Can health care professionals use surveillance cameras to record the provision of health services to their patients for any reason or purpose? This question recently came before the Office of the Information and Privacy Commission of Ontario (IPC). The IPC had been alerted by a media outlet that surveillance cameras were being used by a private health care professional to record the exam rooms, operating room and recovery rooms in the physician’s clinic. The issue was whether such a practice contravened Ontario’s Personal Health Information Protection Act (PHIPA).
PHIPA & Patient Privacy
PHIPA seeks to protect the confidentiality of a patient’s personal health information during and after the provision of health care. The definition of personal health information, as set out in the legislation, is very broad and all-encompassing:
“personal health information”, subject to subsections (3) and (4), means identifying information about an individual in oral or recorded form, if the information,
(a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family,
(b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual,
(c) is a plan of service within the meaning of the Home Care and Community Services Act, 1994 for the individual,
(d) relates to payments or eligibility for health care, or eligibility for coverage for health care, in respect of the individual,
(e) relates to the donation by the individual of any body part or bodily substance of the individual or is derived from the testing or examination of any such body part or bodily substance,
(f) is the individual’s health number, or
(g) identifies an individual’s substitute decision-maker.
Any information which fits into the above definition may only be collected with the patient’s express consent. Further, section 30(2) restricts the information that may be collected to that which is reasonably necessary to meet the purposes of the collection.
Surveillance Cameras & Lack of Informed Consent
Patients of this clinic were not told about the cameras, although they were visible if noticed and there were two signs advising of their presence. No consent was asked for or given by any of the patients. The clinic’s social media consent form stated that videotaping of surgical procedures would be allowed for educational or other purposes but only with consent. It became apparent, however, that the footage was also used in promotional and marketing materials for the clinic. The lack of fully informed consent at the clinic undermined the relationship between physician and patient as one based on trust, as well as the patients’ perception of anonymity and confidentiality.
Clinic Claimed Cameras Were For Security Purposes
The clinic claimed that the purpose of the cameras was for security, given the clinic’s location, multiple points of access, expensive equipment and several past incidents of theft. The clinician had become focused on security and claimed to have completely forgotten the tenants of PHIPA with respect to the collection of data, and the associated consent requirements. On being alerted to the IPC’s concerns, the clinic ceased or modified the operation of the cameras. The clinic began to limit the use of cameras to after-hours only and removed the cameras completely from the pre-operative, operating and examination rooms.
The findings of the investigation showed a clear breach of the principles and rules within PHIPA. The matter did not proceed to a full review given the clinics response. The IPC was satisfied that the issues had been addressed in the following ways:
- The clinic would only record video after hours,
- Limiting its video surveillance cameras to the entrance and reception desk,
- Not recording personal health information,
- The clinic agreed to oversee and confirm the destruction of all footage recorded prior to January 2019 when they stop recording while treating patients;
- Improving notices and committing to amending the clinic’s privacy policies and consent forms.
As a result, the matter came to an end at the end of the investigation without the need for a full review. The clinic had done all it could and was no longer illegally collecting personal health information.
Takeaways for Health Professionals
All health professionals should take note that the use of video surveillance in any situation where a patient is being treated or providing personal health data should be avoided. When surveillance is present at a facility, it should be limited as much as possible in order to protect patient privacy, and patients should be fully aware of any existing surveillance. In addition, patients need to be informed of what data is collected, how that data is used, and they must expressly consent to those terms.
According to the IPC’s decision, videotaping patients is a form of collecting personal health information. Furthermore, the general expectation for all patients should be that they would not consent to have their treatment recorded other than through the physician’s notes.
Health providers should be aware of their obligations to patients with respect to the collection of personal data in any way, shape or form. At Wise Health Law, we regularly assist healthcare professionals with emerging regulatory issues and provide them with exceptional and skilled support. Our team of health lawyers are well-known in the legal, regulatory, and health-care communities for our exceptional legal guidance. Contact us online, or at 416-915-4234 for a consultation.