Title: Proposed Personal Health Information Act
1Proposed Personal Health Information Act
- Presented to
- Atlantic Symposium on Privacy
- in Health Services and Policy Research
- Presented by
- Suellen J. Murray, Project Manager
- Health Information Legislation Project
- April 20, 2009
2Canadian Health Privacy legislationBackground
- Krever Commission of Inquiry into the
Confidentiality of Health Information (Ontario
1980) - Commission on Future of Health Care in Canada
(Romanow report 2002) recommended clear and
consistent privacy rules - Federal Personal Information Protection and
Electronic Documents Act (PIPEDA) - effective in 2004 for health care
- Provinces requested a carve-out from PIPEDA
3Public Opinion
- Revisiting the Privacy Landscape a Year Later
- EKOS Research for Federal Privacy Commissioner
March 2006 - 59 said that there are few types of personal
information that are more important for privacy
laws to protect than personal health information - 77 said that it was of high importance to them
personally to have strong laws to protect
Canadians personal information - 88 believe that, compared to ten years ago, it
is more important that Canadian privacy laws are
updated regularly to ensure that they are keeping
up with new technologies that may impact personal
information
4Provincial Health Information Legislation
Personal Information
Protection of Personal Information in the
Private Sector (1994)
Protection Act
(January 2004)
YK
Personal Health Information Act Passed May 2008
eHealth Act (Introduced April 2008)
NU
NWT
BC
Bill anticipated in 2009
AB
MB
NL
SK
PQ
ON
NB
Legislation in development
Health Information
Personal Health
Health
Protection Act
Personal Health
Information
Information
(September 2003)
Information Act
Protection Act
Act
(April 2001)
(December 1997)
(November 2004)
5Pan-Canadian Health Information Privacy and
Confidentiality Framework
- F/P/T initiative to develop consistent rules for
health privacy - Developed by F/P/T team (plus CIHI, CIHR, Infoway
and Statistics Canada) - January 2005 - Signed off by Health Deputy
Ministers of all provinces (except Saskatchewan
and Quebec) - Recommends a harmonized set of core provisions
for the collection, use and disclosure of
personal health information in the public and
private sector
6Nova Scotia Current Status
- Over 40 pieces of legislation govern collection,
use and disclosure of personal health information - Key provincial Acts
- Freedom of Information and Protection of Privacy
Act (DOH/DHPP) - Hospitals Act (DHAs)
- Health Protection Act (Public Health)
- Key federal Acts
- Privacy Act (Federal government)
- PIPEDA (all commercial health care providers e.g.
physicians, dentists, nursing homes)
7Health Information Legislation Project
Development
- Project full-time in October 2007
- Four-person internal working group
- Discussions held with stakeholders on specific
issues - Dalhousie Health Law Institute contracted to
propose recommendations for research provisions
8Health Information Legislation Project
Consultation
- Started July 31, 2008
- Discussion Paper link circulated to approx. 200
stakeholders - posted on DOH website
- Discussion paper, questionnaire online survey
- Ended November 1, 2008
9Health Information Legislation Project
Consultation
- 48 written submissions received
- 37 presentations on proposal
- July 2008 April 2009
- Most key stakeholders have responded
- Analysis of submissions is underway
10Health Information Legislation Project Next
steps
- DOH Working Group will continue to meet with
stakeholders, and develop full draft legislation - It is anticipated that the bill will be
introduced in 2009 - Implementation period estimated 9-12 months
11Proposed PHIA PurposePage 5
- to govern the collection, use, disclosure,
retention and destruction of personal health
information in a manner that recognizes both the
right of individuals to protect their personal
health information and the need of health
information custodians to collect, use and
disclose personal health information to provide,
support and manage health care
12Proposed PHIA Scope
- Clear scope is key to an effective flow of
information - PHIA only applies to
- personal health information
- health care
- health information custodians
13Proposed PHIA Scope what is covered? Page 9,
Section 2
- Identifying information means information that
identifies an individual or for which it is
reasonably foreseeable in the circumstances that
it could be utilized, either alone or with other
information, to identify an individual.Â
14Proposed PHIA Scope who is covered?Page 6
- Applies to health information custodians
- Exhaustive list of custodians proposed for
legislation - Department of Health
- Regulated health professionals who provide
health care - District Health Authorities IWK Health Centre
- Pharmacies
- Continuing care facilities licensed by DOH
- Other prescribed by regulation
15Health Information Legislation Key Issues
- The Personal Health Information Act will provide
consistent rules for providers within circle of
care
16Health Information Legislation Key Issues
- Requirements for practices and policies to
protect personal health information - general privacy policy
- privacy contact person
- communications materials
- specific policies procedures (e.g.
secure destruction)
17Health Information Legislation Key Issues
- Custodian shall only allow access to the
information that the employee, agent, vendor etc.
requires to carry out their duties and
responsibilities
18Health Information Legislation Key Issues
- Ability of individual to limit or withdraw
consent for use and disclosure of their
information
19Ability to withdraw or withhold consentPage 12,
section 7
- Known as the lockbox
- Already a requirement for providers under PIPEDA
most provinces have it in their PHIAs - Allows an individual to decide if s/he wants to
prevent information from flowing within the
circle of care - Can apply to a specific provider (e.g. Dr. Jane
Smith) or specific piece of information (e.g. lab
results)
20Health Information Legislation Key Issues
- Ability to audit for reporting access to
individual health records
21Health Information Legislation Key Issues
- Requirement to report to individual any breach of
their personal health information
22Mandatory reporting of breachPage 35
- Breach proposed provision defines breach as
taking place when information is stolen, lost or
subject to unauthorized access, use, disclosure
copying or modification - Other jurisdictions, policies qualify
reporting requirement - adverse impact (Newfoundland Labrador)
- harm or embarrassment, public disclosure or
malicious use (NS DOH)
23Health Information Legislation Key Issues
- To be effective, the legislation requires
independent privacy oversight
24Independent privacy oversight Pages 47-48
- Independent privacy oversight is critical to an
effective privacy framework - Nova Scotia is the only jurisdiction in Canada
without independent privacy oversight - Privacy Review Officer Act passed in November
2008
25Health Information Legislation Key Issues
- Researchers must support privacy protection by
limiting use of identifiable information in
research and seeking consent for use of personal
health information (with some exceptions)
26Public Opinion
- Electronic Health Information and Privacy
Survey What Canadians Think - Infoway/Federal Privacy Commissioner August 2007
- 87 support the use of electronic health records
in research provided that personal details are
removed - 54 support the use of electronic health records
in research if identifying details are not
removed - 66 support linking health information to other
information (e.g. education, income) but only
with consent
27Research Pages 28-32
- Proposed research provisions seek to balance use
and protection - Proposed provisions require that the minimum
amount of information necessary for research
purpose may be used or disclosed - Consistent with TCPS Ethical Conduct for
Research Involving Humans
28Research Pages 28-32
- Issues include capacity of Nova Scotia REBs,
distinction between research and planning and
management of health system - Legislation will also take into consideration
proposed Health Policy Research Centre - www.nshrf.ca for more information
29For more information
- Discussion paper is available at
www.gov.ns.ca/health/phia - Comments/questions can be e-mailed to
phia_at_gov.ns.ca