is changing the way that law and policy regulate the use of health data.104
Given the challenges to sharing health data within a country, these challenges
can be more complex for sharing across borders.105 Even between countries
as closely aligned as the United States and Canada,106 cultural and political
differences can slow or even prevent the flow of data for critical health
needs.107 Here, trust works on several levels; each country needs to be able
to trust that its partners will protect sensitive health data108 and will not hide
data for fear of economic consequences.109
The American approach to privacy differs from other countries;
Americans look at privacy sector by sector,110 whereas other countries take a
holistic view of data privacy, regardless of the type of data.111 Further,
reactions to American surveillance techniques and authorizations, such as the
USA PATRIOT Act,112 have led to Canadian provinces prohibiting Canadian
health information from being stored in American-based data storage.113
104. See infra Part III.
105. OECD PRIVACY, supra note 31, at 30 (“Transborder flows of personal data, to
Member countries or non-Member countries, present risks, which data controllers must
106. Fact Sheet: United States-Canada Relationship, WHITE HOUSE (Mar. 10, 2016),
%E2%80%93-canada-relationship; see also CANADA-US HEALTH SUMMIT 2015, supra note
74 (noting partnership between Canada and the United States to advance the Global Health
Security Agenda); see also Oliver Kim & Dani Peters, Health is not Always Local: Beginning
a Cross-Border Health Dialogue, HEALTH AFFS. BLOG (Mar. 22, 2016),
border-health-dialogue/ (“At both the federal and the state/provincial levels, regulatory and
surveillance systems are communicating with one another, on a frequent basis, for public
107. Sane & Edelstein, supra note 99, at 18.
108. OECD PRIVACY, supra note 31, at 30 (“Some data flows may require close attention
because of the sensitivity of the data or because the receiving jurisdiction may lack either the
willingness or capacity to enforce privacy safeguards.”).
109. See, e.g., Huang, supra note 93, at 116–17; see also Tom Leonard, Swine flu: Wall
of Silence in Mexico’s Cancun Holiday Resort, DAILY TELEGRAPH (Apr. 29, 2009),
110. BARRY FURRO W ET AL., HEALTH LAW 171–73 (2d ed. 2000).
111. Vadim Schick, Data Privacy Concerns for U.S. Healthcare Enterprises’ Overseas
Ventures, 4 J. HEALTH & LIFE SCI. L. 173, 178 (2011) (“In contrast [to American law], many
foreign data privacy regimes, including the laws reviewed in this section, are privacy laws of
general application, which apply to all personally identifiable information, including, but not
limited to, health-related data.”); see also Elana Rivkin-Haas, Electronic Medical Records and
the Challenge to Privacy: How the United States and Canada are Responding, 34 HASTINGS
L.J. 177, 194–95 (2011).
112. Uniting and Strengthening America by Providing Appropriate Tools Required to
Intercept and Obstruct Terrorism (USA PATRIOT Act) Act of 2001, Pub. L. No. 107–56, 115
113. See infra III. B. 2.