B.C. privacy laws on sharing health data were relaxed March 26 as Minister of Citizens Services Anna Kang ordered that people’s health information might be shared with others inside and outside of Canada.
And, it’s an issue civil liberties groups such as the B.C. Civil Liberties Association (BCCLA) as well as B.C.’s privacy commissioner are watching carefully.
“We will monitor the implementation of this order – and future ones – to ensure that privacy rights are being respected and are properly balanced with other competing interests,” BCCLA policy lawyer Meghan McDermott said.
“We are staying on top of all the declarations and orders as these are unprecedented times and the lines delineating legal from non-legal are shifting quickly,” she said.
B.C. Information and Privacy Commissioner Michael McEvoy told Glacier Media his office is also watching the situation carefully to ensure data sharing is done within the confines of the law.
“I would judge it to be sufficiently tailored and proportionate to meet the public health care needs,” McEvoy said of the order. “It allows doctors, health-care professionals and educators to do what they need to do in these circumstances.”
“Our office is looking very carefully at it,” he added. “We want to make sure British Columbians privacy is protected.”
McDermott said health officials now have substantial powers to override privacy laws while acting under the Public Health Act ‘s emergency provisions.
The order means that, under B.C.’s Freedom of Information and Protection of Privacy Act that B.C.’s ministries of Health, Mental Health and Addictions or the Provincial Health Services Authority may disclose information:
- for the purposes of communicating with individuals respecting COVID-19;
- for the purposes of supporting a public health response to the COVID-19 pandemic, or;
- for the purposes of coordinating care during the COVID-19 pandemic.
The order further said public bodies may disclose such information inside or outside of Canada on condition that disclosure is for the following:
- is used to support and maintain the operation of programs or activities of public bodies;
- supports public health requirements related to minimizing COVID-19 transmission such as social distancing, working from home, etc, and:
- disclosure is limited to the minimum amount reasonably necessary for the performance of duties by an employee, officer or minister of the public body.
So far, McDermott said, health officials have only asked long-term care homes to collect and share personal information about all employees and contractors – including hours worked and social insurance numbers – but there is no need to submit health information about them.
Eleven Vancouver Coastal and Fraser Health region long-term care homes have confirmed COVID-19cases. Officials have said that is where the majority of B.C.’s 16 deaths have occurred.
McDermott said the order extends information sharing beyond Canadian borders but can only be used by health bodies.
The concerning part, McDermott said, is that the order allows public health bodies to share personal information for “the purposes of communicating with individuals respecting COVID-19.”
“This seems a little broad as it opens the door to sharing with any individual. This may then mean that this mechanism was needed simply to tell people who were tested for COVID and then left the country whether or not their test is positive. Or it may allow for relatives/guardians of COVID-19 victims who aren’t in Canada to have test results or treatment plans shared with them,” McDermott said.
“It may seem alarming at first, there could be very valid reasons for creating this new avenue of personal information sharing in the face of a pandemic when people and communities are as mobile as we are.”
Another reason for sharing beyond Canada, she said, could be to allow some planning with neighbouring jurisdictions about coordinating care and supporting public health responses.
“The government may also be taking an abundance of caution to ensure that they can share broader information like where the infection hotspots are, and which hospitals are at capacity, with counterparts in the USA until the end of June without running afoul of privacy law,” McDermott said.
And, she said, while the act says information can only be used for the purpose for which it was collected, she wonders why use would extend beyond Canada’s borders. Perhaps some key health officials are outside Canada right now, she mused.
But, McDermott added, “this limits the scope of what can be shared and we at the BCCLA are always happy to see limitations and conditions on the sharing of personal information.”
The order also allows for disclosure outside of Canada via third party tools – tools such as information technology.
“It is clear to me that the second portion of the order isn’t linked to the COVID-19 pandemic except for the fact that it has resulted in thousands of civil servants working from home or wherever they happened to be when they were ordered to shelter in place,” McDermott said. “This part of the order is just clearing the way for those civil servants who are now outside of Canada to be able to keep doing their jobs remotely.”
McEvoy said the onus is on public bodies to ensure that out-of-Canada technological tools meet B.C. legal requirements that information not be stored on them.
While the meeting application Zoom may not store information, other such as Facebook, WhatsApp or others could, he said.
Normally, if two doctors are discussing a patient or a conversation is taking place between care facilities, there may not be consent of a third party to that information sharing, he explained.
Now, public bodies must ensure a foreign-based tool is secure, McEvoy said. “You have to make sure that the information being put on it is securely held.”
McDermott said the nature of information shared would depend on the type of work being done
“It could be very sensitive personal health information or other very sensitive personal information about children in care, student performance or vaccination records, employee hiring and firing, social assistance applications, etc.,” McDermott said. “Obviously we are happy to see some conditions being added, such as ‘any disclosure of personal information is limited to the minimum amount reasonably necessary for the performance of duties by an employee’” she said.
Federal Privacy Commissioner Daniel Therrien said in a March 20 statement that, “during a public health crisis, privacy laws still apply, but they are not a barrier to appropriate information sharing.”
A guidance from Therrien’s office said under federal and provincial laws, governments are authorized to declare formal public emergencies.
“Where that is done, the powers to collect, use and disclose personal information may be further extended and can be very broad.”
The B.C. order will remain in effect until June 30 and the minister may rescind or extend the order in full or in part before June 30.