top of page
Search

Integrated Insights: Health Information and Privacy


In my work as an Ethics Officer with the Health Research Ethics Board of Alberta (HREBA) privacy of personal health information is an issue that is discussed daily and at length. Our process includes a rigorous review of health research involving human participants to ensure both scientific and statistical validity, as well as the safety of participants and protection of their health information. While research is inherently results driven, results cannot be achieved without participants taking part in the studies, either directly (e.g., a participant taking a new drug) or indirectly (e.g., providing health data). Throughout the MHST 601: Critical Foundations in Health Disciplines course, we have analyzed health from the ground up. Starting with the policies involved in managing health, its definition, the determinants of health, multiple levels of influence that determine health outcomes, prevention and management of chronic disease, vulnerable populations and future directions in health. We will delve in to how privacy of information interweaves with and impacts these topics and will explore striking the right balance between the protection of information and the access to the same information to ensure optimal health outcomes.

In Alberta, gathering health information must follow the rules set by the Health Information Act (HIA). The HIA, “strikes a balance between the protection of privacy and enabling the appropriate amount of information sharing to provide health services and manage the health system.” (Government of Alberta, 2024). When health research is approved by a Research Ethics Board the study teams can then request access to Health Information within the parameters of the study. This process is overseen by the Office of the Information and Privacy Commissioner of Alberta (OIPC) (Office of the Information and Privacy Commissioner of Alberta, 2025). The basic principle is that, for health research to advance, access to some health information is needed. The HIA allows for the access of information while limiting the use to only the information needed for a particular project or time point. Additionally, the HIA protects research participants by limiting the spread of their identifiable information after it’s collected. This means that the sponsor only receives the data from the study and nothing with which to identify the participants. While this Act is an innovative piece of legislation, it is not without its faults. In a conversation during a conference in 2023 with the Privacy Commissioner of Alberta, Diane McLeod, stated that her office is in the midst of interpreting the Health Information Act, with hopes to update any shortcomings (McLeod, 2023). The Act, in its current form is open to interpretation, which leads to researchers and REB’s having to decide whether the collection of information is appropriate and justified. Clearer rules are needed. Besides the issues with enacting privacy legislation, health research continues to advance and request more access to more information. Naturally, despite attempts at mitigating privacy breaches, mistakes will happen; efforts to safeguard privacy are therefore a necessary byproduct to the research process.

When considering privacy, it is also important to remember that too much privacy can lead to negative outcomes. At a conference held by the Alberta Clinical Research Consortium (ACRC), Dr. Ewan Affleck spoke about a patient of his that had ‘fallen through the cracks’. His patient had multiple health problems and accessed multiple specialists to treat them; however, the specialists did not talk or share data with each other, as the protection of critical health information was too restrictive. Dr. Affleck sarcastically stated that at least his patient died a private death (Affleck, 2023). This story has stayed with me and served as a poignant reminder that the sharing of information must occur between and within health services to best serve the people we are trying to protect. This becomes even more clear when we consider the things external to the individual, that influence and determine someone’s health. With so many variables that affect health, we start by defining ‘health’ and how information access fits within a health framework.

The ‘current’ definition of health was penned by the World Health Organization in 1948 which stated that health is, “a state of complete physical, mental, and social well-being and not merely the absence of disease or infirmity" (Huber, 2011). In my earlier blog post titled “What Is Health?” it is suggested that the definition of health must now be reconsidered to account for advances in technology, diagnostics, early intervention, treatment and a person’s capacity to change. I posited that this new definition should be done in broad strokes to allow a person to be deemed healthy while living with a disease or condition and managing it well (Mallett, 2025a). However, considering privacy of health information, perhaps ‘broad strokes’ are ill advised. If we consider what wellness entails, a vast array of additional professionals and services appear. For example, Massage therapists, physiotherapists, nutritionists, fitness instructors, nail technicians, etc. As the HIA states, finding balance between keeping information private and allowing access to it, it is important to consider where the passing of information must end. The new definition of health requires limits as to who can have access to health information, or institute a list of rules for when it is appropriate and only in the scope with which it is needed. While the new definition should incorporate some limits to the spread and access of information it also needs to consider the external factors that influence health.

A new definition of health and all that it encompasses must also consider determinants of a person’s health. As detailed in my previous blog post titled “Determinants of Health: A Canadian and Alberta Perspective” (Mallett, 2025b) Alberta considers the determinants of health to be, “Income and Social Status, Social Support Networks, Education and Literacy, Employment and Working Conditions, Social Environments, Physical Environments, Personal Health Practices and Coping Skills, Healthy Child Development, Biology and Genetic Endowment, Health Services, Gender, Culture." (Alberta Health Services, n.d.). Consider how this information is currently shared with health professionals. Generally, most would come from a self report and the accuracy of the information would depend on a person’s willingness to disclose it. In health research it is important to have an accurate picture of a participant’s health and factors which may influence it. Extraneous variables that are not accounted for can skew data and offer misleading results. It is an interesting conundrum to consider the HIA’s rules when looking at self-reported factors that influence health. Should highly subjective items like recreational drug use be included in a chart? And if it is expected that a person’s health chart includes absolute, minute detail about a person’s life, what gets shared with whom? In an article written by Robert Brook, he suggests that a measure of tolerance be added to medical charts. This would include whether a person had strong feelings towards different races, genders, cultures, etc. (2017). This, in my opinion, is a fabulous depiction of taking and using too much information. What we know is we need our health information available in various priorities, from medical emergencies to private interest. As the definition of health evolves with our understanding of ourselves, so to must our ability to access health information.

Along with an individual’s determinants of health, there are multiple levels of influence that go beyond the scope of the individual. In my previous blog post “Asthma Care Revolution: The Power of Multi-Level Models” we walk through a specific instance of the multiple levels of influence on a person’s health. The levels can include individual, societal, environmental, institutional and legislative (Mallett, 2025c). These consider things like school, workplace, and culture to add complexity to an individual’s life and health. Currently much of these are measured informally, but the disclosure of this information has risks. Certainly, some disclosure of information is needed in everyday life, but may not always be the positive outcome we expect. For instance, a child who has been diagnosed with cancer may tell their school in order to access accommodations. However, consider a veteran who receives a diagnosis of depression who discloses this to an insurance company and is unable to receive life insurance. The release of information has consequences. Individuals must be reminded of what health information they must disclose and what can be kept private. This is especially relevant to people living with chronic diseases, where health care visits can be frequent.          

In my previous blog post titled “Chronic Disease Surveillance and Management in Alberta” I mention that Alberta is unique in that we house one health organization and one data set. (Mallett, 2025e). Alberta’s health data is special because it maintains a mature data ecosystem with linkable data going back over 30 years (Svenson, et.al., 2018). This not only makes Alberta a prime target of population-based research but provides a multitude of information about all thing’s health related. For instance, Alberta’s Tomorrow Project is currently tracking the health of 55,000 adults to investigate why some people are more likely to develop cancer or other chronic diseases. The data will continue to be gathered over the next few decades and hopes to shape how illnesses are detected, diagnosed, treated and prevented. (Alberta’s Tomorrow Project, 2021). A broader definition of health would lead to an increase of health research as more avenues would be considered ‘health’. This would have more researchers accessing more health data over longer periods of time than ever before. And while this may lead to amazing preventative care and treatment options the consideration of privacy must be acknowledged. As health definitions expand, so to should the umbrella of privacy protection. The recurring idea of balance must be maintained, both for the protection of individuals and the sub-sets of the population we each belong to.

At the legislative level we have the HIA and the OIPC which work in tandem to ensure that only the ‘right amount’ of information is shared. Is the right amount always the same between people and uses of data? The new definition of health is working to address the scale of appropriate uses of data. It maintains the subjectivity and flexibility in order to ensure the appropriate information and amounts thereof are managed and used to best serve the patient. An updated HIA and definition of health could assist each other in determining the best way forward for appropriate use of information and elevated patient care. Along with people living with chronic disease, other vulnerable populations must be considered as we move towards updating the HIA and definition of health.

Members of the Indigenous community and other vulnerable populations have historically lost trust with the health system. In the past, trust has been broken as detailed in my previous blog post titled, ‘Improving Health Research Engagement with First Nations, Metis, and Indigenous (FNMI) Communities’. Research has been carried out without the permission or knowledge of the person with little to no consequence on the researchers and little to no benefit to the participant (Mallett, 2025d). In order to move into a new definition of health with its potential for increased health research and access to health data, vulnerable populations need to be considered. The health system and the researchers must give all participants a reason to trust the appropriate use of their sensitive information. This means clearly communicating what information is being collected, how it will be used, how it will be protected and participant recourse options. The mistakes of the past need to be acknowledged as we move into the future of health care.

