1. PHIPA: The Year in Review Moderator: Debra Grant Panelists: Pam Slaughter Eric Holowaty Eric Holowaty Ron Heslegrave Ron Heslegrave PHIPA Summit: A Balancing Act Toronto, Ontario November 3, 2005

2. Panelists Pamela Slaughter Eric Holowaty Ron Heslegrave

3. Role of Implied Consent Nothing in PHIPA prevents a health information custodian from using personal health information with the implied consent of the individual for purposes other than providing health care Possible for a custodian to imply consent for the use of personal health information for research purposes. Implied consent also not precluded by CIHR’s Best Privacy Practices IPC has asked for a regulation clarifying that custodians may not imply consent to use personal health information for research purposes, but we have also on occasion supported the use of implied consent in some research contexts (e.g., Canadian Stroke Registry)

4. Questions Is there a role for implied consent in the research process? Under what conditions, if any, would it be appropriate to imply consent to use personal health information for research purposes? As long as the custodian provides notice and an opt-out, can consent be implied?

5. Research Ethics Boards PHIPA imposes many obligations on REBs REBs are now responsible for considering matters such as –whether obtaining consent would be impractical –the public interest in conducting the research versus the public interest in protecting privacy

6. Questions What are the implications of these new obligations for REBs? Aren’t all of these obligations just a barrier to research? Have the REBs been given too much power over the research process? Are REBs prepared to take on this new responsibility – do REBs understand their new obligations under PHIPA and what they must do to comply? Are REBs the appropriate body for dealing with the privacy issues as they relate to research? Are we asking too much of our REBs to take on privacy issues?

7. Consent to Contact Prior to the introduction of PHIPA some custodians routinely screened records for suitable research participants There is no provision in PHIPA that would allow for this use without REB approval under section 44

8. Questions What challenges does this new requirement present for researchers? Isn’t it overly burdensome to ask researchers to obtain REB approval before screening personal health information for potential research participants?

9. Consent Waivers Under what conditions do you think REBs should be approving a waiver of the consent requirement?

10. Questions Are there any general rules of thumb for determining waivers of consent? Should consent be routinely waived for all research projects using administrative data? Is it appropriate to waive the consent requirement when identifiable data is needed to link databases across time and sources? Should researchers be required to obtain consent before accessing patient charts? When is it truly impractical to obtain consent? What should researchers do if their REB routinely refuses to waive the consent requirement under conditions where the researcher strongly believes a waiver is warranted?

11. Consent – Privacy Fundamentalist Perspective Many individuals believe that they should be asked for their permission before their personal health information is used for research purposes, even if that information is going to be de-identified.

12. Questions How can the research community raise awareness of the impracticality of obtaining consent under certain circumstances? How can the non-consensual use of personal health information for research purposes be justified? What should the research community be doing to promote support for the non-consensual use of personal health information under conditions where it is appropriate to waive the consent requirement?

13. Informed Consent With complex research protocols involving data linkages, how can researchers be sure that consent is truly informed without overwhelming and possibly scaring off potential research participants?

14. Questions How much do research participants need to know? How do researchers ensure that individuals understand how their personal health information is being collected, used and disclosed for research?

15. How to Contact Us Debra Grant, Ph. D. Information & Privacy Commissioner/Ontario 2 Bloor Street East, Suite 1400 Toronto, Ontario M4W 1A8 Phone: (416) 326-3333 Web: www.ipc.on.ca E-mail: debra.grant@ipc.on.ca