1. Health Equity: Respecting Individuals and their Privacy Amanda Brennan, B.A., LL.B. Corporate Privacy Officer & Freedom of Information Coordinator October 4, 2012

2. Respecting Individuals & their Privacy • Privacy Offices typically concern themselves with the following issues: • Collection of personal health information (PHI) • Use of PHI • Disclosure of PHI • Storage, Retention and Destruction in compliance with the Personal Health Information Protection Act, 2004 (PHIPA)

3. Implementation & Customization • Research indicates that implementation should be customized to the clinical environment • Governing committee within each hospital can advise on best methods of implementation within that hospital • MSH will support other hospitals through implementation in a variety of ways

4. Collecting Personal Health Information (PHI) Reasonably foreseeable that the information collected could identify an individual as a patient of the hospital Preferred spoken language Ability to speak and understand English Preferred language for written materials Whether or not individual was born in Canada, and if not their year of arrival • Year of birth • Race • Religious affiliation • Disability • Gender identity • Sexual orientation • Family income and number of people income supports • Housing

5. Collecting Personal Health Information (PHI) • Broadly speaking the principles underlying our health care system, encoded in the Canada Health Act support the goals of this data collection: • s.12(1)(a) “In order to satisfy the criterion respecting accessibility, the health care insurance plan of a province must provide for insured health services … on a basis that does not impede or preclude, either directly or indirectly whether by charges made to insured persons or otherwise, reasonable access to those services by insured persons.”

6. Collecting Personal Health Information (PHI) • Collecting with consent: building trust & complying with PHIPA • Ask patients for knowledgeable consent: • Tell them the purpose of collection • Be prepared to answer questions about the collection, use and disclosure of their PHI • Document consent • Permit patients to answer all, some or none of the Qs, as they choose

7. Use • PHIPA permits hospitals to use PHI that they have collected for: • “the purpose for which the information was collected…” • “planning or delivering programs or services that the custodian provides … evaluating or monitoring any of them” • “to improve or maintain the quality of care or…any related programs”

8. Disclosure • Aggregate data – to the extent it is not identifiable – can be used and disclosed as it is not subject to PHIPA • To the extent information is identifiable, it would be subject to the stricter disclosure limitations of PHIPA

9. Storage, Retention & Destruction • MSH program stores PHI within each patient’s electronic record with this data in a special portion of the chart so that it can be aggregated & manipulated to draw relevant conclusions • Retained in accordance with our Retention and Storage of Records Policy; securely destroyed afterwards

10. Amanda Brennan, B.A., LL.B. Mount Sinai Hospital, Corporate Privacy Officer & Freedom of Information Coordinator 416-586-4800 ext. 2101 abrennan@mtsinai.on.ca