There were at least 865 privacy breaches of medical records in the province between April 1, 2018 and March 31, according to the Nova Scotia privacy commissioner’s annual report released Wednesday.
But the Nova Scotia Health Authority is not required to report to privacy commissioner Catherine Tully exactly how many records were inappropriately accessed by those breaches or even the most serious instances. The Personal Health Information Act only requires the province to report cases where “there is no potential for harm or embarrassment and (it) has not notified the affected individual.”
“Without important modernizations to our laws, Nova Scotia is not prepared for the risks and opportunities that the digital age presents,” said Tully who’s slated to leave the position on Aug 31 and delivered her final report on Wednesday.
“With each passing day, Nova Scotia falls farther behind other provinces and other democracies. It will take courage and determination on the part of politicians and likely a push from the public to bring our access and privacy laws into the 21st century.”
Tully has served in the position for five years and warns citizens should be worried about the government’s reluctance “to be subject to oversight and to take advice found in the recommendations.”
“In Nova Scotia there are 300 public bodies, of whom about 20 are government departments and those 20 departments only fully accept recommendations 40 per cent of the time. Everyone else is closer to 60 to 62 per cent of the time that they fully accept recommendations.”
“This isn’t something I’m making up for Nova Scotia. This is a trend right across Canada. Most recently, last week, Northwest Territories changed their law to give the privacy commissioner order-making powers and to add some very important privacy protections, the very ones I’ve been recommending for Nova Scotia.”
-Catherine Tully
One of her recommendations that the province has so far ignored is for the health authority to report serious breaches of medical records to the Office of the Information and Privacy Commissioner.
“The ones that have a real risk of significant harm to the privacy of Nova Scotians, that’s a standard used in other jurisdictions in Canada,” she said.
Tully says there’s evidence to suggest that the province is lagging in its response time to access to information requests. The number of times departments didn’t respond to information requests within the 30-day period shot up 50 per cent this year compared to last.
Both opposition parties have consistently accused the government of lacking transparency and accountability and were quick to point to the privacy commissioner’s report as more proof.
“The data in Catherine Tully’s report shows that this is a hyper-secretive government that stubbornly hides information from Nova Scotians,” said Progressive Conservative leader Tim Houston. “The numbers are shocking, particularly from a premier who once promised to lead the most open and transparent government in the country.”
The province denied Houston’s access to information request seeking the amount of money the government is paying Bay Ferries to operate the Yarmouth Ferry. The province also ignored Tully’s recommendation that the financial records be released, prompting Houston to take legal action to get the information. The case is currently before the Nova Scotia Court of Appeal.
“These numbers show a complete lack of respect for Nova Scotians, the Privacy Commissioner and the Freedom of Information system,” said Houston. “When this government has a choice between being transparent and accepting the Commissioner’s recommendations, they choose secrecy 60 per cent of the time.
NDP House Leader Claudia Chender said the report shows the government’s practise “of centralizing decision making and blocking public oversight of everything from school site selection to the business case for a P3 contract for the QEII is not the right way to govern.”
She said the party supports Tully’s call for updated legislation and believes the Office of the Information and Privacy Commissioner should be an independent office of the legislature.
Tully has insisted that new legislation includes giving the privacy commissioner order- making power.
“This isn’t something I’m making up for Nova Scotia,” said Tully. "This is a trend right across Canada. Most recently, last week, Northwest Territories changed their law to give the privacy commissioner order-making powers and to add some very important privacy protections, the very ones I’ve been recommending for Nova Scotia.”
Tully’s report also states the office continues to be under-resourced while trying to keep up with “the exponential increase in new files.” The office received 562 new files last year but it’s contending with a backlog of cases dating back more than a year.
“While this is not an acceptable level of service, barring an increase in the resources to this office, it is not likely to change in the future and will only get worse if new matters continue to increase,” said Tully.
