Brian Beamish. Commissioner (Acting) Ontario Information and Privacy Commission. Cyber Risk National Conference February 9, 2015
|
|
|
- Isaac Doyle
- 8 years ago
- Views:
Transcription
1 Preventing Privacy Breaches and Building Confidence in Electronic Health Records Brian Beamish Commissioner (Acting) Ontario Information and Privacy Commission Cyber Risk National Conference February 9, 2015
2 Mandate and Role The Office of the Information and Privacy Commissioner of Ontario (IPC) provides an independent review of government decisions and practices concerning access and privacy. The Commissioner is appointed by and reports to the Legislative Assembly while remaining independent of the government of the day to ensure impartiality.
3 Oversees Three Acts Freedom of Information and Protection of Privacy Act (FIPPA); and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA): Provides right of access to information and appeals to the IPC. Privacy complaints may be filed with IPC investigations may result in recommendations or orders. Personal Health Information Protection Act (PHIPA): Provides comprehensive privacy protections for personal health information; right of access to personal health information, and a right to complain to the IPC.
4 Importance of Protecting Personal Health Information
5 Unique Characteristics of Personal Health Information Highly sensitive and personal in nature. Must be shared immediately and accurately among a range of health care providers. Widely used and disclosed for secondary purposes seen to be in the public interest (e.g., research, operational planning). Dual nature is reflected in PHIPA.
6 Consequences of Inadequate Attention to Privacy
7 Consequences for Individuals Discrimination, stigmatization, psychological harm. Deterred from seeking testing or treatment. Withhold or falsify information. Loss of trust or confidence in the health care provider. Loss of confidence in electronic health records
8 Consequences for Health Information Custodians and their Agents Suspension or termination. Disciplinary action. Damage to reputation. Lost time and expenditure of resources. Legal liabilities and ensuing proceedings.
9 Common Causes of Breaches Related to Electronic Records
10 Health Orders concerning Mobile and Portable Devices Order HO-004: Theft of a laptop containing the unencrypted personal health information of 2,900 individuals. Order HO-007: Loss of a USB memory stick containing the unencrypted personal health information of 83,524 individuals. Order HO-008: Theft of a laptop containing the unencrypted personal health information of 20,000 individuals.
11 How to Prevent This Type of Breach STOP and ask, Do I really need to store personal health information on this device? THINK about alternatives: De-identify or code information. Use remote access through a secure connection. PROTECT the information on mobile devices: Encrypt and protect with strong passwords. Carry the least amount of identifying information. Have policies and procedures, training and audits.
12 Unauthorized Access to Electronic Records
13 The Meaning of Unauthorized Access There have consistently been cases of unauthorized access in Ontario where health records have been accessed without consent and for purposes not permitted by PHIPA. Unauthorized access includes viewing PHI. This problem becomes more acute with the growth of electronic health records.
14 Order HO-002 The Story A patient told a hospital that her estranged husband and his girlfriend were employees and she did not want them to know she was a patient. The girlfriend, a nurse who was not involved in the health care of the patient, viewed the patient s record on numerous occasions.
15 The hospital was ordered to: Order HO-002 The Outcome Review and revise its practices and procedures relating to personal health information and privacy. Implement a protocol to cease unauthorized access upon notification of a breach. Ensure that staff and agents are informed of their duties under PHIPA, and any revised information practices. Issue an apology to the patient.
16 Order HO-010 The Story A patient complained to a hospital that an employee inappropriately accessed their records. The employee was the former spouse of the patient s current spouse. An audit revealed that the records of the patient were accessed by the employee on six separate occasions.
17 Order HO-010 The Outcome The hospital was ordered to: Review the audit functionality on all systems and ensure that audit capability is turned on. Require agents who have contravened PHIPA to sign a confidentiality undertaking and non-disclosure agreement. Conduct privacy retraining programs. Review its policies, procedures and information practices. Implement a system that can display notice/warning when an agent accesses personal health information.
18 Order HO-013 The Story HO-013 was issued after two hospital employees used and disclosed information for the purpose of marketing RESPs. Hospital did not limit the search functionality of its electronic record system.
