The Yukon’s Department of Health and Social Services (HSS) failed to follow privacy legislation by asking a doctor for more patient information than necessary to process a billing claim, the territory’s information and privacy commissioner (IPC) has found.
In a press release Dec. 13, IPC Diane McLeod-McKay announced the release of her report into a 2016 complaint about HSS’s Insured Health and Hearing Services branch. The complaint, filed by a patient of a Yukon doctor, alleged that, from August to November 2016, the branch was collecting more information than allowed, and that it did not have adequate security measures in place to protect it.
The patient and the doctor are not named.
According to the report, which is dated May 18, the IPC office attempted but failed to resolve the complaint via an informal settlement. McLeod-McKay was then forced to hold a hearing into the matter in early 2018 when, after requesting relevant records from both parties, HSS claimed that it didn’t have any.
The patient’s doctor, meanwhile had provided four pages listing 200 billing claims he had submitted to HSS.
The hearing took place from Jan. 15 to Feb. 19, with witnesses including officials from HSS and the doctor.
McLeod-McKay ultimately found that while the Health Information Privacy and Management Act (HIPMA) allows for HSS to collect some patient information to properly verify and process doctors’ billing claims, it overreached by, in at least one case, requesting the doctor to provide an unredacted clinical record.
Under HIPMA, HSS is permitted to ask for details like a patient’s name, the number of services a patient received and when the patient received them when processing a billing claim, McLeod-McKay found. However, it was not justified in asking for an unredacted clinical record, which, according to an internal document, contains information including “diagnostic interviews or examination, including history, mental status and treatment recommendation, with written report.”
By asking for the clinical report, McLeod-McKay wrote, HSS was asking for more than the minimum amount of information necessary to verify and process the bill, something confirmed by HSS witnesses at the hearing.
She noted that the department has since changed its policy, handing out a manual to doctors on how to redact clinical records before providing them to HSS, but has not laid out procedures for department staff on what to do should a redacted record still contain more information than necessary.
McLeod-McKay also found that while HSS had some measures and policies in place on how to properly protect the information it receives — for example, measures like locked cabinets and using secure files transfers to send sensitive records electronically — it did not meet all the requirements laid out in HIPMA.
“I appreciate that HIPMA has a lot of information security requirements to be met and that HSS has met some of them and is working towards meeting them all,” she wrote. “However, it has work to do, in my view, to achieve this objective.”
As a result of her findings, McLeod-McKay made two recommendations: for HSS to review its practice of collecting clinic records to ensure that it complies with HIPMA, and for HSS to work with her office “in good faith” to address the information security concerns.
Attached to the IPC’s press release was a Nov. 19 letter from HSS deputy minister Stephen Samis stating that the department accepted the recommendations and is “pleased with the progress that is being made on both.”
In a postscript, McLeod-McKay also outlined her concerns about the “number of challenges” she faced in trying to obtain records from HSS for her investigation.
“My ability to obtain the evidence I need to consider complaints under HIPMA is dependent on the cooperation of parties,” she wrote. “It is apparent that (HSS) had records relevant to the Consideration but failed to produce them. My realization of this fact during the course of considering the issues required that I conduct an oral hearing, which took a significant amount of time and cost to complete.”
During the hearing, McLeod-McKay wrote, a witness acknowledged that HSS had “failed to preserve records; namely, the suspended claim report that was relevant to this Consideration, despite their knowing it was underway and that it had moved to adjudication.”
“This, in my view, is serious,” she wrote, but added that she believed it happened “unintentionally.”
Contact Jackie Hong at jackie.hong@yukon-news.com