Submission to the Standing Committee on General Government on Bill 159: Personal Health Information Privacy Act

Introduction to CAMH

The Centre for Addiction and Mental Health (CAMH) was created in 1998 through the successful merger of the Addiction Research Foundation, the Clarke Institute of Psychiatry, the Donwood Institute and the Queen Street Mental Health Centre. The Centre is a teaching hospital fully affiliated with the University of Toronto and is a World Health Organization Centre of Excellence. It is the largest mental health and addictions facility in Canada.

Building on the legacies of four outstanding organizations, the Centre offers a unique model for understanding and helping people with addiction and mental illness, for preventing substance abuse and for promoting mental health. It operates central clinical and research facilities in Toronto, Ontario, as well as 12 community offices across the province. While the Centre's work focuses on the needs of Ontario communities, our impact extends across the country and internationally.

Realizing the diverse needs of all of its clients, the Centre is committed to providing comprehensive and well-coordinated care for all people with mental illness and substance use problems. In addition, the Centre is focused on treating special populations, and has set up specialized programs for women, youth, couples and families, older adults, African Canadian and Caribbean youth, lesbians, bisexuals and gay men.

The Centre brings together internationally recognized biological, clinical and social research with pre-eminent treatment facilities, a range of professional training and a province-wide network of community program staff. As a result, we have a unique capacity to focus our research agenda on the most pressing needs and to translate new knowledge into action.

With clinical expertise in both addictions and mental health, the Centre is in a unique position to demonstrate a collaborative, interdisciplinary approach to prevention, care, education and research.

The Centre advocates for services that are accessible, effective and adequately funded for all people needing help. It is also working towards the elimination of the stigma that is faced by those with mental illness or substance use problems.

As a teaching hospital, the Centre provides innovative interdisciplinary education for students and health professionals from across Canada.

The Centre is dedicated to better understanding, prevention and care.

Bill 159 Process

CAMH has sought to inform many of its partners and stakeholders about Bill 159 and to gather their input on the issues. However, the time frame has been too short to conduct as comprehensive a consultation and review process as we believe would lead to a well-informed reaction and suggestions for improvement to the legislation. We have now been able to obtain our full Board's review and approval for our response as outlined here. We trust that you will be able to consider this further submission when considering amendments to the Bill.

If you have any questions with respect to this submission, or if you require further information about our response, please contact Gail Czukar, CAMH General Counsel at (416) 535-8501 ext. 6923 or gail_czukar@camh.net.

General Response

CAMH supports the need for legislation to govern information in the health system generally. CAMH wants information to be used to improve the understanding of mental health and addictions problems, and to alleviate those problems. However, this use must be BALANCED with patient confidentiality. Bill 159 does not achieve this balance.

Patient confidentiality is not only an essential precondition to successful treatment; it is an issue of basic human dignity and respect. People with mental health and addictions histories are stigmatized, and their lives can be impaired forever by an episode of mental health or addiction treatment. They fear that increased access to information about their status will add to the stigma and discrimination already suffered by mental health consumer/survivors. They fear that symptoms of legitimate physical problems requiring urgent treatment, such as a twisted bowel, can be misinterpreted in light of a psychiatric treatment history, and the results can be very serious.

Patients fear that this legislation could change the very meaning of "confidentiality", and cause people to withhold critical information in circumstances that are often life-threatening.

Even if treatment is successful, the effects of stigma can be far-reaching. One of our former patients, when well and gainfully employed, applied for a loan. As the bank's loan officer entered information into the bank's computer system, a very large flashing sign appeared on the computer, clearly visible to the former patient sitting across the desk. It said "PSYCHIATRICALLY CHALLENGED." The loan officer politely and apologetically refused the loan. The former patient believes that this information was obtained by the infamous credit firm, Equifax, and distributed to many financial institutions in violation of current law. Needless to say, that consumer/survivor is not supportive of more open sharing of information about their past treatment.

Context

1. The mental health system has had legislated rules regarding use and disclosure of, and access by patients to, clinical mental health records since 1978. These rules have worked fairly well. The general result is that consent is required for most transfers of personal health information unless a patient is actually under care at a psychiatric facility that requests information from a place where the patient previously received care. Some problems and issues which have arisen are as follows:

(a) There are barriers to developing a continuum of care and an integrated mental health system because every transfer of patient information requires a consent to disclosure ("Form 14" under the Mental Health Act). Many clinicians find this administratively burdensome but they also fundamentally support the confidentiality protection it affords to patients, particularly where highly sensitive mental health and addictions information is involved.
(b) The clear distinction between the "clinical record" in psychiatric facilities and personal health information held outside the clinical record (e.g., for research, community programs, homes for special care, etc.) means that the protection is uneven.
(c) Not all psychiatric facilities are as well informed as they should be about the Mental Health Act rules and their operation because they are part of general hospitals that operate under different rules in the Public Hospitals Act and its regulations. This situation may be exacerbated by the continuing divestment of the provincial psychiatric hospitals.
(d) The rules do not apply to community mental health programs, so there are widely differing confidentiality practices among those agencies, and it is difficult to transfer information between hospitals and community agencies because of the lack of consistency.

CAMH Response to the Legislation

1. CAMH agrees with and supports the principle of a common set of rules and standards for protection of personal health information throughout the health care system.

2. CAMH supports the extension of rules similar to those in the Mental Health Act to other parts of the health system. We are well aware of the administrative burdens and delays in care and service provision which can occur when it is necessary to obtain consent to disclosure for all transfers of personal health information, but we prefer this approach to the unlimited sharing of information for care purposes. The legislation needs to allow sharing of information in a way that facilitates patient movement through all parts of the system, but that still respects patients' rights to confidentiality with appropriate safeguards and does not exacerbate stigma. This is a complex issue and we would like to work with the Ministry to develop a more targeted approach on this issue.

3. CAMH recognizes that the legislation is an attempt to balance protection of patient information with controlled use and transfer of personal health information to facilitate care, and to create and use knowledge to improve health care and the health system. However, CAMH believes that the balance has gone too far in the direction of permitting disclosures of highly sensitive personal information.

Confidentiality is fundamental to sound patient care and excellent research. The integrity and quality of health care depends on a strong, trusting relationship between client and care provider. Many clients of mental health and addictions services will avoid treatment if their information can be shared with authorities, without their knowledge or consent. This is particularly true of those addictions clients who come reluctantly to treatment in the first place. Their involvement with illegal drugs could fall within the discretionary disclosure provisions of clauses 36(1)(g) and (h). CAMH believes that it is in the public interest to encourage these clients to comply with treatment rather than to drive them away by the threat of disclosure.

One of CAMH's most important strategic directions is client-centered care. Within this direction, CAMH supports the fundamental right of patients to be involved in determining their care as much as possible, and this means, to us, fully informing patients about how their information is being used and shared, and getting their permission whenever possible. The wide-open disclosures in this legislation will make it difficult to continue to adhere to this policy. Once information is disclosed to other providers for care purposes, they may disclose it further without the patient's consent for many unrelated purposes.

Care providers and researchers must be able to assure their clients or research subjects that the extremely sensitive information they may divulge will be held in confidence. If this legislation is passed in its current form, this cannot be done. The lengthy list of disclosures set out in sections 29 to 37 is very problematic. Specific provisions are addressed in points below and in the addendum, but we wish to highlight two sections in particular here.

Section 33: Disclosure to reduce or eliminate risk, or to assist in the management of a person's behaviour in a facility: 33(a). The duty to warn should be clearly related to a threat by a patient or client of the custodian against a specific individual or group of identifiable individuals. Hospitals cannot be responsible for notifying authorities about third parties who may or may not be threatening.

Re 33(b): As care of people who may be at risk increasingly takes place in the community, there is also a need for community service providers and others (e.g., boarding home operators) other than psychiatric facilities and custodial institutions to have information about risky behaviour of clients so that risk management plans can be developed.

Section 36(1)(g): This clause should be deleted. Clause (h) is sufficient to allow disclosure of information for investigative purposes.

4. CAMH supports the protection of personal health information collected for research purposes, but this information should not be subject to disclosure to authorities or others for purposes unrelated to the research, except solely in the discretion of the researcher to prevent harm to the person or others.

The quality of health care research is totally dependent upon the willingness of people to participate and be truthful in their responses. Allowing research information to be disclosed to numerous third parties will not inspire trust and confidence in people who generously donate their time and information in the altruistic cause of curing disease or improving health care.

The provisions in section 27 and 32 regarding use and disclosure of previously recorded information for research purposes are useful safeguards, and the role of research ethics review bodies has been addressed in other presentations, which CAMH supports. We will not dwell on those points here.

5. Section 31: Mandatory disclosure to Minister. There are strong differing views within CAMH on the use of personal health information for prevention, screening, care, planning, fraud detection, evaluation and resource management purposes. CAMH supports these goals of compiling information, but would prefer that personally identifiable information be converted into aggregate form, or anonymized or pseudonymized, as soon as possible. Personal identifiers should be used only to establish necessary linkages and then destroyed. The disclosures should be requested and overseen by a trustworthy oversight and monitoring body, instead of the Minister. At the very least, all such directed disclosures should be subject to stringent and independent external review by a panel of health care providers, researchers, patients and privacy experts.

