Kandasi Levermore | Health professionals concerned about implications of the Data Protection Act
The Data Protection Bill was tabled in Parliament in October 2017. Its tabling was met with mixed reaction by stakeholders across several sectors.
To others, the bill is meant to, among other things, “protect the privacy of certain data for connected matters” and “… secure the confidentiality of personal data which may be in the possession of entities.”
Recently, Jamaica AIDS Support for Life (JASL) held a multi-stakeholder consultation with health professionals to examine the implications of the Data Protection Act on the health sector and arrive at recommendations for how the sector should operate once the bill becomes law.
The consultation, which had representation from several of the island’s major healthcare bodies, including regional health authorities and civil-society partners, revealed a number of issues that require urgent action.
Among the issues high on the list of concerns raised at the consultation is the general lack of public education on the bill among health professionals and details on how it is intended to work for the sector.
JASL, in its 2017 submission to Parliament on the bill, had, as one of its major concerns, the safekeeping and privacy of the medical records of its approximately 650 clients, plus the 3,500 other persons who use its treatment sites. Similar concerns were shared by attendees at the consultations.
With stigma and discrimination among the leading factors driving the HIV prevalence, and ironically, perpetrated by some healthcare professionals themselves, any indiscriminate access to clients’ health records under the act could create a backlash for JASL and health providers, who are sworn to protect the privacy of their clients’ information.
BROADENING OF DEFINITIONS NEEDED
The consultation also found gaps in several definitions contained in the bill, which will require the necessary amendments before they can be considered law.
Section 2 (a) in its definition of ‘health professional’ is limiting, as it fails to take into consideration persons in the performance of their duties, who access medical records and other related data. This group includes psychologists and social workers, and even community-based and civil-society organisations that serve to support the work of the Government.
Similarly, the Data Protection Bill needs to adequately state what it considers ‘accessible records’. This is especially important for entities that collect individuals’ biometric data alongside other health records. To this end, it would be useful if it were more explicitly stated in the definition.
The consultation further expressed concerns about what constitutes ‘consent’ and demanded that the act state in detail the scope of the consent being provided by the individual to data controllers, that is, oral, written, general or informed.
Consideration, it said, ought also be given to the variables likely to be confronted on the ground by the health professional, such as those encountered during in the performance of surgeries.
An expansion of the definition for ‘health records’ is necessary to take into account other health professionals who, by virtue of their involvement in certain aspects of treatment, may come into knowledge of the individual's records. Evidence of this is found in case conferencing, where a psychologist may have to access a patient’s entire file as part of a team of providers of his/her treatment regimen.
The appointment of a single commissioner responsible for “overseeing the manner in which personal data in the possession of those entities is handled” in the act is considered to have implications for transparency and accountability, as this sole person will yield too much power.
A commission, consisting of several individuals, headed by a commissioner, is strongly recommended, where there can be divergent views on matters which come before the commission.
HUGE RESPONSIBILITY FOR DATA CONTROLLERS
The bill contains eight data protection 'standards' for the processing of personal data. Compliance with these standards will mean data controllers incurring cost to put in place the necessary technical and institutional support.
This places tremendous responsibility on data controllers, however, the practicality of the data control standards are questionable, as the act does not take into consideration the nuanced capacities of data controllers, who could range from a medium-sized non-governmental organisations operating on a shoestring budget to a major healthcare provider.
A re-examination of the punitive measures and how they would apply are matters the consultation agreed should be factored into the act.
Issues such as training and advocacy are also important matters to be taken on board by organisations as part of their compliance measures. The list of items requiring expansion and/or clarifications in the act is by no means exhaustive.
PUBLIC EDUCATION, CONSULTATION REQUIRED
There is no doubt that a data protection law is needed to “protect the privacy of certain data and for connected matters”, as the bill purports, especially in an age when nearly all aspects of our lives take place in cyberspace.
However, while this piece of legislation is commendable and of vital importance, legislation cannot be drafted to protect the information of citizens and at the same time seem to put a significant percentage of the people at a disadvantage by virtue of said legislation.
We advocate for greater public education that engages all stakeholders in a manner and language that brings everyone into the discussion. A campaign that includes town halls and traditional and social media is imperative. This will allow for greater engagement with the process and better understanding of the recourse and redress mechanism available to persons under the act.
We look forward to the Ministry of Health’s legal unit leading the charge in providing the much-needed clarity that health professionals require.
Kandasi Levermore is executive director of Jamaica AIDS Support for Life (JASL), the largest NGO providing HIV prevention, treatment and care services in Jamaica. JASL heads up the multi-stakeholder consultation with health professionals on the Data Protection Bill. Email feedback to firstname.lastname@example.org and email@example.com