Can Healthcare Workers Post Patient Stories Online?

Introduction

Healthcare workers may encounter memorable or emotionally difficult patient situations in hospitals, clinics, and other healthcare facilities. Sharing those experiences online may appear harmless when a patient’s name is omitted. However, a patient may still be identifiable through a photograph, diagnosis, location, date of admission, unusual circumstances, or the combination of details in the post.

Under Philippine law, posting a patient’s medical condition, treatment, HIV status, or other health information without a lawful basis may expose hospital staff and healthcare institutions to civil, administrative, and criminal liability. The fact that the post was made on a personal social-media account does not automatically remove the worker’s duties of confidentiality and data protection.

What Information Is Protected?

Health information is sensitive personal information under the Data Privacy Act. This includes information about a person’s health, medical records, diagnosis, treatment, procedures, test results, and other data that can identify or describe the individual’s medical condition. The Supreme Court has recognized that health-related information falls within the statutory protection given to sensitive personal information (Azarraga v. Jalbuna, A.C. No. 13678, 2023).

The protection also covers information that may reasonably identify the patient even if the patient’s name is not stated. A post may therefore be unlawful when it identifies the patient through indirect details such as the hospital, ward, date, age, rare condition, photograph, or the identity of relatives.

Confidentiality Under the Philippine HIV and AIDS Policy Act

The Philippine HIV and AIDS Policy Act guarantees the privacy and confidentiality of individuals who have been tested for HIV, exposed to HIV, diagnosed with HIV infection, or treated for HIV-related illnesses (R.A. No. 11166).

Section 44 of R.A. No. 11166 generally prohibits disclosure without written consent of information that a person has AIDS, underwent an HIV-related test, has HIV infection or an HIV-related illness, or has been exposed to HIV. The duty applies to persons involved in implementing the law or delivering HIV-related services, including persons who handle or have access to confidential information in the workplace.

The prohibition is not limited to formal medical reports. A hospital employee may violate the law by posting a patient’s HIV status, test result, treatment, photograph, or other information that would reasonably identify the patient.

Unauthorized Disclosure Through Social Media

Social-media publication is a form of disclosure to third parties. A post made in a private group may still constitute disclosure if the group includes persons who are not authorized to receive the information. A post made on a public account presents an even greater risk because it may result in widespread dissemination.

Under Section 44 of R.A. No. 11166, media and social-media disclosures identifying persons living with HIV or AIDS, or revealing confidential HIV and AIDS information, are prohibited without prior written consent, subject to the statutory exceptions relating to a person’s own acts and legally recognized waivers.

The law imposes separate penalties depending on the conduct and the offender’s role. A person who breaches confidentiality may face imprisonment of six months to two years and a fine of ₱50,000 to ₱150,000. A person who causes mass dissemination, including online or media dissemination, may face imprisonment of two years and one day to five years and a fine of ₱150,000 to ₱350,000. A healthcare professional, medical worker, employer, data custodian, or other specified custodian who breaches confidentiality may face imprisonment of five years and one day to seven years and a fine of ₱350,000 to ₱500,000 (R.A. No. 11166, Section 50).

Data Privacy Act Requirements

The Data Privacy Act requires that the processing of personal and sensitive personal information have a lawful basis. Sensitive personal information and privileged information may generally be processed only in the circumstances authorized by Section 13 of R.A. No. 10173, such as valid consent, a specific legal authority, protection of life and health when consent cannot be obtained, medical treatment with adequate safeguards, or the protection of lawful rights in court proceedings.

Even when a lawful basis exists, processing must comply with the principles of transparency, legitimate purpose, and proportionality. A healthcare worker may have lawful access to medical records because of employment or professional duties, but that access does not authorize the worker to use the information for personal storytelling, entertainment, criticism, or online commentary.

The National Privacy Commission has emphasized that disclosure of health information must be limited to persons directly involved in patient care or otherwise authorized by law. In MBA v. GoFluent Philippines Inc., the Commission found a lawful basis for certain contact-tracing disclosures but still held that disclosure to more personnel than necessary violated proportionality (NPC 21-082, 2024).

When Disclosure May Be Lawful

Not every disclosure of medical information is prohibited. Disclosure may be lawful when it is supported by a valid legal basis and is limited to what is necessary for the stated purpose.

Examples include disclosure:

• to healthcare professionals directly involved in the patient’s treatment;
• to government authorities when required by law or a valid legal order;
• for mandatory disease reporting and public-health surveillance under applicable law;
• for medical treatment when appropriate safeguards are in place; or
• in court proceedings when the information is necessary and relevant to the assertion or defense of a legal claim.

In JPV v. Souley MD Services, Inc., the National Privacy Commission ruled that attaching medical records to a cyber-libel complaint could be lawful under Section 13(f) of R.A. No. 10173 when the records were necessary to establish, exercise, or defend a legal claim. The Commission nevertheless stressed that ownership of the physical or digital medical records does not mean that the hospital owns the personal data or may use it without limitation (NPC 22-201, 2024).

