An investigation by the Office of the Information and Privacy Commissioner into a complaint about participating in a study is an important reminder to health care custodians and those conducting research using health information.
An individual complained that she had been approached to participate in a study and she wanted to know how the researcher had accessed her health record. The investigation revealed the physician who was conducting the study did not follow proper research procedures in the Health Information Act (HIA) before contacting the complainant.
Covenant Health was the custodian of the health information in question. Besides being a researcher, the physician also worked at a Covenant Health clinic. The physician used health information available through the physician’s work at Covenant Health to contact potential research subjects without entering into a research agreement with Covenant Health as required by the HIA. Covenant Health was unaware of this activity and had not authorized the research.
HIA Director Brian Hamilton made the following determination; “The distinction between conducting research and providing health services is clear when the researcher and the custodian are separate entities. When the researcher also has a role as an affiliate of the custodian, this distinction is blurred. This case serves as a reminder to researchers who have access to health information through their work as health services providers. When conducting research with data they routinely employ to provide health services, researchers still need to follow the HIA research process and execute a research agreement with the custodian of the health information. The HIA makes custodians responsible for considering research requests before health information may be disclosed to researchers. Custodians are the gatekeepers in this regard and have a responsibility to ensure researchers follow the rules of the HIA through a formal agreement”.