Private org has control of Alberta recovery patients' health info
My Recovery Plan was implemented to evaluate and manage substance use treatment waitlists across Alberta. Documents reveal how it denies patients informed consent and control of their personal health information.
In her August 2023 mandate letter to Minister of Mental Health and Addiction Dan Williams, Premier Danielle Smith outlined the need for "electronic information gathering systems to ensure that system outcomes are standardized, transparent, [and] focus on recovery-based outcomes."
But according to more than 1,000 pages of documents obtained by Drug Data Decoded, the government's system to track substance-use outcomes is neither transparent nor primarily focused on the recovery of people seeking substance-use support.
A privately-owned app, which is now mandatory in publicly funded detox and residential recovery facilities in Alberta, is raising serious privacy, consent and transparency red flags.
My Recovery Plan is owned by BC-based Last Door Recovery Society. The app was sole-source contracted by the Ministry of Mental Health and Addiction (MHA) in 2021 for implementation by Alberta Health Services (AHS). The existence of contracts between AHS and Last Door remains undisclosed, and the AHS sole-source contract list has not been updated since 2022.
The app’s central function is to measure “recovery capital” scores of clients, generated from 120 questionnaire responses taken at the start and end of a bed-based program. The scores track improvements in recovery indicators, such as physical and mental health, housing, family, social support, leisure activities, and, emphatically, abstinence from drugs.
In December 2023, Drug Data Decoded flagged My Recovery Plan as a key channel through which the Alberta government is privatizing health information of people seeking substance use support. Responding to a request for data on reasons for patient discharge, Alberta’s Ministry of Health stated that "the Government of Alberta does not have access to the information held in My Recovery Plan (MRP) as it is a proprietary product of the Last Door Recovery Society."
In other words, My Recovery Plan's private ownership allows the government to stonewall requests for data.
The new documents, obtained through freedom of information requests by Drug Data Decoded, reveal how the implementation of My Recovery Plan is violating the privacy and informed consent of people accessing bed-based recovery services across Alberta.
Euan Thomson
In 2023, the My Recovery Plan (MRP) implementation team, comprising AHS and Last Door Recovery Society employees, circulated a FAQs for Service Providers stating that “outcomes based funding decisions in the future will consider agency level results from MRP.” For treatment facilities, this meant future funding eligibility would be tied indirectly to use of the app by clients and directly to improvements in “recovery capital” scores generated by each facility. These scores are central metrics by which the Alberta government is evaluating its substance-use strategy, though no data has yet been made public.
On February 28, 2024, a month before the Alberta government's "non-negotiable" My Recovery Plan launch, the Deputy Minister of MHA circulated a letter to service providers that sent another chill through the bed-based treatment sector. The letter, addressed to treatment facilities, informed them that “consistently using MRP with every client…is a requirement of your funding,” then proceeded to admonish service providers for the app’s low uptake among clients. The Deputy Minister emphasized that "My Recovery Plan data will be watched very closely by the Ministry over the coming months for overall utilization rates.”
In response, a service provider raised an ominous contradiction with the implementation team: “We've been directed that participation with My Recovery Plan is Mandatory…[but] as you can see [the consent form] clearly states that My Recovery Plan is an optional program. If there is an updated one would you be able to forward that to us?”
The implementation team replied to the service provider that “by changing to a Privacy Notice along with creating some of these additional [video and information] resources it will help with client's participation in My Recovery Plan.”
Finalized on April 1, My Recovery Plan's formal launch date, the Privacy Notice was an apparent end-run around the need for paper-based written consent by clients to provide personal health information to Last Door Recovery Society. It was to be read to clients on admission to a waitlist and again on admission to a bed. In both cases, a box is ticked in the app indicating the client has provided consent or has been read the Privacy Notice.
Not informed? Not consent.
AHS policy dictates that informed consent must be obtained for medical treatment except "where it is immediately necessary to preserve the patient’s life, prevent serious physical or mental harm to the patient, or to alleviate serious pain... The requirement for informed consent may be overridden by a warrant, subpoena, court order, or applicable legislation." In the case of bed-based treatment, none of the above exceptions apply and no legislation exists to compel anyone into treatment, though that may soon change as the government develops legislation for ‘compassionate intervention.’
Euan Thomson
Informed consent must meet six conditions: the individual must have the capacity to make an informed decision and be given the chance to understand by asking questions, the information must be complete and specific, the procedure must be voluntary, and consent must be documented – this includes a signature by a witness who cannot be the health practitioner responsible for the intake.
Each of these conditions appears to be violated by My Recovery Plan's current operating scheme.
When one detox facility flagged that “some clients are not in a place to answer” the intake questionnaire, the implementation team decided that such clients nonetheless meet the preconditions of capacity and understanding to feed their health information to a private contractor. Clients lacking capacity to complete forms and practitioners perceiving this ethical quandary could explain why detox facilities struggled the most among bed-based service providers to implement My Recovery Plan.
Alberta government pressure on treatment facilities staff is clear in correspondence. One facility staff member described how “trying to get clients to consent to using My Recovery Plan (despite our best effort) has been unsuccessful,” (emphasis added). Potential clients resisted in part because of concerns about where their data would end up: “Some of the feedback has been that they don't want any information online about them even if anonymous,” the staff member wrote.
Another condition of informed consent is that the information is complete. However, it is not disclosed on the Privacy Notice or any other documents – including the explainer video created by the government for incoming clients – that 'Information Technology staff' at Last Door Recovery Society are authorized to view individual patient data. This fact is only visible in the AHS Privacy Impact Assessment submitted to the Office of the Information and Privacy Commissioner (OIPC), invisible to the public and clients.
To understand the power held by the Privacy Commissioner to enforce the Health Information Act, Drug Data Decoded asked the OIPC if the Health Information Act gives the Privacy Commissioner power to enforce the Act after receiving a Privacy Impact Assessment (PIA). The OIPC replied that it "does not accept or reject PIAs, it reviews them."
It turns out such power does not reside in the working ranks, either. The week of My Recovery Plan’s formal launch, staff at one service provider pushed back on the newly implemented Privacy Notice, insisting they “do not feel comfortable checking the box that clearly states that client signed consent is needed, without actually having the client sign the consent form (which currently does not exist).” They informed the implementation team they would “wait until this is resolved.”
All the same, on April 3, the implementation team announced its “privacy workaround” to remove the need for a client signature, completing the switch to a Privacy Notice across the system. According to internal correspondence, this change was approved by the AHS Privacy department.
Wishes expressed, denied
The Privacy Notice, Privacy Impact Assessment and other documents repeatedly emphasize that participation in My Recovery Plan is voluntary. However, clients attempting to withdraw consent are faced with an unfortunate reality.
Patients who decide to leave the app are given an “Expressed Wishes” document. That form fails to disclose that the client’s collected health information could be held indefinitely by Last Door Recovery Society. This appears to be written into the AHS Privacy Impact Assessment.
The Privacy Impact Assessment has gone through multiple drafts. The latest version submitted to the Privacy Commissioner suggests that Last Door may be treating initial verbal consent as an open invitation to a future sales pitch – even if consent is later withdrawn.
This version changed a reference to the patient’s data being “deleted” to instead say the data would “no longer” be “active.” That data wouldn’t be used for reporting in the future, but there is no longer an option to have their personal data removed entirely.
This issue played out in July 2023, as a client at one facility expressly withdrew consent and sought to have her information removed from My Recovery Plan. The service provider contacted the implementation team, who informed them that “if they gave consent to be on the waitlist they can stay on that list just mark them as not admitted.”
Another client at the same treatment facility was caught using drugs, prompting her discharge from the program. The service provider asked whether her name and information should be removed from My Recovery Plan, to which the implementation team responded that they “can leave her on the wait list, again mark her as not admitted.”
The first client clearly wanted her information removed from My Recovery Plan. And despite her expressed wish for privacy, the service provider communicated both names over unencrypted email.
By November 2023, the implementation team was taking more care with names, noting in response to a separate withdrawal of consent that they would “send an encrypted email for the client's name. We don't want personal information flowing through regular email channels.”
Consenting to commerce
The Health Information Act is clear about the use of health information for commercial purposes: “No individual shall knowingly use individually identifying health information to market any service for a commercial purpose or to solicit money unless the individual who is the subject of the health information has specifically consented to its use for that purpose.”
