Fall 2005

P r i v a c y
Privacy law and health records

The Provider's Edge Photo


It is not clear how Canada’s new privacy regime will ultimately impact health care, but it is something physicians should consider now.

by Ed Brown

The Personal Information Protection and Electronics Document Act (PIPEDA) has been generally in force since the beginning of 2004 for those provinces without similar privacy legislation. Those engaged in commercial activity involving personal information must publish a privacy policy, including a designated privacy officer, a complaints process, and individual access, security and accountability mechanisms, among other things. These rules center on the right of an individual to withhold consent for the collection, use and disclosure of their personal information. The Office of the Privacy Commissioner of Canada takes the view that “core activities” of publicly-funded hospitals are not subject to the PIPEDA, but physicians’ activities in private practice are. Presumably, a private practitioner disclosing information (even to hospital staff) would require patient consent.

The CMA adopted its Health Information Privacy Code** in anticipation of this legislation, creating specific guidelines for health care practices and trying to integrate the doctor's obligation to share information, traditional patient confidentiality, and the new legislation. For example, the CMA Code assumes implied consent by the patient for such things as case consultation and laboratory work. More recently, the Privacy Commissioner has articulated a similar “circle of care” concept, which includes implied consent to some information sharing.

Ultimately, the Commissioner's interpretation of the legislation could be over-ruled or modified by an appeal to the courts. As it stands, there is some uncertainty as to the extent of the “circle of care,” exactly when a physician is acting in private practice, and the adequacy of the CMA’s published privacy handbook as a guide for physicians. But leaving these concerns aside, it seems the Privacy Commissioner does not contemplate radical changes to physicians’ interaction with their patients. Circumspect and appropriate handling of records and posting consent and policy notices would appear to be appropriate steps in her view.

But I’ve been to several waiting rooms in the past few years and have yet to see much sign of compliance with these basics. I also doubt that many would know how to respond if I informed the clinic I was withholding my consent to disclose information, or asked to speak with their privacy officer. This is not really surprising, given the administrative overhead involved, and given that the system is complaints-driven. Only if the Commissioner receives a complaint is there likely to be an investigation, and even then she is limited to organizational recommendations: she cannot apply penalties. That doesn't mean you should ignore the rules: imagine the professional embarrassment of an adjudicative finding that says you’re mishandling personal information. (Besides, physicians are subject to other relevant law, including breach of confidence).

A broader concern for physicians as a group may be impending changes related to electronic health care records. With efforts such as Health Canada's Infoway project, privacy compliance is being designed and built into information networks and services that will determine how you access health care records in the future. For example, many electronic systems store the records on the software provider’s server. With high-speed networks, the records are instantly available, but the clinic doesn't have to manage the database technology. At least one clinic in this province uses this type of service. It requires nominal disclosure of the records to the service provider, in possible conflict with privacy rules. The resolution of such issues will determine how new technologies will affect health care procedures and what new obligations fall on the practitioner.

It is not clear how Canada’s new privacy regime will ultimately impact health care, but it is something physicians should consider now.

Ed Brown is a faculty member in the Computer Science Department of Memorial University and a member of the Bar of Newfoundland and Labrador. He has interests in both law and technology related to privacy.



 Poor Average Good Excellent 




Site Map | DisclaimerCredits | Webmaster
© Newfoundland and Labrador Medical Association (NLMA)



Actions needed now to shore up medical care system

Make time to take care of yourself

Doctor’s notebooks digitized

Eastern Health now largest health organization in province

Privacy law and health records

Survey shows women know they should have a pap test… so why aren't they?

Unbiased evidence: CCOHTA delivers research on drugs, medical devices and systems

Ruling on private insurance has far-reaching impact

Projects support development of the provincial electronic health record

Nutrition first mantra of Kids Eat Smart

Return of capital

Celiac disease: The hidden epidemic

Mobilizing primary health care renewal

Resource kit to help physicians help problem gamblers

Clinical Practice
CMA News
Common Revolt Against Paperwork (C.R.A.P.)
Doctors in the News
Executive Director's Message
General Council
Government Relations
Health Administration
Health Policy
Health Promotion
Health Technology
In Memoriam
Information Technology
Job Action
Physician Wellness
Practice Management
Primary Care Renewal
Resident's Corner
CMA Leadership in Practice**
Primary Health Care poster**
Eastern Health poster**
Winter 2013
Summer 2013
Spring 2013
Winter 2012
Fall 2012
Summer 2012
Spring 2012
Winter 2011
Fall 2011
Summer 2011
Spring 2011
Winter 2010-11
Fall 2010
Summer 2010
Spring 2010
Winter 2009
Fall 2009
Summer 2009
Spring 2009
Winter 2008
Fall 2008
Summer 2008
Spring 2008
Winter 2007
Fall 2007
Summer 2007
Spring 2007
Winter 2006
Fall 2006
Summer 2006
Spring 2006
Winter 2005
Fall 2005
Summer 2005
Spring 2005
Winter 2004
Fall 2004
Summer 2004
Spring 2004
Winter 2003
Fall 2003
Summer 2003
Spring 2003
Fall/Winter 2002
A connected group or series; a bond, a connection.

Nexus is published quarterly for Newfoundland and Labrador's physicians. It is a forum for the exchange of views, ideas and information for members.