Methods
-
Step 1 We identified the research question as follows, “What does the scholarly and grey literature on information privacy in relation to PIPEDA or PHIPA inform us about the barriers and facilitators young adults with developmental disabilities encounter when accessing and utilizing their privacy rights?”
-
Step 2 Next, relevant peer-reviewed studies were identified by searching electronic databases: ProQuest, JSTOR, Scholars Portal, EBSCO, Web of Science, PubMed, PsychINFO, Scopus, and CANLII (for legal cases and briefs), using specific search terms: PIPEDA OR PHIPA OR information privacy AND developmental disabilities AND Canada. The gray literature search was conducted using the Google search engine, and keywords/phrases were either (a) barriers to PIPEDA for young adults with developmental disabilities in Canada or (b) barriers to PHIPA for young adults with developmental disabilities in Canada. The database searchers were not limited by language or type of publication, but location for keywords was restricted to Canada. Specifically, we searched Google Search and websites of agencies that service YADD. The electronic searches retrieved 9299 articles (Fig. 1), and 25 articles through hand searching. Ten duplicates were removed. Search and keyword strategy were developed by research team members and approved by the study Principle Investigator and the health sciences librarian.
-
Step 3 Abstracts of identified articles were reviewed to assess if they met the inclusion and exclusion criteria. Articles were eligible if they were written in a peer-reviewed journal or published online, including policy documents, websites, and commentary, between January of 2000 and November of 2017. All titles and abstracts were individually examined by the reviewers AM and AK. We excluded any articles or gray literature that was aimed at the general population or cited the legislation without detailed explanation or information on application in servicing YADD. Articles not pertaining to access to or utilization of privacy legislation were excluded. Abstracts were included if they described issues related to PIPEDA or PHIPA and legislation with young adults with developmental disabilities. We included articles based on other populations (e.g. physical disability, and mental illness) and countries (EU) and USA) only if their findings were also relevant to the developmental disability community. Articles discussing children and youth under the age of 16 were not included, and studies of adults were only included if a large portion of the reported sample in the study included young adults under 28 years of age. To ensure comprehensiveness in the evidence base, we also supplemented our list of included articles with academic literature that discussed information privacy with similarly vulnerable populations (e.g., those with mental health or decision-making capacity issues). We included studies conducted outside of Canada when findings were informative for barriers and facilitators of privacy legislation. Forty-seven articles (24 peer-reviewed and 23 gray literature) fulfilled the eligibility criteria for the scoping review.
-
Step 4 Information was captured on Excel 2011. To ensure reliability between reviewers, a series of training exercises were conducted and inter-rater agreement for both the study inclusion and data charting phases. Changes were made based on feedback until there was consensus regarding the face validity of the tool by the two reviewers. A total of 10 randomly selected articles were evaluated by two reviewers, and 5 by three reviewers, to assess the level of agreement across all categories for each article. Reliability for level of agreement on items on the abstraction form ranged from 61 to 96%. Given the high degree of variability among the published and gray literature, the mean level of agreement obtained (79.5%) was deemed to be sufficient. All changes were verified by reviewers to ensure data accuracy.
