Privacy commissioner says N.S. Health violated privacy of program participants

The Office of the Information and Privacy Commissioner has ruled Nova Scotia Health violated the privacy of participants in the province's Driving While Impaired program. 

A privacy expert in Halifax says it's an interesting illustration of the complexity of privacy rules when more than one law can come into play. 

"In Canada, and in Nova Scotia in particular, I think there is a mosaic of privacy laws, or a mess of privacy laws," said lawyer David Fraser of McInnes Cooper. 

"It's sometimes difficult to determine what law applies in any particular circumstance," Fraser said. 

Mandatory program

The Driving While Impaired Program is mandatory for anyone wanting to regain their driver's licence after a suspension for driving under the influence of drugs or alcohol. 

The program is designed to educate participants about the risks of impaired driving. It involves a "biopsychosocial assessment" and treatment consisting of individual or group counselling. 

Nova Scotia Health administers the program. It returns a risk assessment of low, medium or high to the province's Registrar of Motor Vehicles.

The risk assessment is used to determine when participants will be allowed to drive again, if at all.

But a participant in the program filed an official privacy complaint because his lifetime medical file was reviewed for the purpose of the risk assessment, including sensitive information he said was irrelevant to his driving record.

"In the complainant's view, it is a deterrent to seeking health care, particularly for sensitive mental health issues, if the personal health information is then made available for other purposes," wrote Commissioner Tricia Ralph in her 27-page decision. 

Nova Scotia Health took a different stance. 

"It stands to reason that an individual would be better served to not break the law rather than be concerned that their health information be used against them in a legal proceeding," Nova Scotia Health wrote in a submission. 

Parsing the legal standard that actually applied was a complicated task, as outlined in the report issued on June 16. 

"The commissioner does comment in the report that this was a complex issue, and there's an awful lot of detail in the analysis," said Janet Burt-Gerrans, the director of investigations for the Office of the Information and Privacy Commissioner.

Not a medical service

In Nova Scotia, medical information is collected under the Personal Health Information Act. 

Medical information can be freely shared within the medical system for the purposes of providing health care. 

The report notes the Driving While Impaired Program assessor, following those rules, accessed a broad swath of the complainant's health records. 

Those included "significant numbers of medical visits, health care encounters, and diagnostic results, containing highly sensitive and potentially embarrassing information spanning more than a decade of the complainant's life, most of which appeared unrelated to alcohol and/or substances."

But the commissioner ruled that providing a risk assessment to the Registry of Motor Vehicles was not a medical service. 

Medical information "was not used to provide health care," Ralph wrote. 

She continued: "But for being a DWI Program participant, participants would not undergo the biopsychosocial assessment and the risk rating would not be created."

Supreme Court precedent

The commissioner agreed with the complainant about the possible social impact of medical records being used for non-medical purposes, as outlined by the Supreme Court of Canada. 

"The Court acknowledged the real possibility of a chilling effect on individuals' likelihood to trust healthcare providers and to seek health care if they fear the information they provide will be used later for other, unrelated purposes," Ralph wrote.

"The Supreme Court of Canada has recognized the importance of protecting the sanctity of personal health information that is collected for the purpose of providing health care."

Freedom of information legislation applies

Because a risk assessment falls outside the definition of medical care, participants' medical information is controlled by Nova Scotia's Freedom of Information and Protection of Privacy Act.

Personal information protected by the act cannot be accessed without consent. 

Fraser said he always tells his clients to tread carefully when they are dealing with overlapping privacy regimes. 

"All organizations need to understand, 'What rules are we subject to? And how do we do whatever we plan to do in a way that respects privacy but also complies with these compliance requirements?'" he said. 

Fraser called the report "very worthwhile because it's a good illustration, not only of the complexity, but of the sorts of factors that need to come into play."

Findings accepted by government

Ralph ultimately recommended Nova Scotia Health withdraw its risk assessment in this case, and offer the participant a chance to participate using only information it's allowed to collect. 

The commissioner also recommended Nova Scotia Health conduct a privacy assessment of the Driving While Impaired Program, and have new guidelines in place by June 2022. 

A spokesperson for Nova Scotia Health says it accepts the report's recommendations. 

"Protecting the privacy of clients who participate in Nova Scotia Health's Mental Health and Addictions Program is paramount in everything we do," wrote Brendan Elliott in an email. 

"Members of the leadership team within the Mental Health and Addictions program are in the process of reviewing and working with our partners in implementing the key actionable items from the report."

A spokesperson for the Registrar of Motor Vehicles said there would be no comment beyond what was already outlined in the report.

MORE TOP STORIES