LCQ17: Transfer of patients' personal data by Hospital Authority to other organisations
***************************************************************************************
Question:
It has been reported that the Hospital Authority (HA) has transferred patients' personal data to the Faculty of Medicine of The Chinese University of Hong Kong (the Faculty of Medicine) each year since 2010 to facilitate the conduct of a Patient Experience Survey through telephone interviews by the Faculty of Medicine. A respondent has recently complained that HA has transferred her personal data (including consultation records) to the Faculty of Medicine without her consent. In this connection, will the Government inform this Council if it knows:
(1) the quantity and contents of the patients' personal data that were transferred by HA to other organisations in each of the past three years, with a breakdown by reason for the transfer and name of organisation;
(2) whether HA had, prior to transferring the patients' personal data mentioned in (1) to other organisations, obtained the consent of each data subject; if HA had, of the relevant procedure and details; if not, the reasons for that, and whether the authorities have assessed if such a practice has contravened the Personal Data (Privacy) Ordinance (Cap 486); if the authorities have assessed and the outcome is in the affirmative, of the authorities' remedial measures and law enforcement actions; and
(3) (i) how the organisations to whom HA has transferred patients' personal data store such data, (ii) at what stage they destroy the data, and (iii) whether they have transferred the data to other organisations; if they have, of the details?
Reply:
President,
My consolidated reply to the various parts of the question raised by the Hon Lam Cheuk-ting is as follows:
To understand the needs of patients for continuous service monitoring and enhancement, the Hospital Authority (HA) regularly conducts Patient Experience Surveys (PES) on in-patient, specialist out-patient or other specialty services. Through an open tender and by contractual means, HA commissioned the Jockey Club School of Public Health and Primary Care (JCSPHPC), Faculty of Medicine, The Chinese University of Hong Kong to assist HA in conducting PES on three major service areas, namely Accident and Emergency, in-patient and specialist out-patient services, from 2016 to 2018. Patients' experience and feedback on HA's services are collected by way of telephone interviews. No other organisations are involved in the conduct of the surveys. The survey results will be in a non-patient identifiable form, and only show the respondents' overall ratings on HA's services, as well as their general demographic information and health profile.
In accordance with the Personal Data (Privacy) Ordinance (PDPO) and the information provided by the Office of the Privacy Commissioner for Personal Data, HA, as the data user, protects personal data entrusted to the JCSPHPC (i.e. the data processor) mainly by contractual means, including specifying and monitoring the security measures required to be taken by the JCSPHPC. For example, timely return, destruction or deletion of the personal data entrusted for processing; prohibition against any use or disclosure of the personal data for other purposes; and prohibition against sub-contracting the provision of the service entrusted without HA's consent. In addition to contractual regulation, HA has appointed members of the JCSPHPC research and telephone interview teams as its honorary staff to ensure the proper conduct of PES. Under contractual regulation and in the capacity of honorary staff, both teams are authorised to carry out the surveys. Same as HA staff, the honorary staff are required to comply strictly with HA's guidelines and PDPO in processing personal data.
The data of randomly selected patients will be provided to the JCSPHPC telephone interview team. The quantity of patient data obtained by the interview team in the past three years is set out in the table below:
| Quantity of patients' data | No. of respondents | |
|---|---|---|
| 2016 Patient Experience and Satisfaction Survey on Accident and Emergency Service | 17 739 | 9 317 |
| 2017 Patient Experience Survey on In-patient Service | 14 000 | 9 921 |
| 2018 Patient Experience Survey on Specialist Out-patient Service (as at October 12, 2018) |
16 700 | Survey not yet completed |
Only basic and necessary data of patients have been kept by the interview team to facilitate their obtaining patient consent and conducting the surveys. For example, in the 2018 PES on specialist out-patient service, the data of a patient obtained by the interview team include the patient's name, contact number, sex, age, residential district and information about his/her specialist out-patient clinic attendance (including name of hospital/clinic, type of specialist service, dates of consultation and date of next follow-up appointment). The interview team is required to clearly explain to the patients that JCSPHPC is commissioned by HA to conduct this survey. The interview team is also required to obtain patients' verbal consent on behalf of HA before conducting telephone interviews with the patients. Patients have the right to consent or refuse to participate in the survey, and to withdraw at any time from the survey or refuse to answer any questions during the survey. All data collected will be handled in strict confidence and used solely for survey purpose. After completion of the interview, feedback from patients who have agreed to participate in the survey will be passed to the research team in a non-patient identifiable form for analysis.
HA has posted a "notice to patient" at public hospitals/clinics to explain the purposes and practice of collecting or disclosing patients' personal data. It is stated in the notice that HA staff may ask a patient to provide personal data (including health information) or obtain from HA/HA Entity/any appropriate third party the patient's medical history/relevant information. Such information is for purposes relating to the patient's healthcare/general related purposes (including, but not limited to, treatment, charges levied by HA/HA Entities on the patient, research and education).
In order to let the public understand the purposes, format and the service aspects covered by PES, HA has proactively and extensively promulgated the survey at public hospitals/clinics before commencement of the survey. Ways of promulgation include setting up roll-up banners and posters at prominent locations, distribution of information leaflets and issuing press release to appeal for active participation of patients.
The HA understands the public’s concern about personal privacy. To avoid unnecessary misunderstanding in future, work related to telephone interviews is now divided into two parts. HA will first obtain patient consent in line with the above practice. The data of the consented patients will then be given to the interview team for conducting detailed telephone surveys.
The JCSPHPC has stringent measures to ensure proper storage of the data concerned. During the survey period, all documents containing patients' personal data will be locked in the cabinets of the team's office and the keys will be kept by designated persons. All patient information will be destroyed under the supervision of HA staff upon completion of the surveys. The JCSPHPC will not transfer any information provided by HA to other organisations.
From time to time, HA may commission other institutions to conduct research on different subjects. If the research involves patients' personal data, HA will protect the data by contractual means in accordance with PDPO.
Ends/Wednesday, October 31, 2018
Issued at HKT 15:55
Issued at HKT 15:55
NNNN