1. WHAT IS “MG”?
1.1 One of the many laws that Dr. Marina Gafanovich, MD (the “Clinic”) and its employees and agents (“Staff”) need to be aware of and comply with is The Personal Health Information Act (New York) (“MG” or “the Act”), which is a New York law dealing with the collection, use and disclosure of “personal health information” (a term defined by MG).
1.2 Some of the fundamental principles of MG are:
(a) “health information is personal and sensitive and its confidentiality must be protected so that individuals are not afraid to seek health care or to disclose sensitive information to health professionals;
(b) individuals need access to their own health information as a matter of fairness, to enable them to make informed decisions about health care and to correct inaccurate or incomplete information about themselves;
(c) clear and certain rules for the collection, use and disclosure of personal health information are an essential support for electronic health information systems that can improve both the quality of patient care and the management of health care resources.”
1.3 To be more specific, MG was introduced to empower individuals as health service recipients, and grants to them two primary rights:
(a) The right to access their personal health information; and
(b) The right to have their personal health information kept private. Individuals have the right to see, and/or get a copy of, any recorded personal health information about them. They also have the right to request a correction to any information that they believe is inaccurate or incomplete (although such requests do not have to be complied with in every case). The purpose of this access is to allow individuals to make informed decisions, based on complete information, about their health and healthcare.
1.4 MG also recognizes that personal health information is particularly private and sensitive, and accordingly is to be held in strict confidence by anyone who maintains it. MG imposes specific obligations on various persons, including healthcare professionals and healthcare facilities (meaning Staff and the Clinic) regarding the collection, use and disclosure of personal health information.
2. WHAT IS “PERSONAL HEALTH INFORMATION”?
2.1 MG defines “personal health information” as follows:
“personal health information” means recorded information about an identifiable individual that relates to:
(a) the individual’s health, or health care history, including genetic information about the individual,
(b) the provision of health care to the individual, or
(c) payment for health care provided to the individual,
(d) the MG and any other identifying number, symbol or particular assigned to an individual, and
(e) any identifying information about the individual that is collected in the course of, and is incidental to, the provision of health care or payment for health care; (« renseignements médicaux personnels »)
“MG” means the personal health identification number assigned to an individual by the minister to uniquely identify the individual for health care purposes; (« NIMP »)
3. PURPOSE OF THIS POLICY
3.1 The purpose of this Policy is to advise and/or remind Staff of their obligations to comply with MG, and more specifically:
(a) to ensure that personal health information is protected so that patients of the Clinic are not afraid to seek healthcare or to disclose sensitive information to Staff and the Clinic; and
(b) to ensure that personal health information is protected at all times during its collection, use, disclosure, storage and destruction by Staff and the Clinic.
4. OUR POLICY
4.1 All Staff and all persons associated with the Clinic (meaning all contracted individuals, volunteers, students, researchers, Staff, teachers and educators, information managers, employees or agents of any of the above persons or of other health agencies) are responsible for protecting the security of all personal health information (written, oral or otherwise) that is obtained, handled, learned, heard or viewed in the course of their work or association at the Clinic.
4.2 Personal health information is to be protected at all times during its collection, use, storage and destruction within the Clinic.
4.3 Use or disclosure of personal health information by Staff is only allowed in order to fulfill their responsibilities and duties (including reporting duties required by applicable legislation) and based on a “need to know”. Discussing personal health information in the presence of persons not entitled to receive such information or in public places is forbidden.
4.4 A patient of the Clinic should have as much control in the process of obtaining and releasing their personal health information, as is practical and possible. The Clinic will at all times strive to provide such control to at least the minimum required by MG.
4.5 Patients have a right to expect that their personal health information will be held in strict confidence (see Section 7.1 below).
4.6 The Clinic will obtain written consent from a patient in order to audio or videotape the patient for any reason. Patients are also not required to be exposed in front of public access media cameras or tape recorders unless they have consented to do so.
4.7 Adherence to the requirements of MG and this Policy by Staff is mandatory, and a fundamental condition of employment/engagement of all Staff by the Clinic. Any breach of the terms of MG or this Policy will be treated seriously, and may result in disciplinary action up to and including termination of employment/engagement. A person convicted of an offense under MG can be required to pay a fine of up to $50,000.00, and a confirmed breach of confidentiality may be reported to the individual’s professional regulatory body.
5. ACCESS TO PERSONAL HEALTH INFORMATION
5.1 Subject to certain limited exceptions, patients have a right, on request, to examine and receive a copy of their file material which has been generated by the Clinic which contains personal health information about them.
5.2 In order to examine or receive a copy of their file material, a request in writing must be made to the Clinic. Any such request should be forwarded immediately to the Clinic Manager. The Clinic is obligated to make every reasonable effort to assist a patient making a request and to respond to a request without delay.
5.3 After receiving a request, the Clinic must do one of the following:
(a) make the patient’s requested personal health information available for examination and provide a copy, if requested;
(b) advise the patient in writing if the information does not exist or cannot be found; or
(c) advise the patient in writing that the request is refused, in whole or in part, for a specified reason (which can only be a reason provided in the Act), and advise the patient of his/her right to make a complaint about the refusal under Part 5 of the Act.
