Skip to content

Hospital patient privacy laws tightened

The act makes it mandatory to report privacy breaches to the Information and Privacy Commissioner and, in certain circumstances, to relevant regulatory colleges.
2015 11 24 health_generic doctor
File photo.

The Health Information Protection Act (HIPA) passed third reading in the Ontario legislature today.

The Act introduces new measures that improves privacy, accountability and transparency in the health care system.

The passing comes in the wake of a North Bay area nurse who faced charges stemming from unlawfully going through nearly 6,000 patient records at the North Bay Regional Health Centre. Charges were dropped last year.

North Bay Regional Health Centre nurse Melissa McLellan was accused of illegally accessing 5,804 patient records, which included information about overdoses, suicide attempts, marriage issues and psychotic episodes. 

However, the charges were dropped because of a 16-month delay which the court said was attributed to the Crown prosecutors not moving quickly enough with the case. 

See original story: North Bay nurse off the hook for privacy charges.

The Act will amend existing legislation to protect the personal health information of patients, including:

  • Making it mandatory to report privacy breaches, as defined in regulation, to the Information and Privacy Commissioner and, in certain circumstances, to relevant regulatory colleges
  • Strengthening the process to prosecute offences under the Personal Health Information Protection Act by removing the requirement that prosecutions must be commenced within six months of when the alleged offence occurred
  • Doubling the maximum fines for privacy offences from $50,000 to $100,000 for individuals and from $250,000 to $500,000 for organizations.

The Health Information Protection Act will, once proclaimed, also update the Quality of Care Information Protection Act (QCIPA) to increase transparency and maintain quality in Ontario's health care system by:

  • Affirming the rights of patients to access information about their own health care
  • Clarifying that facts about critical incidents cannot be withheld from affected patients and their families
  • Requiring the Minister of Health and Long-Term Care to review QCIPA every five years.

Ontario is working to implement all recommendations made by the expert committee that reviewed the Quality of Care Information Protection Act to improve transparency in critical incidents. These include bringing forward a proposal to ensure patients or their representatives are interviewed as part of a critical incident investigation, and are informed of the cause of the incident, if known.

Protecting patient privacy and strengthening transparency is part of the government's plan to build a better Ontario through its Patients First: Action Plan for Health Care, which is providing patients with faster access to the right care, better home and community care, the information they need to stay healthy and a health care system that's sustainable for generations to come.

"This legislation gives our health care system the necessary tools to protect the private health information of patients in Ontario,"  Dr. Eric Hoskins, Minister of Health and Long-Term Care said today. " Patients deserve to know that their most sensitive information is not being accessed inappropriately and that their privacy is being protected. Our legislation also ensures that patients and their families are kept informed when a critical incident occurs and as it is investigated. Both of these initiatives are part of our commitment to put patients first, putting their needs at the centre of our health care system."

The expert committee that reviewed QCIPA undertook extensive research and interviewed more than 60 health care professionals, patients and their family members who had experience with critical incidents or service quality issues in hospitals

"I am pleased that these important amendments to the Personal Health Information Protection Act have passed third reading," added Brian Beamish, the Information and Privacy Commissioner of Ontario. "Personal health information is among the most sensitive of personal information. As new technologies emerge and health records are increasingly shared electronically among health professionals, it is crucial that mechanisms are in place to ensure this information continues to be protected. ‎My office was pleased to provide advice in the development of these amendments."

QCIPA currently applies to public and private hospitals, independent health facilities, long-term care homes, medical labs, specimen collection centers and psychiatric facilities.

The purpose of QCIPA is to enable health care providers to have protected quality improvement discussions, including discussions about critical incidents, in order to help improve patient safety and ensure such incidents are not repeated in the future, while still ensuring that patients and their authorized representatives have access to the facts about the incident.

Ontario has appointed its first-ever Patient Ombudsman, Christine Elliott, who will help meet the needs of patients who have not had their concerns resolved through existing complaint mechanisms.

LEARN MORE