Cyber Posture Basics: What a Philippine Clinic Must Protect Under the Data Privacy Act

A small clinic runs on trust and on a handful of systems: the EMR or patient spreadsheet, the PhilHealth claims workflow, a shared inbox, a front-desk PC and a few staff phones. Patients rarely think about where their records live. The law does, and so do attackers.

This guide is for clinic owners, medical directors and practice managers who don’t have an IT department. It covers what the Data Privacy Act expects, what to protect first, and a checklist you can finish in a month. For a similar walk-through in another sector, see our guide to recruitment agency data privacy.

Why is patient data a special case under the Data Privacy Act?

Because the law puts it in the strictest category. The Data Privacy Act lists information about an individual’s health as sensitive personal information, along with government-issued identifiers such as PhilHealth numbers (RA 10173, Sec. 3(l)). Processing sensitive data needs a specific legal basis under Section 13, and the clinic stays accountable for it even when a vendor hosts the system (Secs. 14 and 21).

Healthcare data is also proven to be worth stealing. After the 2023 Medusa ransomware attack on PhilHealth, the NPC’s leak-check portal identified 42,089,693 PhilHealth PINs in the data the attackers released (NPC PhilHealth leak portal). A small clinic holds a far smaller set, but the same kinds of records: names, birthdays, diagnoses, PhilHealth numbers and contact details.

Hospitals are reporting incidents too. On 30 October 2026, St. Luke's Medical Center notified the NPC that a platform supporting its mobile app, managed by a third-party service provider, had been accessed without authorization; no record count has been published (St. Luke's notice, ABS-CBN News).

What does the NPC expect from a small clinic?

• Registration may apply even to a small team. Under NPC Circular 2022-04, you must register your data processing systems if you employ 250 or more people or process sensitive personal information of 1,000 or more individuals. A busy clinic can pass 1,000 patient records quickly.
• Security controls are written down. NPC Circular 2023-06 expects need-to-know access, multi-factor authentication for online access to sensitive data, a documented retention policy, protection for lost or stolen devices, and a continuity plan that covers backup and restoration.
• Breaches have a clock. Under NPC Circular 16-03, a notifiable breach involving sensitive data must be reported to the NPC and to affected patients within 72 hours of discovery. If it happens, our digital forensics and incident response team can help you scope it.

What are the threats a small clinic actually faces?

The US Department of Health and Human Services’ 405(d) program publishes free guidance for exactly this audience, Health Industry Cybersecurity Practices (HICP), with technical guidance that scales down to small practices. It names five threats it sees as most prevalent in healthcare: social engineering (phishing), ransomware, loss or theft of equipment or data, insider or accidental data loss, and attacks on connected medical devices (HHS 405(d) HICP).

None of these needs a sophisticated attacker. A phishing email to the shared inbox, a stolen laptop with an unencrypted patient list, or a former receptionist who still has the EMR password is enough.

What should a clinic protect first?

Start with the systems that would stop patient care or expose records if they failed:

1. The EMR or patient records system. Named logins for every doctor and staff member, MFA, and accounts removed the day someone leaves.
2. Email and the shared inbox. This is where lab results, referrals and HMO letters travel, and where phishing lands. Turn on MFA and the provider’s anti-phishing settings.
3. Front-desk and doctor PCs. Endpoint protection with detection and response, automatic updates, screen locks and full-disk encryption on laptops. If you run 20 to 40 PCs, see why that is enough to hurt.
4. Backups. One copy offline or immutable, and a restore test every quarter. Our look at clinic downtime and endpoint protection shows what a day without systems costs.
5. Phones and chat apps. Agree on where patient photos and results may be sent, and don’t let personal messaging groups become the medical record.

The 30-day clinic posture checklist

Week	Task	Who
1	List every system and folder that holds patient data, including phones and paper	Practice manager + DPO
1	Write down how long you keep each record type, and shred or archive what you no longer need	DPO
2	MFA on email, EMR and any cloud storage; remove old and shared accounts	IT provider
2	Encrypt laptops; set screen locks; enable remote wipe on clinic phones	IT provider
3	Endpoint protection on every PC; confirm updates install	IT provider
3	Offline or immutable backup, then restore one real patient folder as a test	IT provider
4	One-page breach plan: who decides, who calls the IT provider, who notifies the NPC	Owner + DPO
4	20-minute staff briefing on phishing and on sending results only through approved channels	DPO

Print the breach plan. If ransomware hits, the shared drive is the first thing you lose. (See how ransomware gets in.)

Where should a clinic start this week?

Pick the two highest-impact items: MFA on email and the EMR, and a tested backup. Then book the rest into the next month. If you want a second pair of eyes, ARA Industries runs a fixed-scope cyber health check of your accounts, devices and backups. Think patient data is already exposed? Email securenow@ara.ph. Otherwise, usap tayo.

General guidance, not legal advice. Confirm your obligations with the National Privacy Commission and your own counsel.