Printer Friendly

Cancer surveillance in Canada: analysis of legal and policy frameworks and tools for reform.


Progress in cancer prevention and treatment depends on the collection and analysis of reliable information about the incidence, risk factors, and progression of cancer in the Canadian population. Every jurisdiction in Canada has a public cancer registry, operated by a cancer agency or subsumed within another government department or ministry. (1) These registries contain comprehensive information about patients diagnosed with cancer, which are used for various analyses and reports. Those who operate cancer registries are responsible for maintaining data security and considering requests for access to information by various third party data users. Surveillance and research activities facilitated through cancer registries are recognized as having a compelling public health purpose, but they take place in a context that has become increasingly sensitive to the rights of individuals to protection of their personal information. Ensuring that personal privacy is adequately protected, while maximizing the use of relevant data for surveillance and research, is an important challenge.

This article provides a comprehensive overview of the legal and policy framework for the use of cancer patient information for surveillance and research purposes in Canada. It analyzes various sources of law applicable to cancer registries and to the use and disclosure of personal health information in this context, with a view to identifying key gaps and weaknesses and outlining potential reforms. The article is based on a report produced for the Canadian Partnership Against Cancer, an independent, federally-funded organization working on cancer control in Canada. The research conducted for that report built on earlier work carried out in 1999-2000 for the Canadian Coalition on Cancer Surveillance by researchers at the Health Law Institute, University of Alberta, and the Centre de recherche en droit public at the Universite de Montreal. (2) Though it took the 2000 Report as a starting point, the new report was written as an independent document. In updating the legislative review carried out in 2000, some significant changes have taken place, most notably the proliferation of statutes for the protection of personal information.

This article is divided into five parts: Part 1 provides an overview of public health surveillance and the legal framework within which surveillance and research take place. In Part 2, the legislative framework is analyzed in more detail, focusing on legislation that is directly relevant to the collection, use and disclosure of personal health information by cancer registries. The relevant types of legislation are summarized, and the legislative framework is compared to a set of recommended characteristics. The Appendix contains a Table of Legislation which sets out, for easy reference, the key pieces of legislation (statutes and regulations) relevant to cancer surveillance and the use of cancer data. Part 3 supplements the discussion of legislation in Part 2 with an outline of the policies and procedures of cancer agencies and other bodies that are relevant to use and disclosure of cancer data. Part 4 then provides an assessment of the strengths and weaknesses of the legal and policy framework, and highlights some issues that may require further attention. Finally, Part 5 outlines and discusses a range of tools to improve the legal and policy framework, such as model legislation or policies, best practices, and guidelines. The conclusion discusses priorities for action and potential areas of future work.

Part 1: Cancer Surveillance and its Legal Context

Health surveillance is one of six core functions of public health. (3) Surveillance may be defined as:
   the tracking and forecasting of any health event or health
   determinant through the continuous collection of high-quality data,
   the integration, analysis and interpretation of those data into
   surveillance products (for example reports, advisories, alerts, and
   warnings), and the dissemination of those surveillance products to
   those who need to know. (4)

Health surveillance activities require collection of information about individuals with the disease or health event of interest to those conducting surveillance. For example, cancer surveillance requires collection of data about people diagnosed with cancer. A wide range of health surveillance activities exists in Canada, including surveillance for cancer, infectious diseases (e.g. HIV/AIDS, sexually transmitted infections, influenza, tuberculosis, West Nile virus, nosocomial infections, transfusion transmissible infections), injuries and congenital anomalies. (5)

Surveillance may be active or passive, mandated by law or voluntary. (6) Active surveillance involves proactively seeking information relevant to public health, while passive surveillance involves establishing a health event reporting system, then relying on third parties to transmit relevant, current data to the system. Reporting to surveillance programs is required by law for some conditions; notifiable cancers and sexually transmitted infections are common examples. Many other health surveillance programs operate on a voluntary basis.

Collection and analysis of information is critically important to health surveillance activities, and disease registries are highly valuable sources of information. Canadians and their elected legislators are increasingly concerned about privacy of information. The past decade or so has witnessed the enactment of numerous laws across Canada aimed specifically at the protection of personal information. These include Freedom of Information and Protection of Privacy Acts (FOIPP laws), private sector privacy laws and laws that focus specifically on health information. Patients expect that their personal health information will be treated with confidence. At the same time, however, many acknowledge the benefits of health surveillance, including collection of patient information into cancer registries. International studies demonstrate public support for cancer surveillance and confidence in cancer registries, provided appropriate security safeguards are in place to protect information from unauthorized users. (7) One of the challenges for privacy laws, then, is to provide the right balance between protection and beneficial uses of information.

While the enactment of privacy laws has changed the Canadian legislative landscape, many other laws deal with public health activities, including laws specific to cancer control and surveillance. Understanding and analyzing the interrelationship of these laws is important to evaluating the current state of cancer surveillance in Canada, to identifying strengths, weaknesses and gaps, and to recommending tools for improving the current situation. In addition to legislative provisions set out in privacy, public health and other relevant statutes, other sources of legal rules and guidance are relevant to collection, use and disclosure of personal information for surveillance purposes. These sources include Canadian constitutional and common law as well as codes of conduct and guidance documents developed by professional associations. Although this article focuses on the legislative and policy framework, a brief summary of other sources of law is provided here.

Constitutional law sets out the foundations of the statutory framework for cancer surveillance in Canada. Governments must ensure they have constitutional authority for legislation that regulates personal information, including cancer patient data, and that they respect fundamental rights and freedoms of individuals. For example, with its power over census and statistics, (8) the federal government maintains a national statistics bureau, Statistics Canada, which collects important information about the health status of the population. Statistics Canada operates the Canadian Cancer Registry, a survey that collects information on cancer incidence in Canada through collaboration involving the provincial/territorial cancer registries. (9) While the provinces have primary authority over local health programs and services, and regulation of personal information used within provincial public, private and health sectors, (10) the federal government has established a personal information protection law, the Personal Information Protection and Electronic Documents Act, which applies in some provinces and territories to regulate how organizations like physicians' offices and private laboratories handle personal information. (11)

In addition to complying with constitutional division of powers, legislation and programs that regulate and involve collection, use or sharing of personal information must respect privacy interests that fall within the scope of rights protected under the Canadian Charter of Rights and Freedoms. For example, section 8 of the Charter protects individuals from unreasonable search and seizure by governmental authorities, (12) and section 7 of the Charter protects a right to personal security. (13) The Supreme Court of Canada has stated that section 8 "should seek to protect a biographical core of personal information which individuals in a free and democratic society would want to maintain and control from dissemination to the state. This would include information which tends to reveal intimate details of lifestyle and personal choices of the individual." (14) In regard to section 7, an Ontario Court has emphasized that "the protection of privacy is indeed a fundamental Canadian value. The individual's ability to control the dissemination of personal information is an element of the right to privacy. The Supreme Court has confirmed that all information about a person is in a fundamental way his own, for him to communicate or retain for himself as he sees fit." (15) Sections 7 and 8 of the Charter have been used to challenge collection, use and disclosure of biological specimens and personal information and to elaborate on privacy rights and confidentiality obligations. (16) In collection and disclosure of patient information for health surveillance, a balance must be struck between public health interests and privacy, (17) and organizations that collect, use and disclose information about cancer patients--especially non-consensual handling of identifiable information--must ensure that privacy rights are minimally impaired and that benefits outweigh harms.

As a party to the major international human rights conventions, Canada has an obligation to progressively realize the right to the "highest attainable standard" of health, including the "prevention, treatment and control of epidemic, endemic, occupational and other diseases." (18) It also recognizes the right to "enjoy the benefits of scientific progress and its applications," and undertakes to respect scientific freedom. (19) However, Canada has also agreed to ensure protection from arbitrary or unlawful interference with individuals' privacy. (20) As part of this obligation, it is required to refrain from violating individuals' privacy and have in place a legislative framework that prohibits interference with privacy. (21) These values must be balanced in the legislative framework for cancer surveillance and research.

In the realm of information and privacy, Canada has adopted the 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, which set out basic principles for fair information practices, including individual access, transparency, accountability, and limits on collection, use and disclosure of personal information. (22) While these are non-binding guidelines, they have been influential in the development of information and privacy legislation worldwide.

Within this framework, a range of legal and ethical obligations applicable to the collection, use and disclosure of information supplement the legislative framework. For example, the Supreme Court of Canada has described the physician-patient relationship as a fiduciary relationship. (23) As part of these fiduciary obligations, a physician must "hold information received from or about a patient in confidence." (24) In addition, the Canadian Medical Association (CMA) Code of Ethics (25) and Health Information Privacy Code (26) (HIPC) set out ethical principles to guide medical practice, including the obligation for physicians to protect the personal health information of their patients and to be aware of their rights with respect to use and disclosure. (27) However, patients' personal health information can be disclosed to third parties with their consent, or "as provided for by law." (28)

Part 2: Legislation and Cancer Surveillance

The legislative framework for cancer surveillance includes a range of statutes and regulations, including some specific to cancer and others relating to health, public health, vital statistics, and information and privacy. The legislation reviewed for this analysis is set out in the Table of Legislation in the Appendix.

The Legislative Framework

Cancer and public health legislation

Five jurisdictions (British Columbia, Alberta, Saskatchewan, Manitoba, and Ontario) have specific statutes or regulations focusing on cancer. Six (British Columbia, Manitoba, Nova Scotia, Prince Edward Island, Northwest Territories, and Nunavut) have cancer-specific provisions in their public health statutes or regulations, in addition to or instead of cancer legislation. The remainder do not have any legislative provisions specific to cancer, though they have relevant provisions that address health and surveillance more generally. In several jurisdictions (Nova Scotia, Newfoundland and Labrador) specific cancer legislation has been repealed as the functions of cancer agencies have been absorbed into other entities.

The approaches taken by different jurisdictions are very diverse, with a few (e.g. Manitoba, Saskatchewan) choosing to enact cancer-specific legislation, including comprehensive provisions governing the operation of cancer registries, while others have few or no specific provisions regarding cancer agencies or registries, leaving their operation to more general legislation, such as public health, health department, and information and privacy legislation.

Information and privacy legislation

Where cancer-specific legislation exists, it may set out provisions regarding use and disclosure of cancer data (e.g. Alberta, Saskatchewan). These will coexist with, or be supplemented by, general legislation on information and privacy, including freedom of information and protection of privacy (FOIPP) legislation or health information legislation. All Canadian jurisdictions now have information and privacy legislation covering the public sector, which would apply to cancer registries and other cancer agency activities. In some jurisdictions, the applicable legislation will be general, public sector FOIPP legislation, while in others specific legislation governing health information has been enacted. One significant development since the 2000 review is that six jurisdictions (Alberta, Saskatchewan, Manitoba, Ontario, British Columbia, and Newfoundland and Labrador) now have specific health information legislation.

In every jurisdiction, there is also a variety of legislation that may be relevant to health information in particular contexts. For example, the statutes or regulations governing hospitals usually contain provisions regarding hospital records, typically requiring certain records to be kept and stating that they are property of the hospital, and often setting out provisions for their use and disclosure. Legislation on the regulation of health professions provides a framework for prohibiting and penalizing breaches of confidence by health care providers.

The relationship between FOIPP or health information legislation and any specific provisions in cancer or public health legislation can be dealt with in various ways. The simplest is by means of a specific paramountcy provision that clarifies which legislation will prevail in the event of a conflict, but other provisions can also help define the relationship. For example, Alberta's former Cancer Programs Act contained a provision (29) specifying that it would prevail in the event of any inconsistency with the Health Information Act (HIA). (30) The new Cancer Registry Regulation does not contain a similar provision, and HIA states that it prevails over any inconsistent provision in other legislation unless the other legislation expressly provides otherwise. (31) It also states that any custodian collecting, using, or disclosing health information under the authority of another enactment must comply with the Health Information Act in doing so. (32) However, collection, use, or disclosure of individually identifiable health information is specifically allowed under HIA (33) if authorized by another enactment. The net result is that the Cancer Registry Regulation provides authority for collection, use, and disclosure of individually identifiable health information, but the exercise of this authority must respect other provisions of HIA.

