Question has been called.

---Carried

Committee Report 9-17(5) is deemed read and is to be printed in Hansard in its entirety.

Introduction

The Access to Information and Protection of Privacy (ATIPP) Act came into force on December 31, 1996. The law was created to promote government accountability by balancing access to government information with the protection of individual privacy rights related to that information.

Under the act, the Information and Privacy Commissioner (IPC) is appointed for a five-year term as an independent officer of the Legislative Assembly. The act requires the Commissioner to file an annual report on her activities and authorizes the Commissioner to include recommendations for amending the legislation to improve the act’s efficiency and effectiveness.

The Standing Committee on Government Operations conducted a review of the 2012-2013 Annual Report of the Information and Privacy Commissioner of the Northwest Territories, which was tabled in the Legislative Assembly on February 11, 2014. Members would like to thank Ms. Elaine Keenan Bengts for her report and for her appearance before the committee at the public review on April 25, 2014. The committee also wants to take this opportunity to thank Ms. Keenan Bengts for her continued commitment and dedication to all matters relating to access to information and the protection of privacy by public agencies in the Northwest Territories.

Commissioner’s 2012-2013 Activities

In 2012-2013 the Commissioner opened 16 new files, down from 27 in 2011-2012. Of the 16 new files, seven dealt with health information. Ms. Keenan Bengts completed 12 review recommendations, an increase of two over the previous year. Of these recommendations, seven were focused on the collection, use or disclosure of health information. This, undoubtedly, prompted the

Commissioner to call 2012-2013 “the year of health privacy concerns.” As noted in the Commissioner’s message at the opening of the report:

“The issues ranged from patient concerns about the way in which their personal health information was being shared within the confines of a health authority to concerns raised by patients who were also employees of one of the Northwest Territories’ health authorities who questioned whether or not fellow employees or supervisors had access to their personal health records. And, once again, there were cases of misdirected faxes containing personal health information.” (page 7)

Of the cases resulting in review recommendations, the recommendations of the IPC were adopted in full by the relevant public body in six cases; partially adopted in two cases; not applicable in two cases, as no recommendations were made; and not accepted in two cases.

Eight public bodies were involved in 14 matters before the IPC in 2012-2013. Of these, the Yellowknife Health and Social Services Authority, the Dehcho Health and Social Services Authority, the Department of Environment and Natural Resources and the Department of Education, Culture and Employment each had two or more matters before the IPC.

Recommendations for Legislative Change

As already noted, the Information and Privacy Commissioner is authorized to make recommendations for legislative change. This year the Commissioner highlighted five legislative issues. Of these, four relate to long-standing recommendations raised in her past reports and forwarded to this House by the standing committee: new health privacy legislation, access and privacy legislation for municipalities, the need for a general review of the ATIPP Act and what a revised act might include. In addition, the IPC has raised another matter for consideration, that of access to information and protection of privacy by First Nations governments.

Implementation of New Health Information Privacy Legislation

Again this year the Information and Privacy Commissioner has made her concerns known regarding the potential for breaches of privacy within the health and social services system, which were heightened with the move to electronic medical records in 2010.

Of the breach-of-privacy complaints reviewed by the IPC in 2012-2013, two illustrate the problems that can arise with respect to the handling of medical information. In the first example, Review Recommendation 12-106, a complaint was brought against the Beaufort-Delta Health and Social Services Authority (BDHSSA) by a complainant

who was also an employee. This individual requested that access to his paper medical records be restricted to protect the privacy of his medical issues from coworkers, after he received care at the Inuvik Hospital. Pursuant to his request, the paper records were immediately secured. However, when the complainant later grew concerned about his electronic records, he requested an audit and learned these records had been accessed 12 times outside the period during which he received medical attention.

The IPC’s review of the audit confirmed that the majority of times the records were accessed it was for legitimate reasons, but revealed that for several of the entries it could not be determined who was accessing the records and no reason had been recorded for the access. The BDHSSA argued there was no evidence to suggest that the information on the file had been improperly used or disclosed.

