 Welcome you to the Schulich School of Law at Dalhousie University. It's a great delight to get a chance to see you in person here at the school. This is a lecture that's part of our mini law series, a series that we started last year was the brainchild of one of our colleagues and our communications officer Lindsey Loomer has been instrumental in making sure that it runs effectively and so my sincere thanks to Lindsey as well as to Jordy who's going to be filming this evening's talk. You are in good hands tonight with my great colleague Elaine Gibson. She is an expert in about 14 different areas but all of them sort of meet at the nexus of tort and health law. She teaches our first year students torts and they love her dearly for it. She does a number of upper year advanced courses including an advanced negligence course. She's regularly drawn on by governments for her expertise and she has produced over the years a myriad government reports on topics related to health law. She's also spent some time in her career with our clinic and so she has a sense of law and it's direct human application but more than that I think one of the things that I like Elaine for is she's a quiet sort of fount of wisdom here at the school and if I feel like I need someone to just step back and think something through with me Elaine is always the right person for that exercise and so I'm deeply grateful for her wisdom and her ability to kind of bring that to the table in any moment when she's been asked to do so. So without more I'm sure that you'll enjoy her this evening. Thank you for coming. If you find yourself in dire need of something just to perk you up I'm sure the talk will do it but if not the talk there's also coffee please feel free to go ahead and help yourself to a cup. Thank you. Thank you Kim for the overly kind introduction. The theme of my talk tonight as you know is who the heck owns my health information and I hope that the question posed will be made clear to the extent that it can be made clear in law as the talk unfolds. I thought I would start with a few kind of attention grabbers for you and you may not have thought about all of the dimensions of this topic so I have picked out a few of them from recent press. First lawsuit seeking information on sperm donor begins in BC. So this was a case that went before the courts in the last year. It was a woman who was now an adult but when she well before she was conceived her mother had used an anonymous sperm donation through a sperm bank to bear her child. This woman is now an adult and a journalist and decided that she would bring a lawsuit claiming an entitlement to the information about her father. She argued a right to know her genetic heritage including the health information and she was successful in winning her case. Next headline tuberculosis man sorry over plane trips. Some of you may recall this one from the media. This was an American who took a plane from Atlanta Georgia to Paris in order to get married and have his honeymoon. He happened to be a lawyer and he happened to have tuberculosis a virulent form of tuberculosis. From Paris he went on to Prague and then to Montreal before returning by car to the U.S. So because it's tuberculosis it's a communicable disease. This means it's a reportable disease for the public health system and the information must be shared. This incident led to a worldwide search for people who may have sat by him or come into contact with him for other reasons on either of the transatlantic flights that he took. This is a quote from the Ottawa citizen by a woman whose sister was killed by a man and she was arguing that a DNA data bank then before the federal parliament should include provisions that would cover this man. We now have a DNA data bank. It falls under the criminal code. It contains the DNA of those convicted of certain kinds of heinous crimes. DNA you may realize is essentially health information at its heart. So it's not the physical piece of information but sorry the physical piece of tissue but the information contained within it is the value of the information. Next storing British Columbia baby's blood violates privacy a group is claiming. So this has to do with something called blood spots. This is from blood samples routinely taken in Canada from newborn babies across Canada without consent or knowledge of the mother or father and tests are done for genetic disorders and in British Columbia the practice differs across Canada but in British Columbia these blood spot cards were being kept indefinitely and the claim as you can see is that these well in fact the article reads quite inflammatory the BC civil liberties association says as many as 800,000 babies in the province have been the victims of privacy violations that began the day they were born. A functional DNA database has been created of all the infants born. Someone is quoted as saying. Next you may have followed this in the news just in the last couple of days. It's a girl could be a death sentence. A physician published an article two days ago I think it was in the Canadian Medical Association Journal claiming that there is common fetus side happening in Canada. This is where women are being tested in particular women from particular immigrant communities are being tested for the sex of sorry they're undergoing ultrasound and finding out the sex of the baby of the fetus and then having selective abortion as a result. The physician in this article argues that women should not be entitled women and I suppose the fathers as well not entitled to know the sex of the fetus until she is 30 weeks pregnant. The Society of Obstetricians and Gynecologists of Canada has responded that this is fundamentally the woman's personal health information and she has a right to that information. In other words it is there it is the woman's personal health information. So that's a smattering of recent articles that show a variety of issues kind of a broad reaching range I think involving personal health information. You may not think of them necessarily as being fundamentally about health information but there you go I've put maybe a little bit of a different lens on it. So turning to personal health information more directly then this information is seen to be worthy of the highest protection. Now by the way in one poll of Canadians do you know which kind of information we were identified as valuing most highly? Anyone? Financial that's it yeah. I would have thought in the first instance that it was health information but at least one study shows it's financial but health comes right up very close to financial information. There are varying degrees of sensitivity so something like one's ingrown toenail may not rank on the scale of anything in terms of an individual's feeling that that information is needed to be protected. On the other hand something like one's HIV status or the fact that someone has a psychiatric disorder these carry very high sensitivity in most ways. Now the sensitivity is context specific so for some people something like a piece of health information like a visual impairment would not be sensitive but for some people their jobs could depend on it. There are a number of values and tensions that I can identify you may want to add to this list as well when I thought about what came up through the little news articles that I talked about already and conceptions of information and one is an intuitive sense of privacy. So I think we all have some sense of what privacy means and I