Canadian Privacy Laws and Practices—Health Sector Flashcards
Which provincial health laws have been deemed “substantially similar” to PIPEDA?
Ontario (PHIPA), New Brunswick (PHIPAA), Newfoundland and Labrador (PHIA) and Nova Scotia (PHIA)
What defines Personal Health Information?
Any information concerning an individual’s physical and mental health, which includes information collected about individuals when they register to receive health services or pay for health services
What makes the collection, use and disclosure of PHI is necessary?
Organizations are prohibited from collecting personal information beyond what is necessary to achieve the specified purpose.
The collection, use or disclosure is also limited to “purposes that a reasonable person would consider to be appropriate in the circumstances”
When can an individual access and correct personal health information?
In most instances when making a request. Each Health Law provides individuals with with the right to access their own health information held by the entities covered by the law. In most instances, the right also includes a right to correct or amend inaccurate information.
What do HINP do?
Health Information Network Providers enable custodians to share PHI by electronic means by providing them with IT services.
What is identifying information?
In Ontario, identifying information means (1) identifies an individual or (2) reasonably could be utilized, either alone or with other information, to identify an individual.
What does oversight mean in Health Privacy law?
Each law provides that an independent agency, such as the privacy commissioner, has
independent oversight of the entities covered by the law. The role of the oversight body
is, among other things, to review and resolve complaints from individuals who believe
their rights were violated.
How does Health Privacy Law ensure proper use, retention, safeguarding and disposal of PHI, including third parties
Through Accountability - the onus is on the entity covered to remain accountable for the proper use, retention, safeguarding and disposal of the health information under its custody or control. Remains even with outsourced third parties or agents.
How does one ensure meaningful consent to the collection, use, and disclosure of PHI?
(1) It must be the consent of the individual concerned, (2) it must be knowledgeable, (3) it must relate to the information at issue, and (4) it must not be obtained through deception or coercion.
“Knowledgeable” consent requires the individual to fully understand the purpose for which the information will be collected, used and disclosed or all three.
When implicit/implied consent is considered appropriate?
An individual will have deemed to have implicitly consented to the collection, use and disclosure of their information within their circle of care.
What constitutes the circle of care for an individual and who may act as a custodian or trustee for that individual?
In Ontario law allows most healthcare providers and facilities that receive personal health information about an individual from (1) that individual, (2) the individual’s substitute decision-maker, or (3) another health information custodian to imply consent to collect, use or disclose the information for the purpose of providing healthcare or assisting in the provision of healthcare to the individual, except in circumstances where the recipient custodian is aware that the individual has expressly withheld or withdrawn the consent.
How does a HIC ensure safeguarding ?
Requires the organizations to adopt reasonable administrative (training/policies), technical (password, updates to software) and physical safeguards (safe or camera) that ensure confidentiality, security, accuracy and integrity of the information.
Openness for Health Privacy Law?
The provincial laws do not strictly adhere to the same standards as federal privacy laws in terms of an organization’s obligation to develop comprehensive privacy policies and make them accessible; however, in practice, the commissioners overseeing these laws expect it. Ontario, Newfoundland and Labrador, and British Columbia have laws that more closely resemble the general privacy principle of openness. In these provinces, health information custodians are required to make available information that describes:
* The health information custodian’s information practices
* How to contact the appropriate health information custodian
* How to obtain access to or request correction of personal health information (except for British Columbia)
* How to file a complaint
How does a HIC respond to a PHI data breach?
Provincial privacy legislation mandates that the custodian must notify the appropriate privacy commissioner in situations where a custodian reasonably believes there has been a material breach involving the unauthorized collection, use or disclosure of personal health information
* Includes any instance where health information is handled in a way that does not conform to the custodian’s published policy statement on its information-handling practices.
Examples - Missing USB Key
How does an organization ensure Openness?
Develop comprehensive privacy policies and make them accessible according to
PIPEDA or provincial law as applicable
