The Office of the Information and Privacy Commissioner in Saskatchewan says it has reached an impasse with Saskatchewan Government Insurance (SGI) over three ‘breach of privacy’ complaints related to the collection of personal health information under the Automobile Accident Insurance Act (AAIA).
Saskatchewan’s privacy commissioner has recommended in a report that Saskatchewan’s legislature amend legislation to clarify the rules applying to the public insurer’s collection, use and disclosure of health information collected under the AAIA.
The privacy commissioner has also recommended that SGI publish on its web site “clear information about its collection, use and disclosure practices.” SGI, the commissioner said, should also “revise its procedure for the collection of personal health information to ensure it is not over-collecting such information.”
The privacy commissioner released its report after investigating three formal, separate breach-of-privacy complaints. Each complaint related to the collection of health information after the claimant sustained an injury in a motor vehicle accident.
Upon being approached by the privacy commissioner, SGI took the position that the privacy commissioner had no authority to investigate the complaints, because the information was collected pursuant to the AAIA, and not therefore subject to the Health Information Protection Act or the Freedom of Information and Protection of Privacy Act.
“The Commissioner considered representations from SGI and concluded that there is no evidence that the Legislative Assembly would have intended to create such a gap in legislated privacy protection and that, in fact, there is no such gap as alleged by SGI,” the commissioner concluded in its report.