So, the government have actually been able to see your personal health information for some time, one way or another, even though Health Minister Michelle Thompson, when interviewed by CTV News, stated:

Interestingly, though, MLAs Kelly Regan and Lisa Lachance both recommended changes to the wording of clause 110 to the Committee of the Whole House, such that custodians would only disclose aggregated health data that does not include individually identifiable information to the Minister. These recommendations were both defeated at the committee.

So what is the purpose of this amendment to PHIA? If you’re someone who trusts your government you might accept the reasons given by Michelle Thompson that this amendment will help to improve the healthcare system by providing the data needed to properly manage it, and it will allow us to view our own health information in the convenient yet totally redundant YourHealthNS app (redundant because you already know your private health information). However, the first issue with this is that, as stated above, the government may already access your personal health information to manage the healthcare system and an electronic health record.

The second issue can be garnered from one of Lisa Lachance’s recommendations to the Committee on this bill she suggested it be rewritten as such:

(na) requiring custodians and classes of custodians to disclose de-identified aggregate information to the Minister or a person acting on behalf of the Minister for the purpose of the existing YourHealthNS pilot project, and only until the earlier of the end of that pilot project or December 31, 2024

The very fact that this recommendation was defeated suggests that the information is to be collected for some purpose or application beyond that of the YourHealthNS app. What could that be? Speculation abounds, but the fact that the clause passed as it was written means that your health information can be used for any and all things considered to be a program or service associated with the electronic health record.

This brings me to the other points of interest that differentiates this amendment from the aforementioned provisions of PHIA, and to do that properly we need to understand the definition of some of the terms used in the bill. Law has its very own language – legalese – wherein common words we use every day actually have very nonintuitive meanings.

Let’s look at what it means to be a custodian of health information:

3(f) “custodian” means an individual or organization described below who has custody or control of personal health information as a result of or in connection with performing the person’s or organization’s powers or duties:

This actually makes intuitive sense (at least to me), and includes people such as the Minister, your pharmacist, doctor, the IWK etc. Basically anyone you go to see for a medical problem, or anyone acting as a health authority.

It’s the definitions of “person” and “individual” that are key here, though, because one means a real living human, and the other (surprisingly) does not.

3(m) “individual”, in relation to personal health information, means the individual, whether living or deceased, with respect to whom the information was or is being collected or created;

3(q) “person” includes a partnership, association or other entity;

A “person” then, within the realm of PHIA, really means something more like a corporate entity than a human being. This substantially changes the reading of the amendment to Subsection 110, as the “person acting on behalf of the Minister” is more accurately a third party organisation, not a couple of people inside the health department as you might have previously imagined.

Why is this significant?

Well, first there is the question of security and accountability. How much information will be disclosed – only what is relevant to the service being designed or all of it? Will our identifiable data be available to employees of this “entity” and if not, how will the government guarantee that? We’ve already seen a privacy breach of Nova Scotian’s health information earlier this year, so what safeguards will there be to ensure this doesn’t happen again?

Security is a concern on the end of the user’s device as well: what information will the program or service be pulling from the user’s device, and how will that be managed by the “person” and government? Will this third party organization use, attach or associate this data to your already available health information, to then be included as further “personal health information” that the company or Minister can also use? The YourHealthNS app currently collects your calendar information and app activity, without offering a way for you to delete the data collected about you.

The other reason that all of this is significant is that PHIA’s sections on consent (sections 11-20) do not cover personal health information in the hands of anyone other than a custodian. It is not clear from the amendment to PHIA or the Act as it stands that the “person” acting on behalf of the Minister will become a custodian by regulation. If they are not, then an individual cannot withdraw their consent to having their personal health information collected or disclosed to others by this third party organisation.

So why not withdraw consent from the actual custodians, like your doctor or pharmacist, to stop them from sharing it with the Minister and any “person” acting on behalf of the Minister?

17(6) This Section does not apply to personal health information that a custodian is required by law to collect, use or disclose, as the case may be.

Ah, well that rules that out then, since – thanks to Bill 419 – the law now requires that custodians disclose your personal health information for any new electronic programs and services the government plans with any future entity.

And that’s the real kicker of this bill. It’s not, as some are claiming, that it suddenly gives the government access to your private medical information. They took that while we were sleeping. It also doesn’t grant the Minister of Health any new powers, but it certainly grants the Lieutenant Governor a new one.

It’s worse than that. Your private medical information can now be disclosed to any entity the government partners with for almost any future purpose, and there is seemingly no way to stop it from falling into the hands of potential bad actors. Your private medical information is now quite literally available to the highest bidder.

Awesome.