Vancouver Coastal Health Authority (VCHA)
I phoned the Vancouver General Hospital and UBC Hospital to ask for the name of their privacy officer. Not only did the hospitals not know the name of their privacy officer but they had absolutely no idea what I was talking about. Obviously, they have not had any instructions regarding the privacy legislation.
September 26, 2006
I wrote to the privacy officer at UBC Hospital and Vancouver General Hospital requesting:
1) a copy of their admittance form and
(2) I also stated that "I would like to know, in detail, who has access to anyone's records at any time. For example, if someone had been in the hospital, for whatever reason, who would have access to their records all doctors in the province/country/world or only certain doctors and, if so, which ones; all nurses, technicians, pastors, volunteers, etc.? Do they have access to all medical information or part of it (if so, who has access to what part)? If your access is limited, how is this enforced?
(3) where are the records kept (under lock and key, or in an easily accessible file container); is it kept in electronic or paper form, is it ever left unattended by medical staff, what safety features protect my information (ex. firewalls if on a computer)."
October 16, 2006
Letter from Leslie Kitchen, Sit Coordinator, Health Records, UBC Hospital (this was a form letter):
"In reply to your request for information on the above named patient, please note that the following apply: Your request has been forwarded to Traci de Pape, Vancouver Coastal Health's Freedom of Information Coordinator."
I don't recall every being a patient at Vancouver Health but I suspect that the mail room didn't know who the privacy officer was so forwarded my letter to health records.
November 27, 2006
Two letters to OIPC, re UBC and Vancouver General Hospital. Each letter stated:
"Attached is a letter that I sent to UBC Hospital. It is over 30 days and I have not received an answer to my questions.
Please deal with this matter."
January 26, 2007
E-mail to OIPC:
I sent complaint letters to your regarding Vancouver General Hospital on
November 27, 2006. Please advise me of the status of this complaint."
January 31, 2007
Reply from OIPC
A response letter has been sent to you in the mail yesterday."
January 29, 2007
Letter dated January 29 from Barbara Haupthoff, OIPC:
"I apologize for the delay of my response. We have received your correspondence pertaining to questions you submitted to Vancouver General Hospital, to which you indicate you have not received a response. I recommend you contact Traci de Pape, the Information and Privacy Coordinator for Vancouver Coastal Health Authority (VCHA) to inquire about the status of VCHA's response to your questions."
I can only assume that they believe that no one at the hospitals knows who she is, or what she does, or that mail isn't delivered to her.
February 16, 2007
Letter to Traci de Pape:
"On September 28, 2006 I sent letters to Vancouver General Hospital and UBC Hospital asking the same questions I am asking below. I did not receive a response so I contacted the Privacy Commissioner's Office. They suggested I contact you. Doesn't anyone at your hospitals know who the privacy coordinator is (in which case why didn't they reply stating as much) or are they instructed not to respond to any questions regarding privacy?
I would like a copy of your admittance form.
I would also like to know, in detail, who has access to anyone's records at any time. For example, if someone had been in the hospital, for whatever reason, who would have access to their records all doctors in the province/country/world or only certain doctors and, if so, which ones; all nurses, technicians, pastors, volunteers, etc? Do they have access to all the medical information or part of it (if so, who has access to what part)? If your access is limited, how is this enforced? Where are the records kept (under lock and key, or in an easily accessible file container); is it kept in electronic or paper form, is it ever left unattended by medical staff, what safety features protect my information (ex. firewalls if on a computer).
Actually there was an error on my part. Someone did know who she was (Leslie Kitchen) and forwarded my questions to her. So, either their internal mail delivery doesn't work or she couldn't be bothered to respond until possibly contacted by the OIPC.
February 26, 2007
This letter from Suzanne Kennedy at VCH didn't reach me until about 2 weeks later:
" We write to acknowledge receipt of your request dated February 16, 2007 for information under the Freedom of Information and Protection of Privacy Act (the Act) which was received by the Vancouver Coastal Health Authority on February 20, 2007.
You have requested a copy of the Vancouver Coastal Health Authority admittance form. We assume that you are specifically requesting those forms that are used by the Vancouver General Hospital and the UBC Hospital, but would be grateful if you would please confirm that this is the case. In the meantime, we will proceed with locating the above referenced forms.
You have also requested information about who within the Vancouver Coastal Health Authority has access to patient information. In order to process this request we will require some further clarification from you. Specifically, the Act provides the public with a right to access currently existing records. Therefore, in order to respond to your request we require a request that identifies what type of records you are seeking. We assume, for example, that you are seeking copies of any policies that set out access rights to patient information. As well, it would assist us in responding to your request if you could identify more specifically which facilities and types of patient information you are concerned about.
