Personal Health Information Privacy Act
Submission To The Standing Committee On General Government Regarding The Personal Health Information Bill - The Psychiatric Patient Advocate Office
Introduction
We would like to thank the Committee for its invitation to further consult on the proposed Personal Health Information Bill. The Psychiatric Patient Advocate Office is a quasi-independent program of the Ministry of Health and Long - Term Care created, in part, to advocate on behalf of individuals with serious mental illness.
We are here before the Committee to raise concerns with the proposed Bill from the perspective of our clients. Although some of the issues raised by our office will echo those of other involved parties, we hope to provide this Committee with insight into some of the specific areas of concern for psychiatric patients.
The PPAO strongly supports this government's recognition of the need for clear, effective legislation that will protect the personal health information of Ontarians. We also recognize the challenges in creating legislation that enhances healthcare delivery while ensuring that individual privacy is protected.
We support the decision to incorporate an impartial over-sight body to ensure compliance with the law and to resolve disputes. The selection of the Privacy Commissioner to fulfill this role allows a single point of contact for individuals seeking adjudication of complaints and will allow a single body to review the implementation, application and compliance with the law.
In addition, we are pleased that the Bill incorporates the concept of "consent" from the Health Care Consent Act. The definition of consent, located at section 21, requires that a valid consent be specific, informed, voluntary, and not obtained through misrepresentation or fraud. These elements have a profound impact on the balance of the Bill, setting a high standard for an individual's choice in the process. That high standard must be maintained in each provision of the Bill and remembered when drafting all exclusions to that basic principle.
We believe that further amendments are necessary to strengthen the Bill's ability to protect private health information and enhance public confidence in the integrity of the health care system and health information custodians. Our submission will address three substantial portions of the proposed legislation: (1) the erosion of consent-based disclosure; (2) the decreased access to one's own personal health information; and (3)the insufficient enforcement mechanisms.
I. Erosion Of Consent Based-Disclosure
A. Broad Exceptions to Privacy
The Bill grants broad powers to the Minister of Health and Long - Term Care to obtain and disclose personal health information. Subection 30(5), for example, allows disclosure by the Minister for the purposes of managing the healthcare system. This clause exemplifies the excessively broad drafting of exceptions to basic privacy protections. It is unclear what types of services would be included in the phrase "for the purpose of the management of the health system", it is unclear what type of programs would be granted access through the Regulations.
Section 30 of the Bill provides a number of such broad, undefined exceptions to individual privacy rights. Although the general provisions contained in section 12 indicate that only the minimum amount of information that is necessary for the purpose intended shall be disclosed, it is not clear, on the surface of the Bill, how these protections will mesh with the balance of the legislation. It is not clear from the wording, for example, that directed disclosures must be anonymized; it is also not clear what situations would involve disclosing identifiable information.
Similar to the Minister's powers, under Section 29, a health information custodian can disclose information to a hospital or physician, for example, for the purposes of providing health care without the consent of an individual. Presumably, the section was included to facilitate the treatment of those in medical distress and to allow physicians full access to patient histories. There are obvious benefits to the health care system in permitting such disclosures. However, this section fails to recognize individual choice in the disclosure of information. The imprecision of the section allows treatment providers access to information that may be entirely irrelevant to a person's current treatment needs. It is up to each person what information he or she is comfortable sharing with a physician.
To take away the control from the individual may affect the willingness of individuals to seek treatment in some circumstances for fear that information regarding testing and treatment will be shared. It may compromise the relationship between doctor and patient if information is not held confidential. This is an unacceptable result. This exception to consent-based disclosure is based on a "best-interest" model of disclosure rather than individual determination. The concept is paternalistic and represents a step back for health care in a modern society.
B. Negative-Option Consent
In addition to the powers of the Minister and health information custodians to access and disclose information, the Bill outlines a number of areas in which an individual's failure to specifically request non-disclosure will be deemed sufficient consent.
For example, Paragraph 30(1)(c) allows a health information custodian to disclose information for health screening programs unless the individual, or his or her substitute, specifically requests that the information not be disclosed. Similarly, subsection 29 of the Bill allows facilities to disclose the fact that an individual is a patient or in residence at the facility and the individual's general health status. This information can be disclosed unless it is contrary to that individual's express request not to disclose that information.
Such "opt-out" clauses do not satisfy the elements of consent as outlined in section 21. Many of the PPAO's clients may be acutely ill and even if they become aware of the negative-option consent provisions may be unable to specifically express refusal. Further, as a result of their illness, they may not be able to understand the consequences or ramifications of consent.