Similarly in Saskatchewan, the Health Information Protection Act (HIPA) provides that subject to listed exceptions, "where there is a conflict or inconsistency between this Act and any other Act or regulation with respect to personal health information, this Act prevails." (34) However, it specifically allows personal health information to be disclosed without consent where such disclosure is permitted by other legislation." The provision in the Cancer Agency Act governing use of cancer registry information then states that it is subject to the HIPA. (36)

Ontario has taken the unique approach in its health information legislation of designating the cancer agency (Cancer Care Ontario) and its registries as a "prescribed entity" that is authorized to collect health information. (37) Specific provisions then authorize health information custodians (such as physicians) to disclose personal health information to prescribed entities for specific purposes, including compiling or maintaining a registry, or compiling and analyzing statistical data on health services. (38) Prescribed entities must have practices and procedures in place to protect privacy, and are subject to review by the Information and Privacy Commissioner. (39) Specific provisions apply to the use and disclosure of personal health information by prescribed entities. (40)

Most Canadian information and privacy legislation establishes the office of an Information and Privacy Commissioner (IPC) to perform functions such as: receive complaints about alleged breaches of personal information protection laws; conduct investigations, hearings and/or audits to ensure compliance with personal information protection laws; make recommendations and/or orders; issue public statements or reports about privacy issues; and determine applications for secondary use of personal information for research, statistical or other purposes. (41)

IPCs in several provinces have investigated cancer programs, either in response to individual complaints about the programs or on the basis of the IPC's power to investigate public programs. In 2003, both the Alberta Cancer Board and the Saskatchewan Cancer Agency implemented cervical cancer screening programs that required women's cervical screening test results to be disclosed to the provincial cancer agency, which would then send correspondence to women regarding their test results and reminders about follow-up. Women were not asked for their consent to authorize disclosure of their results from the testing lab to the cancer agency. The IPC reviews found that while the statutes permitted information sharing, the agencies should be more transparent about their uses of personal information and give women an opportunity to opt out of the cervical cancer programs. (42)

IPCs typically have authority to conduct reviews of programs and practices governed under privacy legislation. These reviews generally involve review of the type of information an organization handles, security measures for safeguarding information from unauthorized access, loss or theft, organizational privacy policies and site visits. (43)

Cancer agencies need to be aware of the role of IPCs and other oversight bodies, especially their authority to review and adjudicate complaints about practices and procedures of surveillance programs. Proactive consultation with IPCs on handling and protection of personal information may be helpful to ensure compliance with relevant legal provisions.

Statistics and vital statistics legislation

Vital statistics information, in particular information on deaths and causes of death, is an important resource for cancer surveillance. All jurisdictions in Canada have legislation requiring the registration of deaths. All jurisdictions except Quebec (where these matters are dealt with in the Civil Code) have similar vital statistics statutes. These laws require deaths to be reported and registered, and the cause of death to be certified by a medical practitioner (or by the coroner, in the case of a coroner's investigation), usually according to the International Classification of Diseases.

Vital statistics data is confidential, but information may be released pursuant to several common provisions. Statistical information and reports may be published by the responsible department or registrar. Any person may request a search of registration records, but the only information released in response to these requests is whether the registration exists and the registration number (in a few jurisdictions, the date of registration or other information at the discretion of the registrar). Death certificates are also available upon request (sometimes only to certain persons or with restrictions), but the certificate that is released will generally not disclose the cause of death. Cause of death information can usually be released only by court order or with the Minister's authorization, and in some cases to close relatives or to public officers or institutions. New Brunswick legislation specifically allows disclosure of cause of death information to specified persons for health research. (44) A regulation under the Vital Statistics Act in the Northwest Territories and Nunavut authorizes the Chief Medical Health Officer and designated staff members to have access to vital statistics records for the purpose of gathering public health statistics. (45) Some jurisdictions also allow vital statistics information to be shared pursuant to agreements with certain organizations or public bodies. (46)

Statistics Canada operates under the authority of federal legislation, which authorizes it to collect, analyze, and publish statistics on a wide range of matters, including health. The responsible Minister may enter into agreements with provincial governments for the exchange of data.

Other relevant legislation

All three Territories require any person conducting scientific research in their jurisdiction to obtain a licenses

Analysis of legislation

In the 2000 Report, legislation was assessed against a set of recommended performance characteristics, (48) which were provided to the authors of the report by the Canadian Coalition on Cancer Surveillance. The same performance characteristics were used in this analysis, at the request of the Canadian Partnership Against Cancer. The performance characteristics set out suggested features of an effective legislative framework for cancer surveillance.

Legislative authority to collect data and maintain a registry

The recommended performance characteristics state that legislation "must give clear authority to the designated agency (i.e. cancer information custodian) to implement, maintain and use a population-wide cancer surveillance system," including the authority "to collect, store and use patient information/records as well as tissue and other biologic specimens." Some jurisdictions have such legislative provisions, while others have only general provisions giving the Minister of Health or other entity the responsibility and authority to engage in health surveillance. (49) Alberta, Saskatchewan, Northwest Territories, and Nunavut have specific provisions establishing the cancer registry and/or authorizing an agency to operate a registry. (50) Manitoba's legislation specifically provides for a registry of cervical cancer tests and colposcopy reports. (51) Cancer legislation in Manitoba and Ontario gives the cancer agency responsibility for "adequate reporting of cases" and "recording and compilation of data" on cancer. (52) British Columbia's legislation allows the British Columbia Cancer Agency to request information as prescribed. (53) None of the provisions reviewed give specific authority to collect tissue or other biological specimens.

Sources of data

General (routine) reporting requirements

The performance characteristics recommend that conditions and procedures relevant to cancer be defined as reportable by legislation. It is expected that reporting will be more consistent, and therefore the data of better quality, if reporting is mandatory. However, several jurisdictions in Canada still do not have provisions requiring mandatory reporting of cancer information. Just over half of the jurisdictions surveyed (British Columbia, (54) Alberta, (55) Saskatchewan, (56) Manitoba, (57) Prince Edward Island, (58) Nova Scotia, (59) Northwest Territories, (60) and Nunavut (61)) currently have legislation in place that makes reporting of cancer mandatory. Some others have a legislative framework in place that would allow authorities to make cancer a reportable disease, but have not yet done so. Among those where reporting is mandatory, most require automatic reporting, but British Columbia requires information to be provided upon request. (62) Legislation in Quebec and in Newfoundland and Labrador also requires information to be provided to the Minister or Department by public institutions, medical practitioners, and others upon request, though this is not specific to cancer information. (63) Depending on the nature of the request made under the latter provisions, the difference between these types of provisions may not be significant.

According to the recommended performance characteristics, legislation should define the reportable conditions and/or procedures, a starting reference date, the residency requirements for patients with reportable conditions or procedures, who is responsible for reporting, and the immediacy of reporting. It is also recommended that legislation make reference to other documents such as the ICD-9 or data coding manuals.

The information that may be requested by the British Columbia Cancer Agency under the Health Act is not limited to a specific condition, event or procedure. The information that may be requested is specified by regulation, but this does not include a definition of reportable cancers. (64) Alberta and Saskatchewan adopt the International Classification of Diseases for Oncology (ICDO) to define reportable cancers; (65) the Northwest Territories and Nunavut refer to specific categories within the International Classification of Diseases (ICD). (66) Other jurisdictions define reportable conditions as "cancer or malignant neoplasm" (Manitoba (67)), "neoplasm, malignant or benign" (Prince Edward Island (68)), or simply "cancer" (Nova Scotia (69)).

None of the legislation reviewed specifies residency requirements or starting reference dates. However, information about place of residence is normally included in the data to be reported. Saskatchewan's legislation specifically authorizes the collection of information about residents of Saskatchewan who are diagnosed or treated outside the province. (70)

In jurisdictions with mandatory reporting, the specific information to be provided may be set out in a regulation, as either a list of items or a prescribed form. It typically includes personal information (e.g. name, gender, birth date, residence, personal health number) and medical information (e.g. test results, diagnosis, treatment information). British Columbia also includes ethnicity and medical history. (71)

The obligation to report may be imposed on any person who is requested to provide information (e.g. in British Columbia (72)) or specific persons and/or organizations. The list of those required to report varies considerably from jurisdiction to jurisdiction: e.g. in Alberta, physicians and laboratories; (73) in Saskatchewan, physicians, dentists, regional health authorities, the Athabasca Health Authority, health care organizations, laboratories, and other prescribed persons; (74) in Manitoba, laboratories, health professionals, and persons performing a biopsy or autopsy, (75) as well as laboratories and colposcopists in respect of cervical cancer; (76) in Prince Edward Island, physicians; (77) in Nova Scotia, medical practitioners; and in the Northwest Territories and Nunavut, health professionals. (78) Specific time limits for reporting are specified in Nova Scotia (within ten days of diagnosis (79)) and Manitoba (within 30 days of cervical cancer test results or colposcopy results (80)); other jurisdictions require reporting "without delay" (or similar language, e.g. "forthwith," "as soon as practicable") or as prescribed or requested.

Although screening and surveillance are separate functions, positive test results obtained through screening will also be included in registries, including both general population cancer registries and specialized registries operated by provincial or territorial cancer agencies. In a few jurisdictions there are special legislative provisions governing screening data. Under the Personal Health Information Protection Act, 2004 and its General regulation, special provisions apply to the Colorectal Cancer Screening Registry operated by Cancer Care Ontario (CCO). This Registry collects information relating to the CCO's "ColonCancerCheck" screening program in order to identify and invite individuals who are eligible for screening, notify individuals and their care providers about test results, issue recalls and reminders to individuals, coordinate follow-up care, and conduct data quality, monitoring, and evaluation activities. (81) In Manitoba, specific provisions relating to cervical cancer tests and colposcopy reports are now found in the Cervical Cancer Screening Registry Regulation. (82) Under the regulation, reports must be filed for every cervical cancer test or colposcopy; information from the reports is kept in a registry and used for specified purposes, one of which is "to monitor rates and patterns of cervical cancer to assist in planning and evaluating prevention, treatment and screening programs." (83)

Penalty for failure to report

The performance characteristics recommend that legislation provide for penalties for failure to report or to allow access to records. Where the reporting obligation is contained in public health legislation, failure to comply will generally be an offence under that legislation, with maximum penalties set out (e.g. in Manitoba, fine up to $50 000 or up to 6 months imprisonment; (84) in Prince Edward Island, fine up to $5000 or up to 6 months imprisonment (85)). The disease registries statute in Northwest Territories and Nunavut provides for a fine of up to $500 or a term of imprisonment of up to 30 days or both for contraventions of the legislation. (86) There does not appear to be a specific offence or penalty provision applicable to the reporting obligation in Alberta, Saskatchewan, or Nova Scotia.

Ad hoc access to patient records and other sources

According to the performance characteristics, in addition to making cancer a reportable disease, legislation should allow registries to access health records in order to identify cases, clarify or correct reports, or complete registry records. Legislation in Saskatchewan, (87) Northwest Territories and Nunavut (88) specifically provides for access to health records or follow-up requests for information for registry purposes. Alberta's former legislation contained a similar provision, (89) which was not reproduced in the new Cancer Registry Regulation, but the Regulation does state that the registry can contain information from sources other than reports. (90) Provisions that require information to be provided on request (e.g. in British Columbia or Quebec) could also be used for this purpose.

