EIGHTEENTH CONGRESS )
OF THE REPUBLIC OF THE PHILIPPINES)
First Regular Session )

HOUSE OF REPRESENTATIVES

House Bill No.__ 61.

Introduced by Representative Victor A. Yap

EXPLANATORY NOTE

One of the main challenges of Philippine health care system today is access to health care
services. Based on the data from the Department of Health (DOH), 70% of the population living
in rural areas are still struggling with no or limited access to quality inpatient and outpatient care
services. This is because only 13% of healthcare providers and 40% of tertiary hospitals are
situated in non-urban areas, On the average, according to DOH, it takes around 39 minutes for
Filipinos to travel to a local health facility.

Moreover, delayed access to timely, reliable, accurate, and complete health information
contributes to the challenges faced by health care professionals.

This bill aims to utilize information and communication technology (ICT) for health or
eHealth in order to deliver medical services and improve access to healthcare, particularly in
tural and underserved areas.

It promotes eHealth as equal with other healthcare delivery methods. Through the use of
ICT, eHealth enables the diagnosis, consultation, treatment, education, care management, and
self-management of patients at distance from health providers.

eHealth not only seeks to address current disparities in service care delivery, it also
improves the flow of health information to help achieve the Universal Health Care goal of a
more responsive health system. ICT can be used to enhance the timeliness and accuracy of health
reporting to better facilitate monitoring of diseases in the country.

In view of the foregoing, the immediate passage of this bill is earnestly sought.

Representstive, 2nd District of Tarlac


war anne wn

10
u
12

14
15
16
7
18

EIGHTEENTH CONGRESS: )
OF THE REPUBLIC OF THE PHILIPPINES)
First Regular Session

HOUSE OF REPRESENTATIVES

House Bill No. ac

Introduced by Representative Victor A. Yap

AN ACT
ESTABLISHING THE PHILIPPINE eHEALTH SYSTEM AND SERVICES IN THE
DELIVERY OF HEALTH SERVICES WITH THE USE OF INFORMATION AND
COMMUNICATIONS TECHNOLOGY IN THE PHILIPPINES, AND APPROPRIATING
FUNDS THEREFOR

Be it enacted by the Senate and House of Representatives of the Philippines in Congress
assembled:

ARTICLE I
GENERAL PROVISIONS
SECTION 1. Short Title. — This Act shall be known as the “Philippine eHealth Systems and

Services Act”.

SEC. 2. Declaration of Policy. - The State shall protect and promote the right to health of the
people and instill health consciousness among them. Hence, it is the intent of the Legislature to
institutionalize a system of providing wide access and quality healthcare services through
electronic means using Information and Communication Technologies (ICT) or eHealth
resulting in improved health outcomes for every Filipino, and engaging the participation of the
private sector in the implementation of eHealth services.

SEC. 3. Objectives. - The eHealth Act shall provide a policy framework and establish a National
eHealth System that will direct and regulate the practice of eHealth in the Philippines.

The Philippine eHealth Systems and Services shall be comprehensive, integrative,
sustainable, measurable, synchronized, interoperable, and progressive based on best practices,
and shall facilitate inter-agency and inter-sectoral coordination at various levels of governance
covering both the public and private sectors. It shall: recognize eHealth as equal with other
healthcare delivery methods to the extent allowable by existing laws, provide and support

healthcare delivery, including diagnosis, consultation, treatment, transfer of care of patient,


1
2
3
4
5
6
7
8
9

10
uu
12
13
14
15
16
7
18
19
20
21
2
23
24
25
26
7
28
29
30
31
32
33
34
35
36
37
38

exchange of health data and education, especially in medically unserved and underserved
geographically isolated and disadvantaged areas (GIDAs):

a)

utilize information and communication technology (ICT) to deliver health services
which has the potential to be profitable, improve quality, change the conditions of
practice, and improve access to healthcare, particularly in rural and other medically
underserved areas;

b

develop infrastructure for ICT for health to promote equitable, affordable, and
universal access to health services;

©) set policies and standards, and establish regulations regarding the field of eHealth;

d

designate national and regional centers and networks of excellence for eHealth best
practices, policy coordination, and technical support for healthcare delivery;
e

facilitate the exchange and access to secured personal health information, including
health providers sharing and use health and medical information to improve care as
well as public access to relevant information for the promotion of their own personal
health;

f) ensure harmonization or integration, alignment and interoperability among various
eHealth initiatives, programs and projects across the country, and in accordance with
the national agenda and priorities, and international eHealth practices, directions and
standards; and

facilitate inter-agency and inter-sectoral coordination at various level of governance

8
covering both public and private sectors.

SEC. 4. Definition of Terms. — As used in this Act:

a) Electronic health or eHealth refers to the use of cost-effective and secure

information communications technology for health;

b

Electronic Medical Records refer to the medical background and history of medical
service provider’s patient and such other information to be designed and developed
by the Record Center. It shall be presented in a standard electronic format;

c

eHealth Practitioner refers to any healthcare provider from public or private sector;

d)

eHealth Systems refers to an organized and structure application of eHealth,
integrated in the regular workflow of healthcare facilities;

©)

Geographic Isolated and Disadvantage Areas (GIDAs) refer to communities with

3


wCorvraneune

10
n
12
13
14
15
16
7
18
19
20
a
22
23
24
25
26
27
28
29
30
31
32
33

35
36
37
38

marginalized population physically and socio-economically separated from the
mainstream society and characterized by:

