Monday, 16 April 2007
Vancouver Island Health Authority (VIHA)
November 27, 2006
I e-mailed the privacy officer;
I requested a copy of their admittance form. I also stated that
“I would like to know, in detail, who has access to anyone’s records at any time. For example, if someone had been in the hospital, for whatever reason, who would have access to their records – all doctors in the province/country/world or only certain doctors and, if so, which ones; all nurses, technicians, pastors, volunteers, etc.? Do they have access to all medical information or part of it (if so, who has access to what part)? If your access is limited, how is this enforced?
I also asked “where are the records kept (under lock and key, or in an easily accessible file container); is it kept in electronic or paper form, is it ever left unattended by medical staff, what safety features protect my information (ex. firewalls if on a computer).”
November 27, 2006
I received an e-mail from Audrey Larson, Communication Assistant, VIHA, with cc’s to Cathy Yaskow, Marybeth Corbeil,and Lori Bird;
“By way of this email I’ll ask one of our I & P folks to reply to your query.”
January 5, 2007
As no one replied to my query, I laid a complaint with the OIPC:
“Attached is a letter that I sent to the Vancouver Island Health Authority. It is over 30 days and I have not received an answer to my questions.
Please deal with this matter.”
January 11, 2007
An e-mail from Ms. Larson, with cc’s to Cathy Yaskow, Marybeth Corbeil,and Lori Bird,stating that Elizabeth from the Minister of Information and Privacy’s office called to follow up on this request. And that Elizabeth would be contacting Cathy or Sam.
January 12, 2007
E-mail from M.B. Corbeil:
“I am responding to your e-mail of November 27, 2007 in which you request
general information on access to health records versus a Section 5 FOI access request for your own personal health records.
As part of your e-mail you indicate you wish a copy of our “admittance form”. I am unsure as to what you are referring to but I am assuming it is the form that is created electronically when first admitted to hospital. We refer to this form as a Record of Admission-Separation. We do not have “blank” copies of these forms as they are created electronically but I have been able to get printed a “mock patient” Record of Admission-Separation Form which I would be pleased to send to you but, unfortunately, you did not include your address with your e-mail.
As to the other questions you had related to access, storage, etc., if you will provide your phone number along with your address, someone from the Privacy Office will be pleased to contact you and discuss the answers to these questions with you.
Please feel free to call me at the number listed below if you wish to
discuss this e-mail with me further.”
M.B. “Sam” Corbeil
Release of Information & Privacy Administrator
Health Records, VIHA South Island
Phone: (250) 370-8549
Fax: (250) 370-8550 (RJH)
(250) 727-4114 (VGH)
January 14, 2007
I e-mailed M.B. Corbeil;
“Re: Record of Admission – Separation Form – do you have a scanner?
Re: Access, etc., I would like the information in writing.”
I had wanted them to e-mail me the Record of Admission and other information.
They replied that they did not have a scanner so I e-mailed my address.
January 18, 2007
Letter from M.B. Corbeil:
“I am responding to your request initially received via e-mail on November 27, 2006 for access to a copy of an “admittance form” used within the Vancouver Island Health Authority (VIHA). Unfortunately, your original e-mail did not contain your address, which you subsequently provided to me on January 16, 2007.
A copy of a mock Record of Admission-Separation form is enclosed as per your request for an ‘admittance form.’
Also, as per my e-mail to you of January 12, 2007, I did indicate that someone from VIHA’s Information and Privacy Office would be contacting you to discuss other general questions related to the privacy and security of your personal information. The Freedom of information & Protection of Privacy Act was established to provide access to records within the custody and control of the public body, rather than to answer questions. Accordingly, questions such as you posed in your original e-mail are typically addressed through a conversation with VIHA’s Information & Privacy Office.
However, I note that in your January 16, 2007 e-mail to me you did not include your phone number as requested, just your address. In light of that, VIHA’s Information & Privacy Office has requested that I ask you to please contact them directly at either (250) 370-8043 or (250) 370-8686 to discuss your questions. This will allow VIHA’s Information and Privacy Office to clarify what information you are specifically seeking and respond accordingly. If you choose not to contact VIHA’s Information and Privacy Office by phone, please clarify by e-mail to Ms. Lori Bird, Regional Coordinator, Information & Privacy Office at email@example.com what specific information you are seeking and Ms. Bird will respond back to you.
If you have any further questions related to the ‘admittance form’, please feel free to contact me at (250) 370-8549.
As noted in correspondence from OIPC (Providence Health Care, Jan. 3, 2006) “Vancouver Island Health Authority, for example, is in the process of revising their registration and admitting process to ensure it conforms to FIPPA.” While I am pleased that this is finally being done, why wasn’t it done 13 years ago. FIPPA came into effect in 1993.
They sent a copy of their admittance form. Concerns:
1. They have a place for religion on the form and the question is not identified as optional.
2. Application for Benefits/release of Information: I don’t know why people would be required to make application under the BC Hospital Insurance Act (I assume most people are covered by MSP).
There are other questions under this section but, as long as people can stroke out what they don’t agree with, I don’t see a problem.
January 18, 2007
Letter from Elizabeth Darche, OIPC:
“I am writing in response to your request for a review by our office of the failure of the Vancouver Island Health Authority (“VIHA”) to respond to your request of November 27,. 2006 as outlined in your letter of January 5, 2007.
In response to your letter, I contacted Marybeth.Corbeil of the VIHA regarding the status of your request, who provided our office with a copy of their response of today’s date. As VIHA has now responded to your request, it appears there is nothing further that our office might review on the matter.
You may, however, wish to request a review of the response itself. Should this be the case, such a review would be a separate matter from the WIHA’s failure to respond and would require the submission of a separate request for review. As you are aware, if you wish to request a review on a decision to refuse access to all or part of a record, you must include a copy of your original request for access to information, as well as a copy of the VIHA’s decision letter.
If you have any questions regarding this letter, please do not hesitate to contact me at(250)387-5629 or by calling the toll-free Enquiry BC number which is 1-800-663-7867, where an operator will transfer you free of charge.”
February 18, 2007
Letter to Ms. Darch, OIPC:
“I wish a review of the response by VIHA. In their response they state that FIPPA ‘was established to provide access to records, rather than to answer questions. Does this mean that I am not entitled to know who has access to my personal/medical information?
They also state that they imply that questions “such as I pose” (ie privacy) is addressed through conversation. Am I not entitled to a response in writing? I am aware of the convenience of ‘conversation’ in that it allows ‘denial’ of anything said. In other words, its not worth the air it takes for a ‘conversation’.”
In hindsight, I realize that I had missed the part in the letter (January 18) from VIHA giving me the option to e-mail (see March 1).
February 22, 2007
Letter from Ms. Darche, OIPC:
“We have received your complaint about the response that you received from the Vancouver Island Health Authority (VIHA) further to your access request under the Freedom of Information and Protection of Privacy Act (the Act).
Your complaint appears to be further to VIHA’s offer to have you call and speak to the VIHA Information and Privacy Office in order to respond to the questions you raised in your November 27, 2006 email request to their office rather than provide a written response.
As previously advised by VIHA, the Freedom of Information and Protection Privacy Act was established to provide access to records within the custody and control of the public body, rather than to answer questions. Should a public body deny you access to all or part of a record your requested, our office would be able to review the matter. However, our office cannot review the failure of a public body to answer questions in response to an access request.
I would refer you to subsection 2(1)(a) of the Freedom of Information and Protection of Privacy Act (the Act) which states:
The purposes of this Act are to make public bodies more accountable to the public and to protect personal privacy by giving the public a right of access to records.
Your complaint does [not] seem to pertain to inappropriate collection, use, or disclosure of your personal information in a record under the custody or control of a public body in BC, therefore our office cannot be of assistance at this time.”
I interpret this to mean that I do not have the right to know who has access to medical records. I would not know if there has been “inappropriate” use or disclosure of “my” personal information since I am not entitled to know who has access. Presumably, as long as the hospitals do not written, detailed privacy policies and procedures (ie. records), they do not have to tell people who they give the information to. How does this make public bodies more accountable? How does this protect personal privacy?
March 2, 2007
E-mail to Lori Bird, VIHA:
“I would like to know, specifically, who has access to medical records at any time. For example, if someone had been in the hospital, for whatever reason, who would have access to their records – all doctors in the province/country/world or only certain doctors and, if so, which ones; all nurses, technicians, pastors, volunteers, etc.? Do they have access to all the medical information or part of it (if so, who has access to what part)? If your access is limited, how is this enforced?
Where are the records kept (under lock and key, or in an easily accessible file container); is it kept in electronic or paper form, is it ever left unattended by medical staff, what safety features protect medical information (ex. firewalls if on a computer)?”
March 20, 2007
Email from Ms. Bird, VIHA:
“ I am responding to your email of March 1st, requesting information regarding access to medical records, both electronically and in paper format within the Vancouver Island Health Authority (VIHA). Please be advised that this request is not covered under the Freedom of Information and Protection of Privacy Act (the Act) as you have requested information versus access to specific records. My apologies for the delay in getting a response to you.
I would like to assure you that we take the privacy of your personal information very seriously. We take measures on a daily basis to ensure that personal information is treated in a confidential manner in accordance with the Act as well as VIHA’s Confidentiality Policies. VIHA has posted Notification Signage throughout our facilities stating the reasons for the collection, use and disclosure of personal information and highlight the reasons under which we may share your information.
You have asked the question of who would have access to your personal health information and if the information is kept in a secure manner.
I can assure you that not just anyone can see your health information. To ensure you receive safe and comprehensive care, relevant “need-to-know” information is shared with your referring physician, other care providers, or health care agencies and facilities who demonstrate they are directly involved in your ongoing care. Under certain circumstances, other individuals who may be acting on your behalf or have demonstrated their legal authority to have access to specific information in your record may be provided with some or all of your records. These individuals may include, but are not limited to, Personal Representatives, Committees of Person, Executors, or a lawyer acting on your behalf. Each request would be considered individually and involve the submission of proof of the proper authority to receive access to your personal health information.
You wish to know if Pastors and Volunteers would have access to your health information. If you have requested to see a Pastor, the Spiritual Care team would only have access to information that you have consented to. Additionally, VIHA volunteers do not have access to electronic or paper health records. If a volunteer is assigned to a specific individual, for example, to help feed, they would be advised verbally of the necessary “need-to-know” information in order to feed that individual in a safe manner.
You have requested information relating to electronic health records as well as actions
taken to ensure that both paper and electronic records are held in a secure manner. Please find below two frequently asked questions that I believe will answer your question around security of personal information kept electronically and in paper format.
What is the electronic health record?
An electronic health record is a computerized version of the paper health record that is used to document your care over time in the same way as your paper record.
A major advantage of an electronic health record is that it allows authorized health care providers to access “need-to-know” information about you in a timely fashion to support safe and comprehensive health care. The VIHA currently uses both paper and electronic mediums to document your personal health information.
How does VIHA ensure that your personal health information contained in electronic or paper records is kept confidential?
Strict physical and electronic security protections are in place to ensure only those individuals (doctors, nurses, direct care providers) with the proper authority are accessing your record. VIHA staff are trained in confidentiality and security procedures during their orientation and have ongoing educational opportunities in confidentiality, privacy and security responsibilities. Random audits are done to ensure ongoing appropriate access to patient health records, electronically by a systems audit and through random site visits within the VIHA.
To answer your question regarding the security of paper records I offer you the following:
When a patient is discharged from hospital, staff within the Health Records Department will receive the paper record for processing prior to filing in the secure records room. Authorized Health Records staff are the only individuals’ who have access to the secure file storage rooms and can retrieve a file only for those authorized to have access to the information (e.g. direct care provider). In addition, a family physician and/or a referring specialist will receive copies of any test results and discharge summaries for continuity of care purposes and in order for them to provide you with ongoing care and treatment after your discharge from hospital.
I trust that the above information has answered your questions and that no further action with regard to your file is required of this office. You may find more information by visiting our website at .
If you have any further questions regarding the above you may contact me by phone at (250) 370-8043 or via email, firstname.lastname@example.org.
It’s good that they have signage throughout their facilities. It, hopefully, makes people aware that they have rights and, hopefully, who to contact regarding questions. But signage doesn’t usually state the hospitals limits on the collection of information and the reasons for sharing information can be stated so generally that it could include almost anyone.
I was pleased to hear that volunteers and pastors do not have access to patient information. This is the only health authority with this restriction, although I believe that this should be a standard policy at all hospitals.
However, VIHA does not identify who are the “other care providers”. Nor is there any reference to service providers.
Apparently, strict physical and electronic security protections are in place but they are unwilling to state what those security protections. We are just to take their assurance. Their assurances imply that I must trust them, but my trust in hospitals has been severely damaged over the last two years.
Again, there are no independent audits.
March 29, 2007
E-mail to Marybeth.Corbeil, VIHA:
“On your ‘admittance form’ you have identified as questions: Pastoral Care Visit (with a ? after it) and Religion. Why are these questions not identified as optional?”
April 2, 2007
Response from Marybeth.Corbeil:
“The admittance form is not a form filled out by the patient on their own. It is a form completed with the questions being asked by the admitting clerk and, therefore, the patient has the ‘option’ to say yes or no to this question.
I trust this addresses your concern as to why these questions are not identified as ‘optional’ on the form.”
This does not address my concern. This is the same situation that led to my rights being violated by Providence Health Care. The questions were not identified as optional and so the admitting clerk demanded that I answer the questions or I would not be admitted to the hospital.