think that if I polled you about your response to each of the news items I've just taken you through I think I would get differing answers at least when I have taught privacy law I know that those students have a wide range of responses in terms of whether they feel like they have nothing to hide and everything should be open for everybody right through to a very strong sense of need for protection of information a sense that our society is out of control right now in terms of releases of information and how much information is out there about ourselves and how and what to do to protect it. Next the possibility of discrimination so this varies depending on the sensitivity of the information. Certainly there was a famous case about a teacher in Nova Scotia in the early days of HIV who lost his job as a result of his colleagues finding out that he was HIV positive. There are lots of issues of autonomy and or liberty at stake for example the man who got on the plane and flew knowing that he had tuberculosis probably had a sense of entitlement to do that. On the other hand there's the concept of the right to know not only right to know about our own health information but perhaps the right to know information about genetics. So for instance the BC case that I told you about about this woman who had a very strong drive to know her genetic background. Security there's of course the concept of the guarding of information and who keeps it safe and we'll talk a little bit more about that. Now protection of the public so this is of course in part also the man who got on the plane the whole concept of public health and sharing of information about communicable disease when society decides to step in when government decides to step in and make laws and we'll cover several of them that not only allow facilitate the sharing of information that otherwise might be thought of as confidential but at times insist on that sharing of information. And then there are equality issues throughout the area. So in the case the case from a couple of days ago the news item about the just a second about the it's a girl could be a death sentence the selective abortion of female fetuses. So there's a woman's right to know the information if the health system has access to that information on the other and so that engages equality rights but on the other hand it's only the girl fetuses that are being aborted for this reason so far as we know and so there are serious equality issues there. I'm going to speak for a moment about information privacy and confidentiality privacy is I think the more difficult of the two the two terms are very often lumped together people just speak of privacy and confidentiality in one breath but there is a difference the concept of privacy I already talked about one's intuitive sense of privacy it's there are many different sorts of definitions it's a rather elusive concept on the other hand we know that it's focused on the individual or the group that we're talking about whereas on the other hand when we're talking about confidentiality I've defined it here as a duty owed by the holder of another's information to safeguard against unauthorized disclosure so in other words it's always talking about a duty owed by one person to another or a person or group or organization to another so it's other regarding as opposed to self regarding the duty of confidentiality in ethics comes through the Hippocratic oath in ancient history that whatsoever I shall see or hear in the course of my profession if it be what should not be published abroad I will never divulge and that's a clear relatively clear I think statement now when it comes to health care providers there's an interesting little bit of reversal about confidentiality so in your day to day functioning if someone tells you something in most contexts you would assume that you could in turn pass on that information to somebody else that's how we function generally it tends to be only if they say oh and please don't tell anyone or you know this is confidential or some kind of qualifier like that that it would be considered to be confidential on the other hand throughout the world of health care providers there's a presumption when someone is seeking professional services from that person it's a reversal there's a presumption of confidentiality and so I want you to keep that in mind as we go through the various exceptions to confidentiality that you start with the cloak of confidentiality and then look to wither the circumstance fits within one of the exceptions the duty of confidentiality from the Hippocratic oath that I just outlined in ethics comes through in law as well Supreme Court of Canada in 1928 picked up on this and said nobody would dispute that a secret is the secret of the patient and normally is under his control and not that of the doctor the patient has the right to require that the secret should not be divulged and that right is absolute unless there is some paramount reason which overrides it now we spend a lot of time on those paramount reasons and a little bit on confidentiality and in fact in the case where Supreme Court of Canada said this they went on to say that confidentiality did not apply nevertheless it is the premise that we start with now going to what happens when things go wrong so I'm I identified a few news items from recently that I thought you might be interested in so one is thousands of lost Durham health records spark probe so this was a case that had to do with some flu vaccination clinics in Ontario it concerned the records of 83,000 patients that were contained on one memory stick or USB key next CBC News November 2011 lost and dumped medical records spark privacy investigation this was in BC there was one unecrypted laptop that contained the information of 450 patients the physician actually it was a researcher who lost it at the Toronto airport actually a physician researcher left it at Toronto airport lost it and reported at 10 days later also in this same news article the records of the BC Ministry of Children and Family Development were found a bunch of records were found at hard copy records were found in a dumpster behind an apartment building and getting close to home this article from Kate Bratton health authority admits to privacy breach so this had to do with the unauthorized release of the medical records of 277 patients to a pharmaceutical company for a research study without the proper authorization and approval so what happens in law how does law respond when these breaches occur we've got a number of different routes within law one is professional discipline so one can launch a complaint with the College of Physicians and Surgeons or with the College of Nurses etc the self-disciplining bodies and have it go through a procedure that is one of discipline of the individual another route is breach of fiduciary obligation so in certain circumstances physicians and other health care providers may be found to owe a professional responsibility to their patients not to release health information and it's a separate legal action that one can bring at common law there are a number of different routes negligence is one there's a an area called intrusion upon seclusion which has been questionable but I just received notice today that the Ontario Court of Appeal has acknowledged that there is a tort of intrusion upon seclusion so it's a fast-breaking world in a way when it comes to privacy and there's also a lawsuit for contractual breach if there is a contract that can be presumed and that is breached and finally in terms of the major recourses is the breach of a statutory provision and this is actually where most of privacy law is based is on statutes in other words governments have enacted a number of areas for protection of information generally the first area by the way was for protection of information that governments themselves hold and then it went on to more generally the private sector so I've listed a range of statutes that are directly applicable there are probably about 50 statutes in Nova Scotia that have provisions about confidentiality but the main one until recently has been the hospitals act and I should say until recently and including at present but we're about to have a personal health information act that will come into effect later this year there's a federal piece of legislation called the personal information protection and electronic documents act there is an act that provides provisions that protect international disclosure of our personal information in Nova Scotia there's the freedom of information and protection of privacy act for Nova Scotia and there are separate federal pieces of legislation this is government information held by public bodies that has to do with and then there's the health protection act of Nova Scotia which is the one about public health communicable disease and all that I'm not going to go into these in detail thank heavens but I am going to take you to some extent through the personal health information act of Nova Scotia the new one and before we get to that I don't know if you can see that very clearly but you probably can most of you make out the map of Canada and this is to show the development of legislation protecting personal health information in the various provinces Nova and the dates most of them I think you can see but some of them are in white unfortunately so Nova Scotia is by no means one of the first to bring in such legislation in fact the only places now that don't have coverage are little Prince Edward Island and the territories so turning to personal health information act it was passed by the legislature in December 2010 after a number of attempts the regulations are being drafted right now and it's anticipated that it'll be enforced later this year it's going to repeal the hospitals act section 71 excuse me so that piece of prominence right now is going to fade away and be repealed now who is covered by the legislation well the Department of Health and Wellness itself is covered as well as the district health authorities and IWK regulated health professionals and others by regulation so not everyone who is holding health information falls under the statute it's only those who are within the definition of regulated health professionals and those the government has chosen to regulate the body or person must have custody or control of the record or information and it includes the agents of custodians such as Medivee Blue Cross what kind of information is covered well personal it's only about personal health information and this is defined as identifying into information about an individual note with or living or deceased what is identifying information well we have a definition of that as well it's information that identifies an individual or where reasonably foreseeable in the circumstances could be utilized either alone or with other information to identify an individual so either alone or with other information so envisage there in part is the merging of databases for instance so very much of your information is contained in electronic databases and when combined with other databases it's a powerful tool for a number of purposes including health system administration including research those sorts of things and it's known that if you combine non directly identifying information a few pieces of that information then it can become identifiable so the the statute recognizes that now implicitly but worthy of note I'm talking about what kind of information is covered that means the there is a whole body of information which is non personal health information which is not covered I'm going to touch on some significant aspects of the statute itself just so that you have some grounding in it and then I'll talk in more general terms not about this statute but in generally about the protections in law and the circumstances for disclosure of information and touching on ownership so the personal health information act contains rules for the collection use and disclosure of information but also its retention its disposal and its destruction for the collection use or disclosure of information it's necessary to identify the purpose and one is confined to that purpose and one is only entitled to collect information that is legitimately required for the stated purpose consent is needed for the collection use and disclosure of information but it's subject to a range of exceptions some significant exceptions are within the circle of care and this is a concept that has developed not it's not directly named in statute but the concept of circle of care is to encapsulate the sharing of information for the receipt of health services and so that's thought of as the circle of care those who need the information in order to provide care to an individual the concept of knowledgeable implied consent it's further defined and we can talk about that in discussion if you would like to but the idea is that it's not necessary within the circle of care to get a patient's consent at every instance when for instance a bill is being submitted to Blue Cross or something as long as you can assume that the patient is consenting in that circumstance and as long as it's for the circle of care or provision of care or submission of bills for that purpose then knowledgeable implied consent suffices each each custodian must provide proper security for the information and an overseer is required in other words someone who is responsible for privacy within the organization an individual is entitled to know what information is being held by the custodian and also to request its correction and a complaint about a breach of the personal health information act is to the privacy review officer now I'm going to talk more generally about consensual releases in law followed by the non consensual circumstances for release these are the topics I'll be covering the patient right of access other health care providers surrogate decision maker and other third parties so when it comes to the patient right of access this is kind of the core of the question that I worked into the title of my talk I was kind of playing on words about a little bit in saying who owns my health information implicit in the my is that we think that it's our information but there are questions about who actually could claim to own the information there was a case that went before Supreme Court of Canada in 1992 it's called McInerney and McDonald and this case came out of New Brunswick a woman was seeing a new physician and she the physician changed her prescription she suggested she go off thyroid medication and the woman was interested then Mrs. McDonald was interested in seeing the rest of her personal health information because she was wondering why a previous physician had put her on this medication and so Dr. McInerney said well I will give you access to the health records that I have produced and the tests that I have ordered on your behalf but I can't give you the information from previous health