The Health Information Protection Act

What is the Health Information Protection Act (HIPA)? HIPA is legislation that speaks to access to, and protection of personal health information…

WHO WHO does HIPA apply to? HIPA applies to all designated Trustees under the Act Trustees must have custody or control over personal health information…

WHAT WHAT does HIPA apply to? It’s all about Personal Health Information (PHI) such as: –Information about a health service provided –Information collected during the provision of service –Organ and/or tissue donation including samples collected –Registration information

PHI includes documentation too! paper records microfilm x-ray film electronic records

Where do you see PHI?

HIPA protects the rights of the individual & guides the professional… Collection Use Consent Access Disclosure

Collection KEY WORD: Collection What is collection?

Collection cannot be random… It must relate to a program, activity, or service that benefits the patient You should always try to obtain consent HIPA s25 Manner of Collection

How does this apply to me? You must know why you are collecting the information! Follow the policies, standards, laws If you are ever unsure about collection, consult with the Ministry of Health privacy officer or the Ministry of Justice and Attorney General.

Consent KEY WORD: Consent It’s more than just asking permission…

What is consent? Where ever possible the collection of PHI should stem from the consent of the individual to whom it relates (Preamble) Individuals have the right to consent to the use and disclosure of their PHI as well as to revoke that consent. HIPA s5-7

Consent has three very similar faces… Express (or “expressed”) Implied Deemed

Informed is important! How do you ensure that your client/patient is fully informed? HIPA s9&10

How do you meet your obligations? Understand why consent is required and what the law mandates… Speak with the person/client directly Call us if you need more information!

KEY WORD: ACCESS Disclosure is not access…

What is Access? Individuals: Have the right to access PHI about himself/herself in the custody and control of a trustee. (HIPA s12) Can request access to their personal health information. HIPA s32 to 34

Access cont’d… Trustees: Trustees can “access” PHI within the organization When Trustees external to the organization need to access PHI it becomes a disclosure

Trustees have obligations… You have a ‘duty to assist’ Meet the 30 day timeline for written requests or request an extension Inform the person of their right to review HIPA s 35 to 40

KEY WORD: DISCLOSURE Access within the circle of care is appropriate…

What is Disclosure? Disclosure can generally manifest itself as: –Disclosure of PHI for treatment, program, or evaluation purposes –Disclosure of registration information –Disclosure of PHI for research purposes HIPA s27, s28, s29

Disclosure Without Consent

Privacy vs. Confidentiality… Quite a Difference!

The Protection of Privacy Protect the integrity, accuracy and confidentiality of the information; Protect against any reasonably anticipated threat or hazard; Protect against loss of the information; or Unauthorized access to or use, disclosure or modification of the information.

How do you currently protect personal health information?

Breach KEY WORD: Breach

What do you do when you become aware of a potential breach? Report Document Investigate Follow-up

Failure to Comply with HIPA… Individuals: –Fines up to $50,000 and/or up to one year in jail per offence Corporations: –Fines up to $500,000 per offence –Officers and directors of a corporation can be fined up to $50,000 and/or receive up to one year in jail per offence

Good faith clause protects trustees and employees … HIPA s61(a)

General Duties of Trustee Trustee must establish policies to: Protect integrity, accuracy & confidentiality Protect against reasonably anticipated threat or hazard to security, loss or unauthorized access Ensure compliance with HIPA by employees s.16 Duty to Protect

General Duties (continued) Must store info. in format retrievable, readable and useable for full retention period (s. 17(2)(a)) Destroy info. in a manner that protects privacy (s. 17(2)(b)) Must ensure information management service provider meets same confidentiality standards (s. 18)

Right to Appeal: The Office of the Information and Privacy Commissioner

Right to Appeal If access is refused; If a person is not satisfied with the decision of a Trustee pursuant to Section 36; The person requests an amendment to their information and it is not done; The person believes that there has been a contravention of the Act.

The Office of the Information and Privacy Commissioner Independent Third Party Powers to investigate, review decisions, and make recommendations Conduct public education programs

Questions?

Additional Information Saskatchewan Ministry of Health: Saskatchewan Information and Privacy Commissioner: PIPEDA: Privacy Commissioner of Canada: