Thank you, Mr. Speaker.

Completion of the Health Information Act

In June of 2011 an employee of the Yellowknife Health and Social Services Authority made a complaint to the Information and Privacy Commissioner about inadequate protection of medical information in Yellowknife’s two primary care clinics. The investigation resulted in what the standing committee agrees is one of the most significant review reports completed during this Commissioner’s term of office.

The implementation of an electronic medical records system began in June 2010 at the Yellowknife Primary Care Centre. This is, for the most part, excellent news as electronic records make it much easier and quicker for doctors and nurses to review patients’ medical histories and provide swift and appropriate treatment. Members also recognize the key role electronic medical records will play in the integration of services and effective case management.

The complaint alleged that adequate privacy protections were not built into the new system. Numerous staff, ranging from senior managers to receptionists, had access to patient information in the system, including such sensitive matters as the reason for patients’ visits. There were no safeguards to prevent inappropriate access to patient information, no warning system which would identify when information had been inappropriately accessed, and no routine privacy auditing. All of these factors raised the risk of inappropriate use and disclosure of personal health information.

As the Commissioner observed during the public review, the privacy of health records has a serious impact on patient comfort and safety and, ultimately, on public health. Patients who are concerned about the privacy of their records may not give their doctors important but potentially embarrassing information. They may even decide not to go to the clinic for medical attention.

In the complaint under review, the Yellowknife Health and Social Services Authority responded to the Commissioner’s request for detailed information on its new electronic medical records system. The authority also had its legal counsel conduct a privacy impact assessment, shared the report with the Information and Privacy Commissioner, and committed to make improvements in line with the internal assessment.

The Information and Privacy Commissioner noted, however, that there is a disconnect between her view of what constitutes adequate protection of personal health information and the authority’s view. The differences turn on two issues, both of which have legislative implications: the extent to which information can be shared without the patient’s explicit consent, and the purposes for which it can be legitimately shared.

First, the Yellowknife Health and Social Services Authority takes the position that all the information they collect is shared within a circle of care. That circle of care includes all employees who assist with client care as necessary to perform job-related duties. What this means, in practice, is that sharing of some types of patient information is broadly permitted without explicit patient consent within the Yellowknife Health and Social Services system.

I would now turn the reading of the report over to my colleague Mr. Dolynny.