Anyone who has access to Yukoners’ health and medical information has new privacy rules to follow.
The Health Information Privacy and Management Act became the law at the end of August. It lays out the rules for people like dentists, pharmacists and doctors as well as anyone with the health department or hospital who has access to health records.
Prior to the law, individual departments or clinics, for example, could each have their own privacy policies. Now, the rules are territory-wide.
People who collect private health information must have “policies and technical and physical safeguards that ensure the confidentiality, security, and integrity” of the information, the law says.
They must limit the number of people who have access to private information and those people must be trained in the new law.
It is illegal to collect, use or disclose someone’s personal health information unless you are authorized under the act.
Medical providers are now legally required to report any serious security breeches of someone’s health information to the Yukon’s Information and Privacy Commissioner.
Fines for breaking the rules top out at $25,000 for an individual and $100,000 otherwise.
The new act clocks in at more than 100 pages and comes with a separate set of regulations.
“One thing that concerns me about this whole legal regime is the complexity of the law and the regulations,” said Yukon’s privacy commissioner Diane McLeod-McKay.
“It’s going to be a real challenge for custodians (people who keep health records) to figure it out. It’s a challenge for us. We’re sitting in our office flipping back and forth figuring out what this law is saying.”
As of the end of August businesses and departments were required to train staff that work with health information about the new rules.
In the health department, for example, that amounts to about 1,400 people.
The department says about 950 people have received the required training so far.
Health department spokesperson Michelle Boleen said in an email that some employees on vacation or leave have yet to undergo training.
“When new employees start or existing employees return to work, they will receive training as soon as practicable,” she said.
The Yukon Hospital Corporation says it already has appropriate policies and procedures in place. An online training course has been developed for hospital staff but the corporation couldn’t confirm how many people have completed training.
“We’re confident that we have everything in place to safeguard our patients’ health information,” spokesperson James Low said.
Birgitte Hunter, an assistant deputy minister with the health department, said all indications are that people are working through the training.
To help smaller businesses, the department has created an online training course. There is also information online explaining the new law to patients and medical professionals.
The privacy commissioner’s website also offers plain-language information.
“I do think Health and Social Services has done some good work in term of getting out a toolkit and trying to help custodians meet their obligations under the act. I think that’s great. In most jurisdictions that hasn’t happened,” McLeod-McKay said.
Under the new law a Yukon health card number can only be used for medical purposes.
In the past health numbers have sometimes been used on employment applications or even to apply for a credit card, Hunter said.
“The health care card, I think, has been used more frequently historically as a source of ID,” she said.
“What we’re saying is really the health care card should be used in relation to the provision of health care and health care coverage.”
Yukon government organizations must stop using health card numbers for non‐health related purposes come Dec. 31.
The new act is not the only big change coming to the way Yukon health information is managed.
The department is still working on a new drug information system that is scheduled to be up and running early next year.
That electronic system will link doctors and pharmacists with the goal of having more complete access to a patient’s medical records.
McLeod-McKay said she’ll be keeping a close eye on that system when it rolls out. Patients will have the legal option of “masking” or hiding their information on the system. That means medical staff won’t be able to see it unless there is a serious medical emergency.
McLeod-McKay said she wants to make sure the systems that are being linked electronically are modern enough to allow for masking.
But the department can’t say exactly what that option will look like.
In other jurisdictions the option to mask information is rarely used, Hunter said.
“For example, in British Columbia I think there are (fewer) than 100 out of millions … of people that have actually masked. The numbers are equally low or lower in Alberta and Saskatchewan.”
Most people recognize that giving medical personnel access to your information — with privacy rules in place — is helpful, she said.
Contact Ashley Joannou at firstname.lastname@example.org