Alternatively, the Minister's authority to obtain individual clinical records should be limited to audit and inspection purposes. In addition, the Ministry could have very limited authority to "drill down" through aggregate databases in the form of specific research projects for policy-making purposes, with prior independent review and approval.

6. CAMH supports the patient's right of access to their own personal health information with very few reasons to withhold information. If it has not created problems in the mental health system, it should not cause concern in the general health system. Specifically, information about a patient should not be withheld for the vague reason of interfering with inspections or investigations (clause 48(1)(c)). This concern is adequately covered in clause 48(1)(b).

7. CAMH supports the provisions in the legislation dealing with substitute decision-making and quality assurance. These are useful additions to the law. The provisions dealing with access to and consent to disclosure of information about children by non-custodial parents need to be clarified, and we will include specific suggestions in that regard in our further submission.

8. CAMH wants to ensure the inclusion of personal health information about addictions clients under this legislative scheme by including it in the definition of personal health information.

9. CAMH supports strong oversight function and enforcement powers for the legislation, as these will help to redress the balance in favour of confidentiality protection. The legislation (sections 64 to 72) does not give the Commissioner strong enough investigative powers or sufficient variety of remedies to provide patients with confidence that the law can protect their sensitive information. While it may seem strange for a health information custodian to ask for stronger powers that could be used against itself, we believe that effective safeguards are necessary to balance increased access to health information, and protect against possible abuses.

The Commissioner should be able to inquire into and investigate complaints, and to initiate complaints based on reasonable grounds. He or she should have the power to make binding orders on custodians to change their information practices and to redress complaints with more meaningful remedies. The current remedies of cessation of collection or disposal of records (section 68(14)(b)) are necessary, but so extreme that they may only rarely be used.

Clauses 68(3) and (9) are insulting to complainants who may have experienced serious consequences as a result of a custodian violating the Act. The Commissioner, upon receipt of the complaint, may ask the complainant what other avenues the complainant has explored to resolve the problem, require the complainant (not the person complained of) to try to effect a settlement, appoint a mediator, or review the complaint. The onus is on a complainant to attempt to solve a problem that he or she has not created, and leaves the Commissioner only with a review function. The Commissioner can authorize a mediator to investigate the circumstances of the complaint, but there are no powers of inquiry for either the mediator or the Commissioner. This is in contrast to the inquiry that can be made under section 69 with respect to individuals' access to records, complete with powers of entry and compelling production of documents.

10. The legislation must allow adequate time for implementation of new systems to become compliant with the new legislation. Electronic systems require a minimum of 3 years and up to 10 years to become compliant, if huge transition costs for customized solutions are to be avoided by health care providers. Even if these large costs are avoided, government will have to provide resources for the transition costs that will inevitably follow the introduction of this type of legislation.

11. Whether in paper or electronic systems, the duty in section 25 on custodians to inform people about the expected uses and disclosures and to record unanticipated uses and disclosures is vague and potentially extremely onerous. This requires clarification.

Additional Issues regarding Bill 159

In addition to the issues raised above, several specific points require clarification or amendment.

s. 3(1): Custodian with multiple sites: What is the purpose of this section? How would it apply to CAMH? If each of the four sites were considered to be a separate custodian, the work that has been done over the past three years to integrate the records of the organization across these sites will be lost. Costs to separate records systems would be substantial, and there would be additional ongoing operational costs associated with independent custodian obligations and transfers of records. We would request that CAMH be specified in regulations as an exception to this section.

s. 7(d): Exclusion of employment-related information: CAMH is concerned that personal health information related to employment matters is not protected under the Act. This can be extremely damaging for people with mental health and addictions histories. However, the effect of this section may be to put this information under jurisdiction of PIPED for commercial activities and/or the general Ontario Privacy Act, if one is ever enacted. This will create confusion and uneven protection of personal health information.

s. 12(6): Standards to implement principles for health information custodians: What standards are anticipated? CAMH would like to be involved in developing these standards and regulations, with special regard to mental health and addictions information.

s. 17(1): Definition of information manager: What is the meaning and effect of the exclusion in the final phrase of this subsection, i.e., "does not include a health information custodian ho carries out any of those activities on the custodian's own behalf?"

s. 19(2): Regulations on retention and disposal of records: What regulations are envisioned? CAMH would like to be consulted on the development of these regulations.

