I blogged a little while ago about the numerous complaints received by the Saskatchewan Information and Privacy Commissioner after thousands of women were unexpectedly contacted by the provincial cancer agency about their cervixes. (See PIPEDA and Canadian Privacy Law: More than 100 women complain after cancer test info shared).

Since then, the Commissioner has released his report on the agency and its privacy practices. I haven't had a chance to wade through all of its 203 pages, so I'm relying on the info from the Medical Post (below). While it is lawful, the agency should make sure that women know all about it and it should follow an opt-out program. Who gets to tell the women and manage this opt-out? Physicians! Lucky them. I'm sure they don't have anything else to do....

MedicalPost.com: Sask. MDs: Prepare patients for Pap results:

"... Gary Dickson, provincial information and privacy commissioner, completed a two-year study on the Saskatche-wan Cancer Agency's prevention program for cervical cancer (PPCC) after receiving more than 100 complaints and 700 items of correspondence from Saskatchewan women. Many of the complaints were that personal information was sent directly to patients from the cancer agency without their knowledge or consent—and that the program is compulsory. Many family physicians were also unaware of the process which began in summer 2003, while Saskatche-wan's Health Information Protection Act was being created.

Dickson said the cancer agency had the right to collect and disseminate the information, but did not do so correctly because it did not offer an opt-out provision to patients as other provinces do. He made 23 recommendations including one that family physicians inform their female patients about the PPCC the first time a Pap specimen is taken and alert them that they will be receiving notification from the cancer agency in the future. He said health information act requires physicians to take "reasonable steps to inform the individual of the anticipated use and disclosure of the information by the trustee (the cancer agency)."

He also said "the College of Physicians and Surgeons should take appropriate steps to ensure that there is informational material available to all Saskatchewan women who attend at their physicians' office for a Pap test. This material should explain the PPCC and in particular the direct contact with women that is a feature of the PPCC."

Dr. Dennis Kendel, registrar of the college, told the Medical Post that he wasn't sure how the college will respond to the privacy commissioner's report. "It wouldn't immediately seem logical to us that we would be the agency responsible for that," he said. "We haven't yet had a chance at our council level to consider the report in detail and its implications."..."

Labels: breach notification, health information, information breaches, privacy, saskatchewan