News Release: IPC and YHC at odds over the disclosure of health care information

Tue, Jan 15, 2019

NEWS RELEASE
FOR IMMEDIATE RELEASE
JANUARY 15, 2019

IPC and Yukon Hospital Corporation at odds over the disclosure of
health care information

WHITEHORSE – Yukon’s Information and Privacy Commissioner (IPC) has issued a Consideration Report into a complaint that the Yukon Hospital Corporation (YHC) failed to follow the rules set out in the
Health Information Privacy and Management Act (HIPMA). She found that the disclosure of the health care records was not authorized under HIPMA. YHC accepted three of the IPC’s recommendations and
rejected one.

The complaint was made in April 2017 by a mother who had delivered her child at Whitehorse General Hospital (WGH). After the birth, she returned home to her community elsewhere in the Yukon and was
contacted by an employee of the community health centre, who had detailed knowledge of her care and treatment at the hospital.

“The complainant was concerned that her health care information had been shared by the hospital corporation with the health centre, without her knowledge or consent,” said McLeod-McKay. “In her
submission to my office, she stated that her experience left her feeling ‘exposed and powerless’. It is essential that custodians of health care information realize that this information goes to the biographical
core of individuals and is the most sensitive personal information that exists. They must, therefore, follow the rules in HIPMA for its protection.”

The YHC argued that the disclosure was done so that the health centre could provide follow-up care to the complainant and her newborn after she left the hospital and that HIPMA gives it authority to
disclose the information without consent for this purpose. The YHC also noted that the Department of Health and Social Services (HSS) has a mandated process, which requires that public health nurses
receive necessary information about mothers and newborns. This information is set out in forms created by Perinatal Services BC, as part of that organization’s best practices. The YHC adopted the use of these
forms and their best practices.

The IPC found that the YHC failed to establish that it disclosed only the heath information necessary for the complainant and her newborn to receive follow-up care by Yukon public health nurses. She
determined during the consideration that YHC shares more information about mothers and newborns with Yukon public health nurses than is shared with public health nurses in BC for the same type of care.
The IPC also found that the YHC had authority to disclose the health information without consent but that it failed to make the complainant aware that her information would be disclosed, which denied her
the opportunity to refuse her consent. “This case demonstrates that seeking consent for collection, use and disclosure of personal health information is the best policy.”

The four recommendations made by McLeod-McKay are below, along with the YHC’s response: 

1) The YHC should take steps to recover or destroy the personal health information disclosed to the health centre. [The YHC indicated that HSS refused to destroy the records because no
breach of personal health information occurred. The IPC has since confirmed that HSS has destroyed the records.]

2) The YHC should continue its work with Perinatal Services BC to determine whether it should change the way it shares personal health information with health centres for moms and
newborns receiving at-home follow-up health care. [YHC has indicated it has completed this work and determined that no changes to its practices are necessary.]

3) YHC should adopt the practice of informing people about this type of disclosure so they may exercise their right of refusal. [YHC refused this recommendation. It argued that it should have
been given the opportunity to submit evidence related to this issue.]

4) YHC should review its practice of disclosing health information as mandated by HSS to ensure it does not contravene HIPMA. [YHC has determined that its practices do not violate HIPMA and
will not be changed.]

The IPC identified a weakness in HIPMA, in that it allows the two largest custodians of personal health information in Yukon, the YHC and HSS (although not any others), to collect personal health information
without consent. This authority bypasses the key measure of control in HIPMA that enables individuals to exercise control over their personal health information. She highlights that HIPMA is unique, noting
that other jurisdictions in Canada do not allow this to occur except in very limited circumstances. She intends to recommend that this authority is removed, when HIPMA is reviewed.

For additional information you can view the full Consideration Report, the Department's April 13, 2018 and April 20, 2018, responses to the recommendations, and its progress on implementation.

Contact:
Diane McLeod-McKay, Information and Privacy Commissioner
867-667-8468
info@ombudsman.yk.ca