The realities of implementing health information legislation: the Manitoba experience, 1997-2004.

In the late 1990s, an increasing global emphasis on data protection and the expansion of provincial health information systems provided the optimal context for developing health information access and privacy legislation. Manitoba's Personal Health Information Act (PHIA) was thus enacted on December 11, 1997. (1) PHIA was the first law of its kind in Canada and was developed with a view to interpreting internationally accepted fair information principles for application within the local health care system. PHIA requires health information trustees (public bodies and health care providers) to grant individuals access, upon request, to personal health information about themselves. (2) It also requires trustees to protect the personal health information they maintain from inappropriate collection, use, disclosure, retention and destruction. (3) Manitoba's experience with PHIA over the past six years has included some interesting (and a few unforeseen) implementation challenges and has raised several demanding policy questions. This experience has also offered some useful lessons regarding the administration of health information access and privacy legislation. Some of these challenges, policy questions, and lessons are explored below.

Implementation Challenges

An implementation challenge that emerged early on was the complexity of the legislation. Although PHIA was deliberately drafted in plain language, and although the basic requirements are easily understood, the exceptions to these requirements are sometimes not. Yet an understanding of these exceptions is essential to effective implementation. An employee charged with the responsibility of responding to an access request must understand when it is appropriate or even necessary to sever certain information. (4) Likewise, an employee given the responsibility of discussing treatment and care with a patient's family must understand the amount of information it is appropriate to release without the patient's express consent. (5) While understanding the exceptions can be as important as understanding the rules, these details can sometimes be lost in the myriad of other legal requirements and operational demands trustees must respond to on any given working day.

Demands on the time of health providers and health facility staff can also lead to another challenge in implementation: the time necessary to seek and obtain consent. Although PHIA does not currently define consent, common law holds that consent must be informed to be valid. (6) Obtaining informed consent may require a discussion with the patient, which in turn requires time and opportunity. Where these are scarce, there is a danger that the principle of "no disclosure without consent" may, in practice, simply mean "no disclosure."

Where consent to disclose is not sought and information is withheld, misunderstandings about the purpose of the legislation may ensue. This, in turn, may further impede appropriate communication. One such misunderstanding is that PHIA assures absolute privacy. Like all information protection legislation, PHIA provides for reasonable confidentiality with exceptions where the right of privacy conflicts with an overriding societal interest. The legislation thus enables reporting to appropriate authorities where there is a child protection issue, communicable disease outbreak, or serious and immediate threat to public safety. (7) Another misunderstanding is that the legislation is a barrier to health care. PHIA permits the disclosure of personal health information to persons providing health care, even without express consent from the patient, provided that the patient does not specifically object. (8) In doing so, the legislation also recognizes the importance of information sharing within the circle of care insofar as it is necessary for that purpose.

Another challenge to effective implementation that occasionally arises is an unwarranted fear of prosecution under the legislation. This fear, or "PHIA-noia" as it is sometimes called, may cause a trustee to withhold information even where the disclosure is consented to, or is permitted by legislation. While the consequences of a breach should be understood by trustees and their staff, extreme and unnecessary fear of prosecution can impede the use of appropriate discretion and be an obstacle to appropriate patient care.

Policy Questions

As discussed above, information protection legislation generally seeks to strike an appropriate balance between the protection of privacy and other competing interests. From time-to-time, however, the balance established through PHIA has been challenged, raising some fundamental policy, legislative and philosophical questions.

One such question is whether access to personal health information by community clergy and other representatives of religious organizations should be permitted without express patient consent. Prior to the enactment of PHIA, it was commonplace for a member of the clergy to be given a copy of the hospital census to assist him or her in identifying members of his or her faith community. After December 11, 1997, facilities were required to rethink this practice. Although PHIA permits trustees to disclose the location and general health status of a named patient, (9) general limitation requirements restrict disclosures to the minimum amount of relevant information necessary for a given purpose. (10) As the complete hospital census would include the names of individuals who are not members of a particular faith community--and even of some members of these communities who do not want a visit--many Manitoba facilities have begun to seek patient consent before placing patient names on lists that are disclosed to community clergy. This practice of seeking consent has caused discomfort among some representatives of religious organizations who fear that the patients who most need their services may be missed if, for instance, they come into the facility through the emergency department, bypassing regular admission channels. Seeking out these individuals for consent post-admission can be an administrative challenge. Thus, the question remains: should consent for the disclosure of patient census information be required?

Another demanding policy question is whether police officers should have greater access to personal health information maintained by health care facilities without patient consent. PHIA permits disclosures to police officials in cases where a trustee reasonably believes that the disclosure will minimize or prevent a serious and immediate threat to the individual, another person, or to public health and public safety. (11) It also permits disclosures where a trustee is served with a court order, warrant or subpoena. (12) In most other circumstances, however, nonconsensual disclosures to police are not permitted. The provincial association of police chiefs has expressed the opinion that health care providers and facilities should have greater flexibility in reporting suspected criminal activity and responding to police inquiries regarding ongoing investigations. The concern is that privacy legislation may serve to shield criminals from the law. Some health care providers, on the other hand, argue that a greater ability to notify police of suspected (not necessarily confirmed) criminal activity may discourage individuals who are badly in need of care from accessing necessary services. Law enforcement and access to necessary health care are both important social interests. If these cannot both be achieved, which should prevail?