Future trends that we have started to see in research include an increase in genetic testing and use of genetic data. In the HREBA template for Informed consent, when informing a participant of potential risks of joining a study that involves genetic testing it states that if their data is compromised there may be risks to eligibility of employment, life insurance, mortgage insurance or private health insurance should the results of genetic testing be inadvertently disclosed to certain parties (Health Research Ethics Board of Alberta, 2018). Participants are assured that their samples will be stripped of any identifiable markers (name, date of birth, etc.) however, the security of their data can not be 100% guaranteed. This has become an issue of great publicity lately with the bankruptcy of 23 and Me. The genetic information of their entire database now faces an uncertain future as the company and its assets are up for sale and people with 23 and Me accounts have been encouraged to go and delete their genetic data by withdrawing their consent for use of their information and deleting the information permanently from the online database (Stechyson, 2025). Time will tell how health information legislation approaches this topic. While we hope privacy safeguards will improve and adapt, this serves as a good reminder that policy is reactionary and constantly evolving.

Safeguarding information that is unique to each person must be considered in the ever-changing landscape of health and health research. A new definition of health is needed to expand what ‘healthy’ means and increase access to care for Albertans. There is a balance to be reached between delivering healthcare, facilitating useful and valid research, and privacy.

As research progresses and more health information data is collected, the risks of inappropriate use also rise; this can be seen with the unfortunate consequences of 23 and Me’s insolvency. Obviously denying access to all health information is not an option; nor can we remove all privacy protections. Our healthcare systems must continue to function, research will carry on, and mistakes will happen. Supporting the development of good policy and legislation is in everyone’s best interests: from the general public, to health research, to those that lost trust in the system.





References

Affleck, E. (2023, September 25-26). Data and digital health enabling future care [Conference

Presentation]. ACRC 2023 Annual Conference, Edmonton, AB, Canada.

Alberta's Tomorrow Project. (2021). Home Page. Retrieved from https://myatp.ca/  

Brook, R. H. (2017). Should the definition of health include a measure of tolerance? JAMA,

Government of Alberta. (2024, December 20). Health Information Act. Alberta.ca.

Health Research Ethics Board of Alberta. (2018, August). Informed consent template: Standard

research studies. HREBA.ca. https://hreba.ca/wp-content/uploads/2018/08/Informed- Consent-Template-Standard-Research-Studies-CTC-Aug-2018.pdf

Huber, M. (2011). Health: How should we define it? British Medical Journal, 343, (7817), 235-

Mallett, K. (2025a, February 07). What is health. Professional E-Portfolio. Retrieved from

Mallett, K. (2025b, February 13). Determinants of health: A Canadian and Albertan perspective.

Professional E-Portfolio. Retrieved from https://kmallett3.wixsite.com/professional- eportfo/post/determinants-of-health-a-canadian-and-albertan-perspective

Mallett, K. (2025c, March 06). Asthma care revolution: The power of multi-level models. 

Professional E-Portfolio. Retrieved from https://kmallett3.wixsite.com/professional- eportfo/post/asthma-care-revolution-the-power-of-multi-level-models

Mallett, K. (2025d, March 24). Improving health research engagement with First Nations, Métis,

and Indigenous (FNMI) communities. Professional E-Portfolio. Retrieved from https://kmallett3.wixsite.com/professional-eportfo/post/improving-health-research- engagement-with-first-nations-metis-and-indigenous-fnmi-communities

Mallett, K. (2025e, March 24). Chronic disease surveillance and management in Alberta.

Professional E-Portfolio. Retrieved from https://kmallett3.wixsite.com/professional- eportfo/post/chronic-disease-surveillance-and-management-in-alberta

McLeod, D. (2023, September). Office of the Information and Privacy Commissioner

[Presentation on privacy and the Health Information Act]. Banff, Alberta, Canada.

Office of the Information and Privacy Commissioner of Alberta. (2025). What we do.

Smith, J., & Jones, A. (2022). Social determinants of health. Journal of Public Health, 45(3),

123-135.

Stechyson, N. (2025, March 25). What happens to your DNA data now that 23andMe has filed

for bankruptcy? CBC News. https://www.cbc.ca/news/business/23andme-data- security-1.7492589

 
 
 

Comentarios

bottom of page