Public-health reporting also does not create a general license to post patient information online. R.A. No. 11332 prohibits unauthorized disclosure of private and confidential information concerning a patient’s medical condition or treatment. Disclosure is not treated as a violation under that provision when made to comply with a lawful court order (R.A. No. 11332).

Hospital Staff May Be Liable Even Without Malice

A worker need not intend to harm the patient before privacy liability may arise. Unauthorized disclosure may be actionable even when the worker believes that the post is educational, humorous, informative, or intended to criticize hospital management.

The National Privacy Commission has distinguished unauthorized disclosure from malicious disclosure. In JAA v. RB, the Commission held that the absence of malice or bad faith did not excuse the disclosure of personal and sensitive information to third parties without consent or another lawful basis (NPC 21-085, 2024).

Accordingly, a healthcare worker may face liability where the post was careless rather than deliberately harmful. Good intentions may be relevant to the assessment of sanctions, but they do not replace the requirement of lawful processing.

Professional Confidentiality and Ethical Duties

Medical confidentiality is broader than the prohibition against publishing a patient’s name. It covers information obtained in the course of professional care and applies to physicians, nurses, medical technologists, counselors, hospital employees, and other persons who handle patient information.

The Supreme Court has also recognized the protected character of patient-physician communications under the Rules of Court. In Integrated Bar of the Philippines v. Purisima, the Court discussed the protection given to sensitive personal information and privileged information, including information covered by professional confidentiality (G.R. Nos. 211772 and 212178, 2023).

For lawyers who work in hospitals or advise healthcare institutions, the Code of Professional Responsibility and Accountability separately prohibits the disclosure of confidential information obtained from a client or in the course of representation through online posts, unless allowed by law or the Code of Professional Responsibility and Accountability (A.M. No. 22-9-1-SC).

Common Examples of Risky Online Posts

The following examples may create significant legal risk:

• posting a photograph of a patient in a hospital bed, even after covering the patient’s name;
• describing a rare diagnosis together with the hospital and date of treatment;
• sharing a screenshot of laboratory or HIV test results in a messaging group;
• telling a story about a patient’s condition in a way that relatives, coworkers, or community members can identify the patient; and
• posting a video from a treatment area showing patients, charts, wristbands, or other identifying details.

Removing the post after publication may reduce continuing exposure but does not erase the original disclosure. Screenshots, downloads, reposts, and cached copies may remain available and may be used as evidence.

Possible Consequences

A hospital worker may face several forms of liability, depending on the information disclosed, the manner of disclosure, the worker’s position, and the resulting harm.

• Criminal liability: Violations of the confidentiality provisions of R.A. No. 11166 may result in imprisonment and fines, with higher penalties for mass dissemination and breaches committed by specified healthcare and medical-record custodians.
• Data-privacy liability: Unauthorized or disproportionate processing may violate R.A. No. 10173 and applicable privacy regulations.
• Civil liability: A patient may pursue damages for injury to privacy, reputation, dignity, or other protected interests.
• Employment consequences: The hospital may impose disciplinary sanctions, including suspension or termination, subject to applicable labor rules and due process.
• Professional discipline: Licensed professionals may face proceedings before their professional regulatory bodies.

Recommended Hospital Controls

Healthcare institutions should not rely solely on general confidentiality clauses in employment contracts. They should adopt written policies specifically addressing social-media use, photographs, messaging applications, remote work, electronic records, and discussions of patient cases.

Hospitals should also limit access to patient information based on job functions, maintain access logs, train personnel regularly, and establish a prompt incident-response procedure. A possible disclosure should be reported internally, preserved for investigation, and assessed by the institution’s privacy officer or legal department.

Educational or clinical case discussions should use de-identified information only when the risk of re-identification is remote. When a patient may reasonably be identified, the institution should obtain appropriate written consent and ensure that the disclosure is limited to the stated purpose.

What Healthcare Workers Should Do Before Posting

Before posting any patient-related content, a healthcare worker should ask:

• Can anyone identify the patient from the details, image, timing, or location?
• Is there a specific lawful basis for using and disclosing the information?
• Is the proposed disclosure necessary for a legitimate professional purpose?
• Has valid written consent been obtained where consent is required?
• Could the same educational or professional purpose be achieved without using patient information?

If any answer raises doubt, the safer course is not to post and to consult the hospital’s data-protection officer or legal counsel. Patient stories should be discussed only through authorized channels and with safeguards appropriate to the sensitivity of the information.

Conclusion

Hospital staff do not lose their confidentiality duties when they use personal social-media accounts. Posting a patient’s condition, medical record, HIV status, photograph, or identifying clinical story may constitute unlawful disclosure under R.A. No. 11166, R.A. No. 10173, R.A. No. 11332, and applicable professional and employment rules.

The central safeguards are lawful purpose, necessity, proportionality, confidentiality, and valid consent when required. Hospitals should train personnel, restrict access, monitor disclosures, and respond promptly to incidents. Healthcare workers should avoid posting patient-related stories unless the disclosure is clearly authorized, necessary, and sufficiently protected against identification.

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.