N.S. to work on health info privacy: minister

The provincial health minister said gaps in processes that protect personal health information will be addressed.

“The recommendations that have come in, many require further work and that’s actually the finding, is to have a privacy working group continue to work (on them),” Randy Delorey told reporters Thursday after a cabinet meeting.

The review of the Personal Health Information Act released Wednesday noted inadequacies in who’s notified about privacy breaches.

Under the act, the information and privacy commissioner is notified “of minor or insignificant breaches, but not breaches where there is a real risk of significant harm,” the report said. “This is not consistent with the breach notification provisions of other Canadian laws.”

The individual whose privacy is breached as the result of stolen or lost information will be notified only if the breach is likely to cause “harm or embarrassment” to that person.

This could lead to “recurrence of systemic breaches, a lack of effective breach prevention strategies, and a failure to notify individuals of their right to an independent review by the Office of the Information and Privacy Commissioner.”

In other provinces, such as New Brunswick, the privacy office must be notified of any breach.

Breaches in Nova Scotia include an employee of the former Capital District Health Authority prying into patient files in 2012.

The report also said it can be difficult to determine who is responsible for protecting health information under the current legislation.

It recommends that a digital health privacy working group led by the Department of Health and Wellness be created. The group would develop a framework, policy and guidelines around issues such as information sharing, how personal health information would be organized in records, and access to those records by health-care professionals and patients.

Delorey said his department will act on creating that working group but added his staff will begin immediately to address the privacy breach concerns raised in the report.

“There’s a system in place in terms of notification when there’s significant harm. I believe the language is, a significant breach does require notification (of individuals),” the minister said. “I assure Nova Scotians that, in fact, those criteria are in place right now.”