Vital statistics, in particular deaths and causes of death, may be important sources of information and are collected under the authority of vital statistics legislation. As noted above, however, not all jurisdictions have provisions authorizing the sharing of vital statistics data for health surveillance or research purposes. Clear provisions providing this authority are desirable and seem to be becoming more common. For example, Saskatchewan's Cancer Agency Act authorizes the agency to collect death and cause of death information maintained under vital statistics legislation. (91) The existing vital statistics statute does not contain any provision for the release of this information to the agency, but the new statute (not yet in force) specifically authorizes an agreement for the sharing of vital statistics information with certain organizations, including the Saskatchewan Cancer Agency "for use in maintaining and verifying the accuracy of information in the cancer registry." (92)

Reporting data of acceptable quality

In order to be useful for surveillance and research, data reported to cancer registries must be of the highest possible quality. In addition to ensuring that reports are accurate and complete, this means that cases should be reported consistently and with sufficient detail, so that they can be compared across jurisdictions. The recommended performance characteristics suggest that legislation should make reference to documents such as the ICD or ICDO, or coding manuals. Using universally recognized classifications should promote consistency in reporting. As noted above, the Alberta, Saskatchewan, Northwest Territories, and Nunavut legislation refers to ICDO and ICD in definitions of reportable conditions. No other legislation contains similar provisions, though it is possible that reporting forms and guidelines refer to standardized categories or similar documents.

Use and disclosure of data

The recommended performance characteristics state that legislation should "specify the confidential nature of the data in the registry and provide for the confidentiality of all cancer patient data" and should "address how the data are to be released, to whom and for what purpose." Specifically, they suggest that aggregate data about cancer should be made publicly available, and that access to confidential data should be restricted, but not so strictly as to deny access to researchers with approved projects. Subject to confidentiality agreements, information may be shared with researchers where "the scientific merit and ethics of the proposed research are acceptable to the designated agency" and the research cannot be carried out without access to confidential data; it can also be exchanged with cancer care facilities and other cancer surveillance agencies.

Confidentiality of reported data

Personal information obtained by provincial and territorial registries is subject to confidentiality obligations and limitations on disclosure, either in the specific legislation that requires reporting, in general information and privacy or health information legislation, or both.

Use and disclosure of reported data

Use refers to the agency's own use of data it has collected, while disclosure refers to the release of data to another person or organization outside the agency. Provisions governing the use and disclosure of personal information are set out in information and privacy or health information legislation, and may also be included in specific cancer or public health legislation. For example, the new Alberta Cancer Registry Regulation sets out the purposes for which registry information may be used (e.g. to compile statistics on cancer or assist in cancer research or treatment) and the situations in which disclosure is required (e.g. as directed by the Minister or required by law) or permitted (e.g. for research or in statistical form). (93) Saskatchewan's Cancer Agency Act also contains specific provisions on use and disclosure of registry information. (94)

The use and disclosure of non-identifiable information (e.g. aggregated or anonymized data) is generally not limited by legislation, although as will be seen below (in part 3), cancer registries may have their own internal policies that cover both non-identifiable and identifiable information. Typical provisions regarding use and disclosure of personal (individually identifiable) information that are most relevant in this context include the permission to use or disclose information for the purpose for which it was collected and consistent purposes, as directed by the Minister, or for research purposes.

The statutes in different jurisdictions vary significantly in the amount of detail contained in their provisions on disclosure for research purposes. Disclosure of individually identifiable information for research purposes will be permitted only where this is justified, i.e. where the research purpose cannot reasonably be accomplished without such information. (95) It is also common to require researchers to justify disclosure of information without consent, i.e. to explain that it would be impracticable to obtain consent, for example where large numbers of subjects are involved, and/or that the benefits of such disclosure outweigh the risks or intrusion. (96) Where information is disclosed for research purposes, typical conditions are: prohibition on further disclosure of information or its use for any other purpose; prohibition on contacting individual subjects without their prior consent or approval from an authorized entity; and limits on data matching. (97) Generally the recipient of information must enter into an agreement including these conditions. (98)

Given that the approval of a research ethics board is usually required for disclosure of personal information for research purposes, (99) the specific conditions set out in the legislation will be supplemented by any conditions or restrictions that are imposed by a research ethics board, in accordance with the guidelines it is required to apply, such as the Tri-Council Policy Statement (see Part 3) and institutional research ethics policies. (100) For example, the legislation may contain a provision restricting researchers' ability to contact prospective research subjects without their prior consent, (101) or this restriction may be imposed by a research ethics board as a condition of approval.

Finally, most information and privacy or health information legislation allows information to be disclosed pursuant to an agreement that is authorized by legislation. This would, for example, allow sharing of data among registries or between registries and other organizations. Several jurisdictions also have specific provisions authorizing the making of such agreements in the legislation governing their registries. (102)

Part 3: Policies, Procedures and Standards

Cancer Agency and Registry Policies and Procedures Although the legislative framework governing surveillance activities is of paramount importance, in most cases it is supplemented by internal policies that implement and apply legal requirements in the day-to-day operations of an agency. The cancer agencies or registries of all provinces and territories were contacted to request information about their policies and procedures and copies of relevant documents. Some jurisdictions did not have or were not able to share policy documents but provided information about their policies and procedures, relevant aspects of which are summarized below.

There is significant variation across jurisdictions in the extent to which they have written policies and formal processes for use and disclosure of information. Some jurisdictions (e.g. Ontario, Alberta, Saskatchewan) have extensive written policies and documents, such as application forms and template agreements, while others tend to rely on unwritten principles and standard practices and make direct reference to legislative provisions, rather than policies that implement those provisions. Having explicit written policies in place and available to interested persons has obvious advantages in terms of transparency and consistency, though the approach that is appropriate for each agency will undoubtedly depend on its size and capacity as well as the volume of data requests that it receives.

Some agencies have written policies governing their own use of data, which is also subject to legislative provisions. The policies limit the purposes for which information may be used, and restrict the information used to that which is necessary for the purpose. Employees or contractors of an agency are bound by confidentiality obligations; this is most likely also the case even where this requirement is not explicitly set out by policy.

Policies and procedures regarding disclosure of information distinguish between two or three categories of information: identifiable information and non-identifiable information, which may be further separated into de-identified record-level information (from which identifying information has been removed), and aggregate data (which does not contain individual-level information, whether identifiable or de-identified). These are subject to different requirements and procedures for disclosure, with the most stringent requirements and extensive processes applying to identifiable information. The least identifiable information that can fulfil the purpose will be used or disclosed, in keeping with legal and ethical principles.

Most agencies have a form that must be completed to request data from the registry, which in addition to specifying the data required, typically requires information about the purposes for which the data will be used, and may also integrate other requirements such as confirmation of ethics approval or undertakings relating to confidentiality and security.

All policies reviewed require ethics approval prior to disclosing data for research purposes, at least for identifiable information and in some cases for de-identified (but not aggregate) information. All of them also provide for some internal review on ethical and scientific grounds prior to disclosure; some explicitly mention public benefit, consistency with the agency's mandate, and feasibility as criteria to be considered. The procedure in Quebec is somewhat different, requiring application to and approval by the Commission d'acces a l'information, in accordance with provincial law. The application includes typical components, such as the purpose for which information is sought, justification for seeking nominative information without consent, and a confidentiality undertaking.

If disclosure is made to a researcher, the researcher must agree to certain conditions, which may be set out in a form or in an agreement that the researcher is required to sign. The agreement may depend on the nature of the information disclosed, in particular the degree to which the information is identifiable or raises privacy concerns. Typical conditions include: limits on the use that can be made of the data; an undertaking to maintain the confidentiality of information, including by any individuals who may have access to the data during the research; restrictions on who will be allowed to access the data; undertakings to maintain the security of the data; and provisions regarding the destruction or return of data as soon as they are no longer needed.

Researchers may be permitted to contact individuals who are the subject of disclosed information only with explicit authorization (e.g. in British Columbia or Manitoba), or contact will be made only by agency staff (e.g. in Alberta). Linking or matching the disclosed data with other information may not be permitted except with authorization, and additional requirements may apply, e.g. notification of the Information and Privacy Commissioner and/or a privacy impact assessment (e.g. in Alberta).

It is notable that even among agencies that have well-developed policy documents and forms, there is considerable variation in terms of the elements included and the level of detail. It is important to understand, however, that these policies need to be read in conjunction with applicable legislative provisions, in particular, as well as other relevant documents (such as those discussed below), to gain a full picture of permitted disclosures and conditions attached to them. For example, although Ontario's policy documents do not explicitly address the question of researchers contacting patients, this matter is dealt with in the statutory provisions. Another dimension that must be considered is the way that policies and procedures are actually applied, which may lead to variation among agency practices that is not apparent from examining the policy documents themselves.

Codes and Guidelines on Data Use and Access

Cancer agencies can refer to several national, regional and international sources for guidance on the use and disclosure of patient information. As part of its resources for member registries, the North American Association of Central Cancer Registries provides an "Inventory of Best Practices Assurance of Confidentiality and Security." (103) This document contains a checklist of practices relating to confidentiality, education, and the security of electronic and paper documents.

The International Association of Cancer Registries, of which most Canadian registries are members, has published Guidelines on Confidentiality for Population-Based Cancer Registration (revised in 2004). (104) This document provides guidance on:

(a) The need for a code of conduct in the maintenance of confidentiality in cancer registration, and the definition of what should be considered confidential.

(b) The purpose of confidentiality measures in cancer registration, and their legal basis.

(c) The principles of confidentiality, including the measures to maintain and review security procedures.

(d) The use and release of registry data in accordance with these principles. (105)

The Guidelines affirm the importance of confidentiality while recognizing that the traditional principle of informed consent is not practicable in population-based public health research. They provide general guidance which is to be considered in light of local legislation. (106)

The International Epidemiological Association has also produced a document entitled Good Epidemiological Practice (GEP)--IEA Guidelines for proper conduct of epidemiologicaI research. (107) Though these are general guidelines for the conduct of epidemiological research rather than for registry operations specifically, they contain useful discussions of basic principles such as consent and confidentiality.

In Canada, the major document governing the use of personal information for research is the Tri-Council Policy Statement on the Ethical Conduct of Research Involving Humans (the "TCPS"), (108) a joint document issued by the three major research funding councils in Canada, the Canadian Institutes of Health Research, the Social Sciences and Humanities Research Council of Canada and the Natural Sciences and Engineering Research Council. The TCPS describes standards and procedures for governing research involving human subjects. Distinguishing between health surveillance activities and research activities may be important as non-research activities do not require ethics review, but both types of activities are subject to laws and policies that regulate collection, use and disclosure of personal information.

The TCPS mandates that ethical review is required for all research with human subjects, including research with identifiable information and human tissues. It sets out rules stipulating when informed consent of research subjects is required for use of their information and/or tissues in research and establishes principles for safeguarding privacy and ensuring confidentiality. (109) The TCPS contemplates that some types of research may require re-contact with individuals whose personal information or biological specimens were previously collected for another purpose; such contact is permitted with the authorization of the REB. (110)

While the TCPS is a policy statement and does not have the force of law, organizations that fail to comply with the ethical rules face penalties in the form of suspension of research funding. Compliance audits and the risk of funding withdrawal create strong incentives for compliance within the research community funded through the Tri-Councils.

Data Quality Standards

Though mandatory requirements contained in legislation are often assumed to be the norm, non-binding standards and guidelines promoted by various national and international bodies also play an important role in harmonizing the operations of cancer registries and ensuring data quality. For cancer registries in Canada, the Canadian Cancer Registry (CCR) and the North American Association of Central Cancer Registries (NAACCR) are particularly important.

The CCR is maintained by Statistics Canada and contains data for all Canadian residents who have been diagnosed with cancer. It is composed of data that is shared by all provincial and territorial cancer registries. (111) The CCR publishes manuals and guides that set out rules for reporting of cancer data by provincial and territorial registries, including the preparation and content of records. (112) The provincial and territorial registries send data to the CCR in a pre-edited, standardized format. (113) The records are verified and data quality reports are provided to the contributing registries to allow them to monitor the quality of their data. (114) These procedures provide some--though limited--assurance of data quality.

