Health Sector and Privacy

October 6, 2000

Health Privacy Consultation
Ministry of Health and Long-Term Care
8^th Floor, Hepburn Block, 80 Grosvenor Street
Queen's Park, Toronto, Ontario, M7A 1R3

Dear Ms. Witmer:

Re:   Proposed Personal Health Information
Privacy Legislation for the Health Sector

I wish to thank you for, once again, involving the Psychiatric Patient Advocate Office (PPAO) in your consultation process for this very significant piece of legislation.

The PPAO had participated in an earlier consultation on this significant piece of legislation in February 1998.   At that time, we had had the opportunity to express our general concerns on the draft legislation primarily from the perspective of psychiatric patients' rights. Attached are our comments with respect to the latest consultation document.

We are an advocacy and rights protection program. While we are an internal program of the Ministry of Health and Long-Term Care, we enjoy a quasi-independent relationship with the Ministry to speak freely to the rights and entitlements of psychiatric patients. So, please view our comments in that context.

Once again, thank you for the opportunity to participate.

Sincerely,


______________________
Vahe Kehyayan
Director

Submission to the Ministry of Health and Long-Term Care regarding the Proposed "Personal Health Information Privacy Legislation for the Health Sector" (Health Sector Privacy Rules)

October 6, 2000

Summary of Recommendations

• It is important that the proposed consent rules for research use and disclosure of health records strike the appropriate balance between the privacy interest of individuals and the public interest in health research.
• The PPAO recommends that a research ethics review body review all research proposals involving the use or disclosure of personal health records.
• The PPAO recommends that all unanticipated uses and disclosures of health information made without the consent of the individual must be documented by the health information custodian.
• The PPAO recommends that the Ministry make explicit in the regulations a fee schedule which sets reasonable charges and which takes into account financial hardship and circumstances where copying fees could be waived entirely.
• The PPAO recommends that these fees be consistent throughout all health information custodians. Presently there are no fees, other than copying fees in most circumstances for psychiatric clients. We believe that there should not be additional fees.
• The PPAO recommends that independent rights advice be available to all individuals and that an independent provincial oversight body be available to adjudicate complaints.
• The PPAO recommends that the oversight body provide funding to the individual so that they could appear at the hearing.
• The PPAO recommends that when personal health information is moved outside the control of custodians the regulations must protect the information sufficiently.
• The PPAO recommends standardizing the format by which corrections to the record will be made.
• The PPAO recommends standardizing the format by which an individual revokes consent.
• The PPAO recommends that the current Information and Privacy Commissioner be designated to be responsible of this Act.

Submission to the Ministry of Health and Long-Term Care regarding the Proposed Personal Health Information Privacy Legislation for the Health Sector (Health Sector Privacy Rules)

Introduction
The Psychiatric Patient Advocate Office (PPAO), established in 1983, is an arms-length program of the Ministry of Health and Long-Term Care in Ontario. The purpose of the Office is to provide advocacy and rights advice services to the inpatients of Ontario's nine provincial psychiatric hospitals and at the Queen Street site of the Centre for Addiction and Mental Health. We do this through conducting client-instructed advocacy, systemic advocacy and non-instructed advocacy. We also provide information on issues related to mental health and psychiatric patient rights to the Ministry of Health, other Ministries and members of the public. The PPAO does not speak on behalf of the Ministry.

Since 1983 the PPAO has, on many occasions, commented on the impact of proposed law reform on mental health consumers. The PPAO services people with serious chronic mental illness, information contained in their clinical records often becomes an important source of evidence at Ontario Consent and Capacity Board (CCB) hearings and the Ontario Review Board (ORB). With the impact of mental health reform and health services restructuring, many services previously delivered institutionally will be provided in the community. We are concerned that the level of protection of privacy already afforded to individuals with respect to information in clinical records continues to be provided, regardless of the place where treatment is provided and the format of the record.

