Philippines Data Privacy Act vs HIPAA: Which One Governs Your Offshore Developers?

Quick Answer: The Philippines Data Privacy Act and HIPAA are not alternatives, and for US patient data the Act is usually the smaller of the two. HIPAA reaches an offshore team through your workforce or a business associate agreement. The Act exempts personal data collected from foreign residents under their own laws, but only if you can prove it, and it still requires security measures.

For US patient data, HIPAA does the heavy lifting and the Philippine Data Privacy Act plays a smaller part than most guides claim. The National Privacy Commission's own rules exempt personal data that was collected from foreign residents under their own countries' laws, and that exemption has conditions. Those conditions decide what you put in your contracts.

Full Scale staffs engineers across the Philippines for US companies, including healthcare clients, so this question comes with the territory. Here is how the two laws fit together, with the exact rule text where it matters. None of it is legal advice, and the one open question I found gets flagged below instead of guessed at.

Philippines Data Privacy Act vs HIPAA: what each one answers

HIPAA is a US law about protected health information. It reaches an offshore developer because someone in the chain is bound by it. That is either you, as a covered entity whose workforce includes the developer, or a vendor who signed a business associate agreement with you.

The Data Privacy Act of 2012 (Republic Act 10173) is Philippine law about personal data in general. Health information counts as sensitive personal information under Section 3(l), which is the highest protection tier the Act has.

The two laws ask different things. HIPAA asks what a US covered entity and its partners must do with patient data. The Act asks what anyone processing personal data in the Philippines must do, unless the data is exempt.

Here is how I sort the common setups at Full Scale, as I read the rules. Our engagements usually land in the first row.

Your situation	Which law drives it	What still applies from the other
US covered entity, and the offshore engineers work inside your systems under your direction	HIPAA, through your own workforce compliance program	The Act's security requirements, and the Act in full for the engineers' own employee data
US company hands a project to a Philippine firm that builds on its own infrastructure	HIPAA, through a business associate agreement with that firm	The Act's security requirements, plus anything you can't prove is exempt
You can't show the data was collected under a foreign law	The Act is presumed to apply	HIPAA still applies by contract
Patient data that started in the Philippines	The Act in full	HIPAA only if a US covered entity is involved

The foreign-resident exemption most guides skip

Section 5 of the Act's implementing rules lists special cases where the law does not apply. Item (f) is the one that matters here. It covers personal information "originally collected from residents of foreign jurisdictions in accordance with the laws of those foreign jurisdictions," when that information is processed in the Philippines.

US patient data collected under HIPAA looks like the case that exemption was written for. None of the guides I read mentions it.

The exemption comes with three strings, and all three are in the rule's own text.

• You carry the burden of proof. Whoever claims the exemption has to show the foreign law applies, and without that proof the Act and its rules are presumed to apply.
• Security duties stay on. Controllers and processors "remain subject to the requirements of implementing security measures for personal data protection," even when the rest of the Act falls away.
• It is read narrowly. The exemption holds only to the minimum extent necessary for the specific purpose, and the rules say exemptions are interpreted in favor of data subjects.

The Act hands out the exemption and keeps a firm grip on the security requirements with the other hand.

In practice, don't assume the exemption. Document it. The rules also say the contract between a controller and a processor must state where the processing happens (Section 44). Write down where the data came from, which law governed its collection, and where the work gets done. That paper is your proof.

A Philippine firm that says "we comply with the Data Privacy Act" has told you very little about your PHI. Ask what it does under HIPAA by contract, and which security measures it runs.

Same jobs, different names

The Act and HIPAA both split the world into the party that decides what happens to the data and the party that handles it for them. The names differ, and the fit is close but not exact.

Question	Data Privacy Act term	HIPAA term
Who decides what happens to the data?	Personal information controller	Covered entity
Who handles it on their behalf under a contract?	Personal information processor	Business associate
What does the contract have to cover?	A processing agreement that sets out subject matter, duration, purpose, data types and location (Section 44)	A business associate agreement with the required safeguards and breach terms

HIPAA adds a third category the Act has no obvious twin for. People working under your direct control count as your own workforce, whether or not you pay them, and our HIPAA post walks through that test.

Because Full Scale does staff augmentation, our engineers work inside the client's systems and sprints, which is the first row of the table above. We have also signed business associate agreements, and I'd still ask any vendor for one. An argument about who was responsible goes better on paper than on a breach call.

Two breach clocks, and the part nobody has settled

The Act's rules give a controller 72 hours. Under Section 38 of the implementing rules, the controller notifies the National Privacy Commission and the affected people. The clock starts when the controller knows, or reasonably believes, that a notifiable breach has happened.

A breach is notifiable when sensitive personal information probably went to an unauthorized person and there is a real risk of serious harm. Every incident, notifiable or not, also has to be written up (Section 41), with a yearly summary going to the Commission.

HIPAA's clock for a business associate is looser on paper. The vendor has to tell the covered entity "without unreasonable delay and in no case later than 60 calendar days after discovery," per 45 CFR 164.410.

Here is the open question. The Act's rules exempt foreign-resident data but keep "security measures" in force. Does breach notification count as a security measure for exempt PHI? I could not find that settled anywhere I read, and I'm not going to guess. Your counsel should answer it for your contract.

What I'd do regardless is write the shorter clock into the agreement. Sixty days is a legal ceiling, and a vendor that waits anywhere near it has already failed you. The rules I read also set no deadline for a processor to tell its controller about a breach, so the contract has to. Contract for hours, or at most a few days.

