Your Rights to Personal Health Data

Along with twenty other patient organizations and individual advocates, the Gastrointestinal Society has endorsed the Declaration of Personal Health Data Rights in Canada.¹ People own their personal health data while stewards of that data own the records. Since people own their personal health data, they have corresponding rights over the personal health data they provide. In 2019, the Patients Redefining the Future of Healthcare in Canada Summit created a Working Group consisting of patients and caregivers to develop this essential document on the fundamental principles of ownership, accessibility, and privacy of personal health data. Below is an executive summary of the Declaration. Click here to read the full Declaration.

Declaration of Personal Health Data Rights in Canada

Right to be informed: Individuals have the right to formal notice prior to the collection of their personal health data. Individuals have the right to be informed, using concise, accessible, plain language, about how a steward will be processing or commercializing their personal health data.
Right to consent: Individuals have the right to consent, and withdraw consent, to the processing or commercialization of their personal health data. Different intended purposes require different degrees of consent, either implied consent or express consent, including healthcare provision and the circle of care; research for public beneﬁts using de-identiﬁed data; research using identiﬁable data; and commercial purposes.
Right to access, portability & correction: Individuals have the right to request a portable copy of the personal health data they provided to a steward and to the correction of their data where they identify inaccuracies. Individuals have the right to receive their data in a structured, commonly used, machine-readable format at no cost. For individuals without digital devices and/or internet, timely access will be provided to them in another format (e.g., hard copy), ideally at no cost.
Right to de-identiﬁcation: Whenever feasible and reasonable, individuals have the right for their personal health data to be de-identiﬁed prior to its being shared with anyone other than themselves or their circle of care for purposes for which they have given informed consent.
Right to beneﬁt: Individuals have the right to beneﬁt from their personal health data, including from their data being processed or shared for research or any other purposes. In order to beneﬁt, patients recognize the importance of sharing their personal health data, while recognizing stewards’ duty to respect, protect, and fulﬁll personal health data rights.
Right to object to processing: Individuals have the right to object to the non-care related processing of their personal health data, such as processing for direct marketing.
Right to restrict processing: Individuals have the right to restrict the processing of personal health data in speciﬁc situations, such as where the individual contests the accuracy of the data, or where the individual has objected to the processing of their data and is awaiting the decision of a complaint.
Right to a complaint process: Individuals have the right to a complaint process by their data protection authority if they believe the processing or commercialization of their personal health data violates legislation.
Right to privacy and security: Individuals have a right to have their personal health data processed in a way that meets current standards and regulations of privacy and security.
Right to erasure: Individuals have the right to request that their personal health data be erased, which is sometimes called the right to be forgotten. This right only applies in certain speciﬁc circumstances, such as where the data are no longer necessary for the purpose(s) for which they were processed.
Right to engagement: Patients, and their caregivers, have the right to be part of decision-making related to personal health data to ensure their views, perspectives, and values are meaningfully incorporated into decision-making processes.