In commenting on this case, the Commissioner expressed the opinion that “the onus lies on the health authorities to provide evidence that all access to an individual’s personal health records is proper and for a legitimate reason under the act… Individuals have a right to know who has accessed their records and for what purposes. If the health authority cannot do that, there is a flaw in the system.” (pages 23, 22)

The IPC made six recommendations, detailed on page 24 of the report. Recommendations included: conducting a thorough privacy impact assessment on the electronic record system; removing generic computer names and passwords from the computer system; taking steps to ensure every access to the system includes a reason; instituting a system of regular random audits on the system; and improving training on privacy for staff, including regular messaging about the importance of keeping health records private. The BDHSSA accepted all of the recommendations in full.

In the second example, Review Recommendation 12-109, a complaint was brought against the Yellowknife Health and Social Services Authority (YHSSA) by an employee of the GNWT who required accommodation in the workplace as a result of physical and psychological challenges and who was concerned that his physician had improperly disclosed personal health information, including a psychiatric assessment, to his employer.

The IPC found that, while no actual disclosure had occurred in this instance, because the information in question was recovered from the employer unopened, there were a number of problems with the processes around disclosing medical information. In commenting on this case, she found that “While the oath of confidentiality is meant to prevent the discussion of personal information

outside of the workplace, this does not address unauthorized or inappropriate access to personal health records. These are two different…issues.” (page 31)

The Commissioner recommended that a system be developed for dealing with consents, including a place on forms for patients to provide any instructions, and that when patients request disclosure, a note be made on their files. These recommendations were accepted by the YHSSA.

Review Recommendation 12-112, by comparison, illustrates a case in which the recommendations of the IPC were not accepted by the health and social services authority in question, which is not named in the report.

In this complaint regarding breach of privacy and improper use or disclosure of personal medical information, the complainant, an employee of the GNWT, was asked to obtain a letter of prognosis from his physician. He signed his consent on a form provided to him by his employer, which was to be completed by the employee and his doctor. The complainant understood the doctor would complete this letter and return it to the complainant for delivery to the employer. Instead the doctor forwarded the completed form and letter to all Human Resources staff members, copied on the original letter requesting the prognosis.

The health and social services authority argued that because the complainant signed a form consenting to disclose health information to “the GNWT” that this was sufficient to authorize disclosure of personal health information to everyone copied on the form. Regardless, the Commissioner concluded that there had been a breach of privacy.

In commenting on this case, the Commissioner noted that the doctor’s report “should have been directed only to the complainant’s supervisor... This is not just semantics or a technicality. This is about the law which restricts public bodies and employees of public bodies from using or disclosing the personal information of individuals except in accordance with the act.” (page 37) The health and social services authority in question did not accept that providing a copy of the doctor’s report to all of those copied on the request was a breach of the patient’s privacy because “the result was ultimately consistent with the purpose for which the information was collected and compiled.”

The IPC recommended that the consent form be revised to clarify ambiguities, that all health care workers be given more training and that procedures be developed to clarify what is required of health care workers when consent is being obtained.

The health and social services authority did not accept the recommendations and did not agree to review their own practices, but ultimately agreed to forward the IPC’s recommendations to the GNWT’s

Human Resources and Health and Social Services departments.

The committee notes that, with the heightened duty to accommodate employees suffering from illness or injury, circumstances requiring the disclosure by physicians of employee medical information to the GNWT are only more likely to occur in future. Therefore, it is incumbent upon health and social services authorities in the NWT and the departments of Human Resources and Health and Social Services to ensure that the forms employees are required to fill out are clear and unequivocal regarding consent.

The IPC has noted in past reports that the number of complaints focusing on concerns about the privacy of health information points to the need for health information privacy legislation. The new Health Information Act was approved on March 13, 2014.

In her report the Commissioner noted that she was pleased the legislation is under development – it had yet to receive assent at the writing of her report – but cautioned that effective implementation will rely on educating health sector workers and the public. The IPC suggested that the public needs to understand how their personal information will be collected, used and disclosed and that health information custodians will need to develop new policies and procedures.

The committee wholly concurs with this observation and strongly encourages the government to work with NWT health and social services authorities to ensure that all staff members are educated about their responsibilities under the act and that members of the public are provided with the information they need to understand how the new legislation will impact on the use and disclosure of their medical information.

