Information and Privacy Commissioner report highlights need for a custodian to evaluate its access to information program

Tue, Jan 21, 2020

WHITEHORSE – The Yukon’s Information and Privacy Commissioner (IPC) has issued a consideration report after a Yukoner complained about the length of time it took for the Department of Health and Social Services to respond to a request for access to the complainant’s own personal health information. Diane McLeod-McKay found that the department did not meet its obligations under the Health Information Privacy and Management Act (HIPMA) in regard to access. She recommended the department provide the remaining records to the complainant.  The department accepted her recommendations.

The complainant made a request in August 2018 for access to their continuing care and home care records. Under HIPMA, the department had until September 14, 2018 to respond with the requested records. Instead of providing the records by that date, the department sent a registered letter to the applicant, stating that it was extending the timeline until November 13, 2018, citing a section of HIPMA that allows an extension when meeting the first deadline would unreasonably interfere with department operations. However, no records were provided by November 13. A few days later, on November 22, a complaint was made to the Office of the Information and Privacy Commissioner.

“In looking at the evidence in this case, I found that the department did not have authority to extend the timeline for responding to the access request and did not follow the rules set out in HIPMA,” said McLeod-McKay. “For example, the department did not provide any evidence to show that meeting the access request by the first deadline would unreasonably interfere with its operations, nor did it show that it had exercised its discretion in deciding whether to extend the response deadline.”

The consideration report describes how the applicant pursued the access request via emails and in-person meetings and was told that the department “had been very busy, that it had a lot of record requests and that it had to spend time fairly on the other requests”. The report notes that some of the records were provided to the complainant in four different “interim responses”, in printed and digital form, between November 2018 and March 2019. However, the entire set of records had still not been provided by the time the IPC considered the matter.

In addition to recommending that the department provide the remainder of the requested records, McLeod-McKay recommended that the department provide the complainant with reasons for any refusal of records. She also recommended that it develop a policy for handling these types of access requests, that staff are trained on the policy, and that the department evaluate its human, technical and financial resources to determine if they are sufficient to meet the operational demands of processing, within legislated timelines, the volume of access requests it is receiving.

“Privacy rights afforded to individuals under HIPMA include the right to access one’s own personal health information that is in the custody or control of a custodian such as the Department of Health and Social Services,” said McLeod-McKay. “HIPMA establishes this right of access and requires the custodian to meet specific obligations in terms of providing a response, including that it must do so in accordance with the timelines set out in the legislation.”

McLeod-McKay experienced a number of challenges when dealing with the department on this file in regard to its response to the recommendations, including missed deadlines, lack of responses to correspondence, and what appeared to be modifications by the department to accepted recommendations. “These issues are cause for concern,” said McLeod-McKay. “Health and Social Services is Yukon’s largest custodian and processor of personal health information. A lack of compliance with HIPMA has significant implications for Yukoners. If a custodian accepts IPC recommendations made in a report, it is obligated to implement them as written.  Failure to do so undermines the purposes of HIPMA.” 

The Ombudsman, Information and Privacy Commissioner, and Public Interest Disclosure Commissioner is an independent officer of the Yukon Legislative Assembly. For more information, please go to http://www.ombudsman.yk.ca/.

To view Consideration Report HIP18-24I, click here.

To view correspondence related to this file, click here.

Contact:  

Elaine Schiman, Communications Manager

Office of the Yukon Ombudsman, Information and Privacy Commissioner & Public Interest Disclosure Commissioner                   

elaine.schiman@ombudsman.yk.ca                                                        867-332-4555 or 867-334-2975

www.ombudsman.yk.ca                                                                             Follow us on Twitter