HEALTH INFORMATION ACT (HIA) BILL QUESTIONS AND ANSWERS

Transcription

1 HEALTH INFORMATION ACT (HIA) BILL QUESTIONS AND ANSWERS KEY HIA CONCEPTS AND PROVISIONS Q. What is the purpose of the legislation? To protect clients personal health information. To set rules on the collection, use and disclosure of personal health information that health care providers must follow. To have rules that enable improved care to clients, while still protecting client privacy appropriately. Q. What is Personal Health Information? Information about an identifiable person that relates to their physical or mental health and health services provided. It includes the person s: o Health care plan number; o treatment and chart information; o test results; o information collected and used to determine program and service eligibility and registration; o billing and payment information. Q. What are custodians? Custodians is the legal term for the Department of Health and Social Services, Health and Social Services Authorities, private pharmacists and private physicians. Others may be designated in the future. Custodians are usually those health care providers that play a key role in the core health system and in circles of care. Q. What are agents? Agents are those employees, volunteers, appointees, contractors, and information managers acting on behalf of a custodian. Physicians and pharmacists when employed or contracted by the Department of Health and Social Services, an Authority, or another private custodian are agents and not their own custodians. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 1 of 9

2 Q. What are information managers? They manage and store information, transform information, or provide information technology, system and management services on behalf of someone. The Technology Services Centre (TSC) and the Yellowknife Health and Social Services Authority are information managers. Q. What is the circle of care? The circle of care refers to the group of health care providers involved in a specific patient s care. The HIA allows for the sharing of information within a patient s circle of care as necessary without asking for the patient s further consent each time the information is shared. However, health care providers must still respect any express instructions from a patient that their information not be shared with, for example, their community counsellor. The Act does not specifically refer to a circle of care. Q. What is implied consent versus express consent? When do you need consent? Implied consent occurs when the patient shares their health information with a health care provider in the course of a regular check-up. When sharing information within a circle of care or for reasons set out under the HIA (billing, health system and internal management, inspections) health care providers can assume they are covered by the initial implied consent, so long as the patient has not explicitly stated otherwise. Express consent must be written except where circumstances allow for a verbal express consent to be recorded. The main example of when express consent is needed is for research. Express consent is required when a health care provider shares information outside the circle of care or outside of the reasons allowed under the HIA. Q. What is authorized use, also known as secondary use? Authorized/secondary use refers to the concept where information collected as part of providing a health service can be used for another purpose as well. It can be used for purposes set out in the HIA, such as to verify billing and benefits eligibility, for internal and health system management purposes, to provide information to another member of the circle of care, or for health promotion. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 2 of 9

3 Q. What is the role of the NWT Information and Privacy Commissioner (IPC)? The IPC provides an oversight role for the HIA, similar to the role provided under ATIPP. The ATIPP IPC is automatically the HIA IPC as well. The IPC has recommendation-making powers under the HIA to review and make recommendations. WHY HAVE THE HIA Q. Why do we need this legislation? To provide better care to clients, we need to allow information to be easily shared between Health and Social Services Authorities, the Department of health and Social Services, and external health care providers such as pharmacists and private physicians. As the health sector grows and adopts electronic health systems, we need to recognize and respond to increased privacy risks. Q. What does this legislation mean for the public? It better protects the privacy of your personal health information. It allows for efficient exchange of charts, test results, prescription information, and other health information within your circle of care to improve how you receive health services. Q. How does the HIA better protect patient privacy? ATIPP has limited privacy and security safeguard requirements. Because the HIA allows for easier flow of information, the Act requires tougher safeguard measures to ensure patients privacy is protected appropriately. Custodians are only allowed to share information that is absolutely necessary. Custodians are required to follow privacy and security policies and standards based on nationally and territorially recognized standards appropriate for highly sensitive information. Custodians must put in place access controls, such as role-based access to electronic health information systems, to ensure only those health care providers who have a legitimate reason to view someone s personal health information are able to see the information. Custodians are required to notify an individual and follow certain protocols if a privacy breach occurs. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 3 of 9

