COVID-19 Causes Recalibration of Privacy Interests of Personal Health Information
Ontario generally zealously protects personal health information from disclosure. The Personal Health Information Protection Act, 2004 (the “PHIPA”) contains very stringent controls over the disclosure of personal health information. Personal health information is broadly defined, and includes the physical or mental health of an individual. Health information custodians are subject to a strict regime relating to collection, use and disclosure of personal health information. Health information custodians include laboratories licensed under the Laboratory and Specimen Collection Centre Licensing Act (section 3(1), paragraph 4(iv)), as well as medical officers of health within the meaning of PHIPA (section 3(1), paragraph 6).
Generally speaking, personal health information cannot be disclosed without consent (section 29 of PHIPA), unless specifically provided for by PHIPA. There are detailed exceptions for research, planning and management of the health system, healthcare payments, and analysis of health system. PHIPA does not specifically refer to emergency measures pursuant to the Emergency Management and Civil Protection Act (the “EMCPA”). PHIPA does have a provision which allows disclosure related to risks, where the disclosure could eliminate or reduce significant risks of severe bodily harm to persons or groups of persons (section 40).
Given the rapid spread of COVID-19 in Ontario, and the high incident of contagion with respect to healthcare professionals in other jurisdictions, Ontario determined that it was necessary to encroach upon the generally high level of privacy given to personal health information. The Ontario government had already declared an emergency pursuant to section 7.0.1 of the EMCPA on March 17, 2020. On April 3, 2020, the government passed Regulation 120/20 (the “Regulation”). Schedule 1 to this Regulation is entitled “Access to COVID-19 Status Information by Specified Persons”. In particular, the Regulation requires laboratories and medical officers of health to provide specified information with respect to COVID-19 to authorized persons. The authorized persons identified by the Regulation are police officers, a member of a police force, a First Nations constable, a member of a First Nations police service, firefighters, individuals engaged in providing fire protection services, individuals employed in a fire department, paramedics and communications officers pursuant to the regulations under the Ambulance Act.
The specific information that the above-mentioned individuals are entitled to request is an individual’s name, address and date of birth, and whether the individual has had a positive test for the COVID-19 virus. The Regulation made pursuant to the emergency order also permits disclosure by the Ministry of Health, if the Ministry has developed a system to facilitate access to the required information.
The rationale for this emergency order appears obvious. Given the highly contagious nature of COVID-19 and the fact that the authorized individuals are all first responders of one sort or another, the information can be used by first responders to protect themselves when interacting with individuals who have tested positive for COVID-19 or, at the very least, the information can alert them to their own risk, if they have previously interacted with an individual who has tested positive for COVID-19.
The Regulation itself identifies numerous justifications pursuant to section 7.0.2(4) of the EMCPA, including paragraph 8, (authorizing facilities to operate as necessary), paragraph 9 (making services available), paragraph 10 (procuring necessary services), paragraph 12 (authorizing persons to render services), paragraph 13 (requiring disclosure of information which can be to prevent, respond to or alleviate the effects of an emergency), and paragraph 14 (general provision allowing actions to prevent, respond to or alleviate effects). Clearly, paragraph 13 is the most specifically relevant paragraph for the purposes of an emergency order that requires the disclosure of specific personal health information.
It is notable that paragraph 13, which can be relied upon to require disclosure of information, is specifically subject to section 7.0.2(7) of the EMCPA. This subsection is a recognition of the importance of protecting privacy of information in Ontario. This section requires that the information must be for the purposes of preventing, responding to or alleviating the emergency, and for no other purpose, and provides that personal information that is subject to the Freedom of Information, Protection and Privacy Act (the “FIPPA”) becomes subject to all relevant privacy and confidentiality law when the declared emergency has terminated.
In a memorandum dated April 6, 2020 from Dr. David Williams, Ontario’s Chief Medical Officer of Health, to Medical Officers of Health, Associate Medical Officers of Health and the President and Chief Executive Officer of Public Health Ontario, Dr. Williams indicated that the Ministry is working on mechanisms to reduce the need for first responders to contact medical officers of health and laboratories individually. Dr. Williams indicated that proper safeguards will be instituted to protect the personal health information with respect to any process put into place by the Ministry. In this memorandum, Dr. Williams also emphasized that confidentiality and protection of personal health information will be considered paramount.
In a memorandum dated April 6, 2020 from Richard Stubbings, Assistant Deputy Minister, Public Safety Division and Public Safety Training Division, to all Chiefs of Police, the OPP Commissioner and Chairs of Police Services Boards, Mr. Stubbings informed the Chiefs that the provision of COVID-19 status information will be implemented through a centralized mechanism, and discouraged police officers from making individual requests from laboratories and Medical Officers of Health. Mr. Stubbings went on to encourage police services to develop policies, including policies about how such information will be stored, as well as protocols for communications and dispatch services. This memorandum also stresses that confidentiality of personal health information must be considered paramount.
It is clear that, in the present situation, the government of Ontario has determined that limited disclosure of personal health information to a limited number of defined persons for the purpose of alleviating the effect of the COVID-19 emergency struck the proper balance between protection of first responders and the privacy interests of individuals and their personal health information. It could perhaps be argued that section 40 of PHIPA would have allowed the disclosure of relevant information; however, no doubt each request pursuant to section 40 would require an individualized assessment and, therefore, would cause delay and uncertainty at a time when speed and accuracy can be crucial. Accordingly, the government took the action of promulgating the Regulation, which pursuant 7.0.8 of the EMCPA will be revoked within14 days (April 17, 2020), unless it is extended for the duration of the emergency (or revoked before that time).
All citizens of Ontario, whether they agree with this balancing act or not, are surely united in their hope that this provision will only be necessary for a short period of time.