Annual Report on the Access to Information Act and the Privacy Act 2005-2006

2006
Cat. H1-9/3-2006
ISBN: 0-662-49228-5

(484K)

Table of Contents

Preface

About Health Canada

The Access to Information and Privacy (ATIP) Division, Corporate Services Branch

Highlights and Accomplishments for 2005-2006

Part I: Access to Information

Statistical Reports-Interpretation and Explanation

Part II: Privacy

Statistical Report - Appendix II Interpretation and Explanation

Privacy Impact Assessments

Appendix I

Appendix II

Preface

The Access to Information Act gives Canadian citizens and permanent residents a broad right of access to information contained in federal government records, subject to certain specific and limited exceptions.

The Privacy Act gives individuals the right of access to information about themselves held by the federal government with certain specific and limited exceptions. This Act also protects an individual's privacy by preventing others from accessing his or her personal information, as well as granting individuals basic rights in relation to the collection, use and disclosure of personal information.

Section 72 of the Access to Information Act and section 72 of the Privacy Act require that the head of every federal government institution submit an annual report to Parliament on the administration of the Acts during the fiscal year. This report describes how Health Canada fulfilled its access to information and privacy responsibilities during the fiscal year 2005–2006.

About Health Canada

Overview

Health Canada is the federal department responsible for helping Canadians maintain and improve their health, while respecting individual choices and circumstances. Our goal is that Canada's population be one of the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.

To achieve this goal, we:

• rely on high-quality scientific research as the basis for our work;
• conduct ongoing consultations with Canadians to determine how best to meet their long-term health care needs;
• communicate information about disease prevention to protect Canadians from avoidable risks; and
• encourage Canadians to take an active role in improving their health by, for example, increasing their physical activity and eating well.

To achieve Health Canada's vision, we play five core roles, which are:

• leader/partner through administering the Canada Health Act, which embodies the values and principles of Medicare;
• funder through policy support for the federal government's Canada Health Transfer which replaced the Canada Health and Social Transfer on April 1, 2004. Health Canada also transfers funds to First Nations and Inuit organizations and communities to deliver community health services and provides grants and contributions to various organizations that reinforce the Department's health objectives;
• guardian/regulator through a stewardship role that involves both protecting Canadians and facilitating the provision of products vital to the health and wellbeing of Canadians;
• service provider through the delivery of environmental health and protection programs and services, through monitoring and tracking diseases, through the provision of supplementary health benefits to eligible First Nations and Inuit, through the delivery of public health and health promotion services on reserve and in Inuit communities, as well as through the provision of primary health care services on reserve and in remote and isolated areas where there are no provincial services readily available; and
• information provider through performing high quality science and research, which supports policy development and the regulation of increasingly sophisticated products; and, through research and surveillance we provide information that Canadians can use to maintain and improve their health.

Health Canada is comprised of thirteen Branches, Offices and Bureaus and four agencies, and maintains presence in six regions across the country:

• British Columbia and Yukon
• Alberta and Northwest Territory
• Manitoba and Saskatchewan
• Ontario and Nunavut
• Quebec
• Atlantic

For more information about Health Canada, please visit our website at www.hc-sc.gc.ca.

The Access to Information and Privacy (ATIP) Division, Corporate Services Branch

The Access to Information and Privacy (ATIP) Division, Corporate Services Branch, receives, coordinates and processes access to information and privacy requests for the Department. Its mandate is to serve the public, promote two-way information and knowledge sharing, support work on access and privacy issues and concerns, foster greater sensitivity to openness and transparency and protect personal information within the Department. In addition, the ATIP Division collaborates with Legal Services to oversee the development of corporate-wide privacy policies and practices to guide personal information handling and sharing in Health Canada, and to increase privacy awareness and promote consistency in privacy practices.

Among the Divisions' responsibilities are:

• promoting awareness, and providing training regarding the Access to Information Act and the Privacy Act and consistency of ATIP practices across the Department;
• developing corporate-wide ATIP policies and practices to guide access to and protection of information, including personal information at Health Canada;
• liaising and coordinating efforts with Information and Privacy Commissioners, other government departments and agencies, provincial ministries of health and other key stakeholders;
• coordinating and overseeing the Privacy Impact Assessment process;
• analysing privacy practices in the health care sector; and
• defining privacy standards for information and communication technologies, e-health and e-services.

Highlights and Accomplishments for 2005-2006

The health care field is an information-intensive sector. Consequently, Health Canada is the custodian of sensitive and personal health information. Ensuring public trust regarding the collection, use and disclosure of that information is critical to successfully developing, implementing and managing programs, policies and services to best serve Canadians health needs. Such trust is built on integrity, transparency and openness.

Fiscal year 2005–2006 saw continued efforts at Health Canada to review, improve and update information management and privacy practices.

Policy Initiatives

Improved information technology provides easier access to information, yet it can increase the risk of privacy breaches. In its ongoing efforts to balance legitimate needs for comprehensive information with the right to privacy, Health Canada engaged in a number of policy initiatives in 2005–2006.

Health Canada has initiated the development of a “Privacy and Confidentiality Protection Policy for Information Sharing” in collaboration with federal institutions within the Minister of Health's portfolio. The overall goal of this policy is to ensure that employees are clear on their obligations and responsibilities when sharing information with internal and external stakeholders.

Led by the ATIP Division and in collaboration with internal stakeholders and key institutions (Statistics Canada, Canadian Health Information Institute and the Canadian Institute for Health Research), the development of a “Policy on De-identification and Re-identification of Personal information” was initiated. This policy will assist Health Canada employees in conducting de-identification activities and in assessing re-identification risks. It will establish safeguards against re-identification.

The Department has collaborated with Canada Health Infoway in developing standards for the secure and confidential electronic transmission of prescriptions from prescribers to pharmacists. This was done in consultation with provinces and territories and major stakeholders in the healthcare field. The Department is proceeding with the necessary regulatory changes including a Regulatory Impact Assessment to enable e-prescribing.

The ATIP Division, in cooperation with the University of Alberta and the Office of the Information and Privacy Commissioner of Alberta, developed a course on Health Information Access and Privacy. This course, the first of its kind in Canada, is part of the certificate program in Information Access and Privacy Protection at the University of Alberta. It will be offered in the fall of 2006 in both official languages.

Awareness Raising Initiatives

A three-hour course, “Privacy: It's all about us”, available to all Health Canada and the Public Health Agency of Canada employees, is raising awareness of the importance of privacy in the delivery of programs and services. Forty-five courses were given in all six regions across the country. Approximately 800 Health Canada employees attended. In addition, an Access to Information course is set to be launched in 2006–2007.

The ATIP Division created a series of fact sheets to help raise privacy awareness within the Department and to act as a quick reference for staff. A tip sheet was also produced, giving staff practical advice on protecting and responsibly handling personal information in their daily work.

Together with colleagues in Records Management and Security Management, the ATIP office developed and launched an Information Management Awareness Campaign. This effort delivered a 90-minute session consisting of a video and four presentations to over 800 employees at Health Canada during the last quarter of 2005–2006.

Other Initiatives

During 2005–2006, the Department undertook several internal initiatives to strengthen and secure its ability to fulfill its access to information and privacy responsibilities.

As a priority, and with the support of senior management, operational staff was increased to address the backlog of access to information requests and to ensure that the Department would have the capacity to meet legislative requirements.

An ongoing activity is the conduct of Privacy Impact Assessments to determine whether privacy risks may be present in new or existing Departmental programs or services that handle personal information. During the year, Health Canada initiated eleven Privacy Impact Assessments and two Preliminary Privacy Impact Assessment as part of its efforts to ensure that personal information entrusted to the Department is protected.

Case Load

During fiscal year 2005–2006, Health Canada received 1842 new access requests and 169 new privacy requests, with 273 access requests and 57 privacy requests carried over from the previous fiscal year. The 2341 total requests represent a significant case load, not just in numbers, but in terms of the scope, complexity and volume of documents captured. In spite of the large volume, the Department was able to complete the processing of 1709 requests (1538 access requests and 171 privacy requests), while 632 requests were carried forward to 2006–2007.

Fees

The ATIPimage software, implemented in 2004–2005, allows information formally requested under the Access to Information Act to be provided to a requester on CD-Rom, free of charge. The Access to Information Act authorizes fees for certain activities related to the processing of formal requests under the Act. The current fee structure is specified in the Access to Information Regulations. No fees are imposed for reviewing records, overhead or shipping. In accordance with section 11 of the Act, no fees are charged for the first five hours required to search for a record or prepare any part of it for disclosure.

In accordance with Treasury Board guidelines, the Department waived 125 fees of $25 or less during 2005–2006.

No fees are applicable under the Privacy Act.

Reading Rooms

Section 71 of the Access to Information Act requires government institutions to provide facilities where members of the public may obtain information. The following Health Canada locations in Ottawa have been designated as public reading rooms.

• Access to Information and Privacy Division
  Jeanne Mance Building
  Building #19
  Tunney's Pasture, Ottawa, Ontario, K1A 0K9
  
  
• Health Canada Departmental Library
  Jeanne Mance Building
  Building #19
  Tunney's Pasture, Ottawa, Ontario, K1A 0K9
  
  
• Banting Research Centre Library
  Sir Frederick G. Banting Research Centre
  Building #22
  Tunney's Pasture, Ottawa, Ontario, K1A 0K9
  
  
• Environmental Health Library
  Environmental Health Centre
  Building #8
  Tunney's Pasture, Ottawa, Ontario, K1A 0K9
  
  
• Laboratory Centre of Disease Control
  Library
  Centre for Disease Control Building
  Building #6
  Tunney's Pasture, Ottawa, Ontario, K1A 0K9
  
  
• Product Safety Library
  1800 Walkley Road, Ottawa, Ontario, K1H 8K3
  
  
• Radiation Protection Library
  775 Brookfield Road, Ottawa, Ontario, K1A 1C1

Part I: Access to Information

Statistical Report--Interpretation and Explanation

Appendix I provides a summarized statistical report on Access to Information Act applications processed by Health Canada (including the Public Health Agency of Canada) between April 1, 2005 and March 31, 2006. The following text provides explanations and interpretations for the statistical information.

I. Requests under the Access to Information Act

Overall, the number of new access to information requests has increased. In 2005–2006, the number of new access to information requests reached 1842, which represents a 35% increase over the previous year.

The 1,842 new requests Health Canada received in 2005–2006 represented 87% of the total requests handled for that year (2,115). The 273 requests carried forward from 2004–2005 represented 13% of the total requests.

Source of Requests

The largest number of new requests (1,371) came from the business sector. The percentage breakdown was as follows:

II. Disposition of Requests Completed

Of the 2,115 requests, 1538 (72.7%) requests were completed during the 2005–2006 reporting period. As of March 31, 2006, 577 (27.3%) were carried forward.

The completed requests were classified as follows:

All disclosed – Of the 1538 completed requests, in 627 (40.8%) instances the requesters were provided with total access to the relevant records.

Disclosed in part – In another 483 (31.4%) cases, the requesters were granted partial access.

Nothing disclosed (excluded) – There were 2 requests for which no information was disclosed and/or excluded under the Act.

Nothing disclosed (exempt) – In 118 (7.7%) cases, no access could be provided because all of the information was exempted under the Act.

Transferred – In accordance with the Act, 2 requests were transferred to other government institutions because the relevant records were not within the Department's purview.

Of the remaining 306 requests, the Department as unable to process 156 and dealt with 2 informally. The applicants abandoned 148 requests.

III. Exemptions Invoked

Section III of the statistical summary in Appendix I categorizes the exemptions according to the section or sections of the Act invoked. This information is provided to illustrate the types of exemptions invoked to refuse disclosure. It should be noted that these numbers do not total because a request could be denied under more than one exemption. For example, if for one request five different sections were cited, one exemption under each relevant section would be reported for a total of five. However, if the same exemption is used several times for the same request, it is reported only once.

The three most frequently cited reasons for denying access to information are that it contains third party information, contains personal information or contains information that would affect government operations. Other reasons cited would include that the disclosure could impact on federal-provincial affairs or on law enforcement/investigations, that it violates solicitor client privilege, or that it was obtained in confidence.

IV. Exclusions Cited

The Access to Information Act does not apply to published material, material available for purchase by the public or confidences of the Queen's Privy Council, pursuant to sections 68 and 69 of the Act. As explained under Exemptions Invoked, the information provided in the statistical summary is provided to illustrate the types of exclusions invoked to deny access and the same caution applies.

V. /VI. Completion Time and Extensions

The Department was able to respond within 30 days or less in 812 (52.8%) of completed cases. Response times for the remaining cases were 328 (21.3%) within 31 days to 60 days, 209 (13.6%) within 61 to 120 days, and 189 (12.3%) in 121 or more days.

Extensions were most frequently required (351 cases) to allow time for searching. In 120 cases, extensions were necessary to conduct consultation, 11 of which required more than 30 days. One hundred sixty- four (164) extensions were to allow for third party consultations.

VII. Translations

No translations were required to respond to 2005–2006 access requests.

VIII. Method of Access

Statistics compiled for this section are based solely on those requests for which information was all disclosed or disclosed in part. In only 4 instances did applicants obtain access in person, and in only 6 instances did applicants obtain access through a combination of copies and in-person examination. In 1,104 cases, applicants received copies of the material they requested.

IX. Fees

Health Canada collected $16,894.60 in fees. In addition, the Department waived $12,416.40 for 72 requests.

X. Costs

The Department spent a total of $1,284,030.78 administering the Act, of which salaries accounted for $998,617.70 and operational costs accounted for $285,413.08. Staffing for the fiscal year amounted to 18 employees.

Complaints and Appeals

During 2005–2006, 55 access to information complaints against Health Canada were filed with the Office of the Information Commissioner of Canada. Of these, 8 were abandoned by the applicant. The complaints concerned: refusals, delays, exemptions and extensions.

Formal/Informal Interface

The Access to Information Act is intended to complement, rather than replace, existing procedures for obtaining government information. In accordance with this principle, Health Canada encourages individuals and organizations to continue to address informal requests directly to the appropriate Branch or Regional Office.

Part II: Privacy

Statistical Report – Appendix II Interpretation and Explanation

Appendix II provides a summarized statistical report on Privacy Act applications processed by Health Canada (including the Public Health Agency of Canada) between April 1, 2005 and March 31, 2006. The following text provides explanations and interpretations for the statistical information.

I. Requests under the Privacy Act

The Department received 169 new requests for personal information under the Privacy Act and had 57 requests carried forward from the previous fiscal year, for a total of 226 requests.

II. Disposition of Requests Completed

Of the 226 requests, the Department processed 171 (75.7%) to completion, leaving 55 (24.3%) requests to be carried over into the next fiscal year.

The completed requests were classified as follows:

All disclosed – Of the 171 completed requests, full disclosure was provided for 97 (56.7%) requests.

Disclosed in part – In another 49 (28.7%) cases, the requesters were granted partial disclosure.

Of the remaining 25 (14.6%) requests, the Department was unable to process 12 requests for reasons such as unable to locate the applicant or the records were not under our control. Applicants abandoned 13 requests.

Permissible Disclosures without consent under section 8(2)

III. Exemptions Invoked

As noted in Appendix II, the Department invoked exemptions pursuant to sections 26 and 27 of the Privacy Act which pertain to personal information about other individuals and solicitor-client privilege.

IV. Exclusions Cited

No exclusions were invoked in 2005–2006.

V. /VI.Completion Time and Extensions

The Department was able to respond within 30 days or less in 94 (55%) of completed cases. Response times for the remaining cases were: 23 (13.5%) within 31 to 60 days, 16 (9.3%) within 61 to 120 days, and 38 (22.2%) in 121 or more days. Extensions were most frequently required because of interference with operations.

VII. Translations

One translation was required to respond to 2005–2006 privacy requests.

VIII. Method of Access

Statistics compiled for this section are based solely on those requests for which information was all disclosed or disclosed in part. In all 146 cases, copies of the records were provided and no right of examination was sought.

IX. Corrections and Notation

No corrections or notations were required.

X. Costs

The total cost associated with Privacy Act activities was $163,228.56, of which salaries accounted for $131,516.00 and operational costs accounted for $31,712.56. Staffing for the fiscal year amounted to amounted to 2 employees.

Privacy Impact Assessments

To fulfill its mandate, many of Health Canada's responsibilities require the collection, use and disclosure of personal information. As a trusted custodian of this information, the Department uses Privacy Impact Assessments (PIAs) and Preliminary Privacy Impact Assessments (PPIAs), in accordance with Treasury Board policy, as a risk management approach to determine whether privacy risks may be present in new or existing departmental programs, initiatives or projects that handle personal information. A Privacy Impact Assessment is reviewed internally before being signed off by the Associate Deputy Minister and sent to the Office of the Privacy Commissioner for review.

Preliminary Privacy Impact Assessments may be conducted if an initiative is at an early concept or design stage and detailed information is unknown, or when it is not clear whether a Privacy Impact Assessment needs to be conducted.

Privacy Impact Assessments
Preliminary Privacy Impact Assessments

Privacy Impact Assessments:

Dental Clinic in Whitehorse (First Nations and Inuit Health Branch)

In April 2005, Health Canada opened a dental clinic in Whitehorse to extend services already available to qualifying residents of the Yukon Territory. As the clinic collects personal information about patients, employees and service providers, Health Canada conducted a Privacy Impact Assessment. The scope of the Privacy Impact Assessment included all of the administrative and operational aspects of the clinic.

Health Information and Claims Processing System (First Nations and Inuit Health Branch)

Health Canada's Non-Insured Health Benefits Program provides coverage for a limited range of goods and services for qualifying individuals not insured elsewhere. The scope of the Privacy Impact Assessment covers entry of the data into the Health Information and Claims Processing System, the submission by a provider of a request for a pre-verification and/or predetermination or a prior approval of eligibility and the subsequent submission of a claim by a provider or a client.

Medical Transportation System (First Nations and Inuit Health Branch)

The Medical Transportation Benefit is a component of the Non-Insured Health Benefits Programs that assists First Nations and Inuit people to access needed medical professionals, tests, dental and other treatment not available on reserve or the community of residence. The Privacy Impact Assessment is limited to client information involved with the delivery of the benefits which is supported by the Medical Transportation System Version 4. The scope also includes Internet access by First Nations, Inuit Health Branch regional office staff, Non-Insured Health Benefit Directorate staff, First Nations and Inuit and third-party Health Authority staff.

Operation of Dialysis Unit at Norway House Hospital (Manitoba Region First Nations and Inuit Health Branch)

Norway House Hospital is an accredited facility owned and operated by Health Canada providing primary and secondary levels of service. The hospital houses a two-chair dialysis unit that is funded by Manitoba Health as part of the Provincial Dialysis Program. The Privacy Impact Assessment will be limited to the business processes and data management practices within the unit.

New Transparency Program (Pest Management Regulatory Agency)

Pursuant to section 42 of the new Pest Control Product Act, the Minister must establish and maintain a registry that contains information about pest control products, including information about applications, registrations, re-evaluations and special reviews. The scope of the Privacy Impact Assessment is on the proposed approach to the reading room and the e-registry.

Dental Database Project (First Nations and Inuit Health Branch)

The Primary Health Care Public Health Directorate, Dental and Pharmacy Programs Division provides a report on dental services to the various health regions across Canada in paper format. The updating of the dental database began in 2005 with consultation with the various regional offices. The Privacy Impact Assessment will be limited to the dental data base application and related business processes.

Drug Treatment Court Information System (Healthy Environments and Consumer Safety)

A new information system will support the Drug Treatment (Courts) Funding Program which provides federal funding to support the six courts. This is part of Canada's Drug Strategy which is managed by Justice and Health Canada. It has been recommended that a Privacy Impact Assessment be conducted prior to the implementation of the new system.

ICD-10 (International Classification of Diseases) Software System Licensing and Implementation Agreement (Manitoba Region)

The ICD-10 Software System is designed to standardize the collection of patient data from the First Nations and Inuit Health Branch's 2 hospitals and 22 nursing stations for submission to Manitoba Health, who in turn submit the aggregate provincial patient data to the Canadian Institute for Health Information (CIHI). Manitoba requires a signed MOU with all users of the ICD-10 system. It is necessary for FNIHB to conclude a Privacy Impact Assessment prior to finalizing the agreement. The scope of the Privacy Impact Assessment includes the functionality of the ICD-10 as it relates to First Nations and Inuit Health Branch services and will be limited to the business processes and data flows that may arise through the operation of the program.

National Dose Registry (Healthy Environments and Consumer Safety Branch)

The National Dose Registry is a centralized radiation dose record system operated by the Radiation Protection Bureau of Health Canada. It contains the occupational radiation dose records of all monitored radiation workers in Canada from the 1940's to the present. A Privacy Impact Assessment is being completed on the business model, collection, use, retention and disclosure practices and systems that contain this information.

Workplace Health and Human Resource Modernization Performance Discussion Process Account Phase II (Corporate Services Branch)

Health Canada's Workplace Health and Human Resource Modernization (WHARM) Initiative began in April 2002 and built on previous work in the Department. The Account Profile (AP) Phase II is the final component of the overall project. This application introduces new functionality between the Learning Management Systems and the AP II. The two applications will collect personal information from employees. The Privacy Impact Assessment examines the privacy-related impact of the Learning Management Systems component of the AP II application.

Investigation Management Systems (Health Products and Food Branch)

The program mandate is compliance monitoring, verification and investigation supported by establishment licensing of drugs and medical devices and laboratory analysis. The Privacy Impact Assessment will focus on the privacy risks of replacing a legacy system to manage investigation information and the ability to match a complaint with a regulated product, specifically drugs and natural health products.

Preliminary Privacy Impact Assessments:

Multi-Year Management Reporting Application (MYMRA) (First Nations and Inuit Health Branch)

MYRMA is a new application developed and tested by the Non-Insured Health Benefits Directorate, Program Analysis Division. The purpose of the application is to facilitate the administration of the Non-Insured Health Benefits Program by standardizing and organizing band level, aggregated data from three internal databases. The Preliminary Privacy Impact Assessment focused on the process to populate aggregated information in the new MYMRA and the actual information in the application.

Expert Advisory Database Information System (Health Products and Food Branch)

The Office of Business Transformation is developing an information system and supporting processes to enable the generation, qualification and ongoing maintenance of a pool of external scientific experts who will be called on an “as needed” basis to assist the Therapeutic Products Division (TPD) of Health Canada's Health Products and Food Branch in various activities. The Preliminary Privacy Impact Assessment will be completed on this database information system.

Privacy Impact Assessment/ Preliminary Privacy Impact Assessment Summaries

Privacy Impact Assessment/Preliminary Privacy Impact Assessment summaries are available on the Access to Information and Privacy portion of the Health Canada web site:

http://hc-sc.gc.ca/ahc-asc/activit/atip-aiprp/priv/index_e.html

Appendix I

2005–2006 Statistical Summary: Access to Information Act

Institution: Health Canada

Reporting period: 4/1/2005 to 3/31/2006

Media 116

Academia 16

Business 1,371

Organization 56

Public 283

Appendix II

2005-2006 Statistical Summary: Privacy Act

Institution: Health Canada

Reporting period: 4/1/2005 to 3/31/2006