Outsourced medical billing and privacy law
The Toronto Star today with the relatively new practice of physicians outsourcing their billing for providing uninsured services, like filling out forms and giving advice over the phone.
Outsourcing the responsibility for billing the "block fees" for such services to a growing industry of private firms is now becoming for Canadians doctors to get paid for doing hundreds of hours of unremunerated work per year, but is it legal?
*Update, Monday, November 26: On Saturday, the Ontario Information and Privacy Commissioner announced she will investigate the information-privacy concerns about uninsured billing agencies, and the College of Physicians and Surgeons of Ontario said it too will look into the matter. Ontario NDP leader Howard Hampton is pushing for a ban on block fees. at the Waterloo Record.
The Star's article explains that many of the letters mailed to patients by one firm, Healthscreen Solutions, in order to explain the block fee service, are designed to appear to be mailed directly from the physicians, and don't inform patients that a third party is involved in the transaction:
The letters imply that patients signing up for the plan are communicating only with their doctors. In fact, their personal information, including financial and other personal details from the doctor's file, are going to a company that handles $1.5 billion a year in billing and other services for 5,000 doctors. [...]
Privacy experts say the packages raise questions about transparency.
Fair information practices, the principles that underpin privacy laws across North America, say individuals should know who is collecting their personal data, where it's going and how it will be used.
But that principle, for better or worse, is not enshrined in Canadian privacy legislation. For an explanation, I defer to Richard Owens and Francois van Vuuren the Toronto-based law firm and their discussion of the legalities of outsourcing private information processing, :
PIPEDA [] requires consent for the collection, use or disclosure of personal information unless one of the exceptions in PIPEDA applies.
The most important exception in PIPEDA to the requirement for data subject consent to a disclosure for outsourcing purposes is Principle 4.1.3 of Schedule 1 to PIPEDA, which provides:
- an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.
The Office of the Privacy Commissioner of Canada (Canadian Commissioner), has stated that no consent by the data subjects involved is required for a transfer under Principle 4.1.3, provided the processor only uses the personal information for the purpose that it is transferred and the requirements of Principle 4.1.3 are met. It perhaps bears note that only "processing" services qualify for an exemption under Principle 4.1.3. The term "processing" is undefined. It is worth noting that the ability to transfer data implied by Principle 4.1.3 is just that, an implication, and that it is a bit at odds with the more straightforward prohibitions in the statute itself.
It would seem, then, that although some people might prefer Canadian law to require disclosure and consent in cases of outsourced information processing, no such protection currently exists.
That's probably why the
Star wasn't able to drum up much interest from the Ontario government:
The Ontario Information and Privacy Commissioner's office says it can't comment without full details about how Healthscreen operates and how the province's Personal Health Information Protection Act might apply.
But spokesperson Bob Spence said that "if anyone believes their personal health information has been inappropriately collected, used or disclosed, they can file a privacy complaint with our office."
Health Minister George Smitherman said he keeps a "very, very watchful eye" on the issue of block fees. If questions are being raised about disclosure to patients, he said he'd consider reviewing the issue.
The only hope for change is the ongoing Industry Canada review into PIPEDA reform. It was recently announced that the issue would be opened to public consultation, but a seems to indicate that outsourcing is not being considered for reform.
Check out our website: