Data Sovereignty & Services

[Chris Johnston]

Hi all,

The topic of data sovereignty keeps popping up - understandably as it's on our minds - so when I saw this, I thought I should share it.

I stumbled across this information on the site of a US-based virtual health service vendor called VSee. The products/services they offer cover a broad range from virtual staffing, remote patient monitoring, EMR hosting all the way to full virtual clinic.

I was intrigued and then concerned to read this page:
What you need to know about HIPPA & Canada Health Information Privacy

Now at first glance the page was written in 2017, so clearly some of the information is out of date - and some appears to have been incorrect even at the time - but it hasn't been updated, and still appears on their site as current info - which is concerning.

Particularly because they're clearly marketing (and presumably selling) their services to health providers and clinics in Canada. If providers of any kind in Canada (primary care, specialists, allied health etc.) accept this information at face value, then it poses an immediate risk to their patients'/clients' data.

It makes me wonder how many such vendors are out there offering inaccurate and/or outdated information that may mislead providers into hosting patient data in the US. And there's no indication that patients would even be notified regarding where their data is being processed or hosted.

Would be interested to know if any PAN members have encountered anything similar?

[Debra Turnbull]

@Chris-Johnston

Hi Chris,

This is good (!)... it gives you a perspective into the American mind. Outdated websites are very common. What business has time to remember to update their public-facing webpage content. The answer is none.

A few things to note:

• HIPPA has no jurisdiction in Canada, and

• they are focusing on PIPEDA - the national privacy law (that applies to business; with exceptions to healthcare). (Light reading for insomniacs...)

It is important to note that - as a result of healthcare being in the jurisdiction of the PROVINCES - the feds must accept what 14 jurisdictions decide regarding healthcare. Personal Health Information (PHI) is a provincial matter governed by provincial privacy law. Transferring PHI between provinces is a nightmare. This, in turn, results in the national interoperability horror story that we currently find ourselves in.

Bottom line: it is up to each province to do its due diligence when it comes to PHI protection... and to which - the Americans are oblivious. Also, each healthcare service provider (hospitals, community care, clinics) must show conformance to privacy; in conformance to multiple professional standards. Heck, the provinces can't get their acts together - imagine the Americans trying to sell software in such an environment.

Just because things are being marketed for the American environment, does not mean Canadian entities need to agree. Take a look at your healthcare delivery organizations; look up their privacy statements. There is a catch phrase out there: "Patient PHI is stored on servers that reside in Canada." My local hospital went so far as to state that the PHI resides in Ontario (I'm based here in Ottawa.) I would love to do a deep dive into all the provinces and their privacy standards... but honestly - who has the time.

I'm going to stop here, 'cause I could prattle on forever. However, feel free to ask questions here and I'll do my best to answer.