Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities

Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities Int J Ment Health Addiction (2018) 16:545–572 https://doi.org/10.1007/s11469-018-9904-x ORIGINAL ARTICLE Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities 1 1 1 Nazilla Khanlou & Anne Mantini & Attia Khan & 2 3 Katie Degendorfer & Masood Zangeneh Published online: 18 April 2018 # The Author(s) 2018 Abstract Protection of privacy of information for young adults with developmental disabil- ities and their families is essential to promote quality of life, well-being, empowerment, and inclusion. Despite this, the young adults’ information privacy rights are increasingly at risk. This paper provides a scoping review, applying Arksey and O’Malley’s(2005) approach, of all published peer-reviewed journal articles and gray literature to examine the barriers and facilitators in utilization of legislation that protects the collection, use, disclosure, and access of personal information in Canada. The scoping review process was further expanded with a rigorous reliability method and applied a socio-ecological framework to the final 47 studies. National and international policy and legislation (macro level), organization-based factors (meso), young adults and community interactions (exo), and individual disability related factors (micro) are examined. The review identifies the barriers and highlights the importance of facilitators for acting on personal privacy rights. . . . . . Keywords Information privacy rights Canada PIPEDA PHIPA Confidentiality Personal information protection Young adults with developmental disabilities (YADD) and their families are at risk of exploitation in terms of privacy and protection of their personal information (Joffe, 2010). Their increasing dependency on multiple community-based and private agencies creates a scenario where a wide range of personal information is retained and shared through the course of servicing these individuals and their families over time. YADD are vulnerable not only * Nazilla Khanlou nkhanlou@yorku.ca; http://nkhanlou.info.yorku.ca York University, 4700 Keele St., Toronto, ON M3J 1P3, Canada Toronto, Canada University of Guelph-Humber, 207 Humber College Blvd, Etobicoke, ON M9W 5L7, Canada 546 Int J Ment Health Addiction (2018) 16:545–572 because they are in a sensitive period transitioning into adulthood but also as they have complex developmental needs and may experience difficulties making their own decisions (Dyke et al., 2016). They may also have concurrent health and mental health needs which require support, and even as adults may frequently depend on secondary decision makers to protect their privacy of information rights (Geist, 2016). Developmental disabilities (DDs), which include intellectual disability, autism, down syndrome, fragile x syndrome, cerebral palsy, and developmental delays, are lifelong and affect multiple aspects of psychosocial development, physical functioning, and participation in daily activities (Developmental Services Ontario (DSO), 2016; Roebuck et al., 2008). Indi- viduals with DDs may have deficits in their cognitive, decision-making, comprehension, and communication capacity (Roebuck et al., 2008) that increases their exposure to human rights violations related to privacy of information (Fogden et al., 2016). They or their family caregivers and service providers often do not have the necessary resources to defend their privacy rights to personal information. While legislation in Canada is well developed and in place to guide the protection of personal information (e.g., Personal Information Protection and Electronic Documents Act (PIPEDA), 2000), and health information for individuals (e.g., Personal Health Information Protection Act (PHIPA), 2004), the translation of relevant legislation as required for individ- uals at-risk of understanding or communicating their rights is not. This impression is informed by our findings from our recent and on-going research studies on families of children and young adults with developmental disabilities (Khanlou et al., 2017a; Khanlou et al., 2017c; Khanlou, 2018). During the data collection phase of these projects, family caregivers, service providers, and YADD frequently reported concerns they faced with the collection and use of their personal information. Specifically, they relayed concerns about the extensive paper work, dispersed services, navigation across multiple service sectors with repetition of requests for personal information, financial difficulties, social isolation, and stigma. Immigrant family caregivers of YADD faced additional information privacy concerns specific to language fluency, lack of social networks, and new knowledge required post-migration of service delivery systems and their rights, which were reported to affect their access to and utilization of health and social services (Khanlou et al., 2017a; Khanlou et al., 2017b; Khanlou et al., 2017c; Khanlou, 2018). Their concerns and these factors influence the privacy rights of YADD in a challenging manner. Many YADD and their parents continue to remain uncertain as to who is accountable for the protection of their privacy rights given the complexity and persistence of developmental challenges of the young adults. In Ontario, Canada, persons with DDs are permitted to remain in their secondary school until they reach 21 years of age. Thus, even though they are adults as of 18 years of age, their privacy and confidentiality rights are largely protected by the adherence to privacy laws within their school environment. However, following completion of school, the young adults with developmental disabilities can take different pathways ranging from partial employment, volunteer work, vocational training, day programs, or to no involvement in activities outside the home. Once these young adults leave the protection of their school settings, they are increasingly dependent on both private and public agencies from within both the social and health sectors. This dependency on multiple organizations to provide needed services, super- vision, care, employment, or education— commercially based or not—increases dramatically as the young adults transition into adulthood. Given the significant gap between application of relevant legislation or information privacy evidence and the needs of young adults with developmental disabilities, the Int J Ment Health Addiction (2018) 16:545–572 547 YADD Privacy Project was developed (Khanlou, et al., 2017b). As part of the project, a methodologically rigorous scoping review was conducted to address this gap by synthe- sizing evidence on information privacy rights for YADD in Canada. The goals of this comprehensive scoping review of both published peer-reviewed articles and online gray literature were to: (1) examine the range, depth and nature of both the scholarly and gray literature related to access to privacy of information rights and utilization of legislation in Canada for the provision of services to young adults with developmental disabilities (PIPEDA, 2000 or PHIPA, 2004), (2) apply a socio-ecological framework (Bronfenbrenner & Ceci, 1994) to the findings to illustrate the barriers and facilitators of information privacy rights for young adults with developmental disabilities, and (3) to contribute to the development of future strategies and solutions enhancing information privacy rights with evidence-based recommendations. Methods Our protocol was developed using the scoping review methodology proposed by Arksey and O’Malley (2005), which has a five-step process for conducting scoping reviews. This method entails (1) identification of the research question, (2) identification of relevant studies, (3) study selection, (4) charting the data, and (5) synthesizing and reporting of the results. In addition, we refined the scoping review process to increase methodological rigor, by including three more components as suggested by Tricco et al. (2016) and Colquhoun et al. (2014) and their colleagues, including establishing a protocol, utilizing at least two reviewers and calculation of reliability, a reporting checklist, and conducting a consultation exercise to ensure our results are useful to advancing the field. Step 1 We identified the research question as follows, BWhat does the scholarly and grey literature on information privacy in relation to PIPEDA or PHIPA inform us about the barriers and facilitators young adults with developmental disabilities encounter when accessing and utilizing their privacy rights?^ Step 2 Next, relevant peer-reviewed studies were identified by searching electronic databases: ProQuest, JSTOR, Scholars Portal, EBSCO, Web of Science, PubMed, PsychINFO, Scopus, and CANLII (for legal cases and briefs), using specific search terms: PIPEDA OR PHIPA OR information privacy AND developmental disabilities AND Canada. The gray literature search was conducted using the Google search engine, and keywords/phrases were either (a) barriers to PIPEDA for young adults with devel- opmental disabilities in Canada or (b) barriers to PHIPA for young adults with develop- mental disabilities in Canada. The database searchers were not limited by language or type of publication, but location for keywords was restricted to Canada. Specifically, we searched Google Search and websites of agencies that service YADD. The electronic searches retrieved 9299 articles (Fig. 1), and 25 articles through hand searching. Ten duplicates were removed. Search and keyword strategy were developed by research team members and approved by the study Principle Investigator and the health sciences librarian. Step 3 Abstracts of identified articles were reviewed to assess if they met the inclusion and exclusion criteria. Articles were eligible if they were written in a 548 Int J Ment Health Addiction (2018) 16:545–572 Initial Search Results total: 1)Academic Databases = 2068 JSTOR, Scholars Portal, CINAHL, ProQuest, Web of Science, PubMed, PsychINFO, SCOPUS, CANLII 2)Grey Literature = 7,231 Hit Google N=9,299 Articles removed through Title and Abstract screening: Duplicates Removed: Academic Databases= 2062 Grey Literature = 7195 hits n=10 Reasons for exclusion: Not DD population, related to prescribing/medical interventions only or related to privacy in residential settings or to human rights for those with disability in general. Full-Text Articles n= 9257 Assessed for Eligibility: Academic Databases = 6 Grey Literature = 26 n=32 Full text articles removed: Hand searched articles for inclusion: Reasons for exclusion: Press release, news letter =4 n=25 No relevancy = 3; Duplicates=2 n=10 Studies Included for Data Charting & Analysis: n=47 Fig. 1 Information privacy rights PRISMA diagram peer-reviewed journal or published online, including policy documents, websites, and commentary, between January of 2000 and November of 2017. All titles and abstracts were individually examined by the reviewers AM and AK. We excluded any articles or gray literature that was aimed at the general population or cited the legislation without detailed explanation or information on application in servicing YADD. Articles not pertaining to access to or utilization of privacy legislation were excluded. Abstracts were included if they described issues related to PIPEDA or PHIPA and legislation with young adults with developmental disabilities. We in- cluded articles based on other populations (e.g. physical disability, and mental illness) and countries (EU) and USA) only if their findings were also relevant to Int J Ment Health Addiction (2018) 16:545–572 549 the developmental disability community. Articles discussing children and youth under the age of 16 were not included, and studies of adults were only included if a large portion of the reported sample in the study included young adults under 28 years of age. To ensure comprehensiveness in the evidence base, we also supplemented our list of included articles with academic literature that discussed information privacy with similarly vulnerable populations (e.g., those with mental health or decision-making capacity issues). We included studies conducted outside of Canada when findings were informative for barriers and facilitators of privacy legislation. Forty-seven articles (24 peer-reviewed and 23 gray literature) fulfilled the eligibility criteria for the scoping review. Step 4 Information was captured on Excel 2011. To ensure reliability between reviewers, a series of training exercises were conducted and inter-rater agreement for both the study inclusion and data charting phases. Changes were made based on feedback until there was consensus regarding the face validity of the tool by the two reviewers. A total of 10 randomly selected articles were evaluated by two reviewers, and 5 by three reviewers, to assess the level of agreement across all categories for each article. Reliability for level of agreement on items on the abstraction form ranged from 61 to 96%. Given the high degree of variability among the published and gray literature, the mean level of agreement obtained (79.5%) was deemed to be sufficient. All changes were verified by reviewers to ensure data accuracy. Results All analyzed articles described legislation focused on information privacy rights, in relation to collection, use, disclosure or sharing and correction, or access for checking. Eighty percent of the articles (peer-reviewed published and gray literature) also ad- dressed confidentiality and/or autonomy while only 6 articles (12%) reviewed ethical issues related to accountability on the part of the service organization. Full-length manuscripts, case studies, legislative acts, policy reports, professional practice guide- lines, service provider resources as well as literature and policy reviews were obtained for all abstracts identified for inclusion by both reviewers. Location Fifty-one percent of the 47 articles included for full text review and synthesis represented peer-reviewed published articles and 48% represented documents selected through the gray literature search. Of the published articles, five were based in the USA and three in the EU. Population While 39 articles were related to young adults with developmental disability, 8 articles from the published and gray literature did not discuss young adults or developmental disability, but to consumers of technology (n = 4), genetic researchers (n = 1), and patients with mental health diagnoses (n =3). 