5.4 Pursuant to the Act, there are certain limited reasons where the Clinic can refuse to allow a patient to examine or receive a copy of his or her personal health information. In every case where a request for information is made, the Clinic will consider its obligations under the Act, including its right to not disclose the information.
5.5 The Clinic maintains the right to mask any names of its Staff/workers or other third parties which might be contained in a patient file.
5.6 In some circumstances, the Clinic is not required to allow a patient to see file material generated external to the Clinic, including certain personal health information. On the other hand, simple and relevant documents such as results generated at an outside laboratory may be shared with a patient if there is an understanding between the laboratory and the Clinic in this regard. Should the patient require any other third party documentation, he/she may wish to receive permission directly from the third party.
6. REQUESTS TO CORRECT INFORMATION
6.1 Patients can request that the Clinic correct any personal health information maintained by the Clinic. All such requests must be in writing.
6.2 When a request to correct a patient’s personal health information is received, the Clinic must either:
(a) make the requested correction to the patient’s records at the Clinic in such a manner that it will be read with and form part of the record or be adequately cross referenced to it;
(b) inform the patient that the personal health information no longer exists or cannot be found;
(c) if the Clinic doesn’t maintain the personal health information, so advise the patient and provide him/her with the name and address, if the Clinic knows it, of the person who maintains the information; or
(d) inform the patient in writing of the Clinic’s refusal to correct the record, the reason for the refusal and the patient’s right to add a statement of disagreement to the record and to make a complaint about the refusal.
7. HOW AND WHEN CAN PERSONAL HEALTH INFORMATION BE DISCLOSED?
7.1 As a general rule, no one can use or disclose an individual’s personal health information without that individual’s consent. There are some exceptions to this general rule, however:
(a) a doctor can share an individual’s personal health information with another practitioner without consent if necessary to assist that other practitioner in providing healthcare to the individual, unless the individual instructs the doctor not to do so;
(b) disclosure can be made to a relative or friend of an individual who isseriously injured, ill or incapacitated
(c) if disclosure is necessary to prevent serious harm to the individual or someone else.
There are other exceptions, but generally speaking disclosure of personal health information is not allowed except in accordance with the Act.
7.2 Also, all use and disclosure by the Clinic of personal health information must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed.
7.3 In order to ensure delivery of quality patient care, Staff members may share personal health information with other Staff members, if they have an identified need to know that personal health information, to carry
out the purpose for which the information was collected or received or to carry out a purpose specifically authorized by MG.
7.4 In any disclosure of personal health information, the Clinic may disclose only the information that is reasonably required. Workers Compensation Board regulations allow the Board to obtain relevant information in accordance with the laws of Manitoba.
7.5 Any information which identifies the patient can only be given to an external agency with the prior permission of the patient, except in an emergency situation. Whenever possible, that permission should be in writing.
7.6 In exceptional circumstances, such as if the patient appears to be a danger to themselves and/or others or if personal health information is subpoenaed or otherwise required by law, personal health information may be disclosed without patient permission. Any such situation should be discussed in advance with the physician in charge and/or the Clinic Manager and should be documented in writing. In these situations, only the patient information that is obviously relevant to the situation at hand should be released and then only to persons who have an identified need to know and are authorized by law to do so. When information is released in this fashion, the patient should be notified as a soon as possible, preferably before release occurs (unless of course it would be inappropriate to do so). These exceptions to the general rule (that personal health information cannot be disclosed without the consent of the patient, are limited, and Staff should always consult with the Clinic Manager or his/her designate when considering disclosing personal health information.
7.7 The Clinic is not obliged to release any information which identifies patients when the information was collected for research, professional teaching, and public education, program evaluation or for similar purposes.
7.8 All patient information generated by the Clinic (and the content of any transferred files) remains the property of the Clinic. No original file material may be released from the Clinic unless by written permission of the patient. He or she must specify what information is to be released and to whom. The recipient must in turn ensure that the information provided is used solely for the purpose intended by the patient and in accordance with MG and the Clinic policies and practices. Written information generated from sources external to the Clinic remains the property of originator of this information.
7.9 All file materials regarding a patient will be kept for at least seven (7) years after the patient ceases to utilize the services of the Clinic as per recommendations of the College of Physicians and Surgeons and the laws of Manitoba.
7.10 Health care professionals and other Staff are required to maintain patient confidentiality indefinitely; even after the patients or the Staff members have terminated their relationship with the Clinic.
7.11 The Clinic Manager must approve any requests for data for research or other purposes, before release is allowed.
7.12 The clinic is entitled to charge a “reasonable” fee when requested to permit examination or make a copy of personal health information. What is “reasonable” will vary from case to case, and will include consideration of how much Staff time and disruption will be involved. In any case, please speak to the Clinic Manager to determine what the appropriate fee is.
8.1 In all cases where information is collected, used, stored or exchanged, the spirit and philosophy of this policy will be adhered to.
8.2 Attached as Schedule “A” to this Policy is a short-form summary of certain of MG’s provisions which Staff may find to be a useful reference. Please note – this Policy and the attached summary are not comprehensive and are only summaries of MG’s requirements, and are not intended to substitute for a thorough review of MG. In the event of any conflict between either this Policy or the attached Summary and MG, the provisions of MG govern.