Patient Rights
The proposed Personal Health Information Privacy Legislation (Health Sector Privacy Rules) will replace sections of the Mental Health Act (MHA) with respect to patient access to clinical records. The current level of protection enjoyed by patients must be continued. Under the current rules this means that:

1. A patient who is competent to examine his or her clinical record has the right to request to examine or copy the record (Section 36(1) MHA;
2. That doctors have the authority to determine whether patients are competent to examine or disclose their clinical record. "Mentally competent" means having the ability to understand the subject-matter in respect of which consent is requested and able to appreciate the consequences of giving or withholding consent (Section 1(1) MHA;
3. A competent patient has the right to examine and copy the clinical record unless the Consent and Capacity Board has made an order withholding all or part of that record (Section 36 MHA);
4. The officer in charge of the psychiatric facility may apply to the CCB to withhold all or part of the patient's clinical record. The patient has the right to receive a notice in writing of this application and the reason for it (Section 36(5) MHA); to make submissions to the CCB before it makes its decision (Section 36(7) MHA); and to ask that the CCB hear the patient's submissions in the absence of the physician (Section 36(9) MHA).
5. If a patient is allowed to examine or copy the clinical record, the patient has the right to: request correction of information where the patient believes there is an error or omission in it, to attach a statement of disagreement, and to require that the facility send a notice of amendment or the statement of disagreement to any one who has received a copy of the record within one year before the amendment or disagreement (Section 36(13) MHA);
6. If a patient is determined by a physician to be incompetent to examine or copy his/her clinical record or to consent to its disclosure to another person, the patient has the right to receive a notice of the physician's determination (Section 38(4) MHA), to apply to the CCB for a hearing to review the physician's determination (Section 36(14) MHA), to receive rights advice from a designated rights adviser who will promptly meet with the patient to provide rights advice (Section 38(4) MHA) and to receive assistance from the rights adviser in making an application to the CCB and in obtaining legal counsel (Section 38(9) MHA).

In addition to the above, the patient has the right to appoint a representative to access the clinical record:

• Within 48 hours of admission to a psychiatric facility, a patient has the right to be notified in writing of the right to appoint a representative who would make decisions for the patient regarding access to clinical records in the event that the patient is determined incompetent to make decisions regarding access to his clinical record (Section 36.1(4) MHA).
• A patient has the right to make or revoke such an appointment if the patient is over the age of sixteen years and is mentally competent to do so (Section 36.1(1) MHA).
• If a physician determines that a patient is not mentally competent to appoint a representative, the patient has the right to be notified by the physician of the right to apply to the Board for the appointment of a representative. The patient has the right to receive a form setting out the powers and responsibilities of the representative (Section 36.2(2) MHA).
• A patient who is at least 16 years of age and is not competent to appoint a representative has the right to apply to the Board to make the appointment (Section 36.2(1) MHA).
• If the Board proposed to appoint a person not named in the patient's application, the person will not be appointed unless the patient approves (Section 36.2(5) MHA).
• A patient has the right to approve any conditions or restrictions which the Board wishes to include in the order appointing the representative (Section 36.2(6) MHA).

We believe these rights must be extended to the Proposed Personal Health Information Privacy Legislation for the Health Sector (Health Sector Privacy Rules). 

Research
It is important that the proposed consent rules for research use and disclosure of health records strike the appropriate balance between the privacy interest of individuals and the public interest in health research. However, it is important to note that the information belongs to the individual and as such any disclosure should be with the consent of the individual only. The individual should always maintain control over the use of their personal information and retain the right to deny disclosure, if they choose. The consultation document notes that the consent of individuals would have to be obtained before their health records could be used or disclosed for a research project, except where obtaining such consent would be impractical or where it would compromise research results. Even in these circumstances the PPAO believes that individuals should still maintain the right of refusal for disclosure of their personal health information.

The PPAO also recommends that a research ethics review body review all research proposals involving the use or disclosure of personal health records. Where consent has not been given then it is essential that at the very least, information identifying the subject should be removed. It is also essential that those who conduct research involving health information and with human subject be educated with respect to this legislation and the implications on their research methodology.

Unanticipated Disclosures
The PPAO recommends that all unanticipated uses and disclosures of health information made without the consent of the individual must be documented by the health information custodian. In addition to this documentation, the PPAO believes that to reinforce accountability mechanisms it is important that there be mandatory reporting of these unanticipated disclosures and reasons to the affected individual, after the fact. Individuals should at that time be advised of the recourse available to them, be advised of internal and external complaint resolution processes and be advised by the custodian of measures that will be taken to avoid other unanticipated disclosures. Documentation of the unanticipated disclosure should be noted in the record as should the contact described above, the corrective measures to be taken and how the information will be safeguarded in the future.

