Collection of RCMP member's health information unnecessary (VAC)

Complaint under the Privacy Act (the Act)

1. The complainant has been a member of the Royal Canadian Mounted Police (RCMP). In October 2002, she applied to Veterans Affairs Canada (VAC) for a disability pension for a condition resulting from her service with the RCMP. In 2003, VAC responded to the complainant, advising of its decision to award her a disability pension under section 32 of the RCMP Superannuation Act, as well as additional pension entitlements for her dependent. VAC's correspondence also references the diagnosis resulting from a psychological evaluation, as well as financial information, such as retroactive and future monthly compensatory payments to be made to the complainant. This correspondence was copied to the RCMP's National Compensation Policy Centre, which the complainant alleges was inappropriate and in contravention of the Act, since she does not believe that the personal information within was required by the RCMP.

Summary of Investigation

2. In terms of background to this complaint, the RCMP and VAC signed a Memorandum of Understanding (MOU) on September 5, 2002, which transferred the responsibility for the administration and adjudication of disability pension claims by RCMP employees to VAC. As such, in October 2002, the complainant applied to VAC for a disability pension for a condition resulting from her service with the RCMP.
3. A few months later, the complainant received a disability pension decision letter from VAC advising that her disability had been assessed at a specific percentage under subsection 39(1) of the Pension Act and that an additional pension was also payable to her dependent under subsection 34(3) of the Pension Act. The correspondence included details of the complainant's medical diagnosis, which was established following a psychological evaluation. Additionally, the correspondence included detailed financial information such as the amount of a retroactive adjustment and the amount of future monthly payments payable to the complainant.
4. The complainant takes issue with VAC's disclosure of (1) her financial information, (2) her medical diagnosis/pensioned disability,^{Footnote 1} and (3) the percentage of her disability to the RCMP, her employer, which she believes had no need to know this sensitive personal information.
5. In support of her allegation that this information was inappropriately disclosed to her employer, the complainant provided copies of her completed Application for Disability Pension (PEN 923 - Nov 1999) and Authority to Release Medical Information (PEN 860e - Oct 1999) forms, both of which were signed and dated in October 2002.
6. The Declaration section of the Application for Disability Pension form reads as follows:

   The information you provide on this form is collected under the authority of the Pension Act for the purpose of administering pension benefits. It is protected by Canada's Privacy Act from disclosure to unauthorized persons. You may request a copy of this form in writing by quoting Personal Information Bank No. VAC/P-PU-055.

   Similarly, the Authority to Release Medical Information form includes the following privacy statement:

   The information received will be collected under the authority of the Pension Act for the purpose of administering pension benefits. It will be protected by Canada's Privacy Act from disclosure to unauthorized persons and maintained in Personal Information Bank No. VAC/P-PU-055.

7. According to the Info Source description ofVAC PPU 055, the following was in effect in 2002:

   Purpose: The purpose of the bank is to retain the documents required for making decisions and maintaining accounts on pensions, compensation and grants for applicants under the Pension Act … the Royal Canadian Mounted Police Superannuation Act … the Royal Canadian Mounted Police Pension Continuation Act …

   Consistent Uses: Information in this bank is provided to federal government institutions or departments or agencies of provincial or municipal governments that require the information to determine the entitlement of the individual to any social or financial benefits. The bank's information is also provided to qualified medical practitioners, health professionals or social agencies (established or accredited by federal or provincial law) in order that they may adequately provide a health or social service needed by the individual. Information may also be shared with authorized parties to assist the Department in the collection of overpayments …

8. The description of the consistent uses for the information in VAC PPU 055 makes no specific mention of the RCMP (or employers in general) and does not define or provide examples of the types of "health or social service" contemplated.
9. The complainant therefore argues that based on the information provided on the Application for Disability Pension and Authority to Release Medical Information forms, she did not consent to and was not aware that any of her personal information would be disclosed to her employer, the RCMP. She further argues that the disclosure of her personal medical information to the RCMP's National Compensation Policy Centre was neither necessary nor authorized under the Act.

