Health Information Privacy: Federal and Provincial Issues Assembling the Pieces

1
Health Information Privacy Federal and
Provincial Issues Assembling the Pieces

• Anita Fineberg
• Corporate Counsel Chief Privacy Officer
• IMS HEALTH Canada and Latin America
• Riley Information Services Inc.
• Health Information Privacy Dialogue with the
  Health Community
• Ottawa, September 17, 2004

2
Outline

• The Big Picture
• The Federal Landscape
• The Provincial Landscape
• Drivers for Seamlessness
• Pan-Canadian Health Information Privacy and
  Consultation Framework
• Other Current Activities/Timelines
• Success Metrics

3
The Big Picture From This to .
British Columbia Public Freedom of Information
and Protection of Privacy Act Private Personal
Information Protection Act
Yukon/NWT/Nunavut Private Personal Information
Protection and Electronic Documents Act
Newfoundland Public Freedom of Information and
Protection of Privacy Act (not yet in force)
Private Personal Information Protection and
Electronic Documents Act
Federal Public Privacy Act Private Personal
Information Protection and Electronic Documents
Act
P.E.I. Public Freedom of Information and
Protection of Privacy Act Private Personal
Information Protection and Electronic Documents
Act
Alberta Public Freedom of Information and
Protection of Privacy Act Public/Private Health
Information Act Private Personal Information
Protection Act
Nova Scotia Public Freedom of Information and
Protection of Privacy Act Private Personal
Information Protection and Electronic Documents
Act
Saskatchewan Public Freedom of Information and
Protection of Privacy Act Public /
Private Health Information Protection
Act Private Personal Information Protection and
Electronic Documents Act
Ontario Public FIPPA Public/Private Personal
Health Information Protection Act, 2003 In Force
on Nov.1, 2004 Private Personal Information
Protection and Electronic Documents Act
Quebec Public An Act respecting Access to
Documents held by Public Bodies and the
Protection of Personal Information Private An
Act respecting the protection of personal
information in the private sector
Manitoba Public Freedom of Information and
Protection of Privacy Act Public / Private
Personal Health Information Act
Private Personal Information Protection and
Electronic Documents Act
New Brunswick Public Protection of Personal
Information Act / Right to Information
Act Private Personal Information Protection and
Electronic Documents Act
4
The Big Picture this.
Federal Public Privacy Act Private Personal
Information Protection and Electronic Documents
Act
Pan Canadian Health Information
Privacy and Confidentiality Framework
5
The Federal Landscape

• Legislation
• The Personal Information Protection and
  Electronic Documents Act (PIPEDA)
• The Privacy Act
• Interpretation
• PIPEDA Awareness Raising Tools (PARTs) for the
  Health Sector
• http//strategis.ic.gc.ca/epic/internet/inecic-ce
  ac.nsf/en/gv00211e.html
• PIPEDA findings Case summaries 118, 199, 120
• All relate to employers collection of employee
  personal health information

6
The Provincial Landscape

• Public sector access and privacy legislation
  (all except Newfoundland)
• Private sector privacy legislation
• Quebec An act respecting the protection of
  personal information in the private sector
• Alberta Personal Information Protection Act
• B.C. Personal Information Protection Act

7
The Provincial Landscape

• Health Information Legislation
• Alberta Health Information Act
• Saskatchewan The Health Information Act
• Manitoba The Personal Health Information Act
• Other provincial legislation (e.g. laboratories),
  professional codes, by-laws, guidelines

8
Drivers for Harmonized Approach

• Implied argument to exempt health organizations
  from the application of PIPEDA
• Development of interoperable electronic health
  record across the system
• Kirby, Romanow reports etc. overall health
  system reform/ evidence-based decision-making
• Pan Canadian research studies
• Healthcare across provincial borders
• National standards for healthcare delivery
• wait times
• report cards
• National Programs
• Proposed Canada Health Protection Act
  (legislative renewal)
• Pharmacare?