A third difficult question is whether family members do, or should, have a right of access to an individual's personal health information. PHIA, like most similar legislation, was crafted with a view to supporting individual rights of autonomy and privacy. In cases where the individual is not capable of exercising his or her own rights, PHIA provides for substitute decision-making authority. (13) For example, a parent or guardian of a minor who is not capable of making health care decisions would retain the right of access to the minor's personal health information; however, the adult child of an elderly but competent health care recipient may not. PHIA does permit health care facilities to disclose, to family members and close friends, information about care currently being provided to an individual without his or her express consent. (14) Yet problems may arise when this discretion to disclose is not exercised, or when family members wish to access more detailed personal health information--a disclosure that would require consent--but are refused the information with no attempt to seek consent (for reasons outlined above, perhaps). Such cases, although not the norm, have contributed to the opinion that facilities should not have discretion to disclose to family members, lest they fail to use it. Rather, some believe, facilities should be required to disclose information to family members just as they are required to disclose information to the individual him- or herself. Such positions raise interesting questions about individual versus group rights. Should family members have a right of access to detailed information about a loved one's health, or barring that, the right to be informed of the ability to seek the loved one's consent?

Lessons Learned

The implementation difficulties and policy questions outlined above have required a good deal of attention from trustees, policy makers and legislators in recent years. Some attempts to address these challenges and a few lessons learned from these experiences are outlined below.

Education and training programs, designed to ensure that accurate information about PHIA is communicated broadly to trustees and their employees, are routinely held throughout Manitoba. Much of this education is conducted by the province's eleven regional health authorities, who regularly hold training programs for their staff, agents and volunteers. The provincial government contributes to these training efforts by holding approximately fifty information sessions on PHIA per year, mostly for trustees operating outside the regional health authority framework. The Manitoba experience has demonstrated that training tools must be user-friendly and the tone must be encouraging. Approaches that rely on generating fear of prosecution can be self-defeating; the best approach may be to foster an understanding of, and an appreciation for, the principles the legislation was designed to uphold.

Despite the importance of training and education, their value can quickly be lost where the organizational commitment to access and privacy rights is lacking. Compliance requires appreciation and understanding, but also the dedication of resources to assist in implementation and maintaining compliance. An organization with even the highest philosophical commitment to information privacy, but no willingness to invest in physical security safeguards, will have a difficult time meeting the requirements of the legislation. Similarly, an organization that provides regular reminders of the importance of privacy, but fails to allocate human resources to the completion of privacy impact assessments, may later find that an initiative is non-compliant. Both human and financial resources are necessary ingredients for compliance.

Addressing implementation challenges and responding to difficult policy questions can also be made easier by opportunities to share experiences and solutions. In Manitoba, a provincial network of regional health authority privacy officers have welcomed opportunities to share policies, ideas and knowledge. Information sharing sessions, which take place bi-annually, permit regional health authorities to borrow from and build off the work undertaken by the others. These opportunities also assist in addressing inconsistencies in interpretation across the province.

The Manitoba experience has also demonstrated that effective implementation of health information legislation is supported when trustees are encouraged to take a reasonable, balanced approach to interpretation. In several cases, PHIA requires the exercise of discretion. This can be a daunting task and a trustee may be inclined to err on the side of extreme caution. Often, however, the best interests of the patient are achieved when decisions are made based on an assessment of harm to the patient and the expectations of a "reasonable person." Extreme and unreasonable interpretations can contribute to frustration and poor patient care, which in the end, may exacerbate the goals of the legislation.

Finally, the Manitoba experience has demonstrated that health information access and privacy legislation may occasionally need to be revisited to ensure it continues to strike the most appropriate balance between access and privacy rights and other competing interests. To this end, PHIA itself requires the government to conduct a statutory review of the legislation after several years of experience. The comments and suggestions generated by trustees and members of the public during the public consultation component of this review, which took place between February and May of 2004, will assist in addressing the policy issues outlined above as well as others that were brought to light during the public consultation process by participants.

Conclusion

Despite several implementation challenges and the emergence of a few difficult policy questions, the outlook across Manitoba's health information protection landscape is generally optimistic. While the statutory review helped to flush out some issues that may require attention, it also demonstrated that many health information trustees are no longer skeptical of the need for legislation. Some commented during the review that, while professional codes of ethics have long provided for the right of privacy and the duty of confidentiality, the legislation has helped to reinforce their respective importance. As trustees mature in their experience with health information legislation, new issues and challenges will undoubtedly rise to the surface. In the coming years, Manitoba will continue to learn from its own experiences, and from those of other jurisdictions, as efforts to provide a balanced approach to access and privacy rights continue.

Renata Neufeld is a policy analyst with Manitoba Health's Legislative Unit, Winnipeg.

1. The Personal Health Information Act, C.C.S.M. 1997, c.P33.5.

2. Ibid., s. 5.

3. Ibid., ss. 13-27.

4. Ibid., s. 11(1).

5. Ibid., ss. 22(2)(c), 23(1), 23(2).

6. Reibl v. Hughes, [1980] 2 S.C.R. 880, 14-C.C.L.T. 1 and Hopp v. Lepp, [1980] 2 S.C.R. 192, 13 C.C.L.T. 66.

7. Supra note 1, ss. 22(2)(b), 22(2)(o).

8. Ibid., s. 22(2)(b).

9. Ibid., s. 23(2).

10. Ibid., ss. 20(2), 22(3).

11. Ibid., s. 22(2)(b).

12. Ibid., s. 22(2)(1).

13. Ibid., s. 60.

14. Ibid., s. 23(2).