550 Int J Ment Health Addiction (2018) 16:545–572 Legal and Ethical Themes Within the whole sample (n = 47), all articles discussed relevant legal and ethical issues but through a variety of sub-themes. Fifty-five percent of articles discussed collection of personal information, while 42 to 45% focused on use disclosure of personal information and 25% discussed the legal and ethical issues related to correction or access to personal information that is kept within the organization. With respect to ethical principles related to the privacy of information rights, 83% focused on confidentiality, 38% on the need for autonomy, and 13% discussed accountability on the part of the organization collecting the personal information. TypesofArticles Articles from both the peer-reviewed published and gray literature included a variety of formats, from commentary to policy/legislation and literature reviews to empirical studies utilizing qualitative and/or quantitative data, and professional or organization-based guidelines. Policy and legislation reviews or discussions accounted for 22% of the total articles, while 17% represented the empirical research studies and 32% were based on reviews of the literature (please see Table 1). Fifty-six percent of articles representing the gray literature were published as guidelines, either to be used as a general resource to consumers of the organiza- tion (n = 15), or to support health professional practice (n = 5), or to communicate the organization’s policy and procedures (n = 6). Of the five articles published as professional practice guidelines specifically addressing privacy rights for use by health professionals (e.g., Occupational Therapists, Speech/Language Pathologists, Personal Support Workers), none discussed relevant parts of the legislation, or potential strategies to help the professional protect information privacy rights of those they are supporting. Rather, they referred the reader to read the PIPEDA. The remaining 46% of published gray literature included websites, information sheets, press releases, reports to the Canadian parliament, dissertation, relevant legislation, and a document of meeting minutes (please see Table 2). Discussion Despite legislation that provides standards on how to collect, use, and disseminate personal information to protect privacy, this review identifies specific factors as barriers and facilitators to access and use of information privacy rights for YADD and their families. These findings were classified according to Bronfenbrenner’s socio-ecological framework (Bronfenbrenner & Ceci, 1994) of classifying macro level (policy, legislation, attitudes), meso level (organization), exo level (community interactions), and micro level (individual, family), to more fully understand influences on access and utilization of privacy rights for young adults with developmental disabilities (please see Fig. 2). Macro Level: Policy and Legislation (National and International) At the macro level, this review suggests that aspects of policy and legislation, both in Canada and internationally, are identified as barriers to YADD exercising their privacy rights. The main factors shown to act as barriers can be categorized as relating to presentation of policy, gaps in legislation, and rise of corporate interests. Poorly written policy that is unclear (Dyke, Int J Ment Health Addiction (2018) 16:545–572 551 Table 1 Studies on privacy of personal information: study characteristics (N = 24) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 1. Mills et al., 2003 Policy analysis Not Canada: Health Collection Not addressed 1. Lack of shared databases 1.Increasing use of applicable PIPEDA information Disclosure 2. Poor integration Of Banonymising^ data PHIPA policy and technology through encryption 3. Lack of agreement on 2. Advocating for patient keeping privacy and privacy security of PHI 3. Establishing strong policies 4. Lack of commitment to 4. Willingness to invest in technological networks technological advances 2. Lafky & Horan, Mixed PHR users: USA Personal Use Confidentiality 1. Low levels of experience 1. Heightened access and 2011 methods: unwell, health Access (breach) with managing PHI sense/perception of control qualitative disabled and information Autonomy 2. Disabled less concerned, for those that are more con- interviews and well adults and less in control with cerned with privacy and quantitative privacy more able to protect their survey 3. Lower engagement in health records privacy privacy-protecting activ- ities 4. Underrepresentation of disabled people 5. Records which may be scattered among multiple providers 3. Dyke, et al., Comparative None Canada Health Disclosure Confidentiality 1. Not complying with 1. Understanding local norms 2016 legal and policy (qualified PIPEDA information PIPEDA legislative and standards and legal analysis researchers) requirements requirements 2. Difficulties identifying 2. Understanding factors jurisdiction influencing consumer 3. Complicated legal adoption of health framework for privacy information management law (public and private; tools federal and provincial) 3. Using an accountability model for ensuring that 552 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 4. Effort and cost of Canadian privacy standards sharing, protecting, and are in place ability to publishing 5. Lack of coherence between national and international privacy frameworks 6. Lack of trans-border data flow sharing 4. Yalon-Chanimiz, Review of Adults with USA Personal Collection Autonomy 1. People with ID 1. Provision of: extra time, age 2009 literature and a intellectual health access experience processing appropriate information, conceptual disability information delay, low literacy, simple language, simple model stigma layout, pictograms, and 2. Complexities in auditory means accessibility: verbal 2. Higher levels of communication, layout self-determination: more of physical environment, use of services, inclusion in product-operating their community, reducing instructions and stigma procedures 3. Training and education for service providers 5. Urowitz et al., QUAN CEOs of Canada Electronic Use and Confidentiality 1. Absence of technology to 1. Use of electronic patient 2008 (National hospitals PHIPA health access facilitate the electronic portals Scan)-survey - (N =83) records health record 2. Cultural shift of healthcare prospective, 2. Financial resources providers: to give up cross-sectional 3. Patient computer literacy Bownership^ of the files 4. Lack of hospital survey on patient needs for HER 5. Unwillingness of hospitals to providing Int J Ment Health Addiction (2018) 16:545–572 553 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed patients with access to their EHR 6. Siegel, et al., Comparative Consumers Canada Personal Use Accountability 1. Exploding growth of 1. Jurisdiction over foreign 2009 legal and policy of technology PIPEDA information (security social media, yet lacks organizations analysis USA, EU breach) detail how information is 2. Clear, consistent used for advertising, and communication as to the use how to verify consent of the information across from non-users platforms 2. Regulations are Bpiece-meal^ not explained enough 3. Developments in Canada have been only advisory 7. Geist, 2016 Critical review Consumers of Canada Personal Disclosure Confidentiality 1. Corporate, lobby group 1. Public engagement, protests of legislature technology PIPEDA information (security accountability focus on commercial for privacy rights breach) concerns 2. Mandatory breach 2. Absence of disclosure requirements Border-making power^ 3. Lack of penalties for privacy violations 4. Weak protections when outsourcing information to low protection jurisdictions 8. Larivie’re-Bastien, Review Adolescents USA Health Collection Confidentiality 1. Failure to adjust and 1. Positive attitudes and &Racine, 2011 with cerebral information autonomy focus on disability trustful, open palsy prevents focus on provider-patient relation- traditional adolescence ships free of stereotypes issues 2. Technology for 2. Lack of preparation to communication, time and the transition and social resources help with isolation autonomous consent 554 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 3. Difficulty obtaining 3. Healthcare providers can health information facilitate implicit personal 4. Needs for confidentiality autonomy even if it and privacy are not contradicts professional respected and not opinions acknowledged 5. Issues of informed consent and capacity often not addressed: opportunity to take part in decision-making not provided enough 9. Austin, 2006 Review: case Not None Consumer Collection Confidentiality None identified 1. Privacy protection shifts and legislature applicable identified information use autonomy balance of power away from business to consumers 2. Specifics of privacy give consumers clear ability to control privacy 3. Enforcing organization to comply with explicit consent for sensitive information 10. Repetto, et al., Review 1. YADD in USA Personal Collection Confidentiality 1. Legislature limited to 1. Improved guidelines for 2008 transition: HIPPAA information use Autonomy record keeping and teachers to support from FERPA disclosure documentation and may confidentiality within the Grade 6 to Access not cover the broader classroom 12 needs 2. Teaching students how to students 2. Young adults with DD do balance the advantages and 2. Family not have the knowledge, disadvantages of releasing caregiver skills and are not health personal health information 3. Teachers literate 3. Empowering and preparing students to make informed Int J Ment Health Addiction (2018) 16:545–572 555 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 3. Standards, curriculum choices related to disclosure materials and legislation andincreasingtheir do not refer to communication, reasoning disabilities and investigating skills for 4. Insufficient expansion of health promotion transition planning 5. Cannot reveal students’ personal health information as they learn, so makes teaching the content difficult. 11. Chan, & O’Brien, Review Not Canada Health Use Confidentiality 1. Precarious balance None 2011 applicable PHIPA information Autonomy between respecting Accountability client confidentiality and facilitating patient care 2. Caregivers who assume an allied care giving role not recognized as health information custodian 12. Gagnon, et al., Qualitative Canadian Not Electronic Use Confidentiality 1. Confusion, lack of 1. Increased guidance for 2016 study service identified personal Access Autonomy awareness supporting staff and for providers health Disclosure 2. Usability and relevance defining ePHR, data records with system design ownership 3. Weak user capacities and 2. Access to information and attitudes (i.e., patient sharing of health records to health literacy, education inform stakeholders and interest, support for professionals) 4. Environmental factors (i.e., government commitment, and targeted populations) 556 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 13. Joffe, 2010 Policy review Applied for Ontario Health Collection Confidentiality 1. Lack of knowledge 1. Accessible and people for Human information Autonomy 2. Confusion- > which understandable information DD Rights rights apply in which 2. Helpingpeople todevelop Commission contexts as self-advocates Code 3. Complaints procedure: 3. Rights education outside of not enough support, and service provision: ensures fear of reprisal from confidentiality service providers 4. Provision of accommodations and supports to participate in Act 5. family member/friend sup- port the personwithdis- abilities 14 Keith, 2004 Commentary Not Canadian Personal Collection Confidentiality 1. Unclear language 1.Clarity of purpose in applicable PIPEDA and information Use 2. Lack of direction in Act collecting personal USA privacy Access 3. Stringent definition of information legislature personal information 2.Consent 3. Limiting collection and use 4. Open to public review and compliance with requests for personal information access 15. Rule, 2004 Policy review Not PIPEDA Personal Collection Confidentiality 1. Lack of distinction 1. Clarify purposes for applicable information Disclosure between Bstrategic and gathering and withholding consummatory privacy information rights 2. Clarify how information is 2. Unknown or undefined shared risks 3. Logic of markets vs. logic of personal rights Int J Ment Health Addiction (2018) 16:545–572 557 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 4. Manipulation of personal information connected to online transactions 5. Risks: profiling, matching, data mining 16. Beardwood, 2015 Review Not PHIPA and Personal Disclosure Confidentiality Not identified 1. Organizations knowingly applicable PIPEDA, health (privacy Accountability contravening the Reporting Canadian information breach) Obligation or the Digital Notification Obligation are Privacy Act guilty of punishable offense USA 2. Nothing unique or systemic EU required to report a privacy breach to Commissioner. 17. Clement, & Obar, Review Canadian PIPEDA Personal Use Confidentiality 1. Each company report is 1. Transparency reporting 2016 consumers of data of Disclosure idiosyncratic-hard to sheds useful light on internet customers compare/understand previously hidden practices company’s statistics 2. Lack of transparency: retention periods for personal information, physical location of servers, data storage, and facilities where personal information is routed 18. Davidson, et al., Comparative People with PHIPA Health Collection Autonomy 1 Laws based on mental Universal shifts from 2016 review of mental health information disorder and risk, rather institutional to international problems than decision-making community-based care legal ability frameworks 2 Complex overlaps and some logical inconsistencies of guardianship and other 558 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed mental capacity laws discriminate against people with mental health problems 19. Peekhaus, 2008 National survey General PIPEDA, Health Collection Confidentiality 1. Commercial exploitation Willingness of Canadians public PHIPA, information Use Autonomy of personal information (61%) to sharing their and other and genetic 2. Domestic and genetic information with provincial data international pressures family members Health for minimum standards Information of protection for Acts personal information 3. Ministry of Health use of identifiable health information may not sit well with the Canadian public 4. Compounded safeguarding the privacy of medical information: as medical treatment migrates to complementary and alternative medicine 20. Rose, & Rose, Review of Consumers of PIPEDA, Personal Disclosure Confidentiality None identified None identified 2014 privacy law healthcare PIPA in health Alberta and information BC, Quebec Privacy Act, PHI, HIPAA and HITECH 21. Seelig, 2006 Case study HIPAA Access Confidentiality None identified None identified Int J Ment Health Addiction (2018) 16:545–572 559 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed Youth Personal (24 years) and health with information Angelman Syndrome 22. Skouge, et al., Description a Young adult None Personal Collection Confidentiality None identified None identified 2007 model in transition identified health Autonomy information 23. Moore, et al., 2016 Full research Primary PIPEDA Personal Collection Confidentiality None identified None identified report; mixed healthcare health methods study users in information Southeastern Ontario 24. Wolbring, & Cross-sectional Staff of PIPEDA Electronic Collection Confidentiality 1. Very limited control over 1. Staff more skeptical towards Leopatra, 2013 study disability health Use Autonomy the collection and safe certain sensor applications service records keeping of personal than others organization information created over 2. Staff concerned over the course of participants moderate control of own lives privacy and their client’s 2. PI moderated through even lesser control over staff members their privacy 560 Int J Ment Health Addiction (2018) 16:545–572 Table 2 Gray literature on privacy of personal information: study characteristics (N = 23) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed 1. Central East Final Young adults in Canada: Health Collection Confidentiality Developmental disability 1. Client-centerd care LHIN, report-guidelines transitional age PHIPA information Autonomy identified as a barrier 2. Respect and 2009 avoidance of labels that stigmatize 2. Shimmell, & Professional Occupational Canada: Personal Reference to Confidentiality None identified None identified Gioia guidelines: student therapy students PIPEDA information Act Di Vincenzo, guide in placements PHIPA 3. Desai, 2013 Final Service providers Canada: Health Use Autonomy 1. Families not considered as 1. Stricter rules on report\-community and criminalized PIPEDA information Disclosure partner in care ^circle of care^ mental health person with PHIPA Access 2. Hesitancy to release client’s where consent is not strategy and policy mental health health information from required review problems agency files 2. Understanding the 3. No centralized information type of information delivery model that can be released 4. Not enough consent policies by whom and how for vulnerable populations with mental health issues 4. Canadian Policy review Young adults CACL’s Health Collection Autonomy 1. Attaining full citizenship in 1. Removal of stigma Association for with ID Vision information law, policy, and practice 2. Specialized services Community 2020 2. Institutional 3. New policies to Living, approach-insufficient ac- regulate restraint use 2011 cess to educational aids/- in residential devices services, and for 3. Prejudice, poverty, lack of reporting of employment equality, lack violence/abuse of economic security for against those with ID families 4. Lack of data collection on young people with DD 5. Community Not applicable Not applicable Not Personal Use Confidentiality None identified 1. Stressing protection Living- identified information of privacy and Huntsville, 2012 Int J Ment Health Addiction (2018) 16:545–572 561 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed confidentiality of personal information 