Since the late 1990s, personal health information (PHI) privacy legislation has increasingly been implemented across Canada. Manitoba was the first province to implement privacy legislation with the introduction of the Personal Health Information Act (PHIA) on December 11, 1997. These laws were introduced to help control the collection, use, and disclosure of personal health information in relation to the wide range of health services and access requirements of the health sector. They provide an important balance between addressing the privacy and confidentiality rights of the individual and ensuring the efficient delivery of health services.
In the Maritimes, there are two Acts that work in tandem with other federal and provincial privacy related legislations to govern the use of personal health information: New Brunswick’s Personal Health Information Privacy and Access Act was proclaimed on September 1, 2010, and the Nova Scotia Personal Health Information Act, which came into force on June 1, 2013. Prince Edward Island does not currently have legislation specific to personal health information; this is instead subject to the provincial Freedom of Information and Protection of Privacy Act and related legislation.
One of the MSSU’s goals is to conduct research that improves timely access to high-quality and cost-effective health care. Achieving this goal often requires researchers to analyze personal health information. Recognizing the responsibility of working with this information, researchers and supporting team members are trained in privacy principles and best practices, as laid out in respective federal and provincial legislation. These practices are followed through the adoption of a variety of administrative (e.g. policies and procedures), physical (e.g. secure research facilities) and technical (e.g. closed networks) safeguards as well as the requirements set out in the Tri-Council Policy Statement on Ethical Conduct for Research Involving Humans (a joint policy of Canada’s three federal research agencies – the Canadian Institutes of Health Research, the Natural Sciences and Engineering Research Council of Canada, and the Social Sciences and Humanities Research Council of Canada).
Protecting Privacy in Partnership with Research Data Centres
Another of the MSSU’s goals is to provide timely access to linked data and integrate existing or new databases. This goal is met by facilitating researcher access to provincial administrative health care databases, the linking of health data sets, and building partnerships for developing new data resources. The MSSU works in partnership with three research data centres: Health Data Nova Scotia (HDNS); New Brunswick Institute for Research Data and Training (NB-IRDT); and the Secure Island Data Repository (SIDR) in PEI. Established through partnerships and signed data sharing agreements with their respective provincial governments, these centres provide a secure, controlled environment while ensuring safeguards are in place for the protection of personal privacy. Simply put, without these research data centres researchers would not be able to conduct their research. Among other review steps, researchers’ applications for access to data at any of these centres are reviewed for compliance with relevant privacy legislation. If approved, they are only granted access to the specific information needed for their specific study, and only after a successful, parallel consideration of their application by the local Research Ethics Board. At the same time, these research data centres are a key connecting piece the administrative health data needed to inform improvements to health care in the Maritimes and to provide researchers with the training needed to analyze those data. For example, the MSSU’s research on small-area rate variation in high-cost health care use in Nova Scotia – which is now being expanded to New Brunswick and Prince Edward Island – is being conducted through these centres. Much of the cutting-edge health research being conducted in the Maritimes is made possible through the data centres supported by the MSSU.
Personal health information legislation, while unique to each province, gives direction for research data centres including:
- The authority to operate as research data centres (in role of agents or custodians) by entering in agreements with the province;
- The authority to link and/or match data sets;
- Provision of instructions regarding research project process;
- Reinforcing the requirements of the research ethics review process;
- Addressing the privacy principles such as providing minimum access necessary and limiting access, user and disclosure.
The Way Forward – New, Revised and Additional Legislation
It is an exciting time to be part of a network of research data centres servicing the administrative data access needs of maritime researchers. In Prince Edward Island, summer 2017 will see the proclamation of the province’s first Health Information Act. This Act will fill an important legislative gap and greatly facilitate the development and work of the SIDR. In Nova Scotia, the provincial Department of Health and Wellness is completing a three year review of the Personal Health Information Act. Finally, in New Brunswick proposed changes to privacy legislation are underway. New opportunities are ahead for NB-IRDT to continue to build a strong and meaningful data platform with the addition of new datasets to serve a wide range of administrative data research needs.
Legislation plays an important role for both researchers and the public; it provides the authority to conduct thoughtful and relevant patient focused health research. Keep watch for these important legislative changes in the coming months.