Results
Location
Population
Legal and Ethical Themes
Types of Articles
Author | Type of study | Participants | Country and law | Type of information | Privacy rights addressed | Ethical principle addressed | Barriers identified | Facilitators identified | |
---|---|---|---|---|---|---|---|---|---|
1. | Mills et al., 2003 | Policy analysis | Not applicable | Canada: PIPEDA PHIPA | Health information | Collection Disclosure | Not addressed | 1. Lack of shared databases 2. Poor integration Of policy and technology 3. Lack of agreement on keeping privacy and security of PHI 4. Lack of commitment to technological networks | 1.Increasing use of “anonymising” data through encryption 2. Advocating for patient privacy 3. Establishing strong policies 4. Willingness to invest in technological advances |
2. | Lafky & Horan, 2011 | Mixed methods: qualitative interviews and quantitative survey | PHR users: unwell, disabled and well adults | USA | Personal health information | Use Access | Confidentiality (breach) Autonomy | 1. Low levels of experience with managing PHI 2. Disabled less concerned, and less in control with privacy 3. Lower engagement in privacy-protecting activities 4. Underrepresentation of disabled people 5. Records which may be scattered among multiple providers | 1. Heightened access and sense/perception of control for those that are more concerned with privacy and more able to protect their health records privacy |
3. | Dyke, et al., 2016 | Comparative legal and policy analysis | None (qualified researchers) | Canada PIPEDA | Health information | Disclosure | Confidentiality | 1. Not complying with PIPEDA legislative requirements 2. Difficulties identifying jurisdiction 3. Complicated legal framework for privacy law (public and private; federal and provincial) 4. Effort and cost of sharing, protecting, and ability to publishing 5. Lack of coherence between national and international privacy frameworks 6. Lack of trans-border data flow sharing | 1. Understanding local norms and standards and legal requirements 2. Understanding factors influencing consumer adoption of health information management tools 3. Using an accountability model for ensuring that Canadian privacy standards are in place |
4. | Yalon-Chanimiz, 2009 | Review of literature and a conceptual model | Adults with intellectual disability | USA | Personal health information | Collection access | Autonomy | 1. People with ID experience processing delay, low literacy, stigma 2. Complexities in accessibility: verbal communication, layout of physical environment, product-operating instructions and procedures | 1. Provision of: extra time, age appropriate information, simple language, simple layout, pictograms, and auditory means 2. Higher levels of self-determination: more use of services, inclusion in their community, reducing stigma 3. Training and education for service providers |
5. | Urowitz et al., 2008 | QUAN (National Scan)-survey - prospective, cross-sectional | CEOs of hospitals (N = 83) | Canada PHIPA | Electronic health records | Use and access | Confidentiality | 1. Absence of technology to facilitate the electronic health record 2. Financial resources 3. Patient computer literacy 4. Lack of hospital survey on patient needs for HER 5. Unwillingness of hospitals to providing patients with access to their EHR | 1. Use of electronic patient portals 2. Cultural shift of healthcare providers: to give up “ownership” of the files |
6. | Siegel, et al., 2009 | Comparative legal and policy analysis | Consumers of technology | Canada PIPEDA USA, EU | Personal information | Use (security breach) | Accountability | 1. Exploding growth of social media, yet lacks detail how information is used for advertising, and how to verify consent from non-users 2. Regulations are “piece-meal” not explained enough 3. Developments in Canada have been only advisory | 1. Jurisdiction over foreign organizations 2. Clear, consistent communication as to the use of the information across platforms |
7. | Geist, 2016 | Critical review of legislature | Consumers of technology | Canada PIPEDA | Personal information | Disclosure (security breach) | Confidentiality accountability | 1. Corporate, lobby group focus on commercial concerns 2. Absence of “order-making power” 3. Lack of penalties for privacy violations 4. Weak protections when outsourcing information to low protection jurisdictions | 1. Public engagement, protests for privacy rights 2. Mandatory breach disclosure requirements |
8. | Larivie’re-Bastien, & Racine, 2011 | Review | Adolescents with cerebral palsy | USA | Health information | Collection | Confidentiality autonomy | 1. Failure to adjust and focus on disability prevents focus on traditional adolescence issues 2. Lack of preparation to the transition and social isolation 3. Difficulty obtaining health information 4. Needs for confidentiality and privacy are not respected and not acknowledged 5. Issues of informed consent and capacity often not addressed: opportunity to take part in decision-making not provided enough | 1. Positive attitudes and trustful, open provider-patient relationships free of stereotypes 2. Technology for communication, time and resources help with autonomous consent 3. Healthcare providers can facilitate implicit personal autonomy even if it contradicts professional opinions |
