Currently being studied by the Committee on Public Finance, the bill respecting health and social services information and amending various legislative provisions (Bill no.oh 3) presented to the National Assembly on December 7 proposes several changes to the rules of law in force in Quebec, applicable to the use of health data. This project aims to facilitate the reuse of this data, while guaranteeing respect for the privacy of the people affected.
The bill has three main components. First, the creation of a new administrative process to assess requests for access to health data for research purposes. Second, the adoption of regulations allowing health organizations to reuse data “for purposes compatible with those for which” they were collected. Third, granting new rights to individuals. They include the right of individuals to know the name of each group and individual who has used their health data, as well as when that use took place. They would also be guaranteed the right to deny the staff of health organizations access to their health data.
This bill is distinct from any other Canadian law applicable to the use of health data. It represents an ambitious attempt to meet the urgent needs of the health system. For example, data generated in a clinical setting is increasingly relevant to quality of care activities, as well as research. The relaxation of restrictions on the use of this data thus responds to the realities of contemporary health services. This change would allow healthcare organizations to pool the resources and data needed to improve the efficiency of care.
Serious shortcomings
The objectives of the legislation are very laudable. However, in its current form, the proposed bill has serious flaws. The patient’s right to refuse to health services personnel the use of data contained in his medical file and the obligation to write reports proving any use or communication of health data will be impossible to respect. Satisfying such demands would lead to a decline in the quality of care provided to patients, given the limits of the technology available in the field of health, as well as the shortage of manpower.
In addition, while favoring the use of new technologies in the field of health and the creation of new processes aimed at granting researchers faster access to data, Bill no.oh 3 would require a painstaking assessment of the invasions of privacy that could result from the use of new technologies and the pursuit of research projects. Indeed, the bureaucratic conditions required for the purpose of access to health data would oblige the requesting researchers to testify before “the person having the highest authority within the organization […] a privacy impact assessment”. The latter would supplement the current evaluation by a research ethics committee.
The incorporation of an additional privacy impact assessment will only result in a slowdown in requests for access to health data, already affected by a slow and “conservative” approval trend from public bodies. The drafting of a contract governing the use of data for research purposes would be necessary.
A privacy impact assessment would also be required before any modification or adoption of IT systems or data-oriented services. Health organizations would also be required to maintain a registry of the products and services they operate. This risks preventing, rather than encouraging, the establishment of advanced technological systems in the field of health.
In short, these requirements will exhaust the resources available in the health sector without guaranteeing patients better privacy protection. Organizations working in the field of health are already subject to legal obligations relating to the protection of personal data and cybersecurity. The creation of a regulatory framework facilitating the use of health data would be a step forward for Quebec. However, its subjection to such procedural conditions now risks making it a Pyrrhic victory.