2. Providing supervision in least intrusive manner, with respect for person’s right to privacy and dignity and ensuring safety and well-being 6. Ontario LAW: Legislation review: Person with PIPEDA Personal Collection Confidentiality None identified 1. Limits on collection Services and DD/ID Disability information Use and use to no more Supports to Supports Disclosure than is reasonably Promote the Act necessary to meet Social the purpose Inclusion of Persons with Developmental Disabilities Act, 7. Law Commission Policy Not applicable PIPEDA Information Collection Confidentiality 1. Complying with privacy 1. Formal substitute of review-chapter held in Use Autonomy protections precludes decision-making ar- Ontario: capacity Disclosure Accountability persons from using rangements will give Background and registry informal supports and families greater ac- Contexts in arrangements and makes it cess to supports or Which difficult for family ease the difficulties the Law members to obtain or share of providing care Operates, information 2. Use of informal 2017a network to assist decision-making 562 Int J Ment Health Addiction (2018) 16:545–572 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed 2. Checks and audits, and capacity assessment intrudes on privacy 8. Law Commission Policy/legislation Not applicable Health Personal Collection Confidentiality 1. Vagueness in law 1. Greater involvement of Ontario: Legal review and Care information Autonomy 2. Formal assessment of of families Capacity, qualitative study Consent capacity perceived as an 2. Informal social Decision-making Act, invasion of privacy networks to reduce and Guardian- Substitute 3. Default role to family-not intrusion on privacy ship: Decisions always involved 3. Supporters appointed Final Report, Act, under 2017b Mental decision-making ca- Health pacity rules required Act, to maintain confi- dentiality of infor- mation 9. Mental Health Review of policy Emerging adults PHIPA Health Collection Confidentiality 1. Clinicians strictly adhering Clinicians being Commission of and literature 16–25 years with information to altered legal status at 18 Bfamily-engaged^ Canada, 2015 mental health for confidentiality problems requirements 2. Treatment compliance is reduced 10. Kindred Home Resource Personal support PIPEDA Health Use Confidentiality None identified None identified Care, 2012 workers PHIPA information 11. Simcoe York Resource Families with PHIPA Health Collection Confidentiality Lack of information 1. Specific lists of Dual persons with ID + information regarding services/supports supports and Diagnosis mental health services Education problems 2. Specific questions to committee, 2015 ask and directions to follow 12. Wappel, 2007 Policy review Not applicable PIPEDA Personal Access None 1. Lack of definition for Clear definition of PHIPA information (have identified ^work product^ personal information information 2. Confusion and lack of corrected) specificity between Int J Ment Health Addiction (2018) 16:545–572 563 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed expressed, implied, and opt-out 13. Wedge, 2014 Dissertation Older persons PIPEDA Personal Collection Accountability 1. No means for privacy for None identified information those who suspect crime against older person to report 14. Wellington North, Meeting minutes Not applicable PIPEDA Health Disclosure Confidentiality 1. Social media use 1. Identify specific 2015 MFIPPA information 2. Lack of knowledge of strategies for PIPEDA invasion of privacy 2. Only release health information according to legislation 15. Community Policy document Agency’sboard PIPEDA Personal Disclosure Confidentiality Not identified None identified Living- of directors, staff, information Central Huron, members-at-large 2015 and the people receiving service, and those with DD 16. Office of the Report to the Genetic testing PIPEDA Personal Collection Confidentiality 1. More information is Breach reports to OPC Privacy Parliament users information Use collected: less adequate growing every year, Commissioner, Disclosure safeguards, increased risk (more since 2014) 2016 Annual (breach of and potential consequences Report to information) of privacy breaches (related Parliament on the to genetic testing) PIPEDA and the 2. Cross border privacy issues Privacy Act, increasing 2015–2016 17. Kitchener Client related All users of PHIPA Personal Collection Confidentiality 1. Court order or subpeona 1. Training staff to Downtown policy document primary care, information Use effectively Community treatments, Disclosure communicate with 564 Int J Ment Health Addiction (2018) 16:545–572 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed Health referrals, health persons with Centre, 2012 promotion disabilities. 2. Clarifying the collection, use and disclosure of personal health information 18. Legislative Committee People including PHIPA Health Disclosure Confidentiality 1. Definition of Bhealth 1. Right to education Assembly of documents/review those with information Access information custodian^ not for patients under the Ontario: Review disability entirely clear legislation (consent, of 2. Inability to access their own breaches of privacy) the Personal records due to exorbitant 2. Education for Health fees leads to people with stakeholders to Information disabilities being denied ensure they are Protection Act, social assistance, insurance, aware of their 2008 and accommodations responsibilities under the legislation. 19. Ministry of Service policy Persons PHIPA Health Disclosure Confidentiality 1. Provision of care under None identified Health manual recovering from Health information Access Autonomy CCAC is subject to sharing and Long-Term treatment, and Care of health information Care (MOHLTC), elderly persons Consent 2006 Act (HCCA), Substitute Decisions Act (SDA) 20. Renfrew County Policy and Service providers PHIPA Personal Collection None None identified None identified Catholic District procedure and health Use identified document Information Int J Ment Health Addiction (2018) 16:545–572 565 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed School Board, 21. Trottier & Resource guide Ontario’s PIPEDA Personal Collection Confidentiality None identified None identified Kaattari, community information Use 2010 literacy agencies Disclosure on finances, administration and employment 22. Lacobucci, 2014 Independent review People in crisis PHIPA Individual’s Collection Confidentiality 1. Constraints on 2. Healthcare healthcare Use information-sharing issues institutions must information Disclosure makes coordination be- protect tween the TPS and the physician-patient mental health system less confidentiality effective and sharing of healthcare information. 23. Luker, 2009 News letter: Persons with, PHIPA Health Access Confidentiality None identified None identified College of hearing, speech, information (correction Audiologists and and language of Speech-Language difficulties information) Pathologists of Ontario 566 Int J Ment Health Addiction (2018) 16:545–572 et al., 2016; Keith, 2004; Law Commission of Ontario (LCO) 2017a; Mills et al., 2003;Rule, 2004;Wappel, 2007), and a lack of integration of technology into policy (Mills, et al., 2003) were cited often. The lack of international agreements and compliance with provincial and federal legislation in Canada, including respect for local norms around disability and privacy rights, was stated by several authors as problematic (Dyke, et al., 2016;Geist, 2016; Mills, et al., 2003; Siegel et al., 2009). Increasing levels of corporate lobbying interests and associated pressure to lower standards (Geist, 2016; Peekhaus, 2008) and exploitation of personal information (Peekhaus, 2008;Rule, 2004) were also cited as barriers. On the other hand, facilitators of information privacy rights were also supported in the articles, primarily, the need for penalties to enforce accountability (Bearwood, 2015;Desai, 2013; Dyke, et al., 2016;Geist, 2016; Joffe, 2010; Keith, 2004;LCO, 2017a;Wedge, 2014), but also increased acknowledgement and respect for disability (Canadian Association of Community Living (CACL), 2011; Community Living Huntsville, 2012; Central East Local Health Integrated Network (LHIN), 2009; Repetto et al., 2008), community, socioeconomic, and technology support (CACL, 2011; Joffe, 2010;LCO, 2017b), and higher standards for security of personal information (Community Living Huntsville, 2012;Peekhaus, 2008). Exo Level: YADD and Community Interactions At the exo level for adults with developmental disabilities, an interesting pattern of barriers and facilitators was evident consistently across articles. This related to access issues based in the interactions between YADD and their community and service providers. Barriers included insufficient knowledge leading to limited use of the existing legislation (Keith, 2004;Mental Health Commission of Canada (MHCC), 2015;Mills, etal., 2003; Repetto, et al., 2008;Rule, 2004; Simcoe York Dual Diagnosis Education Committee (SYDDEC), 2015; Wellington North, 2015), fear of reprisal for making a complaint (Joffe, 2010), lack of transparency regarding online social media platforms (Siegel et al., 2009;Rule, 2004), and use of overly Fig. 2 Conceptual framework: determinants of privacy of personal information rights for YADD Int J Ment Health Addiction (2018) 16:545–572 567 complex language and presentation of rules (Siegel et al., 2009; Yalon-Chamovitz, 2009). Most noteworthy was the observation of a failure among organizations to provide appropriate accommodations to better support consent for collection and use of personal information and advocacy (Dyke et al., 2016; Joffe, 2010;Lafky &Horan, 2011;Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Wolbring, & Leopatra, 2013; Yalon-Chamovitz, 2009). Facilitators identified at the exo level included increasing the use of advocacy supports by YADD and family caregivers (Joffe, 2010; Lafky & Horan, 2011; Mills et al., 2003), provision of technology for YADD to facilitate communication and comprehension (CACL, 2011; Larivie’re- Bastien & Racine, 2011), and most importantly, the inclusion of family members to support decision-making (Chan, & O’Brien, 2011; Desai, 2013;LCO, 2017a, b;MHCC, 2015; Peekhaus, 2008). Finally, the addition of specific instructions, in professional practice and organizational guidelines, on how to support young adults with developmental disabilities to exercise their privacy rights was cited in all articles discussing interactions with YADD in the community (Kitchener Downtown Community Health Centre, 2012; Law Commission of Ontario, 2017a, b; Legislative Assembly of Ontario, 2008; Repetto et al., 2008; Wellington North, 2015). Meso Level: Organization-Based Factors Factors related to organizations and their processes, specifically to staff relations that act either as barriers or facilitators of access and utilization of privacy of information rights, were identified at the meso level. Barriers included a persistent lack of willingness on the part of organizations to share their information databases in order to ease the stress on YADD and their families (Clement, &Obar, 2016;Desai, 2013; Dyke et al., 2016;Gagnonet al., 2016;Larivie’re-Bastien, & Racine, 2011; Peekhaus, 2008; Mills, et al., 2003; Ministry of Health and Long-Term care (MHLTC), 2006; Lacobucci, 2014; Urowitz et al., 2008) and lack of commitment to use of technological advances to protect information privacy rights (Mills, et al., 2003;Siegeletal., 2009;Urowitz et al., 2008). Throughout the review, YADD needs were found to be unrepresented in organiza- tional processes (Austin, 2006;CACL, 2011;Clement,&Obar, 2016;Siegeletal., 2009). Identified solutions that acted as facilitators at the meso level focused on the provision of greater levels of experience, training, and practice opportunities for staff to better facilitate privacy rights for YADD (Dyke, et al., 2016; Gagnon et al., 2016; Lafky & Horan, 2011; Legislative Assembly of Ontario, 2008; Wellington North, 2015; Yalon-Chamovitz, 2009). As well, imple- mentation of assessment of YADD needs for electronic health records and patient portals (Dyke et al., 2016; Urowitz et al., 2008) and enforcement of compliance among organizations in providing service that is consistent with existing privacy legislation and legislation governing the provision of individualized accommodations particularly for communication and compre- hension (Austin, 2006;CACL, 2011;Dyke etal., 2016;Geist, 2016;Ontario Law, 2008). Micro Level: Individual Disability-Related Factors A few characteristics that stem from the individual’s disability were identified as barriers at the micro level. However, it is important to note that existing legislation already provides direction to avoid these barriers but is often overlooked due to lack of compliance with privacy legislation and community-based care (Beardwood, 2015; Davidson et al., 2016; Dyke et al., 2016;Geist, 2016; Joffe, 2010;). For instance, the failure to provide individualized accommodations YADD need to exercise their rights and receive support for their decision- making due to low literacy as well as communication, comprehension, and visual difficulties 568 Int J Ment Health Addiction (2018) 16:545–572 surfaced consistently through this review (CACL, 2011; Joffe, 2010;Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008; Yalon-Chamovitz, 2009). Similarly, a lack of support to better prepare YADD during this transition period was identified as a major vehicle for YADD to become more empowered in exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010;Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008). Finally, socio- economic issues were cited as barriers to utilization of privacy rights, in that fees make it difficult for YADD and their families to make corrections to their personal information files (CACL, 2011; Laverie-Bastien, & Racine, 2011; Urowitz et al., 2008). To better facilitate access and utilization of privacy rights for YADD, provision of support in two main areas were identified: (1) provision of training to improve computer literacy and self-advocacy skills specific to information privacy rights (CACL, 2011; Joffe, 2010; Repetto et al., 2008; Urowitz et al., 2008), and (2) provision of supported decision-making through greater engagement of family members in the consent process and utilization of privacy rights (CACL, 2011; Central East LHIN, 2009; Chan & O’Brien, 2011;Davidsonetal., 2016;Lafky &Horan, 2011;LCO, 2017a, b; Joffe, 2010; Repetto et al., 2008). Recommendations The findings and discussions of these articles show that the gap between the existing legislation and access to, or utilization of, information privacy rights among YADD and their families results from three factors: (1) a lack of knowledge among YADD and their family supporters (Gagnon et al., 2016; Joffe, 2010; Lacobucci, 2014;Lafky &Horan, 2011;Repetto et al., 2008; Yalon-Chamovitz, 2009), (2) a tendency of organizations to interpret or adhere to privacy laws inconsistently (Clement & Obar, 2016; Desai, 2013;Dykeetal., 2016; Geist, 2016; Peekhaus, 2008; Wolbring & Leopatra, 2013; Urowitz et al., 2008), and (3) a lack of access to the tools needed to support YADD exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010;Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Repetto et al., 2008; Skouge et al., 2007; Urowitz, et al., 2008; Yalon-Chamovitz, 2009). In connection with the findings reviewed, we recommend the following three areas that need to be addressed by privacy commissioners and organizations supporting young adults with developmental disabilities. First, and foremost, awareness, knowledge, and skills need to be raised among organizational staff, families, and YADD. In this way, self-advocacy will occur more frequently, and families will be included in the YADD’s core support and privacy rights education in their high school curriculum. Second, promotion of information privacy legislation through education for organizational staff is required. In particular, implementation of manuals with specific guidelines instructing staff with strategies to use the privacy legislation is suggested. Finally, targeted transla- tion of existing legislation that will allow more YADD and their families to exercise their privacy of information rights is recommended. Limitations This review has some