s. 21(6): Consent Forms: Forms, or at least elements of forms, should be standardized and prescribed to encourage consistency and compliance, especially with respect to who can consent on behalf of a child (see comments re s. 46 & 56, below).

s. 25(1) & (2): Information about expected and unanticipated uses and disclosures: What circumstances are to be prescribed? CAMH would like to be consulted in the development of these regulations.

s. 26(2)&(3): Fundraising: Children should be excluded from this section. Children should not be asked to consent to the use of their information for fundraising purposes.

s. 27(i): Use of information for research purposes: Section 32 requirements apply to use of personal health information for research purposes. This would seem to include the requirement in subsection 32(10) of an agreement between the researcher and the custodian even where the researcher is an employee or in the service of the custodian and the custodian's research ethics review board has approved the research project in compliance with the Act. This seems to be overkill, since the researcher is already bound to confidentiality and all the obligations of the Act as an employee of the custodian.

Sections 29 to 37: Disclosure provisions generally:

1. Because virtually all of these are permissive, custodians will be well advised to develop their own policies to guide their practitioners and staff on implementation of the law. The opportunity for consistency and standardization of information sharing practices will be lost.
2. Permissiveness is likely to lead to pressure to disclose for risk management reasons. Even if care providers such as CAMH have a genuine desire and good care-related reasons for having more restrictive disclosure policies, only one adverse event can lead to policies that favour disclosure to avoid liability.
3. Each section should state "…may disclose without consent." To ensure that custodians understand clearly what is allowed under these provisions.

s. 29(1)(c): Disclosure for the purpose of obtaining payment: This allows custodians to disclose information to insurers without limits, and without the insurer obtaining any consent of the patient to collect information related to the claim. CAMH is concerned about insurers demanding more information than is necessary in order to properly assess a claim for payment, and then maintaining that information in their records where it is not protected by this Act. If PIPED will apply to the information, its subsequent use and disclosure will be very circumscribed, but it is not certain that all insurers will be covered by that statute.

s. 29(2): Disclosure of basic information about patients in hospital: This should not be permitted for psychiatric patients, especially children, or at least there should be a positive requirement for consent for these patients rather than the "negative option" approach in this subsection.

s. 31: Directed disclosures by Minister: If our previous proposal regarding a change to this section is not adopted, research information should be exempt from this mandatory disclosure so that researchers can assure subjects that their personal health information will not be used or disclosed for anything other than the specific research purpose or to reduce or eliminate a serious physical risk to themselves or another person.

s. 34: Disclosures in proceedings: Are the requirements of subsection 34(4) meant to apply to disclosures in proceedings made under subsection 34(1)? If not, what is the meaning of the opening phrase of subsection (1), "subject to this section"? If (4) to (1) apply to disclosures under (1) only for custodians described in paragraphs 1 to 4 of the definition, why are other custodians allowed to disclose without the procedures in (4) to (10)?

s. 39: Fees: Are there likely to be minimum fees prescribed? This section should permit reduction or waiver of fees set by regulation, as in subsection 47(10) regarding fees for access to one's own record.

s. 46(2)&(3) Access to information about children under 16 by non-custodial parents: While these provisions are clearer than the current Health Care Consent Act provisions regarding children, they are still not entirely clear about the rights of non-custodial parents (i.e., access parents) to have access to a child's record (which includes the rights to copy it and subsequently disclose it to whomever the parent chooses). A court may order therapy, or there is an implied threat that if the child does not participate, there will be legal consequences. In these situations, the clinician is hard-pressed to say that the child has decided to participate "on his or her own". The records of child therapy can contain very personal information about family members and friends of the parents that the (often antagonistic) parents are very anxious to get access to. This section gives them that right. Clinicians want the greatest possible clarity about who has the right to access those records in order to respect the child's rights and to act in the best interests of the child.

s. 56: Use and disclosure of information about children under 16: In joint custody arrangements, parents may disagree about use or disclosure, and both have the authority under this section to consent. The effect of this section is that the consent of both would always be required in order for the clinician to be certain that he/she is not disclosing information without consent of one of the parents. This can present a significant barrier or delay in subsequent treatment where the records are required. CAMH clinicians who work with children and families, usually in a court context, would prefer that a consent form be prescribed which includes an indication of who has the legal authority to access the record at the time that the consent is signed. If there is a joint custody arrangement, and both parents have rights of access to the information and to consent and disclose, both should be named in the form and their authority indicated. But if one of the parents can consent for both, that should be clear as well.