Provincial EMR use was non compliant with privacy laws

Rachel Collier, The Eastern Graphic, Local Journalism Initiative

PEI’s $7.8 million electronic medical record was operational for 10 months before the Department of Health and Wellness moved to ensure patient information shared over the system complied with provincial privacy legislation, records show.

Despite this, government contends patient confidentiality was never jeopardized.

“It’s my understanding that (the ways practitioners were sharing information over the EMR) has been covered (by legislation) the entire way,” said Laurae Kloschinsky, Executive Director of the Department of Health and Wellness.

However, in March 2022, legislative adjudicator Maria MacDonald wrote a dissenting opinion on behalf of the Office of the Privacy and Information Commissioner (OPIC).

“I do not believe that this project complies with the Health Information Act,” she wrote. The letter was released through a freedom of information and protection of privacy request which was partially tabled in the legislature May 19 this year.

Her opinion was based on a review of the provincial EMR project’s Privacy Impact Assessment as well as at least three video conference meetings with project leads to clarify how information was being handled through the system.

She advised the Department of Health and Wellness to notify health care practitioners that, at the time, they were “not authorized to disclose personal health information through PEI’s EMR.”

Ms MacDonald suggested one way to resolve multiple issues flagged was by categorizing the EMR as a part of the province-wide Electronic Health Record (EHR), creating regulations that prescribe what personal health information could be shared and who could be an authorized custodian of these details.

If the department was not ready to activate regulations, she recommended removing the ability to share information across clinics.

Despite multiple requests from the Graphic over the course of three weeks, the department hasn’t reported moving on any of this advice except for when, five months following Ms MacDonald’s letter, it activated the recommended regulations, August 13, 2022.

This was a significant delay, considering health providers started using the system 10 months prior, and the EMR’s pilot program launched 14 months earlier, in July of 2021.

PEI is the first province in Canada to implement an EMR that can share and access diagnostic test and lab results as well as a swath of other patient health information across community based clinics province-wide.

“This is the future of Canadian healthcare,” said Health PEI CEO Dr Michael Gardam, who has since tendered his resignation effective March 2024.

Leading the country in this way could be an invaluable physician recruitment tool, he added.

The EMR could empower both practitioners and health system planners to provide better coordinated, more efficient and higher quality care.

Both Health PEI and the Department of Health were heavily encouraging community practitioners to start using the system through the initial implementation phase which began October 2021.

Despite multiple requests, the department did not disclose whether it sent any notifications to providers using the EMR about the legal opinion that practitioners were not authorized to disclose patient information over the lauded system.

The Graphic was in contact with two healthcare providers who use the EMR and neither recalled receiving any notifications.

The province paused onboarding new clinics and providers onto the EMR from June through September 2022, but Kim Knox, EMR Project Manager, asserted this was unrelated to concerns raised by the privacy commissioner, over legislation issues or questions about compliance with the Health Information Act.

At least 15 sites were using the system by October 28, 2021 and 126 providers were added by July 2022 according to steering committee meeting minutes obtained by the Graphic through a freedom of information request.

The department did not offer the Graphic the total number of providers or clinics using the EMR when regulations finally came into effect or details about who was sharing what information with who.

In a written statement officials explained twice that it has been custodians’ (such as doctors, nurses, social workers and clinic administration staff) obligation to safeguard personal health information in compliance with the Health Information Act, no matter how it is recorded.

The statement went on to admit there was “a misunderstanding by the department” about when they needed to classify the EMR as a part of the EHR and activate regulations to clarify what information could be shared with who.

“Once the misunderstanding was clarified, the department proceeded to prepare a regulatory amendment to support the EHR.”

A team of provincial EMR project leads explained at a mid-July press conference that health care providers can only access information about individuals who they have established a professional relationship with for the provision of care. Depending on their role, some health care providers can’t access the entirety of their patients’ health information stored on the system.

The team is considering adding more layers of protection like this particularly as they contemplate the best way to add mental health and addictions clinics and providers to the system.

Patients can also request providers do not share information with others in the system. However, it is up to patients and their provider to discuss this option.

Ernie Hudson, Minister of Health at the time, did not respond to requests for an interview.

The Local Journalism Initiative (LJI) is a federally funded program to add coverage in under-covered areas or on under-covered issues. This content is created and submitted by participating publishers and is not edited. Access can also be gained by registering and logging in at: https://lji-ijl.ca

Learn more about our News Monitoring here.