Privacy commissioner still waiting two years later for amendments to health information privacy laws

Two years ago, Saskatchewan'sprivacy commissioner proposed several amendments to laws concerning protection of personal health information in Saskatchewan.

On Wednesday he noted many of his proposed amendments to theHealth Information Protection Act (HIPA) were never made.One of the goals of his office this past yearwas to work with the Ministry of Health to develop new legislation, but no progress was made.

"I think it's very concerning," said Ronald Kruzeniski, who is the Saskatchewan information and privacy commissioner.His office released its annual report Wednesday.

He proposed the changes in 2016to helpcitizenshave better access to their personal health information, while also increasing the protection of the data.

Recommendations covered a swath of potential improvements from transparency to increasing personal privacy to the transference of patient data to keeping pace withdigital technology.

• Saskatchewan adopts anti-snooping law for health records

Kruzeniski said his office will continue to advocate for change through speeches, presentations and individual reports, but that's all they can do.

"There is nothing the office can do beyond issuing recommendations."

Privacy act predates many current technologies

Kruzeniski noted HIPA is 15 years old, having been established in 2003, and has not undergone a top to bottom overhaul. He said any legislation that's more than ten years old deserves a closer look.

In an emailed statement, ahealth ministry spokesperson saidHIPA was "originally and intentionally drafted to protect personal health information in all forms and did not speak to specific technologies."

Furthermore, they said the ministry is committed toreviewing recommendations for future amendments to HIPA and its regulations and that it iscontinuously working to improve its existing privacy framework.

The spokesperson said the ministry "will work with relevant stakeholders to undertake an analysis and examine recommendations made by the Information and Privacy Commissioner" and other agencies.

Increase in privacy commission reviews

The privacy commissioner's annual report said110 individual reports had been issued to government institutions, local authorities and trustees in the 2017-18 period.

Those on the receiving end of recommendations are required to respond to the office within 30 days of receiving the report.

They can reject or accept all or some of the recommendations. Five bodies didn't respond at all. They were the Ministry of Justice, R.M. of McKillop, Keewatin Yatthe Regional Health Authority, North-East EMS and Regina Physician Group.

"I would like that portion of our report to be blank, so to that extent it is concerning," Kruzeniski said. "We only have the ability to make recommendations. We don't have the ability to order somebody to do something."

Twelve per cent of those who received recommendations said they wouldn't comply and 29 per cent indicated they would partially comply. If a response isn't issued, the FOIP applicant can take the organization to court.

Regarding the office's plan for 2018-19, the privacy commissioner wants to see publicly funded landlords be subject to freedom of information requests.

He also advocated guidelines for health professionals who use cellphones, as well as best practices for the use of memory sticks. It also plans to develop a report regarding the use of computer backup tapes.

The office saw a six per cent increase in reviews, investigations and consultations this year compared to last.

Kruzeniski said there's likely a multitude of factors but noted the inquires into theGlobal Transportation Hub land deal that involved multiple ministries on a local level.

• $180K for GTH documents 'excessive' and 'unreasonable,' says commissioner
• Confused about the GTH land deal? Here's a short explainer video
• CBC's full coverage of the GTH land deal

He also said awareness of Edward Snowden, the FBI-Apple dispute that followed the San Bernardino terrorist attack and the Facebook-Cambridge Analytic privacy concerns have increased public consciousnessabout data collection.