1. Physical factors such as those isolated due to distance, weather conditions and
transportation difficulties (island, upland, lowland, landlocked, hard to reach

and unserved or underserved communities), and

2. Socio-economic factors such as high poverty incidence, presence of
vulnerable sector, communities in or recovering from situation of crisis or

armed conflict;

f) Health Center refers to an organized and structure application of eHealth, integrated
in the regular workflow of healthcare facilities;

2) Information and Communications Technology (ICT) refers to the totality of
electronic means to access, create, collect, store, process, receive, transmit, present,
and disseminate information;

h) Licensable Healthcare Professionals refer to healthcare professionals applying for

license to practice telehealth services;

i) Live video refers to the two-way interaction between a person (patient, caregiver, or
provider) and a provider using audiovisual telecommunications technology. This type
of service is also referred to as realtime and may serve as a substitute for an in-

person encounter when it is not available;

j) Medical Practitioner refer to licensed physicians who practice their profession in
urban cities and municipalities;

k) Medical Service Providers refer to all medical practitioners, hospitals, clinics, centers

and other similar institutions that provide medical care service and assistance;

1) Mobile Health refers to the health care and public health practice and education
supported by mobile communication devices such as cell phones, tablet computers,
and PDAs. Applications can range from targeted text messages that promote healthy
behaviour to wide-scale alerts about disease outbreaks;

m) Originating site refers to the site where the patient is located at the time of provision


we eVvnaneawne

10
1
2
13
14
15
16
7
18
19
20
a
22
23
24
25
26
a
28
29
30
31
32
33

35
36
37
38

0)

p)

co)

s)

t)

of healthcare services through telecommunication systems;

Records Center refers to the Electronic Medical Records Center created under this
Act;

Remote Patient Monitoring refers to the personal health and medical data collection
from an individual in one location via electronic communication technologies, which
is transmitted to a provider (sometimes via a data processing service) in a different
location for use in care and related support. This type of service allows a provider to
continue to track healthcare data for a patient once released to home or a care facility,

reducing readmission rates.

Secure Socket Layer or SSL refers to the technology which negotiates and employs
the essential function of mutual authentication, data encryption and data integrity for
secure transactions. The SSL security protocol; provides data encryption, server
authentication, message integrity, the client authentication for a transmission control
protocol (TCP) or IP connection;

Store-and-forward refers to the transmission of recorded health history through a
secure electronic communications system to a practitioner, usually a specialist, who
uses the information to evaluate the case or render a service outside of a real-time or
live interaction, This service provides access to data after it has been collected and

involves communication tools such as secure e-mail;

Telehealth refers to the delivery of health-related services and information via
telecommunication technology which encompasses preventive, promotive, curative,
and palliative aspects. It is also a collection of means or methods for enhancing
health care, public health, and health education delivery and support in the field of
dentistry, counselling, physical and occupational therapy, home health, chronic
disease monitoring and management and other related health fields using
telecommunications technologies that perform live video, store-and-forward, remote

patient monitoring and mobile health;
Telehealth Center refers to an office located within a hospital designated for the
purpose of conducting telehealth services and is equipped with the necessary tools

and manpower;

Telemedicine refers to the use of telecommunication technology to provide healthcare


wearvrauawn

services from a distance which focuses more on the preventive and curative or

treatment aspect;

u) 128-bit Encryption refers to the encrypted transaction that secures confidential data
or contents of a message wherein the original information can be recovered through
the use of a corresponding decryption process.

SEC. 5. Scope. ~ This Act covers all existing eHealth practitioners, institutions, entities, services
and related applications in both public and private. It shall not alter the scope of practice of any
healthcare provider or authorize delivery of health care services in any manner not authorized by
law. It shall cover all other eHealth solutions and services including relevant standard equipment
in the field of health and ancillary services that uses ICT and are complementary to existing
minimum modalities or standards of health care and other access to information.

ARTICLE I
eHEALTH SERVICES AND SOLUTIONS

SEC. 6. Services and Application. ~The National eHealth System shall provide tangible means
for enabling services and systems including access to, exchange and management of information
and content for the general public, patients, providers, insurance, and other which may be
supplied by government or private businesses.

SEC. 7. Scope of eHealth Services and Solutions. ~ eHealth is an umbrella term which includes
the following areas:

a) Health informatics refers to interdisciplinary study of the design, development,
adoption, and application of IT-based innovations in healthcare services delivery,
management, and planning;

b

Telehealth refers to the delivery of health related services and information via
telecommunication technology which encompasses preventive, promotive, curative,
and palliative aspects;

©

Telemedicine refers to the use of telecommunication technology to provide healthcare
services from a distance; focuses more on the curative or treatment aspect;
dq)

Electronic learning or e-learning refers to learning utilizing electronic technologies to
access educational curriculum outside of a tradition classroom;

e) Electronic Medical Record or Electronic Health Record refers to software systems

which contains encoded form of documentation of patient’s health information,
f) Electronic prescription or e-prescription refers to an electronic generation of a


ears Hewne

u
12
13
14
15
16
7
18
19
20
a
2
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

physician’s prescription, transmission and filling of medical prescription;

g) Virtual healthcare teams refer to professionals who collaborate and share information

on patients with digital equipment;

h) Mobile health or mHealth refers to medical and public health practice supported by
mobile devices such as mobile phones, patient monitoring devices, personal digital
assistants (PDAs), and other wireless devices;

i) Social media for eHealth refers to the opportunities for the healthcare industry to
engage with patients and healthcare professionals through online communications
channels dedicated to community-based input, interaction, content-sharing and
collaboration;

j) Health Information Exchange refers to the solution which enables data sharing and
exchange between healthcare providers and facilities, and support access to the
patient’s record across providers in many geographic areas of the country;

k

Knowledge management system refers to any kind of IT system that stores and
retrieves information, improves cooperation and collaboration, locates knowledge
sources, manage repositories, and enhance knowledge management; and

1) Patient Self-Education about Healthcare refers to the patient’s use of the internet
through personal computers or mobile devices to research on medical and
pharmacological information, treatment options, or search for healthcare facilities
available in their area.

