WHITEHORSE – The Information and Privacy Commissioner (IPC) for the Yukon, Diane McLeod-McKay, has issued her comments and recommendations regarding changes to the Health Information Privacy and Management Act (HIPMA). HIPMA, which came into force in 2016, is currently under review by the Government of Yukon. The legislation requires a review to have begun by August 2020.

In her comments, McLeod-McKay highlights that:

“The social and technological context for the provision of healthcare has changed since the inception of HIPMA. The COVID-19 pandemic has given rise to or accelerated developments that impact PHI [personal health information] such as remote healthcare, digital contact tracing and exposure notification, the idea of digital vaccination passports and, coincidentally, accelerated adoption of underlying technologies such as cloud computing, the internet of things (IOT), and artificial intelligence (AI).”

“The digital transformation has had a significant impact on individuals’ privacy rights. The complex nature of data processing today, including through the use of AI, is a game changer. Today vast amounts of PHI are being processed by health care providers in an environment that is extremely complex and opaque. It is no longer reasonable in this environment to leave it up to individuals to fight for their rights in court as in doing so they would be at a significant disadvantage in trying to advance their case with limited knowledge about this complex environment.”

“The overall goal of my 18 recommendations is to protect the privacy rights of Yukoners in this environment by ensuring that HIPMA includes the proper controls to allow innovation while protecting privacy,” said McLeod-McKay.

In light of the digital environment where personal health information is being processed, the IPC made recommendations to strengthen the powers of the IPC to enforce the Act including that she be given order-making powers. She also recommended enhanced security measures to better protect personal health information in this environment from a breach.

To promote compliance, she made recommendations to expand the IPC’s authority to assist custodians in meeting their obligations under the Act, including through such activities as conducting compliance audits. To deter non-compliance, she recommended stronger offence and penalty provisions. 

She also made a number of recommendations on the need to clarify the scope and application of the Act and some of its provisions.

The IPC’s comments and recommendations are posted here. View the supporting appendix here and her letter to the Minister here.