The list of privacy infractions by the Yukon government is getting longer.
In the last month and a half the territory’s information and privacy commissioner, Diane McLeod-McKay, has put out three separate reports on three different public bodies that all broke the Yukon’s privacy laws.
Yukoners should be concerned. The commissioner’s work suggests this is more than a handful of mistakes by a few misinformed staff members. In the best case scenario, the investigations found that the Yukon’s bureaucrats don’t understand the privacy laws and aren’t considering them when making decisions. At worst, the reports are a sign of widespread disregard of Yukoners’ privacy.
Most recently, McLeod-McKay revealed the Yukon government’s human resource officials had access to way more personal information about employees than they should have.
Until McLeod-McKay stepped in and the Public Service Commission agreed to make changes, human resources staff had access to the histories of all Yukon government employees, not just those in their particular department.
Human resources staff “have no function in the collection of (personal information)” of employees who are not part of their department, the report says.
That’s common sense. A government department should only have access to the information used within the department, not carte blanche for some staff to see whatever they want. Yet, it took a formal complaint for any changes to be made.
Also in January McLeod-McKay put out another report, this time finding that the Yukon Hospital Corporation violated privacy legislation when it shared a new mother’s health information with a community health centre without the woman’s knowledge or consent in 2017.
McLeod-McKay found that the hospital corporation failed to disclose only the minimum amount of information necessary to provide follow-up care, thereby violating HIPMA, the Yukon’s health privacy legislation.
In December 2018 the Yukon’s health department was scolded for breaking privacy legislation by asking a doctor for more patient information than necessary to process a billing claim in 2016.
McLeod-McKay was forced to hold a hearing on the issue because the health department claimed that it didn’t have any of the records.
She ruled the department overreached by, in at least one case, requesting the doctor to provide an unredacted clinical record.
The department also did not meet all the requirements laid out in HIPMA when it comes to protecting the information it keeps.
One of the biggest takeaways from these investigations is the Yukon government’s instinct to fight McLeod-McKay along the way.
In the case of the mother’s health records, the hospital corporation first argued the commissioner’s office didn’t have the authority to investigate.
The corporation eventually agreed to do a review of its policies but - surprise - that review found “no justification” to modify how things are done in the Yukon. Despite what the commissioner said, the corporation ruled it had not broken the law.
In the Yukon, that’s the end of that. The territory’s independent privacy commissioner can rule that the corporation broke the law, the corporation can say, “no we didn’t,” and the public body wins.
McLeod-McKay does not have the authority to force any of these public bodies to make changes. Complainants would have to go to court to make that happen.
The departments can thank her for her investigations, metaphorically pat her on the head, and send her back to her office while simultaneously giving Yukoners the finger.
In the case involving the health department and the oversharing of information for billing purposes, McLeod-McKay found that some of the records she needed for her investigation had been destroyed.
She says she believes the destruction of the records was unintentional. Readers may be more skeptical.
None of the changes McLeod-McKay has recommended in her various investigations are hard to understand and get behind. Most of them boil down to only collecting and sharing the bare minimum when it comes to private information.
This should be common sense for anyone dealing with private information.
If nothing else, Yukon employees should all be getting a refresher on the trust that has been placed in them when it comes to handling sensitive information.
There are changes the Liberal government could have made to strengthen McLeod-McKay’s office. They have, after all, trumpeted the recent re-write of the access to information legislation. Though some upgrades are coming eventually, the government has said the information and privacy commissioner won’t be getting enforcement powers.
So Yukoners may see more reports in the future but there’s no promise they will be worth more than the paper they come on.
(AJ)