LightningPR
Technicity
Artificial Intelligence (272)Auto Tech (9)Blockchain (62)CanadianCIO (17)Careers & Education (606)Channel (59)channel-strategy (4)Cloud (1077)Communications & Telecom (96)Companies (122)Data & Analytics (180)Development (38)Digital Transformation (774)Distribution (10)Diversity & Inclusion (34)eCommerce (139)Emerging Tech (66)End User Hardware (73)Engineering (1286)Financial (802)Fintech (96)Future of Work (29)Governance (19)Government & Public Sector (134)Human Resources (2084)Infrastructure (37)IoT (109)ITWC Morning Briefing (13)Leadership (2686)Legal (314)Legislation (100)Managed Services & Outsourcing (47)Marketing (1960)MarTech (6)Medical (343)Mobility (4994)Not For Profit (6)Open Source (140)Operations (5427)People (15)Podcasts (1398)Posts (4129)Privacy (785)Project Management (76)Security (3020)Service (893)Smart Home (49)SMB (496)Social Networks (423)Software (86)Supply Chain (22)Sustainability (28)Tech in Sports (247)Technology (7114)Women in Tech (49)
CMO News
Calgary-based ad tech company launches latest version of its platform
Samira Balsara -
Coffee Briefing October 25, 2022 – Hootsuite partners with WHO; Sparrow receives C$1 million in funding; Visa's Installments available at Canada's largest retailers; and...
Ashee Pamma -
Coffee Briefing October 11, 2022 – Hootsuite's Heyday announces integrations for Instagram and Messenger; Google Services provided C$37 billion worth of economic activity to...
CMO Talks Podcast
Latest Digital Transformation News
MORE DX NEWS
Paul Barker -
Wipro Canada's AWS Launch Pad Centre now open for business
AI and data management at the forefront of SAS' 2023 IT predictions
Cyber Security News
Cyber Security Podcasts
Cyber Security Today, May 30, 2022 – Canadian and U.S. wireless carriers update their Android utilities, a jump seen in Clop ransomware victims, and...
Hashtag Trending
Suzanne Robicheau -
ALL ITWC EVENTS
SUPERCHARGING HIGH GROWTH TRANSFORMATION
Join us on December 6, 8:30 AM – 10:30 AM (PT) for an exclusive, interactive virtual experience
CITY STORIES
Cavoukian provides check-up on PHIPA 'lockbox'
TORONTO – Ontario's health-care providers shouldn't let the "dreaded lockbox principle" contained in a recently-passed law force them into an IT overhaul, the provincial Information and Privacy Commissioner said Thursday.
Speaking at a one-day summit held to discuss the impact of the Personal Health Information and Privacy Act (PHIPA), Dr. Ann Cavoukian said the principle, which came into effect Nov. 1, means patients can dictate which sections of their medical file are shared. The "lockbox principle" did not apply to hospitals for the first year when PHIPA came into effect because health-care providers said they needed time to get their record-keeping up to speed.
Cavoukian said the principle was designed so that a woman seeing a gynecologist, for example, would not have to pass on irrelevant information about an abortion she had many years ago. In many cases health-care organizations should only expect to see a handful of such requests, she added, and the Information and Privacy Commissioner's (IPC) office does not expect them to make major investments in technology to comply with them.
"You can respond to many of these things in a manual way," she said. "You do not need to completely revamp your computer systems and IT infrastructure . . . the last thing we wanted to do was come up with something that would impede care. This cannot be a burden on the system."
Under PHIPA, patients gained the right to demand access to their health-care files. Health-care practitioners have 30 days, and sometimes up to 60 days, to respond, and there are provisions to force a quicker turnaround on emergency requests. Individual law-breakers can expect to pay up to $50,000, and corporations face charges of up to $250,000 for failing to adhere to the law.
In the year since it was first passed, Cavoukian said her office had received 138 complaints under PHIPA, 83 of which have been resolved and 56 of which are still open. In most cases the IPC attempts to settle complaints at the "intake stage," though she said some move to mediation by the IPC and in more extreme cases to arbitration.
One of the more challenging breaches in year one came when a computer containing two-and-a-half year's worth of health information on thousands of patients was stolen from a private lab, Cavoukian said. There were no backups of the records on any of the lab's hard drives and many of the patients were referred to the lab by area physicians.
"It was like looking for a needle in a haystack," Cavoukian said. "Sometimes when you deal with these things you have to do a lot of detective work."
The IPC responded by sending a letter to area physicians which included a public notice of the incident, along with a letter from the Ontario Medical Association urging them to inform as many potentially affected patients as possible. The notice included a description of the break-in and the police involvement, Cavoukian said. This strategy was in keeping with the IPC's usual approach: to contain the damage, notify those effected, investigate the cause of the breach and to put in measures to prevent it from happening again.
PHIPA's lockbox principle comes into effect as many health-care organizations attempt to create electronic health records (EHRs) that allow information to be exchanged more easily. Alan Westin, author of "Privacy as Freedom" and director of a project on health information and privacy at Columbia University, said that while trust in health-care providers may be high, trust in the data security of patient information is still low. Many patients fear information will be leaked to employers, insurance companies or marketing firms, he said. As EHRs are developed, he said more focus groups and surveys should be conducted to ensure buy-in from those whose information would be at risk.
"So far the establishment of an electronic health record has been a top-down process," he said. "We don't know enough about the patient-eye view of how this is playing out."
Canada Health Infoway president Richard Alvarez said his organization, which is trying to help create a pan-Canadian interoperable EHR by 2009, said legislation like PHIPA may provide patients some of the reassurances they need.
"We will not fund any project that does not conduct a privacy impact assessment," he said, adding that Infoway recently appointed its first chief privacy strategist.
Cavoukian said she was pleased so far at how well organizations are complying with PHIPA, considering it first came into effect only six months after it was passed. The IPC has tried to assist with the learning curve by publishing short notices informing patients of their rights under the act in the form of posters and brochures.
Comment: [email protected]
Ann Cavoukian
privacy commissioner
Telus moves to ADSL2+ technology for IP network
Global leaders debate Internet governance
Coffee Briefing June 28, 2022 – Blueprint Software Systems fully embraces remote...
Samira Balsara - June 28, 2022
Privacy commissioners find Tim Hortons violated privacy laws
Lynn Greiner - June 2, 2022
Legal experts say proposed Canadian privacy law may face 'a lot of...
Howard Solomon - November 25, 2020
Andrew Yang's plan to take back control of Americans' personal data is...
Pragya Sehgal - June 23, 2020
ServiceNow introduces four emergency response apps to help customers manage the COVID-19...
Pragya Sehgal - March 19, 2020
More from Shane Schick
How CMOs and CIOs can foster cross-business unit collaboration
Shane Schick - November 6, 2015
How the West Edmonton Mall uses Microsoft Kinect and your smartphone for...
Shane Schick - February 12, 2015
2013: The year Jeff Bezos gets a toupee
Shane Schick - December 7, 2012
Get ITBusiness Delivered
Our experienced team of journalists brings you engaging content targeted to IT professionals and line-of-business executives delivered directly to your inbox.
ITBWhere Technology Meets Business