SEC. 8. Telehealth and Telemedicine Services. ~ Telehealth is an approach of providing
healthcare services and public health with the use of ICT to enable the diagnosis, consultation,
treatment, education, care management, and self-management of patient at distance from health
providers. However, it shall not be understood to modify the scope of medical practice or any
healthcare provider or authorized the delivery of healthcare service in a setting or manner not
otherwise authorized by the law.

SEC. 9. Electronic Medical or Health Record (EMR or EHR). ~ A\l data in the EMR or EHR
shall be considered protected health data and shall be governed by established rules for access,
authentications, storage and auditing, and transmittal.

SEC. 9.1. Disclosure. — Disclosure of and accessibility to protected data in the EMR or
EHR shall be limited and standardized following international and local rules and
regulations. Patients may secure a copy of their EMR or EHR upon request and shall
provide informed consent if their EMR or EHR is shared with third parties except when
these are processed for the production of aggregate health statistics, for social health


wor aouswne

insurance claims based on established guidelines, for public health emergency concerns

and national security.

‘The data in the EMR or EHR shall be encrypted and any unauthorized access of the EMR
or EHR shall be punishable under Republic Act No. 10173 or the Data Privacy Act.

SEC. 9.2. Covered Entities. — Covered entities may disclose protected health information
to law enforcement officials performing their official duties and responsibilities as
required by existing national and local laws and with proper order from duly concerned
bodies.

SEC. 10, Electronic Medical Records Facilities Creation, Maintenance and Uploading. ~ All
provisions of existing laws to the contrary notwithstanding medical service providers shall create
and maintain electronic medical records which shall be electronically uploaded on a regular
basis. The medical service providers shall likewise maintain hard copies of the electronic records
to be printed and stored as backup records.

All concerned medical service providers may elect to keep their own existing format in
addition to the new electronic record and its back-up for purposes of their own use or in
providing hard copies to patients: Provided however, that back-up copies of electronic records
shall, at all times, be included when providing hard copies to the requesting patients.

The electronic medical records facilities aside from the keeping records, shall likewise
provide for an electronic facility where patients and medical service providers can communicate

on-line either in real time or off-line.

The EMR may also be integrated with civil registries to facilitate recording of vital

information.

SEC. 11. Electronic Medical Records Center, — There shall be created an Electronic Medical
Records center to be placed under the Office of the Secretary of the Department of Health. The
Center shall serve as a hub of all databanks of medical records and other pertinent information to

the patient’s medical history.

‘The records center shall generate specialized software to be distributed and used as the
standard platform for the maintenance, updating, uploading and making available electronic
Medical Records.


we eyvanewne

10
a
12
13
14
15
16
7
18
19
20
2

23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

‘The center shall enforce strict compliance with uploading and updating of electronic
medical records as provided for in this Act.

SEC. 12. Security Features of Electronic Medical Records. — In order to ensure the privacy of
all medical records, electronic communication and transactions shall use existing 128-bit
encryption or higher form of Secure Socket Layer (SSL) technology which may be devised in the

future,

‘The security features of the electronic medical records shall likewise comply with the
security provisions as provided in Republic Act No. 8792 or the Electronic Commerce Law of
2000.

SEC. 13. Creation of EMR or EHR. — EMR or EHR can be created by the following
professionals if it is necessary for the medical care of the patients:

1) Doctors;

2) Dentists;

3) Pharmacists, pharmacy assistants, pharmacy engineers;
4) Psychotherapist;

5) Nurses; and

6) other allied health professionals

Hospital assistants in preparation for their assisting occupation, insofar as this is
permissibly required for their occupational tasks'and their access are being carried out under the
supervision of the aforementioned persons. EMR software should be standardized and should
have certification by the DOH.

SEC. 14. Standards of Care. — The standards of care to be provided shall be based on
established clinical or service guidelines and services given must be the same regardless of
whether a healthcare provider provides healthcare services in person or electronically. The
attending physician shall be primary accountable for the healthcare delivery of eHealth systems
and services.

eHealth shall not replace health care providers providing services in person or relegate
them to less important role in the delivery of healthcare. The fundamental healthcare provider
patient relationship is not only to be preserved but also augmented and enhanced.


ARTICLE UL
eHEALTH SYSTEMS COMPO! iTS

SEC. 15. The eHealth Components, — The following components are the building blocks that
shall be put in place to realize the national eHealth vision and allow the eHealth outcomes to be

achieved:

weaoranewne

st
12
13
14
15
16
7
18
19
20
a
2
23
24
25
26
2

29
30
31
32
33
34
35
36
37
38

a) Leadership and Governance — Directs and coordinates eHealth activities at all levels
like hospitals and health care providers. Critical areas of governance are management
of the eHealth agenda, stakeholders’ engagement, strategic architecture, clinical

safety, management and operation, monitoring and evaluation, and policy oversight.
b)

eHealth Services or Solutions — Required service and applications to enable

widespread access to health care services, health information, health reports, health

care activities, and securely share and exchange patient’s information in support to
health system goals. These address the needs of the various stakeholders like
individuals, health care providers, managers, officials, and others.

c) Standards and Interoperability — Defines standards of eHealth systems and services,
and promotes and enables exchange of health information across geographical and
health sector boundaries through use of common standards on data structure,
terminologies, and messaging. The implementation of software certification or
accreditation where eHealth data standards for interoperability.

d) Poli

compliance mechanisms to support the attainment of the quality and acceptable

and Compliance — Formulation of the required policies, guidelines and

eHealth systems and services.