The NAACCR provides annual certification for registries that have met specific criteria. Registration is based on completeness, accuracy, and timeliness of data, and seeks to ensure that "data from the year are of sufficiently high quality to use in the calculation of standard incidence statistics." (115) There are two levels of certification: silver and gold. (116) Certification is awarded on an annual basis, and about seven Canadian cancer registries have been awarded either silver or gold certification in recent years. (117) Although this is encouraging, it does not compare favourably with the substantially higher proportion of U.S. cancer registries that regularly obtain certification. (118) The NAACCR also publishes data standards for cancer registries (119) and registry operations guidelines. (120)

These standards focus on data quality, complementing the legislative provisions on other matters, such as reporting, use, and disclosure. The NAACCR has also published guidance and best practices on confidentiality and disclosure, though these matters are not taken into consideration for certification. (121)

Part 4: Discussion of Legal and Policy Framework

This Part has two key objectives: first, legislation relevant to cancer surveillance activities in Canada is evaluated, primarily with reference to the performance criteria explained in Part 2; second, an assessment of strengths, weaknesses and gaps is provided. The Part concludes with brief discussion of new ways in which cancer surveillance and research activities are being facilitated through specialized registries and tumour banks.

Evaluation of Legislation against the Performance Criteria

The review conducted in 2000 found that there was significant variation in the structure and content of legislation in different Canadian jurisdictions. It also found that no jurisdiction's legislation fully matched the recommended performance criteria, and in most cases the gap between recommended and existing provisions was substantial. (122) To a large extent these conclusions remain valid today. There have been some important changes in the legal framework, for example new cancer legislation in Saskatchewan and new health information legislation in Ontario. However, there remains a large degree of variation in the legislative frameworks across Canada. Few jurisdictions have legislation that approximates the recommended performance characteristics, and there are still significant gaps in several jurisdictions.

The most notable gaps between existing and recommended legislative frameworks are the absence of clear statutory authority for the creation and maintenance of registries or tumour banks in most jurisdictions and the lack of mandatory reporting in almost half of Canadian jurisdictions.

Reporting of cancer information may be routine or automatic, without being legally mandated. New Brunswick reports a high rate of capture for its registry, despite not having mandatory reporting. (123) Having administrative systems in place that ensure that relevant data is captured and reported will help to ensure complete and timely registration. Using North American Association of Central Cancer Registries certification as a reference point (see Part 3), it appears that a number of jurisdictions, including some that do not have mandatory reporting, are meeting data quality standards, including accuracy, timeliness and completeness. (124) However, in the absence of a legislative provision making reports mandatory, no legal recourse is available if the system fails.

The question also arises whether a patient could insist that his or her information not be shared with a cancer registry, if no mandatory reporting obligation exists. Whether the information can be shared without the individual's consent in that scenario will depend on other provisions governing personal information and its disclosure, in particular whether information can be disclosed without consent for this purpose. For example, the Personal Health Information Protection Act, 2004 in Ontario allows disclosure of personal health information without consent to Cancer Care Ontario as a prescribed entity, for certain purposes. However, in most cases the mandatory reporting requirement provides the legal basis for sharing information with a cancer registry without the patient's consent, since disclosure without consent is permitted under information and privacy legislation where required by legislation. In the absence of mandatory reporting, there is a risk that patients might be able to opt out of reporting. This could seriously compromise the comprehensiveness of registry data, rendering the registry essentially useless. There is widespread consensus that a population registry that relies on patient consent for data collection is not feasible. (125) Even where there is another exception that could be relied on to permit disclosure without consent, an explicit reporting requirement increases transparency, which helps to support one of the ethical justifications for an exception to the consent requirement. (126)

Where reporting obligations exist, there is a significant degree of variation in the amount of detail specified in legislation as to reportable conditions and information to be reported, although it is possible that these legislative provisions are supplemented by reporting forms or non-legislated guidelines. As discussed in Part 3 above, certification and data quality standards may play an important role in ensuring consistency of information, notwithstanding their non-binding status. Legislative requirements would, however, provide greater certainty and transparency.

The amount of detail set out in legislation regarding conditions for disclosure, particularly for research purposes, is also highly variable. Again, it is possible that there is more consistency than appears on the face of the legislation because it is supplemented by common guidelines such as the Tri-Council Policy Statement as well as internal policies and procedures, but there also appears to be substantial variation in internal policies, as will be apparent from the analysis in Part 3.

Assessment of Strengths, Weaknesses, and Gaps

Many strengths were noted both in the legal framework and in what we were able to learn of the actual operation of cancer agencies and registries. Despite the lack of mandatory reporting in many jurisdictions, registries are obviously functioning and have achieved acceptable rates of data capture. A majority of provincial and territorial cancer registries have been certified by the NAACCR in recent years, which provides some assurance of data quality.

Information and privacy legislation or health information legislation provides important guidance with respect to collection, use and disclosure of personal health information. Health information statutes, where they exist, are particularly helpful in that they contain provisions tailored to the specific considerations of health information (both its sensitivity and its potential uses) and that apply to information in the hands of physicians and private facilities like laboratories as well as public bodies. There is a large degree of consistency in provisions regarding such key matters as disclosure without consent, though the level of detail provided varies from one jurisdiction to another.

Key weaknesses and gaps have been highlighted above in the discussions of legislation and, to a lesser extent, policies and procedures. As in the 2000 report, our review of the legal framework noted a high degree of variation in the structure of legislation in different jurisdictions, and some significant gaps. As noted in the discussion above, few jurisdictions have legislation that is close to matching the recommended performance characteristics. In many jurisdictions there are significant gaps in legal authority, e.g. for the maintenance of a registry and/or tumour bank, reporting of patient data, access to patient information for registry purposes, and sharing of vital statistics data. Although it appears that these activities often continue despite the lack of explicit legislative authority, specific provisions would provide greater certainty and transparency.

The governing framework for cancer surveillance can best be described as a patchwork of laws, implementing policies, and non-binding standards. This patchwork may present a barrier for those wishing to conduct research, especially in more than one jurisdiction. Though the overriding principles for the legislation are consistent across the country, the structure and level of detail with which they are expressed are very different from one province to the next.

The patchwork nature of the legal framework reflects a broader issue of the fragmentation of cancer surveillance in Canada. Indeed, the Canadian Cancer Society has noted:
   Canada has long been a world leader in collecting and analyzing
   cancer incidence and mortality statistics, through its provincial
   cancer registries and national databases. However, the systems have
   collectively fallen short of providing aggregate statistics of
   several parameters that are important to cancer control planning at
   the provincial and national levels... Many individual systems
   collecting and storing cancer data operate relatively independently
   of each other; these include the provincial and territorial cancer
   registries, Statistics Canada, Health Canada, and Canadian
   Institute for Health Information (CIHI), and there is some
   variation among systems in approaches to data collection and
   analysis. (127)

This is not an issue unique to cancer surveillance but has been noted in respect of public health surveillance more generally. It has been recognized as a pressing issue in the context of infectious disease surveillance and control. (128) Though some fragmentation is inevitable in a federal system, greater coordination can and must be achieved through harmonization, coordination, and information-sharing agreements.

An area of increasing importance that will require attention is the governance of tumour banks. Significant work has been done in Canada over the past several years to establish a national network of tumour banks. A 2002 report of a national Tumour Bank Working Group commented:
   Changes in technology have created new opportunities and opened new
   avenues for all cancer research sectors to utilize complex tissues
   and data for both hypothesis generation and testing. As a result,
   Tumor/Tissue Banks that were once regarded as simple tools for the
   translational research sector, may now be considered as a critical
   engine for basic, translational, and clinical research.

   However, unlike other research tools such as cell lines and mouse
   models, Tumor Banks incorporating human tissues and data, invoke
   more complex social, medical and multidisciplinary issues. These
   issues include delivery of health care, evolving clinical practice
   patterns, clinical decisions for acquisition, interpretation of
   pathology and clinical data, adherence to ethical standards and
   privacy laws. To attain value a Tumor Bank must also expand over
   time to meet selection criteria and be sustained for many years.

   Lack of a national strategy, opportunities for national funding,
   and these operational issues have combined to reduce Tumor Banking
   capacity and to significantly impact on access to tissues and data
   in Canada. This is despite increasing demand and consistent
   recognition of its importance to all areas of cancer research....

In 2004, the Canadian Tumour Repository Network (130) ("CTRN") was formed as a consortium of key provincial tumour banks to facilitate access to human tissues from member banks for cancer researchers. CTRN has a governing council that oversees Network activities. This council includes representatives of major cancer funding agencies, representatives of provincial participants in the Network, and the CEO of the Canadian Association of Provincial Cancer Agencies.

The application of existing legislation to these tumour banks is somewhat unclear, since they involve the collection, retention, and use of human tissue rather than just information. None of the legislation reviewed contains provisions specifically authorizing or governing tumour banks operated by cancer agencies, as recommended by the performance characteristics, though there may be relevant provisions in other legislation that falls outside the scope of our review. For example, provincial human tissue gift legislation governs donation of tissues for research, education and transplantation purposes. (131) Information and privacy legislation does not apply to tissue samples themselves, though it would apply to any information derived from the tissue.

Tissue banks, of which tumour banks are an example, raise a number of specialized issues that extend beyond the scope of this article. However, given that tumour banks already exist in Canada, and it is reasonable to expect that these will continue to proliferate, it will be important to examine the legislative framework governing these initiatives, as well as the banks' governance structures and privacy and confidentiality policies. The CTRN, for example, addresses privacy issues in several ways. Member banks must comply with applicable legislation and policies, research activities require Research Ethics Board review, staff sign confidentiality agreements, and researchers who seek access to specimens and patient information from member banks only receive de-identified information. Information about patients whose tumour tissues are accessible through the Network is coded with unique identifiers so that CTRN systems do not contain personally identifiable information. It is common practice among Canadian tumour banks to remove patient identifiers and release only de-identified materials to researchers. (132) In addition to meeting any applicable research ethics review requirements through the researcher's institution, the researcher may require approval from a tumour bank committee. For instance, the Ontario Tumour Bank has a Tissue Ethics Committee that is responsible for reviewing the scientific merit and ethical aspects of proposed research involving samples held by the bank. (133) The BC Cancer Agency Tumour Tissue Repository Initiative has developed a comprehensive privacy policy based on the CSA Model Code for the Protection of Personal Information. (134)

Looking beyond the recommended performance characteristics, a number of other issues arise in the day-to-day operations of cancer registries that indicate gaps or weaknesses in the legal and policy framework. For example, legislation and policies are in place across the country that allow for the use and disclosure of cancer registry data for research, as described above. However, cancer registry data is also used for surveillance activities, such as the analysis of risk factors and treatment outcomes to inform the prevention and treatment of cancer. Public health surveillance does not fall clearly within the definition of research, (135) or of other activities that are the subject of legislative provisions, such as quality assurance or administration, though it may contribute to these. Public health activities like surveillance have been described as being "[l]ost in a legal and ethical grey zone" because they "are not neatly characterized as either practice or research." (136) There is no clear consensus on how these activities should beclassified," (137) and without it there will be little consistency in the application of laws and policies. Different cancer registries, REBs, and public health practitioners will have differing views on whether a particular use of data constitutes "research," and if it does not, what legal provisions or policies should apply.