9. | Austin, 2006 | Review: case and legislature | Not applicable | None identified | Consumer information | Collection use | Confidentiality autonomy | None identified | 1. Privacy protection shifts balance of power away from business to consumers 2. Specifics of privacy give consumers clear ability to control privacy 3. Enforcing organization to comply with explicit consent for sensitive information |
10. | Repetto, et al., 2008 | Review | 1. YADD in transition: from Grade 6 to 12 students 2. Family caregiver 3. Teachers | USA HIPPAA FERPA | Personal information | Collection use disclosure Access | Confidentiality Autonomy | 1. Legislature limited to record keeping and documentation and may not cover the broader needs 2. Young adults with DD do not have the knowledge, skills and are not health literate 3. Standards, curriculum materials and legislation do not refer to disabilities 4. Insufficient expansion of transition planning 5. Cannot reveal students’ personal health information as they learn, so makes teaching the content difficult. | 1. Improved guidelines for teachers to support confidentiality within the classroom 2. Teaching students how to balance the advantages and disadvantages of releasing personal health information 3. Empowering and preparing students to make informed choices related to disclosure and increasing their communication, reasoning and investigating skills for health promotion |
11. | Chan, & O’Brien, 2011 | Review | Not applicable | Canada PHIPA | Health information | Use | Confidentiality Autonomy Accountability | 1. Precarious balance between respecting client confidentiality and facilitating patient care 2. Caregivers who assume an allied care giving role not recognized as health information custodian | None |
12. | Gagnon, et al., 2016 | Qualitative study | Canadian service providers | Not identified | Electronic personal health records | Use Access Disclosure | Confidentiality Autonomy | 1. Confusion, lack of awareness 2. Usability and relevance with system design 3. Weak user capacities and attitudes (i.e., patient health literacy, education and interest, support for professionals) 4. Environmental factors (i.e., government commitment, and targeted populations) | 1. Increased guidance for supporting staff and for defining ePHR, data ownership 2. Access to information and sharing of health records to inform stakeholders |
13. | Joffe, 2010 | Policy review | Applied for people for DD | Ontario Human Rights Commission Code | Health information | Collection | Confidentiality Autonomy | 1. Lack of knowledge 2. Confusion- > which rights apply in which contexts 3. Complaints procedure: not enough support, and fear of reprisal from service providers | 1. Accessible and understandable information 2. Helping people to develop as self-advocates 3. Rights education outside of service provision: ensures confidentiality 4. Provision of accommodations and supports to participate in Act 5. family member/friend support the person with disabilities |
14 | Keith, 2004 | Commentary | Not applicable | Canadian PIPEDA and USA privacy legislature | Personal information | Collection Use Access | Confidentiality | 1. Unclear language 2. Lack of direction in Act 3. Stringent definition of personal information | 1.Clarity of purpose in collecting personal information 2.Consent 3. Limiting collection and use 4. Open to public review and compliance with requests for personal information access |
15. | Rule, 2004 | Policy review | Not applicable | PIPEDA | Personal information | Collection Disclosure | Confidentiality | 1. Lack of distinction between “strategic and consummatory privacy rights 2. Unknown or undefined risks 3. Logic of markets vs. logic of personal rights 4. Manipulation of personal information connected to online transactions 5. Risks: profiling, matching, data mining | 1. Clarify purposes for gathering and withholding information 2. Clarify how information is shared |
16. | Beardwood, 2015 | Review | Not applicable | PHIPA and PIPEDA, Canadian Digital Privacy Act USA EU | Personal health information | Disclosure (privacy breach) | Confidentiality Accountability | Not identified | 1. Organizations knowingly contravening the Reporting Obligation or the Notification Obligation are guilty of punishable offense 2. Nothing unique or systemic required to report a privacy breach to Commissioner. |
17. | Clement, & Obar, 2016 | Review | Canadian consumers of internet | PIPEDA | Personal data of customers | Use Disclosure | Confidentiality | 1. Each company report is idiosyncratic-hard to compare/understand company’s statistics 2. Lack of transparency: retention periods for personal information, physical location of servers, data storage, and facilities where personal information is routed | 1. Transparency reporting sheds useful light on previously hidden practices |
18. | Davidson, et al., 2016 | Comparative review of international legal frameworks | People with mental health problems | PHIPA | Health information | Collection | Autonomy | 1 Laws based on mental disorder and risk, rather than decision-making ability 2 Complex overlaps and some logical inconsistencies of guardianship and other mental capacity laws discriminate against people with mental health problems | Universal shifts from institutional to community-based care |
