Information & Ethics Committee on Feb. 8th, 2007

[Robert Vincent, Bloc, Shefford, QC]

I understand your point of view and I agree with what you are asking for.

Let's take a concrete example. Someone slips in your yard and files a claim for a redemption or benefit. I know you are talking about more significant amounts than that. If one says to the doctor that this is not personal information because it is a work product, I am afraid that the insurance company could turn to the treating physician and say that it is a work product. It is decriminalizing it in a sense, and it could be used in that way.

[Dr. Léo-Paul Landry, Member, Medical Advisory Board, IMS Health Canada]

Mr. Chairman, may I answer?

Generally speaking, in a hospital environment, the situation is relatively simple. If a person suffers an injury during an accident or some kind of incident and the company asks for a medical report in order to study the situation, it is in the interest of the person who was injured, who was wounded or was in an accident to give his authorization. That is how things happen 99.9% of the time.

This poses a problem when the opposing party asks for information and the injured party refuses to disclose it. Normally, this is settled by both parties' attorneys. Generally speaking, this does not pose a problem.

[Robert Vincent, Bloc, Shefford, QC]

The insurance companies are asking us the same questions and tackling the same aspects. Should the prescriptions that are work products that we are discussing here not be the subject of excessive scrutiny or be considered as personal information? If that is the case, is it so that doctors could consult an injured person's file and see the prescriptions? If we say that this information is a work product, these documents are not confidential. I want to see my way clearly in this.

[Dr. Léo-Paul Landry]

It is difficult to respond to each of the aspects you have raised. We have not studied this issue and we have not heard the industry's comments. Personally, I cannot answer you.

[Robert Vincent, Bloc, Shefford, QC]

All right.

[Dr. Léo-Paul Landry]

All I can tell you is that we, at IMS Health Canada, do not have access to patient files and we do not want to have access to them. We cannot talk about 100% because there are always exceptions, which by the way are covered by the act, but in 99.999% of the cases, we use the information generated by what we call the work product in the doctor-patient relationship in order to improve services to the population without knowing the identity of the patient.

[Robert Vincent, Bloc, Shefford, QC]

In your case—

[The Vice-Chair, Conservative, David Tilson]

Thank you. That will have to wait until the next round, Monsieur Vincent and Dr. Landry.

Mr. Martin.

[Pat Martin, NDP, Winnipeg Centre, MB]

Thank you, Mr. Chair, and my thanks to the witnesses.

I'm going through the IMS documents. I'm sorry I wasn't here for the actual presentation, but I've scanned the presentation.

I'm interested in a couple of general things that are beyond your brief. The duty to notify, of course, keeps coming up in our work here as a committee. We're rapidly approaching the end of the study on PIPEDA and we'll be making recommendations, so I would appreciate a brief comment from both of the witnesses as to how they feel about that.

The other thing is the transborder transfer of information. There are some jurisdictions that will not allow the transfer of data to jurisdictions that don't have comparable protections. That would be of interest to me too.

Specifically on IMS, Ms. Fineberg, I notice that on page 3 of your speaking notes, you say your business is to “provide information products and services to governments, researchers, health providers, regulators and the private sector—pharmaceutical and biotech companies—to support the safe and effective use of medications”, and so on. Is there ever a case in which the pharmaceutical and biotech companies want to know from you not personal information but information regarding frequency of claims of certain types of drugs or the experience of certain types of treatments in certain jurisdictions, so that they can have an idea which products are more popular, which are being used, etc.? Is that one of the information services you might offer to the pharmaceutical and biotech industries?

[Anita Fineberg]

I'll let my colleague Gary Fabian answer that one.

[Gary Fabian]

One of the fundamentals of our database, because it's so comprehensive and spans the country, is that we're able to provide the research community, the pharmaceutical sector, and governments as well, with comparative data. Exactly the kind of analysis that you're talking about can be done fairly readily. It can be done by province or even by areas within a province, to allow for that kind of comparison in order to see if there are differences in a certain area versus another area.

[Pat Martin, NDP, Winnipeg Centre, MB]

What if the same question was asked not just for medical and scientific purposes, but for commercial interests?

[Gary Fabian]

For the pharmaceutical sector, it's also important. They want to know where their drugs are being dispensed, for what reasons if possible, and whether there are differences in different parts of the country. That's all information that's important for them as they try to evaluate the efficacy of their own performance or their own drugs.

[The Vice-Chair, Conservative, David Tilson]

Mr. Carey, I think the first couple of questions may have applied to you. Do you have any response?

[Dave Carey]

Which ones would—

[Pat Martin, NDP, Winnipeg Centre, MB]

The duty to notify and the transnational or transborder transfer of information.

[Dave Carey]

I'll let Robert take that.

[Robert Johnson, Executive Director, National Association for Information Destruction - Canada]

Thank you for the question.

First of all, on notification, from our comments, NAID Canada's position would clearly be that notification is not only important as a protection for the individual whose information may have been breached, but I think we all know that as much as teeth or enforcement can be put into this, it may be one of the most serious deterrents to casually treating the information as well. If notification is hanging out there as an obligation, I think you're going to see organizations that handle personal information be much more concerned about that real thing happening.

As far as the transborder issue is concerned, it has cropped up. It originally cropped up when the European Union adopted data protection directives and then directives about sharing that data with the U.S., which was lagging behind at that time. It has also arisen between Canada and the U.S. with regard to the Patriot Act being passed in the U.S., and various things like that.

I would just say that it is fairly common-sense. As far as NAID Canada is concerned, the common-sense approach would certainly be that personal information belonging to a jurisdiction's citizens should not be allowed to be shared or to enter into an environment where those same protections aren't allowed for in the other jurisdiction.

[Pat Martin, NDP, Winnipeg Centre, MB]

That's very useful to us, because we actually contracted out the gathering of our census information to Lockheed Martin recently, and that was the big issue. It eventually didn't happen, I believe, but our concern was the Patriot Act.

If we did put rigid cross-border or transborder limitations in effect in our recommendations now, that could effectively halt the flow of an awful lot of information to the United States, couldn't it?

[Robert Johnson]

If I may, it has generally been approached through safe harbour mechanisms that are negotiated even within...perhaps not the U.S., but within the organization. Obviously if the U.S. were to have a law that trumped that or exempted that safe harbour agreement, that would be an issue as well.

[Pat Martin, NDP, Winnipeg Centre, MB]

On safe harbour, though, if the information isn't in Canada and the information isn't in the States, but it's in some safe harbour, then where is it?

[Robert Johnson]

Let me explain what I mean by safe harbour. For instance, with the flow of information from Europe into North America, after the data protection directives passed, the Federal Trade Commission, along with the EU panel working on that, developed a process by which companies could ascribe and self-certify to meet certain standards that made them, in particular, compliant with the data protection directives.

[Pat Martin, NDP, Winnipeg Centre, MB]

They stipulate themselves to a certain set of guidelines.

[Robert Johnson]

Exactly.

[Pat Martin, NDP, Winnipeg Centre, MB]

But that would fall short of any statutory legislation and there wouldn't be any punishment for compliance. Who would enforce that then?