19 The hospital was ordered to: Order HO-013 The Outcome Implement measures to audit all instances when agents access personal health information. Develop a solution that will limit search capabilities so that agents are unable to perform open-ended searches. Review the Privacy Audits policy, the Pledge of Confidentiality policy and the Pledge of Confidentiality, and the Privacy Advisory. Develop a Privacy Training Program policy, a Privacy Awareness Program policy, and a Privacy Breach Management policy, as well as review privacy training tools and materials. Immediately conduct privacy training for all applicable staff and agents.
20 Educational Outreach: New Guidance Document Benefits and Risks of Electronic Records Impact of Unauthorized Access Preventing or Reducing the Risk of Unauthorized Access
21 Detect, Prevent and Reduce Comprehensive policies and procedures. Comprehensive training programs. Privacy notices and warning flags. Confidentiality agreements. End-user agreements regarding expectations and obligations. Physical, technical and administrative measures to limit access. All access is logged, audited and monitored. Comprehensive privacy breach management. Policies and procedures that set out the types of discipline and/or corrective action that may be imposed when unauthorized access occurs.
22 Is It Worth It? Campaign
23 Prosecution for Offences PHIPA creates offences for contraventions. It is an offence to willfully collect, use or disclose PHI in contravention of PHIPA. The Attorney General is responsible for commencing prosecutions under PHIPA. On conviction, an individual may be liable for a fine of up to $50,000 and an organization up to $250,000.
24 Detecting, Deterring and Reducing the Risk of Unauthorized Access Everyone has a role to play: Health Information Custodians IPC Employees/Agents Regulatory Colleges MOHLTC/Attorney General
25 Lack of Clarity About Roles in Shared Electronic Systems
26 Need for A Governance Framework The custody and control of personal health information is not left to just one health information custodian. This can lead to a lack of clarity as to who is responsible for the various duties and obligations in PHIPA. Imperative that harmonized privacy policies and procedures be developed.
27 Harmonized Policies and Procedures: Why are They Essential? Harmonized privacy policies and procedures are essential to: Clarify roles and responsibilities of custodians. Ensure consistency of experience across the sector. Minimize burden on individuals wishing to exercise their rights. Foster trust with patients and among custodians.
28 Long-Term Legislative Framework We need a long-term legislative framework for the provincial electronic health record. While PHIPA has served as a model health privacy statute, it does not adequately address the rights of individuals and the duties of custodians in a shared provincial system.
29 Bill 78, Electronic Personal Health Information Protection Act The Bill would have required prescribed organizations to: Have in place and comply with privacy and security practices and procedures that are approved by the IPC every three years. Audit and monitor the EHR. Manage consent directives in the EHR. Respond or facilitate a response to access and correction requests. Maintain records of all accesses to the EHR. Maintain records of all instances where a consent directive is made, withdrawn, modified or overridden in the EHR.
30 Build A Culture of Privacy Start from the top down. Ensure your staff know how to apply privacy policies and procedures. Provide on-going privacy training. Use multiple means to communicate. Regularly assess the effectiveness of your privacy program.
31 How to Contact Us Brian Beamish Acting Information and Privacy Commissioner of Ontario 2 Bloor Street East, Suite 1400 Toronto, Ontario, Canada M4W 1A8 Phone: (416) / Web: info@ipc.on.ca
What s New in Access, Privacy and Health Care. Brian Beamish Commissioner. Ontario Connections May 21, 2015
What s New in Access, Privacy and Health Care Brian Beamish Commissioner Ontario Connections May 21, 2015 The Three Acts The IPC ensures compliance with: o Freedom of Information and Protection of Privacy
EMBEDDING PRIVACY INTO ELECTRONIC HEALTH RECORDS. Manuela Di Re Associate Director of Legal Services Information and Privacy Commissioner of Ontario
EMBEDDING PRIVACY INTO ELECTRONIC HEALTH RECORDS Manuela Di Re Associate Director of Legal Services Information and Privacy Commissioner of Ontario Presentation Outline 1. Definitions 2. Need to Protect
Ann Cavoukian, Ph.D.