The IPC also pointed out that the necessary resources will have to be put into the oversight function so that the office of the Information and Privacy Commissioner will be able to take on the inevitable increase in workload brought about by the implementation of the Health Information Act. The Commissioner advised the committee that she will be bringing forward to the Clerk of the Legislative Assembly a business plan which will include a proposal for additional resources, and she asked for the committee’s support for this evolution of her office.

While the committee feels that it is premature to offer support for the proposal until it is received and reviewed, the committee is supportive, in principle, of the work carried out by the IPC and of the provision of adequate resources to enable the Commissioner to properly fulfill the mandate of the office.

Information and Privacy Legislation for Municipalities

The three northern territories are the only Canadian jurisdictions that do not have information and privacy legislation for municipalities. Municipalities collect and retain significant amounts of personal information about citizens and employees. There is no recourse in the Northwest Territories for citizens when this information is improperly used, nor are there any rules governing citizens’ access to municipal information.

Since 2007-2008 the IPC has been encouraging the GNWT to find ways to include municipalities under the ATIPP Act or under their own legislation. The Commissioner has repeated this recommendation in her 2012-2013 Annual Report.

Two years ago the committee recommended the implementation of access and privacy legislation for municipalities, with a bill to be brought forward within the first two years of the 17th Assembly. The

government’s response, TD 51-17(3), tabled October 17, 2012, acknowledged the importance of the issue, recognized that this recommendation was outstanding and noted that a working group, led by the Department of Municipal and Community Affairs, was established to review how all NWT municipalities may be brought under existing access and privacy legislation and to develop a discussion paper for stakeholders.

Last year the recommendation was again repeated that the GNWT expedite work on bringing municipalities under access to information and protection of privacy legislation. This time, in its response, TD 114-17(4), tabled October 17, 2013, the GNWT indicated that “the estimated timeline for this initiative is as follows: • complete background research – January 2014 • complete discussion paper – March 2014 • circulate discussion paper to key stakeholders –

April/May 2014

• draft “What We Heard” report – June 2014 • develop final report and recommendations –

July to October 2014.

The Standing Committee on Government Operations strongly recommends that this work, which has been outstanding for many years, be completed by the government in accordance with its own timeline and without further delay.

Recommendation 1

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories make every effort to complete the work necessary to bring municipalities under access to information and protection of privacy legislation; and

that the government table its review report and discussion paper in the 2014 fall sitting, identifying next steps and resources necessary to complete this legislative initiative within the life of the 17th Assembly.

Review of the Access to Information and Protection of Privacy Act

In her 2012-2013 Annual Report, as in her four previous reports, the Information and Privacy Commissioner again recommended a general review of the ATIPP Act. The Northwest Territories ATIPP Act has now been in force for 18 years. Access and privacy laws in other jurisdictions, and indeed other statutes of the Northwest Territories, provide for regular reviews at five- or 10-year intervals.

The IPC calls upon the GNWT to do a comprehensive review of the ATIPP Act, echoing the Information and Privacy Commissioners of Canada who, at their 2012 Annual Meeting, acknowledged that most access and privacy legislation in the country today has remained relatively unchanged since the 1980s and called upon federal, provincial and territorial governments to modernize and strengthen these laws. A copy of this call to action is appended to the IPC’s report as Appendix A on page 52.

In its response to last year’s standing committee report, TD 114-17(4), the GNWT reiterated its commitment to undertake a comprehensive review of the Access to Information and Protection of Privacy Act and provided, as part of its response, a progress report on the review. However, the government qualified its commitment by noting that “the scope and pace of advancements noted in the progress report factor in the competing priorities and the resources of the (GNWT access and privacy) office which currently has one dedicated position focusing on GNWT initiatives.”

The committee is pleased that work to review the ATIPP legislation has commenced and appreciates the challenges associated with limited resources and competing priorities. The committee notes, however, the Commissioner’s observation that information is one of the most important natural resources in today’s world. The committee joins the IPC in urging the GNWT to review the ATIPP Act to ensure it can effectively address changes in government practices, such as public/private partnerships, outsourcing and shared services models; changes in technology, such as electronic medical records; and changes in the public’s expectations of government accountability and the corresponding growing demand for government accountability, as demonstrated by activist whistleblowers.