Another problem in the interpretation and application of legal and policy provisions in this context is determining when health information is identifiable. As explained earlier, both legislation and cancer registry policies distinguish between identifiable and non-identifiable information, and this distinction determines what restrictions will apply to the use and disclosure of the information. When faced with a request for patient information, a registry will need to determine whether non-nominative or aggregate data carries a high enough risk of re-identification that its release should be refused or restricted. (138) This is most often an issue with small data sets where the limited number of individuals makes re-identification more likely, even for aggregate data. As a result, it is common practice to suppress small ceils (cases below a certain number, e.g. 6 cases). (139) However, there are at least two difficulties with this: first, there may be an important scientific or public interest in knowing that a small number of cases occurred, and second, any number that is used to determine what should be suppressed will be arbitrary to some extent, potentially providing more protection than is required or not enough. The number of cases that carries a significant risk of re-identification may vary between populations and geographic locations. To make matters more difficult, definitions of what constitutes "personal" (i.e. identifiable) information vary between different jurisdictions. (140) Greater consistency in these definitions and a clearer understanding of how they apply in this context are needed.

Finally, legislation across Canada has been designed or is being revised to provide a framework for the transition to electronic health records (EHRs). However, the use of data in EHRs for secondary purposes such as cancer registration, surveillance, and research has not adequately been addressed. (141) There are obvious advantages in allowing access to EHR data for these purposes, since data collection could be faster and more comprehensive, yielding better overall data quality and efficiency. The current incremental approach to developing EHRs, focusing first on primary uses of data and leaving the issue of secondary use until a later stage, may result in missed opportunities and later complications. (142)

Port 5: Tools for Enhancing Cancer Surveillance in Canada

Objectives and Considerations Tools that may be developed to improve the framework for cancer surveillance activities in Canada could have several objectives. Taking into account the discussion above, priorities would include addressing the key weaknesses or gaps identified, such as:

* Lack of mandatory reporting in a number of jurisdictions;

* Variation in reporting requirements where they do exist;

* Lack of clear authority for registries and tumour banks in many jurisdictions;

* Differences between jurisdictions in the structure of applicable legislation and the level of detail in legislative provisions; and

* Ambiguity and inconsistency in applicable legislative provisions.

In broader terms, any strategies would aim to increase:

* Certainty: providing clear legal authority and limits for activities;

* Comprehensiveness: ensuring comprehensive compilation of cancer data to optimize public health benefits of surveillance programs;

* Consistency: harmonizing laws and policies across jurisdictions;

* Quality: improving timely, accurate and complete reporting; and

* Transparency: making it easier for interested persons to inform themselves about relevant laws and policies.

Each of these objectives brings some challenges. In particular, it is important to recognize the limits of harmonization, especially in a country like Canada that has a federal system. For better or worse, each province and territory in Canada has its own distinct laws. Any attempt to harmonize the legal frame works for cancer surveillance must respect this diversity, acknowledging that not all differences are negative, and must accept that the laws and policies applicable to cancer patient information are affected by the broader legal context in each jurisdiction.

Bearing in mind the principles and issues discussed in earlier parts, any initiatives also must balance privacy interests of individuals (and possibly groups) in society against legitimate uses of personal information, such as providing quality health care and enabling health research for the public good.

Tools for strengthening the framework

Model legislation, template policies and agreements, standards and guidelines, best practice documents, and consensus statements are all tools that may be used to enhance certainty, comprehensiveness, consistency, quality and transparency of cancer surveillance systems. These options are not mutually exclusive, and design and adoption of more detailed tools may well follow the development of other tools that provide broader guidance. For example, model legislation and template policies and agreements may be developed to meet the principles and objectives set out in best practice guidelines and consensus statements. The advantages, challenges and priorities for use of each of these tools are summarized in Figure 2 following the discussion below.

Model legislation

Model legislation, such as a draft statute, is commonly used by law reform organizations. Its main objective is to promote harmonization, though even if model legislation is adopted, it may be modified somewhat in each jurisdiction. Model legislation can be an effective way of providing clear guidance on key issues and ensures a high degree of consistency if it is adopted. Its limitations are that it tends to suggest a one-size-fits-all approach which may not be appropriate where other relevant aspects of the legal framework are different or where the needs and interests of different jurisdictions are not consistent.

Model legislation may be particularly useful for those jurisdictions that do not currently have well-developed legislative frameworks, since it provides them with a model to use should they choose to engage in law reform. It also offers particular benefits for smaller jurisdictions where capacity is limited. Any model legislation depends on political support and initiative in order to be adopted.

One example of model legislation that might be useful in this context is a model cancer agency statute that includes legal authority for the registry, mandatory reporting obligations, and use and disclosure provisions. It could be designed in such a way as to be adapted to jurisdictions with different legal frameworks (e.g. coordination with FOIPP or health information legislation). Model vital statistics or public health legislation may also be useful, though these would involve issues extending beyond cancer surveillance.

In the United States, the Center for Law and the Public's Health (143) has produced a Model State Public Health Act and a Model State Public Health Privacy Act. The US National Program of Cancer Registries has conducted work on model cancer registry legislation.

Template policies and agreements

Templates for policies and agreements, such as use and disclosure policies and research agreements, would be similar to model legislation in that they provide a model to be adopted (and, if necessary, adapted) in jurisdictions that are considering policy development or reform. This approach offers many of the same advantages as model legislation but also has some similar limitations. In particular, model policy documents would need to be adaptable to different legislative environments, since they are designed to implement rather than modify legislation.

Development of template documents would be aided by the fact that some cancer agencies and registries across Canada have already developed agreements and forms for various purposes. As noted above in Part 3, there are also several authoritative international sources that could be used as points of reference, such as the IARC Guidelines. (144) Template documents would be particularly helpful for agencies that would like to adopt policies to assist them in their operations, but have not yet been able to devote resources to doing so. They could also help to promote greater consistency in policies across the country. As explained in Part 4, there appears to be substantial variation across the country in terms of the level of development and detail of policies; therefore, model policies or templates may be a priority for action.

Standards and guidelines

Non-binding standards and guidelines may take many different forms and be used for a range of purposes. Typically they will set out a common practice or minimum standard to be followed. As discussed above, such standards are already in place for data quality. Standards and guidelines could also be developed for dealing with internal access and use policies or disclosure for research purposes, for example. Like template policies, these documents would need to take account of the different legislative frameworks across Canada.

Standards and guidelines discussed in other sections of this report, such as the Canadian Standards Association Model Code for the Protection of Personal Information and the Tri-Council Policy Statement for the Ethical Conduct of Research Involving Humans, provide examples. While the CSA Code provides a set of high-level principles, the TCPS provides more detailed guidance (and also has penalties for non-compliance).

Best practice documents

As the name suggests, "best practices" are similar to standards and guidelines but set out "ideal" or recommended policies and practices that organizations should aim for. They are based on experience of what works best and draw on existing practices that can be held up as examples. As a result, input and cooperation from agencies would likely be required to develop this type of tool. Best practices may take different forms, for example a checklist or a collection of procedures, principles, or rules to be followed. The NAACCR has developed a best practice document regarding confidentiality and disclosure from a U.S. perspective; a Canadian equivalent that takes into account our unique legal framework might be useful.

Development of best practice documents for cancer surveillance should take account of existing best practice documents in areas such as health informatics and health research. For example, in the United States, the National Program of Cancer Registries has carried out work on "best practices for messaging standards, standard vocabularies for cancer surveillance, and other technical and operational standards such as security." (145) In Canada, the Canadian Institutes of Health Research adopted in September 2005 a best practices document for protecting privacy in health research. (146) It may also be useful to facilitate sharing of best practices between cancer agencies, so they can learn from each others' experiences of similar issues.

Consensus statements

Consensus statements set out agreed principles or common positions on issues. They are best suited to higher-level principles, and can be used to guide the development of other tools that translate these principles into operational procedures or policies. It is not clear how valuable this type of tool would be in this context, since there already appears to be a degree of consistency at the level of broad principles. However, it may be useful to state a consensus position regarding some matters, such as the importance of mandatory reporting requirements or of data quality certification.

Model legislative provisions for the operation of cancer registries may be a useful tool to develop in the near future, given the significant gaps and variations we identified in our review of legislation. A potential difficulty with this approach is that it may be challenging to take into account the different legislative environments in each province and territory. However, it may be possible, and useful, to draft a set of common provisions that could be adapted to accommodate those differences.

Our review also found a significant degree of variation across the country in the level of development of registry policies and procedures for the use and disclosure of data. Therefore, a set of model policies or best practice guidelines would also seem to be a useful avenue to pursue.


This article has provided a comprehensive analysis of various sources of law relevant to cancer information in Canada, and has examined policies specific to the operations of cancer registries, as well as codes/guidelines regarding protection of personal information and research with human subjects. The article has identified key strengths and weaknesses in the legal framework, as well as tools that could be used to enhance cancer surveillance by improving certainty, comprehensiveness, consistency, quality and transparency in regard to data collection and uses.

The theme of balancing legitimate and valuable uses of information with appropriate privacy protection runs through this article. Health organizations have certain legal and ethical obligations to implement programs and policies to meet health protection and promotion goals. Some individuals may, however, have particular sensitivity about how personal information is used to meet these goals, and may challenge organizations' activities. Knowledge of legal principles and policies related to privacy and protection of personal information is important so organizations may design and conduct their activities in ways that meet public health goals while ensuring appropriate consideration of individuals' interests in collection, use and sharing of personal information.

As discussed in Part 1, Canadian courts and Privacy Commissioners recognize the importance of public health activities. Legislators who enact laws governing cancer programs and regulating personal information also attempt to strike a balance between facilitating collection, use and sharing of information for appropriate purposes and respect for personal privacy. At times, this balance is not achieved. If those who are involved in cancer surveillance and research face legal and policy barriers to their legitimate activities, these experiences should be communicated to Privacy Commissioners and appropriate government departments. Some provincial privacy laws in Canada have been amended in response to complaints that specific provisions were overly restrictive or burdensome. (147)

This article focuses on laws and policies, and it is recognized that actual practices may vary among the numerous individuals and organizations that collect, use, retain and share cancer patient information. In some situations, practices may not reflect formal policy statements and, in others, a lack of applicable legislation or policy guidance may lead to variations in practice. These variations will need to be taken into account in determining the best ways forward. Further research and work to develop, test and implement potential tools and strategies are key to improving the Canadian frameworks that govern collection, use and disclosure of cancer patient data for cancer surveillance and control purposes.
Appendix: Table of Legislation (148)

                                            Health and
                   Cancer                   public health

Yukon                                       Health Act, R.S.Y
                                            2002, c. 106

British Columbia   British Columbia         Public Health Ad,
                   Cancer Agency            S.B.C. 2008, c.
                   Research Information     28; (149) Health
                   Regulation, B.C.         Act, R.S.B.C.
                   Reg. 286/91              1996, c. 179 (150)

Alberta            Cancer Registry
                   Regulation, Alta. Reg.
                   71/2009 (152)

Saskatchewan       Cancer Agency Act,
                   S.S. 2006, c. C-1.1;
                   Cancer Agency
                   Regulations, Sask.

