The Personal Health Information Act Policy Development Manual Version 1.2 Date: February, 2011 2 Government of Newfoundland and Labrador Department of Health and Community Services WARNING AND DISCLAIMER The PHIA Policy Development Manual has been prepared by the Department of Health and Community Services as a general guide to assist custodians of personal health information to meet their obligations under Newfoundland and Labrador’s Personal Health Information Act. The PHIA Policy Development Manual is designed to assist in complying with the law and meeting the changing expectations of patients and the public. The resource materials provided in this Manual are for general information purposes only. They should be adapted to the circumstances of each custodian using the manual. This manual reflects interpretations and practices regarded as valid when it was published based on information available at that time. This manual is not intended, and should not be construed, as legal or professional advice or opinion. Custodians concerned about the applicability of privacy legislation to their activities are advised to seek legal or professional advice based on their particular circumstances. This is the second edition of the PHIA Policy Development Manual; subsequent editions may be published in due course. 3 Government of Newfoundland and Labrador Department of Health and Community Services ACKNOWLEDGEMENT The PHIA Policy Development Manual was prepared by the Department of Health and Community Services with the assistance of several stakeholders in the province’s health and community services sector. The Department would like to thank the members of the PHIA Provincial Implementation Steering Committee, the PHIA Policy and Standards Working Group and the Newfoundland and Labrador Office of the Information and Privacy Commissioner for their assistance in preparing these materials. 4 Government of Newfoundland and Labrador Department of Health and Community Services TABLE OF CONTENTS CHAPTER 1: INTRODUCTION ......................................................................................... 9 Introduction ....................................................................................................................9 Purposes of the Act........................................................................................................9 Who is a Custodian? ....................................................................................................10 What is Personal Health Information?........................................................................10 Purpose of this Manual ...............................................................................................12 Who should use this Manual.......................................................................................12 How to use this Manual ...............................................................................................12 Evaluation of the Policy Development Manual ..........................................................14 Responsibility for Manual Review, Revisions and Additions.....................................14 Glossary of Terms ........................................................................................................15 CHAPTER 2: SAMPLE POLICIES AND PROCEDURES ................................................... 19 Section: 1.0 - Protecting Personal Health Information ............................................... 20 1.10 Security of Personal Health Information ........................................................20 1.20 Oath or affirmation of confidentiality..............................................................22 1.30 Awareness of obligations.................................................................................24 1.40 Accuracy of personal health information .......................................................26 1.50 Designation of decision maker .......................................................................28 1.60 Designation of contact person ........................................................................30 1.70 Notification of uses and public statements ...................................................32 1.80 Agreements between custodians and information managers......................34 1.90 Individual’s representative..............................................................................37 Section: 2.0 - Consent................................................................................................. 39 2.10 Consent requirements .....................................................................................39 2.20 Circle of care ....................................................................................................44 2.30 Consent directives and limited consent .........................................................47 2.40 Withdrawal of consent .....................................................................................49 2.50 Disclosure without consent ..............................................................................51 Section: 3.0 - Collection .............................................................................................. 57 3.10 Collection of personal health information - Generally ...................................57 3.20 Indirect collection of personal health information.........................................59 Section: 4.0 - Use ........................................................................................................ 62 5 Government of Newfoundland and Labrador Department of Health and Community Services 4.10 Use of personal health information ................................................................62 4.20 Confidential use of personal health information ...........................................66 4.30 Transforming personal health information ....................................................68 Section: 5.0 - Disclosure ............................................................................................. 70 5.10 Disclosure of personal health information.....................................................70 5.20 Preventing unauthorized disclosure of personal health information ...........72 5.30 Accuracy of disclosed personal health information.......................................74 5.40 Disclosure of personal health information to relatives .................................76 5.50 Disclosure of personal health information to a successor ...........................78 5.60 Disclosure of personal health information for health and safety purposes 80 5.70 Disclosure of personal health information for legal proceedings.................82 5.80 Disclosure of personal health information for law enforcement purposes .84 5.90 Disclosure of personal health information for research purposes...............86 5.100 Disclosure of personal health information outside the province .............87 5.110 Disclosure of personal health information to a registry ............................89 Section: 6.0 – Access and correction ......................................................................... 90 6.10 Access to personal health information...........................................................90 6.20 Correction and amendment of personal health information ........................94 Section: 7.0 – Privacy breach protocols ..................................................................... 