Protecting Privacy in an Era of Electronic Health Records Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario Barrie and Community Family Health Team Royal Victoria Hospital Georgian College
Privacy Breach Protocol
& Privacy Breach Protocol Guidelines for Government Organizations www.ipc.on.ca Table of Contents What is a privacy breach? 1 Guidelines on what government organizations should do 2 What happens when the
What to do When Faced With a Privacy Breach: Guidelines for the Health Sector ANN CAVOUKIAN, PH.D. COMMISSIONER
What to do When Faced With a Privacy Breach: Guidelines for the Health Sector ANN CAVOUKIAN, PH.D. COMMISSIONER INFORMATION AND PRIVACY COMMISSIONER/ONTARIO Table of Contents What is a privacy breach?...1
FIPPA and MFIPPA: Bill 8 The Recordkeeping Amendments
FIPPA and MFIPPA: Bill 8 The Recordkeeping Amendments December 2015 CONTENTS Introduction...1 The Amendments What s New?...1 Is My Institution Required to Comply With These Provisions?...2 What are Records?...2
Report of the Information & Privacy Commissioner/Ontario. Review of the Canadian Institute for Health Information:
Information and Privacy Commissioner of Ontario Report of the Information & Privacy Commissioner/Ontario Review of the Canadian Institute for Health Information: A Prescribed Entity under the Personal
Ann Cavoukian, Ph.D.
School Psychologists: What You Should Know about the Personal Health Information Protection Act Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario Psychological Services Northeast Toronto
Detecting and Deterring Unauthorized Access to Personal Health Information
Detecting and Deterring Unauthorized Access to Personal Health Information TABLE OF CONTENTS Introduction... 1 The Benefits and Risks of Electronic Records... 3 The Impact of Unauthorized Access... 5
Instant Messaging and Personal Email Accounts: Meeting Your Access and Privacy Obligations
Instant Messaging and Personal Email Accounts: Meeting Your Access and Privacy Obligations June 2016 Acknowledgments The IPC gratefully acknowledges the contributions of staff at Ontario s Ministry of
Administrative Procedures Memorandum A1452
Page 1 of 11 Date of Issue February 2, 2010 Original Date of Issue Subject References February 2, 2010 PRIVACY BREACH PROTOCOL Policy 2197 Management of Personal Information APM 1450 Management of Personal
Privacy Update Recent Updates in Privacy Law
Privacy Update Recent Updates in Privacy Law Kathryn Frelick DISCLAIMER This Coffee Talk presentation is provided as an information service and is not meant to be taken as legal opinion or advice. Please
PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004: AN OVERVIEW FOR HEALTH INFORMATION CUSTODIANS
PERSONAL HEALTH INFORMATION PROTECTION ACT, 2004: AN OVERVIEW FOR HEALTH INFORMATION CUSTODIANS Note: This document provides a general overview of the Personal Health Information Protection Act, 2004,
HOT!! Privacy Issues:
September, 2015 HOT!! Privacy Issues: Handle with care................... Micheal Harding Legislative & Policy Analyst Legislative Unit Manitoba Health, Healthy Living and Seniors By the end of 2016, the
Table of Contents. Acknowledgement
OPA Communications and Member Services Committee February 2015 Table of Contents Preamble... 3 General Information... 3 Risks of Using Email... 4 Use of Smartphones and Other Mobile Devices... 5 Guidelines...
