Ontario’s Information and Privacy Commissioner recently ordered Cancer Care Ontario to stop sending paper copies of screening reports containing personal health information to physicians.
However, a massive amount of personal health information is mailed or faxed every day in Ontario.
The implications of this order to information sharing and transfer across the health care system remain unclear.
Cancer Care Ontario and the Privacy Commissioner
Cancer Care Ontario operates a province-wide colon cancer screening program called Colon Cancer Check for the Ministry of Health and Long-Term Care. Colon Cancer Check invites adults who are 50 or older to be screened using a fecal occult blood test every two years. The test detects blood in the stool as an early warning sign of colorectal cancer. Patients can collect their stool at home and mail their samples to a laboratory for testing. Laboratory results are mailed to the patients’ family doctor as well as to the patient.
Cancer Care Ontario was using Canada Post’s courier service to send test results to physicians. However, in 2011, 17 packages containing the test results of 7000 patients were lost. Cancer Care Ontario informed Ann Cavoukian, the Ontario Information and Privacy Commissioner, of this in June 2011.
Last October Cavoukian ordered Cancer Care Ontario to stop sending results to physicians through the mail. Her report states that Cancer Care Ontario should not have been sending letters by courier when “other viable, more secure and privacy protective options were available.” The report noted that Cancer Care Ontario had piloted the use of a secure web-based portal (Ontario MD) and encrypted USB keys to send test results to physicians. However, the pilot projects were considered a failure because very few doctors enrolled in the pilots adapted easily to using the portal, and many expressed a preference for paper copies over the web based portal.
Brian Beamish assistant commissioner of access at the Information and Privacy Commissioner’s office says that “Cancer Care Ontario is a large, sophisticated organization …[and] they had other means that they had examined to send that information out more securely. They also had a relatively sophisticated group of recipient doctors who had other means to receive the report.”
But Lynn Wilson, Chair of the Department of Family Medicine at the University of Toronto says that having family doctors adopt another electronic method for receiving information is not a simple matter. She notes most providers receive “a high volume daily of sensitive patient information through paper, fax, mail and electronic portals.” Wilson notes that this situation “puts patients at risk for falling through the cracks” with doctors trying to remember multiple logins, and piecing together information from various sources.
Information transfer in Ontario’s health care system
The challenges of sharing health care information go far beyond Cancer Care Ontario. On the face of it this order appears to be inconsistent with the fact that every day in Ontario, laboratory results and imaging reports are faxed or mailed to thousands of physicians. Paul Gould, CEO of the Ontario Association of Medical Laboratories notes that in Ontario there are many different ways that laboratories report results to doctors. He says that “we are continually looking at ways to improve the methods of reporting results – we’ve got a paper based reporting system [and] we have an electronic transmission to physician’s right into their clinical management systems.” However, with many family physicians continuing to use paper records, Gould acknowledges that adopting more secure methods of transmitting information “will be a slow transition.”
Ontario has struggled for a long time to create an electronic repository for laboratory results. The Ontario Laboratory Information System was initially supposed to be implemented across the province in 2007. Although $200 million dollars has been spent on the system, province-wide expansion has not yet occurred due to delays and defects with the system. This is described in detail in the special 2009 Auditor General’s Report on Ontario’s eHealth Initiatives. Healthydebate.ca contacted two senior executives at eHealth Ontario to inquire about the status of the Ontario Laboratory Information System, but both refused comment.
Implications of the privacy decision for the rest of the health care system
Tom Closson, CEO of the Ontario Hospital Association recognizes the challenge of standardizing the way that health care information is stored and shared across the province. Closson notes that across Ontario’s thousands of medical practices and practice groups and 151 hospitals there are two extremes. “Some providers want to receive paper … to put in their paper file.” On the other extreme, some “highly sophisticated organizations want all patient information transmitted through their electronic medical record.” He notes that between these two extremes there is “every possibility along the continuum.” For example, some hospitals have electronic medical records but still use internal paper-based mail to send every laboratory and imaging report to the ordering doctor.
Lynn Wilson says that despite the order’s narrow focus on Colon Cancer Check, information sharing practices “cannot be looked at in isolation without seeing that Ontario does not have an organized information sharing system.” Wilson also points out that there is varied capacity within primary care practices to adopt electronic solutions noting that many primary care providers lack “even email access in their offices.”
The comments section is closed.
Local police I feel have accessed my mental health files in collingwood. I’m leaving Canada due the medical ratchet but I would appreciate compensation
Nova Scotia has had province wide eresults for a number of years. Access via Meditech and 3 EMR’s.
Ensuring privacy of patient information is clearly important, but it is not THE most important issue facing practitioners and patients. It seems to me that the Privacy Commissioner focused largely or solely on the privacy issues (this is her mandate), and not on the whole picture of what’s best for the patient. There is no question that Cancer Care Ontario (CCO) could have sent the material in a more secure way by uploading the data on a secure web server – in fact, my guess is that this would have been much easier and cheaper than sending paper by courier. However, the key issue is whether the uptake of the information would have been as great as sending the material in paper format. In looking at the Commissioner’s 39 page report on this matter, it appears that the major focus was on the sender; could the information have been sent in a more secure way? For example, the report states that “most health information custodians will not have the size and sophistication of CCO, nor have the ready access to alternative methods of transferring records of personal health information. In other words, what constitutes reasonable practices and procedures to transfer records of personal health information for an agency like CCO may vary greatly from what may be reasonably expected from a single health care practitioner.” However, uptake of information requires an appropriate receptor; as noted in the last phrase of this quote, the Commissioner expressly notes that single health care practitioners (which are the recipients of the information in this case) are not all that terribly sophisticated. This is confirmed by the comments of Dr. Lynn Wilson. So, is it better for patients if data are sent in a more secure manner, but one in which the uptake is likely to be much lower? Weighing the sensitivity of the information in this case (patient identifiers and occult blood positive/negative) vs the clinical implications of an occult blood positive result, I think the latter is much more important. There is no question that physicians in Ontario have to become more sophisticated with appropriate information technologies, which will eventually get rid of paper transfers, but they are not there yet.
As well, this example brings up the question as to whether we have gone overboard in trying to protect privacy; how obsessive do we have to be in addressing privacy issues? What actual harms have befallen individuals whose personal health data has been released in Ontario? I am sure that there are some examples of harm, and I’m not suggesting that it’s not an important issue, but we do have to look at the “costs” of maintaining privacy. The obvious costs are the budget to run the Privacy Commissioner’s office – I am sure that they are reasonable. However, the costs to health care organizations to implement the legislation and orders of the Privacy Commissioner must be quite large; one just has to think about responding to the (39 pages) report of the Privacy Commissioner re the CCO issue. I’d love to see a study addressing the costs (direct and indirect (e.g. organizational time)) and benefits that have accrued in implementing the Privacy legislation over the past few years.