limitations. Our literature search was limited to articles focusing on privacy legislation and developmental disabilities, and this search strategy may have contributed to excessively narrow range of articles included. Several exceptions for inclusion were established to capture relevant articles and to make it possible to broaden Int J Ment Health Addiction (2018) 16:545–572 569 the capture of relevant barriers and facilitators also relevant to YADD. The articles differed not only in their objectives and methodology or type of article, but also showed great heterogeneity in approach to considering the issue of privacy of information rights. While quality was consistently high (such as representative samples, standardized tools, in depth policy discussion), the total number of empirical studies was very few (n = 6). It is important that future studies examine public understanding of privacy rights and pathways to accessing tools to exercise privacy rights. Finally, the presentation of our findings in Fig. 2 (Conceptual Framework: Determinants of Privacy of Personal Infor- mation Rights for YADD) presents a systems perspective. Our interpretation of our findings is influenced by this perspective. Conclusion In this scoping review, 24 peer-reviewed articles and 23 articles from the gray literature were identified which examined the barriers and facilitators for access and utilization of informa- tion privacy rights in relation to the needs of young adults with developmental disabilities and their families. A basic requirement in protecting individual privacy rights is informing people of their rights so they know when a violation has occurred and how it can be remedied. This becomes a challenge to organizations trying to support families and their YADD as communication and information sharing can be complicated, often requiring accommodations or supports for the decision-making. The implications of the challenges typically experienced by YADD are tremendous, especially for providing support for provi- sion of consent and decision-making to ensure ensuring confidentiality and autonomy throughout the protection of personal information privacy (Joffe, 2010). Although some parallels can be made with elderly citizens or persons with physical disabilities, important and distinct differences exist for YADD whose chronological age indicate adult, but who may not have sufficient decision-making capacity, and, more often than not, may be restricted as a result of their mode of communication or literacy level. By the time the potential privacy breach is voiced, or even recognized, young adults with developmental disabilities may have already lost some of their privacy rights in the process. For this reason, and because existing privacy legislation exists, the present review suggests that increasing awareness, education, and knowledge translation tools for all involved, especially YADD, family caregivers, and service providers, will help to combat the disadvantage in exercising information privacy rights by young adults with developmental disabilities. Acknowledgements This project was funded by the Office of the Privacy Commissioner of Canada (OPC); the views expressed herein are those of the authors and do not necessarily reflect those of the OPC. Compliance with Ethical Standards Conflict of Interest The authors declare that they have no conflict of interest. Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and repro- duction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. 570 Int J Ment Health Addiction (2018) 16:545–572 References Arksey, H., & O’Malley, L. (2005). Scoping studies: towards a methodological framework. Journal of Social Research Methodology, 8,19–32. Austin, L. (2006). Is consent the foundation of fair information practices? Canada’s experience under PIPEDA. The University of Toronto Law Journal, 56(2), 181–215. Beardwood, J. (2015). The new Canadian digital privacy act: the good, the bad and the ugly. new legislation creates new problems as it fixes others. CRI, 129–134. Bronfenbrenner, U., & Ceci, S. (1994). Nature-nurture reconceptualized in developmental perspective: a bioecological model. Psychological Review, 101(4), 568–586. Canadian Association for Community Living. (2011). Inclusion of Canadians with intellectual disabilities. Toronto: CACL Retrieved from http://www.cacl.ca/sites/default/files/National%20Report%20 Card%202013%20ENG%20Final.pdf. Central East Local Health Integration Network. (2009). Final Report. Early youth interventions project report. Transitional Age Youth and Health Promotion. Ontario: Central East LHIN Retrieved from http://www. canadian-patient-consent-form.com/form/86347912-Full-Report-Central-East-LHIN. Chan, B. W., & O’Brien, A. M. (2011). The right of caregivers to access health information of relatives with mental illness. International Journal of Law and Psychiatry, 34(6), 386–392. Clement, A., & Obar, J. A. (2016). Keeping internet users in the know or in the dark an analysis of the data privacy transparency of Canadian internet carriers. Journal of Information Policy, 6,294–331. Colquhoun, H. L., Levac, D., O’Brien, K. K., Straus, S., Tricco, A. C., & Perrier, L. (2014). Scoping reviews: time for clarity in definition, methods, and reporting. Journal of Clinical Epidemiology, 67(12), 1291–1294. Community Living-Central Huron. (2015). Community living-Central Huron policies & procedures. Ontario: CL-CH Retrieved from http://www.clch.ca/policy. Community Living- Huntsville. (2012). Section policies & procedures. Policy title service records and retention. Ontario: Community Living-Huntsville Retrieved from http://www.clhuntsville.ca/wp-content/uploads/2014 /02/Policy-and-Procedures.pdf. Davidson, G., Brophy, L., Campbell, J., Farrell, S. J., Gooding, P., & O’Brien, A. (2016). An international comparison of legal frameworks for supported and substitute decision-making in mental health services. International Journal of Law and Psychiatry, 44,30–40. Desai, A. (2013). Towards an integrated network (second edition): working together to avoid criminalization of people with mental health problems. Ottawa, ON: St. Leonard’s Society of Canada. Developmental Services Ontario. (2016). What is a developmental disability? Ontario: DSO Retrieved from: http://www.dsontario.ca/whats-a-developmental-disability. Dyke, S. O. M., Saulnier, K. M., Pastinen, T., Bourque, G., & Joly, Y. (2016). Evolving data access policy: the Canadian context. Facets, 1(1), 138–147. Fogden, B., Thomas, S., Daffern, M., & Ogloff, J. (2016). Crime and victimisation in people with intellectual disability: a case linkage study. BMC Psychiatry, 16,170. Gagnon, M.-P., Breton, E., Fortin, J.-P., Khoury, L., Dolovich, L., Price, D., Wiljer, D., Bartlett, G., & Archer, N. (2016). Adoption of electronic personal health records in Canada: perceptions of stakeholders. International Journal of Health Policy Management, 5(7), 425–433. Geist, M. (2016). The policy battle over information and digital policy regulation: a Canadian perspective. Theoretical Inquiries in Law, 17,415–449. Joffe, K. (2010). Enforcing the rights of people with disabilities in Ontario’s developmental services system. In The Law as it affects persons with disabilities. Ottawa: Law Commission of Ontario. Keith, B. C. (2004). Privacy north of the border: 10 things you should know about Canadian personal information laws. American Bar Association, Business Law Section, 14(2). Retrieved from http://www.americanbar.org/content/dam/aba/publications/blt/2004/11/privacy-north-of-border- 200411.authcheckdam.pdf. Khanlou, N. (2018). Final report: Developmental services research Grant Fund. Toronto: York University. Khanlou, N., Haque, N., Mustafa, N., Vazquez, L. M., Mantini, A., & Weiss, J. (2017a). Access barriers to services by immigrant mothers of children with autism in Canada. International Journal of Mental Health and Addiction, 15(2), 239–259. Khanlou, N., Mantini, A., & Degendorfer, K. (2017b). The YADD privacy project: improving privacy for young adults with developmental disabilities through research and innovative knowledge translation. Toronto: York University. Khanlou, N., Mustafa, N., Vazquez, L. M., Davidson, D., & Yoshida, K. (2017c). Mothering children with developmental disabilities: a critical perspective on health promotion. Health Care for Women International, 38(6), 613–634. Int J Ment Health Addiction (2018) 16:545–572 571 Kindred Home Care. (2012). Life at home just got better: providing kindred care. New Brunswick: KHC. Retrieved from kindredhomecare.com/wp-content/uploads/2012/10/KHC-Training-Textbook-Sample.pdf. Kitchener Downtown Community Health Centre. (2012). Kitchener downtown community health Centre: client related policies. Kitchener, ON: KDCHC Retrieved from http://www.kdchc.org/wp-content/uploads/2012 /02/Client-Policies-Web-2.pdf. Lacobucci, F. (2014). Police encounters with people in crisis: an independent review. Toronto Police Service, 1–413. Lafky, D. B., & Horan, T. A. (2011). Personal health records: consumer attitudes toward privacy and security of their personal health information. Health Informatics Journal, 17(1), 63–67. Larivie’re-Bastien, D., & Racine, E. (2011). Ethics in health care services for young persons with neurodevelopmental disabilities: a focus on cerebral palsy. Journal of Child Neurology, 26(10), 1221–1229. Law Commission of Ontario. (2017a). Background and contexts in which the law operates.Toronto:LCO Retrieved from https://www.lco-cdo.org/en/our-current-projects/legal-capacity-decision-making-and- guardianship/legal-capacity-decision-making-and-guardianship-discussion-paper-2/i-background-and- contexts-in-which-the-law-operates-2/. Law Commission of Ontario. (2017b). Legal capacity, decision-making and guardianship: final report. Toronto, ON: LCO Retrieved from https://www.lco-cdo.org/en/our-current-projects/legal-capacity-decision-making- and-guardianship/. Legislative Assembly of Ontario. (2008). Committee documents: standing committee on social policy - 2008- Aug-28—review of the Personal Health Information Protection Act, 2004. Ottawa, ON: Legislative Assembly of Ontario Retrieved from http://www.ontla.on.ca/web/committee-proceedings/committee_ transcripts_details.do?locale=en&Date=2008-08-28&ParlCommID=8875&BillID=&Business= Review+of+the+Personal+Health+Information+Protection+Act%2C+2004&DocumentID=23176 #P84_5361. Luker, K. (2009). The age of the electronic health record. CASLPO Today, 7(3), 13–17. Mental Health Commission of Canada. (2015). Taking the next step forward: Building a responsive mental health and addictions system for emerging adults. Ottawa, ON: MHCC. Mills, S. K., Yao, R. S., & Chan, Y. S. (2003). Privacy in Canadian health networks: challenges and opportu- nities. Leadership in Health Services, 16(1), 1–10. Ministry of Health and Long-Term Care. (2006). Community care access centres: client services policy manual. Toronto: MHLTC Retrieved from http://www.ontla.on.ca/library/repository/mon/26004/316651.pdf. Moore, K.M., Belanger, P., & Biro, S. (2016). Understanding health inequities and access to primary health care in Southeastern Ontario. Retrieved from http://www.kflaphi.ca/wp-content/uploads/HealthInequities_ FullReport.pdf. Office of the Privacy Commissioner. (2016). 2015–2016 annual report to parliament on the personal informa- tion protection and electronic documents act and the privacy. Gatineau, QC: OPC Retrieved from https:// www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/201516/ar_201516/. Ontario Law. (2008). Services and Supports to Promote the Social Inclusion of Persons with Developmental Disabilities Act, 2008, S.O. 2008, c. 14. Ontario: Ontario Law Retrieved from https://www.ontario. ca/laws/statute/08s14. Peekhaus, W. (2008). Personal health information in Canada: a comparison of citizen expectations and legisla- tion. Government Information Quarterly, 25,669–698. Personal Health Information Protection Act (PHIPA), 2004, SO 2004, c 3, Sch A. (2004). Retrieved from: http://canlii.ca/t/53154. Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5. (2000). Retrieved from: http://canlii.ca/t/52hmg. Repetto, J. B., Gibson, R. W., Lubbers, J. H., Gritz, S., & Reiss, J. (2008). Practical applications of confidentiality rules to health care transition instruction. Remedial and Special Education, 29(2), 118–126. Renfrew County Catholic District School Board. (2014). INDEX: administration policies & procedures. Appropriate use of technology guidelines. Renfrew, ON: RCCDSB Retrieved from: https://drive.google. com/file/d/1RJyTkV_X433H4mdT2Zvim3DGQFznQrOp/view, Index. Roebuck, R., Paquet, M. & Coultes-Macleod, J. (2008). Improving health outcomes for children and youth with developmental disabilities. Retrieved from: http://www.surreyplace.on.ca/documents/Resources/Children's%20 Forum%20Literature %20Review_final(web).pdf. Rose, R. V., & Rose, L. H. (2014). Appreciating healthcare data privacy laws in Canada, the United Kingdom, and the United States. The EDP Audit, Control, and Security Newsletter, 49(5), 18–24. Rule, J. B. (2004). Toward strong privacy: values, markets, mechanisms and institutions. University of Toronto Law Journal, 54(2), 183–225. Seelig, R. (2006). New technology provides urgent medical information and protects privacy: providing important information in medical situations for the developmentally disabled. The Exceptional Parent, 36(5), 47–51. 572 Int J Ment Health Addiction (2018) 16:545–572 Shimmell, L., & Gioia Di Vincenzo, G. D. (Eds.). (2017). Master of science occupational therapy MSc (OT). Clinical education handbook. Hamilton, ON: McMaster University, Faculty of Health Sciences. Siegel, A., Denny, W., Poff, K. W., Larose, C., Hale, R., & Hintze, M. (2009). Survey of privacy law developments in 2009: United States, Canada, and the European Union. The Business Lawyer, 65(1), 285–307. Simcoe York Dual Diagnosis Education Committee. (2015). Supports and services for persons with a dual diagnosis: a resource manual for York region families. Simcoe York, ON: SYDDEC Retrieved from http://www.community-networks.ca/wp-content/uploads/2015/11/central-york-ddx-resource-guide.pdf. Skouge, J.R., Kelly, M.L., Roberts, K.D., Leake, D.W., & Stodden, R.A. (2007). Technologies for self- determination for youth with developmental disabilities. Education and training in developmental disabil- ities, 42(4), special conference issue research to practice, 475–482. Tricco, A., Lillie, E., Zarin, W., O’Brien, K., Coquohoun, H., Kastner, et al. (2016). A scoping review on the conduct and reporting of scoping reviews. BMC Medical Research Methodology, 16(15), 1–10. Trottier, V. & Kaattari. J. (2010). Capacity Plus: Organizational Capacity Resource Guide for Ontario’s Community Literacy Agencie. Community literacy of Ontario. Retrieved from http://www. communityliteracyofontario.ca/wp/wp-content/uploads/2013/08/capacity_plus_book_02.pdf. Urowitz, S., Wiljer, D., Apatu, E., Eysenbach, G. DeLenardo, C, Harth, T., Pai, H., & Leonard, K.J. (2008). Is Canada ready for patient accessible electronic health records? A national scan. BMC Medical Informatics and Decision Making,8(33), 1–7. Wappel, T. (2007). Statutory review of the personal information protection and electronic documents act (PIPEDA): 4th report of the Standing Committee on Access to Information, Privacy and Ethics /. Standing Committee on Access to Information, Privacy and Ethics, 2007. Retrieved from https://search. library.utoronto.ca/details?6228520. Wedge. (2014). Enduring powers of attorney and financial abuse of older persons are existing safeguards sufficient? Retrieved from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.855.5092&rep=rep1 &type=pdf. Wellington North. (2015). Admin. & finance committee meeting minutes. Retrieved from https://wellington- north.com/content/government/committees-of-council/administration-finance-committee/2015-agendas- minutes/12-17-2015-administration-finance-minutes.pdf. Wolbring, G., & Leopatra, V. (2013). Sensors: views of staff of a disability service organization. Journal of Personalized Medicine, 3,23–39. Yalon-Chamovitz, S. (2009). Invisible access needs of people with intellectual disabilities: A conceptual model of practice. Intellectual and Developmental Disabilities, 47(5), 395–400. http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png International Journal of Mental Health and Addiction Springer Journals

Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities

Free
28 pages
Loading next page...
 
/lp/springer_journal/protection-of-privacy-of-information-rights-among-young-adults-with-liHwomKejg
Publisher
Springer US
Copyright
Copyright © 2018 by The Author(s)
Subject
Medicine & Public Health; Public Health; Health Psychology; Psychology, general; Rehabilitation; Psychiatry; Community and Environmental Psychology
ISSN
1557-1874
eISSN
1557-1882
D.O.I.
10.1007/s11469-018-9904-x
Publisher site
See Article on Publisher Site

Abstract

Int J Ment Health Addiction (2018) 16:545–572 https://doi.org/10.1007/s11469-018-9904-x ORIGINAL ARTICLE Protection of Privacy of Information Rights among Young Adults with Developmental Disabilities 1 1 1 Nazilla Khanlou & Anne Mantini & Attia Khan & 2 3 Katie Degendorfer & Masood Zangeneh Published online: 18 April 2018 # The Author(s) 2018 Abstract Protection of privacy of information for young adults with developmental disabil- ities and their families is essential to promote quality of life, well-being, empowerment, and inclusion. Despite this, the young adults’ information privacy rights are increasingly at risk. This paper provides a scoping review, applying Arksey and O’Malley’s(2005) approach, of all published peer-reviewed journal articles and gray literature to examine the barriers and facilitators in utilization of legislation that protects the collection, use, disclosure, and access of personal information in Canada. The scoping review process was further expanded with a rigorous reliability method and applied a socio-ecological framework to the final 47 studies. National and international policy and legislation (macro level), organization-based factors (meso), young adults and community interactions (exo), and individual disability related factors (micro) are examined. The review identifies the barriers and highlights the importance of facilitators for acting on personal privacy rights. . . . . . Keywords Information privacy rights Canada PIPEDA PHIPA Confidentiality Personal information protection Young adults with developmental disabilities (YADD) and their families are at risk of exploitation in terms of privacy and protection of their personal information (Joffe, 2010). Their increasing dependency on multiple community-based and private agencies creates a scenario where a wide range of personal information is retained and shared through the course of servicing these individuals and their families over time. YADD are vulnerable not only * Nazilla Khanlou nkhanlou@yorku.ca; http://nkhanlou.info.yorku.ca York University, 4700 Keele St., Toronto, ON M3J 1P3, Canada Toronto, Canada University of Guelph-Humber, 207 Humber College Blvd, Etobicoke, ON M9W 5L7, Canada 546 Int J Ment Health Addiction (2018) 16:545–572 because they are in a sensitive period transitioning into adulthood but also as they have complex developmental needs and may experience difficulties making their own decisions (Dyke et al., 2016). They may also have concurrent health and mental health needs which require support, and even as adults may frequently depend on secondary decision makers to protect their privacy of information rights (Geist, 2016). Developmental disabilities (DDs), which include intellectual disability, autism, down syndrome, fragile x syndrome, cerebral palsy, and developmental delays, are lifelong and affect multiple aspects of psychosocial development, physical functioning, and participation in daily activities (Developmental Services Ontario (DSO), 2016; Roebuck et al., 2008). Indi- viduals with DDs may have deficits in their cognitive, decision-making, comprehension, and communication capacity (Roebuck et al., 2008) that increases their exposure to human rights violations related to privacy of information (Fogden et al., 2016). They or their family caregivers and service providers often do not have the necessary resources to defend their privacy rights to personal information. While legislation in Canada is well developed and in place to guide the protection of personal information (e.g., Personal Information Protection and Electronic Documents Act (PIPEDA), 2000), and health information for individuals (e.g., Personal Health Information Protection Act (PHIPA), 2004), the translation of relevant legislation as required for individ- uals at-risk of understanding or communicating their rights is not. This impression is informed by our findings from our recent and on-going research studies on families of children and young adults with developmental disabilities (Khanlou et al., 2017a; Khanlou et al., 2017c; Khanlou, 2018). During the data collection phase of these projects, family caregivers, service providers, and YADD frequently reported concerns they faced with the collection and use of their personal information. Specifically, they relayed concerns about the extensive paper work, dispersed services, navigation across multiple service sectors with repetition of requests for personal information, financial difficulties, social isolation, and stigma. Immigrant family caregivers of YADD faced additional information privacy concerns specific to language fluency, lack of social networks, and new knowledge required post-migration of service delivery systems and their rights, which were reported to affect their access to and utilization of health and social services (Khanlou et al., 2017a; Khanlou et al., 2017b; Khanlou et al., 2017c; Khanlou, 2018). Their concerns and these factors influence the privacy rights of YADD in a challenging manner. Many YADD and their parents continue to remain uncertain as to who is accountable for the protection of their privacy rights given the complexity and persistence of developmental challenges of the young adults. In Ontario, Canada, persons with DDs are permitted to remain in their secondary school until they reach 21 years of age. Thus, even though they are adults as of 18 years of age, their privacy and confidentiality rights are largely protected by the adherence to privacy laws within their school environment. However, following completion of school, the young adults with developmental disabilities can take different pathways ranging from partial employment, volunteer work, vocational training, day programs, or to no involvement in activities outside the home. Once these young adults leave the protection of their school settings, they are increasingly dependent on both private and public agencies from within both the social and health sectors. This dependency on multiple organizations to provide needed services, super- vision, care, employment, or education— commercially based or not—increases dramatically as the young adults transition into adulthood. Given the significant gap between application of relevant legislation or information privacy evidence and the needs of young adults with developmental disabilities, the Int J Ment Health Addiction (2018) 16:545–572 547 YADD Privacy Project was developed (Khanlou, et al., 2017b). As part of the project, a methodologically rigorous scoping review was conducted to address this gap by synthe- sizing evidence on information privacy rights for YADD in Canada. The goals of this comprehensive scoping review of both published peer-reviewed articles and online gray literature were to: (1) examine the range, depth and nature of both the scholarly and gray literature related to access to privacy of information rights and utilization of legislation in Canada for the provision of services to young adults with developmental disabilities (PIPEDA, 2000 or PHIPA, 2004), (2) apply a socio-ecological framework (Bronfenbrenner & Ceci, 1994) to the findings to illustrate the barriers and facilitators of information privacy rights for young adults with developmental disabilities, and (3) to contribute to the development of future strategies and solutions enhancing information privacy rights with evidence-based recommendations. Methods Our protocol was developed using the scoping review methodology proposed by Arksey and O’Malley (2005), which has a five-step process for conducting scoping reviews. This method entails (1) identification of the research question, (2) identification of relevant studies, (3) study selection, (4) charting the data, and (5) synthesizing and reporting of the results. In addition, we refined the scoping review process to increase methodological rigor, by including three more components as suggested by Tricco et al. (2016) and Colquhoun et al. (2014) and their colleagues, including establishing a protocol, utilizing at least two reviewers and calculation of reliability, a reporting checklist, and conducting a consultation exercise to ensure our results are useful to advancing the field. Step 1 We identified the research question as follows, BWhat does the scholarly and grey literature on information privacy in relation to PIPEDA or PHIPA inform us about the barriers and facilitators young adults with developmental disabilities encounter when accessing and utilizing their privacy rights?^ Step 2 Next, relevant peer-reviewed studies were identified by searching electronic databases: ProQuest, JSTOR, Scholars Portal, EBSCO, Web of Science, PubMed, PsychINFO, Scopus, and CANLII (for legal cases and briefs), using specific search terms: PIPEDA OR PHIPA OR information privacy AND developmental disabilities AND Canada. The gray literature search was conducted using the Google search engine, and keywords/phrases were either (a) barriers to PIPEDA for young adults with devel- opmental disabilities in Canada or (b) barriers to PHIPA for young adults with develop- mental disabilities in Canada. The database searchers were not limited by language or type of publication, but location for keywords was restricted to Canada. Specifically, we searched Google Search and websites of agencies that service YADD. The electronic searches retrieved 9299 articles (Fig. 1), and 25 articles through hand searching. Ten duplicates were removed. Search and keyword strategy were developed by research team members and approved by the study Principle Investigator and the health sciences librarian. Step 3 Abstracts of identified articles were reviewed to assess if they met the inclusion and exclusion criteria. Articles were eligible if they were written in a 548 Int J Ment Health Addiction (2018) 16:545–572 Initial Search Results total: 1)Academic Databases = 2068 JSTOR, Scholars Portal, CINAHL, ProQuest, Web of Science, PubMed, PsychINFO, SCOPUS, CANLII 2)Grey Literature = 7,231 Hit Google N=9,299 Articles removed through Title and Abstract screening: Duplicates Removed: Academic Databases= 2062 Grey Literature = 7195 hits n=10 Reasons for exclusion: Not DD population, related to prescribing/medical interventions only or related to privacy in residential settings or to human rights for those with disability in general. Full-Text Articles n= 9257 Assessed for Eligibility: Academic Databases = 6 Grey Literature = 26 n=32 Full text articles removed: Hand searched articles for inclusion: Reasons for exclusion: Press release, news letter =4 n=25 No relevancy = 3; Duplicates=2 n=10 Studies Included for Data Charting & Analysis: n=47 Fig. 1 Information privacy rights PRISMA diagram peer-reviewed journal or published online, including policy documents, websites, and commentary, between January of 2000 and November of 2017. All titles and abstracts were individually examined by the reviewers AM and AK. We excluded any articles or gray literature that was aimed at the general population or cited the legislation without detailed explanation or information on application in servicing YADD. Articles not pertaining to access to or utilization of privacy legislation were excluded. Abstracts were included if they described issues related to PIPEDA or PHIPA and legislation with young adults with developmental disabilities. We in- cluded articles based on other populations (e.g. physical disability, and mental illness) and countries (EU) and USA) only if their findings were also relevant to Int J Ment Health Addiction (2018) 16:545–572 549 the developmental disability community. Articles discussing children and youth under the age of 16 were not included, and studies of adults were only included if a large portion of the reported sample in the study included young adults under 28 years of age. To ensure comprehensiveness in the evidence base, we also supplemented our list of included articles with academic literature that discussed information privacy with similarly vulnerable populations (e.g., those with mental health or decision-making capacity issues). We included studies conducted outside of Canada when findings were informative for barriers and facilitators of privacy legislation. Forty-seven articles (24 peer-reviewed and 23 gray literature) fulfilled the eligibility criteria for the scoping review. Step 4 Information was captured on Excel 2011. To ensure reliability between reviewers, a series of training exercises were conducted and inter-rater agreement for both the study inclusion and data charting phases. Changes were made based on feedback until there was consensus regarding the face validity of the tool by the two reviewers. A total of 10 randomly selected articles were evaluated by two reviewers, and 5 by three reviewers, to assess the level of agreement across all categories for each article. Reliability for level of agreement on items on the abstraction form ranged from 61 to 96%. Given the high degree of variability among the published and gray literature, the mean level of agreement obtained (79.5%) was deemed to be sufficient. All changes were verified by reviewers to ensure data accuracy. Results All analyzed articles described legislation focused on information privacy rights, in relation to collection, use, disclosure or sharing and correction, or access for checking. Eighty percent of the articles (peer-reviewed published and gray literature) also ad- dressed confidentiality and/or autonomy while only 6 articles (12%) reviewed ethical issues related to accountability on the part of the service organization. Full-length manuscripts, case studies, legislative acts, policy reports, professional practice guide- lines, service provider resources as well as literature and policy reviews were obtained for all abstracts identified for inclusion by both reviewers. Location Fifty-one percent of the 47 articles included for full text review and synthesis represented peer-reviewed published articles and 48% represented documents selected through the gray literature search. Of the published articles, five were based in the USA and three in the EU. Population While 39 articles were related to young adults with developmental disability, 8 articles from the published and gray literature did not discuss young adults or developmental disability, but to consumers of technology (n = 4), genetic researchers (n = 1), and patients with mental health diagnoses (n =3). 