Access & Correction Policy
EHR Policies Table of Content 1. Access & Correction Policy.. 2 2. Assurance.. 14 3. Consent Management Policy.. 27 4. Inquiries and Complaints Policy.. 39 5. Logging and Auditing Policy... 51 6. Privacy
Personal Health Information Privacy Policy
Personal Health Information Privacy Policy Privacy Office Document ID: 2478 Version: 6.2 Owner: Chief Privacy Officer Sensitivity Level: Low Copyright Notice Copyright 2014, ehealth Ontario All rights
How To Ensure Health Information Is Protected
pic pic CIHI Submission: 2011 Prescribed Entity Review October 2011 Who We Are Established in 1994, CIHI is an independent, not-for-profit corporation that provides essential information on Canada s health
PHIPA Potpourri. Judith Goldstein, Legal Counsel Information and Privacy Commissioner/Ontario. IPC Mediators April 21, 2015
PHIPA Potpourri Judith Goldstein, Legal Counsel Information and Privacy Commissioner/Ontario IPC Mediators April 21, 2015 Powers of the Commissioner The Powers the Commissioner has to conduct a review
Electronic Health Record Privacy Policies
Electronic Health Record Privacy Policies Table of Contents 1. Access and Correction Policy v1.1 2. Assurance Policy v1.1 3. Consent Management Policy v1.2 4. Inquiries and Complaints Policy v1.1 5. Logging
Mohawk DI-r: Privacy Breach Management Procedure Version 2.0. April 2011
Mohawk DI-r: Privacy Breach Management Procedure Version 2.0 April 2011 Table of Contents 1 Purpose... 3 2 Terminology... 5 3 Identifying a Privacy Breach... 5 4 Monitoring for Privacy Breaches... 6 5
Helpful Tips. Privacy Breach Guidelines. September 2010
Helpful Tips Privacy Breach Guidelines September 2010 Office of the Saskatchewan Information and Privacy Commissioner 503 1801 Hamilton Street Regina, Saskatchewan S4P 4B4 Office of the Saskatchewan Information
Cyber Risk in Healthcare AOHC, 3 June 2015
Cyber Risk in Healthcare AOHC, 3 June 2015 Kopiha Nathan, Senior Healthcare Risk Management and Data Specialist James Penafiel, Underwriting Supervisor, Insurance Operations CFPC Conflict of Interest -
Submission to the Standing Committee on Industry. Bill C-54, Personal Information Protection and Electronic Documents Act. Information and Privacy
Information and Privacy Commissioner Ontario / Submission to the Standing Committee on Industry Bill C-54, Personal Information Protection and Electronic Documents Act Ann Cavoukian, Ph.D. Commissioner
A Guide to Ontario Legislation Covering the Release of Students
A Guide to Ontario Legislation Covering the Release of Students Personal Information Revised: June 2011 Ann Cavoukian, Ph.D. Information and Privacy Commissioner, Ontario, Canada Commissioner, Ontario,
Strengthening Public Sector Transparency and Privacy
Strengthening Public Sector Transparency and Privacy Renee Barrette Director of Policy Information and Privacy Commissioner of Ontario AMCTO 2015 Municipal Information Access and Privacy Forum October
Responsibilities of Custodians and Health Information Act Administration Checklist
Responsibilities of Custodians and Administration Checklist APPENDIX 3 Responsibilities of Custodians in Administering the Each custodian under the Act must establish internal processes and procedures
INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER
INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER 3 APPLIES TO: ALL STAFF 4 COMMITTEE & DATE APPROVED: AUDIT COMMITTEE
Privacy Incident and Breach Management Policy
Privacy Incident and Breach Management Policy Privacy Office Document ID: 2480 Version: 2.1 Owner: Chief Privacy Officer Sensitivity Level: Low Copyright Notice Copyright 2014, ehealth Ontario All rights
Individuals affected by the breach How many individuals are affected by the breach? Who was affected by the breach: employees, public, contractors, clients, service providers, other organizations? Foreseeable
Privacy Services in Ontario - What Are the Benefits of Copying Files?