The health information custodian must have an obligation to be open about their information management practices and that would include having written information available to individuals about uses and disclosures of personal health information that they anticipate making under the legislation. The legislation must ensure that, in all circumstances, the individual is informed when their personal health information is disclosed, to whom and for what reason.

The individual must be informed in advance of all anticipated disclosures and consent obtained prior to disclosure taking place. When an individual is deemed to be incapable to disclose their record then the consent of the Substitute Decision Maker must be obtained prior to disclosure.

The PPAO is concerned about the cost of photocopying charged by institutions and sole practitioners as some charge prohibitive fees for copying the individual's record. These fees often act as a barrier to access for those on fixed or limited incomes. The PPAO recommends that the Ministry make explicit in the Regulations a fee schedule which sets reasonable charges and which takes into account financial hardship and circumstances where copying fees could be waived entirely. When individuals simply want to look at or read their record an administration fee should never be charged by the custodian of the health information. All reasonable efforts should be made to keep the cost of accessing ones records to a minimum so as not to create barriers to access.

The PPAO recommends that these fees be consistent throughout all health information custodians. Presently there are no fees, other than copying fees in most circumstances for psychiatric clients. We believe that there should not be additional fees.

Patients' right to block disclosure for health care purposes
Under the 1997 draft Act the concept of a "lock box" was introduced and an individual would have had a statutory right to block the transfer of any part of their personal health information to other health care providers. The current consultation document expresses concern that "locking" information could create a dangerous and in certain circumstances potentially life threatening situation for that individual. Currently it is suggested that health care providers would have the responsibility to protect individuals' health information, follow the legislated health sector privacy rules, and use their professional judgment in ensuring that personal health information is used and shared appropriately.

The PPAO supports the concept of inclusion of a "lock box" in which the individual could make the decision as to the information that should be "locked". The inclusion of a "lock box" would need to strike a balance between the individual's right for privacy, his/her own safety, and public interests. In emergency or life threatening situations the lock box could be opened but the health records custodian would be required to notify the individual of this immediately. In situations where the "lock box" was to be opened, and if time permitted, the individual would be notified in advance and if they objected to the "lock box" being opened then they could apply for a hearing before an independent body. At the point of creating the "lock box" the individual would need to be advised that in certain situations the "lock box" could be opened, with a Court Order, in other legal proceedings, in emergency or life threatening situations or pursuant to other legislative requirements.

Access to Records
Current legislation defines for the individual the process for accessing records. Once the individual has applied to access their record using the prescribed form the hospital must respond to that request within seven days. If access is denied, a hearing is held before the Consent and Capacity Board within the next seven day period and the individual is party to the proceedings. The individual may have legal representation for this hearing or may choose to represent themselves. These timelines ensure that the individual can have their matter heard without unreasonable delays and a decision rendered within a reasonable period of time.

The consultation document states that when a custodian receives a request for access to an individual's personal health record that they are expected to respond within 30 days and that extensions could be provided under certain circumstances. The PPAO believes that these timeframes are too generous and will unduly delay an individual's right of appeal if access is denied. A more timely and accountable process would benefit the individual in accessing their own personal health information. The PPAO would support the timelines that are currently available to individuals under the Mental Health Act.

When an individual is found incapable with respect to personal health information they may disagree with the finding that they are incapable to decide about disclosure. Currently a rights adviser meets with the individual and provides them with information about their rights and the option of challenging this decision before the Consent and Capacity Board. In all such situations the PPAO believes that the individual should be entitled to rights advice which is independent from the service provider. Under the proposed legislation this process should be enshrined to protect the rights of the individual.

The PPAO recommends that independent rights advice be available to all individuals and that an independent provincial oversight body be available to adjudicate complaints. This might include expanding the jurisdiction of the Consent and Capacity Board to deal with these matters. However, if the hearing is not held in the individual's home community, the PPAO recommends that the oversight body provide funding to the individual so that they could appear at the hearing.

