The audience laughed when Ontario Information and Privacy Commissioner Ann Cavoukian said she got called on a weekend over a major privacy breach. “I don’t know how they got my home number,” she said teasing.
Cavoukian rushed downtown to Toronto’s Wellington Street to find thousands of patient health records strewn around as part of a set for a mini-series on 9/11. The production company had asked a recycling company to provide some paper for the scene. That they did.
Upon investigation, Cavoukian found that the health care provider had made an error, sending the documents to recycling instead of shredding.
After her story she said it was the CBC who tipped her off and that she had voluntarily given her number to the reporter. No breach after all.
The story was one of many as Cavoukian spoke October 25 at the Longwood’s Breakfast with the Chiefs forum at the University of Toronto.
Cavoukian says that you can avoid privacy by disaster by following privacy by design – by building systems intentionally with security in mind.
It’s possible your health records are being used at this moment without your consent.
Health records are a valuable source of information for health research, population health monitoring, quality improvement and as evidence to inform management of our health system.
Ontario’s Information and Privacy Commissioner notes, in a new report released March 2nd, that such information is often used and disclosed to researchers in a form in which patients are identifiable. This is because the original health provider lacks the resources or capacity to “de-identify” the records before making it available, especially when the documents are paper-based. Even when data from electronic health records (EHRs) are de-identified, some researchers have found it is sometimes possible to re-identify individuals from the anonymous data.
Ontario’s Personal Health Information Protection Act (2004) permits certain secondary uses of information contained in these records without consent from the individual.
Ann Cavoukian, Ontario’s Information and Privacy Commissioner has called upon the province to regulate the amount doctors and other health care providers can charge to provide patients with copies of their health records.
Cavoukian writes that “access to one’s own records of personal information is a cornerstone of fair information practices and privacy legislation. In the context of health care, the right of access enables individuals to determine what shall or shall not be done with their own bodies, to exercise control over the collection, use or disclosure of their own personal health information, and to require the correction or amendment of that information.”
While the McGuinty government did draft a regulation around such fees in 2006, it was never passed.
A patient complained to the Commission about a $125 fee charged by her physician for access to 34 pages of her records. They found $125 to exceed “reasonable cost recovery” and ordered the physician to reduce the fee to $33.50. The Commission arrived at the fee by suggesting $30 be charged for the first 20 pages to cover time for the doctor to review the information, and 25 cents per page be charged beyond that.
Health Minister Deb Matthews said she didn’t believe the problem to be widespread, but said she would talk to the Ontario Medical Association about it.
Creeping charges related to access to health care is becoming a growing issue.
A few years ago Vector conducted a poll in which the majority agreed that the high cost of parking at hospitals constituted a health care user fee.
If you want to find the most expensive place to park in any town or city, it’s usually the hospital. We have seen ridiculous attempts by hospitals to protect that revenue such as erecting fences to prevent people from walking from nearby free parking lots. Municipalities have been forced to limit parking in nearby neighborhoods as patients and their families try and avoid the high fees.
The high parking fees have also been used as an argument by some hospitals for divesting services elsewhere in the community.