Canadian Pensioners Concerned

SUBMISSION TO

Health Committee site
SUBMISSION TO THE STANDING COMMITTEE ON GENERAL GOVERNMENT
BILL 159: PERSONAL HEALTH INFORMATION AND RELATED MATTERS FROM CANADIAN PENSIONERS CONCERNED, INC., ONTARIO DIVISION
FEBRUARY 28, 2001. Prepared by: GERDA KAEGI
1. Introduction: Who are We?
Canadian Pensioners Concerned (CPC), founded in 1969, is a membership-based, non-partisan advocacy organization of mature Canadians committed to preserving and enhancing a human-centred vision of life for all citizens of all ages. CPC has particular concern for the quality of life for people in our society who by virtue of age, illness, physical or psychological disabilities or impairments, and/or economic need are especially vulnerable in a society driven by marketplace, economically determined values, often to the exclusion of other societal values that sustain and enhance a fair, just and inclusive social order.
2. Background to this Submission
On July 25, 1996, we submitted Comments to the Ministry of Health on A legal Framework for Health Information: Consultation Paper.
On February 27, 1998, we submitted a Response to the Ministry of Health Consultation on the Draft Personal Health Information Protection Act, 1997.
We are very interested in this area of public policy and, once again, are here before you to express our views on this most important policy initiative. We will not repeat what we have said before but will target particular elements of this Act that is now before you.

3. Our Comments on Bill 159:
I) In principle, we support the introduction of legislation that will regulate the use of personal health information and prohibit the abuse of the right to privacy that we believe all citizens should have in regard to their own personal health information. However, we have serious concerns with elements of Bill 159.
(II) The Use of the Term "Retirement Home" (Section 2.4(vi)
We are very concerned to see this term included in the legislation. Does this term have a clear definition in law? What exactly is meant by a "retirement home for the elderly"? Does this imply that everyone who lives in a "retirement home" is a patient? If they are not receiving care from the "home" why should the retirement home be a custodian of their health information?
III) The Custodian of Personal Health Information
A custodian of an individual's health information holds that information in trust. We believe that, in principle, the personal Health information of an individual must not be disclosed by the custodian of that information without the informed consent of the individual.
IV) Security of Information and Standards of Confidentiality
a) The legislation must apply to all those who have access to the personal health information of individuals.
b) The legislation must require all persons who have access to such records to submit to an oath of confidentiality. Breaches of the privacy of individuals' health information must be dealt with by sanctions established in the legislation. The sanctions should carry a significant penalty and those found guilty of violating the confidentiality of health records should have their names made part of the public record.
c) Redress and compensation must be available to those complainants whose privacy has been proven to be violated.
V) Right of Privacy, Issue of Consent and the Custodians of Personal Health Information a) An individual must receive written notice from the collector(s) and custodian(s) of his/her personal health information outlining the following:
i) the potential use(s) of the information being collected,
ii) the potential benefits and risks to granting or refusing consent for disclosure,
iii) that the consent may relate to specific information, that some information may be excluded if the individual so wishes,
iv) that consent, once given, is time limited and renewed consent must be obtained,
v) the name of the representative of the custodian(s) with whom the individual may discuss the terms of their consent as well as the accuracy of the information being held,
vi) the legislated (and limited) circumstances that might require the custodian(s) to release some limited information in the broader public interest - for example health conditions that might affect the individual's capacity to drive a motor vehicle.
b) Custodians of personal health information must be required to keep a record of all disclosures of a person's health information, identifying when, to whom and why disclosure was made. This record must be available to the individual, his or her trustee and the Commissioner of Information and Privacy.
c) Where individual consent is provided for information to be used for epidemiological or other public research, the legislation must require absolute confidentiality, that no electronic cross-linking could reveal the identity of the individual.
VI) Limitation on Minister and Ministry Actions
a) The power of the Minister and Ministry of Health and Long Term Care or other Government officials to access the personal health information of an individual by direction must be clearly limited by the legislation.
b) The power of the Minister and Ministry of Health and Long Term Care or other Government officials to violate the security of an individual's right to privacy and right to deny disclosure, through the Regulatory Process, must be restricted by this legislation . If special power is needed, the circumstances should be included in the legislation and not left to the "regulations".
c) The Minister and Ministry of Health and Long Term Care and other Government officials could appeal to the Information and Privacy Commissioner (the Commissioner) if access to specific records was deemed to be essential to the public interest. If such disclosure is deemed to be essential by the Commissioner, the Commissioner will decide how and under what conditions of anonymity the information will be provided. The individual whose records are disclosed must be informed by the Commissioner.
VII) The Role and Power of the Information and Privacy Commissioner (the Commissioner)
a) A central role must be given to the Commissioner and the resources needed to carry out that role.
b) The Commissioner must have the following roles and power necessary to carry them out:
i) a clear oversight role with yearly reports to the Legislatureon the public's experience with the legislation
ii) the right to investigate and gather information/evidence to carry out an audit or in response to a citizen's complaint
iii) the right to issue binding orders which carry the same force as those issued by a court of law.
VIII) The Charging of Fees
The rights of citizens must not only be exercisable by those who have money. We would object to any suggestion of a means test that would be used to waive the requirement for a fee to be paid.
a) The right of a citizen to access their personal records must be recognized as a right and not subject to his or her capacity to pay. (Section 47)
b) The invasion of an individual's privacy without justification ultimately affects the rights of all citizens. The imposition of a fee on a citizen wishing to lay a complaint would inevitably limit access to the process for the majority of citizens. (Section 68)
IX) Person Health Information and Employment
The legislation should prohibit employers from asking for consent to access the health information of potential employees. This is clearly an abuse of power. The employer has the right to ask if there is an impediment to the applicant's capacity to carry out the responsibilities of the job being applied for.
X) Electronic Linking of Health and Other Information - Smart Cards
We do not believe that personal health information should be electronically linked to a "Smart Card" carrying other personal information such as a driver's license or an employment record. The potential for serious abuse or misuse is all too apparent. We have yet to see evidence that a "Smart Card" is a smart card from the perspective of the individual and his or her right to privacy.
4. Conclusion
We urge you to continue with the legislation but to make significant changes such as we have outlined. We desperately need protection of health information now. We are all well aware of the abuses that are taking place now in the exchange of very personal and confidential information without the informed and freely given consent of the individuals concerned. Please bring in a good Act that will in fact "protect" the right to privacy of the individual rather than breaking that right as the current Bill 159 does.