Watchdog says eHealth breached privacy by sharing personal information with Elections Sask.

Elections Saskatchewan should not have received personal health information aboutresidents as part of a data-sharing agreement with eHealth, according to a report by the provincial privacy watchdog.

In a reportreleased on June 23, Saskatchewan information and privacy commissioner RonKruzeniski says eHealth had no legislativeauthority to share the information.

• Saskatoon police say no personal information to be shared from 2 new licence plate readers
• 'Culture of caution': Digital world concerns Sask. privacy commissioner

Starting in August 2015, eHealth the provincial agency thatcollects, combines, stores and manages the electronic health records of people in Saskatchewan provided the name, date of birth, health services number, address and residency status of Saskatchewan residents as part of a data-sharing agreement with Elections Saskatchewan.

According to eHealth, no clinical health information was shared with Elections Saskatchewan.

The election management organizationhad been using the information to revise its voter registry, includingkeeping track of deaths andname changes.

Issue uncovered after self-reported breach

The breach was uncovered after eHealth contacted the commissioner's office to report a breach of its own data-sharing agreement.

EHealth had mistakenly released the personal health information of between 50,624 and 83,403 individuals under the age of 16 to Elections Saskatchewan. The agreement was only supposed to apply to people aged 16 and older.

But the self-reported breach raised concerns within the commissioner's office about the overall practice of sharing the information.

An investigation by the privacy commissioner's office, outlined in the June report, found that eHealth did not have the legislative authority to release the information to Elections Saskatchewan.

Commissioner urges amendment to legislation

The commissioner recommended anamendmentto the Health Information Protection Act regulations to allow the practice ofdata sharing with Elections Saskatchewan, saying it was important for democracy to have an up-to-date register of voters.

But the commissioner's report said safeguards would need to be in place, especially protections surrounding an individual'shealth services number, or HSN.

Those measures would include a privacy-impact assessment before data sharing occurs, destruction of data generated and allowing citizens to find out if their information is being shared.

"I recommend that eHealth and ESK have discussions on the need for the HSN but if they conclude the HSN is essential, then eHealth should ensure most of these safeguards have been put in place," said the report.

"Because there is a data-sharing agreement, some of these safeguards are there, so the recommendation is one to ensure that the discussion of safeguards continues."

The commissioner urged eHealth and Elections Saskatchewanto promote and support the legislative change needed to allow the sharing of information to keep the voting register up to date.

In a statement on its website, eHealthsaid that it plans to comply with the commissioner's recommendations, including notifying people whose information was shared.

Chief executive officer Susan Antosh apologized to those affected by the breachin whichinformation was sharedabout people under 16.

"EHealth is committed to ensuring the privacy and security of personal health information, which is why we are taking this incident seriously and immediately informed the office of the information and privacy commissioner," Antosh said.