550 Int J Ment Health Addiction (2018) 16:545–572 Legal and Ethical Themes Within the whole sample (n = 47), all articles discussed relevant legal and ethical issues but through a variety of sub-themes. Fifty-five percent of articles discussed collection of personal information, while 42 to 45% focused on use disclosure of personal information and 25% discussed the legal and ethical issues related to correction or access to personal information that is kept within the organization. With respect to ethical principles related to the privacy of information rights, 83% focused on confidentiality, 38% on the need for autonomy, and 13% discussed accountability on the part of the organization collecting the personal information. TypesofArticles Articles from both the peer-reviewed published and gray literature included a variety of formats, from commentary to policy/legislation and literature reviews to empirical studies utilizing qualitative and/or quantitative data, and professional or organization-based guidelines. Policy and legislation reviews or discussions accounted for 22% of the total articles, while 17% represented the empirical research studies and 32% were based on reviews of the literature (please see Table 1). Fifty-six percent of articles representing the gray literature were published as guidelines, either to be used as a general resource to consumers of the organiza- tion (n = 15), or to support health professional practice (n = 5), or to communicate the organization’s policy and procedures (n = 6). Of the five articles published as professional practice guidelines specifically addressing privacy rights for use by health professionals (e.g., Occupational Therapists, Speech/Language Pathologists, Personal Support Workers), none discussed relevant parts of the legislation, or potential strategies to help the professional protect information privacy rights of those they are supporting. Rather, they referred the reader to read the PIPEDA. The remaining 46% of published gray literature included websites, information sheets, press releases, reports to the Canadian parliament, dissertation, relevant legislation, and a document of meeting minutes (please see Table 2). Discussion Despite legislation that provides standards on how to collect, use, and disseminate personal information to protect privacy, this review identifies specific factors as barriers and facilitators to access and use of information privacy rights for YADD and their families. These findings were classified according to Bronfenbrenner’s socio-ecological framework (Bronfenbrenner & Ceci, 1994) of classifying macro level (policy, legislation, attitudes), meso level (organization), exo level (community interactions), and micro level (individual, family), to more fully understand influences on access and utilization of privacy rights for young adults with developmental disabilities (please see Fig. 2). Macro Level: Policy and Legislation (National and International) At the macro level, this review suggests that aspects of policy and legislation, both in Canada and internationally, are identified as barriers to YADD exercising their privacy rights. The main factors shown to act as barriers can be categorized as relating to presentation of policy, gaps in legislation, and rise of corporate interests. Poorly written policy that is unclear (Dyke, Int J Ment Health Addiction (2018) 16:545–572 551 Table 1 Studies on privacy of personal information: study characteristics (N = 24) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 1. Mills et al., 2003 Policy analysis Not Canada: Health Collection Not addressed 1. Lack of shared databases 1.Increasing use of applicable PIPEDA information Disclosure 2. Poor integration Of Banonymising^ data PHIPA policy and technology through encryption 3. Lack of agreement on 2. Advocating for patient keeping privacy and privacy security of PHI 3. Establishing strong policies 4. Lack of commitment to 4. Willingness to invest in technological networks technological advances 2. Lafky & Horan, Mixed PHR users: USA Personal Use Confidentiality 1. Low levels of experience 1. Heightened access and 2011 methods: unwell, health Access (breach) with managing PHI sense/perception of control qualitative disabled and information Autonomy 2. Disabled less concerned, for those that are more con- interviews and well adults and less in control with cerned with privacy and quantitative privacy more able to protect their survey 3. Lower engagement in health records privacy privacy-protecting activ- ities 4. Underrepresentation of disabled people 5. Records which may be scattered among multiple providers 3. Dyke, et al., Comparative None Canada Health Disclosure Confidentiality 1. Not complying with 1. Understanding local norms 2016 legal and policy (qualified PIPEDA information PIPEDA legislative and standards and legal analysis researchers) requirements requirements 2. Difficulties identifying 2. Understanding factors jurisdiction influencing consumer 3. Complicated legal adoption of health framework for privacy information management law (public and private; tools federal and provincial) 3. Using an accountability model for ensuring that 552 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 4. Effort and cost of Canadian privacy standards sharing, protecting, and are in place ability to publishing 5. Lack of coherence between national and international privacy frameworks 6. Lack of trans-border data flow sharing 4. Yalon-Chanimiz, Review of Adults with USA Personal Collection Autonomy 1. People with ID 1. Provision of: extra time, age 2009 literature and a intellectual health access experience processing appropriate information, conceptual disability information delay, low literacy, simple language, simple model stigma layout, pictograms, and 2. Complexities in auditory means accessibility: verbal 2. Higher levels of communication, layout self-determination: more of physical environment, use of services, inclusion in product-operating their community, reducing instructions and stigma procedures 3. Training and education for service providers 5. Urowitz et al., QUAN CEOs of Canada Electronic Use and Confidentiality 1. Absence of technology to 1. Use of electronic patient 2008 (National hospitals PHIPA health access facilitate the electronic portals Scan)-survey - (N =83) records health record 2. Cultural shift of healthcare prospective, 2. Financial resources providers: to give up cross-sectional 3. Patient computer literacy Bownership^ of the files 4. Lack of hospital survey on patient needs for HER 5. Unwillingness of hospitals to providing Int J Ment Health Addiction (2018) 16:545–572 553 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed patients with access to their EHR 6. Siegel, et al., Comparative Consumers Canada Personal Use Accountability 1. Exploding growth of 1. Jurisdiction over foreign 2009 legal and policy of technology PIPEDA information (security social media, yet lacks organizations analysis USA, EU breach) detail how information is 2. Clear, consistent used for advertising, and communication as to the use how to verify consent of the information across from non-users platforms 2. Regulations are Bpiece-meal^ not explained enough 3. Developments in Canada have been only advisory 7. Geist, 2016 Critical review Consumers of Canada Personal Disclosure Confidentiality 1. Corporate, lobby group 1. Public engagement, protests of legislature technology PIPEDA information (security accountability focus on commercial for privacy rights breach) concerns 2. Mandatory breach 2. Absence of disclosure requirements Border-making power^ 3. Lack of penalties for privacy violations 4. Weak protections when outsourcing information to low protection jurisdictions 8. Larivie’re-Bastien, Review Adolescents USA Health Collection Confidentiality 1. Failure to adjust and 1. Positive attitudes and &Racine, 2011 with cerebral information autonomy focus on disability trustful, open palsy prevents focus on provider-patient relation- traditional adolescence ships free of stereotypes issues 2. Technology for 2. Lack of preparation to communication, time and the transition and social resources help with isolation autonomous consent 554 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 3. Difficulty obtaining 3. Healthcare providers can health information facilitate implicit personal 4. Needs for confidentiality autonomy even if it and privacy are not contradicts professional respected and not opinions acknowledged 5. Issues of informed consent and capacity often not addressed: opportunity to take part in decision-making not provided enough 9. Austin, 2006 Review: case Not None Consumer Collection Confidentiality None identified 1. Privacy protection shifts and legislature applicable identified information use autonomy balance of power away from business to consumers 2. Specifics of privacy give consumers clear ability to control privacy 3. Enforcing organization to comply with explicit consent for sensitive information 10. Repetto, et al., Review 1. YADD in USA Personal Collection Confidentiality 1. Legislature limited to 1. Improved guidelines for 2008 transition: HIPPAA information use Autonomy record keeping and teachers to support from FERPA disclosure documentation and may confidentiality within the Grade 6 to Access not cover the broader classroom 12 needs 2. Teaching students how to students 2. Young adults with DD do balance the advantages and 2. Family not have the knowledge, disadvantages of releasing caregiver skills and are not health personal health information 3. Teachers literate 3. Empowering and preparing students to make informed Int J Ment Health Addiction (2018) 16:545–572 555 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 3. Standards, curriculum choices related to disclosure materials and legislation andincreasingtheir do not refer to communication, reasoning disabilities and investigating skills for 4. Insufficient expansion of health promotion transition planning 5. Cannot reveal students’ personal health information as they learn, so makes teaching the content difficult. 11. Chan, & O’Brien, Review Not Canada Health Use Confidentiality 1. Precarious balance None 2011 applicable PHIPA information Autonomy between respecting Accountability client confidentiality and facilitating patient care 2. Caregivers who assume an allied care giving role not recognized as health information custodian 12. Gagnon, et al., Qualitative Canadian Not Electronic Use Confidentiality 1. Confusion, lack of 1. Increased guidance for 2016 study service identified personal Access Autonomy awareness supporting staff and for providers health Disclosure 2. Usability and relevance defining ePHR, data records with system design ownership 3. Weak user capacities and 2. Access to information and attitudes (i.e., patient sharing of health records to health literacy, education inform stakeholders and interest, support for professionals) 4. Environmental factors (i.e., government commitment, and targeted populations) 556 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 13. Joffe, 2010 Policy review Applied for Ontario Health Collection Confidentiality 1. Lack of knowledge 1. Accessible and people for Human information Autonomy 2. Confusion- > which understandable information DD Rights rights apply in which 2. Helpingpeople todevelop Commission contexts as self-advocates Code 3. Complaints procedure: 3. Rights education outside of not enough support, and service provision: ensures fear of reprisal from confidentiality service providers 4. Provision of accommodations and supports to participate in Act 5. family member/friend sup- port the personwithdis- abilities 14 Keith, 2004 Commentary Not Canadian Personal Collection Confidentiality 1. Unclear language 1.Clarity of purpose in applicable PIPEDA and information Use 2. Lack of direction in Act collecting personal USA privacy Access 3. Stringent definition of information legislature personal information 2.Consent 3. Limiting collection and use 4. Open to public review and compliance with requests for personal information access 15. Rule, 2004 Policy review Not PIPEDA Personal Collection Confidentiality 1. Lack of distinction 1. Clarify purposes for applicable information Disclosure between Bstrategic and gathering and withholding consummatory privacy information rights 2. Clarify how information is 2. Unknown or undefined shared risks 3. Logic of markets vs. logic of personal rights Int J Ment Health Addiction (2018) 16:545–572 557 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed 4. Manipulation of personal information connected to online transactions 5. Risks: profiling, matching, data mining 16. Beardwood, 2015 Review Not PHIPA and Personal Disclosure Confidentiality Not identified 1. Organizations knowingly applicable PIPEDA, health (privacy Accountability contravening the Reporting Canadian information breach) Obligation or the Digital Notification Obligation are Privacy Act guilty of punishable offense USA 2. Nothing unique or systemic EU required to report a privacy breach to Commissioner. 17. Clement, & Obar, Review Canadian PIPEDA Personal Use Confidentiality 1. Each company report is 1. Transparency reporting 2016 consumers of data of Disclosure idiosyncratic-hard to sheds useful light on internet customers compare/understand previously hidden practices company’s statistics 2. Lack of transparency: retention periods for personal information, physical location of servers, data storage, and facilities where personal information is routed 18. Davidson, et al., Comparative People with PHIPA Health Collection Autonomy 1 Laws based on mental Universal shifts from 2016 review of mental health information disorder and risk, rather institutional to international problems than decision-making community-based care legal ability frameworks 2 Complex overlaps and some logical inconsistencies of guardianship and other 558 Int J Ment Health Addiction (2018) 16:545–572 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed mental capacity laws discriminate against people with mental health problems 19. Peekhaus, 2008 National survey General PIPEDA, Health Collection Confidentiality 1. Commercial exploitation Willingness of Canadians public PHIPA, information Use Autonomy of personal information (61%) to sharing their and other and genetic 2. Domestic and genetic information with provincial data international pressures family members Health for minimum standards Information of protection for Acts personal information 3. Ministry of Health use of identifiable health information may not sit well with the Canadian public 4. Compounded safeguarding the privacy of medical information: as medical treatment migrates to complementary and alternative medicine 20. Rose, & Rose, Review of Consumers of PIPEDA, Personal Disclosure Confidentiality None identified None identified 2014 privacy law healthcare PIPA in health Alberta and information BC, Quebec Privacy Act, PHI, HIPAA and HITECH 21. Seelig, 2006 Case study HIPAA Access Confidentiality None identified None identified Int J Ment Health Addiction (2018) 16:545–572 559 Table 1 (continued) Author Type of Participants Country and Type of Privacy Ethical Barriers identified Facilitators study law information rights principle identified addressed addressed Youth Personal (24 years) and health with information Angelman Syndrome 22. Skouge, et al., Description a Young adult None Personal Collection Confidentiality None identified None identified 2007 model in transition identified health Autonomy information 23. Moore, et al., 2016 Full research Primary PIPEDA Personal Collection Confidentiality None identified None identified report; mixed healthcare health methods study users in information Southeastern Ontario 24. Wolbring, & Cross-sectional Staff of PIPEDA Electronic Collection Confidentiality 1. Very limited control over 1. Staff more skeptical towards Leopatra, 2013 study disability health Use Autonomy the collection and safe certain sensor applications service records keeping of personal than others organization information created over 2. Staff concerned over the course of participants moderate control of own lives privacy and their client’s 2. PI moderated through even lesser control over staff members their privacy 560 Int J Ment Health Addiction (2018) 16:545–572 Table 2 Gray literature on privacy of personal information: study characteristics (N = 23) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed 1. Central East Final Young adults in Canada: Health Collection Confidentiality Developmental disability 1. Client-centerd care LHIN, report-guidelines transitional age PHIPA information Autonomy identified as a barrier 2. Respect and 2009 avoidance of labels that stigmatize 2. Shimmell, & Professional Occupational Canada: Personal Reference to Confidentiality None identified None identified Gioia guidelines: student therapy students PIPEDA information Act Di Vincenzo, guide in placements PHIPA 3. Desai, 2013 Final Service providers Canada: Health Use Autonomy 1. Families not considered as 1. Stricter rules on report\-community and criminalized PIPEDA information Disclosure partner in care ^circle of care^ mental health person with PHIPA Access 2. Hesitancy to release client’s where consent is not strategy and policy mental health health information from required review problems agency files 2. Understanding the 3. No centralized information type of information delivery model that can be released 4. Not enough consent policies by whom and how for vulnerable populations with mental health issues 4. Canadian Policy review Young adults CACL’s Health Collection Autonomy 1. Attaining full citizenship in 1. Removal of stigma Association for with ID Vision information law, policy, and practice 2. Specialized services Community 2020 2. Institutional 3. New policies to Living, approach-insufficient ac- regulate restraint use 2011 cess to educational aids/- in residential devices services, and for 3. Prejudice, poverty, lack of reporting of employment equality, lack violence/abuse of economic security for against those with ID families 4. Lack of data collection on young people with DD 5. Community Not applicable Not applicable Not Personal Use Confidentiality None identified 1. Stressing protection Living- identified information of privacy and Huntsville, 2012 Int J Ment Health Addiction (2018) 16:545–572 561 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed confidentiality of personal information 2. Providing supervision in least intrusive manner, with respect for person’s right to privacy and dignity and ensuring safety and well-being 6. Ontario LAW: Legislation review: Person with PIPEDA Personal Collection Confidentiality None identified 1. Limits on collection Services and DD/ID Disability information Use and use to no more Supports to Supports Disclosure than is reasonably Promote