Manitoba           CancerCare Manitoba      Public Health Act,
                   Act, C.C.S.M. c. C20;    S.M. 2006, c. 14;
                   Cervical Cancer          (156) Reporting of
                   Screening Registry       Diseases and
                   Regulation, Man. Reg.    Conditions
                   31/2009                  Regulation, Man.
                                            Reg. 37/2009 (157)

Ontario            Cancer Ad, R.S.O.
                   1990, c. C.1

Quebec                                      Act Respecting
                                            Health Services and
                                            Social Services,
                                            R.S.Q. c. S-4.2;
                                            Public Health Act,
                                            R.S.Q. c. S-2.2

New Brunswick

Prince Edward                               Public Health Act,
Island                                      R.S.P.E.I. 1988, c.
                                            P-30; Notifiable and
                                            Regulations, P.E.I..
                                            Reg. EC330/85

Nova Scotia        Queen Elizabeth II       Health Act, R.S.N.S.
                   Health Sciences          1989, c. 195
                   Centre Act, S.N.S.
                   1995-96, c. 15

Newfoundland and   None (159)               Health and
Labrador                                    Community Services
                                            Act, S.N.L. 1995,
                                            P-37.1 (160)

NWT                                         Disease Registries
                                            Act, R.S.N.W.T.
                                            1988, c. 7 (Supp.);
                                            Reportable Diseases
                                            Order, R.R.N.W.T
                                            1990, c. D-3

Nunavut                                     Disease Registries
                                            Act, R.S.N.W.T.
                                            1988, c. 7 (Supp.);
                                            Reportable Diseases
                                            Order, R.R.N.W.T
                                            1990, c. D-3

Federal                                     Department of Health
                                            Act, S.C. 1996, c.
                                            8; Public Health
                                            Agency of Canada
                                            Act, S.C. 2006

                   Information and         Health
                   privacy                 information

Yukon              Access to
                   Information and
                   Protection of
                   Privacy Ad, R.S.Y
                   2002, c. 1

British Columbia   Freedom of              E-Health (Personal
                   Information and         Health Information
                   Protection of           Access and
                   Privacy Act,            Protection of
                   R.S.B.C. 1996, c. 165   Privacy) Act, S.B.C.
                                           2008, c. 38 (151)

Alberta                                    Health Information
                                           Act, R.S.A. 2000,
                                           c. H-5

Saskatchewan                               Health Information
                                           Protection Act, S.S.
                                           1999, c. H-0.021

Manitoba                                   Personal Health
                                           Information Act,
                                           C.C.S.M. c. P33.5;
                                           Personal Health
                                           Regulation, Man.
                                           Reg. 245/97

Ontario                                    Personal Health
                                           Protection Act,
                                           2004, S.O. 2004, c.
                                           3, Sch. A; General,
                                           O. Reg. 329/04
                                           (under Personal
                                           Health Information
                                           Protection Act)

Quebec             Act Respecting
                   Access to Documents
                   Held by Public
                   Bodies and the
                   Protection of
                   Information, R.S.Q.,
                   c. A-2.1

New Brunswick      Protection of
                   Personal Information
                   Act, S.N.B. 1998, c.
                   P-19.1; [Right to
                   Information and
                   Protection of
                   Privacy Act, S.N.B.
                   2009, c. R-10.6

Prince Edward      Freedom of
Island             Information and
                   Protection of
                   Privacy Act,
                   R.S.P.E.I. 1988, c.

Nova Scotia        Freedom of
                   Information and
                   Protection of
                   Privacy Ad, S.N.S.
                   1993, c. 5; Freedom
                   of information and
                   Protection of
                   Privacy Regulations,
                   N.S. Reg. 105/94

Newfoundland and   Access to               Personal Health
Labrador           information and         Information Act,
                   Protection of           S.N.L. 2008,
                   Privacy Act, S.N.L.     c. P-7.01
                   2002, c. A/1.1;
                   (161) Access to
                   Regulations, N.L.R.

NWT                Access to
                   Information and
                   Protection of
                   Privacy Ad, S.N.W.T.
                   1994, c. 20; Access
                   to Information and
                   Protection of
                   Privacy Regulations,
                   N.W.T. Reg. 206-96

Nunavut            Access to
                   Information and
                   Protection of
                   Privacy Act,
                   S.N.W.T. 1994, c.
                   20; Access to
                   Information and
                   Protection of
                   Privacy Regulations,
                   N.W.T. Reg. 206-96

Federal            Privacy Art, R.S.C.
                   1985, c. P-21

                   Other privacy          Vital statistics

Yukon                                     Vital Statistics Ad,
                                          R.S.Y 2002, c. 225

British Columbia   Personal Information   Vital Statistics
                   Protection Act,        Act, R.S.B.C. 1996,
                   S.B.C. 2003, c. 63;    c. 479
                   Privacy Ad, R.S.B.C.
                   1996, c. 373

Alberta                                   Vital Statistics
                                          Act, R.S.A. 2000,
                                          c. V-4 (153)

Saskatchewan       Privacy Act, R.S.S.    Vital Statistics
                   1978, c. P-24          Act, 1995, S.S. 1995,
                                          c. V-7.1 (155)

Manitoba           Privacy Act, R.S.M.    Vital Statistics
                   1987, c. P125          Act, C.C.S.M., c.

Ontario                                   Vital Statistics
                                          Act, R.S.O. 1990, c.
                                          V4; General, R.R.0.
                                          1990, Reg. 1094
                                          (under Vital
                                          Statistics Act)

Quebec             Charter of Human       Act Respecting the
                   Rights and Freedoms,   Institut de la
                   R.S.Q., c. C-12; Act   statistique du
                   Respecting the         Quebec, R.S.Q. c.
                   Protection of          I-13.011; Civil
                   Personal Information   Code of Quebec,
                   in the Private         C.c.Q, Title 3
                   Sector, R.S.Q., c.
                   P-39.1; Civil Code
                   of Quebec

New Brunswick                             Vital Statistics
                                          Act, S.N.B. 1979,
                                          c. V-3

Prince Edward                             Vital Statistics Ad,
Island                                    R.S.P.E.I. 1988, c.
                                          V/4.01; General
                                          Regulations, P.E.I.
                                          Reg. EC 453/00
                                          (under Vital
                                          Statistics Act)

Nova Scotia                               Vital Statistics
                                          Act, R.S.N.S.1989,
                                          c. 494

Newfoundland and   Privacy Act, R.S.N.    Vital Statistics
Labrador           1990, c. P-22          Act, R.S.N. 1990, c.
                                          V-6 (162)

NWT                                       Vital Statistics
                                          Act, R.S.N.W.T 1988,
                                          c.V-3; Access to
                                          Records Regulations,
                                          R.R.N.W.T. 1990,

Nunavut                                   Vital Statistics
                                          Act, R.S.N.W.T.
                                          1988, c.V-3; Access
                                          to Records
                                          R.R.N.W.T 1990,

Federal            Personal Information   Statistics Act,
                   Protection and         R.S.C. 1985, c.
                   Electronic Documents   S-19
                   Act, S.C. 2000, c. 5


Yukon              Scientists and
                   Explorers Act, R.S.Y
                   2002, c. 200

British Columbia

Alberta            Regional Health
                   Authorities Ad,
                   R.S.A. 2000, c.
                   R-10 (154)





New Brunswick      Regional Health
                   Authorities Act,
                   S.N.B. 2002, c.
                   R-5.05; General
                   Hospital Act, N.B.
                   Reg. 92-84; General
                   Regional Health
                   Authorities Act,
                   N.B. Reg. 2002-27

Prince Edward

Nova Scotia

Newfoundland and   Health Research
Labrador           Ethics Authority
                   Act, S.N.L. 2006,
                   c. H-1.2

NWT                Scientists Ad,
                   R.S.N.W.T 1988,
                   c. S-4

Nunavut            Scientists Act,
                   R.S.N.W.T 1988,
                   c. S-4


Barbara van Tigerstrom & Nola M. Ries *

* Barbara von Tigerstrom, Associate Professor, College of Law, University of Saskatchewan, Saskatoon, Saskatchewan and Research Fellow, Health Law Institute, University of Alberta, Edmonton, Alberta. Nola M. Ries, Assistant Professor at the University of Victoria, Victoria, BC and Research Associate, Health Law Institute, University of Alberta.

** This research was funded by Health Canada, through the Canadian Partnership Against Cancer. The views expressed herein are those of the authors. We would like to thank the many staff members from departments of health and cancer agencies and registries who responded to our requests for information and copies of policy documents. Without their assistance, the analysis of policies and procedures would not have been possible. The information in this article is current to July 2009 unless otherwise noted.

(1) The discussion in this article focuses on the activities of comprehensive public cancer registries. However, there are also smaller, more specialized registries, which are often part of or used for specific research projects or patient-care initiatives and operated by a health or academic centre involved in studying or treating those with the relevant disease. Since they are generally not undertaken with a specific public mandate like the provincial and territorial registries, their main form of oversight would be through existing mechanisms for governance of research ethics.

(2) A report based on this earlier research was published as a journal article and later as a report: Barbara von Tigerstrom, et al., "Legal Regulation of Cancer Surveillance: Canadian and International Perspectives" (2000) 8 Health L.J. 1; Barbara von Tigerstrom, et al., Use of Cancer Patient Information for Surveillance Purposes: A Systematic Review of Legislation, Regulations, Policies and Guidelines (Ottawa: Canadian Coalition on Cancer Surveillance, 2000), online: <http://www.phac-aspc.> [2000 Report].

(3) Six core functions of public health are: disease and injury prevention; health promotion; health protection; health surveillance; population health assessment; and emergency preparedness and response. See Government of Canada, The Chief Public Health Officer's Report on the State of Public Health in Canada 2008 (Ottawa: Minister of Health, 2008), online: Public Health Agency of Canada < cpho-report-eng.pdf>.

(4) National Advisory Committee on SARS and Public Health, Learning from SARS: Renewal of Public Health in Canada (Ottawa: Health Canada, 2003) at 80.

(5) For an overview of such activities, see the Public Health Agency of Canada webpage on surveillance: "Surveillance," online: Public Health Agency of Canada <>.

(6) For discussion of types and methods of surveillance, see e.g.S. Declich & A.O. Carter, "Public health surveillance: historical origins, methods and evaluation" (1994) 72 Bulletin of the World Health Organization 285.

(7) For example, Barrett et al. found that "[t]he majority of the British public does not consider the confidential use of personal, identifiable information by the National Cancer Registry for the purposes of public health research and surveillance to be an invasion of privacy. Furthermore, four fifths of the public would support a law making cancer registration statutory." Geraldine Barrett et al., "National survey of British public's views on use of identifiable medical data by the National Cancer Registry" (2006) 332 British Medical Journal 1068 at 1072. See also Laura M. Beskow et al., "Patient perspectives on research recruitment through cancer registries" (2005) 16 Cancer Causes and Control 1171.

(8) Constitution Act, 1867 (U.K.), 30 & 31 Vict., c. 3, reprinted in R.S.C. 1985, App. II, No, 5, s. 91(6).

(9) See "Canadian Cancer Registry," online: Statistics Canada <>.

(10) These powers derive from provincial constitutional authority in relation to "the Establishment, Maintenance and Management of Hospitals .... " "Property and Civil Rights in the Province," and "Generally all Matters of a merely local or private Nature in the Province." Supra note 8, ss. 92(7), (13), (16).

(11) Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5. The application of this law is complex as it does not apply in provinces where substantially similar legislation is already in force and overlaps with provincial laws regulating health information.

(12) Section 8 of the Charter states: "Everyone has the right to be secure against unreasonable search or seizure."

(13) Section 7 of the Charter states: "Everyone has the right to life, liberty and security of the person and the right not to be deprived thereof except in accordance with the principles of fundamental justice."

(14) R. II. Plant, [1993] 3 S.C.R. 281 at 293, [1993] S.C.J. No. 97.

(15) Cheskes v. Ontario (Attorney General), 87 O.R. (3d) 581, [2007] O.J. No. 3515 at para. 62 (Sup. Ct. Just.).

(16) See, for example, R. v. Dyment, [1988] 2 S.C.R. 417, [1988] S.C.J. No. 82.

(17) For further discussion, see e.g. Nola M. Ries, "Legal Issues in Disease Outbreaks: Judicial Review of Public Health Powers" (2007) 16:1 Health Law Review 11. For cases addressing privacy claims, see e.g. Canadian AIDS Society v. Ontario, 25 O.R. (3d) 388, [1995] O.J. No. 2361 (mandatory reporting of HIV cases under Ontario's Health Protection and Promotion Act a justifiable intrusion on personal privacy, as was tracing of past blood donors to inform them of their HIV+ status); Cheskes v. Ontario (Attorney General) (2007) 87 O.R. (3d) 581 (Sup. Ct. Just.) (liberalized regime for access to adoption records found to violate privacy rights of birth parents and adoptees).

(18) International Covenant on Economic, Social and Cultural Rights, 16 December 1966, 993 U.N.T.S. 3, art. 12.

(19) Ibid., art. 15.

(20) International Covenant on Civil and Political Rights, 16 December 1966, 999 U.N.T.S. 171, art. 17.

(21) UN, Human Rights Committee, General Comment 16: The right to respect of privacy, family, home and correspondence, and protection of honour and reputation, 32nd Sess., 1988 at para. 9.

(22) Organization for Economic Cooperation and Development, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (Paris: OECD, 2001) 11.

(23) See e.g, McInerney v. MacDonald, [1992] 2 S.C.R. 138, [1992] S.C.J. No. 57; Norberg v. Wynrib, [1992] S.C.R. 224, [1991] S.C.J. No. 107.

(24) McInerney, ibid. at para. 20. This obligation can also be part of a health care provider's obligations in tort or contract law, or under civil privacy statutes in some provinces: see Peters-Brown v. Regina District Health Board, [1995] S.J. No. 609, [1996] 1 W.W.R. 337 (Q.B.).

(25) Canadian Medical Association, Code of Ethics (Update 2004) (Ottawa: Canadian Medical Association, 2004), online: < PolicyPDF/PD04-06.pdf> [CMA Code].

(26) Canadian Medical Association, "Health Information Privacy Code," online: <> [HIPC]. The HIPC was most recently reviewed in February 2009.

(27) Supra note 25, Principles 31, 33.

(28) Ibid., Principle 35. See also supra note 26, Clause 3.4.

(29) Cancer Programs Act, R.S.A. 2000, c. C-2, s. 30.1. This Act was repealed by the Health Governance Transition Act, S.A. 2008, c. H-4.3, s. 5(2) [in force 1 April 2009].

(30) Health Information Act, R.S.A. 2000, c. H-5.

(31) Ibid., s. 4.

(32) Ibid., s. 6.

(33) Ibid., ss. 20(a), 27(1)(f), 35(1)(p).

(34) Health Information Protection Act, S.S. 1999, c. H-0.021, s. 4(l).

(35) Ibid., s. 27(4)(1).

(36) Cancer Agency Act, S.S. 2006, c. C-1.1, s. 14(1).

(37) General, O.Reg. 329/04, s. 18(1).

(38) Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch. A, ss. 39(1), 45(1).

(39) Ibid., ss. 45(3)-(4).

(40) Ibid., s. 45(6); supra note 37, ss. 13, 18.

(41) In some provinces, the Office of the Ombudsman is authorized under privacy legislation to perform these activities.

(42) The cervical cancer programs in Alberta and Saskatchewan now allow women to opt out of programs if they do not wish to receive letters from the cancer agency, though the agency still receives their test results.

(43) See e.g. Ann Cavoukian, Review of Cancer Care Ontario: A Prescribed Entity under the Personal Health Information Protection Act (Toronto: Information and Privacy Commissioner of Ontario, 2008), online: < 56>.

(44) Vital Statistics Act, S.N.B. 1979, c. V-3, ss. 39.1(d)-(e).

(45) Access to Records Regulations, R.R.N.W.T. 1990, c.V-1, s. 1; Access to Records Regulations, R.R.N.W.T. 1990, c.V-1, s. 1, as duplicated for Nunavut by s. 29 of the NunavutAct, S.C. 1993, c. 28.

(46) See e.g. Vital Statistics Act, R.S.B.C. 1996, c. 479, s. 41.1; Vital Statistics Act, 2009, S.S. 2009, c. V-7.21, s. 82 [Sask. Vital Statistics Act] [not yet in force].

(47) Scientists and Explorers Act, R.S.Y. 2002, c. 200; Scientists Act, R.S.N.W.T. 1988, c. S-4; Scientists Act, R.S.N.W.T. 1988, c. S-4, as duplicated for Nunavut by s. 29 of the Nunavut Act, S.C. 1993, c. 28.

(48) 2000 Report, supra note 2 at App. C.

(49) See e.g. Public Health Act, R.S.Q.c. S-2.2, s. 33 [QC Public Health Act]; Public Health Act, R.S.P.E.I. 1988, c. P-30, s. 3 [P.E.I. Public Health Act].

(50) Cancer Registry Regulation, Alta. Reg. 71/2009; Cancer Agency Act, S.S. 2006, c. C-1.1, s. 12; Disease Registries Act, R.S.N.W.T. 1988, c. 7 (Supp.), s. 9; Disease Registries Act, R.S.N.W.T. 1988, c. 7 (Supp.), s. 9, as duplicated for Nunavut by s. 29 of the Nunavut Act, S.C. 1993, c. 28.

(51) Cervical Cancer Screening Registry Regulation, Man. Reg. 31/2009, s. 3.

(52) CancerCare Manitoba Act, C.C.S.M. c. C20, s. 7(d); Cancer Act, R.S.O. 1990, c. C.1, s. 5(f).

(53) Health Act, R.S.B.C. 1996, c. 179, s. 9(1).

(54) Ibid., s. 9; British Columbia Cancer Agency Research Information Regulation, B.C. Reg. 286/91, s. 2. The new Public Health Act, S.B.C. 2008, c. 28, also provides a framework for mandatory reporting of prescribed diseases and requesting information, but as of the time of writing, the Health Act section and regulations dealing with cancer information remain in force.

(55) Cancer Registry Regulation, supra note 50, s. 6.

(56) Cancer Agency Act, supra note 50, s. 16.

(57) Reporting of Diseases and Conditions Regulation, Man. Reg. 37/2009, ss. 2-6, Sch. B.

(58) Notifiable and Communicable Diseases Regulations, P.E.I. Reg. EC330/85, ss. 6, 17.

(59) Health Act, R.S.N.S. 1989, c. 195, s. 101(1).

(60) Reportable Diseases Order, R.R.N.W.T. 1990, c. D-3, s. 2.

(61) Ibid., as duplicated for Nunavut by s. 29 of the Nunavut Act, S.C. 1993, c. 28.

(62) Supra note 53, s. 9.

(63) QC Public Health Act, supra note 49, s. 38; Health and Community Services Act, S.N.L. 1995, P-37.1, s. 3.

(64) British Columbia Cancer Agency Research Information Regulation, supra note 54, s. 2, App. 1-3.

(65) Cancer Registry Regulation, supra note 50, s. 1 (c); Cancer Agency Regulations, Sask. Reg. 1/2009, s. 3.

(66) Supra note 60; supra note 61.

(67) Supra note 57, Sch. B.

(68) Supra note 58, s. 17(a)(ix).

(69) Supra note 59, s. 101.

(70) Cancer Agency Act, supra note 50, s. 13(1)(b).

(71) British Columbia Cancer Agency Research Information Regulation, supra note 54, App. 3.

(72) Supra note 53, s. 9(1).

(73) Supra note 55, s. 6.

(74) Cancer Agency Act, supra note 50, s. 16(1). Midwives and nurse practitioners are prescribed persons: Cancer Agency Regulations, supra note 50, s. 5.

(75) Supra note 57, ss. 2-6. Section 6, which mentions cancer specifically, mentions only health professionals; the other provisions refer to any reportable disease (which includes cancer).

(76) Supra note 51, s. 2.

(77) Supra note 58, s. 6.

(78) Disease Registries Act, supra note 50, s. 3.

(79) Supra note 59, s. 101(1).

(80) Supranote 51, s. 2(1).

(81) Cancer Care Ontario, ColonCancerCheck Privacy Policy (Toronto: Cancer Care Ontario, 2008), online: Ontario Ministry of Health and Long-Term Care <> at 5

(82) Supra note 51.

(83) Ibid., s. 5(d).

(84) Public Health Act, C.C.S.M c. P210, s. 90(4). The Act also provides that the person will be guilty of a separate offence for each day the offence continues: s. 90(2).

(85) P.E.I. Public Health Act, supra note 49, s. 20.

(86) Disease Registries Act, supra note 50, s. 23.

(87) Supra note 36, s. 16(2).

(88) Disease Registries Act, supra note 50, s. 6(1).

(89) Cancer Programs Act, supra note 29, s. 34(3) [repealed].

(90) Cancer Registry Regulation, supra note 50, s. 3(2).

(91) Cancer Agency Act, supra note 50, s. 13(1)(g).

(92) Sask. Vital Statistics Act, supra note 46, s. 82(2)(e).

(93) Cancer Registry Regulation, supra note 50, s. 4.

(94) Cancer Agency Act, supra note 50, ss. 14-15.

(95) See e.g. Access to Information and Protection of Privacy Act, R.S.Y. 2002, c. 1, s. 38(a); Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, s. 35 (a); supra note 30; An Act respecting access to documents held by public bodies and the Protection of personal information, R.S.Q., c. A-2.1, s. 125 (1); Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5, s. 29(a); Access to Information and Protection of Privacy Act, S.N.W.T. 1994, c. 20, s. 49(a) [N.W.T. Access to Information and Protection of Privacy Act].

(96) See e.g. supra note 34, s. 29(2)(c); Personal Health Information Act, C.C.S.M.c. P33.5, s. 24(3)(a), (c); supra note 38, s. 44(3)(c)-(d).

(97) See e.g. Health Information Protection Act, ibid., s. 29(1)(c); Personal Health Information Act, ibid., s. 24(4); Freedom of Information and Protection of Privacy Act, S.N.S. 1993, c. 5, s.29(c); Freedom of Information and Protection of Privacy Regulations, N.S. Reg. 105/94, s. 9; N.W.T. Access to Information and Protection of Privacy Act, supra note 95, s. 49; Access to Information and Protection of Privacy Regulations, N.W.T. Reg. 206-96, s. 8.

(98) See e.g. Health Information Protection Act, ibid., s. 29( 1 ) (c); Personal Health Information Act, ibid.; supra note 38, s. 44(5); Access to Information and Protection of Privacy Act, ibid., s. 49(d).

(99) Supra note 30, s. 52; Health Information Protection Act, ibid., s. 29(1)(b); Personal Health Information Protection Act, 2004, ibid., s. 44(1) (a)(iii).

(100) In some cases the legislation itself also sets out specific criteria that the REB must consider: Health Information Act, ibid., s. 50; Personal Health Information Protection Act, 2004, ibid., s. 44(3).

(101) See e.g. Personal Health Information Act, supra note 96, s. 24(5); Personal Health Information Protection Act, 2004, ibid., ,s. 44(6)(e).

(102) Supra note 53, s. 9(7); Cancer Registry Regulation, supra note 50, s. 5; Cancer Agency Act, supra note 50, s. 15(b); supra note 86, s. 16(1).

(103) North American Association of Cancer Registries, Inventory of Best Practices Assurance of Confidentiality and Security (Springfield, Ill.: North American Association of Cancer Registries, 2002), online: NAACCR, Inc. < filesystem/pdf/Inventory-Data%20Security_Confid%2004-09-02.pdf>.

(104) International Association of Cancer Registries, Guidelines on Confidentiality for Population-Based Cancer Registration (Lyon: International Association of Cancer Registries, 2004), online: International Association of Cancer Registries <>.

(105) Ibid. at 9, para. 1.2.

(106) Ibid. at 2.

(107) International Epidemiological Association, Good Epidemiological Practice (GEP)--IEA Guidelines for Proper Conduct of Epidemiological Research (Alexandria: International Epidemiological Association, 2007), online: International Epidemiological Association <>.

(108) Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada & Social Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (Ottawa: Public Works and Government Services Canada, 1998 with 2000, 2002 and 2005 amendments), online: Interagency Advisory Panel on Research Ethics < TCPS%20October%202005_E.pdf>[TCPS]. At the time of writing, the TCPS is under review and a draft second edition has been released for comment: Interagency Advisory Panel on Research Ethics, Draft 2nd Edition of the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (Ottawa: Interagency Advisory Panel on Research Ethics, 2008), online: Interagency Advisory Panel on Research Ethics <>.