Withdrawal of Consent
The proposed legislation must strongly reinforce that a capable individual always maintains the right to withdraw their consent to disclosure. The regulations should formalize this process as to protect the rights of individuals who withdraw their consent. When someone is incapable to consent to disclosure of their record, the same protections should be extended to the Substitute Decision Maker. An approved form would formalize this process and ensure that the rules and procedures were consistent across all locations.

Requesting Corrections to Personal Health Records
In cases where the individual believes that their personal health record contains an error or omission the individual must be able to request that the correction be made. The custodian must have a duty to either amend the information as requested, or attach a statement of disagreement to the record setting out the requested amendment and indicating that the custodian has not made the amendment. The regulations should prescribe the format for such corrections, define where this information will be held and require the custodian to notify the persons to whom the custodian had disclosed the information to during the previous year. The PPAO recommends standardizing the format by which corrections will be made.

The regulations must clearly define the length of time that a custodian is required to keep personal health information records and when an institution or sole practitioner closes their practice that there be carriage of the files and safe storage of the records for a specified period of time. This is particularly relevant for provincial psychiatric hospitals as they are divested. Individuals need to be reassured that their records will be maintained in a safe, secure and confidential place.

The PPAO recommends that when personal health information is moved outside the control of custodians the regulations must protect the information sufficiently. An accountability mechanism must exist to keep track of the information as it changes hands, who has current responsibility for the information and who tracks the whereabouts of the information at all times. This accountability mechanism must also apply when records are stored and transferred electronically.

What would happen if a person had a complaint?
The PPAO recommends that the current Information and Privacy Commissioner be designated to be responsible of this Act. The Information and Privacy Commissioner has the infrastructure and expertise to administer the Act. It would be consistent with the Government's initiative to streamline service delivery and to reduce cost. It would also be less confusing to the public to have a single point of access for all privacy information, complaints and violations.

To ensure the effective implementation of the Act, public education needs to occur so that the public is aware of the Act, their rights and have knowledge of the complaints process. Health information custodians require education about the Act to ensure that they are in compliance with the law and have the opportunity to establish internal complaint processes that would be available to individuals. The public needs to be advised of the recourse available to them should their privacy rights be violated.

In order for the complaint process to work effectively there must be stringent timelines defined in the Regulations for complaint investigation, definition of parties to the proceedings and decision making. Any process that is too lengthy or bureaucratic becomes a barrier and may result in individuals feeling that to make a complaint is pointless. Barriers to access such as language, understanding of the process, knowledge of the law and the recourse available to them needs to be addressed by the Commissioner. In order to address barriers to access, a single point of access requires the establishment of a toll free number, an appropriate number of staff to respond to inquiries and complaints and the ability to respond to individuals in their first language. Information about the privacy legislation must be distributed in various languages, by all health information custodians and in plain language. The service must also be designed to respond to the special needs of individuals including those with physical or mental disabilities.

Responsibilities of Health Information Custodians
The oversight body should determine a method for distributing and sharing best practices which are developed by custodians and which would benefit all Ontarians. As the implementation of the legislation evolves there may be unique circumstances or exceptional situations in which a custodian has to develop very specialized policies, practices or procedures. The sharing of this information would be a direct benefit to all custodians and could be a way to develop continuous quality improvement practices and standards.

Enforcement
In order for the public to have confidence in this legislation and to know that their personal health information is secure, there must be sanctions in the law which are realistic and enforceable. Individuals must be educated on the recourse available to them should a custodian commit an offence under this act and disclose information in violation of this Act. Individuals must be aware of the appeals process and have access to the oversight body that is able to assist them in obtaining information on if their rights have been violated and in resolving their complaint. Minimum penalties that are too excessive often are difficult to enforce and may deter individuals from pursuing their complaint for fear that conviction would be impossible because the burden of proof on them is too great. It might be more appropriate to have a range of penalties given the nature, severity and impact of the offence on the affected party.

Once the proposed Ontario Privacy Act is ready, it is expected that the health sector rules will be incorporated into the Act as a separate schedule. The PPAO is concerned that this may lessen the significance or enforcement of these rules.

< BackBack to Top