Medicus Philippines Inc. | Laboratory & Diagnostic Imaging Services

Official Website of Medicus Philippines Inc.

Security Incident Management Policy

Medicus Philippines Inc.- March 1, 2026

1.0 Objective

These Rules provide the framework for security incident management including personal data breach and the procedure for personal data breach notification and other requirements.

2.0 Scope

Shall apply to all Medicus Philippines Inc. (MPI) personnel, regardless of the type of employment status involved in the processing of information within the company and must comply with the terms set out in the policy.

3.0 Definition of Terms

For the purpose of this Policy, the following terms are defined, as follows:

3.1 “Personal Data” refers to all types of personal information;

3.2 “Act” refers to Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012;

3.3 “Commission” refers to the National Privacy Commission

3.4 “Data Processing System” refers to a system or procedure by which personal data is collected and processed in an information and communications system, or a relevant filing system.

3.5 “Data Protection Officer” refers to an individual designated by the head of agency to be accountable for the agency’s compliance with the Act: Provided, that the individual must be an organic employee of the government agency; Provided further, that a government agency may have more than one data protection officer;

3.6 “Data subject” refers to an individual whose personal data is processed;

3.7 “Incident Report” refers to a document that provides a detailed account of a suspected security incident. It is not an acknowledgment of guilt or wrongdoing on the part of the person who prepares it. It shall be treated primarily as a statement of facts, which also includes an initial assessment of the incident;

3.8 “IRR” refers to the Implementing Rules and Regulations of Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012;

3.9 “Personal Data Breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

It may be in the nature of:

3.9.1 availability breach – loss, accidental or unlawful destruction of personal data;

3.9.2 integrity breach – alteration of personal data; or

3.9.3 confidentiality breach – unauthorized disclosure of or access to personal data.

3.10 “Personal Information” refers to any information, on its own or when combined with other information, from which the identity of an individual is apparent or can be reasonably and directly ascertained;

3.11 “Personal Information Controller” or “PIC” refers to a natural or juridical person that controls the processing or use of personal data. It includes a person who instructs another person to process personal data on its behalf;

3.12 “Personal Information Processor” or “PIP” refers to a natural or juridical person to whom a personal information controller may outsource the processing of personal data under the latter’s control or custody;

3.13 “Privacy Impact Assessment” is a process undertaken by a PIC or PIP to evaluate and manage the impact on privacy of a particular program, project, process, measure, system or technology product;

3.14 “Security Incident” is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach, if not for safeguards that have been put in place;

3.15 “Sensitive personal information” refers to personal information:

3.15.1 about an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

3.15.2 about an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such individual, the disposal of such proceedings, or the sentence of any court in such proceedings;

3.15.3 issued by government agencies peculiar to an individual which includes, but is not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and specifically established by an executive order or an act of Congress to be kept classified.

4.0 Security Incident Response Team

There shall be a Security Incident Response Team (SIRT), which shall be responsible for investigating a suspected security incident. The SIRT has the authority to make immediate decisions regarding critical action. The team shall be responsible for the following:

4.1 Implementing security incident management policy of the personal information controller or personal information processor;

4.2 Managing security incidents and personal data breaches; and

4.3 Compliance with the relevant provisions of the Act, its IRR, and all related issuances by the Commission on personal data breach management.

Headed by the Data Protection Officer, the Team shall have two (2) other permanent members in the person of the IT Manager/ Supervisor and Corporate Sales Manager.

Other MPI personnel may be called on to join the Team on a per incident basis when their expertise or background is appropriate and necessary to adequately address the incident, as recommended by the permanent members and approved by the President & CEO.

5.0 Responsibilities

To ensure the effective implementation of this Policy, the following offices and individuals shall perform their respective functions and responsibilities:

5.1 Security Incident Response Team

5.1.1 Investigate and assess suspected security incidents in coordination with all concerned units and offices of MPI.

5.1.2 Recommend corrective actions to be performed by the Process Owner and other concerned units or offices of MPI in relation to a suspected security incident.

5.1.3 Designate additional members/alternate members of the SIRT as the circumstances may require.

5.1.4 Notify the NPC and/or affected data subjects when required by DPO.

5.2 Process Owners

5.2.1 Where a reported incident involves its data processing system or any personal data under its control or custody, submit an Incident Report to the Data Protection Officer in accordance with this policy.

5.2.2 Implement security measures that aim to:

  • avoid or minimize the risk of experiencing security incidents
  • stop an ongoing security incident
  • contain, limit, or mitigate the impact of a security incident

5.4.3 Cooperate with and extend assistance to the SIRT in resolving each reported incident.

6.0 Procedures

6.1 GUIDELINES FOR THE PREVENTION OF PERSONAL DATA BREACH

6.1.1 Preventive or Minimization Measures

  1. Conduct privacy impact assessment in each department/section/unit to identify attendant risks in the processing of personal data;
  2. Implementation of appropriate security measures that protect the availability, integrity, and confidentiality of personal data being processed;
  3. Regular monitoring for security breaches and vulnerability scanning of computer networks;
  4. Coordinate with NPC for the capacity building of personnel to ensure knowledge of data breach management principles, procedures.
  5. Regular review of policies, procedures and to evaluate the effectiveness of the security measures;
  6. Regular revision and review, at least annually, of the incident response policy and procedure, by the Security Incident Response Team. The date of the last review and the schedule for the next succeeding review must always be indicated in the documentation of the incident response policy and procedure.

6.1.2 Availability, Integrity and Confidentiality of Personal Data

The security measures should be directed to ensuring the availability, integrity, and confidentiality of the personal data being processed, and may include:

  1. Implementation of back-up solutions;
  2. Access control and secure log files;
  3. Encryption;
  4. Data disposal and return of assets policy.

