Reaching a Consensus on the Privacy of Health Information: Looking Down the Road
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Address to The New Wave of Privacy Protection in Canada Conference
Panel on Prescriptions for Protecting Health Privacy:
Are We Moving toward Consensus?
March 10, 2000
Vancouver, British Columbia
Director, Issues Management and Assessment
(Check Against Delivery)
I'd like to begin by answering the question posed to our panel this morning - are we moving toward consensus? My answer is "Not yet" or, at best, a qualified "Yes", and there are a number of reasons that lead me to this conclusion, for there are a number of substantial issues that have to be resolved first.
But before I go any further, let me give you a sense of my perspective on this by highlighting the role of the Office of the Privacy Commissioner. Our mission and our main objectives are:
- To be an effective ombudsman's office, providing thorough and timely complaint investigations to ensure Canadians enjoy their privacy rights as set out in law.
(In this regard, our bias is towards negotiated reconciliation and resolution of privacy issues rather than the blunt instrument of enforcement or the courts. You will understand then why we attach such a high importance on the idea of consensus.)
We also strive:
- To be an effective privacy guardian on Parliament's behalf, by assessing the quality of the government's adherence to the Privacy Act;
- To be Parliament's window on privacy issues, arming it with the facts needed to make informed judgements through research and communications; and,
- To be the primary national resource centre for research, education and information on privacy.
As a result of Bill C-6, one of our priorities will be to emphasize the improvement of the public's awareness of their privacy rights. One of the strongest features of the Bill is that it gives our office a formal mandate to undertake public education and research. And, in that regard, we will continue to follow and report on developments that affect health information privacy.
For the purposes of our discussion this morning, I would like to raise four points:
- whether we need a consensus about the importance of health information privacy;
- the premise upon which any consensus about health information privacy should be based;
- some major issues that we have to tackle during the dialogue necessary for achieving consensus; and,
- recent positive signs suggesting that we can achieve a consensus.
Need for consensus about health information
First, is there a need for consensus about health information privacy? That answer is easy. As it stands right now, protection for health information in Canada is even more of a patchwork than the general set of laws, regulations, voluntary codes of practice and policy guidelines pertaining to privacy. This is widely recognized. Even the federal Health Minister's own Advisory Council went to some lengths to outline the important features it envisioned for harmonized privacy protection across jurisdictions in its Final Report last February.
Our office has repeatedly called for establishing a consistently high benchmark for the protection of health information across the country. The fact remains that the rules must be the same across the country to prevent the creation of health information data havens.
The premise for a consensus
And what about the premise for a consensus? In our view, any consensus about health information privacy should be based on just that - the premise that privacy is - and must be - the key to success of any health information system.
And when we talk about consensus building, it is important to build in the conditions for success right from the start. From my experience, the two preconditions for success are that the consensus-building discussion be as open as possible and that it be as broad as possible.
Consider the process that went into the preparation of Privacy: Where Do We Draw the Line?, the 1997 report of the House of Commons Standing Committee on Human Rights and the Status of Persons with Disabilities. The committee, which was chaired by the Honourable Sheila Finestone, did the following:
- initially, it called together two panels of eminent Canadians to give overviews of the impact of biomedical and information technologies on human rights
- it then convened a third group of experts to discuss the nature of legislative change
- the committee itself then travelled across the country to listen to small informal group discussions led by experts, and attended by individuals representing the broadest possible cross-section of society, including - among others - human rights and privacy advocates, bankers, business executives, people with disabilities, educators, public servants, health-care professionals, labour activists, technology firms and students, and,
- finally, it organised an open townhall meeting at which members of the committee summarized the discussion groups' findings.
The Commons committee was not just going through the motions: the process took 10 months and truly advanced knowledge and understanding about privacy issues in this country.
My point in raising this process is that it constituted a form of communicative action - a kind of open dialogue among public, experts and leaders in which there was give and take, a two-way communication rather than a monologue dominated by so-called experts who impose their points of view on people.