care providers you'll have to go to each of them and seek the information from them case went to Supreme Court of Canada and Supreme Court of Canada said fundamentally this is Mrs. McDonald's own information so there's a confirmation in there that fundamentally it is our own information on the other hand they use vague terms in saying they won't reify it to a property interest so the ownership is left a little bit questionable they also indicated that the institution or physician owns the physical health records and there's some sense to that because there's an obligation on health care providers to keep records it's not like they could just hand them right back over to a patient if a patient wanted but therefore the court found a patient is entitled to access to their information there's one exception laid out in the judgment and that is where there's a significant risk of harm to the health of the patient or of a third party so the question posed in the title to my talk is left a little bit unclear but with hopefully a little bit more clarity than we started out with consensual release to other health care providers it's based again on the concept knowledgeable implied consent for therapeutic purposes within the circle of care if there's any ambiguity or doubt then it would be appropriate for a health care provider to get actual consent and in certain circumstances actual consent is the best practice anyway even if the law doesn't set that as the standard now where there is a person who is incapacitated the surrogate decision maker and there's a ranking laid out in terms of who becomes the surrogate decision maker who has the entitlement they step into the shoes of the patient for all purposes that we're talking about here in terms of their ability to make decisions about release of information there is consensual release is permitted to other third parties this is with the consent of the patient or of their surrogate and preferably it is obtained in writing now we're getting to the tougher area really I think and that is we've covered the consensual release circumstances but there are various provisions either permitted or insisted upon in law for the non consensual release where the patient is refusing and I'm going to talk first about the provisions that provide for non consensual release for the sake of the patient him or herself and then talk about where it's for the sake of others that information is to be released emergency circumstances so this would apply where a patient is unable due to infirmity to decide whether the information can and should be released and there's a danger to their health or safety if the information flow is delayed in the circumstances it's only permitted however if there is no advance directive refusing the information flow and where there's no substitute decision maker refusing the information flow and this principle comes out of a case out of Ontario called mallet versus shulman it was in a different context it was not to do with release of information per se but to do with it was a woman who went into hospital unconscious she was brought by ambulance following a serious car accident and she had a card in her wallet saying Jehovah's Witness I refuse blood transfusion under all circumstances for religious reasons and it went on to say that she understood the implications etc the physician provided blood transfusions regardless because he felt that her that that she would die if she didn't have the transfusions and he had other justifications as well about not knowing whether she might have changed her mind if she had known the Ontario court of appeal made a very strong statement of right of the individual to make decisions about their own health care and that even if their life or health is at stake we fundamentally have the autonomy to make those decisions and so the same principles apply to the release of information if there's an advance directive that refuses the sharing of information then it must be respected now there is an an adult protection act there are different adult protection acts in every jurisdiction in Canada ours says that the act is to provide a means whereby adults who lack the ability to care and fend adequately for themselves can be protected from abuse and neglect and so it goes on to say that every person who has information whether or not it is confidential or privileged and privilege is something we haven't talked about yet but this is in particular reference to lawyer client privilege and the usual sacrosanctis the usual absolute privacy that pertains to that information that is shared between a client and a lawyer but here's a provision that says we're setting aside privilege in this circumstance if someone has information that an adult is in need of protection and then it speaks in mandatory terms it says shall report that information to the minister so it's an obligation on every person to report it defines adult as a person who is or is apparently 16 years of age or older and then there's a quite involved definition of who constitutes an adult in need of protection now what about if the disclosure of information is in the best interest of the patient or individual the answer is no so this applies even if harm or death will result it's not appropriate for a health care provider to report to others for instance that a person is apparently suicidal there is an exception to that and that is the probe if the person falls within or appears to fall within the provisions of the involuntary psychiatric treatment act in order to fall within those provisions one must be suffering from a mental disorder and threatening or attempting to cause serious harm to self or others or likely to suffer serious physical impairment or serious mental deterioration if left unattended likewise the and furthermore the person has to lack the capacity to make admission and treatment decisions so those were the areas for non consensual release believed to be in the best interests of the patient now we're going on to non consensual release that is in others interest in other words one can assume primarily against the interest of the individual and the first is child abuse so our society has made a major exception to the general rule of confidentiality of personal health information when in order to facilitate the protection of children and this first provision says that every person who has information again it's setting aside confidentiality and or privilege indicating that a child is in need of protective services shall forthwith report that information to the agency so we see some mandatory language in there now what is it to be in need of protective services well there's a a list about the person's either suffering or being at risk of suffering from abuse sexual abuse neglect failure to provide needed medical services so this is where the provisions kick in actually to do with parents who are refusing medical services for their children emotional harm or engaged in criminal activities now the standard is higher for professionals so every person who performs professional or official duties with respect to a child and it goes on to include healthcare professionals um if they come across information in the course of their professional duty if they have reasonable grounds to suspect so i'm going to if i can take you back um two slides the this one said every person who has information indicating that a child is in need of protective services shall report in this case it's on the basis of reasonable grounds