This document discusses steps that hospitals can take to prepare for the implementation of digital requirements under the Universal Healthcare Law in the Philippines. It begins by outlining the UHC Law and NICCA regulations regarding mandatory adoption of health data standards. It recommends that hospitals take an enterprise approach to digital transformation, focusing on governance, architecture, project management, and standards/interoperability. Specific next steps proposed include designating a Chief Information Officer, establishing an architecture plan, hiring certified project managers, and adopting interoperability standards to comply with regulations and protect patients while enabling data sharing and innovation.

1. Preparing Hospitals
for the Digital Requirements
of the UHC Law
Alvin B. Marcelo, MD

2. Disclosures
Clinical Professor of Surgery and Health Informatics, UP Manila
Chief Medical Information Officer, St. Luke’s Medical Center
Executive director, Asia eHealth Information Network
Director, Philippine Society for Digital Health
Former Chief Information Officer (CIO), Philippine Health Insurance Corporation
*No financial interests in any of the technologies mentioned

3. Objective
Increase awareness on recent laws and regulations
Enumerate steps hospitals can take to prepare for implementation

4. Outline
The UHC Law and the NICCA
An Enterprise Approach to Digital Transformation in Hospitals
Recommended Next Steps

5. What is “health data”?
Source: Regional digital health action plan for the WHO European Region 2023-2030

6. Health
Systems are
Complex
Many stakeholders
Many transactions between
stakeholders
Different rules and
contractual arrangements

7. Where are we now?
Laws related to health data (prior to 2019)
● Medical Act of 1959
● e-Commerce Act of 2000
● Data Privacy Act of 2012

8. Philhealth eClaims (2012)

9. RA 10606 (2013)
“Telemedicine” is first mentioned in the revised Philhealth law

12. Mandatory Adoption of Health Data Standards (2013)

16. Source
National
Integrated Cancer
Control Act of
2019

17. Source

19. Source
document

20. Mandatory Adoption and Use
of National Health Data
Standards (2021 update)
JAO 2021-0002 (April 21, 2021)
MC 2021-0020 (April 23, 2021)
bit.ly/mandatoryadoption

25. What are the risks?

26. Information
Management
mitigates risk.
Information
Management
creates risk.
Top 15 Risks
for Hospitals
https://www.rcmd.com/resources/blog/top-15-risk-concerns-hospitals-and-health-systems

27. Where do we want to go?

29. Mind the GAPS,
Fill the GAPS
Governance
Architecture
People and Programme Management
Standards and Interoperability

30. WHO-ITU 7 Components of National eHealth
Strategy (2012)
Source: WHO-ITU National eHealth Strategy Toolkit

31. Source: WHO-ITU National eHealth Strategy Toolkit
WHO-ITU Component: Leadership and
Governance

32. Source:
https://www.slideshare.net/isiptan/government-or-private-sector-the-future-of-asias-healthcare-infrastructure
Governance: Philippines

33. Philippine National eHealth Framework

34. Source: wiki.ohie.org
Source: ehealth.doh.gov.ph
Philippine eHealth Blueprint (2014)

35. HEALTH DATA
GOVERNANCE
PRINCIPLES
Universalising the benefits of health digitalisation
Protect people | Promote health value | Prioritise equity

36. INTRODUCTION &
OVERVIEW
The Health Data Governance Principles:
● Bring a human rights and equity lens to the use of data
within and across health systems.
● Are oriented towards supporting sustainable and
resilient public health systems that can deliver
Universal Health Coverage (UHC).
● Aim to strengthen national and regional health data
governance approaches, maximising the public value
of health data whilst protecting individual rights.
● Align policymakers and other stakeholders around a
shared vision of equitable health data governance,
where all people and communities can share, use and
benefit from health data.
● Recognise and build on existing norms, principles,
treaties, conventions and guidelines, while further
strengthening the health data governance
ecosystem.
● Are a critical step towards a global framework for
health data governance.

37. ● Driven and developed by civil society through an
inclusive and consultative, bottom-up process.
● The process was designed to gather perspectives
and expertise, and ensure meaningful engagement,
of diverse stakeholders from across geographies and
sectors.
○ Over 200 contributors from over 130 organisations.
○ Eight global and regional workshops covering
Sub-Saharan Africa; the Middle East and North
Africa; South, East, and Central Asia; Latin America
and the Caribbean; and Europe, North America, and
the Pacific.
○ One-month public consultation on a draft set of
Principles.
● Transform Health stewarded this process, under the
leadership of its Policy Circle.
DEVELOPMENT OF
THE PRINCIPLES

38. The Principles are clustered around three
interconnected objectives:
1. Protect people – as individuals, as groups, and as
communities
2. Prioritise equity – by ensuring equitable
distribution of benefits that arise from the use
of data in health systems
3. Promote health value – through data sharing and
innovative uses of data
The Principles are:
● Designed to complement and reinforce one another.
● Not weighted or listed in any order of priority.
● Supported by core elements that describe how it
can be put into practice.
OBJECTIVES &
STRUCTURE

39. THE PRINCIPLES

40. PROTECT PEOPLE

41. Core Elements
• Address individual and collective risk
• Collect data with a defined purposes
• Collect personal or sensitive data only when
necessary and with informed consent
• Use secure data collection and storage
mechanisms
• Use de-identification and anonymization
• Define inappropriate uses of health data
• Institute safeguards against discrimination,
stigma, harassment and bias
• Provide guidance specific to marginalised
groups and populations
Health data governance must protect
individuals, groups and communities against
harm and violations at every stage of the data
lifecycle. It should balance protection and rights
with the societal value of data use for health.
PROTECT INDIVIDUALS
AND COMMUNITIES
PROTECT PEOPLE