Please contact us at your convenience to discuss the clarification requested above. Before March 13, 2007, you may contact Suzanne Kennedy, at 604-643-6470 or firstname.lastname@example.org to clarify your request or to respond to any questions regarding the processing of your request. From and after that date, please contact Traci de Paper at Tel: 604-708-5338 Fax: 604-708-5330."
March 23, 2007
Letter from Ms. S. Kennedy:
"Further to my letter dated February 27, 2007 responding to your February 16, 2007 request for information under the Freedom of Information and Protection of Privacy Act, we enclose copies of the following:
1. A document entitled 'Inpatient Registration Facesheet'.
2. A document entitled 'Supplementary Application for Benefits under the Hospital Insurance Act';
3. A copy of the Vancouver Coastal Health Authority Information, Privacy & Confidentiality Policy; and
4. A copy of the Vancouver Coastal Health Authority 'Management of Information Privacy Incidents Policy
As per my earlier letter, we are having some difficulty ascertaining what other types of records you may be seeking, and are unable to process the remainder of your request without further clarification from you.
If you wish to proceed with the remainder of your request, would you kindly contact Traci de Pape, the Vancouver Coastal Health Authority Freedom of Information Coodinator. Her contact information is set out below.
Traci de Pape
Freedom of Information (FOI) Coordinator
Vancouver Coastal Health
1. The inpatient registration asks for employment information, marital status, religion, guarantor information. None of these questions are identified as optional. Is marital status and guarantor information necessary?
I noted with amusement a paragraph at the bottom of the registration: There is a minimum find of $100.00 and/ornot less than 10 days in jail for making false statements in application for benefits, or for failing/refusing to complete such an application when required to do so by an officer of any hospital in British Columbia. And, yet, these same hospitals can demand illegal information from you with impunity.
2. I don't know what that application is about so I will have to look into it.
3. This is 8 pages and gives more detailed, useful information than the others I've read (of course, some authorities, apparently, don't even have one).
However, on page 5 it states that VCH will make available, directly to individual, specific information about its policies and practices related to the management of Personal Information. So why are they refusing to state specifically who has access to our information.
Assuring Clients that their information will be kept confidential is essential to the establishment of a trust-based relationship, which improves the quality of care because Clients will provide better and more complete information for decisions made with care providers'. It's hard to develop trust when the hospital authority refuses to provide details.
Staff should take all reasonable steps to ensure no unauthorized personnel or third parties are provided with access to records containing Personal Information. Any third party who requests access should be asked to produce identification and confirmation that they have signed an agreement in accordance with this Policy. How do they know who is authorized, or who should be authorized, if there are no detailed guidelines?
I found another paragraph interesting, Requests by researchers are to be directed to the Vancouver Coastal Health Research Institute. How much of our confidential information is being given to researchers without our knowledge, much less our consent.
4. Essentially this outlines what happens if confidential or sensitive information has been lost, stolen or mistakenly disclosed.
"2.4 Notification - The Information Privacy & Steering Committee decides whether affected individuals or organizations should be notified of a privacy incident, in order to avoid or mitigate harm to them, and how these individuals or organizations should be notified, including the Office of the Information and Privacy Commissioner.
The factors relevant to deciding it, when and to whom to provide notification include:
- the sensitivity of the information
- what harm might arise from the incident, including whether it could be used for identity theft or other harmful purposes.
- number of people affected and their relationship to VCH;
- whether the information could be easily exploited for reasons it was not intended for;
- the cause of the incident, whether or not the information was fully recovered; and
- the extent of any residual risks associated with the incident once it has been contained."
Disposal of Confidential Information: This policy generally states that Confidential Information in paper format that is not longer required for clinical or business purposes must be destroyed in a secure manner (i.e. shredding) to prevent any unauthorized retrieval and disclosure of the Confidential Information. It then talks about collection bins, security and disposal.
This policy also states re Disposal of Electronic Media: Detailed procedures for the disposal of Confidential Information can be found in the policy 'Waste Management Methods of Disposal (Confidential Material)'.
I appreciated the information that they sent. This was certainly the best information sent by the authorities. But I still don't know who, specifically, has access to personal information.
March 27, 2007
Letter Traci de Pape:
"With regard to the admittance form, yes I am referring to those used by Vancouver General Hospital and the UBC Hospital. What other health facilities do you operate?
I really don't know how much more detailed I can get from my last letter. I am not only seeking policies that set out access rights to patient information (which are usually so general it provides little information) but information that identifies exactly who has access, for example service providers, who are service providers and why would they need access to patient information; if you say employees, who do you include as employees. Surely, somewhere you must have something in writing which more clearly identifies who accesses patients information than general policies. Surely somewhere it is written which service providers, health care providers, volunteers, pastors, etc. are allowed to access patients information, under what circumstances and to what extent.
And, surely, somewhere there must policies and procedures, in reasonable detail, regarding the measures in place to protect patient information.
I am referring to all facilities and all types of patient information.
I would also like to know if you share patient information, without explicit patient consent, to research organizations."