9
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• Background
• Developed by the Advisory Committee on
  Information and Emerging Technologies (ACIET)
• ACIET reports to the Conference on F/P/T Deputy
  Ministers of Health
• Includes representatives from Health Canada, all
  provinces and territories, CIHI, Statistics
  Canada, National Aboriginal Health Organization,
  Canada Health InfoWay
• Conference support in principle the development
  of the framework as a basis to review and, where
  necessary, revise or enact new legislation
  reflecting the core collection, use and
  disclosure provisions
• Quebec not participating in framework development
  to monitor and comment on progress as a member of
  ACIET

10
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• Scope Entities and Information
• Any organization that collects, uses or discloses
  health information for the purposes of
• Providing care and treatment to the individual
• Management of the health system
• Research
• Recorded information about an identifiable
  individual
• No exceptional legislative vehicle for genetic
  information
• No application to health services provider
  information
• No application to personal information in an
  employee health record

11
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• The Framework Provisions
• Definitions
• Duties and Obligations of Custodians/Trustees to
  Protect Personal Health Information
• privacy impact assessments
• cross-border transfers
• policies and procedures
• information manager
• transforming identifying personal health
  information

12
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• The Framework Provisions (contd)
• Duties and Obligations of Custodians/Trustees to
  Protect Personal Health Information (contd)
• physical, technical and administrative safeguards
• retention, storage and destruction of personal
  health information
• personal health numbers
• fines and penalties
• immunity from suit

13
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• The Framework Provisions (contd)
• Right of Individual to Access own Health
  Information
• Collection of Personal Health Information
• Duty to Protect the Individuals Privacy
• Consent Rules
• proposed rules for care and treatment
• collection, use and disclosure requiring
  individual express consent

14
Pan-Canadian Health Information Privacy and
Confidentiality Framework

• The Framework Provisions (contd)
• Consent Rules (contd)
• disclosure without consent unless individuals
  express otherwise
• purposes/uses with no right to withhold/withdraw
  consent
• disclosures without consent
• Substitute Decision Maker
• Use and Disclosure for Research Purposes
• Commissioners/Review Officers
• Oversight/Redress Rules

15
Current Activities/Timelines

• F/P/T
• Pan-Canadian Health Information Privacy and
  Confidentiality Framework Provisions
• Currently consulting on both the federal and
  provincial levels
• Draft to ACIET September 30, 2004
• Approval by Committee of Deputy Ministers
  December 30, 2004?
• Federal
• PIPEDA review to commence by April 1, 2006
• Report back within a year or further period as
  authorized by Parliament

16
Current Activities/Timelines

• Provincial
• Ontario
• Coming into force of the Personal Health
  Information Protection Act, 2004 November 1,
  2004
• Alberta
• HIA Review Committee consultation
• likely to report back October 20, 2004
• PIPA designation as substantially similar?

17
Current Activities/Timelines

• Manitoba
• Consultations on The Personal Health Information
  Act
• Report back??
• Saskatchewan
• Consultations on proposed draft regulations under
  The Health Information Protection Act
• Deadline of September 30, 2004

18
Current Activities/Timelines

• B.C.
• PIPA designation as substantially similar?
• Quebec
• PIPEDA constitutional challenge
• General
• Interpretation of both provincial legislation and
  PIPEDA by privacy commissioners
• Scope of application and jurisdiction to be
  determined
• Complaints related to the collection, use and
  disclosure of personal health information

19
Success Metrics

• All provinces implementing substantially
  similar legislation as it applies to personal
  health information?
• Status of Quebec?
• Drill down re internal provincial codes,
  by-laws etc.
• Clarity required before large IT investments to
  avoid costly system retrofits
• Timing given current InfoWay projects

20
Contact Information

• Anita Fineberg, B.A., LL.B.
• Corporate Counsel and Chief Privacy Officer
• Canada and Latin America
• afineberg_at_ca.imshealth.com
• Tel [phone]-5000
• Fax [phone]
• www.imshealth.com