Telehealth and Privacy in BC: How Can Healthcare Providers Protect Patient Data?

Telehealth became a lifeline during the pandemic, making it easier than ever for patients to have their healthcare needs met without having to leave the comfort of their home. While the social distancing days of the pandemic are behind us, it is clear that this convenient and accessible approach to healthcare is here to stay. But along with all its benefits, telehealth has raised some real privacy challenges for healthcare practitioners. From ensuring virtual consultations are secure to protecting sensitive health data, this technology has opened the door to a host of questions about how to keep our information safe. Balancing the perks of telehealth with strong privacy safeguards is a challenge we can’t afford to ignore.

BC has stringent rules for the safeguarding of patient information. The Personal Information Protection Act (PIPA) governs private-sector organizations, including most healthcare providers in private clinics (physicians, dentists, massage therapists, psychologists, physiotherapists, chiropractors, the list goes on). For healthcare providers in public settings (i.e. hospitals or other government-run institutions), FIPPA (Freedom of Information and Protection of Privacy Act) has similar data protection requirements, and both pieces of legislation impose requirements on healthcare practitioners to secure the health information of their patients in telehealth settings.

How can healthcare providers meet these standards and protect patient privacy? Here are some fundamental tips:

1. Choose the Right Platform: Go with telehealth platforms designed with healthcare privacy in mind. BC’s laws mandate secure storage and use, so end-to-end encrypted platforms are a must. Under PIPA, organizations can store their data outside of Canada, however, for public organizations governed by FIPPA, look for Canadian data storage options to ensure compliance, as FIPPA does not permit storage of data outside of Canada.

2. Get Clear Consent: Health regulatory Colleges in BC are generally of the view that patient consent must be obtained to proceed with an appointment via telehealth. This means the patient must be informed of the risks of limitations of using telehealth, including that there are potential privacy risks, the limitations of virtual assessments (e.g. the inability to perform physical assessments). The patient must be informed of in-person care as an option. Consent should be documented in the patient’s record.

3. Stick to Secure Connections: Privacy starts with locking down both the physical and virtual space. That means no use of public Wi-Fi, using only encrypted connections, and a quiet, private room for your calls. Taking a patient appointment in a noisy coffee shop isn’t just careless; it’s a privacy risk you can’t afford to take.

4. Two-Factor Authentication: To protect access to telehealth systems, use two-factor authentication (2FA). This way, only authorized staff and patients can log in, adding an extra layer of security against potential hackers or data breaches.

5. Train the Team: Even with secure tech, the human element can be a weak link. Staff need regular training on privacy best practices, from spotting phishing emails to following strong password protocols. Human error is often the cause of data breaches, so keep teams sharp on data security basics.

Even with solid precautions, breaches can happen. In BC, healthcare providers in a public setting are legally required to notify both patients and the Office of the Information and Privacy Commissioner if sensitive health data is compromised. For practitioners at private clinics, there is no mandatory reporting requirement, however, reporting is often a good idea. 

As telehealth continues to expand, BC’s privacy regulations are likely to evolve. New standards may emerge around data localization (keeping data in Canada) and even stricter requirements for telehealth platforms. Staying on top of these developments is essential for providers as they navigate this fast-growing area of care.

If you need assistance navigating this tricky area of the law or discussing your reporting obligations, contact Roshni or one of the members of our Privacy and Data Protection group, here.