ENFORCE THE LAW
The Saskatchewan government should not be surprised if a collective shrug greets its latest attempt to deal with breaches of patient privacy by health-care workers and those charged with safeguarding medical records.
A law designed to deal with such incidents has been on the books since 2003, yet neither the Saskatchewan Party government nor its NDP predecessor has put a single case before the courts. Sure, some health-care workers have been fired or suspended without pay, but successive governments have been unwilling to use the ultimate deterrent — prosecution leading to fines of up to $50,000 and/or a year in jail upon conviction.
We’re not the only ones puzzled by this reluctance to go to court on behalf of patients. Successive information and privacy commissioners have urged governments to use the full weight of the Health Information Protection Act (HIPA) to deal with “snooping” and careless disposal of old medical records. Indeed, in December, current commissioner Ronald Kruzeniski recommended that Heartland Regional Health Authority forward to the Justice Ministry its investigation of an employee who snooped into the personal health records of 901 patients. That employee was fired, but Kruzeniski said prosecutors should determine whether charges were warranted. As of Tuesday, no charges had been laid. It’s been the same story in other cases of unauthorized accessing of health records, or the frighteningly casual way medical files have been disposed of by trustees responsible for them. For example, a physician responsible for more than 2,600 patient files found in a recycling bin outside a Regina mall in 2011 wasn’t charged either. Justice Minister Gord Wyant said the facts wouldn’t sustain a prosecution, showing “a problem with the legislation that we need to fix.”
Well, effective today the law has been fixed. It will now be easier to prosecute trustees of medical records that are “found unsecured” since they must show they “took all reasonable steps to prevent the abandonment” rather than the Crown having to prove intent.
A specific “snooping offence” has also been added to HIPA, as has an individual offence for “wilful disclosure” of personal information. These offences carry the same hefty fines and/ or jail times found elsewhere in HIPA.
While it’s good to see a beefing-up of health privacy laws, we wonder when — and if — they’ll ever be used. Surely no louder message could be sent to those entrusted with keeping confidential our intimate health information than to make known the government’s intention to enforce the law against anyone who violates our privacy.