The Privacy Commissioner of Saskatchewan is reportedly having to scale back services after the provincial government nixed a request for additional resources to hire another investigator. Gary Dickson's office not only administers the public sector access and privacy law, but he has to deal with the health privacy law that covers public and private sector healthcare.

I'm not sure you can truly be independent of the government if you have to go begging to it for adequate funds.

Saskatchewan privacy commissioner cuts services citing lack of resources - Winnipeg Free Press

REGINA - Saskatchewan's privacy commissioner says his office is in crisis and is being forced to cut back services because of a lack of funding from the provincial government.

Gary Dickson says surging demand for service has overwhelmed his office and the current three investigators cannot sustain the caseload.

He says despite his plea, the government's Board of Internal Economy has denied a request for $129,000 to hire another investigator and set up office space for that person.

"I've said to the board when I appeared in front of them, and I used the word very consciously, our office is in a crisis in terms of being swamped with demands for service from the people who live in the province," Dickson said Monday.

"We just cannot possibly ... respond to that demand in any kind of reasonable time frame."

Dickson says the number of reviews and complaints is up by 113 per cent over last year. Requests for advice and inquiries from public bodies and health trustees are also up.

Some people have been waiting for more than three years for a resolution to their case file, he says. The three investigators currently have a caseload of 376 reviews and investigations.

"Something has to give," says Dickson.

"So what we've decided to do is try and be transparent to the people of the province in terms of how this is going to translate into waits and delays."

The commissioner says his office will send letters to everyone who requests an investigation or review alerting them that they should not expect any action on their file for approximately 12 to 18 months.

Dickson also says all public organizations should expect significant cutbacks and delays if they need consultation on a project.

The privacy commissioner's office oversees some 3,000 bodies including ministries, Crown corporations, boards, commissions, agencies, schools, regional health authorities, municipalities, universities, colleges and health trustees.

The commissioner says the decision by the board will diminish how accountable public bodies are to the people of Saskatchewan.

"Manitoba, with roughly the same population, would have six investigators. Newfoundland and Labrador I think has more than six investigators (and) half the population. They certainly don't oversee 3,000 public bodies and health trustees," says Dickson.

Saskatchewan Justice Minister Don Morgan, who sits on the board of internal economy, says the privacy commissioner's budget has been steadily rising since 2002. That can't continue during tough financial times, he says.

"We're in times of fiscal restraint and we're expecting all ministries, all government agencies to try and work within existing budgets wherever they can," says Morgan.

The province is trying to cope with a big hole in last year's budget when potash revenue fell $1.8 billion.

The Saskatchewan government will deliver its new budget March 24, but Premier Brad Wall has already warned there won't be big spending increases - in fact, cuts are in the works.

Morgan said there's no way of controlling how many complaints the privacy commissioner's office receives, but he wants to cut the number if possible.

"We would like to work with the privacy commissioner to find ways that we can reduce the backlog in their office and try and find some efficiencies by having more of the requests dealt with at the ministry levels rather than through his office," he says.

Labels: access to information, privacy, saskatchewan

Saskatchewan, as of September 1, 2007, has become the second province in Canada to require healthcare professionals to report gunshot and stabbing wounds to the police. See: Sask. closes gun loophole: Lloydminster Meridian Booster, Lloydminster, AB.

Nova Scotia is considering doing the same; the Deputy Minister of Justice has been circulating a discussion paper on the topic this past week, seeking comments on the topic.

Labels: nova scotia, privacy, saskatchewan

NEWS RELEASE – July 4, 2007

Saskatchewan Information and Privacy Commissioner tables 2006-2007 Annual Report.

Saskatchewan’s Information and Privacy Commissioner, Mr. Gary Dickson, has submitted his Annual Report for 2006-2007 to the Legislative Assembly. The document is available at the website: www.oipc.sk.ca.

Dickson commented on a number of improvements in terms of compliance by Saskatchewan public bodies with access and privacy requirements. He made recommendations to the Saskatchewan Legislative Assembly as to how the province can do an even better job. This includes:

• An open letter from the Premier to each of his Ministers stressing the importance of compliance with our access and privacy laws.
• Making each Deputy Minister explicitly responsible for ensuring that his or her Department fully complies with our access and privacy laws.
• The need for Ministers, CEOs of Crown corporations and local authorities to provide clear direction and explicit support to the FOIP (access and privacy) Coordinators in each of their organizations.

Commissioner Dickson discussed a worrisome trend in the introduction of new laws and regulations that diminish the information rights of Saskatchewan residents.

Dickson’s report includes 9 proposed steps for the Saskatchewan Government that would promote excellence in meeting access and privacy requirements.

Labels: privacy, saskatchewan

Last month, a Saskatoon private investigator pleaded guilty to charges stemming from unauthorized access to police databases at an RCMP detachment. A few years ago, the PI's firm was investigated for a similar incident in which 6 government employees were ultimately suspended. See: CBC - Private eye fined for accessing police computer system.

Thanks to PI Buzz for the link.

Labels: privacy, saskatchewan

The Information and Privacy Commissioner of Saksatchewan, Gary Dickson, has released his annual report for 2005-2006, calling for a significant overhaul of the province's public sector legislation. See: Saskatchewan told to update privacy laws that expose residents to risk - Yahoo! Canada News.

From the Commissioner's media release:

Saskatchewan

Information and Privacy Commissioner

NEWS RELEASE – November 16, 2006

Saskatchewan Information and Privacy Commissioner tables 2005-2006 Annual Report.

Saskatchewan’s Information and Privacy Commissioner, Mr. Gary Dickson, has submitted his Annual Report for 2005-2006 to the Legislative Assembly. The document is available at the website: www.oipc.sk.ca.

Dickson recommends action by the Saskatchewan Government to make Deputy Ministers and CEOs of Crown corporations and local authorities explicitly accountable for access and privacy compliance in their organizations.

The Commissioner also highlights unfinished business from his last Annual Report. Of six major recommendations in his 2005 Privacy and Access: A Saskatchewan ‘Roadmap’ for Action, there has been no action taken on four recommendations, namely:

• Extend privacy protection to private sector employees in Saskatchewan;
• Conduct a public review of our 14 year old law, The Freedom of Information and Protection of Privacy Act, and then make the necessary changes to modernize that first- generation law;
• Integrate two separate access and privacy laws into a single law to make it more understandable and easier to comply;
• Ensure that public registries address the new challenges to the privacy of citizens.

The Commissioner also highlighted two emerging issues that warrant attention:

• Development of an electronic health record for every man, woman and child in Saskatchewan poses major challenges to the protection of privacy. “It will be important to get the ‘privacy piece’ of the EHR right so that citizens will continue to be frank and candid when they deal with their family physician and other primary providers.”
• There is a popular trend to promote ‘shared services’, whether SchoolPlus for children at risk, or multi-department delivery of services for adults. This trend requires a careful rethinking of the way access to information and privacy will be managed.

Labels: health information, privacy, public sector, saskatchewan

I don't think anyone in the privacy community, regardless of what side they usually fall on, thinks that the privacy watchdogs in Canada have enough resources to do their jobs quickly and efficiently. The Saskatchewan Information and Privacy Commissioner, Gary Dickson, is the subject of an article on CBC Saskatchewan's website. His three person office is having a hard time keeping up with the workflow and is still wrangling with files from 2003.

Technorati tags: Privacy :: Saskatchewan.

Labels: information breaches, saskatchewan

Gary Dickson, the Privacy Commissioner of Saskatchewan, has released a report that calls for some significant changes to the province's public sector privacy law. The Sask. statute is similar to Nova Scotia's in that it lacks any requirement to safeguard personal information:

The Globe and Mail: Address 'gaping hole' in privacy laws, officer says:

"Saskatchewan's privacy commissioner says the province must address a 'gaping hole' in privacy laws and require public organizations to protect personal information more stringently.

In the report, Privacy Commissioner Gary Dickson said that the current Freedom of Information and Protection of Privacy Act does not require a government body to ensure personal information in its possession or under its control is protected.

'The effect is that Saskatchewan citizens continue to experience an unreasonably high level of risk that their personal information entrusted to public bodies will be used or disclosed inappropriately.'..."

