An insurance company (Re), 2017 CanLII 70023
The Office of the Information and Privacy Commissioner of Ontario ("IPC") recently considered whether and under what circumstances insurers could collect health card numbers from their insureds. They found that health card numbers could not be collected as part of insurance applications, however could be collected where it was necessary for the insurer to secure the insured a bed at an Ontario hospital prior to repatriation.
The issue arose when the Ministry of Health and Long-term Care informed the IPC that individuals' health card numbers were compromised by criminal activity and were being used to file fraudulent claims for insurance products by the insurance company in question. When the IPC contacted the insurer, the insurer confirmed that it was collecting its insureds' health card numbers as part of its applications for health insurance.
|
Section 34 of the Personal Health Information Protection Act (the "Act") regulates the collection use and disclosure of health card information, specifically it permits collection and use of health numbers by a person who is not a health information custodian only for purposes related to the provision of provincially funded health resources and limits disclosure to only where required by law. The insurer argued that it was using the information for the provision of provincially funded health resources. It said that it used the numbers to coordinate with the province where it was required to pay additional amounts not covered by the province. It also argued that it used the information to ensure that their insureds had provincial coverage which their insurance would supplement, and for emergency medical travel claims where it needed to repatriate the insured to an Ontario hospital.
The IPC considered the interpretation of s. 34 and found that, although it could be read to permit the collection of health card numbers by insurers, to do so would not be consistent with the object of the Act, which is to protect the privacy and confidentiality of the patients. The IPC also noted the sensitivity of health card information as the information is uniquely associated with a person and the information that is linked to that number would paint a comprehensive picture of the person's health. The IPC determined that, insurers could not collect health card numbers on their health insurance applications. Based on the insurance company's evidence, they found that the collection of the information did not facilitate the provision of healthcare by the province, as is required by s.34, but in fact facilitated payment by the insurer. However, addressing the issue of repatriation of an injured person from a foreign hospital to Ontario, the IPC agreed that the information could be collected then. The insurer had argued that, in order to repatriate and insured they would need to arrange a bed at an Ontario hospital for the patient to be transferred to, and to do so would require providing the hospital with a health card number. This, the IPC agreed, was being for the purpose of providing provincially funded healthcare and therefore allowed under the Act. The insurer in this case stopped collecting health card numbers and destroyed all of the health card information in their possession, with the exception of the original forms which they were required to retain for their official records for 15 years. Given that they had taken these actions, the IPC did not need to complete a further review. The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. |
