Saskatchewan adopts anti-snooping law for health records

The government is toughening up its laws around the protection of personal health information in Saskatchewan.

• Anti-snooping legislation to protect health info coming to Sask.

The changes are in response to a member of the public finding thousandsof medical records in a Regina dumpster in 2012, something the privacy commissioner at the time called the "worst breach of patient information" his office had ever seen.

Despite that, there were no prosecutions.

That incident sparked the government to create a working group made up of doctors, nurses, government officials and a patient representative to come up with stronger rules.

The amendments to the Health Information Protection Act (HIPA) are effective June 1. They include a reverse onus clause for trustees of medical records to show they took reasonable steps to prevent their abandonment.

A trustee is a doctor or a health professional who is considered responsible for protecting their files.

Ronald Kruzeniski, Saskatchewan's information and privacy commissioner, said he believes these amendments are "somewhat of a direct consequence of the dumpster case."

"I'm not a Crown prosecutor, but as I understand the situation, sort of the knowledge or the willful intent wasn't there or provable," Kruzeniski said. "What this piece of legislation does is basically say, 'When you're a trustee and you have these records, you have to make sure that you safeguard them ... you're responsible to keep track of your records."

My hope is that we never have a prosecution, but that's because files will be protected into the future.- Dustin Duncan, Saskatchewan health minister

Dustin Duncan, Saskatchewan's health minister, said the law will also cover people employed by trustees

"In the past, we've had a problem with the existing HIPA legislation because it was silent on a couple of areas. One was whether or not an employee of a trustee was not specifically identified in the existing Act. So we had some cases where prosecution couldn't be followed up on because it technically wasn't the trustee that had disposed of the records improperly."

Duncan said he believes the province is now "better positioned to have the intent of the legislation prevail."

"My hope is that we never have a prosecution, but that's because files will be protected into the future," he said.

No more snooping

The changes also specify snooping as an offence, after a number of cases where health care workers accessed medical records without a professional reason for doing so.

You're not entitled to just snoop on an ex-spouse or a neighbour or a friend or an ex-friend.- Ronald Kruzeniski, Saskatchewan's information and privacy commissioner.

"Even the late Mayor (Rob) Ford in Toronto is a pretty high-profile case where his records were violated," Duncan said. "So we know that it happens, and it certainly has happened in Saskatchewan."

Kruzeniski also agreed that snooping is a Canada-wide issue.

"We do need to do more to have our legislation up-to-date to, in effect, inform and tell people that when you are a health professional working in a system where you have access to large amounts of personal data, that you really are to be accessing the information that's related to your job," Kruzeniski said.

"You're not entitled to just snoop on an ex-spouse or a neighbour or a friend or an ex-friend."

Duncanadded that the changes also give the minister the ability to appoint somebody to go and collect records that have been disposed of improperly.

"There was a dispute of who needed to go and take those records into possession," he said. "So this really does allow for the minister to appoint somebody to actually go."

The government said the maximum fine under HIPA is $50,000 and/or up to one year imprisonment. The maximum fine for an organization or corporation is $500,000.

Central repository for records

When Don McMorris served as the province's health minister, he talked about a central repository for these records. Duncan said the governmenthopes to do it as soon as possible, but there is still work to do.

"We are continuing to follow up with that recommendation. We are in discussions with the various stakeholders, including the SMA (Saskatchewan Medical Association) and others. We're still trying to work out what that exactly looks like (and) who would be responsible for the records."

No specific timeline has been set for the repository.