Evidence of meeting #22 for Health in the 39th Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was privacy.
A recording is available from Parliament.
Auditor General of Canada, Office of the Auditor General of Canada
Well, I think that is a question for the department to answer. As I said, it would first need to determine which activities are required.
Bloc
Auditor General of Canada, Office of the Auditor General of Canada
It depends on how these objectives are defined.
Auditor General of Canada, Office of the Auditor General of Canada
No. However, we did say that this is something the department should do.
In 2004, we observed that departmental officials had analysed one part of the program. They estimated that approximately 75 people were needed to handle the prescription drug component, whereas in fact they were working with a staff of 37 people.
In short, the department did analyze human resource requirements for post-market activities.
Liberal
Conservative
Patrick Brown Conservative Barrie, ON
Thank you.
I appreciate the testimony so far.
I looked at this for a while before this committee, and I would like you to touch a bit further on the specific issues of the Privacy Act regarding the Government of Canada's use of electronic health records, and any other patient data, for post-market surveillance use. Are there any issues that you see with personal information protection of electronic documents?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Yes, with the use of personal information by the Canadian government, particularly sensitive information like health information, there are issues. I think the issue is not so much the information that Health Canada has in its databases to study this--it obviously needs extensive information, and I mentioned the number of fields of information that were in this existing database--but who else would have access to this database and what fields of information would be shared. I gave the example of the recent court case in which we were involved: what examples of this database would be shared with researchers doing work, university hospitals, the pharmaceutical company, and so on?
So as Health Canada goes forward to increase its efforts in this area of post-prescription surveillance and adverse reaction, this is something I think it will consider carefully. It will probably do what's called a privacy impact assessment and send it to our office, as required under Treasury Board guidelines. We would comment on it then.
Conservative
Patrick Brown Conservative Barrie, ON
I understand there's a lot of data mining of the administrative databases by government to look at health risks. What standards should be applied to protect privacy in utilizing our own administrative databases?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
We have been questioning government departments recently about their use of data mining. From the answers we've been getting, it's perhaps not as extensive as some urban legends would lead us to believe. Under the Privacy Act there is quite a bit of discretion for the Government of Canada to use information given in one context for another context, as long as the use can be labelled consistent.
Conservative
Patrick Brown Conservative Barrie, ON
One question I've asked a lot of the witnesses as we've studied this topic is about enhancing the use of electronics as prescriptions are made. Originally concerns were raised by the CMA that they didn't have real-time access to information. Do you have any concerns about handheld devices being used to access patients' information or to get immediate updates from Health Canada on health risks? Are there any new issues there that we should be cautious about in regard to privacy?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
That's an interesting question that goes back to the whole issue of security and confidentiality around electronic health records. While they may be more efficient, they are ironically far more vulnerable if they're not done properly. This is a huge challenge for all of us.
One of the early studies my office commissioned about four years ago went into the privacy risks of being able to capture personal information from handheld devices being used by doctors in hospitals across Canada and where the patient records were. We know about the increasingly recognized dangers of the Wi-Fi communication network--the problem of trying to constantly update your encryption levels to protect yourself against smarter and smarter hackers.
So given the sensitivity of a lot of this information, coupled with possibly specific personal information in some cases, this is a huge concern. I think organizations like Infoway are constantly struggling with that in their investment in security, which is increasingly demanding.
Liberal
The Vice-Chair Liberal Lui Temelkovski
Thank you very much.
We will move on with Madam Wasylycia-Leis.
NDP
Judy Wasylycia-Leis NDP Winnipeg North, MB
Thank you, Mr. Chair.
Madam Stoddart, on this whole question of privacy, it seems to me that this is often used as an excuse by industry for not giving open, frank, transparent information about adverse reactions, about problems with drugs, about safety issues. How do we prevent that? How do we separate out the legitimate concerns around privacy from the need for an open, transparent system?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Mr. Chair, could I ask the honourable member if she's talking about people's access to their own personal information in the hands of companies or third party access?
NDP
Judy Wasylycia-Leis NDP Winnipeg North, MB
I'm thinking about information pertaining to individuals, and reactions of drugs, and the fact that industry has a poor record for getting government and consumers the information they need to make proper choices. And they sometimes hide behind privacy. But is there any reason for that to be the case? Is there not a simple, straightforward way of providing information that doesn't link it to individuals? And isn't it just as legitimate?
Privacy Commissioner, Office of the Privacy Commissioner of Canada
Thank you for the question, Mr. Chair.
PIPEDA, the private sector law, governs many organizations in Canada. In the other provinces where it isn't extant, there is substantially similar legislation. We are very concerned about an interpretation of the law—remember, a law can be interpreted in many ways—by organizations so that individuals don't have access to their own personal information. In fact, in January we took a case to the Federal Court on this very issue of whether or not a person could have access to their personal information, held in this case not by a pharmaceutical company but by an insurance company.
Could I ask Ms. Kosseim, who actually pled that case, to tell you about it? We're very engaged in this.
NDP
Judy Wasylycia-Leis NDP Winnipeg North, MB
Sure, although my concern isn't so much with access to my own records, although that is a legitimate concern. My concern is that companies will, under the guise of needing to protect information, say that they can't be forthcoming with information on adverse reactions and problems with drugs on the market and will use that as an excuse not to actually get.... We have to find a way to account for the failure of industry to fulfill its obligations and report. It's not doing it. I want to make sure we're not putting up the privacy issue as a roadblock.
Privacy Commissioner, Office of the Privacy Commissioner of Canada
This committee is looking at legislation that would seek to address this issue. There are many ways of making scientific information available to the public and more transparent, in which personal identities can be de-identified or blurred. I just gave you the example.
In the other court case we're involved in, there's a case-by-case very sensitive analysis, but you do it in such a way that the overall results are given and personal identities are taken out of that information.
NDP
Judy Wasylycia-Leis NDP Winnipeg North, MB
Madam Fraser, you've done a lot of work and spoken and written a lot about regulatory frameworks. Going back to 2000, you mentioned the growing influence of the industry over the regulatory process, and also the international globalization and standardizing across the board. There are a lot of concerns, and they have led some people to suggest that the only way we can be sure of a fair and objective analysis of drugs on the market is to have an independent board that has no connections to industry, that is separate from the department, which doesn't seem to be trusted anymore, as the only way to keep government accountable on this front.
Do you have any thoughts on that?
Auditor General of Canada, Office of the Auditor General of Canada
Mr. Chair, I'm sure as Ms. Wasylycia-Leis can appreciate, this is really getting into policy, and we do not comment on policy.
NDP
Judy Wasylycia-Leis NDP Winnipeg North, MB
I appreciate that, and I understand.
But from an objective point of view, separate from any of the specifics of Health Canada, there is the question, in this area of drug safety, of having within the regulatory framework an independent advisory board or an independent evaluation board as part of the whole mix to ensure safety.
Auditor General of Canada, Office of the Auditor General of Canada
All I can say, as I mentioned earlier, is that in 2004 when we looked at medical devices, we did look at the activities for licensing, and we found that the department was carrying out all of the procedures in accordance with their own policies. Now, should they decide to have an independent committee, that would certainly supplement, perhaps, the rigour with which this is done. But we did not see any indication of difficulties in their following through on their own process. The concern at the time seemed to be more the time that it took something to get to market actually, and the delays in that process.
