Feds should guarantee health information will not be shared with immigration authorities: law prof

To ease vaccine hesitancy among undocumented migrants in Ontario, governments must guarantee personal information will not be shared with federal immigration authorities, says Dr. Graham Hudson, associate professor in the Lincoln Alexander School of Law at Ryerson University.

Through his research studying migrant access to COVID vaccines, Hudson has prepared a memo on privacy and the sharing of health data with the Canada Border Services Agency (CBSA), called Personal Health Information and Privacy in a Sanctuary City.

While privacy law, “in theory,” protects immigration status as personal health information, there are “discretionary windows” where healthcare professionals may disclose that information, says Hudson, who is also JD Program Director at Ryerson. Hudson recommends that Prime Minister Justin Trudeau, or the Privacy Commissioner of Canada Daniel Therrien, make a statement and an official policy that the CBSA “will not ask for, or in other ways attempt to get,” personal health information related to COVID. He also says the provincial government should clarify the conditions under which personal health information is shared with the CBSA.

“We know the provincial government is going to collect this information,” says Hudson. “It has to collect this information. The quickest solution is for the federal government just to say the CBSA is not going to try to get access to this information. And I don't think it's a big ask.”

Rebecca Purdy, acting manager of media relations at the CBSA, said in a statement to Law Times, "The Canada Border Services Agency does not use medical information to track or find individuals who may be subject to removal."

In March of 2020, Ontario’s policy was standard across the country: if a person was without a health card or federal interim health program documentation, that person would be charged for any health service. When the pandemic hit, advocacy efforts produced a policy change, says Hudson. Ontario pledged to provide “all medically necessary healthcare,” even to the uninsured, he says. The province gave hospitals and family clinics fee codes so they would be compensated, at OHIP rates, for those without health cards.

“That was a huge change that has never happened in the country before,” says Hudson.

As the global health emergency wore on, the policy was extended to COVID testing, and then to Vaccines.

“The difficulty has been that hospitals, clinics and other institutions have been operating under the old model,” he says.

The problem is illustrated in the province’s vaccine rollout, which lacks “central, consistent, clear messaging” about the information healthcare workers need to collect for a person to book an appointment, says Hudson. In the online booking system, OHIP number is a required field. Though the policy is clear that an OHIP number is not a necessity, hospitals, pharmacies and clinics – including Hudson’s own family doctor – are asking for them.

Inability to provide an OHIP number, in combination with “other markers of social difference,” such as an accent or particular skin colour, can lead a healthcare practitioner to infer about a person’s immigration status, he says.

This poor policy implementation acts as a disincentive for people lacking status to approach healthcare practitioners, says Hudson.

The rapidly changing health-policy regimes also have privacy law implications.

“Any information which is provided, used, disclosed or collected in the context of healthcare counts as personal health information,” he says. “And so, if somebody has asked for an OHIP card, and they say they don't have it, and follow-up questions are asked, or inferences are drawn, and records are kept indicating that individual lacks status – all of that instantaneously becomes legally protected under the Personal Health Information Protection Act.”

A person’s national origin is also expressly protected under the Freedom of Information and Protection of Privacy Act and its municipal equivalent.

But another difficulty is that privacy law is not “rights based,” says Hudson. Privacy is balanced with other values and interests that drive the circulation of information. In the context of a pandemic, the government needs this information circulation to decide how to allocate vaccines and whether to impose or lift emergency regulations, among other decisions, he says.

There are some exceptions built into privacy legislation, says Hudson. Health information, including immigration status, can be disclosed if a healthcare institution or practitioner is served with a court order. But without a court order, an institution or practitioner can still disclose this information to law enforcement to “aid a law enforcement investigation.”

“That little loophole – that discretion – provides a great deal of uncertainty about whether personal health information will be disclosed to the CBSA in the absence of a court order, he says. “And this is really what's going on.

“Migrants talk to each other. They talk to migrant rights organizations, community lawyers, and they understand that the way privacy law works, there's always a risk that some doctor or nurse somewhere, will interpret this legislation in such a way as to think they are either permitted or obligated, actually, to assist the CBSA, even in the absence of a court order.”