Over-collection of Personal Information of First Nations and Inuit people for the Administration of Non-Insured Health Benefits

Complaint under the Privacy Act (the Act)

Summary

1. We received a complaint concerning the privacy practices of Health Canada.
2. The complainant alleged that Health Canada required First Nations and Inuit people to provide more personal information than necessary for the adjudication of claims for medical services under its Non-Insured Health Benefits (NIHB) Program. According to the complainant, Health Canada’s collection of personal information was beyond that required for the purposes of administering the NIHB Program, and that that information was being used by Health Canada as a condition for the approval of medical transportation and medication.
3. The complaint was filed on behalf of more than twenty physicians. Their concerns centered around two specific practices:
   1. An alleged requirement for physicians to provide diagnostic information about patients seeking medical transportation and specialist services; and
   2. An alleged requirement for physicians to provide detailed patient information for the approval of prescription medication.
4. This Report of Findings concerns the first practice. The allegation concerning the requirement for physicians to provide detailed patient information for the approval of prescription medication will be addressed in a separate report.
5. Concerning the issue of the collection of diagnostic information about patients seeking medical transportation and specialist services, Health Canada acknowledged that the form used to request medical transportation and specialists services often led to the unintentional collection of diagnostic information. In response to the complaint, Health Canada changed the form to clarify that diagnostic information is not required.
6. After reviewing submissions from both parties as well as consulting with practicing physicians, we determined that the complaint is well-founded. The reasons for our finding are outlined below.

Scope and Methodology

7. The complainant also raised concerns about the adequacy of the Act to protect the personal health information of First Nations and Inuit people, as compared to provincial health privacy legislation. Those concerns were considered outside the scope of our investigation.
8. In conducting our investigation, we reviewed:
   • the mandate of Health Canada and the NIHB Program;
   • the personal information elements Health Canada collects in the administration of the NIHB Program;
   • a sample of claims - all void of personal information - that had been recently denied by NIHB officials on the basis that the claimants had failed to provide sufficient supporting information.
9. In the course of our investigation, we consulted with the practicing physicians. Although formal representations in support of the complaint were provided by the complainant’s Office, we also considered physician concerns over patient privacy, and the privacy impacts of those concerns on First Nations and Inuit communities.

Relevant Facts and Issues

10. Health Canada’s NIHB Program is a national program that provides registered First Nations and recognized Inuit residents in Canada with coverage for medically necessary health services not otherwise available through private plans or provincial/territorial health and social programs. NIHB benefits include limited prescription drugs and over-the-counter medications, dental and vision care, medical supplies and equipment, mental health counselling, and transportation to health services not available on reserve or in an individual’s community of residence.
11. In order to support the adjudication of claims under the NIHB Program to coordinate the processing of those claims with provincial, territorial and private health programs, Health Canada collects personal information about individuals applying for NIHB benefits.
12. Personal information collected by Health Canada under the NIHB Program is collected primarily from health service providers on behalf of individual patients. Health service providers include physicians, nurses, pharmacists, optometrists, dentists, psychologists, social workers, and medical transporters.
13. According to Health Canada, personal information about patients is limited to that which is required for the review and processing of a service provider’s claim. The collection of personal information is intended to be largely transaction-based; only the minimum amount of information required to assess a need for a benefit is expected to be collected.
14. In the case of exceptional benefits, additional patient information may be collected and shared between the health service provider and NIHB’s own health care professionals. The NIHB Program employs and contracts health care professionals to facilitate the review and approval of exceptions, and to validate the applicant’s need for services. According to Health Canada, supplementary information is sometimes needed to support a specific request or need, and to ensure that that request is assessed according to evidence-based standards of care.
15. In most instances, personal information used to process a benefit claims is collected through prescribed forms, as developed by Health Canada. These forms are intended to ensure that information provided in support of a claim is accurate and complete, and that only information needed for the processing of a claim is collected. In some cases, claims are received in the form of an open letter from the attending health service provider. Although the receipt of an open letter may, in some cases, be acceptable, in most cases, Health Canada discourages such submissions, as they may result in the provision of more information than is necessary for adjudication.
16. The issue considered in this Report centers around the inclusion of a field titled ‘Reason for Appointment’ in Health Canada’s NIHB Medical Transportation and Specialist Referral Form. According to the complainant, that field suggests the need for health service providers to disclose an individual’s medical diagnosis, thereby revealing intimate details about their patients, and challenging their ability to ensure patient-client confidentiality.
17. As argued by the complainant, Health Canada does not have a legitimate need to collect diagnostic information for the provision of NIHB benefits, nor should the supply of that information by health service providers be used as a condition for the pre-approval of access to care. As stated by one physician for remote First Nations communities, a determination of the medical necessity for travel or a health specialist should rest with the health service provider, not with Health Canada; his or her opinion on the need for treatment should suffice as evidence of the requirement for both patient travel and the need for an escort.
18. In response to the allegation, Health Canada conceded that its long-used NIHB Medical Transportation and Specialist Referral Form did, in some cases, result in the collection of diagnostic information, and that such information was not needed for the adjudication of NIHB claims. According to Health Canada however, the ‘Reason for Appointment’ field was not intended to collect diagnostic information, but rather to establish or confirm core policy requirements for travel approval.
19. Under the NIHB Program, travel is only covered where the medical service in question is not available locally. According to NIHB policies, the service provider to whom the patient is referred to must also be the nearest provider available. According to Health Canada, its inclusion of the field ‘Reason for Appointment’ had been to solicit information confirming that these two policy requirements had been met. In so much as nursing stations and medical clinics are available locally, some explanation was needed to justify travel beyond existing service zones. According to Health Canada, the issue of unwarranted travel was raised in a 2015 audit of the NIHB Program by the Auditor General of Canada.

Applicable Sections of the Act

20. In making our determination, we considered sections 3 and 4 of the Act. We also considered relevant policies, directives and guidelines issued by the Government of Canada in relation to the handling of personal information. This included the Treasury Board of Canada Secretariat’s (TBS) Directive on Privacy Practices. Although the Directive is not legally binding, as a mandatory policy instrument, it can be helpful in identifying and assessing federal obligations with respect to the handling of personal information.
21. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form. Drawing from jurisprudence, this definition of personal information must be given a broad and expansive interpretation. Information is ‘about’ someone, when it relates to or concerns that person. It is about an ‘identifiable individual’ when there is a serious possibility that a person could be identified through the use of that information (alone or in combination with other data).
22. Section 4 of the Act provides that personal information collected by a government institution must relate directly to an operating program or activity of the institution. As a matter of policy, not only must the collection of personal information be directly related to an operating program of the institution, the collection of that information should be demonstrably necessary to achieve a specific and legitimate purpose (as stated in subsection 6.2.8 of the TBS Directive on Privacy Practices).

Analysis and Findings

Did Health Canada contravene the collection provisions of the Act by collecting diagnostic information about patients seeking medical transportation and specialist services?

23. Notwithstanding the policy requirements above, Health Canada acknowledged in the course of our investigation that the inclusion of a ‘Reason for Appointment’ field had led to the incidental collection of diagnostic information. It also conceded that in certain cases, such information was not necessary for the adjudication of claims.
24. Our review of a sample of travel and referral request forms confirmed the same - that Health Canada was in fact collecting diagnostic information from health service providers even though such information was not needed for the adjudication of medical claims. Based on our review, we are satisfied that the diagnostic information often collected by Health Canada qualifies as ‘personal information’, being information about identifiable individuals.

Finding

25. Whereas diagnostic information about individual patients constitutes personal information, and where the collection of that information was above and beyond that needed by Health Canada for the adjudication of travel and referral claims, we find the allegation that Health Canada was collecting more information than necessary to be well-founded.
26. In response to physician concerns surrounding the over-collection of personal information through the ‘Reason for Appointment’ field, that field has been removed from Health Canada’s NIHB Medical Transportation and Specialist Referral Form. According to Health Canada, although the new form was officially introduced in October 2016, NIHB Program clerks have been directed not to request medical diagnostic information since June 2016.

Other

27. In light of our finding, we ask that Health Canada develop a plan outlining how the over-collected information is to be retained or securely destroyed.
28. We also encourage Health Canada to continue consultations with First Nations and Inuit Communities, and with affected health service providers, so as to better understand and minimize privacy impacts on First Nations and Inuit communities as a whole.
29. Finally, to preclude any further over-collection of personal information, we encourage that, in conjunction with the roll-out of new NIHB forms, Health Canada develop guidelines or instructions for health service providers which clearly set out what information is needed in each field of forms used for the collection of personal information.
30. We ask that Health Canada report back to our Office within 6 months regarding its progress.