97 7.10 Duty to notify individual ...................................................................................97 7.20 Duty to notify Privacy Commissioner ..............................................................99 Section: 8.0 - Accountability......................................................................................100 8.10 Definition of compliance............................................................................... 100 8.20 Responsibilities related to review by Privacy Commissioner ..................... 102 8.30 Consequences of the willful disregard of the Act ....................................... 105 8.40 Consequences of failing to protect personal health information .............. 107 8.50 Immunity from suit ........................................................................................ 109 8.60 Non-retaliation............................................................................................... 110 8.70 Information asset profile .............................................................................. 112 8.80 Frequency of privacy audits ......................................................................... 114 Section: 9.0 - Appeals ...............................................................................................116 9.10 Appeal by individual ...................................................................................... 116 9.20 Appeal by Privacy Commissioner ................................................................. 118 6 Government of Newfoundland and Labrador Department of Health and Community Services APPENDICES..............................................................................................................120 Appendix “A” Information Management Agreement Principles.................................................... 121 Appendix “B” Sample Oath / Affirmation of Confidentiality .......................................................... 127 Appendix “C” Information Security Management Overview.......................................................... 130 Appendix “D” Sample Information Asset Profile ............................................................................ 134 Appendix “E” Privacy Breach Guidelines........................................................................................ 137 Appendix “F” The Circle of Care: Sharing Personal Health Information for Health Care Purposes ........................... 143 Appendix “G” Limited Consent under PHIA .................................................................................... 150 Appendix “H” Privacy Breach Incident Reporting Form ................................................................. 153 7 Government of Newfoundland and Labrador Department of Health and Community Services 8 Government of Newfoundland and Labrador Department of Health and Community Services CHAPTER 1: INTRODUCTION Introduction In the spring of 2008, the Personal Health Information Act was passed by the Newfoundland and Labrador House of Assembly. The Act applies to both public- and private-sector custodians of personal health information, and establishes rules relating to the collection, use and disclosure of such information; the Act also provides individuals with the right to access and to request correction of their own personal health information. The Act is available on the Government of Newfoundland and Labrador’s website at: http://www.assembly.nl.ca/legislation/sr/statutes/p07-01.htm. (Please note that the copy of the Act and regulations made available in this policy development manual were prepared by the Office of the Legislative Counsel. As they are not published by the Queen’s Printer they are not an official version of the laws of the Province. You should contact the Queen’s Printer to obtain the official statement of the law.) Purposes of the Act The purposes of the Personal Health Information Act, as defined in the Act, are as follows: • To establish rules for the collection, use and disclosure of personal health information that protect the confidentiality of that information and the privacy of individuals with respect to that information; • To provide individuals with a right of access to personal health information about themselves, subject to limited and specific exceptions set out in this Act; • To provide individuals with a right to require the correction or amendment of personal health information about themselves, subject to limited and specific exceptions set out in this Act; • To establish mechanisms to ensure the accountability of persons having custody or control of personal health information and to safeguard the security and integrity of the personal health information in their custody or control; • To provide for an independent review of decisions and resolution of complaints with respect to personal health information in the custody or control of custodians; and • To establish measures to promote the compliance with this Act by persons having the custody or control of personal health information. 9 Government of Newfoundland and Labrador Department of Health and Community Services Who is a Custodian? The information in this policy development manual has been developed for use by all custodians of personal health information in the province of Newfoundland and Labrador. Entities that are and are not a “custodian” of personal health information are defined in section 4 of the Personal Health Information Act. Entities that have been designated as custodians under the Act include (but are not limited to): Health care professionals and health care providers (Physicians, nurses, chiropractors, optometrists, etc.), Regional Integrated Health Authorities, Departments of the provincial government when engaged in health care activities, The Public Health Laboratory, The Centre for Health Information, The Workplace Health and Safety Compensation Commission, Etc. What is Personal Health Information? The policies in this manual apply to “personal health information” held by custodians. Personal health information is defined in section 5 of the Act. The section states as follows: Personal health information means identifying information in oral or recorded form about an individual that relates to: (a) the physical or mental health of the individual, including information respecting the individual's health care status and history and the health history of the individual's family; (b) the provision of health care to the individual, including information respecting the person providing the health care; the name, business title, address and telephone number; licence number; and profession, job classification and employment status. (c) the donation by an individual of a body part or bodily substance, including information derived from the testing or examination of a body part or bodily substance; (d) registration information; (e) payments or eligibility for a health care program or service in respect of the individual, including eligibility for coverage under an insurance or payment arrangement with respect to health care; 10 Government of Newfoundland and Labrador Department of Health and Community Services