HIPA legislates privacy protection and obligations of trustees in the health system.
The privacy and protection of your personal health information has always been a priority in Saskatchewan. When you receive health services in the province, you rightfully expect that government institutions, health providers, and administrators provide the highest level of protection regarding the use, disclosure and safekeeping of your personal health information.
Legislation called The Health Information Protection Act (HIPA) was developed and came into force on September 1, 2003 to protect the privacy of your personal health information. At the same time, the Act ensures that information is available when needed to provide you with services and to monitor, evaluate and improve the health system in Saskatchewan.
The Health Information Protection Act identifies specific rights that individuals have with respect to their personal health information. These rights are important because they ensure that you will be involved in decisions about your personal health information.
HIPA also places duties or responsibilities on organizations and individuals in the health system to protect the privacy of any personal health information they have about you. In doing so, they must also make sure that your rights are respected.
HIPA applies to individuals and organizations who are part of Saskatchewan’s health system and who have custody or control of personal health information. The Act calls them trustees to reflect the fact that they hold your personal health information “in trust” and must manage it with your best interests in mind.
Examples of a trustee include:
- Government institutions in Saskatchewan;
- Health professionals (e.g. physicians, dentists, nurses, pharmacists);
- Ambulance operators.
The Act also applies to personal health information in the custody or control of a trustee. Personal health information is information about your physical or mental health as well as information gathered in the course of providing you with a health service. It also includes information collected to register you for a service (name, address, gender, date of birth). Your health services number on your health card is also considered to be personal health information under HIPA. Personal health information can be in any form, including traditional paper records, electronic records on computers, microfilm, x-ray film to name a few.
Examples of personal health information include:
- The medical record held by a physician;
- A patient record held by a hospital;
- Registration information held by Saskatchewan Health to register individuals for insured services;
- Records of prescriptions filled by a pharmacist.
Rights of individuals
The Health Information Protection Act describes a number of rights that you have with respect to your personal health information. These rights include:
- The right to consent to use and disclosure. It should be noted that there are circumstances identified in HIPA where consent of the individual is not required for use or disclosure of an individual’s personal health information.
- The right to revoke consent to the use or disclosure.
- The right to prevent access to a comprehensive health record.
- The right to be informed by trustees about anticipated uses and disclosures.
- The right to be informed about disclosures without consent.
- The right to refuse to provide the Health Services Number as identification for a non-health service.
- The right to access personal health information about oneself.
- The right to request amendments to records of personal health information about oneself.
- The right to request a review by the Information and Privacy Commissioner about a decision by a trustee.
- The right to appeal to a court the decisions of a trustee.
- The right to designate another person to make decisions about one’s personal health information.