What the Data Privacy Act penalties actually are

Most guides say "penalties include fines and imprisonment" and stop there. The statute has real numbers, and these are the ones that matter for a health-data developer team:

Offense (Act section)	Prison	Fine
Unauthorized processing of sensitive personal information (25b)	3 to 6 years	PHP 500,000 to 4,000,000
Negligent access to sensitive personal information (26b)	3 to 6 years	PHP 500,000 to 4,000,000
Concealing a breach you had to report (30)	1 year 6 months to 5 years	PHP 500,000 to 1,000,000
A combination or series of these acts (33)	3 to 6 years	PHP 1,000,000 to 5,000,000

Section 35 sets the maximum penalty when at least 100 people are affected. HIPAA civil penalties are tiered and adjusted for inflation every year, so check the current table at HHS instead of trusting anyone's blog, including this one.

SOC 2 is a third thing

SOC 2 is an audit report on a company's own controls. It is not a law, and neither the Act nor HIPAA requires one. HHS doesn't certify anyone as HIPAA compliant either, though plenty of vendors will sell you something certificate-shaped.

Full Scale doesn't hold a SOC 2 report and doesn't plan to pursue one. Our engineers work inside your infrastructure under your access controls, so your own controls govern the work. The long version is in our post on whether offshore companies need SOC 2. A report does make sense for a vendor hosting your data on its own infrastructure at real scale. In that case it is a fair thing to ask for.

What actually changes for the developers

Most of the compliance work is ordinary engineering discipline applied to the access path. None of it depends on whether the team writes Ruby on Rails or Go.

• How the team reaches PHI is the client's call. Setups range from remote desktops to keeping production data away from developers altogether. Our IT manager sits down with the client's security team and builds to their requirements.
• Logs and error trackers get the same care as the database. PHI that leaks into an application log, a monitoring payload or a pasted support screenshot is a breach whether the engineer lives in the Philippines or down the hall.
• Code review and CI/CD run in your repositories and pipelines. That puts the audit trail in your hands, which is where you want it.
• Training comes from your workforce program. If the engineers are your workforce, your HIPAA training covers them.
• Devices are company-owned. Our developers do the work on laptops we own, not personal machines.
• Every hire is background-checked. Infovision Research Systems, an independent Philippine firm, runs an eight-part investigation on each one, from identity to sanctions screening.

For the HIPAA-side detail on keeping PHI off laptops, see the HIPAA software development post.

A BPO changes the answer

A business process outsourcing firm that takes over claims handling, billing or support for a US insurer usually works on its own systems with its own staff. That makes it a business associate by design. The Act's processor duties apply to it in full.

That is a different model from putting engineers inside your environment. If your vendor list mixes the two, treat them as two different compliance questions. The difference between them is covered in our post on staff augmentation vs outsourcing.

Questions to ask a Philippine vendor before you sign

• Where will the data be processed, and will the contract say so in writing?
• Do you sign a business associate agreement, and who on your side can answer questions about it?
• How many hours until you tell us about an incident, and where is that written?
• Who is your data protection officer, and are you registered with the National Privacy Commission where the rules require it?
• Do developers work on company-managed devices, or on their own machines?
• Who runs your background checks, and what do they cover?
• Will you let us audit you? The Act's rules say a processor must allow audits by the controller, so the answer should be yes.

If the cheapest bid skips most of these, you're looking at what I call cheapshoring, and the savings show up later as incident-response bills.

If you are weighing a Philippine team for healthcare software development and want to talk through how the access setup would work, book a call with us.

Frequently asked questions

Does HIPAA apply in the Philippines?

HIPAA is US law and does not apply to a Philippine company on its own terms. It reaches Philippine engineers through a US covered entity. Either they work under that entity's direct control as its workforce, or their employer signed a business associate agreement. The Philippine Data Privacy Act applies in parallel for anything not exempt.

Is the Philippines Data Privacy Act equivalent to HIPAA or SOC 2?

No. The Act is a general Philippine privacy law covering all personal data. HIPAA is a US law about health information, and SOC 2 is an audit report that no law requires. For US patient data, the Act's implementing rules exempt personal information collected from foreign residents under their own laws. The party claiming the exemption must prove it, and security requirements still apply.

Do I need a business associate agreement with a Philippine company?

If the company creates, receives, maintains or transmits PHI on your behalf using its own systems, yes, it is a business associate and HIPAA requires the agreement. If its engineers work inside your systems under your direction and count as your workforce, the agreement may not be strictly required. It costs little and settles who is responsible before an incident does.

Can a developer in the Philippines be HIPAA compliant?

Yes. No certificate exists for a developer or a country. What decides it is the structure: whether PHI ever reaches the developer's device, how access is controlled and logged, whether training and background checks are in place, and what the contract says. Engineers in the Philippines work under the same HIPAA rules as engineers anywhere else.

Does US insurance data have to stay in the US if it is processed in the Philippines?

HIPAA itself has no rule requiring data to stay in the US. Other sources can restrict it, including customer contracts, state agency terms and CMS requirements for some Medicare programs. The Philippine rules require a processing contract to state the geographic location of the processing, so write the location down.

Does the 72-hour Data Privacy Act breach deadline apply to US patient data?

That is unsettled. The Act's rules set a 72-hour clock for controllers. They also exempt foreign-resident data while keeping security measures in force, and I found no source resolving whether breach notification falls under that carve-back. Write the shorter of the two deadlines into your contract and ask counsel how it applies to your case.