By Michael Power

The federal and provincial governments of Canada have invested billions to develop health information technology, but privacy concerns loom. Public support for EHRs, says Michael Power, will be tied to how well patients’ private information is protected. Power describes Canada’s EHR landscape here.

In Canada, the provinces and territories manage and deliver health services to their residents; the federal government provides a large degree of funding under the authority of the Canada Health Act, which specifies criteria and conditions that provinces and territories must meet in order to qualify for financial transfers.

To facilitate the sharing of health information among healthcare providers across the continuum of care, the federal government, through Canada Health Infoway, has made significant investments in regional and provincial electronic health record systems. To date, Infoway has invested $1.6 billion and committed a further $500 million in early 2009 to several hundred EHR projects. The provinces have also contributed significant funds to implement healthcare information technology.

It is important to emphasize that “EHR” in Canada specifically refers to patient-centric, longitudinal health record systems that contain a subset of data of interest to multiple providers. Electronic medical records (EMRs) in Canada, on the other hand, are provider-centric and contain substantial patient detail that may not be of interest to other providers. This distinction does not appear to apply in the U.S.

Most of the development to date has focused on infrastructure and systems to digitize and transport key elements (e.g. network, applications, registries) and electronic medical record systems in hospitals. Because of a low level of EMRs held by primary care providers, adoption and implementation of EMRs (a necessary component in any EHR system) is moving to the forefront as the next challenge to address. A number of provinces are moving to an ASP model for EMRs (British Columbia, Ontario, Alberta, Nova Scotia and Saskatchewan).

Privacy and security considerations loom large because EHRs, in the Canadian eHealth model, are designed to facilitate the sharing of data for patient care, public health surveillance, and health research, and in electronic communication between and amongst patients and providers. For patients, there is a fear of undesirable consequences, including financial loss or the loss of personal dignity (e.g. discrimination or social stigma) arising from the misuse of data. Public support for EHRs can be tied to how well healthcare providers and governments keep PHI private and secure.

A number of provinces have health-specific privacy legislation (British Columbia, Alberta, Saskatchewan, Manitoba, Ontario) and others are contemplating enactment of such statutes (New Brunswick, Nova Scotia, Newfoundland). Other statutes exist that affect the collection, use, and disclosure of personal health information.

British Columbia has enacted the E-Health (Personal Health Information Access and Protection of Privacy) Act. This statute, among other things, creates a framework for the creation of Health Information Banks; allows individuals to issue “disclosure directives;” and creates a Data Stewardship Committee to evaluate research requests for information. Whether this is sufficient is debatable given the emergence of the “BC Big Opt Out” campaign (www.bcoptout.ca), which promotes “opting out” of the provision of PHI to “eHealth.” Alberta has proposed amendments to its Health Information Act to effectively dispense with consent (a custodian will no longer be required to consider a patient’s wishes about the exchange of health information via Alberta Netcare) and permitting the government to require custodians to make health information available via Alberta Netcare. Alberta’s Privacy Commissioner has been critical of these changes and the enactment of these amendments seems to have stalled.

It can be argued that the Canadian experience with the deployment of EHRs has seen technology outpace policy and concerns about privacy (or perhaps more accurately how to deal with privacy issues) have affected the development of provincial EHRs. The whole area of de-identification policy, the misalignment of legacy IT systems and privacy policy requirements, the need for the aggressive use of audit capabilities (i.e. a strong monitoring policy), and the lack of comprehensive privacy programs at all levels of healthcare delivery all point to further attention to privacy being necessary in order to avoid a loss of patients’ trust and confidence.

Governance and data custodianship loom large as issues where sharing of sensitive data is a major system requirement. It is arguable that current legislation and rules of conduct governing the healthcare professions do not adequately address responsibilities for health IT systems’ operations. Similarly, how EHR/EMR custodians will manage and apply consent directives across multiple patient/provider identities, domains, and even jurisdictions remains a challenge.

Privacy is recognized clearly as an issue to address and, to some degree, is being addressed. Canada Health Infoway has produced privacy and security requirements in the form of a conceptual architecture and is working with provincial and territorial representatives to address privacy governance issues. Provincial privacy commissioners remain vigilant in the enforcement of health privacy statutes, and RFPs for provincial e-health initiatives show a clear attention to the privacy aspects of such initiatives. The devil, as they say, is in the details, and EHR initiatives, whether in Canada or elsewhere, will need to demonstrate alignment between political objectives of protecting privacy and workable technical and process measures that achieve those requirements while meeting the needs for a more efficient and effective healthcare system.

Michael Power is a Toronto-based legal advisor/consultant on privacy and information risk management issues, serving both public and private-sector clients. Mr. Power writes and speaks extensively on privacy and information security issues and previously served as vice president of privacy and security at eHealth Ontario. He may be reached at