©)

Infrastructure — Establishes and supports the ICT and medical base to enable
provision of eHealth services and health information exchange to enable sharing of
health information across geographical and health sector boundaries, and
implementation of innovative ways to deliver health services and information.

f) Human Resources — Workforce or professionals that develop, operate, uses or
implement the national eHealth environment such as the health workers who will be
using cHealth in their line of works, health care providers, information and
communication technology workers, and others.

g) Strategy and Investment — Schemes and outlay that are needed to develop, operate

and sustain the eHealth Systems and Services. These components support the

development of a strategy and plans to serve as guide in the implementation of the
eHealth agenda. Investment refers to the funding or amount needed for executing the
strategies and plans.

10


Corvraunewn

un
12
13
14
15
16

18
19
20
2
22
23
24
28
26
27
28
29
30
31
32

35
36
37

ARTICLE IV
LEADERSHIP AND GOVERNANCE

SEC. 16. Lead Agency. ~ The Department of Health (DOH) shall be the lead agency in
implementing this Act. For the purpose of achieving the objectives of the Act, the DOH shall

a) Establish an inter-agency and multi-sectoral National eHealth Steering Committee;

b) Spearhead the establishment of a National eHealth System and Service;

d) Coordinate with the Department of Science and Technology (DOST), the Department
of Information and Communication Technology Office (DICT) and the Philippine
Council for Health Research and Development (PCHARD), Philippine Health
Insurance Corporation (PhilHealth), University of the Philippines — National
‘TelehealthCenter (UPM-NTHC), Medical and Paramedical Specialty Societies,
Boards and Associations, Professional Regulation Commission (PRC) and various
health services providers and facilities including the academe and patient groups, and
other stakeholders;

°)

Create or identify an Office to coordinate the development and implementation of a
National eHealth System and Services among agencies concerned and provide
direction and guidance to all DOH offices and attached agencies including the local
government units and the private sector; and

f) The Telehealth Centers shall be under the supervision of the Department of Health,

SEC. 17. National eHealth Steering Committee. — To ensure the implementation of this Act and
to serve as an executive body of the Philippine eHealth System and Services (PNeHSS), the
National eHealth Steering Committee shall be created and made an integral part of the DOH. It
shall also provide policy oversight and ensure that its implementation is consistent and pertinent
laws such as Republic Act No. 8792 or the Philippine E-Commerce Law, Republic Act No.
10173 or the Data Privacy Act of 2012, and other commitments to the international health
community. The National eHealth Steering Committee can also provide strategic directions to the
health sector towards the integration of Philippine services in view of the ASEAN integration.

‘The Secretary of the Department of Health shall act as Chairperson.

The following shall serve as members:

a) Secretary, Department of Science and Technology;

b) Secretary, Department of Information and Communication Technology;
c) Secretary, Department of Social Welfare and Development,

ce


we aervrourewne

10
n
2
13
14
15
16
7
18
19
20
24)
2
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

ge

=

Secretary, Department of Interior and Local Government;

President and Chief Executive Officer, Philippine Health Insurance Corporation,
Commissioner, Professional Regulatory Commission;

Commissioner, Commission on Higher Education;

Commissioner, National Privacy Commission;

Commissioner, National Anti-Poverty Commission;

President, Philippine Hospital Association;

President, Philippine Medical Association;

A representative from the Association of Municipal Health Officers/PHO/CHO; and

Members of the Committee shall be appointed by the President of the Philippines and shall serve

for three (3) years for a maximum of two (2) consecutive terms, unless recalled, replaced or

resigned from office. The Committee shall exercise the following functions:

a

b

C)

d

fc

8)

bh

Establish eHealth policies, standards, regulations, and ethical frameworks pertinent to
use, practice and provision of eHealth services;

Direct and coordinate the eHealth system and services at the national level and ensure
alignment of the system and services with the overall health goals of the government;
Spearhead the activities that promote eHealth awareness and engages the participation
of stakeholders,

Formulate responsive plans and strategies for the development of a national eHealth
environment in coordination with major stakeholders and affected sectors;

Set and develop policies and programs for the advancement of eHealth, and impose
necessary regulatory mechanisms including penalties upon hearing and deciding
cases;

Create a technical working group, committees, and expert group to assist in the
development of the eHealth projects;

Create or identify the Telehealth Licensing and Regulatory mechanisms and body to
implement the provisions of this Act;

Submit yearly assessments to the Senate Committee on Health and Demography and
the House of Representatives Committee on Health; and

Convene at least twice a year.