Application

10. In making our determination, we considered sections 3 and 8 of the Act.
11. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
12. The information at issue clearly fits into the definition of personal information found in section 3 of the Act, since it contains elements of the complainant's medical, employment, and financial information.
13. The Act states that personal information can only be disclosed with an individual's consent - Subsection 8(1) - or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
14. As described above, in signing the Application for Disability Pension and Authority to Release Medical Information forms, the complainant understood that she was consenting to VAC collecting and using her personal information for the purposes of adjudicating her disability pension application, but she did not believe that she was consenting to its disclosure to her employer for any purpose, since the RCMP had transferred the responsibly for the administration of disability pension benefits to VAC.
15. In its representations in this matter, VAC does not claim that the complainant's personal information was disclosed with her consent. Rather, its position is that the complainant's personal information was disclosed to the RCMP for a use consistent with the purpose for which it was collected and was therefore authorized under paragraph 8(2)(a) of the Act.
16. VAC is of the position that since RCMP members are not eligible for provincially insured health services as per subsection 2(b) of the Canada Health Act, the RCMP is responsible for the medical and dental treatment of its members as detailed in section 83 of the Royal Canadian Mounted Police Regulation. VAC therefore provides the RCMP with information about its members' disabilities to ensure that all aspects of the treatment of that disability will be properly addressed.
17. VAC's representations in this matter also included a copy of its Pension Claims Policy (RCMP Section), which was in force in 2003. Our review determined that the policy speaks only to factors determining pension eligibility and not to the disclosure of information to the RCMP.

The MOU between VAC and the RCMP

18. In order to understand the nature of the relationship betweenVAC and theRCMP with respect to the administration of disability pensions, the aforementionedMOU between to the two institutions was reviewed. According to theMOU:
    • RCMP members and former members are entitled to benefits under the Pension Act for injuries or illness arising from and attributable to their service. In the past, the role of VAC, with respect to the RCMP, has been limited to the first level of adjudication for RCMP disability pension applications. The Veterans Review and Appeal Board (VRAB) also played a role in reviewing unfavorable decisions and rendering subsequent adjudications. Once VAC adjudicated on a pension application and rendered a decision, the RCMP was responsible for advising the client of the ruling on their disability pension application and for communicating any payment information and instructions to Public Works and Government Services.
    • In response to the complex needs presented by an increasing number of disability pensioners, the RCMP determined that it should transfer the management of disability pensions and health care to VAC.
    • Despite being signed in September of 2002, the agreement came into effect (retroactively) on April 1, 2002.
    • The RCMP transferred to VAC its obligations in relation to the adjudication, assessment, payment, and administration of award and health care benefit entitlements to RCMP members.
    • VAC does not have the legislative authority to provide health benefits to RCMP pensioners or to provide pensions awarded to eligible civilian and regular members; the RCMP will pay VAC for these costs (by way of an Interdepartmental Settlement).
19. Neither the MOU nor its Terms of Reference address information sharing practices between VAC and the RCMP.
20. The MOU clearly indicates, however, that VAC has agreed to provide its services to RCMP members on behalf of the RCMP, which includes the adjudication, assessment, payment, and administration of awards and health care benefit entitlements. As such, it is not apparent that the RCMP required detailed financial information about the disability pension award, the percentage of disability assessment, or the medical diagnosis/pensioned condition at issue. According to the wording of the MOU, the only information required by the RCMP would be the total amount to be paid to VAC by Interdepartmental Settlement.
21. Accordingly, the comingling of medical and financial information resulted in the complainant's sensitive personal information being disclosed to the RCMP's National Compensation Policy Centre without any clear indication that it was required for the purposes of the Interdepartmental Settlement.
22. In our view, the disclosure of personal medical and financial information to the RCMP by VAC should be governed by the "need-to-know" principle and, accordingly, subject to strict confidentiality policies and controls. As such, personal medical information should not have been made accessible to employees who are not involved in the provision of health services and, conversely, personal financial information should not have been made accessible to health services personnel.
23. As will be set out in more detail below, this conclusion is reinforced by the fact that the RCMP itself proactively requested that VAC change its disclosure practices to limit the types of personal information being shared with various parts of the RCMP.

The Systemic Nature of the Complaint

24. During the course of the investigation, information came to light that the issue of the unauthorized disclosure of sensitive personal information by VAC to the RCMP was systemic in nature. The complainant was able to provide information demonstrating the continuous and routine disclosure of personal medical information to the RCMP by VAC between 2005 and 2010, despite a request by the RCMP for VAC to revise its disclosure practices.
25. The complainant in this matter also designated a representative, who provided the investigator with a copy of correspondence dated November 2010 that he received from the Deputy Coordinator ofVAC's ATIP branch, which provided the following information:

    Veterans Affairs Canada is, on request by the Royal Canadian Mounted Police (RCMP), responsible for adjudicating claims for disability pensions for serving and former members of the RCMP. The authority for members and former members of the RCMP to have eligibility for a disability pension is derived from the RCMP Superannuation Act (Part II). Responsibility for a still serving member's fitness assessment, occupational health and safety remains as the sole responsibility of the Minister for Public Safety and Emergency Preparedness.

