SOMBA K'E/YELLOWKNIFE
In what she calls "one of the most significant reports I have prepared since taking office," Privacy Commissioner Elaine Keenan Bengts is raising the red flag on electronic medical records kept at Yellowknife's two primary health care centres, which she says are far too accessible to health centre staff.
In her annual report tabled in the legislative assembly Feb. 19, Keenan Bengts found that, despite filters meant to limit what workers at Yellowknife's primary care clinics can see of a patient's personal medical information, all 150 employees at the two primary care clinics can view records that "can be quite sensitive."
This information includes pregnancy, substance abuse, erectile dysfunction, cancer screening, therapeutic abortion, psychiatric diagnosis and sexually transmitted disease screening.
"Yellowknife is a small town and inevitably at least one of the 150 people who have access to the system is going to have some connection to each patient who walks in the door, whether as a friend or a relative or a friend-of-a-friend or relative," Keenan Bengts states in her 2011/12 annual report.
These 150 employees with access include physicians, nurses, administrative assistants, clinic assistants, mental health and addictions councillors and IT department employees.
However, the amount of access an employee has to a patient's record is limited according to their role. For example, a physician has access to a patient's entire electronic record, while an administrative assistant has access to only parts of it.
The handling of sensitive patient information comes with the territory for those who work in health care, said Les Harrison, CEO of the Yellowknife Health and Social Services Authority (YHSSA), the body that oversees the electronic medical record program.
"There's always this challenge surrounding the sharing of information between clients and providers," said Harrison. "The electronic record is much safer than the former paper record system that we had."
All employees sign a confidentiality agreement when they are first hired. Also, to gain access to the electronic medical records system, employees must sign another confidentiality agreement, he said.
One of the major benefits of the electronic medical records system over paper records is the ability to determine who has looked at what in a patient's file, he said. If a patient complains their privacy has been breached, the department can now audit the system and find out exactly when that patient's information was accessed and by whom.
Digitizing medical records also creates many new opportunities for providing better care to patients, said Harrison.
In an age when patients rarely have a single permanent doctor, this system assures that on the day of an appointment, the physician has access to their patient's full medical record. Also, there is a protected electronic messaging system where physicians can send notes to one another but no one else can access it, which Harrison says improves patient care.
But Keenan Bengts states that under the current privacy law, medical information can be shared to treat a specific medical condition, but not entire medical files.
"YHSSA takes the position that they, as a health authority, can share client information within the authority as needed to facilitate their functions, without client consent," she states in her report.
However, under the federal privacy act, all Canadians have the right to determine for themselves if, when and how their personal information is being released.
The electronic medical records system has been in the works since 2004, and was first implemented in Yellowknife in 2006 at the Great Slave Community Health Clinic. It was then fully implemented in Yellowknife in 2010, with the intention of eventually rolling it out throughout the territory, said Harrison.
He said the health authority welcomes the fact the privacy commissioner is raising concerns now while the program is still young.
Since receiving the commissioner's report, the health authority has committed to providing more training for its workers on the handling of sensitive information. It's also reviewing its auditing system and may increase how often they check who is accessing what information on patient accounts, he said.
Nonetheless, it would be difficult to comply in full with Keenan Bengts' recommendations, said Harrison.
"We appreciate the work the commissioner has done here, we just don't completely agree with the assessment," said Harrison. "In order to accommodate (her recommendations), it would basically grind the system to a halt."
