Healthcare providers who fail to adhere to requests for data will no longer face the threat of prison.

The Bermuda Health Council Amendment Act 2024, passed 18-5 in the House of Assembly, had stipulated that failure to give statutorily required information designed to reduce healthcare costs could result in a person being jailed or fined, or both.

After a fierce backlash from the health industry, health minister Kim Wilson announced an about-turn and said the Act would be amended in the Senate.

However, despite the amendment removing the prison threat being approved by senators yesterday, the legislation was still criticised as being deeply flawed.

The Act allows the Bermuda Health Council, “upon the direction of the minister, to require licensed health service providers, licensed insurers, and approved schemes to provide information necessary to support objective decision making with respect to, among other things, universal health coverage”.

In the House, Ms Wilson said that one of the legislation’s principal objectives was to allow for the collection of data “necessary for improving healthcare outcomes and ensuring equitable access to services”.

One Bermuda Alliance senator, Douglas De Couto said his party recognised the importance of improving healthcare in terms of outcomes, the resources required and the need for informed decision making.

“But we cannot support this Bill,” he added. “From where we sit, this Bill does not support those objectives. It is too broad and is not appropriately tailored.”

He said even with the amendment there were “numerous other issues”.

“I cannot recall a piece of legislation that has engendered such a spirited, such an emotional, such an outpouring of response to us from the stakeholders.

“Since the Bill was originally passed, the OBA has had numerous consultations with medical professionals and we have had the opportunity to learn about the many issues with this Bill.

“It is very open-ended about the amount of data that can be collected and we will have to trust future rules and regulations that have not appeared yet.

“Many of the stakeholders are worried about arbitrary data sweeps and overly broad discretion. Many of the smaller operators are also concerned about the costs.”

On the handling of data, Dr De Couto said: “This Bill only mandates that patient names be hidden. That leaves the rest up to the discretion of the health council.”

He said the OBA was concerned the Bill was not consistent with privacy laws under Pipa, adding that medical professionals had also raised that concern.

Dr De Couto also asked: “Does the health council have the appropriate data retention policies, who will have access?”

He said what should have been “a mutually constructive and collaborative process” between the medical professionals and that the Government had turned the process into “a carrot-and-stick exercise that seems to have a little more stick than carrot”.

Independent senators John Wight and Kiernan Bell both said they could not support the legislation.

While Mr Wight said he could appreciate the need for the health council to require information, he questioned the level of consultation.

“The very fact that there has been such strong opposition to the Bill by the medical profession following its recent passing in the House tells me that the collaboration required did not adequately take place.”

He said the Bermuda Health Council Act 2004 stated that licensed healthcare service providers were required to “supply returns, statistics and other information that the council may by notice of writing require”.

“This wording has been in existence for almost 20 years and I am not aware of any material complaints from the application of this wording over that long period.

“Fast forward to 2024 and that wording becomes broader. While we understand the need for the health council to obtain information to achieve its goals, healthcare practices are staffed to prioritise patient care.

“We do not want patient-care outcomes to be adversely impacted by a sudden need to provide administrative services relating to this amendment.”

Ms Bell asked a series of questions, including whether there had been any consideration to adding a provision stating it was the health council’s duty to “ensure the safe and secure collection, analysis and dissemination of healthcare data”.

She asked whether anyone was employed at the council as a data protection officer, a privacy officer or a chief information security officer.

Ms Bell questioned if the council had a data protection impact assessment template to help identify and mitigate potential data protection risks to an acceptable level before requesting information.

She also asked whether the legislation met Pipa requirements and added: “Put bluntly the proposed Bill in its current form makes insufficient provision to safeguard our personal health information.”

She added: “This Bill is not concerned with the data that belongs with health insurers, doctors, nutritionists, occupational therapists or any other licensed health service provider.

“It is concerned with my data, your data and your family’s data, and the data of every single person living in Bermuda today.”

In response, government senator Arianna Hodgson gave a series of assurances over the collection and use of data.

She said data access would be provided only to those who needed it to fulfil their job duties and that the health council had a ring-fenced data analytics team. The council also has encrypted folders and two-factor authentication.

Ms Hodgson insisted the Act complied with Pipa, that there had been discussions with the Privacy Commissioner, and that the health council had a privacy officer and would abide by all Pipa provisions.

On consultation, Ms Hodgson said more was to come as “we move forward with the implementation” of the Act.

“The Ministry of Health and the health council collect data at a population level. We do not collect or store any information that would identify a specific individual or their families,” said the senator.

“This amendment is not about collecting personal health data. The data will absolutely not include anything identifiable relating to the physical or mental health of any individual.”

Ms Hodgson said there was a list of data that the health council would not be collecting, such as any information that identified individual patients or their medical histories, medical diagnosis, doctor patient conversations, social insurance numbers, religious and sexual orientation, financial information or DNA.

“I want all people to note that their personal information will remain private and confidential. It is important to understand that a person’s privacy will be maintained.

“Privacy is of utmost importance and any data collection involving identifiable information will require explicit justification and will be subject to rigorous oversight to protect sensitive information.

“Extensive stakeholder engagement has been a priority throughout this process and it will continue to be a priority.

“The intention is to enable the health council to collect the necessary data to help in healthcare delivery and oversight and it was designed with safeguards in place to prevent misuse.”

The legislation will now go back to the House of Assembly.