3-136 Bridge Street Carleton Place, Ontario K7C 2V5 Letter of understanding I,, understand the fees to be charged to me, or my insurance, or both, for treatment by Dr. Weatherall. These fees may vary
Privacy Practices for Frontline Health Care Workers. RNN Workshop June 5, 2015 Erin McLean, RN, BNSc Staff Development Coordinator
Privacy Practices for Frontline Health Care Workers RNN Workshop June 5, 2015 Erin McLean, RN, BNSc Staff Development Coordinator Confidentiality you tube Privacy: But first, some Definitions The right
PRIVACY BREACH POLICY
Approved By Last Reviewed Responsible Role Responsible Department Executive Management Team March 20, 2014 (next review to be done within two years) Chief Privacy Officer Quality & Customer Service SECTION
A Guide. Personal Health Information Protection Act. to the. December 2004. Ann Cavoukian, Ph.D Commissioner
A Guide to the Personal Health Information Protection Act December 2004 Information and Privacy Commissioner/Ontario Ann Cavoukian, Ph.D Commissioner Dr. Ann Cavoukian, the Information and Privacy Commissioner
Practice Tool for Exercising Discretion: Emergency Disclosure of Personal Information by Universities, Colleges and other Educational Institutions
Practice Tool for Exercising Discretion: Emergency Disclosure of Personal Information by Universities, Colleges and other Educational Institutions October 2008 Information and Privacy Commissioner of Ontario
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions Table of Contents Understanding HIPAA Privacy and Security... 1 What
Annual Continuing Education (ACE) (Print version) Information Privacy and I.T. Security and Compliance
Annual Continuing Education (ACE) (Print version) Information Privacy and I.T. Security and Compliance Information Privacy and IT Security & Compliance The information in this module in addition to the
The potential legal consequences of a personal data breach
The potential legal consequences of a personal data breach Tue Goldschmieding, Partner 16 April 2015 The potential legal consequences of a personal data breach 15 April 2015 Contents 1. Definitions 2.
Corporate Data Protection Policy
Corporate Data Protection Policy September 2010 Records Management Policy RMP-09 GOLDEN RULE When you think about Data Protection remember that we are all data subjects. Think about how appropriately and
Policy Brief: Protecting Privacy in Cloud-Based Genomic Research
Policy Brief: Protecting Privacy in Cloud-Based Genomic Research Version 1.0 July 21 st, 2015 Suggested Citation: Adrian Thorogood, Howard Simkevitz, Mark Phillips, Edward S Dove & Yann Joly, Policy Brief:
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR
Guide to INFORMATION SECURITY FOR THE HEALTH CARE SECTOR Information and Resources for Small Medical Offices Introduction The Personal Health Information Protection Act, 2004 (PHIPA) is Ontario s health-specific
What is involved if you are asked to provide a Police Background Check?
What is involved if you are asked to provide a Police Background Check? Read on What right do employers, volunteer recruiters, regulators, landlords and educational institutions ( organizations ) have
Information and Privacy Commissioner of Ontario. Guidelines for Using Video Surveillance Cameras in Schools
Information and Privacy Commissioner of Ontario Guidelines for Using Video Surveillance Cameras in Schools Ann Cavoukian, Ph.D. Commissioner Revised July 2009 This publication is an updated version of
Electronic Health Record Sharing System Bill. Contents. Part 1. Preliminary. 1. Short title and commencement... C1203. 2. Interpretation...
