Protecting privacy of health information for those who serve and protect us

Everyone, from the Prime Minister and Privacy Commissioner of Canada to veterans and their families, are crying foul over the alarming breach of Gulf War veteran Captain Sean Bruyea’s privacy. 1 The complete disregard by a federal institution of privacy rights that involved sensitive personal health information is disturbing. For veterans, moreover, it may also have serious health consequences.

In hospitals throughout Canada, even minor breaches of privacy result in swift corrective or even punitive action. Such protection sends a message that the public can trust health institutions and professionals with their sensitive and very private health concerns.

Quite a different message is coming from Veterans Affairs Canada — personal medical information will be used to silence critics. Soon after criticizing Veterans Affairs in 2005, Bruyea discovered that public servants were sharing his health records and mentioning him in 14 000 pages of documents. 1 Later, his medical information, including a psychiatric report, went to two former ministers of veterans affairs (one Liberal, the other Conservative), deputy ministers and numerous departmental branches, including communications and media relations. 2 In all, Bruyea’s confidential financial and medical files were viewed more than 4000 times by as many as 850 people. 3 Sensitive personal health information appears to have been used to further the interests of institutions by attempting to discredit outspoken critics. Government actions may even have pushed Bruyea, a retired intelligence officer, to consider suicide. 4 This is an inexcusable abuse of power that undermined a man who suffered a disability while serving his country.

Shockingly, no one sounded the alarm about privacy issues over these many years. And this is not an isolated example. Attempts to silence two other critics, Veterans’ Ombudsman Pat Stogran and a nurse, Louise Richard, have been widely reported. 5 A distressing feature of all three cases is that they involved veterans who suffered from mental health problems. As a consequence, veterans who may be especially worried about privacy, mistrustful of health care institutions or embarrassed about their diagnosis may refuse to seek assistance.

Following these recent revelations, Privacy Commissioner Jennifer Stoddart has launched a wide-ranging audit of Veterans Affairs. One can only hope that her office will rapidly and effectively document the extent of abuse and outline remedial actions. As Canada’s Privacy Commissioner, Stoddart has investigative powers comparable to those of a superior court justice and significant powers of persuasion with parliamentarians and the Canadian public through the media. However, only her political masters have the power to enact meaningful change.

Prime Minister Stephen Harper has called the breach “completely unacceptable,” and Veterans Affairs Minister Jean-Pierre Blackburn said the department is reviewing rules for using private information and penalties for breaking confidentiality. 3 This is all very well, but restoring public trust will require more than waiting or hiding behind a yet-to-be completed report and a few harsh words. Immediate action is required.

The Prime Minister would do well to learn from Canada’s leading hospitals about relevant privacy protocols. Like Veterans Affairs, hospitals care for people whom they employ; unlike Veterans Affairs, hospitals must abide by strict rules enforced by a provincial or territorial privacy commissioner and institutional privacy officers. Health professionals and support staff have either been disciplined or dismissed for violating institutional standards. Take, for instance, the high-profile example of Pat Quinn and Brian Mulroney, who were both admitted to a Toronto hospital in 2002. Both high-profile individuals had their hospital records examined by people who were not considered part of the care team. Six people, including physicians, were severely reprimanded. 6 And although hospital employees usually appear to be motivated by curiosity in such instances, the motives at Veterans Affairs seem far more ominous.

To begin healing and building trust, Veterans Affairs and its leadership must fundamentally change attitudes and behaviours about the privacy of personal health information. Privacy-specific interventions might include multiple and repeated sessions emphasizing privacy rights, far stricter privacy rules specific for health information and serious oversight with teeth — and yes, even career-limiting penalties, like those in place at our hospitals.

Part of the genesis of the scandal appears to be the adversarial nature of the disability benefits process. Veterans Affairs should stop treating veterans like private insurance claimants and start treating them like beneficiaries who paid their country in blood. Furthermore, veterans and their families deserve an apology and a description of a plan to prevent this form of abuse from happening again.

Canadians should not accept inferior privacy standards for health information in federal institutions as compared to those in their provincial counterparts. Serving and protecting the health information of the individuals who protect and defend us requires more than moral outrage. Their health depends on it. Let’s hope our Prime Minister agrees.