Employee Medical-Record Privacy in the Philippines: Employer and Employee Guide

Quick answer: An employer may collect and use an employee’s medical information only when there is a lawful, specific employment purpose and the processing is proportionate to that purpose. Medical records reveal health information, which the Data Privacy Act treats as sensitive personal information. Access should therefore be restricted, retention should be limited, and disclosure should not go beyond people who genuinely need the information.

What employee medical information is covered?

Workplace medical information can include medical certificates, fit-to-work clearances, laboratory results, diagnosis details, disability records, pregnancy-related documents, vaccination records, occupational-health assessments, HMO claims and information submitted for sick leave, accommodation or benefits. Even a short email identifying an employee’s illness can be sensitive personal information.

Can an employer ask for medical records?

An employer may request information that is reasonably necessary to verify leave, determine fitness for a particular job, provide an accommodation, comply with occupational-safety duties, administer benefits or establish or defend a legal claim. That does not create an unlimited right to obtain a complete medical history.

The request should pass three tests:

• Purpose: Is there a clear employment, safety, benefits or legal reason?
• Necessity: Can the purpose be achieved with a medical certificate or functional limitation instead of a detailed diagnosis or full record?
• Proportionality: Is the privacy impact reasonable compared with the workplace need?

What is the legal basis?

Republic Act No. 10173 permits processing only under lawful conditions. Because health information is sensitive personal information, employers should identify the specific basis that applies, document the purpose and comply with the principles of transparency, legitimate purpose and proportionality. Depending on the facts, processing may be required by law, necessary to protect lawful rights and interests, connected with medical treatment by an authorized professional, or based on valid consent. Consent should not be used casually in employment because the imbalance between employer and employee can affect whether it is truly freely given.

How much information may the employer collect?

Collect the minimum information needed for the decision. For ordinary sick leave, the necessary information may be limited to the employee’s inability to work, the relevant dates and whether the employee is fit to return. A manager usually does not need laboratory results, prescription details or a full diagnosis.

When a job has genuine health or safety requirements, a more detailed assessment may be justified. The request should still be tied to the essential functions and risks of that role, not used as a general fishing expedition.

Who should have access?

Access should follow a need-to-know model. HR, an occupational-health professional, the data protection officer or a benefits administrator may need access for defined tasks. A direct supervisor generally needs only the operational conclusion—for example, the approved leave dates, work restrictions or accommodation—not the underlying diagnosis.

Medical files should not be kept in a shared personnel folder accessible to unrelated managers. Use role-based permissions, access logs and a separate restricted repository where practical.

May the employer disclose the diagnosis to coworkers?

Usually not. Coworkers may need operational information, such as that the employee is on leave or that duties have been reassigned. They ordinarily do not need the diagnosis. Disclosure to an HMO, insurer, SSS, government agency, lawyer or clinic should be limited to what the transaction or legal requirement needs and protected by appropriate safeguards.

Medical certificates and fit-to-work clearances

An employer may verify whether a certificate is authentic and whether the employee is fit to perform the job. Verification should not become an unrestricted demand for the employee’s full clinical file. If additional information is genuinely necessary, explain the reason, identify the requested fields and use a secure channel.

When fitness is disputed, the employer should focus on functional capability and workplace risk. A second medical assessment should be connected to a legitimate concern and handled consistently, without discrimination or retaliation.

Retention and deletion

Do not keep medical records indefinitely “just in case.” The employer should use a retention schedule based on the purpose, applicable labor, tax, social-security, occupational-safety and claims periods, and any active dispute or legal hold. When the purpose and required retention period end, securely delete, anonymize or destroy the record.

Employee rights

Subject to the Data Privacy Act and valid exceptions, employees may ask what information is being processed, why it is used, who receives it, how long it is retained and how it can be corrected. They may also raise an objection or complaint where processing is excessive, inaccurate, insecure or unauthorized. For the broader rights framework, see CyberCode.ph’s Philippine data-privacy guide.

What should an employee do after an improper disclosure?

1. Preserve the email, chat, screenshot, access log or witness details showing the disclosure.
2. Ask HR or the data protection officer to identify what was disclosed, to whom, for what purpose and under what authority.
3. Request containment, correction, access restriction and a written response.
4. If the issue is not resolved, consider the employer’s grievance process and the NPC complaint procedure.
5. For retaliation, discrimination or an employment dispute, preserve the employment records and seek advice about the proper labor forum.

Employer compliance checklist

• State the exact purpose before collecting health information.
• Request only the minimum fields or document needed.
• Give an appropriate privacy notice.
• Identify and document the lawful basis.
• Store medical files separately with restricted access.
• Tell managers only the operational information they need.
• Use secure transfer methods for clinics, HMOs and government filings.
• Set retention and secure-destruction rules.
• Prepare a breach and incident-response process.
• Train HR staff and supervisors not to discuss diagnoses casually.

Employee checklist before submitting a record

• Confirm which document is actually required and why.
• Ask whether a certificate stating dates and fitness is sufficient.
• Use the employer’s secure HR channel rather than a group chat.
• Keep a copy of the submitted document and privacy notice.
• Record any disclosure, retaliation or request that appears excessive.

Frequently asked questions

Can HR call the employee’s doctor?

HR may verify a document or seek necessary clarification through an appropriate process, but a healthcare provider is not automatically free to disclose the employee’s full medical information. The scope and authority for any disclosure must be established.

Can a supervisor keep a copy of the medical certificate?

The better practice is for the restricted HR or occupational-health function to retain it. The supervisor should receive only the leave or work-status information needed to manage operations.

Can medical information be used to dismiss an employee?

A diagnosis alone does not automatically justify dismissal. Labor-law requirements governing disease as a ground for termination, medical certification, due process, reasonable workplace measures and anti-discrimination protections may apply. Read the related guide on medical or health-related employment issues.

For health testing performed as part of workplace policy, see the guide to workplace drug testing, employee rights and termination limits.

Primary sources

• Republic Act No. 10173 — Data Privacy Act of 2012
• Implementing Rules and Regulations of the Data Privacy Act
• National Privacy Commission

This guide provides general legal information, not legal advice. The correct result depends on the employer’s purpose, the record requested, the safeguards used and the facts of the employment issue.