Legislation aims to broaden Alberta health records access while privacy breaches rise

Alberta's health minister says suggestions that a new health bill will allow him to snoop on citizens' medical records are "ridiculous."

Bill 46, an omnibus piece of legislation introduced last week, proposes putting the minister and Alberta Health in charge of who can access Netcare, which holds Albertans' electronic health records. The bill seeks to amend the Health Information Act, among other legislation.

"This is about the ministry and AHS [Alberta Health Services] being able to work together and sharing their information so they can come to government with policy recommendations," Health Minister Tyler Shandro said at a news conference on Monday.

"I am not going to be able to access anybody's personal health information. To me it seems completely ridiculous."

Earlier this year, two Alberta doctors accused Shandro of improperly obtaining their phone numbers after they protested at a public appearance by the minister.

Jill Clayton, Alberta's information and privacy commissioner, said last week she was shocked the government neglected to consult her on proposed changes to the Health Information Act, which she oversees. But Shandro said Monday that Clayton was consulted.

He said the government refrained from showing Clayton any of the proposed clauses in legislation, but that's the practice for any bill tabled in Alberta — the details are kept under wraps to preserve parliamentary privilege.

Clayton's staff said the commissioner knew none of the policy proposals until the bill became public. Her office received a high-level description of possible topics during a phone call, spokesperson Scott Sibbald said.

"At no point were details or context provided by Alberta Health during or after the call in a way for us to provide feedback or for the phone call to be considered a consultation," he said.

Sibbald said Clayton hopes to write to the minister with her specific concerns about changes to the Health Information Act by next week.

Although the bill proposes steep increases to the maximum fines for improper access of a person's health information — to $200,000 from $50,000 — the highest fine ever levied in Alberta is $15,000, Sibbald said.

Last fiscal year, the commissioner received about 1,000 reports of privacy breaches from the health sector, he said, most of which were errant faxes and emails.

"But we are receiving more reports of unauthorized access to health information, also known as 'snooping' breaches when someone who is allowed to access health information for their job does so without a legitimate business purpose," he said in an email.

In 2018, it became the law to report suspected health record snooping. Reports of potential breaches to the privacy commissioner ballooned during the next year.

Health ministry spokesperson Tom McMillan said 53,000 people currently have access to Netcare. He said the ministry can limit what information a worker sees based on their role.

Out of province, out of Alberta's control?

Other legal and privacy experts said Monday they see some red flags within the bill.

Giving health-care workers outside Alberta access to patients' electronic health records could leave the individual, or the government, without much recourse if a person from outside Alberta breaches their privacy.

University of Calgary health law professor Lorian Hardcastle said, within Canada, people could potentially complain to health-care workers' professional colleges about potential privacy breaches. But seeking amends outside Canada could be trickier.

Opposition health critic David Shepherd said Bill 46 could open the door to more for-profit medical videoconferencing apps to enter the market in Alberta.

Earlier this year, the Telus Babylon app was greeted with some controversy when the privacy commissioner hadn't been asked to review the service until after its launch.

Alberta doctors were also angry that, for a while, doctors seeing patients virtually on the app were paid more by the Alberta government than doctors seeing their patients by phone or online.

McMillan said there is no plan to give people outside Canada access to Netcare. Workers in other parts of Canada would be subject to privacy law in their jurisdictions and any professional standards.

"The plan is to enable access to health care providers in provinces and territories, for the purpose of providing health services to Albertans," McMillan said. "Immediate plans will be to focus on Lloydminster."

Hardcastle said some of the proposed changes in Bill 46 don't give the minister any new powers, but have drawn attention to extraordinary powers the public may not have known health ministers have, she said.

"This government has maybe shown itself as one that's willing, in order to aggressively implement their agenda, to do things that they're legislatively authorized to, but that other governments might have achieved through more conciliatory means," she said.

Sharon Polsky, president of the Privacy and Access Council of Canada, has several concerns with the bill as proposed.

She said it seeks to change the definition of how video and audio of patients are recorded without their knowledge, which opens the door to more telehealth recordings.

She said it makes it easier for health-care workers to share information with each other, without patients' knowledge.

The bill would also allow Netcare to be used for research purposes, not just patient care.

Polsky said if a researcher misuses the data, the legislation says they have to give the information back. That's hardly useful if it's already fallen into the wrong hands or left the country, she said.

And while people can change their passwords, they can't change biometric data, such as fingerprints or their face shape.