Labels: information breaches, saskatchewan

I blogged a little while ago about the numerous complaints received by the Saskatchewan Information and Privacy Commissioner after thousands of women were unexpectedly contacted by the provincial cancer agency about their cervixes. (See PIPEDA and Canadian Privacy Law: More than 100 women complain after cancer test info shared).

Since then, the Commissioner has released his report on the agency and its privacy practices. I haven't had a chance to wade through all of its 203 pages, so I'm relying on the info from the Medical Post (below). While it is lawful, the agency should make sure that women know all about it and it should follow an opt-out program. Who gets to tell the women and manage this opt-out? Physicians! Lucky them. I'm sure they don't have anything else to do....

MedicalPost.com: Sask. MDs: Prepare patients for Pap results:

"... Gary Dickson, provincial information and privacy commissioner, completed a two-year study on the Saskatche-wan Cancer Agency's prevention program for cervical cancer (PPCC) after receiving more than 100 complaints and 700 items of correspondence from Saskatchewan women. Many of the complaints were that personal information was sent directly to patients from the cancer agency without their knowledge or consent—and that the program is compulsory. Many family physicians were also unaware of the process which began in summer 2003, while Saskatche-wan's Health Information Protection Act was being created.

Dickson said the cancer agency had the right to collect and disseminate the information, but did not do so correctly because it did not offer an opt-out provision to patients as other provinces do. He made 23 recommendations including one that family physicians inform their female patients about the PPCC the first time a Pap specimen is taken and alert them that they will be receiving notification from the cancer agency in the future. He said health information act requires physicians to take "reasonable steps to inform the individual of the anticipated use and disclosure of the information by the trustee (the cancer agency)."

He also said "the College of Physicians and Surgeons should take appropriate steps to ensure that there is informational material available to all Saskatchewan women who attend at their physicians' office for a Pap test. This material should explain the PPCC and in particular the direct contact with women that is a feature of the PPCC."

Dr. Dennis Kendel, registrar of the college, told the Medical Post that he wasn't sure how the college will respond to the privacy commissioner's report. "It wouldn't immediately seem logical to us that we would be the agency responsible for that," he said. "We haven't yet had a chance at our council level to consider the report in detail and its implications."..."

Labels: breach notification, health information, information breaches, privacy, saskatchewan

More than 100 women were sufficiently upset to complain to the Saskatchewan Privacy Commissioner after finding out their cancer test results are routinely shared with the province's cancer agency. The Commissioner's report is available here and CBC's coverage is below:

CBC Saskatchewan - More than 100 women complain after test info shared:

"Last Updated Apr 27 2005 04:38 PM CDT

REGINA – Women in Saskatchewan should have the option of keeping their Pap test results to themselves, rather than having the data go to the province's cancer agency automatically, Privacy Commissioner Gary Dickson says.

On Wednesday, Dickson said more needs to be done to protect women after more than 100 complained of receiving copies of their test results in the mail.

Many women had no idea their private health information and cervical cancer test results were sent to the Saskatchewan Cancer Agency.

"I opened it up and was shocked," recalled Anemarie Buchmann-Gerber of Saskatoon, who thought she received a piece of junk mail. "There was my information from an agency I had never heard of. There were the results of my test."

Thousands of other women received their cancer test results the same way. In some cases, the results were sent to a woman's ex-husband or parents.

"The agency did not have in place what I determined would be all the safeguards," Dickson concluded after a year-long investigation.

Dickson's report recommends doctors do a better job of telling women that their test results will be shared with the province's cancer agency.

Women who don't want to participate in the cancer agency's research should be able to opt out, Dickson said.

Other women said they didn't mind receiving a letter notifying them of their results, or reminding them to get tested.

Hilary Craig has been cancer-free for more than 10 years, but wishes a health professional suggested having a mammogram years ago.

"I would have gone and had my mammogram," the Regina resident said. "Instead, I realized with a terrible sinking heart when I felt the lump. I wondered how much growth happened between when I hadn't went for a mammogram and the time that I had the lump found."

Early detection is critical to many cancer treatments. The cancer agency notes the information they collect is saving lives, but it acknowledges it will have to factor in privacy concerns in using the statistics."

Labels: health information, information breaches, saskatchewan

Further to a few recent items referred to in this blog (see here and here), the Saskatchewan opposition is asking that amendments to the Health Information Act be discussed by a legislative committee:

Committee should deal with privacy act: Opposition

The opposition Saskatchewan Party wants concerns involving proposed regulations for the Health Information Protection Act discussed by a legislative committee.

Health critic Rod Gantefoer says it's important the committee deal with them first.

Privacy commissioner Gary Dickson says the province's health department needs to be more careful about how it handles patients' health information.

Dickson has released a 20-page report critiquing the province's proposed regulations for the Health Information Protection Act.

The Information and Privacy Commissioner's report is available here.

Labels: health information, information breaches, saskatchewan

The Saskatchewan Federation of Labour is objecting to the proposed changes to the Saskatchewan Health Information Protection Act that would allow hospitals to use patient information for fundraising without consent. (See my blog entry Saskatchewan proposal to use patient information for fundraising lists.)

Saskatoon StarPhoenix - canada.com network:

"A warning to the provincial Health Department from the privacy commissioner.

Gary Dickson says if an organization wants to use somebody's personal information for a different purpose than for which it was given, it should go back to the individual for consent.

Dickson says allowing regional health authorities that operate hospitals to share with their fundraising organizations the names and addresses of patients without getting their consent would be a serious breach of privacy.

He has released a 20-page report critiquing the provincial government's proposed regulations for the Health Information Protection Act."

For those in Ontario, you may be interested in the "case study" included the the Information and Privacy Commissioner's new "Guide to the Health Information Protection Act":

Example 5: Can personal health information be used for fundraising activities?

A charitable foundation for a children’s hospital has been asked to raise money to support a large research project on a specific childhood genetic disorder. To make the campaign for funds as effective as possible, the foundation has decided to solicit funds only from families affected by this particular disorder. The foundation has asked the hospital for the contact information of the parents of children who have been identified as having this genetic disorder. Is the hospital permitted under the Act to provide this information to the foundation?

---

Is the parents’ contact information considered to be personal health information?

Under the Act, personal health information includes identifying information about an individual if the information relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family. Thus, parental contact information combined with information about a child’s genetic disorder would be considered to be the personal health information of both the child and the parent.

---

Is the hospital permitted to provide personal health information to the foundation for fundraising purposes?

Since the hospital foundation is fundraising on behalf of the hospital, the foundation is considered to be an agent of the custodian and the provision of personal health information to an agent of the custodian is considered to be a use by the custodian rather than a disclosure to the agent. Under the Act, custodians may use personal health information for the purpose of fundraising activities only where the individual expressly consents or the consent of the individual can be implied, from the circumstances, and the information consists only of the individual’s name and contact information (as specified in the regulations). In this scenario, consent for the use of the information for fundraising may be implied, but only if the information that will be used is limited to individuals’ contact information.

---

Is the information that will be used limited to individuals’ contact information?

Since the fact that one of more of the individual’s children has a specific genetic disorder will be used to compile a list for the purpose of targeted fundraising, the information that will be used is not limited to contact information. Accordingly, the conditions for implying consent to use the information for fundraising purposes in this scenario have not been met. The custodian would have to seek express consent for this type of targeted fundraising activity.

Labels: health information, information breaches, saskatchewan

From today's Globe & Mail Health column:

Looking for a loophole:

"Saskatchewan's health department is considering amendments to provincial privacy regulations that would allow hospitals to use patient records to build mailing lists for fundraising campaigns.

Under the current Health Information Protection Act, patients must give their consent before hospitals can send them requests for donations. Duane Mombourquette, director of strategic planning and information policy with Saskatchewan Health, said one option now under consideration would allow hospitals to assume patients don't mind being asked for money.

If patients don't enjoy being contacted, Mr. Mombourquette said, they would be allowed to contact the hospital and take their name off the mailing list.

Gary Dickson, Saskatchewan's Information and Privacy Commissioner, plans to give the provincial legislature his opinion about the proposal in a few weeks."

Labels: health information, information breaches, saskatchewan