.

b. Ensure the integrity, security, and confidentiality of data and information being maintained, transmitted or exchanged pursuant to RA 10173 and other applicable Philippine laws.

c. Report issues, concerns, and/or problems that may arise in the participation in the PHIE and/or institution of its operational requirements and mechanisms at the participating/implementing points of services.

d. Provide relevant inputs to further improve the adoption, continuous development/enhancement and implementation of the PHIE, and its component registries and various use cases.

IX. Operational Budget

The DOH, PhilHealth, and DOST shall separately allocate funds and provide counterpart resources necessary and appropriate to the overall and regularly funded functions and projects of each agency for the proper implementation of PHIE. Each agency shall secure COA Post Audit review over any and all transactions for this project.

X. Repealing Clause

All issuances whose provisions are inconsistent with or contrary to any of the provisions of this Joint Administrative Order are hereby rescinded and modified accordingly.

XI. Separability Clause

In the event that any provision or part of this Joint Administrative Order is declared unauthorized or rendered invalid by any Court of Law or competent authority, those provisions not affected by such declaration shall remain valid and in force.

XII. Publication and Effectivity

This Joint Administrative Order shall take effect upon approval/signing by the Secretary of Health, Secretary of Science and Technology, and President/Chief Executive Officer of Philippine Health Insurance Corporation, and fifteen (15) days after its publication in two (2) newspapers of general circulation. acEHCD

Done in the City of Manila on January 20, 2016.

(SGD.) ALEXANDER A. PADILLAPresident and Chief Executive Officer

(SGD.) MARIO G. MONTEJOSecretary

(SGD.) JANETTE P. LORETO-GARIN, MD, MBA-HSecretary

 

Footnotes

n  Note from the Publisher: Copied verbatim from the official copy. Duplicate Item No.3.

Published in The Philippine Daily Inquirer on January 29, 2016.