Sunday, 15 April 2007
Interior Health Authority (IHA)
November 27, 2006
E-mail to the Interior Health Authority, requesting:
(1) a copy of their admittance form and
(2) I also stated that “I would like to know, in detail, who has access to anyone’s records at any time. For example, if someone had been in the hospital, for whatever reason, who would have access to their records – all doctors in the province/country/world or only certain doctors and, if so, which ones; all nurses, technicians, pastors, volunteers, etc.? Do they have access to all medical information or part of it (if so, who has access to what part)? If your access is limited, how is this enforced?”
(3) “where are the records kept (under lock and key, or in an easily accessible file container); is it kept in electronic or paper form, is it ever left unattended by medical staff, what safety features protect my information (ex. firewalls if on a computer).”
November 28, 2006
E-mail from IHA, Jane Larocque:
“Our office received your email dated Monday, November 27, 2006 requesting an admittance form and patient record security procedures.
Some clarification is needed before we can proceed with your request, can you please provide a daytime phone number so that we may begin the process of providing you with the required information as quickly as possible.”
November 28, 2006
E-mail to Ms. Larocque:
“I prefer to do things in writing. So, if you have any questions, just e-mail them to me.”
November 30, 2006
E-mail from Patty Skultety, Leader, Risk Management, ERP, Policy Development, Performance Management:
“My assistant Jane Larocque e-mailed you on Monday November 27, 2006 to request a contact phone number so that I might clarify your request. On Tuesday November 28, 2006 you responded that you preferred me to e-mail my questions.
Under Section 5 of the FOIPPA the 30 day time limit to respond does not commence until I am certain that I understand the information you are requesting.
At this time I am not certain that I understand your request so I am unable to provide a date by which you can expect a response. The following are my questions and comments with regard to your request.
1. ‘I would like a copy of your admittance form’. Can you please clarify what you mean by our ‘admittance form’.
2. The remainder of your request involves general questions pertaining for the most part to our practices around privacy and security of health records. Section 3(1) of the Act (Scope of the Act) states: “this Act applies to all records in the custody or under the control of a public body…” As you have not asked for a specifc record under the Act the Public Body is not obliged to respond to this particular request. However it seems you may be interested in how we protect the confidentiality of our health records. I would suggest therefore that you may be interested in receiving our Policy on Privacy and Management of Confidential Information. Please let me know if this would satisfy your request.
I would like to stress that in order to adequately respond and facilitate your request it would be beneficial to communicate over the phone.”
December 1, 2006
My e-mail to Ms. Skultety:
“Admittance form – it identifies the questions asked when one enters the hospital, ex. name, address, etc.
I am asking about medical records. No, your Policy on Privacy and Management of Confidential Information would be too general. I am looking for more detailed information. For example, who has ACCESS to medical records – all doctors or only doctors assigned to an individual’s care, all nurses or just nurses assigned to an individual’s care, ministers…, volunteers…, pharmacists, technicians, etc. How much information can they access, for example ministers – do they have access to only your name and religion or more information.
How are medical records protected so that no one but those authorized can access your records. For example, are paper records kept under lock and key and how do authorized people access your information, same with electronic records.”
December 12, 2006
Letter from Ms. SkultetY:
“Interior Health received your request for access to information under the Freedom of Information and Protection of Privacy Act (the Act) on November 27th, 2006. Specifically, you have requested:”They repeated my questions.
“We understand from your e-mail dated December 1st, 2006 you clarified your request to mean you have requested a copy of the Interior Health Admittance Form and that you do not require a copy of our Policy on Privacy and Management of Confidential Information. As the information requested in 2 and 3 above are not contained in any specific record in the custody of Interior Health under section 3(1) of the Act we will not be supplying any records.
We will make every effort to provide the information available to you under the Act as quickly as possible. The Act allows 30 working days to respond to your request, therefore unless we notify you otherwise, we will respond no later than January 17th, 2007.”
Comments:
Included was a copy of Section 3(1).
Finally, some honesty. I’m not happy that hospitals don’t have detailed policies and procedures on who has access to patient information and how it is protected (which was being implied by other hospitals), but I do appreciate them being upfront about it.