19. | Peekhaus, 2008 | National survey | General public | PIPEDA, PHIPA, and other provincial Health Information Acts | Health information and genetic data | Collection Use | Confidentiality Autonomy | 1. Commercial exploitation of personal information 2. Domestic and international pressures for minimum standards of protection for personal information 3. Ministry of Health use of identifiable health information may not sit well with the Canadian public 4. Compounded safeguarding the privacy of medical information: as medical treatment migrates to complementary and alternative medicine | Willingness of Canadians (61%) to sharing their genetic information with family members |
20. | Rose, & Rose, 2014 | Review of privacy law | Consumers of healthcare | PIPEDA, PIPA in Alberta and BC, Quebec Privacy Act, PHI, HIPAA and HITECH | Personal health information | Disclosure | Confidentiality | None identified | None identified |
21. | Seelig, 2006 | Case study | Youth (24 years) with Angelman Syndrome | HIPAA | Personal and health information | Access | Confidentiality | None identified | None identified |
22. | Skouge, et al., 2007 | Description a model | Young adult in transition | None identified | Personal health information | Collection | Confidentiality Autonomy | None identified | None identified |
23. | Moore, et al., 2016 | Full research report; mixed methods study | Primary healthcare users in Southeastern Ontario | PIPEDA | Personal health information | Collection | Confidentiality | None identified | None identified |
24. | Wolbring, & Leopatra, 2013 | Cross-sectional study | Staff of disability service organization | PIPEDA | Electronic health records | Collection Use | Confidentiality Autonomy | 1. Very limited control over the collection and safe keeping of personal information created over the course of participants lives 2. PI moderated through staff members | 1. Staff more skeptical towards certain sensor applications than others 2. Staff concerned over moderate control of own privacy and their client’s even lesser control over their privacy |
Organization or author | Type of document | Population of focus | Country and law | Type of information | Privacy law addressed | Ethics addressed | Barriers identified | Facilitators identified | |
---|---|---|---|---|---|---|---|---|---|
1. | Central East LHIN, 2009 | Final report-guidelines | Young adults in transitional age | Canada: PHIPA | Health information | Collection | Confidentiality Autonomy | Developmental disability identified as a barrier | 1. Client-centerd care 2. Respect and avoidance of labels that stigmatize |
2. | Shimmell, & Gioia Di Vincenzo, 2017 | Professional guidelines: student guide | Occupational therapy students in placements | Canada: PIPEDA PHIPA | Personal information | Reference to Act | Confidentiality | None identified | None identified |
3. | Desai, 2013 | Final report\-community mental health strategy and policy review | Service providers and criminalized person with mental health problems | Canada: PIPEDA PHIPA | Health information | Use Disclosure Access | Autonomy | 1. Families not considered as partner in care 2. Hesitancy to release client’s health information from agency files 3. No centralized information delivery model 4. Not enough consent policies for vulnerable populations with mental health issues | 1. Stricter rules on ”circle of care” where consent is not required 2. Understanding the type of information that can be released by whom and how |
4. | Canadian Association for Community Living, 2011 | Policy review | Young adults with ID | CACL’s Vision 2020 | Health information | Collection | Autonomy | 1. Attaining full citizenship in law, policy, and practice 2. Institutional approach-insufficient access to educational aids/devices 3. Prejudice, poverty, lack of employment equality, lack of economic security for families 4. Lack of data collection on young people with DD | 1. Removal of stigma 2. Specialized services 3. New policies to regulate restraint use in residential services, and for reporting of violence/abuse against those with ID |
5. | Community Living- Huntsville, 2012 | Not applicable | Not applicable | Not identified | Personal information | Use | Confidentiality | None identified | 1. Stressing protection of privacy and confidentiality of personal information 2. Providing supervision in least intrusive manner, with respect for person’s right to privacy and dignity and ensuring safety and well-being |
6. | Ontario LAW: Services and Supports to Promote the Social Inclusion of Persons with Developmental Disabilities Act, 2008 | Legislation review: | Person with DD/ID | PIPEDA Disability Supports Act | Personal information | Collection Use Disclosure | Confidentiality | None identified | 1. Limits on collection and use to no more than is reasonably necessary to meet the purpose |
7. | Law Commission of Ontario: Background and Contexts in Which the Law Operates, 2017a | Policy review-chapter | Not applicable | PIPEDA | Information held in capacity registry | Collection Use Disclosure | Confidentiality Autonomy Accountability | 1. Complying with privacy protections precludes persons from using informal supports and arrangements and makes it difficult for family members to obtain or share information 2. Checks and audits, and capacity assessment intrudes on privacy | 1. Formal substitute decision-making arrangements will give families greater access to supports or ease the difficulties of providing care 2. Use of informal network to assist decision-making |