    Until December 2002, the payment of monthly disability pensions and the costs of treatment related to the pensioned condition(s) were made directly by the RCMP. During this time, copies of pension decisions and Summary of Assessments and Veterans Review and Appeal Board favourable rulings were provided to the RCMP to support the processing of payments of the disability pensions and related treatment benefits to RCMP members.

    Information was also provided to the RCMP because rulings on individual requests for disability through VAC do not include any specific wording about restrictions or limitations for employment. Disability pensions and the associated percentages address permanent loss of physical/mental integrity, pain, as well as impact on personal life, recreational activities and work.

    In December 2002, the RCMP requested VAC to assume direct payment of monthly pension cheques for all serving, retired and certain civilian RCMP members. In addition, the RCMP requested VAC to assume the administration of health coverage for service related disability of retired RCMP pensioners. During this time (December 2002 to March 2010), complete copies of disability pension decisions continued to be provided to the RCMP for serving members for the provision of treatment benefits related to the member's pensioned condition(s).

26. The complainant's representative also provided the investigator with a copy of correspondence dated October 2005 from the Director of the Program Support Directorate in the RCMP's Occupational Health and Safety Branch to the A/Director of Disability Pension Adjudication at VAC, in which an agreement was detailed between the RCMP and VAC that the disability award letter would be modified to a one page summary for each member. This summary was to include only: 1) the member's name and regimental number; 2) the member's home province; 3) the pensioned disability; and 4) the percentage level of the disability. The correspondence also advised that the information was to be disclosed directly from VAC to the appropriate RCMP Health Services Officer (HSO) rather than to the National Compensation Policy Centre. This change was to come into effect by November 15, 2005.
27. This policy change indicates that a member's medical diagnosis should, in fact, not have been routinely disclosed to the RCMP's National Compensation Policy Centre as it was not required. Additionally, it indicates that the RCMP does not require detailed financial information about specific pension awards.
28. Despite theRCMP's request in 2005, it appears that the same information continued to be disclosed byVAC to theRCMP's National Compensation Policy Centre until 2010.VAC's November 2010 correspondence to the complainant's representative goes on to explain the following:

    In March 2010, VAC changed its practices on direction from the RCMP, to limit the information sharing to only five key pieces of information for still serving members. Specifically, member's name and regimental number; their province of residence; the description of pensioned condition(s); percentage of assessment and effective date are now provided.

    This limited information continues to be shared with the Member's Divisional Health Services Officer based on the continuing requirements relating to fitness for duty and occupational health in accordance with RCMP internal policies.

    Finally, when completing an application for a Disability Benefits through Veterans Affairs, applicants are advised that their information may be shared with their employer if they are successful (see attached PEN 923e).

29. The PEN 923e form referred to in the correspondence is a version dating back to September 2009. The Declaration section of the form indicates that the collection of information provided on the form is authorized under the Pension Act. With respect to the use and disclosure of the information, the wording is similar to that found on the 1999 version signed by the complainant:

    The information provided on this application is confidential and is for internal VAC use only. All personal information collected and used for the purpose of administering this program is protected from unauthorized disclosure by the Privacy Act. You have a right of access to your own personal information. You also have the right to review your information and ask for corrections or add notations.

    For further information on the above, you can contact the Access to Information and Privacy Coordinator's Office, Veterans Affairs Canada, PO Box 7700, Charlottetown, PE, C1A 8M9 and by quoting Personal Information Bank number VAC PPU 055 and/or VAC PPU 560.

30. It is not known why VAC continued to supply the RCMP with complete copies of disability pension decision letters between 2005 and 2010. Even when the disclosure process was finally amended in early 2010, the Declaration on VAC's Application for Disability Benefits remained inadequate in terms of the information provided to applicants about potential uses and disclosures of their personal information.
31. We note, however, that the current version ofVAC's Application for Disability Benefits (dating to July 2013) appears to provide sufficiently comprehensive information from which an applicant can give informed consent:

    The personal information provided on this form is collected under the authority of the Pension Act, the Canadian Forces Members and Veterans Re-establishment and Compensation Act, the Royal Canadian Mounted Police Superannuation Act and/or the Royal Canadian Mounted Police Pension Continuation Act for the purpose of determining disability entitlement and/or assessments. The personal information received by VAC may be shared with other VAC programs to decide if individuals may be eligible for additional benefits, case management, or for commemorative activities, where applicable. These disclosures are shown in personal information banks as consistent uses in accordance with the Privacy Act. Providing the information is voluntary, however, failure to complete any part of this form may result in delays, or an adverse decision for the Member/Veteran.

