Research and the Health Information Act Rachel Hayward Office of the Information and Privacy Commissioner of Alberta

Agenda Introductions An overview of the Health Information Act  Purpose  Roles  Updates to the legislation Privacy and Research  Researcher, Research Ethics Board and Custodian obligations  Research Agreements  Recent Investigation Reports

Purpose Alberta’s access and privacy law for health information  Proclaimed 2001, amended 2006 and 2010  Regulates Albertans’ rights:  to access their own health information and  to request corrections  Regulates collection, use and disclosure of health information whenever a health service is provided  Confidentiality of health information  Reasonable measures to protect health information  Provides independent oversight  Information and Privacy Commissioner

The Office of the Information and Privacy Commissioner Commissioner – Jill Clayton an officer of the Legislative Assembly independent of government Has a broad range of responsibilities and powers, including oversight of: Freedom of Information and Protection of Privacy Act Personal Information Protection Act HIA

Role of the Commissioner Resolve access and privacy disputes Mediation Investigation Adjudication Conduct investigations to ensure compliance with any provision of the Act Order compliance with the Act Comment on PIAs Give advice and recommendations to custodians Inform the public about the Act and receive their comments

Recent Changes to HIA Bill 52 HIAA

Custodians expanded Still custodians: Minister of Health and Wellness Alberta Health and Wellness Alberta Health Services Health Quality Council of Alberta Physicians Pharmacists & Pharmacies Nursing Homes Boards and committees established by custodians Others may be named in regulation New custodians (as of September 1): Optometrists Opticians Chiropractors Midwives Podiatrists Denturists

The scope has changed Before September 1, HIA applied to the health services paid for in public health system Now HIA applies to health services, regardless of who pays

New Regulation Alberta Electronic Health Record Regulation  Sets rules and governance for Netcare  Specifies audit requirements for electronic health records Name of user and application that performs an access Date and time of access Actions performed by the user during an access including creating, viewing, editing and deleting information

Other changes Professional colleges have new roles  Consultation on putting members’ information into Netcare  Policy development for electronic health records Health Information Repositories  Stay tuned – regulations not released yet

Research and the HIA

Research HIA defines research as; academic, applied or scientific research that necessitates the use of individually identifying health information

Researcher Roles Researcher – Individual looking to use individually identifying health information for academic, applied or scientific research Custodian – Individual OR Organization that has custody and control of the data  Must also be a custodian as defined in the HIA

Privacy and Research Researcher Obligations  Submit research proposal to a designated REB Consent considerations Public interest of the research Qualifications Document adequate safeguards to protect privacy and confidentiality

Privacy and Research Research Ethics Board Obligations  Review research proposals  Consent Considerations  Develop a response Provide to the researcher and OIPC

REBs and the HIA 2 An REB must;  Assess whether adequate safeguards will be in place at the time the research will be carried out  Assess whether obtaining consent is unreasonable, impracticable, or not feasible

Privacy and Research Custodian  Review request from researcher REB approval Request for disclosure  Decide whether or not to disclose to the researcher  Sign agreement with the researcher (s. 54)

Research Agreements  Researchers must enter into an agreement with the custodian in which the researcher agrees; To comply with the HIA and its Regulations Any conditions imposed by the custodian relating to the use, protection, return or disposal of health information Any requirements imposed by the custodian to provide safeguards against the identification, direct or indirect, of an individual who is the subject of the health information ….  Recent Order H2011-IR-002

Questions …

Rachel Hayward Portfolio Officer, Health Information Act OIPC Alberta # 410, 9925 – 109 Street Edmonton, AB T5K 2J8 Phone: (780) Web: