Ontario’s new medical test results system is fast and convenient. But is it safe?

By Iman Sheikh - Published on August 25, 2015
patient medical records
Obtaining medical records can be difficult and expensive for Ontarians—but offering that same information online could pose its own risks.

Comments

X

Do you have a right to know what your doctor writes in your medical records? Yes. Is the information easily obtainable? Historically, not really.

While federal law says you own the information in your file, the hospital or clinic where you were treated owns the physical records that hold this information. As a patient, you therefore have a right to access the medical information in the record and to obtain copies of its documents, but not to obtain the record itself.

Copies can get expensive. In one case, a Thunder Bay woman who requested her records was sent a $617 bill. While provinces such as Saskatchewan have stipulated that a practice may charge “fair” copy fees for its time and expenses, the associated costs are often prohibitive.

While Toronto healthcare providers such as Sunnybrook Hospital (and later Baycrest) began using an online portal called MyChart to provide patients access to records and results as early as 2006, the system was slow to catch on in surrounding areas. A new test result delivery format, however, may finally change that for patients across the province. On August 10, Canadian laboratory service company LifeLabs launched an online system called My Results, through which patients of Ontario hospitals that use its services can obtain certain medical test results within 24–48 hours of testing, at no extra charge. (At 240 clinics across the province, LifeLabs is the largest lab service company in Ontario.)

While some specialized test results, such as FOBT-ColonCancerCheck, electrocardiograms, and histology (whole tissue), will be sent only to physicians, other common laboratory outcomes, such as pregnancy and hepatitis will be made available to patients and doctors at the same time. The same system launched in B.C. five years ago under the name my eHealth. Both services are operated by Excelleris Technologies (Excelleris), a wholly-owned subsidiary of LifeLabs.

But given the large-scale online security breaches of the last few months and former Toronto mayor Rob Ford’s medical records being illegally obtained, can this new system keep private information private? Only if providers make it a priority, says Michael Crystal, a data breach and class action lawyer in Ottawa.

“The problem is that traditionally, cyber security in the medical field in Ontario has been low priority,” he explains. “My observations in a number of hospital cases have been that technology has been relatively older. In terms of hospital expenditure, how high a priority will security be?”

It has never been a problem with my eHealth, according to Mitchell Toker, director of public affairs at LifeLabs. He says that through the entire operation in B.C., there have been no security breaches in the online test result system.

“We deal with personal information thousands of times a day and it’s very safe,” he says. “We have about five years experience with around 550,000 patients in B.C. using the same system. It’s monitored by a security firm, it’s password-protected and it requires a patient’s name, date of birth and health care number. It also requires the number of an actual lab test.”

In 2014, LifeLabs ran a pilot program of My Results in Peterborough and Stratford with 1,800 patients. “It was very safe,” he says. “We now have over 10,000 users across Ontario­—and that’s within only one week of our launch. It’s a very positive step.”

Patrick Kenny, privacy and security officer at LifeLabs, also adds that the web servers the system operates on are also regularly tested and evaluated for safety by independent security officers.

But Crystal, who is currently fighting a case against Peterborough Regional Health Centre on behalf of 280 patients who had their medical files improperly accessed by hospital staff, says not to underestimate the value and vulnerability of patient information.

“You only have to look at the frequency of these hacking cases in Ontario with Ashley Madison, Walmart, GM Financial and MasterCard only in the last couple months,” he points out. “The data is valuable for drug testing and for all kinds of purposes. It needs to be properly protected and insurance for breaches needs to be put in place.”

Crystal says currently invasion-of-privacy damages are capped at $20,000 by the Ontario Court of Appeals, unless a patient’s information is sold or used. This is called intrusion upon seclusion, and damages are evaluated on a case by case basis.

While a focus on risk and security is important, other factors such as the benefits of improved infrastructure also need to be considered when looking at portals such as My Results, according Ivy Bourgeault, a professor in the Telfer School of Management and Institute of Population Health at the University of Ottawa.

“You need to have easy access to your health information because there may be inaccuracies in there that you could correct,” she says. “It’s not for people to self-diagnose. It’s so people have an active, engaged perspective on their health and illnesses. Having easier public access to health records would make health providers utilize them in a different way.”

She says that instances where people don’t have access, or where providers can only read and can’t add information to a file are very common, and the costs of amending records is very high. Borgeault believes the new lab result delivery system is a very positive step, but entire medical histories should be available online to patients, not just select lab test results.

“There are security risks with any system,” she says. “I think the bigger issue is democratizing access, and we need the infrastructure to enable that.”

Image credit: Alanna Autler/Medill DC/flickr.com

Author