the Act necessary to meet Social the purpose Inclusion of Persons with Developmental Disabilities Act, 7. Law Commission Policy Not applicable PIPEDA Information Collection Confidentiality 1. Complying with privacy 1. Formal substitute of review-chapter held in Use Autonomy protections precludes decision-making ar- Ontario: capacity Disclosure Accountability persons from using rangements will give Background and registry informal supports and families greater ac- Contexts in arrangements and makes it cess to supports or Which difficult for family ease the difficulties the Law members to obtain or share of providing care Operates, information 2. Use of informal 2017a network to assist decision-making 562 Int J Ment Health Addiction (2018) 16:545–572 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed 2. Checks and audits, and capacity assessment intrudes on privacy 8. Law Commission Policy/legislation Not applicable Health Personal Collection Confidentiality 1. Vagueness in law 1. Greater involvement of Ontario: Legal review and Care information Autonomy 2. Formal assessment of of families Capacity, qualitative study Consent capacity perceived as an 2. Informal social Decision-making Act, invasion of privacy networks to reduce and Guardian- Substitute 3. Default role to family-not intrusion on privacy ship: Decisions always involved 3. Supporters appointed Final Report, Act, under 2017b Mental decision-making ca- Health pacity rules required Act, to maintain confi- dentiality of infor- mation 9. Mental Health Review of policy Emerging adults PHIPA Health Collection Confidentiality 1. Clinicians strictly adhering Clinicians being Commission of and literature 16–25 years with information to altered legal status at 18 Bfamily-engaged^ Canada, 2015 mental health for confidentiality problems requirements 2. Treatment compliance is reduced 10. Kindred Home Resource Personal support PIPEDA Health Use Confidentiality None identified None identified Care, 2012 workers PHIPA information 11. Simcoe York Resource Families with PHIPA Health Collection Confidentiality Lack of information 1. Specific lists of Dual persons with ID + information regarding services/supports supports and Diagnosis mental health services Education problems 2. Specific questions to committee, 2015 ask and directions to follow 12. Wappel, 2007 Policy review Not applicable PIPEDA Personal Access None 1. Lack of definition for Clear definition of PHIPA information (have identified ^work product^ personal information information 2. Confusion and lack of corrected) specificity between Int J Ment Health Addiction (2018) 16:545–572 563 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed expressed, implied, and opt-out 13. Wedge, 2014 Dissertation Older persons PIPEDA Personal Collection Accountability 1. No means for privacy for None identified information those who suspect crime against older person to report 14. Wellington North, Meeting minutes Not applicable PIPEDA Health Disclosure Confidentiality 1. Social media use 1. Identify specific 2015 MFIPPA information 2. Lack of knowledge of strategies for PIPEDA invasion of privacy 2. Only release health information according to legislation 15. Community Policy document Agency’sboard PIPEDA Personal Disclosure Confidentiality Not identified None identified Living- of directors, staff, information Central Huron, members-at-large 2015 and the people receiving service, and those with DD 16. Office of the Report to the Genetic testing PIPEDA Personal Collection Confidentiality 1. More information is Breach reports to OPC Privacy Parliament users information Use collected: less adequate growing every year, Commissioner, Disclosure safeguards, increased risk (more since 2014) 2016 Annual (breach of and potential consequences Report to information) of privacy breaches (related Parliament on the to genetic testing) PIPEDA and the 2. Cross border privacy issues Privacy Act, increasing 2015–2016 17. Kitchener Client related All users of PHIPA Personal Collection Confidentiality 1. Court order or subpeona 1. Training staff to Downtown policy document primary care, information Use effectively Community treatments, Disclosure communicate with 564 Int J Ment Health Addiction (2018) 16:545–572 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed Health referrals, health persons with Centre, 2012 promotion disabilities. 2. Clarifying the collection, use and disclosure of personal health information 18. Legislative Committee People including PHIPA Health Disclosure Confidentiality 1. Definition of Bhealth 1. Right to education Assembly of documents/review those with information Access information custodian^ not for patients under the Ontario: Review disability entirely clear legislation (consent, of 2. Inability to access their own breaches of privacy) the Personal records due to exorbitant 2. Education for Health fees leads to people with stakeholders to Information disabilities being denied ensure they are Protection Act, social assistance, insurance, aware of their 2008 and accommodations responsibilities under the legislation. 19. Ministry of Service policy Persons PHIPA Health Disclosure Confidentiality 1. Provision of care under None identified Health manual recovering from Health information Access Autonomy CCAC is subject to sharing and Long-Term treatment, and Care of health information Care (MOHLTC), elderly persons Consent 2006 Act (HCCA), Substitute Decisions Act (SDA) 20. Renfrew County Policy and Service providers PHIPA Personal Collection None None identified None identified Catholic District procedure and health Use identified document Information Int J Ment Health Addiction (2018) 16:545–572 565 Table 2 (continued) Organization or Type of document Population of Country Type of Privacy law Ethics Barriers identified Facilitators identified author focus and law information addressed addressed School Board, 21. Trottier & Resource guide Ontario’s PIPEDA Personal Collection Confidentiality None identified None identified Kaattari, community information Use 2010 literacy agencies Disclosure on finances, administration and employment 22. Lacobucci, 2014 Independent review People in crisis PHIPA Individual’s Collection Confidentiality 1. Constraints on 2. Healthcare healthcare Use information-sharing issues institutions must information Disclosure makes coordination be- protect tween the TPS and the physician-patient mental health system less confidentiality effective and sharing of healthcare information. 23. Luker, 2009 News letter: Persons with, PHIPA Health Access Confidentiality None identified None identified College of hearing, speech, information (correction Audiologists and and language of Speech-Language difficulties information) Pathologists of Ontario 566 Int J Ment Health Addiction (2018) 16:545–572 et al., 2016; Keith, 2004; Law Commission of Ontario (LCO) 2017a; Mills et al., 2003;Rule, 2004;Wappel, 2007), and a lack of integration of technology into policy (Mills, et al., 2003) were cited often. The lack of international agreements and compliance with provincial and federal legislation in Canada, including respect for local norms around disability and privacy rights, was stated by several authors as problematic (Dyke, et al., 2016;Geist, 2016; Mills, et al., 2003; Siegel et al., 2009). Increasing levels of corporate lobbying interests and associated pressure to lower standards (Geist, 2016; Peekhaus, 2008) and exploitation of personal information (Peekhaus, 2008;Rule, 2004) were also cited as barriers. On the other hand, facilitators of information privacy rights were also supported in the articles, primarily, the need for penalties to enforce accountability (Bearwood, 2015;Desai, 2013; Dyke, et al., 2016;Geist, 2016; Joffe, 2010; Keith, 2004;LCO, 2017a;Wedge, 2014), but also increased acknowledgement and respect for disability (Canadian Association of Community Living (CACL), 2011; Community Living Huntsville, 2012; Central East Local Health Integrated Network (LHIN), 2009; Repetto et al., 2008), community, socioeconomic, and technology support (CACL, 2011; Joffe, 2010;LCO, 2017b), and higher standards for security of personal information (Community Living Huntsville, 2012;Peekhaus, 2008). Exo Level: YADD and Community Interactions At the exo level for adults with developmental disabilities, an interesting pattern of barriers and facilitators was evident consistently across articles. This related to access issues based in the interactions between YADD and their community and service providers. Barriers included insufficient knowledge leading to limited use of the existing legislation (Keith, 2004;Mental Health Commission of Canada (MHCC), 2015;Mills, etal., 2003; Repetto, et al., 2008;Rule, 2004; Simcoe York Dual Diagnosis Education Committee (SYDDEC), 2015; Wellington North, 2015), fear of reprisal for making a complaint (Joffe, 2010), lack of transparency regarding online social media platforms (Siegel et al., 2009;Rule, 2004), and use of overly Fig. 2 Conceptual framework: determinants of privacy of personal information rights for YADD Int J Ment Health Addiction (2018) 16:545–572 567 complex language and presentation of rules (Siegel et al., 2009; Yalon-Chamovitz, 2009). Most noteworthy was the observation of a failure among organizations to provide appropriate accommodations to better support consent for collection and use of personal information and advocacy (Dyke et al., 2016; Joffe, 2010;Lafky &Horan, 2011;Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Wolbring, & Leopatra, 2013; Yalon-Chamovitz, 2009). Facilitators identified at the exo level included increasing the use of advocacy supports by YADD and family caregivers (Joffe, 2010; Lafky & Horan, 2011; Mills et al., 2003), provision of technology for YADD to facilitate communication and comprehension (CACL, 2011; Larivie’re- Bastien & Racine, 2011), and most importantly, the inclusion of family members to support decision-making (Chan, & O’Brien, 2011; Desai, 2013;LCO, 2017a, b;MHCC, 2015; Peekhaus, 2008). Finally, the addition of specific instructions, in professional practice and organizational guidelines, on how to support young adults with developmental disabilities to exercise their privacy rights was cited in all articles discussing interactions with YADD in the community (Kitchener Downtown Community Health Centre, 2012; Law Commission of Ontario, 2017a, b; Legislative Assembly of Ontario, 2008; Repetto et al., 2008; Wellington North, 2015). Meso Level: Organization-Based Factors Factors related to organizations and their processes, specifically to staff relations that act either as barriers or facilitators of access and utilization of privacy of information rights, were identified at the meso level. Barriers included a persistent lack of willingness on the part of organizations to share their information databases in order to ease the stress on YADD and their families (Clement, &Obar, 2016;Desai, 2013; Dyke et al., 2016;Gagnonet al., 2016;Larivie’re-Bastien, & Racine, 2011; Peekhaus, 2008; Mills, et al., 2003; Ministry of Health and Long-Term care (MHLTC), 2006; Lacobucci, 2014; Urowitz et al., 2008) and lack of commitment to use of technological advances to protect information privacy rights (Mills, et al., 2003;Siegeletal., 2009;Urowitz et al., 2008). Throughout the review, YADD needs were found to be unrepresented in organiza- tional processes (Austin, 2006;CACL, 2011;Clement,&Obar, 2016;Siegeletal., 2009). Identified solutions that acted as facilitators at the meso level focused on the provision of greater levels of experience, training, and practice opportunities for staff to better facilitate privacy rights for YADD (Dyke, et al., 2016; Gagnon et al., 2016; Lafky & Horan, 2011; Legislative Assembly of Ontario, 2008; Wellington North, 2015; Yalon-Chamovitz, 2009). As well, imple- mentation of assessment of YADD needs for electronic health records and patient portals (Dyke et al., 2016; Urowitz et al., 2008) and enforcement of compliance among organizations in providing service that is consistent with existing privacy legislation and legislation governing the provision of individualized accommodations particularly for communication and compre- hension (Austin, 2006;CACL, 2011;Dyke etal., 2016;Geist, 2016;Ontario Law, 2008). Micro Level: Individual Disability-Related Factors A few characteristics that stem from the individual’s disability were identified as barriers at the micro level. However, it is important to note that existing legislation already provides direction to avoid these barriers but is often overlooked due to lack of compliance with privacy legislation and community-based care (Beardwood, 2015; Davidson et al., 2016; Dyke et al., 2016;Geist, 2016; Joffe, 2010;). For instance, the failure to provide individualized accommodations YADD need to exercise their rights and receive support for their decision- making due to low literacy as well as communication, comprehension, and visual difficulties 568 Int J Ment Health Addiction (2018) 16:545–572 surfaced consistently through this review (CACL, 2011; Joffe, 2010;Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008; Yalon-Chamovitz, 2009). Similarly, a lack of support to better prepare YADD during this transition period was identified as a major vehicle for YADD to become more empowered in exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010;Larivie’re-Bastien, & Racine, 2011; Repetto et al., 2008). Finally, socio- economic issues were cited as barriers to utilization of privacy rights, in that fees make it difficult for YADD and their families to make corrections to their personal information files (CACL, 2011; Laverie-Bastien, & Racine, 2011; Urowitz et al., 2008). To better facilitate access and utilization of privacy rights for YADD, provision of support in two main areas were identified: (1) provision of training to improve computer literacy and self-advocacy skills specific to information privacy rights (CACL, 2011; Joffe, 2010; Repetto et al., 2008; Urowitz et al., 2008), and (2) provision of supported decision-making through greater engagement of family members in the consent process and utilization of privacy rights (CACL, 2011; Central East LHIN, 2009; Chan & O’Brien, 2011;Davidsonetal., 2016;Lafky &Horan, 2011;LCO, 2017a, b; Joffe, 2010; Repetto et al., 2008). Recommendations The findings and discussions of these articles show that the gap between the existing legislation and access to, or utilization of, information privacy rights among YADD and their families results from three factors: (1) a lack of knowledge among YADD and their family supporters (Gagnon et al., 2016; Joffe, 2010; Lacobucci, 2014;Lafky &Horan, 2011;Repetto et al., 2008; Yalon-Chamovitz, 2009), (2) a tendency of organizations to interpret or adhere to privacy laws inconsistently (Clement & Obar, 2016; Desai, 2013;Dykeetal., 2016; Geist, 2016; Peekhaus, 2008; Wolbring & Leopatra, 2013; Urowitz et al., 2008), and (3) a lack of access to the tools needed to support YADD exercising their information privacy rights (Davidson et al., 2016; Joffe, 2010;Larivie’re-Bastien & Racine, 2011; Mills et al., 2003; Repetto et al., 2008; Skouge et al., 2007; Urowitz, et al., 2008; Yalon-Chamovitz, 2009). In connection with the findings reviewed, we recommend the following three areas that need to be addressed by privacy commissioners and organizations supporting young adults with developmental disabilities. First, and foremost, awareness, knowledge, and skills need to be raised among organizational staff, families, and YADD. In this way, self-advocacy will occur more frequently, and families will be included in the YADD’s core support and privacy rights education in their high school curriculum. Second, promotion of information privacy legislation through education for organizational staff is required. In particular, implementation of manuals with specific guidelines instructing staff with strategies to use the privacy legislation is suggested. Finally, targeted transla- tion of existing legislation that will allow more YADD and their families to exercise their privacy of information rights is recommended. Limitations This review has some limitations. Our literature search was limited to articles focusing on privacy legislation and developmental disabilities, and this search strategy may have contributed to excessively narrow range of articles included. Several exceptions for inclusion were established to capture relevant articles and to make it possible to broaden Int J Ment Health Addiction (2018) 16:545–572 569 the capture of relevant barriers and facilitators also relevant to YADD. The articles differed not only in their objectives and methodology or type of article, but also showed great heterogeneity in approach to considering the issue of privacy of information rights. While quality was consistently high (such as representative samples, standardized tools, in depth policy discussion), the total number of empirical studies was very few (n = 6). It is important that future studies examine public understanding of privacy rights and pathways to accessing tools to exercise privacy rights. Finally, the presentation of our findings in Fig. 2 (Conceptual Framework: Determinants of Privacy of Personal Infor- mation Rights for YADD) presents a systems perspective. Our interpretation of our findings is influenced by this perspective. Conclusion In this scoping review, 24 peer-reviewed articles and 23 articles from the gray literature were identified which examined the barriers and facilitators for access and utilization of informa- tion privacy rights in relation to the needs of young adults with developmental disabilities and their families. A basic requirement in protecting individual privacy rights is informing people of their rights so they know when a violation has occurred and how it can be remedied. This becomes a challenge to organizations trying to support families and their YADD as communication and information sharing can be complicated, often requiring accommodations or supports for the decision-making. The implications of the challenges typically experienced by YADD are tremendous, especially for providing support for provi- sion of consent and decision-making to ensure ensuring confidentiality and autonomy throughout the protection of personal information privacy (Joffe, 2010). Although some parallels can be made with elderly citizens or persons with physical disabilities, important and distinct differences exist for YADD whose chronological age indicate adult, but who may not have sufficient decision-making capacity, and, more often than not, may be restricted as a result of their mode of communication or literacy level. By the time the potential privacy breach is voiced, or even recognized, young adults with developmental disabilities may have already lost some of their privacy rights in the process. For this reason, and because existing privacy legislation exists, the present review suggests that increasing awareness, education, and knowledge translation tools for all involved, especially YADD, family caregivers, and service providers, will help to combat the disadvantage in exercising information privacy rights by young adults with developmental disabilities. Acknowledgements This project was funded by the Office of the Privacy Commissioner of Canada (OPC); the views expressed herein are those of the authors and do not necessarily reflect those of the OPC. Compliance with Ethical Standards Conflict of Interest The authors declare that they have no conflict of interest. Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and repro- duction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. 570 Int J Ment Health Addiction (2018) 16:545–572 References Arksey, H., & O’Malley, L. (2005). Scoping studies: towards a methodological framework. Journal of Social Research Methodology, 8,19–32. Austin, L. (2006). Is consent the foundation of fair information practices? Canada’s experience under PIPEDA. The University of Toronto Law Journal, 56(2), 181–215. Beardwood, J. (2015). The new Canadian digital privacy act: the good, the bad and the ugly. new legislation creates new problems as it fixes others. CRI, 129–134. Bronfenbrenner, U., & Ceci, S. (1994). Nature-nurture reconceptualized in developmental perspective: a bioecological model. Psychological Review, 101(4), 568–586. Canadian Association for Community Living. (2011). Inclusion of Canadians with intellectual disabilities. Toronto: CACL Retrieved from http://www.cacl.ca/sites/default/files/National%20Report%20 Card%202013%20ENG%20Final.pdf. Central East Local Health Integration Network. (2009). Final Report. Early youth interventions project report. Transitional Age Youth and Health Promotion. Ontario: Central East LHIN Retrieved from http://www. canadian-patient-consent-form.com/form/86347912-Full-Report-Central-East-LHIN. Chan, B. W., & O’Brien, A. M. (2011). The right of caregivers to access health information of relatives with mental illness. International Journal of Law and Psychiatry, 34(6), 386–392. Clement, A., & Obar, J. A. (2016). Keeping internet users in the know or in the dark an analysis of the data privacy transparency of Canadian internet carriers. Journal of Information Policy, 6,294–331. Colquhoun, H. L., Levac, D., O’Brien, K. K., Straus, S., Tricco, A. C., & Perrier, L. (2014). Scoping reviews: time for clarity in definition, methods, and reporting. Journal of Clinical Epidemiology, 67(12), 1291–1294. Community Living-Central Huron. (2015). Community living-Central Huron policies & procedures. Ontario: CL-CH Retrieved from http://www.clch.ca/policy. Community Living- Huntsville. (2012). Section policies & procedures. Policy title service records and retention. Ontario: Community Living-Huntsville Retrieved from http://www.clhuntsville.ca/wp-content/uploads/2014 /02/Policy-and-Procedures.pdf. Davidson, G., Brophy, L., Campbell, J., Farrell, S. J., Gooding, P., & O’Brien, A. (2016). An international comparison of legal frameworks for supported and substitute decision-making in mental health services. International Journal of Law and Psychiatry, 44,30–40. Desai, A. (2013). Towards an integrated network (second edition): working together to avoid criminalization of people with mental health problems. Ottawa, ON: St. Leonard’s Society of Canada. Developmental Services Ontario. (2016). What is a developmental disability? Ontario: DSO Retrieved from: http://www.dsontario.ca/whats-a-developmental-disability. Dyke, S. O. M., Saulnier, K. M., Pastinen, T., Bourque, G., & Joly, Y. (2016). Evolving data access policy: the Canadian context. Facets, 1(1), 138–147. Fogden, B., Thomas, S., Daffern, M., & Ogloff, J. (2016). Crime and victimisation in people with intellectual disability: a case linkage study. BMC Psychiatry, 16,170. Gagnon, M.-P., Breton, E., Fortin, J.-P., Khoury, L., Dolovich, L., Price, D., Wiljer, D., Bartlett, G., & Archer, N. (2016). Adoption of electronic personal health records in Canada: perceptions of stakeholders. International Journal of Health Policy Management, 5(7), 425–433. Geist, M. (2016). The policy battle over information and digital policy regulation: a Canadian perspective. Theoretical Inquiries in Law, 17,415–449. Joffe, K. (2010). Enforcing the rights of people with disabilities in Ontario’s developmental services system. In The Law as it affects persons with disabilities. Ottawa: Law Commission of Ontario. Keith, B. C. (2004). Privacy north of the border: 10 things you should know about Canadian personal information laws. American Bar Association, Business Law Section, 14(2). Retrieved from http://www.americanbar.org/content/dam/aba/publications/blt/2004/11/privacy-north-of-border- 200411.authcheckdam.pdf. Khanlou, N. (2018). Final report: Developmental services research Grant Fund. Toronto: York University. Khanlou, N., Haque, N., Mustafa, N., Vazquez, L. M., Mantini, A., & Weiss, J. (2017a). Access barriers to services by immigrant mothers of children with autism in Canada. International Journal of Mental Health and Addiction, 15(2), 239–259. Khanlou, N., Mantini, A., & Degendorfer, K. (2017b). The YADD privacy project: improving privacy for young adults with developmental disabilities through research and innovative knowledge translation. Toronto: York University. Khanlou, N., Mustafa, N., Vazquez, L. M., Davidson, D., & Yoshida, K. (2017c). Mothering children with developmental disabilities: a critical perspective on health promotion. Health Care for Women International, 38(6), 613–634. Int J Ment Health Addiction (2018) 16:545–572 571 Kindred Home Care. (2012). Life at home just got better: providing kindred care. New Brunswick: KHC. Retrieved from kindredhomecare.com/wp-content/uploads/2012/10/KHC-Training-Textbook-Sample.pdf. Kitchener Downtown Community Health Centre. (2012). Kitchener downtown community health Centre: client related policies. Kitchener, ON: KDCHC Retrieved from http://www.kdchc.org/wp-content/uploads/2012 /02/Client-Policies-Web-2.pdf. Lacobucci, F. (2014). Police encounters with people in crisis: an independent review. Toronto Police Service, 1–413. Lafky, D. B., & Horan, T. A. (2011). Personal health records: consumer attitudes toward privacy and security of their personal health information. Health Informatics Journal, 17(1), 63–67. Larivie’re-Bastien, D., & Racine, E. (2011). Ethics in health care services for young persons with neurodevelopmental disabilities: a focus on cerebral palsy. Journal of Child Neurology, 26(10), 1221–1229. Law Commission of Ontario. (2017a). Background and contexts in which the law operates.Toronto:LCO Retrieved from https://www.lco-cdo.org/en/our-current-projects/legal-capacity-decision-making-and- guardianship/legal-capacity-decision-making-and-guardianship-discussion-paper-2/i-background-and- contexts-in-which-the-law-operates-2/. Law Commission of Ontario. (2017b). Legal capacity, decision-making and guardianship: final report. Toronto, ON: LCO Retrieved from https://www.lco-cdo.org/en/our-current-projects/legal-capacity-decision-making- and-guardianship/. Legislative Assembly of Ontario. (2008). Committee documents: standing committee on social policy - 2008- Aug-28—review of the Personal Health Information Protection Act, 2004. Ottawa, ON: Legislative Assembly of Ontario Retrieved from http://www.ontla.on.ca/web/committee-proceedings/committee_ transcripts_details.do?locale=en&Date=2008-08-28&ParlCommID=8875&BillID=&Business= Review+of+the+Personal+Health+Information+Protection+Act%2C+2004&DocumentID=23176 #P84_5361. Luker, K. (2009). The age of the electronic health record. CASLPO Today, 7(3), 13–17. Mental Health Commission of Canada. (2015). Taking the next step forward: Building a responsive mental health and addictions system for emerging adults. Ottawa, ON: MHCC. Mills, S. K., Yao, R. S., & Chan, Y. S. (2003). Privacy in Canadian health networks: challenges and opportu- nities. Leadership in Health Services, 16(1), 1–10. Ministry of Health and Long-Term Care. (2006). Community care access centres: client services policy manual. Toronto: MHLTC Retrieved from http://www.ontla.on.ca/library/repository/mon/26004/316651.pdf. Moore, K.M., Belanger, P., & Biro, S. (2016). Understanding health inequities and access to primary health care in Southeastern Ontario. Retrieved from http://www.kflaphi.ca/wp-content/uploads/HealthInequities_ FullReport.pdf. Office of the Privacy Commissioner. (2016). 2015–2016 annual report to parliament on the personal informa- tion protection and electronic documents act and the privacy. Gatineau, QC: OPC Retrieved from https:// www.priv.gc.ca/en/opc-actions-and-decisions/ar_index/201516/ar_201516/. Ontario Law. (2008). Services and Supports to Promote the Social Inclusion of Persons with Developmental Disabilities Act, 2008, S.O. 2008, c. 14. Ontario: Ontario Law Retrieved from https://www.ontario. ca/laws/statute/08s14. Peekhaus, W. (2008). Personal health information in Canada: a comparison of citizen expectations and legisla- tion. Government Information Quarterly, 25,669–698. Personal Health Information Protection Act (PHIPA), 2004, SO 2004, c 3, Sch A. (2004). Retrieved from: http://canlii.ca/t/53154. Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5. (2000). Retrieved from: http://canlii.ca/t/52hmg. Repetto, J. B., Gibson, R. W., Lubbers, J. H., Gritz, S., & Reiss, J. (2008). Practical applications of confidentiality rules to health care transition instruction. Remedial and Special Education, 29(2), 118–126. Renfrew County Catholic District School Board. (2014). INDEX: administration policies & procedures. Appropriate use of technology guidelines. Renfrew, ON: RCCDSB Retrieved from: https://drive.google. com/file/d/1RJyTkV_X433H4mdT2Zvim3DGQFznQrOp/view, Index. Roebuck, R., Paquet, M. & Coultes-Macleod, J. (2008). Improving health outcomes for children and youth with developmental disabilities. Retrieved from: http://www.surreyplace.on.ca/documents/Resources/Children's%20 Forum%20Literature %20Review_final(web).pdf. Rose, R. V., & Rose, L. H. (2014). Appreciating healthcare data privacy laws in Canada, the United Kingdom, and the United States. The EDP Audit, Control, and Security Newsletter, 49(5), 18–24. Rule, J. B. (2004). Toward strong privacy: values, markets, mechanisms and institutions. University of Toronto Law Journal, 54(2), 183–225. Seelig, R. (2006). New technology provides urgent medical information and protects privacy: providing important information in medical situations for the developmentally disabled. The Exceptional Parent, 36(5), 47–51. 572 Int J Ment Health Addiction (2018) 16:545–572 Shimmell, L., & Gioia Di Vincenzo, G. D. (Eds.). (2017). Master of science occupational therapy MSc (OT). Clinical education handbook. Hamilton, ON: McMaster University, Faculty of Health Sciences. Siegel, A., Denny, W., Poff, K. W., Larose, C., Hale, R., & Hintze, M. (2009). Survey of privacy law developments in 2009: United States, Canada, and the European Union. The Business Lawyer, 65(1), 285–307. Simcoe York Dual Diagnosis Education Committee. (2015). Supports and services for persons with a dual diagnosis: a resource manual for York region families. Simcoe York, ON: SYDDEC Retrieved from http://www.community-networks.ca/wp-content/uploads/2015/11/central-york-ddx-resource-guide.pdf. Skouge, J.R., Kelly, M.L., Roberts, K.D., Leake, D.W., & Stodden, R.A. (2007). Technologies for self- determination for youth with developmental disabilities. Education and training in developmental disabil- ities, 42(4), special conference issue research to practice, 475–482. Tricco, A., Lillie, E., Zarin, W., O’Brien, K., Coquohoun, H., Kastner, et al. (2016). A scoping review on the conduct and reporting of scoping reviews. BMC Medical Research Methodology, 16(15), 1–10. Trottier, V. & Kaattari. J. (2010). Capacity Plus: Organizational Capacity Resource Guide for Ontario’s Community Literacy Agencie. Community literacy of Ontario. Retrieved from http://www. communityliteracyofontario.ca/wp/wp-content/uploads/2013/08/capacity_plus_book_02.pdf. Urowitz, S., Wiljer, D., Apatu, E., Eysenbach, G. DeLenardo, C, Harth, T., Pai, H., & Leonard, K.J. (2008). Is Canada ready for patient accessible electronic health records? A national scan. BMC Medical Informatics and Decision Making,8(33), 1–7. Wappel, T. (2007). Statutory review of the personal information protection and electronic documents act (PIPEDA): 4th report of the Standing Committee on Access to Information, Privacy and Ethics /. Standing Committee on Access to Information, Privacy and Ethics, 2007. Retrieved from https://search. library.utoronto.ca/details?6228520. Wedge. (2014). Enduring powers of attorney and financial abuse of older persons are existing safeguards sufficient? Retrieved from http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.855.5092&rep=rep1 &type=pdf. Wellington North. (2015). Admin. & finance committee meeting minutes. Retrieved from https://wellington- north.com/content/government/committees-of-council/administration-finance-committee/2015-agendas- minutes/12-17-2015-administration-finance-minutes.pdf. Wolbring, G., & Leopatra, V. (2013). Sensors: views of staff of a disability service organization. Journal of Personalized Medicine, 3,23–39. Yalon-Chamovitz, S. (2009). Invisible access needs of people with intellectual disabilities: A conceptual model of practice. Intellectual and Developmental Disabilities, 47(5), 395–400.

Journal

International Journal of Mental Health and AddictionSpringer Journals

Published: Apr 18, 2018

References

You’re reading a free preview. Subscribe to read the entire article.


DeepDyve is your
personal research library

It’s your single place to instantly
discover and read the research
that matters to you.

Enjoy affordable access to
over 18 million articles from more than
15,000 peer-reviewed journals.

All for just $49/month

Explore the DeepDyve Library

Search

Query the DeepDyve database, plus search all of PubMed and Google Scholar seamlessly

Organize

Save any article or search result from DeepDyve, PubMed, and Google Scholar... all in one place.

Access

Get unlimited, online access to over 18 million full-text articles from more than 15,000 scientific journals.

Your journals are on DeepDyve

Read from thousands of the leading scholarly journals from SpringerNature, Elsevier, Wiley-Blackwell, Oxford University Press and more.

All the latest content is available, no embargo periods.

See the journals in your area

DeepDyve

Freelancer

DeepDyve

Pro

Price

FREE

$49/month
$360/year

Save searches from
Google Scholar,
PubMed

Create lists to
organize your research

Export lists, citations

Read DeepDyve articles

Abstract access only

Unlimited access to over
18 million full-text articles

Print

20 pages / month

PDF Discount

20% off