Knowledge and understanding
The majority of participants possessed extremely limited knowledge of how their PHI is collected, used, and disclosed. Many confessed to having given little or no thought to the issues involved in the health privacy debate. This was particularly true for recent immigrants: "I think the truth is that I don't know. I've never thought of that before, who has my information."(IM-1). The level of understanding was low among participants in other groups as well, as a number of comments betrayed basic misperceptions of how PHI is currently managed within the Canadian health care system:
"It [personal health information] goes in the computer and then it's available to every medical professional in Ontario." (SC-3)
"Health providers have access to your file, to your information... but everybody in the financial department, too, because they have to bill OHIP [Ontario Health Insurance Program] so they have to know everything about you." (IM-2)
One participant perceptively noted that the general population has limited knowledge of the issue of health privacy:
"That's another thing. What do people know about what they can get access to, what they can ask for, and what they can expect? I think the majority of the population have no idea of what they can ask for and expect to get." (CA-4)
Control of access
Participants' accounts clearly suggested an absence of patient control over the collection, use, and disclosure of PHI. No participants recalled having ever been consulted about how their information was to be used. A great deal of concern was voiced about the extent to which health data appears to be freely accessible to a wide variety of users: "Lawyers, psychologists, social workers, researchers, pharmaceutical companies. Where does it stop?" (UP-4). In the course of describing how they feel about the issue of health privacy, participants repeatedly used terms such as "scary" and "horrifying":
"I'm scared to guess who has [access to my health information]. It looks so easy for a lot of people to have access. That's the scary part of it. Maybe your employer can have access to your files, too. I don't know, that's just a guess." (IM-6)
The majority of participants expressed concern that their PHI is not adequately safe-guarded and that the implementation of a tool such as the Health Care Information Directive would not result in significantly enhanced privacy or increased security. There was a widespread view that too much data is currently made available when only specific details are required. Doubts were raised about how consent for one specific use only would be managed:
"What's going to prevent any leaking from one of these [uses] into the others? ... It just seems to me that if there's information on-line, things are going to be compromised. You know, people make a living doing that stuff. The more they find out about you, the more you can be exploited. It's that simple. These systems, they're not secure yet, and I don't know if they can ever be secure." (UP-3)
Health privacy concerns related to the security of electronic databases and the Internet were shared by others:
"We've all heard stories where there's been stolen identities. How difficult is it for the victim to get his or her own identity back? Same idea. Where does it end? Where does it stop? Who's got what information? How am I going to protect myself?" (UP-6)
Participants suggested a number of other mechanisms that could work in conjunction with the HCID to enhance security and facilitate individual control over PHI. One such mechanism would be an online real-time audit system in which the details of all accesses to an individual's PHI are recorded and made available to those wishing to track access to their PHI over time. Also, the idea of a health data ombud was raised in several groups and received a great deal of support.
Mistrust
Issues related to trust were raised in each of the four groups. Participants of all ages and socioeconomic status expressed feelings of mistrust in relation to the protection of their privacy and the security of their PHI. A great many participants spoke of how their past experiences with the health care system have fostered significant mistrust and suspicion where their right to privacy is concerned. These accounts revealed a growing distress that large corporations have too much access to and influence on government programs, especially in contrast to the access and influence accorded to patients:
"What about the rights of the patient? Let's say I'm the patient. What kind of power do I have? Let's say this [the HCID] was created next year. What power does the patient have to make sure any of this is happening? To me, a pharmaceutical company is way more powerful than the patient." (CA-2)
Others were even more sceptical, questioning the trustworthiness of the basic tenets of the model upon which the HCID is based:
"By filling this out, I'm buying into the concept of sharing information, but I don't have any faith that it can be kept private.... It will spill, it will bleed, it will flow. So I'm distrustful of the whole thing. This just sets up more spilling and more flowing. If I fill out a form like this, then I'm validating the process, which I don't really trust." (UP-8)
Need and utility
While the majority were sceptical that the HCID would prevent all breaches of privacy, there was a general consensus that it would serve to enhance significantly the security of health data. One participant noted that the proposed decision aid may also serve a useful purpose as "a sort of consciousness raising" tool. Other impressions varied from "it has some potential" to "it is a great step forward." Reactions were mixed in response to the question of whether the HCID will be successful in empowering individuals and increasing the amount of control over PHI:
"I'm very dubious as to whether this matrix will be useful because of the difficulty people will have filling it out. In spite of that, I think the idea has merit and principle. There's merit in what you're trying to do, but I don't think that this is going to succeed." (CA-5)
"I guess the reality is our information will be shared, so we might as well get on the bandwagon with regulating it and controlling it... You can't stop it from being shared, so maybe you can influence how it will be shared." (UP-2)
Despite the weaknesses and limitations of the present version of the directive, one participant neatly summarized the view of the majority of participants regarding the utility of the HCID or some such tool: "Not having it allows total absence of control, therefore it is a necessary evil." (CA-4).
Implementation barriers
Participants provided numerous suggestions regarding the formatting of the HCID in order to facilitate implementation. Ideas ranged from simplifying the language and providing definitions of technical terms to modifying the layout and shading those areas where there is no discretion (i.e., for physician payment):
"Maybe you've got too many columns.... Well, maybe you're trying to do too many different things at once." (CA-4)
"This is too busy, it's too much. If I'm sick, I friggin' don't want to be bothered with it.... Look at this. English is my first language. How would somebody whose mother tongue is something other than English? It's too complicated." (SC-1)
"I think people tend to say 'no' for things that are not clear. I would say 'yes' if I knew what it means exactly, but I don't know, so I don't want to take a chance." (IM-1)
To address the complexity issue, suggestions were made concerning the need to provide a customer service representative either in a health clinic or via a toll-free helpline for assistance with completing the HCID.
Across the four groups, there was great variability in the preferred mode of implementation. The preference among participants in the health advocates and urban professional groups was for an on-line implementation format. In contrast, the majority of the senior citizens and immigrants preferred other options, the former favouring a postal format and the latter the primary care setting. As one senior citizen remarked: "I prefer the doctor's office. I wouldn't fill it and send it back through the mail, no." (SC-3)