Flashcards Studio

A private hospital in Metro Manila collects patients’ health information and biometric identifiers (facial recognition) to diagnose and treat patients. It contracts a cloud-based telemedicine vendor located in the United States to analyze imaging and biometrics to support clinical decisions. Intake forms authorize use of data for treatment and hospital operations but do not address disclosure to third‑party processors or cross‑border transfers. A data processing agreement with the US vendor provides that data will be processed to provide services and deleted upon contract termination, but does not specify retention beyond termination or localization. Data may be stored on local servers and in the vendor’s cloud in the United States. (a) Identify the lawful basis for processing the patient’s health information and biometrics for diagnosis and treatment. (b) Is disclosure to the US vendor permissible without a separate express consent? What is the controlling rule on processing sensitive personal information in this context? (c) If the data are transferred to the United States, is such cross‑border transfer permissible under the Data Privacy Act, and what safeguards must be in place? Apply the rule to the facts.