to suspect so it's a lower standard in other words a lesser amount of information uh on the part of a professional gives rise to a duty to forthwith report the suspicion and the information upon which it is based to the agency so big exception for child protection prevention of harm to others so there's an obligation developing in law and ethics and you'll find um similar language within the new personal health information act on this um so far the courts have said may so they're not using the mandatory language of shall that you saw in the legislation we looked at just now um but that a an individual may disclose information that is otherwise confidential and or privileged because in the main canadian cases came out of it was actually um solicitor client privilege context um the information may be disclosed without consent if you have all of these elements present the threat of serious bodily harm or death and it has to be to a third party or a defined group so it's not to oneself um the threat must be imminent um and the person must have a reasonable belief that that threat will materialize into harm uh the circumstance where it um came in the canadian well in the american context um the case of tarasoff was of a man who reported to his psychologist that he had a detailed plan to kill his former girlfriend he was um upset with her for having left him and he outlined a detailed plan and it was found to give rise to in that case a reporting obligation the canadian case involved a person who had had been convicted of a crime and a psychologist was examining him for purposes of um assessing i believe it was a probation report at the time and uh during the course of their discussion the person report the um prisoner reported a detailed plan uh to kill a number of prostitutes in the vancouver area and he outlines um in as I say quite some detail with specifics how he was going to do it and um so this judgment came out of that case uh and it's developing in law and ethics because we're not it in a way it's not as helpful perhaps to healthcare professionals to say you may disclose this information because it puts the onus back onto the health professional to decide whether the circumstances are right for reporting um now there's release for legal proceedings and um the the so if a subpoena is issued for the release of information in a circumstance where um confidentiality applies then the appropriate route is for the person to actually attend at the hearing but not release the information attend at the hearing and argue the confidentiality of the information and let the um judicial or quasi judicial officer make a decision however if it's a warrant it's already been issued by the court and the healthcare provider must release that information if there's a warrant so the obligation then is to ensure that one keeps within the um terms of the warrant itself and doesn't release any more information than necessary um and then there are lots of provisions for for instance release of information for purposes of discipline of a healthcare provider um and or um the healthcare system um for ensuring that billings have been appropriate uh those sorts of things um so public health is the last area that I'm going to mention and then um I'll open it up for discussion um so in the public health legislation um there's a list of communicable or reportable diseases um and it is mandatory for a physician and sometimes others to report to the public health officer if they have information that someone is uh that has contracted um one of these communicable diseases and then there's a set of corresponding obligations and so there may be an obligation to notify the contacts of that person that um obligation may rest on the individual or it may rest on the um public health officer and um there are other provisions in there for um release of personal information and that is the conclusion of my presentation do you have any questions or comments yes my question just relates to the conversion that's uh on coming to electronic health records and uh whether or not that information is accessible now to people in general or if you want to start to try to talk to one health portfolio or health record oh the latter part I'm not so familiar with I know there've been a couple of um software companies that have um offered for purchase um the kind of record that is meant to eventually be one that you could compile all your personal health information into um you know that there was a move to um developing such a record in Ontario the e-health Ontario um situation kind of went down in flames with both with complexity and with um other serious problems with its um uh running its operation but uh I to my knowledge we're not in a place now where we can have our little card and go to our doctor and go to the hospital well for sure not in Nova Scotia um and its various provinces have developed different sorts of electronic record systems um BC and Alberta being the most advanced in that regard but usually the the state of the art is for the information to be um shareable ideally between physician and hospital uh and possibly um with the pharmacies and three years into this latest meeting that they're having now are talking about re-envigorating the converting to electronic records and I guess my question is very simply if I want my information can I get oh can you get your information yes in Nova Scotia so once the personal health information act comes into place um certainly you'll have a I should say I'm just wondering if this is exaggerating but basically a crystal clear um right to know the information that is being held uh in Nova Scotia right now the information provisions are are more generally under the case of McInerney and Mcdonald that I referred to so you certainly have an entitlement to request access to the information you have an entitlement to that information assuming that it doesn't fall within the significant risk of harm to yourself or others for that information to be revealed to you um but the health care provider or institution is entitled to place a reasonable charge on your access to that information so that's the basic answer and when it is electronic um it should in theory be even easier to gain access to that information at lower cost but um we're only in the process of developing a hospital based electronic health record system in Nova Scotia and it is not far along in my understanding. Now individual physicians have some information on electronic health records. Yes. There's been a trend perhaps in the last couple of years on internet privacy problem on some of the major service providers that resulted in class actions that have resulted in very large cells which I'm not quite sure what the consumer gets at. Do you see any evidence of you mentioned it in front of me talking about privacy or health privacy, privacy of emerging as a target and do you see any evidence of a class action around some of these major breaches that occurred across the country in various jurisdictions and very possible records for example or personal records? So so you're thinking for instance in the one that I said 83,000 patients in or the clients in in Ontario. So could they bring a class action suing the district health authority for violation of one of the various rights that I went through? You know in theory it's there but boy it's a slow moving kind of area don't you think? I know you have a lot of experience with this. Just what I've read in the last 12 months it appears that