    The personal information collected on this form is protected from unauthorized disclosure by the Privacy Act. Personal information, including Service Health Records, obtained by VAC may be shared with Public Works and Government Services Canada (PWGSC) for the purpose of creating a digital image of the record for use by VAC. By Order in Council 2011-1348, Human Resources and Skills Development Canada (HRSDC) may provide services on behalf of VAC.

    The Privacy Act also gives individuals a right of access to personal information about themselves under the control of the Department, as well as a right to challenge the accuracy and completeness of their personal information and have it changed as appropriate

    …

    For further information on the above statement, contact the Access to Information and Privacy Coordinator's Office, Veterans Affairs Canada, PO Box 7700, Charlottetown, PE, C1A 8M9. Please quote Personal Information Bank VAC PPU 215 of the Government of Canada Info Source publication.

    If you are awarded a disability benefit and you are still-serving with the Canadian Forces (CF) or the Royal Canadian Mounted Police (RCMP), information will be shared with them, as required, to enable the medical authorities to fully assess and respond to your health needs … For RCMP members, the basic information that is shared in this process is typically limited to your name, regimental number, home province, medical disability description, and assessment percentage level of disability.

Findings

32. The investigation established that VAC did, in fact, disclose the complainant's medical diagnosis and personal financial information to the RCMP's National Compensation Police Centre via its pension award letter. VAC made representations that the disclosure of this information was for a purpose consistent with that for which it was collected and therefore authorized under paragraph 8(2)(a) of the Act.
33. As noted previously, the information provided to disability pension applicants in the Declaration section of VAC's PEN 923 form at the time of the complainant's application was inadequate, and the Info Source description of VAC PPU 055 referenced therein was not sufficiently detailed to establish informed consent or consistent usage of the personal information collected by VAC.
34. Furthermore, our review of the MOU between VAC and the RCMP revealed that it does not specifically address the sharing of personal medical or financial information of RCMP clients but only refers generally to the processing and adjudication of an applicant's claim.
35. Since (A) VAC has not made representations with respect to the issue of consent, and that we have found that informed consent could not have been established based on the inadequate wording found in both the Declaration section of the PEN form and the Info Source description; (B) the 2002 MOU transferred responsibility for the adjudication, assessment, payment and administration of award and health care benefit entitlements to RCMP members from the RCMP to VAC; (C) it has not been established that the RCMP's National Compensation Policy Centre had any need to know the complainant's medical and financial information at issue, and that the RCMP's health services had no need to know the complainant's personal financial information, the disclosure of this information by VAC cannot be considered to have been for a consistent use as described in paragraph 8(2)(a) of the Act and was therefore in contravention of the Act.
36. We are therefore of the view that this complaint is well-founded.
37. This type of sensitive personal financial and medical information was disclosed by VAC to the RCMP between 2002 and 2005 without a proper information management agreement in place - a deficiency that continues to date. The same information was disclosed by VAC to the RCMP's National Compensation Policy Centre for a five-year period between 2005 and 2010, despite the RCMP's request that VAC's disclosures be limited to only the member's name and regimental number, their province of residence, the description of pensioned condition(s), percentage of assessment, and the effective date, and be provided only to the member's divisional HSO. This issue affected not only the complainant in this matter, but was a systemic contravention of the Act affecting a significant number of RCMP employees during this time period.

Recommendations

38. Based on the foregoing, we strongly recommended to VAC that the MOU be updated to provide comprehensive information about the proper flow of such sensitive personal information between the two institutions. The MOU should also be reviewed periodically to ensure that it remains valid should there be any changes in program delivery.
39. Pursuant to paragraph 35(1)(b) of the Act, we asked that VAC provide us notice of any action taken or proposed to be taken to implement our recommendation with respect to the creation of a proper information management agreement or reasons why no such action has been or is proposed to be taken.
40. In correspondence from its Acting Deputy Minster, VAC held its view that this complaint should be deemed not well-founded because paragraph 8(2)(a) of the Act gives VAC the authority to exchange personal information with the RCMP based on the "consistent use" provision.
41. Nevertheless, VAC agreed with our recommendation that the MOU currently in place between VAC and the RCMP should be updated to more clearly articulate the flow of sensitive personal information between the two institutions. This update will also include a requirement for a periodic review to ensure that it remains valid in the event of changes in program delivery.
42. We will follow-up with VAC in one year in order to verify that the MOU has in fact been updated accordingly.