6.2 INCIDENT REPORTING

Any employee with knowledge or reason to believe that there is either:

  1. A Security Incident, that is, an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data; or
  2. A Personal Data Breach, that is, a security incident that leads to the accidental or unlawful destruction, loss, alteration, inaccuracy, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

shall immediately report all information on hand to the Data Protection Officer.

Incident reporting shall be carried out in accordance with the provisions of this Section:

6.2.1 An incident must involve a data processing system or personal data under the control or custody of the MPI. It includes those being processed by a service provider or any other authorized third party.

6.2.2 Any person who becomes aware of or has reason to believe that an incident has occurred must notify the Data Protection Officer at medicusphilsdpo@medicus.ph.

6.3 INVESTIGATION OF INCIDENTS

Investigations of incidents shall be carried out in accordance with the provisions of this Section:

6.3.1 The DPO shall refer a reported incident to the concerned Process Owner. It shall also give advance notice to the SIRT about the reported incident.

6.3.2 Once informed by the DPO, the Process Owner shall accomplish an Incident Report and submit the same to the DPO within twenty-four (24) hours. The Process Owner must inform the DPO before the expiration of such period if it requires additional time. However, in no case shall such additional time exceed five (5) calendar days. Whenever possible, the person/s who may be involved in the reported incident should not be made to accomplish the Incident Report to minimize any conflict of interest.

6.3.3 The DPO shall refer the Incident Report to the members of the SIRT for their evaluation. At this point, the SIRT will determine if additional members are necessary to investigate the reported incident. If so, deemed necessary, the SIRT shall recommend the designation of additional members.

6.3.4 The SIRT shall conduct its investigation of the incident and shall complete its investigation within forty-eight (48) hours after it has obtained all information it needs to carry out its investigation. If it requires additional time, it must at least determine within this period whether or not a data breach has occurred, and if notification of the NPC is necessary.

6.3.5 The SIRT Incident Report and other relevant attachments, shall be recorded and stored in accordance with this Policy. However, if it contains recommendations and/or other matters that require the attention of the Medical Center Chief, it shall be transmitted immediately to the latter for appropriate action.

6.4 DATA BREACH NOTIFICATION OF THE NPC AND DATA SUBJECTS

Notification of the NPC and affected data subjects shall be carried out in accordance with the following provisions:

6.4.1 A confirmed data breach shall be reported to the NPC if the DPO, after being informed of the advice of the SIRT, has determined that it is attended by all of the following conditions:

  • it involves sensitive personal information or any other information that may be used to enable identity fraud;
  • there is reason to believe that the information may have been acquired by an unauthorized person; and
  • there is reason to believe that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.

6.4.2 If there is uncertainty regarding the need to notify the NPC, the following additional factors shall be considered by the DPO and/ or the SIRT:

  • Notification could reduce the risks arising from the data breach.
  • The data breach would likely affect national security, public safety, public order, or public health.
  • The personal data involved is required by applicable laws or rules to be confidential.
  • The personal data involved belongs or refers to vulnerable groups.
  • The data breach affects at least one hundred (100) individuals.

6.4.3 The DPO shall notify the NPC through the Data Breach Notification Management System (“DBNMS”) online platform (https//dbnms.privacy.gov.ph) within seventy-two (72) hours upon knowledge of or the reasonable belief that a personal data breach has occurred.

6.4.4 Notification may only be delayed to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system.

The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. details of contact person for more information

6.4.5 There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information will harm or adversely affect the data subject. In both instances, the NPC shall be notified within the 72-hour period based on available information. The full report of the personal data breach must be submitted within five (5) days, unless MPI is granted additional time by the Commission to comply.

6.4.6 MPI must also notify affected individuals within the same period. If it is not reasonably possible to notify the data subjects within the prescribed period, MPI shall request the NPC for an exemption from the notification requirement, or the postponement of the notification.

6.4.7 Whenever possible, MPI, through the concerned Process Owner, shall coordinate with all affected data subjects and provide appropriate guidance or assistance.

7.0 Documentation

All reported incidents and actions taken shall be properly documented. The DPO shall maintain records of Security Incidents and Personal Data Breaches. Reports should include:

  1. Description of the personal data breach, its root cause and circumstances regarding its discovery;
  2. Actions and decisions of the SIRT;
  3. Outcome of the breach management, and difficulties encountered; and
  4. Compliance with notification requirements and assistance provided to affected data subjects.

A procedure for post-breach review must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor.

8.0 Remedial and Prevention Measures

To help prevent or avoid the same type of security incident from occurring, the following measures may be undertaken:

8.1 The SIRT may recommend the conduct of a Privacy Impact Assessment (PIA) on the data processing system involved in a security incident, or on the entire office of the Process Owner. The DPO shall issue the necessary guidelines for the proper conduct of a PIA.

8.2 The concerned Process Owner shall implement new security measures, and/or make changes to existing ones.

9.0 Reference Documented Information

9.1 Data Privacy Act RA 10173

9.2 Implementing Rules and Regulations of RA 10173

9.3 NPC Privacy Toolkit (A Guide for Management & Data Protection Officer)

9.4 The 2017 Compendium of NPC Issuances

9.5 NPC Circular 16-03 – Personal Data Breach Management

For strict implementation

Powered by  GDPR Cookie Compliance
Privacy Notice

I have read about the Medicus Philippines Inc. Privacy Notice and express my consent thereto. In the same manner, I hereby express my consent for Medicus to collect, record, organize, update or modify, retrieve, consult, use, consolidate, block, erase or destruct my personal data as part of my information. I hereby affirm my right to: (a) be informed; (b) object to processing; (c) access; (d) rectify, suspend or withdraw my personal data; (e) damages; and (f) data portability pursuant to the provisions of the Act and its corresponding Implementing Rules and Regulations.