I would have thought the internet would have been a major problem because it damages as always the problem in terms of proving that. Well yeah. And some of the cases like that in Saskatchewan where someone's hepatitis record was here in the remand center. That's probably the only one that you can really major health case that you can really really find across the country. I've just thought internet class actions would have resulted in the settlements like I think I'm not sure it was Sony or a couple of the others. I've been up in Ontario, locker in Ontario, specializing in this and even going after other jurisdictions with mixed success other than the whole Cal or the I'm just wondering if that's I don't know if it was in the heavens or the United States? Yeah I I think that for the law to be used practically in this area the route is more statute based than it is at common law. I think that people just have less motivation actually to bring this kind of lawsuit usually if someone is dealing with a well for one thing a lot of breaches of health information are not known at present quite likely of personal health information but secondly if they're known it's very often someone who is in a circumstance where a breach of confidentiality is the least of their problems if they're dealing with serious health issues and so I think that it's just not caught on readily and so at least the provinces are developing these alternative routes which are usually more kind of user friendly and less costly. They have disadvantages compared to an actual lawsuit through the system of tort or contract or fiduciary duty but they at least provide a more ready route. Now in this province as in others the price of access to that system is something that is vulnerable to going up when a government needs to collect more money so that's another problem. Nevertheless launching a legal action is more costly and for a class action you have to have a lawyer who is initiating and encouraging and you have to have people who are motivated enough and yeah we really don't seem to have that right now. Another question yes. The practical side of accessing the information are these new acts that you've read that are just deductible of the federal privacy act like I'd say. There's a form you fill it out you send it in you make a request your request lapses if in a year nothing happens you have to keep requesting there's a rate of correction. Does it operate like that? Who do you complain to if you make a request for your information and nothing happens? Right so the the request for information I'm hoping will will function smoothly. A complaint when it comes to a breach. There are provisions in the statute there are lengths of time laid out I believe right in the statute if not then it'll definitely be in the regulations in terms of how quickly a response is required there I I'm not sure that there can be a fee for a complaint under the act but that's going to be so yeah I'll get to that in a second so that's going to be in the regulations but basically the complaint is to someone called the privacy review officer and so this is the so we have had the freedom of information and protection of privacy act under that we have a review officer wasn't called a privacy review officer but with recent changes this same person will be handling both sides of it and so they will be handling the the complaints under this statute so the complaint is to the privacy review officer for Nova Scotia Does it carry a right of correction or invitation? Which is once you get it and it's incorrect? Oh okay so if there's if there's a so if your question now is if there's an error in your record and you have an entitlement to request a correction to it and the health care provider has to respond to that to that request for correction and they have there's various tests laid out in the statute but let's assume that you're right and the information in the record is wrong then you have the entitlement to have that information corrected and yes the privacy review officer would ultimately hear a complaint from you if that information was not corrected okay yes and with concern to deciding how how it's determined that somebody may be harmed by accessing their own records how does that decision get made and what kinds of things get taken into account particular guess on psychiatric information right so that's that's the trickiest and that's frankly the only area that i have ever been able to think of where there could be an issue about whether someone could whether gaining that information stands a risk of serious harm to oneself is the area of psychiatric and the the case law doesn't give us too too much guidance on that it does say that it is the obligation of the physician or other healthcare provider to to justify that grounds exist for refusal of information in other words the onus is not on the individual requesting the information to establish that they are entitled to it and it won't be harmful to themselves the obligation is on the healthcare provider who is inclined to decline and the access to such information and i see Donna Franey director of our Dalhousie legal aid service in in the audience here and Donna may remember that when i was at Dal legal aid i had requested a client's medical file and the doctor wrote back and refused and said no and i wrote back and said McInerney and McDonald clear right of the client to this information and the doctor then did provide the information but said that he was totally opposed this is so offensive and patients will have wrong information in their hands and they won't know how to interpret it and it'll be dangerous so but we did get the information but it was and you probably still have circumstances where they're refusing right pardon me you do all the time yeah so but the the but the basic test is as i had said in the statute i don't know if i can see the wording immediately about release but i can find it for you after what's going to be in the personal health information act but it's very similar to the wording just as i put it up on the screen so beyond that it's to the physician to justify how they fit within the wording of that yeah you're welcome yes you talked about varying sensitivities about health information did you find that there was a correlation with stigma and sensitivity of how people felt about their health information the stigma of various illnesses like mental illness or an hiv diagnosis oh yeah how that sensitivity things might be changed by perception by society yeah what an interesting question because it you would think that it would correlate strongly with stigma that that is maybe a major if not the motivating factor for people to be sensitive about their personal health information um i do recall in one study i was involved in i think it was there there was some surprising results like i think that well surprising to me at least and the other researchers at the time i think it was diabetes that was ranked quite highly that people did not want that information and intuitively that would not have been as high as some sorts of psychiatric disorder but it was up there um in the one uh and you know we hadn't asked the question oh and why would that be so i can't actually explain why that is but i think you get you get probably a fairly strong correlation but then there are some surprising results as well perhaps yes joe it seems sometimes when we talk about the information access you don't differentiate between information and knowledge