ARTICLE V
STANDARDS AND INTEROPERABILITY


waervraunnwn

1
12
13
14
15
16
7
18

20
a
2
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

SEC. 18. Standards, — Standards shall be introduced and imposed to facilitate interoperability
among systems and devices, provide unqualified privacy and security and to address the unique
needs. This must be complied with by various providers, centers, and systems developers to
enable consistent and services. The appropriate Committee as may be mandated in this Act shall
define and regularly update, and impose standards for inoperability among various eHealth

systems and services and ensure wide dissemination for easy access of all concerned.

eHealth systems and services can potentially transform healthcare through mobile health
delivery, personalized medicine, and social media eHealth applications. Reaching the potential
for advancements in eHealth shall only be achieved through information and communication

technology standards efforts that facilitate interoperablitiy among systems and devices, of the
developing world, and leverage existing ubiquitous technologies such as social media
applications and mobile devices.

SEC. 19, Interoperablility framework. ~ The eHealth interoperability shall be defined and must
be in consonance to DOH national eGovernment interoperability framework and established
internal standards.

SEC. 20. Secure Health Information Exchange (HIE). ~ The DOH, DOST, DICT, and
PhilHealth shall establish a secured health information exchange using a common trust
framework and a common set of rules which serves as the foundation for electronic information
exchange across geographical and health-sector boundaries. The HIE includes the physical
infrastructure, standards, core services, and applications that will strengthen the national eHealth

environment.

SEC. 21. Establishment and Accreditation of eHealth Centers and eHealth Practitioners. ~
‘The Act shall ensure that telehealth centers are strategically organized across the country within
three (3) years upon effectivity of this Act to ensure that Telehealth practitioners are sufficiently
equipped with skills for the ethical and safe practice of Telehealth such as the necessary
audiovisual communications technology that will enable each Telehealth center to communicate
with each other in real time. Regional Telehealth Centers shall be established. No telehealth
center shall be allowed to operate unless it has been duly accredited based on standards set forth
by the DOH. The Department of Health shall be the lead agency for the accreditation for the
facilities as Telehealth centers, whereas the Professional Regulations Commission shall be the
lead agency for the accreditation of the Telehealth Practitioners in coordination with the National
eHealth Steering Committee. Telehealth Practitioner shall be accredited by the PhilHealth for
reimbursement purposes. A Telehealth center shall have the following minimum requirements:

23


Comvnnewune

16

18
19
20
2
22
23
24
25
26
27
28
29
30
31
32
33

35
36
37

a) Equipped with the needed ICT applications suitable for telehealth in the country such as
‘computers, internet connections, and communication lines;

b) Supervised and staffed by trained personnel such as doctors, nurses, primary health care
workers, and clinical specialists;

c) Construction of facilities for the delivery of telemedicine services sites;

d) Provision of transportation and other courier services for the delivery of medicines and
other services; and

¢) Undergo periodic unannounced inspection by the DOH in order to evaluate and ensure
quality telehealth center performance.

These Telehealth Centers shall be established for the purpose being primarily to give
access to virtual medical care to as many people as possible. Their objectives shall be:

4) To provide people in rural and far-flung areas with no adequate access to specialized
medical care with a virtual access at no cost to them where warranted; and

b) To give these people easy access to fast and efficient treatment and diagnosis, especially
the poor and indigent among them.

Sec. 22. Public-Private Partnership of eHealth Services. - The DOH is hereby mandated to
promulgate rules regarding the participation of the private sector in the provision of eHealth
services and solutions, including public-private partnerships and other suitable arrangements,
subject to the limitations provided by this Act.

ARTICLE VI
THE eHEALTH CENTER BOARD

SEC. 23. eHealth Center Board. — There is hereby created a governing board of the Telehealth
Center which shall hereafter be known as the eHealth Center Board.

‘The eHealth Center Board shall be composed of ten (10) members with the Secretary of
the Department of Health as the ex-officio Chairman, four (4) members, each of from the Lung
Center of the Philippines, National Kidney and Transplant Institute, Philippine Children’s
Medical Center, and the Philippine Heart Center and five (5) members from the private sector.

‘The members of the eHealth Center Board shall be appointed by the President of the

Philippines and shall receive no salary. They shall, however, receive a per diem of not exceeding
two thousand pesos (P 2,000.00) for every meeting of the Board actually attended: Provided,

14


we evaunewn

10
n
2
13
14
15
16
7
18
19

2
2
23
24
25
26
27

29
30
31
32
33

35
36
37

however, that the total amount of per diem for all meetings of the eHealth Center Board in a

single month shall not exceed ten thousand pesos (P 10,000.00).

Members of the eHealth Center Board who are not officers of the Government shall serve

for a term of four years which is renewable for another term.

‘The Board Secretary shall be appointed by the Chairman from the ranking members of

the hospital staff.

SEC. 24. Powers and Duties of the eHealth Center Board. — The eHealth Center Board, as the
governing and policy-making body of the eHealth Centers, shall have such powers as are

necessary to carry out the purpose and objectives stated in this Act, including the exercise of

corporate powers. It shall perform the following functions and duties:

a)

b
©

qd

©)

g

h)

‘To promulgate and prescribe the rules and regulations for the administration of the affairs
of eHealth Centers,

To study, propose and approve plans for the improvement of eHealth Center services.

To propose, study and approve or, amend or revise the organizational structure of eHealth
Centers, in order to meet the exigencies of the service, subject to existing laws and
regulations on the matter and consonant with the principles of sound hospital
administration.

To consider and approve appointments and promotions of all staff personnel, medical and
administrative, and other employees upon the recommendation of the eHealth Center
Director. i

To investigate all cases of anomalies, negligence or misconduct of all eHealth Center
personnel including the Director. It shall have the final authority to pass upon the
removal, separation, and suspension of such personnel subject to Civil Services Rules and
Regulations.