It is unreasonable to place the onus on an individual to initiate discussions and then express his or her feelings regarding disclosure of information. Such negative option clauses directly conflict with the Bill's own recognition of the elements of consent and fail to provide adequate protection.
C. Recommendations
i. Emphasis on Consent-Based Disclosure
The PPAO recommends that the very structure of the Bill be revisited with a consistent emphasis on consent-based disclosure. We recommend that the legislation require a positive act of consent prior to disclosures of any nature.
The PPAO recommends that all exceptions to consent-based disclosure be carefully articulated in the Bill, the purposes of the exceptions be specifically defined and that the Bill itself outline the permitted recipients of information. We would support the suggestion that all exceptions be narrowly drafted and specifically exempted through the use of a "notwithstanding" clause from the consent provisions in section 21 and the general protections of section 12.
ii. Lock-Box
The PPAO supports and encourages the use of a "lock-box" system, a system that allows an individual the statutory right to block the transfer of any part of his or her personal health information to other health care providers and other related service providers. Such a mechanism resolves some of the concerns outlined above regarding disclosures not based on consent.
Various parties have raised concerns that doctors would not be able to appropriately treat individuals without access to medical histories. Doctors have indicated that patients are unable to determine information that may be relevant to treatment. Such concerns, again, rely on a "best interest" model of health care and subvert individual choice. An individual has the right not to share information regarding his or her medical history whether or not that information may assist in treatment.
The "lock-box" would permit individual control of information while allowing its release for specific circumstances, striking a balance between privacy rights, safety and public interest. In the case of emergencies, where consent was impossible as defined by the Health Care Consent Act, the "lock-box" could be tapped by physicians requiring information; however, the disclosure would be documented and reported. In the case of a dispute between the individual and the health care provider or another party, the Privacy Commissioner could resolve disputes.
iii. Consent Forms
The PPAO recommends that forms consenting to the disclosure of information be standardized, as is done in the Mental Health Act. The consent forms must make clear the extent of the information being released by the individuals, the purposes for which the information is being released, any limits or conditions on the disclosure and an expiry date for the release. The statute must incorporate a default expiry in the event that a date is not specified to ensure that disclosure is not indefinite. Currently, no Ontario legislation provides this level of protection.
The proposed legislation must strongly reinforce that a capable individual always maintains the right to withdraw their consent to disclosure. An approved form would formalize this process and ensure that the rules and procedures were consistent across all locations.
II. Decreased Access to One's Own Information
Fundamental to any privacy information legislation is reasonable access to one's own information. The proposed privacy legislation will replace sections of the Mental Health Act ("MHA") with respect to patient access to his/her own clinical records. The current level of protection enjoyed by patients must be continued. That is, under the current MHA, the following protections are provided:
- A patient who is competent to examine his or her clinical record has the right to request to examine or copy the record (Section 36(1) MHA;
- Doctors have the authority to determine whether patients are mentally competent to examine or disclose their clinical record. "Mentally competent" means having the ability to understand the subject-matter in respect of which consent is requested and able to appreciate the consequences of giving or withholding consent (Section 1(1) MHA;
- A competent patient has the right to examine and copy the clinical record unless the Consent and Capacity Board ("CCB") has made an order withholding all or part of that record (Section 36 MHA);
- The officer in charge of the psychiatric facility may apply to the CCB within 7 days to withhold all or part of the patient's clinical record. The patient has the right to receive written notice of this application and reasons (Section 36(5) MHA); to make submissions to the CCB (Section 36(7) MHA); and to ask that the CCB hear the patient's submissions in the absence of the physician (Section 36(9) MHA).
- If a patient is allowed to examine or copy the clinical record, the patient has the right to: request correction of information where the patient believes there is an error or omission in it, to attach a statement of disagreement, and to require that the facility send a notice of amendment or the statement of disagreement to any one who has received a copy of the record within one year before the amendment or disagreement (Section 36(13) MHA); and
- If a patient is determined by a physician to be incompetent to examine or copy his/her clinical record or to consent to its disclosure to another person, the patient has the right to receive a notice of the physician's determination (Section 38(4) MHA); to apply to the CCB for a hearing to review the physician's determination (Section 36(14) MHA); to receive rights advice from a designated rights adviser who will promptly meet with the patient to provide rights advice (Section 38(4) MHA) and to receive assistance from the rights adviser in making an application to the CCB and in obtaining legal counsel (Section 38(9) MHA).