While clients are engaged with AHS, their information is subject to that Act, but the Privacy Impact Assessment appears to obscure the fact that after clients exit their agreement with AHS, their health information persists in My Recovery Plan. It states that “information will be archived” by Last Door and they “can manually delete the data as requested by the client or AHS or when the data meets the AHS records retention schedule.” This presumably refers to the patient records regulation in the AHS Records Retention Schedule, which stipulates that records should be retained for at least 10 years – with no obligation that they must be destroyed at all.
It remains an open question who can access the data while clients are engaged with AHS and thereafter. A “FAQs for Clients” circulated in July 2023 provides key messaging that service providers were encouraged to share with clients asking such questions:
According to the Privacy Policy on the My Recovery Plan website, personal information can be disclosed without a client’s consent “where required to provide a service you signed up for or to give effect to a court order.” The Policy explains that My Recovery Plan collects personal information “to process online requests you submit to us for quotes or financial products and services,” including “news updates and promotional material.” Furthermore, the policy reads, “signing the Consent for Treatment forms authorizes the components you do business with to share among them the personal information you provided.”
The translation of this appears to be that Last Door’s “components,” such as their New Westminster treatment centre or Downtown Calgary sales office, can access personal information uploaded to My Recovery Plan.
On August 19, Last Door Recovery Society was approached by email for comment on the use of My Recovery Plan client data for sales and marketing purposes, on whether all information uploaded to My Recovery Plan is subject to the Health Information Act, and for the organization’s policy on long-term storage of personal data. Last Door did not respond, so the Ministry of Mental Health and Addiction was approached on August 20. The Ministry also did not respond.
AHS Media Relations was asked on August 19 how the health service verifies that patient data is destroyed after a request is submitted, as well as whether any contracts exist between AHS and Last Door. The department acknowledged the request but declined to comment.
It is unclear how the statements in the My Recovery Plan Privacy Policy square with the AHS FAQ for Clients.
In its Privacy Impact Assessment, AHS states that a client’s desire to withdraw consent is only subject to consideration by the health service: “If a patient expresses a wish in regard to the disclosure of his or her information, it is the responsibility of AHS to ensure the patient’s expressed wish is considered.” In plain language: there is no obligation to fulfill this request if a health care provider believes it is in the patient's best interest to remain in the system.
As a final hex upon its users, the My Recovery Plan Privacy Policy gives the wrong email address for private participants to withdraw consent: publicrelations@lasstdoor.org carries an extra ‘s’ in the domain name.
Under the banner of a ‘recovery-oriented system of care’ (ROSC), the Alberta government has built considerable infrastructure that funnels people toward My Recovery Plan. Its recent investments include $10 million for “Compassionate intervention implementation intake and assessment centres.” It is unclear whether these are synonymous with the Edmonton and Calgary ‘navigation centres’ to which unhoused people are being sent after eviction from tents. Last week, the government cut the ribbon on a 75-bed recovery community and workforce training institute run by ROSC Solutions Group Inc. This company also received $12.5 million of the 2023-24 budget to launch Alberta’s therapeutic living units, which appear to facilitate treatment privatization in prisons. With publicly funded recovery facilities now forced to adopt My Recovery Plan, there are vanishingly few situations in which people who use drugs can avoid pressure to use the app.
Whether or not they are accessing services voluntarily, clients in this system are being urged to trust their health information with a private organization that has done little in recent years to demonstrate integrity. In February 2023, New Westminster Police revealed they were investigating sexual assault allegations against a longtime contractor employed by Last Door Recovery Society. The contractor was charged in May 2023 with sexual assault against three former clients of Westminster House, described by a former client as Last Door’s sister centre. In June 2023, two stories broke describing how upper management at Last Door ignored the “open secret” of the contractor’s alleged predatory behaviour and attempted to silence people giving voice to their abuse.
Patients concerned about the use and disclosure of their personal health information are entitled to request a review or file a complaint free of charge with the Office of the Information and Privacy Commissioner, under Section 85(e) of the Health Information Act.
Don't miss the follow-up to this story.
Story tips, questions or comments: info@drugdatadecoded.ca
Drug Data Decoded provides analysis on topics related to prohibitionist drug policy using news sources, publicly available data sets and freedom of information submissions, from which the author draws reasonable opinions. The author is not a journalist.