(109) See ibid., Art. 3.3 (secondary use of information for research purposes), Art. 10.3 (research with previously collected human tissues).

(110) Ibid., Art. 3.5.

(111) Statistics Canada, "Canadian Cancer Registry (CCR)," online: Statistics Canada <http://www.statcan.gc.calcgi-bin/imdb/ 3207&lang=en&db=imdb>.

(112) Statistics Canada, "Canadian Cancer Registry Manual," online: Statistics Canada <>.

(113) Supra note 111.

(114) Ibid.

(115) North American Association of Central Cancer Registries, "Registry Certification," online: NAACCR, Inc. < 54>.

(116) Ibid.

(117) Ibid.

(118) Ibid.

(119) North American Association of Central Cancer Registries, "NAACCR Data Standards of Cancer Registries," online: NAACCR, Inc. <>.

(120) North American Association of Central Cancer Registries, "Registry Operations Guidelines," online: NAACCR, Inc. <>.

(121) Supra note 103; North American Association of Central Cancer Registries, Frequently Asked Questions and Answers about Cancer Reporting and the HIPAA Privacy Rule (Springfield, Ill.: North American Association of Central Cancer Registries, 2003), online: NAACCR, Inc. <>.

(122) 2000 Report, supra note 2 at 44.

(123) New Brunswick Cancer Network, A Cancer Control Accountability Framework (Fredericton: Department of Health and Wellness, 2003), online: <>.

(124) See the discussion of NAACCR certification in Part 3.

(125) John Illman, "Cancer Registries: Should Informed Consent Be Required?" (2002) 94 Journal of the National Cancer Institute 1269; Jack V. Tu et al., "Impracticability of Informed Consent in the Registry of the Canadian Stroke Network" (2004) 350 New Eng. J. Med. 1414; Julie R. Ingelfinger & Jeffrey M. Drazen, "Registry Research and Medical Privacy" (2004) 350 New Eng. J. Med. 1452.

(126) Michael Parker, "When is research on patient records without consent ethical?" (2005) 10 Journal of Health Services Research & Policy 183 at 185 (arguing that one of the ethical justifications is grounded in patients' legitimate expectations about the use of their information).

(127) Canadian Cancer Society website: Canadian Cancer Society, "A new national cancer surveillance system for Canada," online: Canadian Cancer Society < 0,2704,3172_36765516520_langId-en,00.html>.

(128) See e.g. Office of the Auditor General of Canada, 2008 May Report of the Auditor General of Canada to the House of Commons--Chapter 5: Surveillance of Infectious Diseases--Public Health Agency of Canada (Ottawa: Minister of Public Works and Government Services Canada, 2008), online: <>.

(129) Canadian Institutes of Health Research, "Models for Tumour Bank Programs in Canada," online: Canadian Institutes of Health Research <>.

(130) See Canadian Tumour Repository Network, "The Canadian Tumour Repository Network (CTRNet)," online: Canadian Tumour Repository Network <>.

(131) See e.g. British Columbia Human Tissue Gift Act, R.S.B.C. 1996, c. 211; Nova Scotia Human Tissue Gift Act, R.S.N.S. 1989, c. 215; Ontario Trillium Gift of Life Network Act, R.S.O. 1990, c. H.20.

(132) For further discussion of procedures to safeguard patient confidentiality see, for example, Ontario Institute for Cancer Research, "Bioethics," online: Ontario Tumour Bank <> and Alberta Research Tumor Bank, "F.A.Q.," online: Canadian Breast Cancer Foundation <>.

(133) See Ontario Institute for Cancer Research, "Information for Researchers," online: Ontario Tumour Bank < applicationAndReviewProcedure.jsp>.

(134) BC Cancer Agency, Tumour Tissue Repository Initiative: Privacy Policy Manual (Vancouver: BC Cancer Agency, 2004), online: < downloads/ttr/PolicyTTRMANUAL_webAug17-2004.pdf>.

(135) At the time of writing, the TCPS defined research as involving "a systematic investigation to establish facts, principles or generalizable knowledge": TCPS, supra note 108, Art. 1.1.

(136) James G. Hodge, Jr., "An Enhanced Approach to Distinguishing Public Health Practice and Human Subjects Research" (2005) 33 J. L. Med. & Ethics 125 at 125.

(137) Ibid. at 126.

(138) This problem was illustrated by a case in Illinois in which a newspaper challenged the decision of the state Department of Health to refuse a request for data from its cancer registry, including ZIP codes of neuroblastoma patients and dates of cancer diagnoses in these patients, due to concern that the information could be used to identify individual patients. Ultimately, the Illinois Supreme Court agreed with the newspaper and ruled that the public interest in disclosure of information that might reveal an association between environmental pollution and cancer outweighed the potential risk that non-identifying information could be linked with other information to identify a specific cancer patient. Southern Illinoisan v. The Illinois Department of Public Health et al., [2006] Docket No. 98712 (Sup. Ct. Ill.), online: Illinois Courts < court/Opinions/SupremeCourt/2006/February/98712.pdf>.

(139) Cancer Care Ontario, Data Use & Disclosure Policy (Toronto: Cancer Care Ontario, 2008), online: < UserFile.aspx?fileId=13234> at 3.

(140) See e.g. supra note 30, s. l(1)(p) [emphasis added]: ""individually identifying," when used to describe health information, means that the identity of the individual who is the subject of the information can be readily ascertained from the information;" in Saskatchewan's Health Information Protection Act, de-identified personal information is information that "cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified." See supra note 34, s.3(2) [emphasis added].

(141) For a very useful discussion of this issue in relation to secondary uses of EHRs generally, see Patricia Kosseim & Megan Brady, "Policy by Procrastination: Secondary Use of Electronic Health Records for Health Research Purposes" (2008) 2 McGill Journal of Law and Health 5.

(142) Ibid.

(143) See Centers for Law & the Public's Health, "Model Laws," online: Centers for Law & the Public's Health <>.

(144) Supra note 104.

(145) National Program of Cancer Registries, "Cancer Surveillance Messaging, Vocabulary, and Standards Workgroup," online: Centers for Disease Control and Prevention <>.

(146) Canadian Institutes of Health Research, CIHR Best Practices for Protecting Privacy in Health Research (Ottawa: Public Works & Government Services Canada, 2005), online: Canadian Institutes of Health Research <>.

(147) For discussion of examples, see Nola M. Ries, "Patient Privacy in a Wired (and Wireless) World: Approaches to Consent in the Context of Electronic Health Records" (2005-2006) 43 Alta. L. Rev. 681. As another example, British Columbia's new E-Health (Personal Health Information Access and Protection of Privacy) Act, S.B.C. 2008, c. 38, permits contact with individuals for research purposes provided certain conditions are met. This provision was included in the new legislation based on feedback from the research community that prohibitions against contact are too restrictive. In First Reading of the draft legislation in the British Columbia Legislature, the Minister of Health stated: "...earlier this year the health research community raised concerns on their ability to conduct research because they were not able to contact potential participants. With this amendment, if researchers want access to data bank information in order to contact individuals to participate in health research, they will need to make their case to the Information and Privacy Commissioner in order to be granted access, in addition to submitting their proposal to the data stewardship committee." See British Columbia, Legislative Assembly, Official Report of Debates of the Legislative Assembly (Hansard), Vol. 30, No. 4 (10 April 2008) at 11179 (G. Abbott).

(148) Only the legislation that is most directly relevant to cancer information is included in this table" There may be legislation in force in some jurisdictions that would fall within these categories but is not included because it is not currently applicable to cancer information. Information in this table is updated to July 2009 unless otherwise noted.

(149) Most provisions in force 31 March 2009.

(150) Most provisions of this statute were repealed by the Public Health Act, but s. 9, which deals with collection and disclosure of information by the B.C. Cancer Agency, is still in force.

(151) Sections 1 to 7, 11 to 16, 18 to 26 and 31 to 33 in force 7 November 2008; sections 43 (a), 44 and 46 in force 1 April 2009; sections 8 to 10 and 30 in force 30 June 2009.

(152) Replaced the Cancer Programs Regulation, Alta. Reg. 242/1998, in 2009. The Cancer Programs Act, R.S.A. 2000, c. C-2, was repealed by the Health Governance Transition Act, S.A. 2008, c. H-4.3, s. 5(2) [in force 1 April 2009].

(153) This statute will be replaced by Vital Statistics Act, S.A. 2007, c. V-4.1, when it comes into force.

(154) Amended by the Health Governance Transition Act, s. 7, to provide (in s. 11.1) for the continuation of the cancerregistry formerly established under the Cancer Programs Act.

(155) This statute will be replaced by the Vital Statistics Act, 2009, S.S. 2009, c. V-7.21 when it comes into force.

(156) In force 1 April 2009; replaced the Public Health Act, C.C.S.M. c. P210.

(157) In force 1 April 2009; replaced the Diseases and Dead Bodies Regulation, Man. Reg. 338/88R.

(158) Not yet in force.

(159) The Cancer Treatment and Research Foundation Act, R.S.N.L. 1990, c. C-4, was repealed by the Regional Health Authorities Act, S.N.L. 2006, c. R-7.1, which vests the assets and liabilities of the Foundation in the Eastern Regional Health Authority (s. 30(4)).

(160) Formerly Public Health Act, S.N. 1995, c. P-37.1.

(161) Now that the Personal Health Information Act, S.N.L. 2008, c. P-7.01, is in force, the Access to Information and Protection of Privacy Act will no longer apply to personal health information. See Personal Health Information Act, S.N.L. 2008, c. P-7.01, s. 12.

(162) This statute will be replaced by Vital Statistics Act, 2009, S.N.L. 2009, c. V-6.01, when it comes into force (1 October 2009).
Figure 1: Tools for Enhancing Cancer Surveillance


TOOL                 Advantages              Challenges

Model           * promote               * one-size-fits all
Legislation     legislative             approach may not
                harmonization           be appropriate for
                                        all jurisdictions
                * ensure
                consistency across      * may be viewed
                jurisdictions           as adding another
                                        layer of legislation,
                * useful for            thus increasing
                jurisdictions that do   legislative
                not have specific       complexity

Template        * promote               * must be
policies and    consistency across      adaptable to
agreements      organizations           different legislative
                * useful for
                organizations           * would require
                without specific        comprehensive
                policies or standard    review of policies
                agreements              and agreements
                                        already in place

Standards       * promote               * must be
and             consistency in          adaptable to
guidelines      practices and           different legislative
                standards               environments

Best practice   * promote               * would require
documents       adoption of ideal       data collection to
                practices               gather information
                                        on best practices
                * useful for
                organizations that      * uniform
                are developing or       best practices
                updating policies       may not reflect
                and procedures          variation among

Consensus       * well-suited to        * requires
statements      express higher-level    agreement among
                or aspirational         organizations
                                        * less useful where
                                        much agreement
                                        already exists about
                                        key principles


TOOL               Priority Areas

Model           * model cancer
Legislation     agency statute
                to establish legal
                authority for a
                registry, mandatory
                obligations, and
                use and disclosure

Template        * template use
policies and    and disclosure
agreements      policies

                * template
                agreement with
                conditions for
                research disclosure

Standards       * standards and
and             guidelines for use
guidelines      and disclosure for
                key purposes

Best practice   * best practice
documents       statements on
                privacy and data

Consensus       * statements
statements      on mandatory
                and data quality

                * statement
                on balancing
                information use with
                privacy concerns
COPYRIGHT 2009 Health Law Institute
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 2009 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Author:von Tigerstrom, Barbara; Ries, Nola M.
Publication:Health Law Journal
Date:Jan 1, 2009
Previous Article:Judicial reasoning about pregnancy and choice.
Next Article:Starson v. Swayze, 2003-2008: appreciating the judicial consequences.

Terms of use | Privacy policy | Copyright © 2021 Farlex, Inc. | Feedback | For webmasters |