C1193 Electronic Health Record Sharing System Bill Contents Clause Page Part 1 Preliminary 1. Short title and commencement... C1203 2. Interpretation... C1203 3. Substitute decision maker... C1213 4. Ordinance
SCHEDULE "C" to the MEMORANDUM OF UNDERSTANDING BETWEEN ALBERTA HEALTH SERVICES AND THE ALBERTA MEDICAL ASSOCIATION (CMA ALBERTA DIVISION)
SCHEDULE "C" to the MEMORANDUM OF UNDERSTANDING BETWEEN ALBERTA HEALTH SERVICES AND THE ALBERTA MEDICAL ASSOCIATION (CMA ALBERTA DIVISION) ELECTRONIC MEDICAL RECORD INFORMATION EXCHANGE PROTOCOL (AHS AND
RECORD AND INFORMATION MANAGEMENT FRAMEWORK FOR ONTARIO SCHOOL BOARDS/AUTHORITIES
PURPOSE Records and information are important strategic assets of an organization and, like other organizational assets (people, capital and technology), must be managed to maximize their value. Information
Access and Privacy Manual
Access and Privacy Manual 2 nd Edition: March, 2006 Table of Contents 1. Introduction 1.1 Overview 1.2 Purposes of the Act 1.3 Definitions and abbreviations 2. Right of Access and Exemptions 2.1 General
Central LHIN Governance Manual. Title: Whistleblower Policy Policy Number: GP-003
Central LHIN Governance Manual Title: Whistleblower Policy Policy Number: GP-003 Purpose: Originated: September 25, 2012 Board Approved: September 25, 2012 To set out the LHIN s obligations under the Public
How to Avoid Abandoned Records: Guidelines on the Treatment of Personal Health Information, in the Event of a Change in Practice
Information and Privacy Commissioner / Ontario How to Avoid Abandoned Records: Guidelines on the Treatment of Personal Health Information, in the Event of a Change in Practice Ann Cavoukian, Ph.D. Commissioner
EHR Contributor Agreement
This EHR Contributor Agreement (this Agreement ) is made effective (the Effective Date ) and sets out certain terms and conditions that apply to the sharing of Personal
Issue #5 July 9, 2015
Issue #5 July 9, 2015 Breach Response Plans by Lyndsay A. Wasser, CIPP/C, Co-Chair Privacy Privacy breaches can occur despite an organization s best efforts to prevent them. When such incidents arise,
The office of the County Attorney Bill, 2014
THE OFFICE OF THE COUNTY ATTORNEY BILL, 2014 ARRANGEMENT OF CLAUSES Section PART I PRELIMINARY 1 Short title and commencement. 2 Interpretation. 3 Application. PART II: ESTABLISHMENT OF THE OFFICE OF THE
Privacy Law in Canada
by PATRICIA WILSON & MICHAEL FEKETE Protection of personal information remains at the forefront of public policy debate in. Federal and provincial privacy legislation has a profound impact on the way virtually
Information and Privacy Commissioner of Ontario. Guidelines for the Use of Video Surveillance Cameras in Public Places
Information and Privacy Commissioner of Ontario Guidelines for the Use of Video Surveillance Cameras in Public Places Ann Cavoukian, Ph.D. Commissioner September 2007 Acknowledgements This publication
Grand Rapids Medical Education Partners Mercy Health Saint Mary s Spectrum Health. Pam Jager, GRMEP Director of Education & Development
Grand Rapids Medical Education Partners Mercy Health Saint Mary s Spectrum Health Pam Jager, GRMEP Director of Education & Development To understand the requirements of the federal Health Information Portability
THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT (PIPEDA) PERSONAL INFORMATION POLICY & PROCEDURE HANDBOOK
THE PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT (PIPEDA) PERSONAL INFORMATION POLICY & PROCEDURE HANDBOOK REVISED August 2004 PERSONAL INFORMATION POLICY & PROCEDURE HANDBOOK Introduction
Senate Bill No. 48 Committee on Health and Human Services
Senate Bill No. 48 Committee on Health and Human Services CHAPTER... AN ACT relating to public health; repealing provisions that provide for a statewide health information exchange system; authorizing
Moving Information: Privacy & Security Guidelines
Information and Privacy Commissioner/ Ontario Moving Information: Privacy & Security Guidelines Ann Cavoukian, Ph.D. Commissioner July 1997 Information and Privacy Commissioner/Ontario 2 Bloor Street East
Data Security and Extranet
Data Security and Extranet Derek Crabtree Schools ICT Support Manager derek.crabtree@merton.gov.uk Target Operating Model 2011 Merton Audit Organisation name: London Borough of Merton Periodic plan date:
Texas House Bill 300 & HIPAA. A MainNerve Whitepaper
A MainNerve Whitepaper Overview If you do business in Texas and your organization handles, creates, stores, transmits or has access to electronic patient healthcare information, you need to be mindful
The Archives and Public Records Management Act
1 ARCHIVES AND PUBLIC RECORDS MANAGEMENT c. A-26.11 The Archives and Public Records Management Act being Chapter A-26.11* of The Statutes of Saskatchewan, 2015 (effective August 24, 2015). *NOTE: Pursuant
PLEASE NOTE. For more information concerning the history of this Act, please see the Table of Public Acts.