‘To make an integral audit once a year of the business operation of the eHealth Center.

To receive in trust, legacies, gifts, land grants and donations of real and personal property
of all kinds, free of tax, and to administer the same for the benefit of the hospital or a
department of service thereof. Foreign and domestic donors legacies, gifts, grants and
donations under this Section shall be exempt from any tax of any kind and nature to the
extent of the full amount donated, provisions of existing laws to the contrary
notwithstanding.

To consider and approve the budget prepared by the hospital administration for
submission to the Congress of the Philippines through the Budget Secretary.

15


we evaunewne

a
22
23
24

SEC. 25. Meeting of the Board and Quorum. ~The eHealth Center Board shall meet regularly
once a month at the Department of Health on a regular date fixed for the purpose. Special
meetings may be called as often as necessary. A majority of the members shall constitute a
quorum, All decisions of the Board must be by a majority of the members present.

SEC. 26. eHealth Center Director and Auditor. ~ There shall be acHealth Center Director,
elected by a majority vote of the eHealth Center Board: Provided, that the recomendee is
qualified under the Civil Service Act

‘The eHealth Center Director shall serve until otherwise incapacitated or removed for
cause and shall receive an annual salary equivalent to that of Chief of Hospital IV under the
Salary Plan of the Wage and Position Classification Office. One shall have charge of the hospital
and shall have the powers in respect to the hospital as vested by the law in chiefs of hospitals.

Specifically, the eHealth Center Director shall:

a) Be responsible for the implementation of all policies, decisions and orders of the eHealth
Center Board;

b) Have immediate supervision and control over the affairs of the eHealth Centers as well as
its management and administration, subject to the authority of the eHealth Center Board;

c) Prepare and submit to the eHealth Center Board periodic reports on the state of affairs,
financial conditions, budgetary requirements and other problems of the hospital together
with the corresponding recommendations thereon; and

d) Perform such other duties as the eHealth Center Board may from time to time direct him
to do, consonant with the dignity and responsibility of the office.

‘The eHealth Center Board shall appoint an auditor who shall be the representative of the
Auditor General who is hereby designated as ex-officio auditor of all eHealth Centers.

The eHealth Center Auditor shall be the chief of its auditing and accounting department.
One shall audit, examine and settle all accounts of the eHealth Centers, according to existing
laws and regulations and shall perform such other duties as the Auditor General, the eHealth
Center Director or the eHealth Center Board may require of one. One’s compensation shall be
fixed by the eHealth Center Board.

SEC. 27. Heads of Departments and Services and Compensations. ~ The participating Heads of
departments and services as well as medical consultants and specialists shall be appointed by the
eHealth Center Board upon recommendation of the eHealth Center Director. Their

16


weervauneune

compensations shall be prescribed by the eHealth Center Board but the same shall in no case be

less than provided for under existing laws and regulations.

All other personnel and employees of the eHealth Centers shall be appointed by the
eHealth Center Director subject to the approval of the eHealth center Board.

ARTICLE VIL
INFRASTRUCTURE

SEC. 28. ICT Infrastructure. — The required ICT infrastructure to implement eHealth system
and services shall conform to the national ICT infrastructure plan and standards.

SEC. 29. Medical devices and eHealth solutions. — Software platform that connects existing or
new medical devices and gateways shall be defined and regulated to ensure seamless data
transfers based on established industry and national standards and standardization of EMR or
EHR.

SEC. 30. eHealthCenters Database. — All eHealth Centers and originating sites shall coordinate
with DOH for consolidation of pertinent database. DOH shall maintain and manage a national
database for consults on clinical cases as well as health and medical education exchanges.

SEC. 31. National Health Database and Data warehouse. ~ The DOH shall spearhead the
maintenance and management of a secured and protected national health database and national
health data warehouse or defined shared EMR or’ EHR and of consultations on clinical cases as
well as health and medical education exchanges and other eHealth applications.

ARTICLE VU
HUMAN RESOURCES

SEC. 32. Human Resources ICT Competencies. ~ Minimum ICT or eHealth competencies shall
be established and imposed to medical and paramedical professionals practicing eHealth, and be
part of the medical and allied medical curricula.

SEC. 33. Capability Building Plans and Policies. ~ Human resource plans and policies shall
fully take into account in delivering eHealth and Telemedicine. The following are to be

considered:

7


eCervaunsvune

oe
2
13
14
15
16
7
18
19
20
a
22
23
24
25
26
27

29
30

32
33
34
35
36
37

a)

Licensable healthcare professionals must have a valid Philippine license based on the
requirement of the Professional Regulations Commission (PRC);
b)

Appropriate policies concerning cases wherein a licensed eHealth practitioner in the
Philippines who intends to provide eHealth services to a patient in another country should
be in place;

°)

In any event, a eHealth center should have policies and procedures to ensure that all
relevant staff have the appropriate competencies to practice safer Health services; and
@

eHealth centers should ensure regular review of human resource plans and policies
related to eHealth and eMedicine

ARTICLE IX.
STRATEGY AND INVESTMENT

SEC. 34. eHealth Strategic Framework. — The DOH shall spearhead the development and
monitoring of strategic framework and plans to serve to guide the implementation of eHealth

systems and services.

SEC. 35. Monitoring Evaluation System. — There shall be established a robust metric for the
monitoring and evaluation for eHealth to assess and analyze the impact of eHealth systems and

services.