We commend this process to this health debate. Surely some Health Infoway funds could be used to establish a similar consultation process about health information privacy. The patients at the heart of this system deserve no less. The point is that for the search for any consensus on this issue to succeed, the public at large must be involved, including privacy and patient advocates, health professionals, health-related government agencies, labs, pharmacists, and all the rest.
The sad fact is that the public is not involved. According to Beverly Woodward, a prominent academic involved in research on health privacy, "The transformation of medical records from confidential personal documents into widely available tools for medical industry management - including the medical surveillance of patients and their physicians - had been occurring with little public notice."
Canadians aren't even aware that their health information is being shared. According to a recent survey conducted for the Canadian Medical Association, three out of four Canadians still believe that the information they provide their physician is kept confidential. As Dr. Woodward once expressed it: "disclosures unannounced are disclosures unremarked".
Issues for a dialogue
So what are some of the issues that we will have to consider in an extended dialogue seeking a consensus? Several come to mind: mapping the existing information flows, establishing definitions, dealing with the consent issue, and overcoming the obstacles to consensus building.
Mapping existing information flows
Let me begin with mapping existing information flows. Health-related organisations and government agencies must explain the existing flows of health information. I can't stress this point enough. After the patient has provided the information to his or her primary caregiver, no one seems to be able to explain to us the flow of health information from where it originates - with the patient. It's really difficult to ask the tough questions - and get meaningful answers - about the privacy implications of a proposed initiative when all we have are generalities about what is taking place right now.
We also have to get a handle on establishing definitions. As others have mentioned earlier, we all have to be clear on the definitions of the terms we are using. Distinguishing between privacy, confidentiality and security is only one set of misunderstandings. I'm sure part of the confusion comes from not having a clear understanding of the information flows. For example, staff from our office attended one meeting on the Proposed National Health Surveillance System last May where the term "data collectors" was used by some participants to refer exclusively to a provincial government, laboratory or health authority, and by others to refer exclusively to primary care physicians. Examples like this lead us to believe that even the architects of the health networks aren't speaking the same language.
Overcoming opposition to obtaining consent
We also have to deal with the issues involved in obtaining consent. Of all the arguments challenging the practicality of patient privacy, opposition to consent is one of the most important. But, as Donald Haines of the American Civil Liberties Union expressed it in 1996, "Anyone who claims, however accurately, that the patient will ultimately be better off because personally-identifiable information has been disclosed to a computer network without consent, is essentially claiming a right to override the decision of the individual. Such an approach . again, regardless of whether it could produce a better result in some way, is the antithesis of a free society. Medical information is like the patient's right arm, and abuse of such information would be more deleterious than abuse of the arm. Whatever you wouldn't do to the right arm without patient consent, you shouldn't do to the medical information about the patient".
The advocates of the transition to electronic health records claim that they are protecting us and that their interest is in saving lives by making sure that records are available in an emergency. I'm sure that's true. But as Denise Nagel, Chair of the American Psychiatric Association Committee on Confidentiality states, in an article in the Los Angeles Times, "What they won't admit is why they can't ask for our consent. A system created for emergency situations could easily be built with the full knowledge and informed consent of patients. A system to advance medical research could involve patients in the decision or use anonymous information."
Obstacles to consensus-building
Finally, we have to deal with the obstacles to consensus building. When we consider obstacles to consensus-building, or at least incidents that impede a dialogue, it is unfortunately not difficult to find examples of errors or lack of planning that can undermine trust in various systems.
For example, just last month the Ottawa Citizen reported the case of a Kingston resident who has mistakenly been receiving confidential medical records from psychiatric institutions across the province. Over eight months, he had received between 40 and 50 facsimiles revealing people's private medical and psychiatric details, apparently because institutions were dialling the wrong fax number. But although he kept informing the institutions of the problem, he kept receiving the confidential faxes.
The 1997 security review of the British Columbia Ministry of Health's PharmaNet system is another case in point. (I'm sure you're all familiar with this province's pharmacy network and database system, connecting all pharmacies throughout the province, Pharmacare, the College of Pharmacists of British Columbia and the College of Physicians and Surgeons of British Columbia.)
