Privacy commissioner still waiting two years later for amendments to health information privacy laws
Two years ago, Saskatchewan's privacy commissioner proposed several amendments to laws concerning protection of personal health information in Saskatchewan.
On Wednesday he noted many of his proposed amendments to the Health Information Protection Act (HIPA) were never made. One of the goals of his office this past year was to work with the Ministry of Health to develop new legislation, but no progress was made.
"I think it's very concerning," said Ronald Kruzeniski, who is the Saskatchewan information and privacy commissioner. His office released its annual report Wednesday.
He proposed the changes in 2016 to help citizens have better access to their personal health information, while also increasing the protection of the data.
Recommendations covered a swath of potential improvements — from transparency to increasing personal privacy to the transference of patient data to keeping pace with digital technology.
Kruzeniski said his office will continue to advocate for change through speeches, presentations and individual reports, but that's all they can do.
"There is nothing the office can do beyond issuing recommendations."
Privacy act predates many current technologies
Kruzeniski noted HIPA is 15 years old, having been established in 2003, and has not undergone a top to bottom overhaul. He said any legislation that's more than ten years old deserves a closer look.
In an emailed statement, a health ministry spokesperson said HIPA was "originally and intentionally drafted to protect personal health information in all forms and did not speak to specific technologies."
Furthermore, they said the ministry is committed to reviewing recommendations for future amendments to HIPA and its regulations and that it is continuously working to improve its existing privacy framework.
The spokesperson said the ministry "will work with relevant stakeholders to undertake an analysis and examine recommendations made by the Information and Privacy Commissioner" and other agencies.
Increase in privacy commission reviews
The privacy commissioner's annual report said 110 individual reports had been issued to government institutions, local authorities and trustees in the 2017-18 period.
Those on the receiving end of recommendations are required to respond to the office within 30 days of receiving the report.
They can reject or accept all or some of the recommendations. Five bodies didn't respond at all. They were the Ministry of Justice, R.M. of McKillop, Keewatin Yatthe Regional Health Authority, North-East EMS and Regina Physician Group.
"I would like that portion of our report to be blank, so to that extent it is concerning," Kruzeniski said. "We only have the ability to make recommendations. We don't have the ability to order somebody to do something."
Twelve per cent of those who received recommendations said they wouldn't comply and 29 per cent indicated they would partially comply. If a response isn't issued, the FOIP applicant can take the organization to court.
Regarding the office's plan for 2018-19, the privacy commissioner wants to see publicly funded landlords be subject to freedom of information requests.
He also advocated guidelines for health professionals who use cellphones, as well as best practices for the use of memory sticks. It also plans to develop a report regarding the use of computer backup tapes.
The office saw a six per cent increase in reviews, investigations and consultations this year compared to last.
Kruzeniski said there's likely a multitude of factors but noted the inquires into the Global Transportation Hub land deal that involved multiple ministries on a local level.
He also said awareness of Edward Snowden, the FBI-Apple dispute that followed the San Bernardino terrorist attack and the Facebook-Cambridge Analytic privacy concerns have increased public consciousness about data collection.
