Guide on use, disclosure of personal health information for broader public health purposes released

The Information and Privacy Commissioner of Ontario has released a publication covering the use and disclosure of personal health information for broader public health purposes, seeking to promote understanding of the applicable provincial legislation.

The new publication aims to build confidence in the digital health care system by guiding custodians to respect Ontarians’ privacy and access rights and by supporting the use of personal health information for research and analytics in service of the public good, said commissioner Patricia Kosseim. This is in line with one of the commissioner’s four strategic priorities, which is trust in digital health.

The publication discusses how the Personal Health Information Protection Act, 2004, SO 2004, c 3, Sch A (PHIPA) allows the use or disclosure of personal health information for broader public health purposes, with permitted purposes including the following: conducting research; planning, evaluating and managing the health system; maintaining an information registry for the better provision of health care; and protecting and promoting public health.

The PHIPA allows the collection, use or disclosure of personal health information without consent for research purposes, subject to certain conditions in s. 44. As for the management, evaluation, monitoring, resource allocation or planning of the health system, custodians may disclose personal health information to certain prescribed entities who will analyze or compile such statistical information.

With respect to the maintenance of a registry for personal health information, custodians can also disclose information to certain prescribed persons. Lastly, the protection and promotion of public health may involve certain disclosures to the chief medical officer of health, to a medical officer of health or to Public Health Ontario.

According to Kosseim, benefits of the PHIPA include facilitating the sharing of key health data to tackle obstacles and opportunities, the integration of data access conditions with research ethics review and the improvement of regulatory oversight and accountability with respect to certain designated health research organizations and registries.

The province can further benefit from the upcoming amendments to the PHIPA relating to de-identification, electronic audit logs, consumer electronic service providers and administrative penalties, Kosseim said. These changes may assist the province in its continuing efforts to achieve its public health objectives and to safeguard Ontarians’ privacy.

Kosseim called attention to the recent report of the Expert Advisory Group on the Pan-Canadian Health Data Strategy, chaired by Dr. Vivek Goel, which has discussed pertinent issues impacting the success of the health data strategy, including the lack of trust and clear accountability, a culture of risk aversion and avoidance, misaligned incentives and a lack of common vision, an antiquated data policy environment and limited public insight and involvement.

While the report did not name privacy legislation as an issue, it pointed out that a lack in understanding of personal health information legislation and inconsistencies among such statutes across different jurisdictions may aggravate the problem.