After months of hesitation, a woman finally schedules her first mammogram. At her appointment, she shares details about her medical and family history, trusting that her personal data will be handled responsibly, securely stored, and kept private.
That trust deserves to be honoured. From that first appointment, her information begins to travel: to the radiologist who reads her scan, the laboratory that tests her biopsy, the oncologist who plans her treatment, the pharmacy that fills her prescriptions and the insurance company that helps her pay the costs. Each holds a piece of her story and, under Jamaica’s Data Protection Act, 2020, each is also responsible for protecting it.
Every October, Jamaica joins the world in observing Breast Cancer Awareness Month. We honour women fighting breast cancer, celebrate survivors and remember those we have lost. However, behind every statistic, is a mother, daughter, sister or friend whose dignity and privacy deserve protection.
Why the privacy of health records matters
The Data Protection Act treats health information as sensitive personal data, and for good reason. Even a list of the medications a patient receives can reveal her diagnosis. A breast cancer diagnosis is deeply personal. Shared carelessly, it can lead to stigma, gossip or unfair treatment at work, just when a woman most needs support. In the wrong hands, that information can be used to embarrass, defraud or otherwise exploit her. No woman should hesitate to get screened because she fears who might find out or what could happen.
Protecting health data is not only about keeping it private. It is also about keeping it safe and ensuring it is available when needed. When Hurricane Melissa struck last October, paper records at some western hospitals were damaged beyond recovery. Such damage could result in doctors having to recreate medical histories from scratch and even some patients having to repeat expensive and, often difficult to schedule, laboratory tests. For a woman undergoing cancer treatment, a missing record can mean delays she cannot afford.
Digital recordkeeping gives doctors quicker access to a patient’s history and medication making healthcare faster and more reliable. However, recent cyber incidents involving health information show that the risks to digital records are just as great. As more health facilities move to electronic record storage, data protection matters even more.
This is why the Act requires organisations to guard against, not just theft, but also accidental loss and destruction of personal data, including health records. Hospitals, clinics or health centres, and doctor’s offices must implement disaster risk management and recovery plans which ensure the availability and accessibility of health records even in the event of physical destruction.
Digital health records must be properly secured, with access limited to those who need it to provide care, and with backups that keep them safe. This usually involves having electronic copies of records stored on premises and offsite as well as ‘in the cloud’.
How the law protects the privacy of your health data
Under the law, hospitals, clinics, laboratories, pharmacies, insurers and others that handle personal data must:
collect only information necessary for a specific purpose and use it only for that purpose – do not collect a patient’s medical history to inform a diagnosis then use it to market other products and services;
keep it accurate and up-to-date – Inaccurate or outdated health records can result in patients being wrongly treated with dire consequences;
protect it from unauthorised access, and from accidental loss, damage or destruction – ensure it is available to authorized medical personnel, other health service providers, and to the patient when required, including transferable in usable format to another service provider, if requested by the patient;
appoint a data protection officer who can, among other things, assist in facilitating patients’ access to information about their health data – patients have the right to know what data is held, what it is being used for, who it is shared with, and for how long it will be kept;
keep it no longer than necessary, and dispose of it securely – reduce the risk of sensitive heath data being misused, especially in ways that cause patients substantial damage or distress; and
implement technical measures to prevent data breaches and, in the event of a breach, report it to the Information Commissioner and notify affected persons within 72 hours.
Patients who believe their data has been mishandled or who have concerns organisations have not resolved, may submit a complaint to the Office of the Information Commissioner.
Putting pink into practice with privacy protection
This October, as you wear your pink ribbons and book your cancer screening, don’t be afraid to ask your healthcare provider how your health data is being protected and encourage others you love to do the same. Seeking care and protecting your privacy are not competing priorities; they go hand in hand.
Additionally, if you know a woman or any person who has been diagnosed with breast or another cancer, respect their privacy too. An individual’s diagnosis is never ours to share, however good our intentions. Do not post it in a group chat or on social media. Protect the person behind the pink.