The Saskatchewan Federation of Labour is objecting to the proposed changes to the Saskatchewan Health Information Protection Act that would allow hospitals to use patient information for fundraising without consent. (See my blog entry Saskatchewan proposal to use patient information for fundraising lists.)

Saskatoon StarPhoenix - canada.com network:

"A warning to the provincial Health Department from the privacy commissioner.

Gary Dickson says if an organization wants to use somebody's personal information for a different purpose than for which it was given, it should go back to the individual for consent.

Dickson says allowing regional health authorities that operate hospitals to share with their fundraising organizations the names and addresses of patients without getting their consent would be a serious breach of privacy.

He has released a 20-page report critiquing the provincial government's proposed regulations for the Health Information Protection Act."

For those in Ontario, you may be interested in the "case study" included the the Information and Privacy Commissioner's new "Guide to the Health Information Protection Act":

Example 5: Can personal health information be used for fundraising activities?

A charitable foundation for a children’s hospital has been asked to raise money to support a large research project on a specific childhood genetic disorder. To make the campaign for funds as effective as possible, the foundation has decided to solicit funds only from families affected by this particular disorder. The foundation has asked the hospital for the contact information of the parents of children who have been identified as having this genetic disorder. Is the hospital permitted under the Act to provide this information to the foundation?

---

Is the parents’ contact information considered to be personal health information?

Under the Act, personal health information includes identifying information about an individual if the information relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family. Thus, parental contact information combined with information about a child’s genetic disorder would be considered to be the personal health information of both the child and the parent.

---

Is the hospital permitted to provide personal health information to the foundation for fundraising purposes?

Since the hospital foundation is fundraising on behalf of the hospital, the foundation is considered to be an agent of the custodian and the provision of personal health information to an agent of the custodian is considered to be a use by the custodian rather than a disclosure to the agent. Under the Act, custodians may use personal health information for the purpose of fundraising activities only where the individual expressly consents or the consent of the individual can be implied, from the circumstances, and the information consists only of the individual’s name and contact information (as specified in the regulations). In this scenario, consent for the use of the information for fundraising may be implied, but only if the information that will be used is limited to individuals’ contact information.

---

Is the information that will be used limited to individuals’ contact information?

Since the fact that one of more of the individual’s children has a specific genetic disorder will be used to compile a list for the purpose of targeted fundraising, the information that will be used is not limited to contact information. Accordingly, the conditions for implying consent to use the information for fundraising purposes in this scenario have not been met. The custodian would have to seek express consent for this type of targeted fundraising activity.

Labels: health information, information breaches, saskatchewan