Which Privacy Laws and Regulations Govern the Use of EMRs in Canada?

There are a number of privacy and security concerns associated with electronic medical records, particularly with respect to the storage and handling of sensitive medical information. To ensure the privacy and security of patient information, a number of regulatory and legal frameworks have been established in Canada to govern the use of electronic medical records (EMRs).

The vast amount of personal and medical data stored in EMRs make them prime targets for cyber attacks, thefts, and breaches. For example, a patient's medical records include information such as the name, address, Social Insurance number, test results, and treatment plan, prescription and diagnosis stored in the EMR.

To protect this sensitive information, several laws and regulations have been put in place in Canada. We have the Personal Information Protection and Electronic Documents Act (PIPEDA) as Canada’s biggest privacy law on a federal level. It sets the rules for how organizations must handle personal information during commercial activities. 

In the healthcare sector, the Personal Health Information Protection Act (PHIPA) applies in Ontario as a provincial law. There are specific requirements for protecting personal health information under this act. Under the Act, healthcare providers must obtain patient consent before collecting, using, or disclosing personal health information.

Here is a brief overview of both privacy acts and how they apply to the use of electronic medical records in Canada and Ontario.

PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a federal privacy law in Canada that sets rules for the collection, use, and disclosure of personal information during commercial activities. It applies to private sector organizations across Canada, including those involved in healthcare.

Under PIPEDA, personal information must be collected, used, and disclosed with the knowledge and consent of the individual, and organizations must ensure the protection of personal information through appropriate security measures. The act also gives individuals the right to access and request correction of their personal information held by organizations.

PIPEDA applies to EMRs as they often contain sensitive personal information, such as medical history, diagnosis, and treatment information, and therefore must be treated with the highest level of confidentiality and security in accordance with the provisions of PIPEDA.

PHIPA 

The Personal Health Information Protection Act (PHIPA) is an example of a  provincial law that applies in Ontario, Canada. It governs the collection, use, and disclosure of personal health information by health information custodians, such as hospitals, clinics, and long-term care facilities. PHIPA protects the privacy of an individual’s personal health information and ensures that it is collected, used, and disclosed in a manner that is consistent with the principles of privacy.

Under PHIPA, health information custodians are required to obtain consent from individuals for the collection, use, and disclosure of their personal health information, except in specific circumstances where consent is not required by law. Health information custodians must also implement appropriate security measures to protect personal health information from unauthorized access, use, or disclosure.

PHIPA also provides individuals with the right to access their personal health information and to request that any inaccuracies be corrected. Additionally, PHIPA gives the Information and Privacy Commissioner of Ontario the power to investigate complaints and enforce compliance with the Act.

Combined, the PIPEDA and PHIPA Acts promote the use of EMRs in Ontario by:

• Establishing a legal framework for collecting, using, and disclosing personal health information electronically. Through this approach, personal health information can be handled securely and in accordance with privacy regulations, thereby increasing confidence in EMRs and promoting their wider adoption.

• Promoting the use of EMRs in a secure and responsible manner. A requirement that health information custodians implement appropriate security measures to protect personal health information reduces the risk of privacy breaches and promotes the secure use of EMRs.

• Balancing privacy and access to information. Despite protecting individuals' privacy rights, these laws allow the collection, use, and disclosure of personal health information for appropriate purposes. This can help to facilitate the use of EMRs, as they can provide healthcare providers with access to more comprehensive and up-to-date information about patients.

• Enforcing accountability and transparency. In addition to giving individuals access to their personal health information and allowing them to request that any inaccuracies be corrected, these laws also give regulatory bodies the power to investigate complaints and enforce compliance. EMRs can be transparent and accountable in this way, helping to build trust in their use.

Does Tali AI Comply with PIPEDA and PHIPA?

Tali is compliant with both the Personal Information Protection Act (PIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA).

Tali AI is a Canadian company and by default is required to comply with Canadian privacy laws, including the PIPEDA and PHIPA. Also, Tali is a software tool that assists physicians and clinicians in storing and managing patient data so we make sure to do so. Our privacy policies ensure that we comply with the privacy laws, which include implementing appropriate security measures and ensuring that patient information is not saved. 

What Information does Tali Store?

At the moment, we store the medical questions that physicians ask and the transcriptions they make of the audio files. The records are not linked to any patient's personal information.  We also gather high-level analytics about your engagement with Tali (the number of times you use each feature per day, how long it takes you to transcribe a note, how many times you have to edit the note, etc.). The analytics don't include any PHI (Personal Health Information) or PII (Personal Identifiable Information) and are used only to optimize the product.

For more information, please visit Tali's Privacy Policy Page and Terms of Service.