42. Core Elements
● Align with best practises for data protection and
privacy
● Ensure consent is informed and understood in all
its complexities
● Obtain collective consent where appropriate
● Define concrete exceptions to informed consent
● Ensure data quality, availability, and accessibility
● Reinforce health data governance with evidence
● Establish transparent and accessible processes
Health data governance should reinforce trust in
data systems and practises. Developing health
data governance systems in a participatory and
transparent manner, and ensuring regulations and
guidelines are accessible, understood, and
followed in practice, can help build trust.
BUILD TRUST IN
DATA SYSTEMS
PROTECT PEOPLE

43. Core Elements
● Require strong technical security measures for
data processing
● Mitigate risks related to security threats
● Ensure transparency around data breaches
● Consider federated data systems
Data security is an essential component of
health data governance, for the protection of
individuals and communities. Processes for
collecting, processing, storing, using, sharing
and disposing data should all employ robust
security mechanisms.
ENSURE DATA
SECURITY
PROTECT PEOPLE

44. PROMOTE HEALTH VALUE

45. Core Elements
● Evaluate the benefits of health data
● Use data to enhance health services for
individuals and communities
● Encourage a culture of data-led insights and
action
● Address health system efficiency,
effectiveness, and resilience
● Strengthen community ownership of health
data
Health data governance should enhance health
system efficiency and resilience, improve health
access, and advance health equity towards UHC.
A whole health system approach must be applied,
ensuring health data governance supports the
systemic transformation of health systems.
ENHANCE HEALTH
SYSTEMS AND
SERVICES
PROMOTE HEALTH VALUE

46. Core Elements
● Establish data sharing rules and guidelines
● Validate informed consent before sharing data
● Promote interoperability of data systems
● Define common data structures across health
systems
● Define multiple levels of data access
● Use common definitions and global standards
● Support multi-sector partnerships
Data collection and sharing is a prerequisite
for creating value from health data but must
be done in ways that support equity and
human rights. Data sharing allows for deeper
and more significant insights related to health
needs and challenges.
PROMOTE DATA
SHARING AND
INTEROPERABILITY
PROMOTE HEALTH VALUE

47. Core Elements
● Apply health data governance to emerging
technologies
● Address the use of non-health data in health
contexts
● Build public health data infrastructure
● Employ policy innovation
Health data governance should enhance health
system efficiency and resilience, improve health
access, and advance health equity towards UHC.
A whole health system approach must be applied,
ensuring health data governance supports the
systemic transformation of health systems.
FACILITATE INNOVATION
USING HEALTH DATA
PROMOTE HEALTH VALUE

48. PRIORITISE EQUITY

49. Core Elements
● Represent all groups and populations
equitably in data
● Consider the unique needs of marginalised
groups and populations
● Mitigate data bias
● Use accessible language and plug knowledge
gaps
● Implement inclusive data feedback
mechanisms
Health data governance must ensure
equitable representation in data of all
individuals, groups and communities;
meaningful participation of all groups in
decision-making; and equitable access to
data-generated health value.
PROMOTE EQUITABLE
BENEFITS FROM
HEALTH DATA
PRIORITISE EQUITY

50. Core Elements
● Apply a human rights lens to health data
governance
● Define clear governance roles and
responsibilities
● Codify data rights and ownership
● Extend data rights and ownership to products
and services
● Develop health data trusts and health data
cooperatives
● Employ participatory data governance
Health data governance should be rooted in strong
and clear data-related rights. Data-related norms,
principles, policies, and laws should be drawn from
such overarching rights. This includes
consideration of all human rights.
ESTABLISH DATA
RIGHTS & OWNERSHIP
PRIORITISE EQUITY

51. Adopting the
Principles and a
global framework

52. DRIVING ACTION ON
THIS AGENDA
Governments, regional bodies and organisations are urged to take
action to strengthen the governance of health data by:
● Endorsing the Health Data Governance Principles.
● Supporting the development, and subsequent adoption, of a
global health data governance framework, underpinned
by the Principles (e.g. through a World Health Assembly
resolution).
● Prioritising health data governance as part of global,
regional and national agendas.
● All stakeholders, including civil society and communities,
should champion this agenda, advocating for action and
holding governments and other stakeholders
accountable.
● Communities, particularly the most marginalised, must be
meaningfully engaged in discussions and decision making.

53. healthdataprinciples.org

54. How do we get there?
(for hospitals)

55. Mind the GAPS,
Fill the GAPS
Governance
Architecture
People and Programme Management
Standards and Interoperability

56. Governance: Designate a chief
information officer (CIO)
Responsibilities:
1. Align IT strategy under the larger hospital strategy
2. Ensure IT delivers the benefits expected
3. Optimize IT risks
4. Optimize IT resources

57. Architecture: establish the practice
Scope:
1. Document the current state architecture
2. Adopt industry-accepted target state architecture
3. Prepare the sequence plan (from current to target)
Current Target
Y1 Y2 Y3 Y4 Y5

58. People: Project/Program
Management
Scope:
1. Hire certified project managers (PMP, PRINCE2, Agile)
2. Train staff on project management
3. Adopt project management frameworks internally and from
vendors/suppliers
4. Embed and promote culture of information security

59. Standards and Interoperability
Scope:
1. Adopt standards
2. Ensure compliance to the standards
3. Control all exceptions to the standards

60. www.psdh.net

61. As healthcare institutions
Protect our patients
Establish good governance over information
Create a culture of information security among the staff
Work with qualified partners

62. admarcelo@up.edu.ph
admarcelo@stlukes.com.ph
@amarcelo