N.S. must identify, mitigate risks of digital health records, warns commissioner

The Nova Scotia government is pushing ahead with plans to create a "one person, one record" system for every Nova Scotian who seeks medical help,but it has not sought the expertise of theinformation and privacy commissioner to helpdesign the digital record-keeping system.

The commissioner, Catherine Tully,was asked about the systemduring anappearance Wednesday before the legislature's public accounts committee.

"We're aware of it, we've asked questions about it, but we haven't been consulted on it,no," said Tully in response to a question from NDPMLA Susan Leblanc.

Tully was testifying before the all-party committeeabout the province's largest privacy breachlast spring when a 19-year-old man was able to download more than 7,000 pages of material from the government's online access to information portal.

She released a report last month that was highly critical of how the governmenthandled thedesign and launch of theportal, saying there was a"serious failure of due diligence" that led to multiple breaches.

The commissioner also implored the committee to advocate on her behalf tomodernize the province's Freedom of Informationand Protection of Privacy Act, which she called outdated and not up to the task of protecting Nova Scotians.

'We have concerns'

Leblancsaid during the committee meeting that the public has a "healthy amount of concern" about a digital health-recordsystem "especially given that we're going down the road to that very private information being online."

Speaking later to reporters, Tullysaid her office met Tuesday with officials involved in the project to try to get a better understanding of it.

"We have asked questions about it and we will be following up," she said. "We have concerns about how this system is designed and we want to make sure that the proper steps are taken."

Tullysaid she would like to see the provincial government conduct a privacy impact assessment and reassess every step of the way to completion of the project.

"They need to identify risks. They need to mitigate those risks. They need to circle back and make sure that privacy is protected."

Health Department responds

The government is under no obligation to consult with Tully'soffice about the system something she would like to see changed.

"For serioussystems that involve sensitive personal information particularly large systems or systems that are connecting databases togetherthose are the kinds of things that I would expect to be consulted about," she said.

A spokesperson for the Health Department said in an email the department takes the "protection of information seriously," adding that "experts in privacy, access and security have been involved" behind the scenes.

"The department has met twice with the Office of the Information and Privacy Commissioner," Tracy Barron wrote. "We have started monthly meetings with them to share information and be a forum for common interest items like digital health systems."

A director with the commissioner's office confirmed the meetings, but said the information provided was "very high level" and it has not yet been given any details about a privacy analysis.