The committee asks the GNWT to provide an update on the status of its work and to demonstrate its commitment to completing this work by ensuring

that an update to the ATIPP Act is introduced during the life of the 17th Legislative Assembly.

Recommendation 2

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide an updated detailed progress report to this Assembly on work done towards a comprehensive review of the Access to Information and Protection of Privacy Act and that updates to the act be introduced during the life of the 17th Legislative Assembly.

Proactive Disclosure or “Access by Design”

The IPC recommended that any review of the ATIPP Act should include a consideration of the benefits of including the requirement for public agencies to plan for privacy implications at the outset when developing legislation, programs, policies or services. This can be done by requiring privacy impact assessments and instituting “privacy by design.” This approach is a proactive way to ensure access to more government information, notes the IPC, suggesting that the GNWT should be exploring ways to do this through new and less expensive online technologies to provide a more streamlined and less formalized route to access most government records. As the IPC noted previously, “There is no good reason not to be providing more access to more government information pro-actively.”

The committee feels that there is considerable merit in this approach, noting that in this information age it can only be of benefit to the government to plan for access and privacy considerations at the outset, rather than having to rely on remedial solutions in those instances when government’s activities are found to be inadequate under the ATIPP Act.

Start a Discussion about ATIPP for First Nations Governments

The case which gave rise to Review Recommendation 12-108 in the IPC’s 2012-2013 Annual Report highlights the matter of access to information and protection of privacy by First Nations governments.

In this case, a consultant requested a copy of the Barren Ground Caribou Harvesting Interim Agreement between the GNWT’s Department of Environment and Natural Resources, ENR, and the Yellowknives Dene First Nation, YDFN, a subject described by the IPC as being of some controversy and considerable public interest.

ENR met with YDFN and concluded that the loss of trust between the parties would outweigh the public policy benefit of accountability. ENR refused to disclose the agreement on the grounds that to do so would impair relations between the GNWT and YDFN.

During the review, the IPC sought direct YDFN input and learned they were strongly opposed to disclosure of the agreement. The IPC concluded the YDFN is not a public body under the act and, therefore, not subject to the same rules. She also concluded that ENR’s concern about impairing the relationship was founded.

The Commissioner recommended that ENR fully analyze its position on disclosure, bearing in mind that “disclosure is the rule and exceptions should be interpreted narrowly,” and that ENR carefully consider disclosing those portions already within public knowledge and those stating facts and background.

In light of matters discussed in Review Recommendation 12-108, concerning the Barren Ground Caribou Harvesting Interim Agreement between ENR and YDFN, the IPC recommended that the GNWT begin the dialogue about ensuring First Nations governments in the NWT are also required to provide access to information. The IPC recognizes that this is not a matter that the GNWT has full authority over, but recommends, nonetheless, that all levels of government begin the discussion.

The committee acknowledges this recommendation but notes that Aboriginal governments are autonomous, independent governments that are not subject to the ATIPP Act. Therefore, it is entirely at the discretion of these governments how they choose to address matters of access to information and protection of privacy regarding the information they collect and disclose.

The committee does note, however, that where the GNWT enters into agreements with other governments, the GNWT should be advising these governments as to its obligations under the ATIPP Act, so that there is a clear understanding of what information the GNWT may be required to disclose. This also points to the value of “access by design,” so that the GNWT anticipates, in advance, the possibility of such requests and can factor this into planning future intergovernmental agreements or similar arrangements entered into with parties not subject to ATIPP.

Conclusion

The committee wishes to reiterate, again this year, how fortunate the people of the Northwest Territories are to have had the services of Ms. Elaine Keenan Bengts as the NWT’s Information and Privacy Commissioner. Ms. Keenan Bengts, a lawyer in private practice, has served in her capacity as the IPC since 1997. As noted in last year’s report of the committee, this length of service provides the territory with remarkable continuity and expertise in the complex and evolving field of access to information and protection of privacy. The Standing Committee on Government Operations is grateful for Ms. Keenan Bengts’ passion for

information and privacy rights in northern Canada and respects her work in reviewing complaints and making thoughtful, well-considered recommendations for legislative change. Members are committed to giving the Commissioner’s recommendations due consideration, forwarding them as appropriate to this House and following up with the government on their implementation.

Recommendation 3

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a comprehensive response to this report within 120 days.