An audit revealed:
- A lack of documented policies and procedures concerning the confidentiality, security, operation and availability of the PharmaNet environment;
- No overall responsibility for PharmaNet security (the roles and responsibilities for security were not clearly defined);
- Large numbers of individuals, both within and external to government, having access to confidential information on PharmaNet as a result of job responsibilities - in some cases, access to virtually all PharmaNet information; and,
- It was not government's policy to require its employees or contractors to sign confidentiality agreements.
Revelations like this should be instructive to the proponents of more-and-better-access to personal health information: straightforward fair information practices policies and procedures must be in place and observed.
Positive signs for a consensus and concluding remarks
Let me conclude on a more optimistic note. There are some positive signs for a consensus. Commissioner Phillips has outlined the main recent indicators of optimism, but let me review some of them.
During the Senate Committee hearings on Bill C-6, the polarised views of several health-related organisations were laid bare. When the Bill passes the House of Commons with the Senate amendments, as seems likely, we will have an additional year delay in applying privacy standards to personal health information. This delay accentuates the urgency of a consensus among all sectors of the health community.
On that score, however, there is some room for optimism. Among other organizations, the Canadian Medical Association and the Canadian Healthcare Association have established a Working Group on the Privacy of Health Information. They should be commended taking the initiative to work out their disagreements about patient consent and other privacy issues.
Our hope is that they come to agree on applying the CMA Code, and that any national consensus provincially and federally will embody the principles of the Code. If any organization or company wants to water down those principles, surely they have an obligation to explain very clearly and very publicly exactly why they want to diminish Canadians' right to the privacy of health information.
As well, the Final Report of Health Canada's Advisory Council on Health Infrastructure incorporates protective language, and the Minister of Health's comments to the Privacy Commissioner are encouraging. Again, our hope is that the Minister's formal response will support privacy recommendations as strongly as they deserve.
We have recently seen a Private Member's Bill to establish a Patients' Bill of Rights, introduced in the House of Commons by Greg Thompson of New Brunswick, the Progressive Conservative Party's health critic, and we have seen yesterday, Senator Sheila Finestone's discussion paper on a Canadian "Charter of Privacy Rights". These are clear signs that MPs and Senators are becoming much more aware of the public's concern for health privacy issues.
The recently launched Senate's Standing Committee on the state of the health-care system in Canada will also offer an excellent opportunity to raise some critical points about privacy.
And we also hope that the Canadian Institutes of Health Research seize this opportunity to establish a fully independent advisory committee on ethical, legal, socio-cultural and policy dimensions of research funded by the organization. We would hope that patient privacy and the confidentiality of health information would feature front and centre in any such discussion.
So in answering the question of are we moving toward consensus, I feel there are still too many issues to resolve to be more optimistic than a reply of "Not Yet". But our office will continue to monitor developments that affect health information privacy fairly closely and will gladly be part of the debate. We would propose to become more educated ourselves about the issues and, in so doing, perhaps develop a health privacy resource centre as part of our mission to be a centre for research, education and information on all privacy issues. As well, we will promote the kind of process instituted by Senator Finestone of bringing the debate to the people.
In the end, all of us need to come to the table - this debate is not the exclusive property of physicians and researchers, or health professionals and privacy advocates - it is a debate for everyone. To paraphrase the great democratic thinker, Daniel Yankelovich, reason is not the exclusive property of so-called experts - it is more humble, more universal and more democratic than that.
The goal is communicative action - permitting us to understand each other well enough so that the common goals and values are possible - a dialogue among public, experts and leaders in which there is give and take, two-way communication rather than monologue, and the genuine encounter among all stakeholders.
Given emerging events, I think that all of us can be reasonably optimistic about reaching a consensus on health privacy, so long as the dialogue is open, and so long as it is broadly representative of all Canadians. Thank you.
- Date modified: