No privacy of health information in Canada’s Armed Forces

Privacy abuses at Veterans Affairs Canada1 raise concerns about whether the Canadian Armed Forces offer sufficient protection of personal health information. In the absence of adequate safeguards, health professionals, including civilian and military physicians, may be forced to choose between obeying orders and upholding the values of their profession.

Many countries have enacted laws to protect the privacy of personal health information of civilians in response to the growing secondary use of large health databases and ease of access to electronic medical records. On the basis of privacy laws,2^,3 most health care institutions have strict privacy rules for staff caring for colleagues — for example, proactively defining the circle of care, updating and communicating access rights with each encounter, warning staff of privacy concerns, and actively monitoring access.

However, few of the world’s armed forces provide complete confidentiality of personal health information. The duty to inform the patient as well as the process of explicitly defining the context of information access (the who, why, when and how) of medical records also vary significantly from country to country.4^,5 For instance, in the United Kingdom, there are provisions for patients to learn who has had access to their personal health information and to request restrictions on use and disclosure. No such controls exist in our system.5

In the military, respect and obedience for the chain of command are paramount and rigidly enforced by a robust Code of Service Discipline. As a consequence, how can a health records clerk, nurse or physician serving with the military disobey a direct order from a superior who requests access to the health information of one of his or her personnel? Medical clerical staff are unlikely to refuse a request from a superior officer wishing to review the medical records of a sergeant who exhibits disruptive behaviour. Nor would they refuse an order to provide all medical records of personnel being considered for deployment. For physicians and nurses in the military, professional oaths can do little more than act as a moral compass.

How often does this happen? We don’t know, but it certainly does happen. Recently, in response to misuses of records by former Base Commander and convicted murderer Russell Williams, Lieutenant General André Deschamps said, “Ultimately the commander is still responsible for all the people under his command and therefore needs to have access to those files when required.”6 Simply put, Deschamps acknowledges that soldiers have few rights to privacy while they’re in the service.

Although most military officers likely have the best of intentions when accessing the health records of subordinates, potential or real violations of privacy breed mistrust. If officers hope to predict dangerous behaviour during combat by reviewing health information, they will fail since little evidence suggests it can be done accurately. It is especially misguided and potentially dangerous if done by line officers who have no professional training in mental health.

As a result, soldiers returning from combat operations may hide symptoms of mental health conditions such as post-traumatic stress disorder and depression — diagnoses made by trained health professionals who require honest disclosure during structured diagnostic interviews.7 Without an early diagnosis and effective treatment, redeployed military personnel may be putting their lives and the lives of others at risk. Given that military personnel either suspect or know that they have limited privacy rights, physicians would be well advised to confirm that their patients’ private health information may be divulged to others before they initiate a therapeutic relationship. Under such circumstances, a soldier’s silence is understandable, but it is to the detriment of his or her health.

The only protection afforded military personnel is a weak federal Privacy Act1 and a commissioner who reports breaches to Parliament. But Canada’s Privacy Act only provides investigative authority to the commissioner; it has no enforcement tools. The Act does little to address the many nuanced privacy issues in dealing with sensitive health information, which explains why several provinces have developed their own privacy laws for health information.

Privacy Commissioner Jennifer Stoddart, who has authority to investigate compliance with the Privacy Act, has used the considerable weight of her office to protect Canadians from online abuses by Facebook and Google, but she has done little to protect the privacy of health information of our soldiers and veterans. On the contrary, her office had to be embarrassed into acting on obvious breaches of privacy at Veterans Affairs Canada — a situation uncovered more than four years ago.

With so few protections and the recent Veterans Affairs fiasco, Chief of Defence Staff General Walter Natynczyk must take action to reassure the men and women under his command that their health privacy will not be abused by well-meaning superiors.

Natynczyk should ask the federal privacy commissioner to conduct an independent review resulting in clear recommendations that incorporate international best practices from other armed forces. Updated privacy rules should include, at the very least, a duty to provide notice as well as to offer explanations to a military patient if his or her personal information is to be disclosed to nonmedical personnel. Better yet would be a guarantee of privacy for mental health records. Obviously, exceptions should be made, particularly during operational deployments when there are risks to the person, the unit or the mission. Nevertheless, notification should still occur. To further dissociate health information from the chain of command, more radical solutions, such as outsourcing of all medical services, may be explored. Most important, all policies, regardless of approach, must be subject to regular oversight and review by a professional civilian body.

Health professionals, both civilian and military, would do well to advocate for service men and women. Our military personnel protect our rights; it’s time we worked to protect theirs.