this i think has been done in the front of the comment about the possible applied harm if somebody has access to information they can't actually interpret um i think for me information is not knowledge and so the issue is that whether or not you hand over information historically my issue has been i'll hand over to someone actually you can identify a qualified professional i'll hand it over to all the information but they hand over to explicitly a whole file with somebody there's no formal training to make things up that's a bit of a concern um i mean when you look at the health information it's not one or two data points the convergence and pattern system is actually you know the convergence is the essence of diagnosis and attribution to germination so isolated bits of information is a big concern i'm not referring to the germinities here but you know this we didn't access to all kinds of information in that report um so i think that's an issue that needs to be addressed and the second point is i do have concerns of you know we need to study carefully but what you may find over a period of time is that it needs to be careful monitoring of whether or not people actually modify eventually what information can go down so yeah the practitioner is out there and is concerned about how much information is going down and where it may go out you might find over a period of time now how the information recorded and less recorded may start to change over a period of time and that's uh you know probably the chance of i was on the flipside when it was alerted to that because it could greatly affect clarity of the information recorded and therefore transfer to another practitioner who's telling their patients these things we need to keep in mind well that was one of the arguments in McInerney and McDonnell the Supreme Court of Canada 1992 judgment well not everything you said but one of the arguments was and well one was patients wouldn't know how to interpret it properly but another was um physicians would not record information in the same way as in the past and that they would be limited in what they could record and the court refused to accept that argument and said that if a healthcare provider would write one way to themselves in their community in a different way thinking that the patient might have access to it and not like what they read in it or something they just found that to be spurious to be an argument that was not convincing it's an argument that is being made in the context of electronic health records that the information gets changed as a result of the the way that one has to provide the information in the record and also with the likelihood of access by others i i don't know i think that in terms of whether people will misinterpret the information that they receive i i do think that my general inclination is to think that people can seek resources if they need help interpreting the information but that i think it is more our information than it is a healthcare provider's information fundamental that would be my thinking on it yes i want to get back to your basic question there i want to echo my health information insurance companies require that you take a test or so for life insurance disability or health insurance and they pay for the test but it goes into a data bank and then other insurers have access to that data bank and even your medications they pay for them and they say sunlight for some other company your pharmacy sends in the record to them so they have a record of all your medications and also your tests from doctors and now granted you might give them consent to take a particular test for that insurance but they use it continuously and now with this high tech in genetics your siblings they can screen out your siblings or whatever so who the heck holds your information yes so the so the circumstance where someone it undergoes a medical examination by a physician who is hired by an insurance company and or by one's employer let's say for those purposes that's a very that's a very tricky situation and i you would have to look very closely at that particular circumstance my guess is that when the information prior to the information being collected the individual is asked to sign a form and my guess is that in that form one is agreeing to the surrender of whatever information is provided during the course of the interview and that that information then is actually handed over for many purposes and it's done through consent but it's done in a way that the patient or the individual may not be very aware of what they're agreeing to at the time and then in terms of the sharing of information after that well that's part of what we're facing right now is the collection of information into databases and without necessarily the knowledge of what's going to be done with that information and with certain non-consensual uses being made of that information such as for research purposes now does anyone have specific knowledge of the insurance context no okay next question i have a specific question related to delivery of health services that maybe a little aside that means you so and the example is on a first nation where a for the most part will have some form of a health center which is funded through usually funded through or primarily funded through a federal government and delivered by band employed health professionals and the health center and ultimately the chief and household band administration and that funding comes with agreement for funding which has abilities of the government to to do any ministerial audit or compliance review or program review of particular programs for example could be like a home care program that's delivered by health center how would that if the if there was a program review compliance review product or what have you made conducted by the whatever federal department then what would you what would you see sort of as the the picture of how that would be responding to in terms of the rights of the government to ask for that and then the the health care provider and employer in that situation and in providing that information which in which you would at some points get into the body in the course of the audit yes so it's it's a an interesting and detailed question and so let me pull back a little bit from it to say that in every piece of information legislation that I've seen there is a provision for non-consensual access to personal health information for purposes of auditing and monitoring of use of resources those sorts of terms are used in there so I would think that that is contained in the federal legislation in but I'd have to look for sure at it but I did want to add to so I'm answering in a general way because you know you would have to look in great detail but I also did want to mention thinking of your question that the average the national Aboriginal health organization that's not the exactly the correct title for it but a national Aboriginal health organization is the only national body to my knowledge which has actually asserted ownership of health information so it's the answer who the heck owns my health information the answer by the national Aboriginal organization is we own our health information and no other group as I say has spoken quite as strongly about that do you know the actual title of the group I think that's the correct title you think it is napple napple that's yeah okay yeah yes I'm going to ask you to talk about a circle of care and what your time of exception is that