SEC. 36. Appropriations. — The amount necessary to carry out the provisions of this Act shall be
included in the General Appropriation of the year following its enactment into law.

SEC. 37. Telehealth Center Trust Funds. ~ All funds and money not coming from the general
fund of the National Government such as contributions from taxes and assessments from
authorized sweepstakes lotteries and games, donations, legacies, endowment shall be used and
disbursed only upon the authorization of the Telehealth Center Board for the purpose of
improving the Telehealth Centers, its facilities and services, including the purchase of supplies
and equipment.

SEC. 38. Financing eHealth Services. — Financing for applicable eHealth services by

PhilHealth and other partners, as defined by the National eHealth Steering Committee shall be

made available.

18


we eavraouneune

33

35
36
37
38

SEC. 39. Private Sector Participation. ~ The government shall encourage private sector
investment on eHealth systems and services subject to existing laws and regulation through the
appropriate government agencies and must be compliant to the established national eHealth
systems and services and standards.

Under the Private Sector Participation Program, the joint DOH-PhilHealth-DOST-National
Privacy Commission-Philippine Statistics Authority undertakings on eHealth shall be expanded
to align with the Medium-term Information and Communications Technology Harmonizing
Initiative (MITHD efforts of Department of Budget and Management (DBM) and DOST which
shall include the development of a Citizen Registry. The participation from the private sector
such as IT providers is important for the rapid sailing up of the eHealth services and in
comprehending the delivery of eHealth services in the national and local levels.

SEC. 40. Tax Incentive. — Any private corporation that will engage in providing eHealth services
shall not be required to pay any national or local tax within the first two (2) years of operation.

ARTICLE X
RESEARCH AND DEVELOPMENT

SEC. 41, Research and Development. — Consistent with Republic Act No. 10532 or the
Philippine National Health Research System Act of 2013, the Department of Science and
technology ~ Philippine Council for Health Research and Development (DOST-PCHRD), in
coordination with DOH, DICT, PhilHealth, specialty societies, and non-government institutions
shall ensure for the development of new eHealth solutions, services, and innovations through:

a) Formulation of expanded eHealth research priority areas under the National Unified
Health Research Agenda (NUHRA), and

b) Establishment of knowledge hub and research centers for eHealth that focus on but
not limited to capacity building, health technology assessment, knowledge
management, standards development, and research utilization.

SEC. 42. Funding Source for Research Development, ~ The research budget shall not be more
than 5% of the funding sources of each of the following government agencies:

a) Department of Health;

b) Department of Science and Technology; and

c) Department of Information and Communication Technology.

19


Cov annewne

10
n
12
13

15
16
7

19
20
2
2
23
24
25
26
oy
28
29
30
31
32
33

35
36
37
38

ARTICLE XI
LIABILITIES AND PENALTIES

SEC. 43. Unauthorized Processing of Personal Information and Sensitive Personal
Information. ~(a) The unauthorized processing of personal information shall be penalized by
imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Two million pesos (Php
2,000,000.00) to be imposed on persons who process personal information without the consent of
the data subject, or without being authorized under this Act or any existing law.

(b) The unauthorized processing of personal sensitive information shall be penalized by
imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Four million pesos (Php
4,000,000.00) to be imposed on persons who process sensitive personal information without the
consent of the data subject, or without being authorized under this Act or any existing law.

SEC. 44. Accessing Personal Information and Sensitive Personal Information Due to
Negligence. - (a) Accessing personal information due to negligence shall be penalized by
imprisonment ranging from one (1) year to three (3) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Two million pesos (Php
2,000,000.00) to be imposed on persons who, due to negligence, provided access to personal
information without being authorized under this Act or any existing law.

(b) Accessing sensitive personal information due to negligence shall be penalized by
imprisonment ranging from three (3) years to six (6) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Four million pesos (Php
4,000,000,00) to be imposed on persons who, due to negligence, provided access to sensitive
personal information without being authorized under this Act or any existing law.

SEC. 45. Improper Disposal of Personal Information and Sensitive Personal Information.

(a) The improper disposal of personal information shall be penalized by imprisonment ranging
from six (6) months to two (2) years and a fine of not less than One hundred thousand pesos (Php
100,000.00) but not more than Five hundred thousand pesos (Php 500,000.00) to be imposed on
persons who knowingly or negligently dispose, discard or abandon the personal information of
an individual in an area accessible to the public or has otherwise placed the personal information

of an individual in its container for trash collection.

20


we evaunswne

10
1
12
13
14
15
16
7
18
19
20
2a
2
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

(b) The improper disposal of sensitive personal information shall be penalized by imprisonment
ranging from one (1) year to three (3) years and a fine of not less than One hundred thousand
pesos (Php 100,000.00) but not more than One million pesos (Php 1,000,000.00) to be imposed
on persons who knowingly or negligently dispose, discard or abandon the personal information
of an individual in an area accessible to the public or has otherwise placed the personal

information of an individual in its container for trash collection.

SEC. 46. Processing of Personal Information and Sensitive Personal Information for
Unauthorized Purposes. —'The processing of personal information for unauthorized purposes
shall be penalized by imprisonment ranging from one (1) year and six (6) months to five (5)
years and a fine of not less than Five hundred thousand pesos (Php 500,000.00) but not more
than One million pesos (Php 1,000,000.00) to be imposed on persons processing personal
information for purposes not authorized by the data subject, or otherwise authorized under this

Act or under existing laws.