PLEASE NOTE This document, prepared by the Legislative Counsel Office, is an office consolidation of this Act, current to May 19, 2010. It is intended for information and reference purposes only. This
PHIA GENERAL INFORMATION
To: From: Researchers Legal Services and Research Services Date: May 21, 2013 Subject: Research and the New Personal Health Information Act On June 1, 2013, the Personal Health Information Act ( PHIA )
LEGAL UPDATE INFORMATION AND PRIVACY DECISION USE OF EMPLOYEE MONITORING SOFTWARE BY THE DISTRICT OF SAANICH
LEGAL UPDATE - A Publication - Vol. 03, INFORMATION AND PRIVACY DECISION USE OF EMPLOYEE MONITORING SOFTWARE BY THE DISTRICT OF SAANICH On March 30, 2015, Information and Privacy Commissioner for British
Student Visa - confidentiality and Reporting Requirements
Information Security: Best Practices Larry Carson Associate Director, Information Security Management, UBC larry.carson@ubc.ca 604-822-0773 Twitter: @L4rryC4rson Agenda News-worthy Incidents Legislation
Privacy Law in Canada
Privacy Law in Canada Federal and provincial privacy legislation has a profound impact on the way virtually all organizations carry on business across the country. Canada s privacy laws, while likely the
Newcastle University disciplinary procedure
Newcastle University disciplinary procedure Contents 1. INTRODUCTION... 1 2. RIGHT OF REPRESENTATION... 3 3. TRADE UNION REPRESENTATIVES... 3 4. SCHEDULING OF FORMAL MEETINGS AND APPEALS... 3 5. INVESTIGATION...
INVESTIGATION REPORT 131-2015
Saskatchewan Government Insurance September 30, 2015 Summary: Saskatchewan Government Insurance (SGI) proactively reported to the Office of the Information and Privacy Commissioner (OIPC) that a number
INVESTIGATION REPORT 173-2015
Saskatchewan Government Insurance November 12, 2015 Summary: Saskatchewan Government Insurance (SGI) proactively reported to the Office of the Information and Privacy Commissioner (OIPC) that it had received
By the end of this course you will demonstrate:
1 By the end of this course you will demonstrate: 1. that HIPAA privacy rules protect privacy and security of confidential information. 2. your responsibility for use and protection of protected health
Privacy and Security Resource Materials for Saskatchewan EMR Physicians: Guidelines, Samples and Templates. Reference Manual
Privacy and Security Resource Materials for Saskatchewan EMR Physicians: Guidelines, Samples and Templates Guidelines on Requirements and Good Practices For Protecting Personal Health Information Disclaimer
ORDER MO-2114 Appeal MA-060192-1 York Regional Police Services Board
ORDER MO-2114 Appeal MA-060192-1 York Regional Police Services Board Tribunal Services Department Services de tribunal administratif 2 Bloor Street East 2, rue Bloor Est Suite 1400 Bureau 1400 Toronto,
An Executive Overview of GAPP. Generally Accepted Privacy Principles
An Executive Overview of GAPP Generally Accepted Privacy Principles Current Environment One of today s key business imperatives is maintaining the privacy of your customers personal information. As business
Protection for Persons in Care Act
DEPARTMENT OF COMMUNITY SERVICES Protection for Persons in Care Act Policy Manual 8/16/2013 Table of Contents Terms Used in this Manual Section 1: Introduction and Authority 2 4 Policy 1.1: Authorization
Common Privacy Framework CCIM Assessment Projects
Common Privacy Framework CCIM Assessment Projects Acknowledgements This material, information and the idea contained herein are proprietary to Community Care Information Management (CCIM) and may not be
COLLECTION, MANAGEMENT, SECURITY OF AND ACCESS TO INFORMATION RECORDS
#4.00 PREAMBLE: The management of information required by due process, legislation or regulation is an important consideration for administrators and staff of the Burnaby School District. On November 3,
Privacy Impact Assessment Guidelines for the Ontario Personal Health Information Protection Act. Ann Cavoukian, Ph.D. Commissioner October 2005
Privacy Impact Assessment Guidelines for the Ontario Personal Health Information Protection Act Ann Cavoukian, Ph.D. Commissioner October 2005 Information and Privacy Commissioner/Ontario Privacy Impact
POLICIES AND REGULATIONS Policy #78
Peel District School Board POLICIES AND REGULATIONS Policy #78 DIGITAL CITIZENSHIP Digital Citizenship Digital citizenship is defined as the norms of responsible behaviour related to the appropriate use
EXAMINATION OF BRITISH COLUMBIA HEALTH AUTHORITY PRIVACY BREACH MANAGEMENT. Elizabeth Denham Information and Privacy Commissioner
EXAMINATION OF BRITISH COLUMBIA HEALTH AUTHORITY PRIVACY BREACH MANAGEMENT Elizabeth Denham Information and Privacy Commissioner September 30, 2015 Examination of British Columbia Health Authority Privacy
PERSONAL INFORMATION PROTECTION ACT
Province of Alberta Statutes of Alberta, Current as of December 17, 2014 Office Consolidation Published by Alberta Queen s Printer Alberta Queen s Printer 7 th Floor, Park Plaza 10611-98 Avenue Edmonton,
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT The parties to this ( Agreement ) are, a _New York_ corporation ( Business Associate ) and ( Client ) you, as a user of our on-line health record system (the "System"). BY
Procedure for Managing a Privacy Breach
Procedure for Managing a Privacy Breach (From the Privacy Policy and Procedures available at: http://www.mun.ca/policy/site/view/index.php?privacy ) A privacy breach occurs when there is unauthorized access
Arizona Medical Information Exchange Proof Of Concept. Privacy & Security Policy Manual version 1.0
Arizona Medical Information Exchange Proof Of Concept Privacy & Security Policy Manual version 1.0 September 29, 2008 Chapter 100 Introduction Table of Contents... 2 Chapter 100 Introduction... 4 101:
HIPAA TRAINING. A training course for Shiawassee County Community Mental Health Authority Employees
HIPAA TRAINING A training course for Shiawassee County Community Mental Health Authority Employees WHAT IS HIPAA? HIPAA is an acronym that stands for Health Insurance Portability and Accountability Act.
Personal Health Information Protection Act
Frequently Asked Questions : Personal Health Information Protection Act February 2005 Information and Privacy Commissioner/Ontario Ann Cavoukian, Ph.D Commissioner. Dr. Ann Cavoukian, the Information and
The Licensed Practical Nurses Act, 2000
1 LICENSED PRACTICAL NURSES, 2000 c. L-14.2 The Licensed Practical Nurses Act, 2000 being Chapter L-14.2 of the Statutes of Saskatchewan, 2000 (effective November 24, 2000) as amended by Statutes of Saskatchewan,
A Resource for Parents, Teachers, and Administrators
A Resource for Parents, Teachers, and Administrators A Joint Project of The Toronto District School Board and The Information and Privacy Commissioner, Information and Privacy Commissioner, Revised November
Cloudy With a Chance Of Risk Management
Proudly presents Cloudy With a Chance Of Risk Management Toby Merrill, ACE USA John Mullen, Nelson Levine de Luca & Hamilton Shawn Melito, Immersion Ltd. Michael Trendler, ACE INA Canada What is Cloud
SAFEGUARDING PRIVACY IN A MOBILE WORKPLACE
SAFEGUARDING PRIVACY IN A MOBILE WORKPLACE Checklist for taking personally identifiable information (PII) out of the workplace: q Does your organization s policy permit the removal of PII from the office?
Insurance Journal. Defending Until the End When Does the Duty to. Volume 1, Issue 3 Editor Keoni Norgren. May 1, 2013
Insurance Journal May 1, 2013 In this Issue Volume 1, Issue 3 Editor Keoni Norgren Defending Until the End When Does the Duty to Defend End? