The Standing Senate Committee on Social Affairs, Science and Technology

has the honour to table its

FOURTEENTH REPORT

Your Committee, which was authorized on Thursday, March 1, 2001 to examine and report upon the developments since Royal Assent was given during the Second Session of the Thirty-Sixth Parliament to Bill C-6, an Act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act, now tables its report.

Background 

In November 1999, the Committee held extensive hearings in consideration of Bill C-6, today known as the Personal Information Protection and Electronic Documents Act 2000, S.C. c. 5 (hereinafter the Act). At these hearings, witnesses representing the health sector demonstrated a lack of unanimous support for the Act as presented. Their primary concern was the possible impact of the Act on their ability to collect, use and disclose personal health information and hence on their ability to keep the health system functioning efficiently and effectively. 

The Act imposes obligations on organizations with respect to the collection, use and disclosure of personal information within the course of commercial activities. The responsibility for oversight, redress and audit under the Act rests with the Privacy Commissioner. 

The substantive obligations created by the Act are contained in the Canadian Standards Association Model Code. The Code is incorporated by reference in section 5(1) of the Act, thus giving it the force of law. The Model Code was said to have been developed through five years of negotiation among stakeholders primarily in the business community; however, the evidence before the Committee in 1999 suggested that the health sector had not participated sufficiently in the negotiation of the Model Code and, therefore, it did not reflect the realities of that sector. 

For that reason, and in recognition of the importance and complexity of the issues, the Committee recommended that Bill C-6 be amended to suspend the collection, use and disclosure of personal health information from the application of Part 1. The government accepted the recommendation and amended the bill with the addition of section 30.(1.1). That section, which created a one-year suspension, was proclaimed in force January 1, 2001, (SI/2000-29). As such, the Act will begin to apply to personal health information on January 1, 2002. 

Observations and Recommendations 

The Committee is aware that, since 1999, discussions have been ongoing between certain health sector stakeholders and government to clarify and resolve these issues.  These discussions did not reach a definitive conclusion, although significant progress has been made. 

The Canadian Institutes of Health Research (CIHR) considered the issues over a two year process of background work and consultations among relevant stakeholders.  This process has resulted in recommendations in the form of draft regulations, which it has submitted to the Committee for its consideration (Appendix 1).  The Committee has considered the regulations proposed by CIHR, and commends CIHR for its efforts in this regard. The Committee supports the intent of the proposed regulations. The Committee is confident that these regulations will receive their fullest and fairest consideration in those discussions in the relevant forum. 

As well, the Privacy Working Group, a discussion forum consisting of some stakeholders in the health sector, has informed the Committee that it was able to make some progress towards achieving consensus within the sector by focussing its discussion on the principles underlying the privacy of health information (Appendix 2). While the discussion did not produce a unified position, it did result in agreement on many issues, including a process to address the unresolved issues. The Working Group expressed the view that that process would require the active involvement and leadership of the federal government.  However, in a letter to the Canadian Medical Association (Appendix 3), the government made it clear that the concerns of the Privacy Working Group should be resolved between the members of the group and the Privacy Commissioner.  Furthermore, the Committee recommends that discussions pursue among stakeholders, the Privacy Commissioner, and those federal and provincial governments departments involved with the provision, management, evaluation and quality assurance of health services.

In a letter of November 20, 2001 to the Chairman of the Committee (Appendix 3), the Privacy Commissioner undertakes to maintain “vigilant oversight” in order to ensure that personal health information is collected, used and distributed only as appropriate. To this end, he states his intention to interpret sections 7(2)(c) and 7(3)(f) of the Act in a broad manner, with a view to ensuring that bona fide health research is not deterred or impeded. We have carefully considered the timely and judicious intervention of the Privacy Commissioner and we are satisfied that the approach he proposes will provide assurance that individuals’ privacy rights will be protected, while at the same time ensuring that organizations will be able to collect, use and disclose personal information for health research purposes in appropriate ways. However, the Committee is of the view that regulations such as those proposed by CIHR may nonetheless be necessary to provide greater clarity and certainty of the law and to ensure that its objectives will be met without preventing important research to continue to better the health of Canadians and improve their health services.  Also, further guidance and direction is needed in respect of the provision, management, evaluation and quality assurance of health services.  

The Committee is also mindful that, pursuant to section 29(1) of the Act, Part I will be subject to review by a committee of Parliament five years after its coming into force.  

In light of all these considerations, the Committee is of the view that its further intervention is not warranted at the present time. Nevertheless, it is the Committee’s intention to actively monitor the discussions, as well as the approaches and solutions, which emerge.  Perhaps more importantly, the Committee recognizes that the privacy issue needs to be addressed in the context of the development of the electronic health record (EHR).  The Committee is on record as strongly supporting the rapid development of the EHR. At the same time, the Committee is very mindful of the potential risks to the privacy of personal health information, which arise as a result of the creation of an EHR.  The Committee hopes to work with all interested parties in seeking a solution that appropriately balances the need for privacy with the need for an EHR.

Respectfully submitted,

MARJORY LEBRETON
Deputy Chair

APPENDIX