Epiq Systems, Inc.

Important to understand provincial differences in health privacy law

It is important for businesses and all health-care providers to understand their legal obligations when it comes to the protection of private health information, says privacy and information lawyer Sara Levine.

“The legal responsibilities aren’t the same across the country so an organization can’t assume if they are complying with the law in the province where they are based, that they are automatically compliant in another province,” she tells AdvocateDaily.com. “They have to be aware of the laws in all provinces where they do business.”

Levine, who practises in association with Alliance Lex Law Corporation, says in addition to hospitals and clinics, there are hosts of companies that manage patient information, including those that set up appointments for health-care providers, companies that handle billing software for health-care providers, temp employment agencies for the health-care sector, marijuana dispensaries, and others. 

Levine comments on the issue after a CBC News investigation found that six provinces — with a combined population of about 20 million — have no legislation in place requiring hospitals, doctors and other health-care providers to notify patients of a breach of their medical files.

B.C., Alberta, Saskatchewan, Manitoba, Quebec and P.E.I. don't have this kind of requirement right now; but it’s noteworthy that Ontario, Alberta and P.E.I. have passed legislation that, once implemented, will make it a requirement, says CBC.

This patchwork of regulatory requirements exist even as the personal health information of hundreds of patients is breached across the country every year. 

Such privacy breaches can be someone “snooping” when they have no authority to access the patient information or it could mean the patient information was sent to the wrong person. It could also involve the theft of patient information for profit. 

“The information CBC News gathered from privacy watchdogs and health authorities from across the country suggests there were more than 1,300 breach reports in 2015, compared to 922 in 2014. The numbers include provinces where custodians of health information don't have to report breaches to their respective privacy watchdogs,” says the article.

Levine explains the requirements around private health information are different across the provinces because health is a provincial jurisdiction and each province makes its own laws around health, for the most part.

“Many provinces have chosen to make privacy laws that are specific to health information and they regulate that separately from other kinds of private information; not every province has made that choice,” she says. “Some provinces have general private-sector privacy laws so everybody working in the private sector is covered by the same privacy law and that includes your car dealership and your doctor’s office.”

Levine says it’s important to note that physicians are considered private sector but bill a public-sector insurer.

“So every health-care provider in provinces that don’t have a health information privacy law are covered under the general privacy law,” she says. “If they are in a province with a health information privacy law of some kind, they may be subject to that, depending on the application of the law. The landscape shifts, depending on which jurisdiction you are in.”

Levine notes every jurisdiction in Canada has some kind of privacy law that imposes a minimum level of privacy protection.

She says businesses that handle private health information have to remember that even in those jurisdictions where there is no requirement to report now, that may change in the future. 

“And there is a difference between notification of the breach to the individual and notification to the privacy commissioner,” she says. “Some jurisdictions have mandatory breach reporting to the individual and not the commissioner. Other provinces say you have to notify the commissioner or you might have to do both, depending on the law.”

Levine says it's key to know where those differences lie in the provinces. 

To Read More Sara A. Levine, Q.C. Posts Click Here
Lawyer Directory
BridgePoint Financial Services (post to 5.31.19)Toronto Lawyers Association (post to 6.30.19)MKD International (post until Sept. 30/18)Feldstein Family Law (post until May 31/19)Legal Print & Copy Inc.Stancer Gossin Rose Lawrence ForstnerGelman & Associates