8. | Law Commission of Ontario: Legal Capacity, Decision-making and Guardianship: Final Report, 2017b | Policy/legislation review and qualitative study | Not applicable | Health Care Consent Act, Substitute Decisions Act, Mental Health Act, | Personal information | Collection | Confidentiality Autonomy | 1. Vagueness in law 2. Formal assessment of capacity perceived as an invasion of privacy 3. Default role to family-not always involved | 1. Greater involvement of families 2. Informal social networks to reduce intrusion on privacy 3. Supporters appointed under decision-making capacity rules required to maintain confidentiality of information |
9. | Mental Health Commission of Canada, 2015 | Review of policy and literature | Emerging adults 16–25 years with mental health problems | PHIPA | Health information | Collection | Confidentiality | 1. Clinicians strictly adhering to altered legal status at 18 for confidentiality requirements 2. Treatment compliance is reduced | Clinicians being “family-engaged” |
10. | Kindred Home Care, 2012 | Resource | Personal support workers | PIPEDA PHIPA | Health information | Use | Confidentiality | None identified | None identified |
11. | Simcoe York Dual Diagnosis Education committee, 2015 | Resource | Families with persons with ID + mental health problems | PHIPA | Health information | Collection | Confidentiality | Lack of information regarding services/supports | 1. Specific lists of supports and services 2. Specific questions to ask and directions to follow |
12. | Wappel, 2007 | Policy review | Not applicable | PIPEDA PHIPA | Personal information | Access (have information corrected) | None identified | 1. Lack of definition for ”work product” 2. Confusion and lack of specificity between expressed, implied, and opt-out | Clear definition of personal information |
13. | Wedge, 2014 | Dissertation | Older persons | PIPEDA | Personal information | Collection | Accountability | 1. No means for privacy for those who suspect crime against older person to report | None identified |
14. | Wellington North, 2015 | Meeting minutes | Not applicable | PIPEDA MFIPPA | Health information | Disclosure | Confidentiality | 1. Social media use 2. Lack of knowledge of PIPEDA | 1. Identify specific strategies for invasion of privacy 2. Only release health information according to legislation |
15. | Community Living- Central Huron, 2015 | Policy document | Agency’s board of directors, staff, members-at-large and the people receiving service, and those with DD | PIPEDA | Personal information | Disclosure | Confidentiality | Not identified | None identified |
16. | Office of the Privacy Commissioner, 2016 Annual Report to Parliament on the PIPEDA and the Privacy Act, 2015–2016 | Report to the Parliament | Genetic testing users | PIPEDA | Personal information | Collection Use Disclosure (breach of information) | Confidentiality | 1. More information is collected: less adequate safeguards, increased risk and potential consequences of privacy breaches (related to genetic testing) 2. Cross border privacy issues increasing | Breach reports to OPC growing every year, (more since 2014) |
17. | Kitchener Downtown Community Health Centre, 2012 | Client related policy document | All users of primary care, treatments, referrals, health promotion | PHIPA | Personal information | Collection Use Disclosure | Confidentiality | 1. Court order or subpeona | 1. Training staff to effectively communicate with persons with disabilities. 2. Clarifying the collection, use and disclosure of personal health information |
18. | Legislative Assembly of Ontario: Review of the Personal Health Information Protection Act, 2008 | Committee documents/review | People including those with disability | PHIPA | Health information | Disclosure Access | Confidentiality | 1. Definition of “health information custodian” not entirely clear 2. Inability to access their own records due to exorbitant fees leads to people with disabilities being denied social assistance, insurance, and accommodations | 1. Right to education for patients under the legislation (consent, breaches of privacy) 2. Education for stakeholders to ensure they are aware of their responsibilities under the legislation. |
19. | Ministry of Health and Long-Term Care (MOHLTC), 2006 | Service policy manual | Persons recovering from treatment, and elderly persons | PHIPA Health Care Consent Act (HCCA), Substitute Decisions Act (SDA) | Health information | Disclosure Access | Confidentiality Autonomy | 1. Provision of care under CCAC is subject to sharing of health information | None identified |
20. | Renfrew County Catholic District School Board, 2014 | Policy and procedure document | Service providers | PHIPA | Personal and health Information | Collection Use | None identified | None identified | None identified |
21. | Trottier & Kaattari, 2010 | Resource guide | Ontario’s community literacy agencies on finances, administration and employment | PIPEDA | Personal information | Collection Use Disclosure | Confidentiality | None identified | None identified |
22. | Lacobucci, 2014 | Independent review | People in crisis | PHIPA | Individual’s healthcare information | Collection Use Disclosure | Confidentiality | 1. Constraints on information-sharing issues makes coordination between the TPS and the mental health system less effective | 2. Healthcare institutions must protect physician-patient confidentiality and sharing of healthcare information. |
23. | Luker, 2009 | News letter: College of Audiologists and Speech-Language Pathologists of Ontario | Persons with, hearing, speech, and language difficulties | PHIPA | Health information | Access (correction of information) | Confidentiality | None identified | None identified |