4 The Department of Health and Social Services and Health and Social Services Authorities are required to complete Privacy Impact Assessments (PIAs) when they propose new or make changes to existing information systems and communications technologies, and these Assessments must be shared with the Information and Privacy Commissioner. Q. What does the Act mean for the health system? The HIA facilitates a circle of care for each patient made up of core health care providers. Information may be shared more easily to provide seamless care to clients. The HIA allows the Department of Health and Social Services and Health and Social Services Authorities to gather information for internal and health system management purposes. Using this information the Department and Authorities are able to develop and deliver evidence-based programs and services that better meet the needs of NWT residents. For example, our chronic disease prevention and management teams will be able to work together to provide better support and care to their patients. They will be able to compile information to identify trends in chronic disease cases and determine improved methods of early intervention and clinical care. Q. Does having the HIA let us share patient information with Alberta and Nunavut more easily? The HIA facilitates improved sharing of patient information with Alberta and Nunavut. WHAT THE ACT APPLIES TO Q. Does the HIA apply to just medical care? Does it apply to mental health and addictions services? Does it apply to community counselling services? The HIA applies to health services, including mental health services. In order for the health system to better address mental health and addictions as inter-related, the HIA also applies to addiction services and mental health counselling services. Q. Does it apply to how patients and health care providers make treatment decisions? No. The HIA is about the handling and management of patient information. In no way does it set up rules on how treatment decisions are made. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 4 of 9

5 Q. Does the HIA apply just to the public sector or the private sector as well? The HIA applies to the Department and Authorities, as well as private pharmacists and private practice doctors, such as Medical Directors at mines. Others may be designated in the future, for example perhaps emergency medical services (EMS) providers. Q. Does the HIA apply to electronic records? What about hard copy records? Yes, this legislation applies to all records, whether in paper or electronic form. Q. How does this legislation relate to the Electronic Medical Record (EMR) system, interoperable Electronic Health Record (iehr) system, and other ehealth systems? It allows for the easy sharing of information between health care providers from different organizations through the EMR, iehr and other ehealth systems. It requires us to establish administrative, technical and physical safeguards related to electronic health information systems to properly protect patient privacy. Whenever we start work on a new ehealth system, we will be required to carry out a privacy impact assessment. Q. Would my personal health information ever NOT be covered by this legislation? Yes. It only applies when personal health information is collected for health services and is kept by the Department of Health and Social Services, a Health and Social Services Authority, a private pharmacist, or private physician. Personal health information in child and family services records and adoption records is not covered by the HIA. Health information that appears in human resource personnel records and professional licensing files is not covered by the HIA. HIA, ATIPP AND WHAT TAKES PRECEDENCE Q. Doesn t the Government already have privacy legislation? The NWT also has the Access to Information and Protection of Privacy Act (ATIPP). ATIPP is not specific to health information and does not apply to private physicians and pharmacists. It does not meet the sharing of information needs of the health system. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 5 of 9

6 Q. Do the Department and Authorities still need to follow ATIPP? The Department and Authorities still need to abide by ATIPP outside the health services context. For example, public records such as contracts and records of decisions will still be governed by ATIPP. Q. How does the HIA differ from ATIPP? The HIA deals with an individual s personal health information, whereas ATIPP focuses on setting rules around public access to government records. ATIPP applies to public bodies; whereas the HIA applies to public and private persons and organizations whose primary purpose it is to deliver health services to Northwest Territories residents. Routine access to your own medical record was not envisioned under ATIPP. The HIA regulates the routine disclosures currently occurring to better ensure the proper protection of patient privacy. Under ATIPP, any party can request access to certain government records; whereas the HIA is focused on granting access to patients and health care providers. Q. What happens when someone wants access to a record that includes personal health information covered by the HIA as well as information covered by ATIPP? When someone wants access to a record covered by both the HIA and ATIPP, the person processing the request would split the request into two and follow both the HIA and ATIPP. Q. Does ATIPP prevail? Will any legislation override the HIA? The HIA prevails over ATIPP. Parts of the following will override the HIA: o Elections and Plebiscites Act, o Guardianship and Trusteeship Act, o Jury Act, o Maintenance Orders Enforcement Act, o Mental Health Act, o Public Health Act, o Vital Statistics Act, and o Workers Compensation Act. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 6 of 9

7 CONSULTATION Q. Who did the Department of Health and Social Services consult with on the development of this legislation? The Department of Health and Social Services consulted with the: o Information and Privacy Commissioner (IPC); o NWT Medical Association; o NWT Pharmacy Association; o Registered Nurses Association of the NWT and Nunavut; o Canadian Medical Protective Association; o Canada Health Infoway; o Health and Social Services Authorities; o Clerk of the Legislative Assembly; and o Departments and Agencies affected by necessary consequential amendments to their respective pieces of legislation as a result of the HIA: Department of Justice; Workers Safety and Compensation Commission; and Chief Electoral Officer. HEALTH CARE PROVIDER TRAINING Q. What training has been delivered to health care providers? The Department has had great uptake on in-person HIA training being delivered to health service providers across the Northwest Territories (NWT). The HIA in-person training has been delivered in Yellowknife, Hay River, Inuvik, Fort Simpson, Norman Wells, and Fort Smith, to both private and public health service providers. Community Date Yellowknife June 23-25, 2015; September 14-15, 2015; September 23-24, 2015 Hay River August 11-12, 2015 Inuvik August 31 September 2, 2015 Fort Simpson September 10-11, 2015 Norman Wells September 21-23, 2015 Fort Smith September 28-29, 2015 DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 7 of 9

8 Q. What training materials are available? The Department has developed a plain language HIA Guide, which is being distributed to health care providers across the NWT. In-person training materials are available. The Department is also finalizing a Privacy Risk Toolkit and online short tutorials to accompany the HIA Guide and in-person training, as resources to help health care providers comply with the Act. Q. Will there be more training in the future? Yes, the Department will provide ongoing HIA training in the future. In addition, part of the in-person training available is a Train the Trainer module, giving each custodian under the HIA the resources required to carry out further internal training. LOOKING TO THE FUTURE Q. What work is the Department focused on now? The ongoing work that will be carried out by the Department includes: o Updating and monitoring health privacy and security policies, including privacy breach protocols for the Department and Authorities; o Administration and enforcement of the HIA for the Department, Authorities, private physicians and pharmacists; o Ongoing health privacy training for the Department, Authorities, private physicians and pharmacists, and updating of the HIA Manual; o Annual preparation of the Government Response to the Information and Privacy Commissioner s Annual Report on the HIA; o Review of mandatory privacy impact assessments; o Auditing and monitoring of e-health systems and privacy practices; o Participating in a health information governance committee; o Privacy and security advice to private physicians and pharmacists; o Collaboration with private physicians and pharmacists on records retention schedules that harmonize with GNWT records retention schedules. Q. Will the Department of Health and Social Services pursue PIPEDA substantial similarity status? Yes, once the HIA has been brought into force, the Department of Health and Social Services will contact Industry Canada to apply for this status. The HIA is drafted to be substantially similar to PIPEDA, using a Pan-Canadian model, to ensure we get this status. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 8 of 9

9 Q. What are the implications of the HIA receiving federal Personal Information Protection and Electronics Document Act (PIPEDA) substantial similarity status? Currently NWT public bodies follow ATIPP and private pharmacists and physicians follow PIPEDA. When we bring the HIA into force, private pharmacists and physicians would have to abide by both PIPEDA and the HIA, unless we get substantial similarity status. This status would allow private pharmacists and physicians to abide by just the HIA, and not PIPEDA as well. This would reduce the regulatory burden for private pharmacists and physicians and ensure all custodians designated under the HIA follow the same privacy framework. LEGISLATION OF OTHER PROVINCES AND TERRITORIES Q. Do other provinces and territories have similar legislation? Alberta, Saskatchewan, Manitoba, Ontario, Newfoundland and Labrador, New Brunswick, Nova Scotia, British Columbia and Quebec have similar legislation. PEI and Nunavut do not. Yukon introduced their Health Information Privacy and Management Act Bill on the same day as the NWT introduced the HIA Bill. The Act was passed later that session. DEPARTMENT OF HEALTH AND SOCIAL SERVICES Page 9 of 9