The processing of sensitive personal information for unauthorized purposes shall be penalized by
imprisonment ranging from two (2) years to seven (7) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Two million pesos (Php
2,000,000.00) to be imposed on persons processing sensitive personal information for purposes
not authorized by the data subject, or otherwise authorized under this Act or under existing laws.

SEC. 47. Unauthorized Access or Intentional Breach, ~The penalty of imprisonment ranging
from one (1) year to three (3) years and a fine of not less than Five hundred thousand pesos (Php
500,000.00) but not more than Two million pesos (Php 2,000,000.00) shall be imposed on
persons who knowingly and unlawfully, or violating data confidentiality and security data
systems, breaks in any way into any system where personal and sensitive personal information is
stored,

SEC. 48. Concealment of Security Breaches Involving Sensitive Personal Information. ~ The
penalty of imprisonment of one (1) year and six (6) months to five (5) years and a fine of not less
than Five hundred thousand pesos (Php 500,000.00) but not more than One million pesos (Php
1,000,000.00) shall be imposed on persons who, after having knowledge of a security breach and
of the obligation to notify the Commission pursuant to Section 20(f), intentionally or by
omission conceals the fact of such security breach.

SEC. 49, Malicious Disclosure. — Any personal information controller or personal information
processor or any of its officials, employees or agents, who, with malice or in bad faith, discloses

unwarranted or false information relative to any personal information or personal sensitive

2


weervaueune

sey
12
3
14
15
16
7
18
19
20
a
2
23
24
25
26
7
28
29
30
31
32
33

35
36
37
38

information obtained by him or her, shall be subject to imprisonment ranging from one (1) year
and six (6) months to five (5) years and a fine of not less than Five hundred thousand pesos (Php
500,000.00) but not more than One million pesos (Php 1,000,000.00).

SEC. 50. Unauthorized Disclosure. —(a) Any personal information controller or personal
information processor or any of its officials, employees or agents, who discloses to a third party
personal information not covered by the immediately preceding section without the consent of
the data subject, shall he subject to imprisonment ranging from one (1) year to three (3) years
and a fine of not less than Five hundred thousand pesos (Php 500,000.00) but not more than One
million pesos (Php 1,000,000.00).

(b) Any personal information controller or personal information processor or any of its officials,
employees or agents, who discloses to a third party sensitive personal information not covered by
the immediately preceding section without the consent of the data subject, shall be subject to
imprisonment ranging from three (3) years to five (5) years and a fine of not less than Five
hundred thousand pesos (Php 500,000.00) but not more than Two million pesos (Php
2,000,000.00)..

SEC. 51. Combination or Series of Acts. - Any combination or series of acts as defined in
Sections 42 to 49 shall make the person subject to imprisonment ranging from three (3) years to
six (6) years and a fine of not less than One million pesos (Php 1,000,000.00) but not more than
Five million pesos (Php 5,000,000.00),

SEC. 52. Extent of Liability. — If the offender’ is a corporation, partnership or any juridical
person, the penalty shall be imposed upon the responsible officers, as the case may be, who
participated in, or by their gross negligence, allowed the commission of the crime. If the offender
is a juridical person, the court may suspend or revoke any of its rights under this Act. If the
offender is an alien, he or she shall, in addition to the penalties herein prescribed, be deported
without further proceedings after serving the penalties prescribed. If the offender is a public
official or employce and lie or she is found guilty of acts penalized under Sections 44 and 45 of
this Act, he or she shall, in addition to the penalties prescribed herein, suffer perpetual or
temporary absolute disqualification from office, as the case may be.

SEC. 53. Large-Scale. —The maximum penalty in the scale of penalties respectively provided
for the preceding offenses shall be imposed when the personal information of at least one
hundred (100) persons is harmed, affected or involved as the result of the above-mentioned
actions.

22


we evaunun

SEC. 54. Offense Committed by Public Officer. - When the offender or the person responsible
for the offense is a public officer as defined in the Administrative Code of the Philippines in the
exercise of his or her duties, an accessory penalty consisting in the disqualification to occupy
public office for a term double the term of criminal penalty imposed shall he applied.

SEC. 55. Restitution. — Restitution for any aggrieved party shall be governed by the provisions
of the New Civil Code.

SEC. 56. Liability of Supervising Persons. — Persons who directly supervise and control staff’
members entitled to fill EMR or HER are liable for injuries associated with inaccurate or
deficient summary reports provided by these staff members.

SEC. 57. Liability of eHealth Centers, — eHealth centers are liable for injuries associated with
inaccurate or defective treatment caused by their software and database.

ARTICLE XII
FINAL PROVISIONS

SEC. 58. Implementing Rules and Regulations. ~ Within ninety (90) days from the effectivity
of this Act, the Secretary of Health, after consultation with the DOST, DICT, University of the
Philippines ~ Manila (National Telehealth Center), PhilHealth, CHED, medical and paramedical
associations and societies, and other stakeholders, shall promulgate the necessary rules and
regulations implementing the provisions of this Act.

SEC. 59. Separability Clause. — If any part or provision of this Act shall be declared or held
unconstitutional or invalid, other provisions hereof which are not affected thereby shall continue
to be in full force and effect.

SEC. 60, Repealing Clause. — All general and special laws, decrees, executive orders,
proclamations and administrative regulation, or any parts thereof which are inconsistent with this

Act are hereby repealed, amended and modified accordingly.

SEC. 61. Effectivity. — This Act shall take effect fifteen (15) days after its publication in the
official gazette or in any newspaper of general circulation.

Approved,

23