September 9-10, 2009, St. John’s, Newfoundland and Labrador
Personal health records (PHRs) have started to attract attention in Canada with recently announced services from the public and private sectors that will offer online health records for consumers. This has major implications for the development of the pan-Canadian electronic health infostructure. In this context, a PHR is generally an online health record that is initiated and maintained by an individual patient but there are a variety of other models and terms (such as “patient portal”).1
Whether or not PHRs are developed by the private or the public sector, Canada’s Privacy Commissioners want to ensure that they encompass the highest privacy standards. Now is the time to build components of PHRs that enhance patient privacy and control.
The Commissioners recognize that PHR services will be appealing to many people who may want to store their medical records online. If a large majority (84%) of Canadians consistently respond2 in favour of being able to access their own health information summary, including medical treatments they have received, they will no doubt be even more interested in the opportunities online PHRs may be able to deliver, as well as the potential for more robust control over their own personal health information.
Privacy Commissioners note that Canada Health Infoway has launched a pre-certification service for “Consumer Health Platforms,3 to define standards and architecture. Regardless of such initiatives, PHRs must conform to applicable Canadian privacy laws.
Developing privacy-enhancing PHRs should be consistent with the original vision for the electronic health infostructure. A decade ago, the landmark Final Report of the Advisory Council on Health Infostructure took a strong position in favour of patient control when it set out its strategic direction on electronic health records. Among other key recommendations, such as logging of all access to a patient’s record, the authors called on ministers of health to develop electronic health records systems that operate “on a need-to-know basis and under the control of patients.”4
Canada’s Privacy Commissioners see the development of PHRs as an opportunity for the patient empowerment envisioned by the authors of the Final Report. If governments and industry make the right choices now, PHRs could be a key privacy-enhancing technology to improve patients’ control over their own health information. PHRs may be the method patients have been waiting for to engage with their health care providers and to be informed about their options in controlling how the health system makes use of their electronic health record (EHR).
IN THIS CONTEXT, CANADA’S PRIVACY COMMISIONERS AND PRIVACY ENFORCEMENT OFFICIALS (“COMMISSIONERS”) RESOLVE AS FOLLOWS:
1 There are patient portals and other forms of online access where a patient’s information is maintained under the control of a provincial health system, physician, hospital or insurance company.
2 EKOS survey, Final Report, “Electronic Health Information and Privacy Survey: What Canadians Think — 2007,” August 2007, pp.56-57.
3 Canada Health Infoway Press Release, “Infoway launches new certification service for health information technology vendors,” February 12, 2009.
4 Recommendation 3.4, Advisory Council on Health Infostructure, Final Report, Paths to Better Health, February 1999, p.3-10.
5 The health-specific privacy legislation in some jurisdictions includes masking and locking provisions which permit some patient control.
6 D. Willison, “Use of Data from the Electronic Health Record for Health Research – current governance challenges and potential approaches,” March 2009.
Copyright 2020 OIPC. All rights reserved.