Personal Health Information - Disclosure to Police

1. Personal Health Information - Disclosure to Police R. Gary Dickson, Q.C. Saskatchewan Information and Privacy Commissioner Privacy and Access Section, Canadian Bar Assoc.

2. Introduction • Advent of The Health Information Protection Act (HIPA) • Confusion over section 27(4)(a) HIPA • Legislative focus on criminal gang activity • Historical approach to secondary uses and disclosures of personal health information (PHI ) Privacy and Access Section, Canadian Bar Assoc.

3. Agenda • Disclosure to Police of PHI prior to Sept. 1, 2003 • Disclosure to Police of PHI after Sept. 1, 2003 • Disclosure to Police Regulations under HIPA • The Gunshot and Stab Wound Mandatory Reporting Act • Regional health authority response • Resources Privacy and Access Section, Canadian Bar Assoc.

4. Definitions • Police – The RCMP or a police service as defined in The Police Act 1990 (a city or municipal police service) • Military police or conservation officers are not police services recognized by HIPA • Personal Health Information (PHI) includes: • physical or mental health information • Information about health services provided to someone • Information about donation of body part or substance • registration information • incidentally collected information when health service provided • Registration Information – basic identifying information such as name, address, date of birth, phone number, health services number Privacy and Access Section, Canadian Bar Assoc.

5. Disclosure pre-HIPA • Disclosure by: • 1. Search warrant • 2. With consent of the person receiving treatment • 3. Casual disclosure by health care providers • The result was: • PHI critical to investigations sometimes not obtained • Over-collection of PHI • Consent from victim not always possible • Tainted evidence Privacy and Access Section, Canadian Bar Assoc.

6. Disclosure post-HIPA • Section 27(4) of HIPA allows disclosure of PHI without consent to: • Minimize danger to the health or safety of any person • Monitor, prevent or reveal fraudulent abusive or dangerous use of public health services • Disclosure where authorized by warrant, subpoena or where required to commence court proceedings • Disclosure where it is permitted by any Act or regulation Privacy and Access Section, Canadian Bar Assoc.

7. Disclosure post-HIPA (2) • S. 27(4)(a) provides as follows: • “A trustee may disclose [PHI]…without …consent…in the following cases: • (a) where the trustee believes, on reasonable grounds, that the disclosure will avoid or minimize a danger to the health or safety of any person” Privacy and Access Section, Canadian Bar Assoc.

8. Disclosure post-HIPA (3) • Common feature of all privacy laws is to allow disclosure to avoid harm • Criteria to make the decision: • Must be a reasonable expectation of harm • Harm must constitute damage or detriment and not mere inconvenience • Must be a causal connection between disclosure and the anticipated harm (FOIP Folio Feb. 2007) Privacy and Access Section, Canadian Bar Assoc.

9. Disclosure post-HIPA (4) • Emergency care: • Domestic abuse victim is in hospital and the Emergency Department receives warning that her partner is coming to the hospital to finish the job • A nurse overhears gang members planning to retaliate against their rivals when one of their own is stabbed Privacy and Access Section, Canadian Bar Assoc.

10. Disclosure post-HIPA (5) • Identification of Individual and Notification of Next of Kin • Person is dropped off at Emergency Ward either deceased or incapacitated • In order to ID Jane or John Doe police can be called to assist and disclosure of PHI is allowed • Same disclosure is allowed for notification of next of kin in similar cases Privacy and Access Section, Canadian Bar Assoc.

11. Disclosure post-HIPA (6) • Disclosure of PHI allowed for enforcement of investigations pursuant to the Criminal Code and CDSA or where health care is directly related to an incident • Release of registration information is allowed or only information directly related to the treated injury Privacy and Access Section, Canadian Bar Assoc.

12. Disclosure to Police Regulation • Disclosure of PHI is allowed where it is permitted by any Act or regulation • Under HIPA Regulations the Health Minister is allowed to release information to police: • Enforcing a warrant for arrest issued by a court, person, or body authorized Service of subpoena for indictable offenses • Locating missing persons • Limits are that only registration information or the last place where medical care was received or offered is allowed to be disclosed Privacy and Access Section, Canadian Bar Assoc.

13. Disclosure to Police Regulation • Disclosure to police by a trustee where health information is requested for purposes: • enforcing the Criminal Code or CDSA • carrying out a lawful investigation regarding the Criminal Code or CDSA • Disclosure is limited to: • Registration information respecting the individual; or • The nature and severity of an injury that: • was suffered by the subject or another individual • is connected with the enforcement or lawful investigation Privacy and Access Section, Canadian Bar Assoc.

14. Disclosure to Police Regulation • Disclosure to police by a trustee where health information is requested for purposes: • Where someone received or was offered health services directly as a result of an incident that is the subject of a lawful investigation pursuant to the Criminal Code or CDSA Privacy and Access Section, Canadian Bar Assoc.

15. Disclosure to Police Regulation • The PHI disclosed is limited to: • the factual circumstances surrounding the incident and • the factual circumstances surrounding the provision of, or offer to provide health services; and • the factual circumstances do not include the health history of the individual prior to the incident • PHI can be released without consent to chief coroner or appointed coroner conducting an inquest or investigation pursuant to The Coroner's Act 1999 Privacy and Access Section, Canadian Bar Assoc.

16. Gunshot and Stab Wound Mandatory Reporting Act • This is an example where mandatory disclosure of PHI is required by another Act pursuant to section 27(4)(l) • Every hospital or facility that treats an individual for a gunshot or stab wound shall disclose the following to the local police service • the fact that an individual is being treated, or has been treated, for a gunshot or stab wound; • the individual’s name, if known; • the name and location of the hospital or facility • The disclosure required must be made orally as soon as is reasonably practicable without interfering with the individual’s treatment or disrupting the regular activities of the hospital Privacy and Access Section, Canadian Bar Assoc.

17. Gunshot… Regulation • “Stab wound” means any wound caused by a knife or other sharp or pointed instrument that is indicative of an act of violence inflicted by another individual (not accidental stab wounds) • When a hospital or facility treats an individual for a gunshot or stab wound disclosure must be made by • The CEO of the regional health authority responsible for that hospital/facility or • Any persons designated by the CEO for that purpose • Section 5 of the Act allows for immunity for any action taken pursuant to this Act done “in good faith” Privacy and Access Section, Canadian Bar Assoc.

18. Caution: other considerations • How to interpret exceptions to principle that disclosures of PHI for secondary purposes require consent. • Consider transparency requirements in ss. 9 and 10 of HIPA. • Is such legislation vulnerable to a section 1 analysis under the Charter? Privacy and Access Section, Canadian Bar Assoc.

19. Caution: other considerations (2) • Impact on developing Electronic Health Record (EHR) • “For the purpose of classifying PHI in terms of its confidentiality, this document advocates a uniform classification for PHI (i.e. all PHI will be classified as uniformly confidential).”(EHRi Privacy and Security Conceptual Architecture, June 2005, page iii) Privacy and Access Section, Canadian Bar Assoc.

20. “Far too often, bureaucrats, cops and others use poorly understood privacy laws as a justification for inaction.” (Canadian Privacy Law Blog, April 29, 2008) Privacy and Access Section, Canadian Bar Assoc.

21. Resources • The Health Information Protection Act • The Health Information Protection Regulations (Disclosure to Police) • The Gunshot and Stab Wounds Mandatory Reporting Act • The Gunshot and Stab Wounds Mandatory Reporting Regulations • The Police Act 1990 Privacy and Access Section, Canadian Bar Assoc.

22. Resources (continued) • Disclosure of Personal Health Information to Police Services and Coroners (HIPA Toolkit) • SaskHealth Sample “Request for Disclosure of Personal Health Information to Police Services Without Consent” Privacy and Access Section, Canadian Bar Assoc.

23. Resources (continued) • OIPC Commentary on Disclosure to Police Reg. (April 11, 2007 Letter to Speaker) • Healing, not Squealing: Recent Amendments to Alberta’s Health Information Act(Health Law Review Vol. 15:2) • Mandatory Reporting of Gunshot Wounds to Police…Not As Simple As It Seems (Health Law in Canada, Vol. 25:1, page 1) Privacy and Access Section, Canadian Bar Assoc.

24. Questions? • Saskatchewan Information and Privacy Commissioner 503, 1801 Hamilton Street Regina, SK, S4P 4B4 • Phone: (306) 787- 8350 • Toll free: 1-877-748-2298 • Fax: (306) 798-1603 • Email: info@oipc.sk.ca • Website: www.oipc.sk.ca Privacy and Access Section, Canadian Bar Assoc.