Recommendations
i. Reasonable Time-Frames
Unlike the seven day period granted to the Officer in Charge of a psychiatric facility to answer an individual's request for access to his/her medical record, the current provisions in this Bill allow a health care custodian thirty days to respond to requests. Thirty days is an arbitrary figure and unreasonable in length potentially delaying an individual's right to appeal in the event that access is ultimately refused. The period of time is further exacerbated by the option for the custodian to delay a response for successive thirty day periods at his/her own discretion. A more timely and accountable process must be available to ensure the delay does not act as a barrier to access. The PPAO supports the timelines that are currently available to individuals under the Mental Health Act.
Failing such a change, an individual must have a right to appeal to the Privacy Commissioner should access not be provided within a reasonable period. The health information custodian is not an impartial body in determining the right to access information. Under section 47, the health information custodian need only provide notice to the individual if he/she intends to extend the timeframe to access records, he/she need not justify the delay to the individual nor to an independent over-sight body. The Bill currently does not provide access to the Privacy Commissioner in the event that a health care custodian unreasonably delays access. The PPAO supports an appeal process able to review unreasonable delays; however, the PPAO prefers the access model prescribed under the Mental Health Act.
The proposed legislation provides for a number of situations in which a health information custodian can refuse access to an individual's file. Under the Mental Health Act, no person or institution has the authority to withhold an individual's health information unless the Consent and Capacity Board has specifically ordered it withheld. Before such an order can be made, there must be a demonstrable safety risk to the individual or another person. There is no compelling reason why this Bill should not mirror these provisions of the Mental Health Act. The PPAO recommends restricting the number of situations in which access to one's own file to reflect the current MHA provisions.
When an individual is found mentally incompetent with respect to personal health information he or she may disagree with the finding that they are incapable with respect to disclosure. Currently, under the Mental Health Act, a rights adviser meets with the individual and provides them with information about their rights and the option of challenging this decision before the Consent and Capacity Board. The PPAO recommends that any person who is denied access to his or her own health information be given independent rights advice.
The PPAO further recommends that the Consent and Capacity Board be given jurisdiction to review complaints under this section as the Board has particular expertise in the area of competency.
The right to examine one's records may be further complicated by the potential to levy fees for access. Unless provided for in the regulations, fees may be unlimited. The cost of fees may be preventative for our seriously mentally ill clients as many of them are indigent and receive social assistance, thus denying them access to their records. In addition to costs that may be charged to simply view the record, costs may be charged to copy that record. The PPAO recommends that no new fees be instituted to view a record and only expenses be charged for photocopying material. We also recommend a means of reducing or waiving fees, in accordance with a financial means test, where the cost acts as a barrier to access.
III. ENFORCEMENT MECHANISMS
The incorporation of the Privacy Commission as over-sight body represents a significant improvement to the enforcement structure of the Bill; however, the change stops short of providing the Commissioner's office with sufficient powers to ensure compliance with the legislation.
In order for the public to have confidence in this legislation and to know that their personal health information is secure, there must be sanctions in the law which are realistic and enforceable. Clear redress must be available in situations where non-compliance with the law leads to illegal disclosures.
Recommendations
The PPAO recommends that the Commissioner be given clear and full authority to conduct independent audits of the policies and procedures of all health information custodians. Power must be granted to allow full investigation of complaints. Finally, to be effective, the Commissioner must have the power to enforce decisions and to compel compliance with the legislation.
The PPAO recommends wide based education to further promote compliance. Education programs will assist all people affected by the legislation, including health information custodians, health care workers, government and the general public, obtain and understand their rights and responsibilities under the Bill. In order to ensure effective enforcement procedures, individuals must know their rights and know how to access the Privacy Commissioner to register complaints.
IV. Conclusion
The PPAO supports some of the steps taken to date with this proposed legislation. Legislation of this nature is long overdue and the momentum behind this Bill is encouraging. We support attempts to strengthen this Bill, to make the changes that are necessary while ensuring that the Bill moves forward to completion.
Prior to making specific amendments to the Bill, we ask that the Committee take a step back from the individual provisions and review the proposed legislation as a whole. Section 12 outlines the guiding principles, the context against which all other parts of the Bill are read and measured. These principles must inform the balance of the provisions to ensure consistency and clarity.
Further, if the purpose of this legislation is truly to protect individual privacy values, the Bill must be revisited with a view to ensuring specific, informed and voluntary consent remains the primary condition of disclosure. The current Bill fall short of this value by allowing broad, cryptic exceptions to consent-based disclosure and negative option consent. This issue must be answered before the public, and, particularly our client base, will have any confidence that the health care system truly protects individual information.
