Information and Privacy Commissioner report highlights need for discretion before using highly sensitive personal health information

Tue, Jan 21, 2020

WHITEHORSE – The Yukon Information and Privacy Commissioner (IPC) has found that the Department of Health and Social Services violated the Health Information Privacy and Management Act (HIPMA) when it failed to exercise discretion before using the personal health information of a patient under psychiatric care. Diane McLeod-McKay made two recommendations to ensure the department would meet this requirement in the future.

McLeod-McKay has completed a consideration report into four complaints brought by a Yukoner in October 2018. The complainant alleged that the custodian (Health and Social Services) violated HIPMA by using, disclosing, and retaining their personal health information without following HIPMA’s requirements and because an agent of the department accessed their personal health information without authorization. The IPC found the complaints about disclosure, retention and unauthorized access to be unsubstantiated. In regard to the complaint about the use of personal health information, she found one aspect of the complaint to be substantiated.

“HIPMA gives a custodian discretion to use an individual’s personal health information to provide health care, unless the individual expressly refuses or withdraws their consent to the use,” said McLeod-McKay. “In my consideration of this complaint, I found that the department had authority to use the complainant’s personal health information to provide the complainant with psychiatric care but that it failed to exercise its discretion about the use.” 

McLeod-McKay noted that it is not enough for a custodian to determine it has authority to use personal health information. The authority to use this type of information under HIPMA includes the word “may,” so any use of personal health information by a custodian must only occur after it determines it has authority and it exercises its discretion about whether to use it. 

The IPC stated that “a factor in exercising discretion when using personal health information to provide health care is whether any harm ‘could or may’ come to the individual or another person as a result of the use.” She commented in her report that “had the custodian exercised its discretion as required, it may have decided not to use the complainant’s ‘very personal information’ for the purposes of the consult, after taking into account the complainant’s interests and evaluating whether they may suffer harm from its use.”

McLeod-McKay recommended to the department that it provide training to its employees on the requirement under HIPMA to exercise discretion prior to using personal health information in its custody or control. She also recommended that the department inform her within 90 days of receiving her report about the steps it has taken to meet the first recommendation.

The department accepted the recommendations but did not provide the IPC with information demonstrating it met them, despite numerous attempts by McLeod-McKay’s office to obtain this information. If a custodian fails to follow a recommendation that it accepted, the complainant has a right of appeal to the Yukon Supreme Court within six months of the IPC’s report being issued. The six-month appeal period expired in December 2019. The IPC informed the department on November 1, 2019 that she was of the view the recommendations were not followed. In a letter dated November 7, 2019, the complainant was informed that the department did not follow the recommendations and about their right of appeal.

The Ombudsman, Information and Privacy Commissioner and Public Interest Disclosure Commissioner is an independent officer of the Yukon Legislative Assembly. For more information, please go to http://www.ombudsman.yk.ca/.

To view Consideration Report HIP18-19I, click here.

To view correspondence related to this file, click here.

Contact:

Elaine Schiman  

Communications Manager

Office of the Yukon Ombudsman, Information and Privacy Commissioner & Public Interest Disclosure Commissioner                   

elaine.schiman@ombudsman.yk.ca                                          867-332-4555 or 867-334-2975

www.ombudsman.yk.ca                                                            Follow us on Twitter