BC privacy chief calls for new health information laws

VICTORIA – The Government of British Columbia should enact a new health information privacy law that allows patients to reap the benefits of health innovation while also protecting privacy, says B.C. Information and Privacy Commissioner Elizabeth Denham (pictured).

The recommendation is one of 21 made by the Commissioner in a special report released this month that outlines the changing landscape of healthcare in the wake of new technologies and cutting-edge research.

Specific recommendations include:

• Requirements for custodians to collect only the minimum amount of personal health information needed for specified purposes, ensure the accuracy of personal health information and institute privacy management programs;
• In relation to large electronic health record systems implemented by the Ministry of Health or health authorities, requirements for notification to the individual, role-based access, choices about who can access records (masking) and audit logs;
• In relation to health research, the establishment of a single research ethics board, a data stewardship committee responsible for ensuring a consistent approach to data access and specific authorities for disclosures to the Canadian Institute of Health Information and organizations like Population Data BC;
• In relation to individuals, rights to have access to their own personal health information and request correction;
• Significant fines for non-compliance; and
• Oversight by the Commissioner, including mandatory review of privacy impact assessments and breach notification.

The Commissioner urges government to fill her prescription for legislative reform at the earliest possible opportunity.

According to the report, “B.C.’s current legal framework for the use of personal health information is increasingly strained in the digital era. The current laws have developed incrementally over the years, and are spread across many statutes. The result is a complex web of rules and regulations that are, in some cases, difficult to understand and result in a lack of transparency for the public about how their information is being used or shared.”

“While other jurisdictions in Canada have stand-alone health information legislation, in B.C. we have a patchwork of laws where the rules can be complex and difficult to follow. This patchwork does not provide sufficient clarity, transparency and controls for the public, who may have questions about how their personal health information is being used, shared, and protected.

“Doctors treat the patient, not the disease; likewise, government needs to take a holistic approach to the collection, use, disclosure and protection of personal health information and patient data by introducing a comprehensive health information privacy law with independent oversight and enforcement,” said Denham.

The report also contains important recommendations to enhance the ability of researchers to safely and securely access data. Some of the proposals include streamlining approvals to promote efficient access to data for researchers, and making the process more transparent for the public.

“B.C. has an opportunity to be a leader, to embrace these new technologies and use them to improve health outcomes for patients and promote leading edge research. To achieve this aim, we need the right legal framework with robust privacy protections that meets the evolving needs of patients and the public,” said Denham.

A Prescription for Legislative Reform: Improving Privacy Protection in BC’s Health Sector is available at: www.oipc.bc.ca/report/special-reports.