Privacy review finds personal information protections lacking at B.C. medical clinics

Medical clinics throughout British Columbia need to do more to protect the often highly sensitive personal information in their possession, according to a new report from the Office of theInformation and Privacy Commissioner.

TheOIPCreport, looking at how nearly 2 dozen B.C. medical clinics aremeeting their legal obligations under the Personal Information Protection Act, found that privacy protections are lacking.

OIPC auditors examined 22 clinics and found gaps in privacy management programs at several clinics, including the absence of a designated privacy officer, a lack of funding and resources for privacyand a failure to ensure that privacy practices keep up with technological advances.

Privacy Commissioner Michael McEvoy said the report raises concerns about patient privacy that are relevant throughout the province.

"Medical clinics were chosen for this review for two reasons: the amount and sensitivity of the personal information they collect, some of the most sensitive personal information out there," McEvoy said.

"Doctors and staff at clinics not only owe it to their patients to do their utmost to build and maintain strong privacy programs, but they are also legally obligated to abide by privacy legislation."

Report recommendations

The report makes several recommendations including that clinics build robust privacy management programs that considerhowpersonal information inventories andprivacy policies are created, ensureadequate funding and resources for effective privacy management programsand that each clinic designatesa privacy officer and establishes and communicates clear internal reporting structures on privacy issues.

The Office of the Information and Privacy Commissionerprovides independent oversight and enforcement of British Columbia's access and privacy laws.