Protecting Personal Privacy: A First Principle for Canadian Health Infostructure

By Andrew J. Siman, Director General
Office of Health and the Information Highway, Health Canada
In Healthcare Information Management & Communications Canada, Vol. XIII, No. 4, 3rd Quarter, July 1999, pp. 12-13.

Help on accessing alternative formats, such as Portable Document Format (PDF), Microsoft Word and PowerPoint (PPT) files, can be obtained in the alternate format help section.

---

For Health Canada, protecting personal privacy should lie at the heart of efforts to build a national health infostructure composed of health information systems across Canada.

This position derives, not just from a pragmatic realization that responding to privacy concerns is critical to the success of a health information system, but also from the belief that respect for privacy is a fundamental value in Canadian society and central to the provision of health care.

As the Advisory Council on Health Infostructure stated in its February 1999 report to federal Health Minister Allan Rock, "Privacy will be a key value in the Canada Health Infoway (or infostructure). A fundamental condition for successful health care is the trust patients have that their personal health information will be protected." The Council saw privacy protection as one of its four strategic goals. A number of privacy commissioners supported the Council's approach. For example, the British Columbia Information and Privacy Commissioner wrote that, "Federal recommendations to better protect health and medical information are a positive step in the fight to protect privacy-sensitive medical information."

The privacy opportunity

Building health information systems may represent an opportunity to address outstanding privacy issues in health and to improve on the level of privacy protection now available in the paper-based health care system.

In relation to information, privacy involves the right of individuals to determine when, how and to what extent they share information about themselves with others. Health information systems have the potential, through electronic health records, to give Canadians far greater control over access to their personal health information. With paper-based records, such control has not always been possible.

On the one hand, for example, patients cannot always get access to their own paper-based health records, let alone ensure that their medical histories are available to the professionals giving them care. Most first-time patients, even after visits to hospitals, arrive at the offices of health-care professionals without medical records. Indeed, when patients move from one care setting to another, it is often difficult for them to ensure that their records follow them.

The paper-based records of most patients -- especially those from out of province -- visiting hospital emergency wards on weekends or at night are now locked away in physicians' offices, unavailable to hospital staff. The result can be not just duplicated, unnecessary, expensive and occasionally health-threatening tests, but also a greater risk of misdiagnosis and inappropriate treatment.

On the other hand, security practices, privacy standards and confidentiality obligations are inconsistent across the country and not always explicit, with the result that patients cannot always control who has access to their paper-based medical records.

With electronic health records, new privacy-enhancing technologies and improved security practices should give patients far greater control over the level of access to their medical histories by health care professionals and others than has been possible in the past. Patients themselves will have far greater access to their own health records than is the case now. Most important of all, patients, whether in their home province or not, will be able to ensure that health care professionals treating them will be able to gain access to their medical history.

The result will be more informed individuals and thus higher-quality care, not to mention less spending on duplicate tests and procedures.

The privacy challenge

Yet most observers would agree that technology alone cannot guarantee privacy protection. For many privacy advocates, the very efficiency with which the new technology collates, analyzes and communicates information is part of the problem.

And patients do have understandable concerns. There are many excellent reasons why people say in surveys that they do not want their personal health information to be made available to employers or market researchers for pharmaceutical companies.

Given these realities, anyone developing a health information system here in Canada or abroad can expect to have their work significantly set back by any incident involving violations of privacy.

To prevent such incidents, the challenge will be not only to install the best privacy-enhancing technologies, but also to ensure that everyone with access to personal health information follows the best information and security practices in their handling of it. Finally, the privacy standard to be met must have the full force of law to ensure that it will be fully respected.

Progress towards a harmonized approach

The Canadian Standards Association, the Canadian Medical Association and COACH, Canada's Health Informatics Association, have all brought forward privacy and security policies for the protection of personal information. Debate over the principles and practices enshrined in these documents should provide a solid foundation for a consensus on how to protect personal health information.

In the last year, the federal government introduced privacy legislation applicable to the private sector, and three provinces have recently passed or introduced new legislation to protect personal health information. Despite these developments, significant variations still exist in federal, provincial and territorial laws, regulations, guidelines and security standards for the protection of personal health information. These differences could render more difficult both the protection of personal health information and the information exchanges across jurisdictional boundaries which are fundamental to fully realizing the benefits of health infostructures.

Health Canada is actively working with many partners and on many fronts addressing the issue of informational privacy in health care to ensure that privacy principles are respected. The Advisory Council on Health Infostructure made recommendations for a harmonized approach to health information privacy across the country; Federal, Provincial and Territorial officials are studying this matter and discussing options for the harmonization of privacy regimes in Canada. Health Canada is committed to the development of a common approach to this issue among all major stakeholders in health care.

These collaborative efforts represent the best hope for providing improved privacy protection and secure communications while at the same time ensuring that health information systems make their fullest contribution to the health of Canadians and our health system.