Bill no19: A Small Revolution in Medical Data
Bill no19: A Small Revolution in Medical Data
Jean-François Normand
ROBIC LLP
Lawyers, patent and trademark agents
On December 3rd, the Minister of Health and Social Services, Mr. Christian Dubé, introduced Bill 19 – An Act respecting health and social services information and amending various legislative provisions – (“Bill 19“)[1] which significantly modernizes privacy within the health and social services system.
The purpose of Bill 19 is to establish a legal framework specific to health and social services information (“HSSI“) inorder to (i) protect individuals’ data and (ii) determine who may use HSSI and under what conditions. The latter is particularly important, as Bill 19 provides that, under certain conditions, HSSI may be used without the consent of the individual, even for purposes other than those for which it was initially collected (e.g., for research purposes).
This is certainly an imposing reform: Bill 19 provides for the creation of a national system for the deposit of HSSI, as well as various pan-Quebec registries, in order to facilitate access to and the keeping of records on users of the health and social services system. The aim is to push the Dossier Santé Québec project – whose constitutive law is repealed by Bill 19 [2]– further, in order to alleviate the problem of information that contributed to the crisis in long term care centers (CHSLD) and the difficult management of the Covid-19 pandemic.[3]
The Definition of Health and Social Services Information
The first contribution of Bill 19 is to define what is HSSI[4], since such definition is absent in both Dossier Québec’s constitutive law[5] and the Act Respecting Health Services and Social Services[6]:
[…] health or social services information is any information held by a health and social services body that concerns a person, whether or not it allows the person to be identified, and that has one of the following characteristics:
(1) it concerns the person’s state of physical or mental health and his or her health determinants, including his or her medical or family history;
(2) it concerns any material, including biological material, collected in the context of an assessment or treatment, and any implants, ortheses, prostheses or other aids that compensate for the person’s disability;
(3) it concerns the health services or social services provided to the person, including the nature of those services, their results, the location where they were provided and the identity of the persons or bodies that provided them;
(4) it was obtained in the exercise of a function under the Public Health Act (chapter S-2.2); or
(5) any other characteristic determined by government regulation.
Despite the first paragraph, information concerning a personnel member of the body or a professional practising his or her profession within the body, […], is not HSSI when it is collected by that body for human resources management purposes.
In addition, information allowing a person to be identified, such as the person’s name, date of birth, contact information, health insurance number or any other information of the same nature, is HSSI when it is next to information referred to in the first paragraph or when it is collected for registration, enrolment or admission of the person concerned to or at a health and social services institution or for the taking in charge of the person concerned by another health services or social services body.
[Emphasis added]
It should be noted that, contrary to the “traditional” definition of personal information within the meaning of privacy legislation[7], HSSI is any information referred to in any of subsection 1 to 5, whether or not it identifies an individual. This is a particularly important distinction, since it is now possible with artificial intelligence algorithms to re-identify an individual from certain allegedly anonymous medical data.
To Whom Does Bill 19 Apply to?
The application of Bill 19 is broad. Indeed, any health and social services bodies (an “HSS Body“) is subject to the law, which includes[8]:
- The Department of Health and Social Services;
- A person operating in the health and social services sector referred to in Schedule I or Schedule II (e.g., private health facility, specialized medical center, assisted procreation center, private senior’s residence, palliative care hospice, etc.);
- A health and social services institution established under the Act Respecting Health Services and Social Services[9];
- A person who enters into an agreement with a body referred to in subsections 2 and 3 to provide certain health or social services on behalf of that body, but only in respect of the person’s activities related to that provision of services; and
- Any other person determined by regulation.
In summary, most individuals and organizations involved in health and social services will be subject to Bill 19 (except for private pharmacies and alternative care clinics). This also means that providers of digital platforms ancillary to the provision of health and social services (e.g., online patient record platforms) will also be subject to Bill 19.
It is also important to mention that Bill 19 removes HSSI from the application of the Act respecting the protection of personal information in the private sector and the Act respecting access to documents held by public bodies and the protection of personal information[10][11], in order to create a distinct legal regime.
Protection of HSSI
Bill 19 makes each HSS Body responsible for the protection of the HSSI it collects[12], which is no small task. The HSS Body is therefore subject to data protection rules that are similar to those found in privacy legislation (including the requirement to appoint a privacy officer[13]), for which HSS Bodies are not necessarily well equipped to this day.
The best way to protect information is not to collect it in the first place. In this regard, the Government is pursuing the same data minimization philosophy than Bill 64[14] and is providing that any HSS Body may only collect the HSSI necessary to carry out its mission[15].
Before an HSS Body collects HSSI from an individual, it must inform the latter[16]:
- the name of the body collecting the information or on whose behalf it is collected;
- the purposes for which the information is collected;
- the means by which the information is collected;
- the right to access or rectify the information; and
- the period of time the information will be kept.
These elements will generally be reflected in the privacy policy and/or the HSSI governance policy that each HSS Body is required to have[17]. We draw your attention to paragraph 2, as HSSI may only be used for the purpose for which it was collected[18]. Certain exceptions apply to that restriction, notably if the use is for compatible purposes (i.e., there is a relevant and direct link with the purposes for which the HSSI was collected), if its use is clearly for the benefit of the person concerned, or when the use is necessary for the application of a Quebec law or for the sound management of a health and social service institution listed in Schedule I (e.g., Régie de l’assurance maladie, Institut national de santé publique du Québec). It will therefore be very important, when drafting the privacy policy and the governance policy, to identify all the uses that will be made of the collected HSSI and then inform the individuals.
New Tool for Research
The new provisions allowing the use of HSSI without the consent of the individual[19] for research purposes is an aspect of Bill19 that is expected to generate a lot of discussion. Although the process for requesting access to HSSI for research purposes is regulated[20], the fact remains that researchers from both the public and private sectors will be able to access this voluminous database. Although several restrictions are imposed on private researchers – all managed by the new research access center [21]– the fact remains that this is a brand-new tool that should greatly promote research in the health sector in the province.
Conclusion
In conclusion, it remains to be seen how Bill 19 will be implemented from an operational standpoint, particularly with regard to the fluidity of the exchange of HSSI. Indeed, the patient file management systems do not currently allow for all HSSI held by an HSS Body to be easily accessible to other bodies. That said, this is a long-awaited reform (especially for MedTech researchers) and well received.
If you have any questions about Bill 19, please feel free to contact our Data Protection, Privacy and Cybersecurity team.