However, it certainly concerns me that if a hospital has no written policies and procedures on who accesses confidential records, or protection of same records, I am not entitled to a reply. This implies that I do not have a right to know who accesses my personal/medical information or that they do not have adequate protection (if any). This situation seems to apply to all hospitals.
January 2, 2007
Letter from Ms. Skultety, Leader, Risk Management, Emergency/Disaster Management, Policy Development/FOI:
“I am responding to your request of November 27th, 2006, for access to information under the Freedom of Information and Protection of Privacy Act (the Act).
We are unable to provide you with:–
repeated questions 2 and 3
as there is no record in existence that outlines the answers to your questions.
Enclosed please find the other requested record.
A copy of the Interior Health Admittance Form. As this is an electronic processing form and not available in hard document format we have provided you with actual “screen shots” of the document.
If you have any further questions or concerns regarding your request, please contact me at (250)549-5731.
Under Section 52 of the Act, you may ask the Information and Privacy Commissioner to review Interior Health’s response to your request. You have 30 days from receipt of this notice to reqest a review by writing to the Office of the Information and Privacy Commissioner. The procedure is outlined on the attached page.
Comments:
I appreciated the fact the they put together a form for me but I believe some questions violate FOIPPA. For example, they ask for insurance number, mother’s name, employer’s name and address, occupation, employment status, marital status. religion. Some of these questions have already been determined by the OIPC to be in violation of privacy rights.
Ms. Skultety also provided some additional information on my rights which was appreciated.
January 5, 2007
E-mail to Ms. Skultety:
“I will take a copy of your Policy on Privacy and Management of Confidential Information, although I suspect it does not offer the detail I want.”
January 8, 2007
E-mail from Ms. Skultety:
“In response to your emailed request dated Friday, January 5th, 2007 please find attached a copy of the Interior Health Policy AR0400-Privacy and Management of Confidential Information.”
Comments:
The policy and procedures consist of two pages, 25% of which lists sources. Needless to say, the information is very general and vague . For example, one paragraph says “Interior Health considers intentional viewing of Confidential Information that is not required to carry out work-related responsibilities or misuse of Confidential Information to be a breach of access rights/confidentiality”. In other words, people have access to confidential information not required to perform their work.
January 18, 2007
Letter to the OIPC:
“Attached is correspondence from the Interior Health.
Parts of the Interior Health Admittance form is obviously in violation of the Privacy Act. I would like to know exactly why they are asking these questions and, then, I would like you to assess which parts are violating the Privacy Act and have it corrected.
The Interior Health has refused to provide the information on who has access to personal information (which includes all information on a patient), and what steps are taken to protect a patient’s confidential information. This is a violation of the Privacy Act and I would like it corrected.
I did request a copy of their Policy on Privacy and Management of Confidential Information. But since they admitted having no detailed information, it obviously will be insufficent to answer my questions.”
Comments:
Although Ms. Skultety, especially in hindsight, had been upfront, I decided to refer the matter to the OIPC to determine if this was correct, that I was not entitled to an answer. Also the admittance form appeared to have a number of violations so I believed it would save time to let the OIPC and Interior Health work to resolve this.
February 12, 2007
Letter from OIPC (Morag Ross):
“As you are aware the Freedom of Information and Protection of Privacy Act (the Act) applies to all records in the custody or under the control of the public body. A record, as defined in Schedule 1, includes “books, documents, maps, drawings, photographs, letters, vouchers, papers and any other things on which information is recorded or stored by graphic, electronic, mechanical or other means. After reading your e-mail to the Interior Health Authority, it is clear that you have asked questions regarding specific issues and that you expected the Interior Health Authority to provide a written response to those questions.
“Our office would be able to review a public body’s decision to deny you access to all or part of a record you requested, for example. This office does not have authority to review the failure of a public body to answer questions about its operations.”
Comments:
This was the first time I received this response. It became a standard.
February 18, 2007
Letter to Ms. Ross:
“So you are saying that if the hospital has no records on protecting privacy, no records on who accesses confidential records and procedures, I am not entitled to a reply. This implies that I do not have a right to know who accesses my personal/medical information. Is this correct?
Also, I sent a copy of their admittance form which you did not address. I believe that parts of this are in violation of the law, for example it shows Pt. occup which I assume means patient’s occupation, etc.”
Comments:
I am waiting for a response.