you sense the crisis within the circle of care yeah and I thought you said there was a definition of what circle does that include professional circle of care circle of care within the same health institution for the circle of care professions outside but it's a term that I hear used more more frequently to include more and more things right right so the term does not come up in the personal health information act not directly the concept is there the term to my knowledge was first used in a document issued by industry canada when the personal information protection and electronic documents act was first to apply to health care services so I believe that was 2002 and you can look it up online if you go to the industry canada website and then you go to personal information protection and electronic documents act you'll find it there and it's a strange place for a for a discussion of health care services but it's because this statute applies to commercial activity and that's where the the concept or I shouldn't say the concept but the term circle of care where to my knowledge it was first used and you'll find a definition of it there yes oh good question um and there was a decision in Australia I talked about the case of macanurdy in mcdonald because it's the most guidance we have on ownership and right to access information there was a case in Australia that went to their high court and macanurdy in mcdonald was argued to assert a patient right of access to information and the court was kind of smearing the Supreme Court of Canada and said no patients of course do not have a right to access their information and there are problems with copyright of that information because a physician's own diagnosis for instance goes into the record and so there are copyright issues I haven't seen it explored fully in law and copyright is not my particular area but I think there are tensions there that have not been fully sorted out actually of copyright in information contained within the record yes uh no no no I mean there may be organizations that strive to um you know I was talking about best practice and then what's contained in law but no the provisions in the statutes that certainly even in the new personal health information act it's not non-identifiable information it is identifiable there it may be stripped away at a certain point along the way that wasn't my original reason for raising my hand which is in spite of the framework that you're talking about it seems to make there are some standard practices that routinely breach for example you know doctor's office hotel hospital waiting rooms people's names get called though it's you're the next patient or you go to pick up your medication pharmacy and you overhear conversations with somebody else where it's in the details of their medical situation are being discussed and often there are supposedly private cubicles to do that but they're never used from the way I can see and even if they were they're not really private anyway or for example I had a few years ago you know I had cataract surgery and I don't remember how common this is but the setup for that was that the pre-operative setup was an open area where there are several chairs and you could hear discussions with all of the patients where nurses were asking about people's medications was being done but now I'm over here in a conversation about you know antidepressant drugs that this person had been taking I'm just feeling really uncomfortable over here in this conversation but I mean that it's an open area and that there seem to be no concern about that kind of issue could people hear at the back yeah okay yeah um I just have to agree absolutely like I um did a piece for the the publication on pharmacy and on seamless care which is kind of all the sharing of information among health care providers and the issues to do with that and in particular a lot of it being electronic issues and everything but I ended it by saying that I actually thought for pharmacists the big you know the the biggest breaches that happen are right at that counter where the person is interacting with the pharmacist they have set up those booths more recently though like that those are attempts I think they're they're inadequate attempts I agree absolutely and they are not operating as they should but at least I think with greater awareness of the importance of confidentiality that there is more turning one's mind to the need for confidentiality it's imperfect for sure and and part of your point maybe that we ourselves are because in the conversation you're talking about everyone the person the patient was readily discussing this her or himself is that right yeah so um I mean they really didn't have a choice of saying well can we go somewhere else and talk about that but oh it was with the health care provider yeah oh I see yeah yeah so then I agree absolutely so but you know I suppose I would hope that with greater um um attention through legislation and obviously there's a fair amount of interest for this kind of turnout in this room on a Wednesday evening um on a topic that some would consider boring I think the topic of health information shows um an interest right and surely that interest combined with some protections will filter through to at least some degree of protection but uh as imperfect as it is yes oh boy um so Europe has had greater protections in fact I spoke about the Federal Legislation Personal Information Protection and Electronic Documents Act that was brought about because it was forced by the European Union the European Union said we will discontinue the sharing of certain kinds of data with you Canada unless you bring in greater protections um for information oh was it the right thing to do well um it it helped um I I couldn't point to a place right now that has really accomplished excellence in privacy and confidentiality um in terms of electronic health record systems I could point to New Zealand which is bringing in a system they are building it from the ground up so it doesn't require the massive investments that have been necessary and continue to be necessary in Canada and it has done it with consultation and with um um full involvement of the various providers and if you call us consumers of health information yeah um wasn't is it's not fully constructed yet but um New Zealand is a small nation as well and so it may be easier for them to go about such a thing in a meaningful and consultative way but I don't think that's a good excuse not to be trying to look to models like that in Canada uh last question okay not a question you were asking if somebody has a concrete example or knowledge about the industry or the insurance industry I don't have any but um very disturbing situation happened to me um a number of years ago a colleague asked me about the professor at Dalhousie who happened to be a friend of mine how he is doing and I didn't answer I just asked why did you ask and it turned out that this colleague was a lawyer for the insurance company who was supposed to provide him with disability oh so so much for that and I see that one of the topics to be discussed is the virtuous lawyer and left okay very good um ending and I am uh I have copies here I'm with the health law institute here at Dalhousie and I have copies of our seminar series so I'm making a little plug come and pick up one of these posters and if you want to be on our mailing list for it there's a a sign up sheet uh to get on the email bit uh so thank you all for coming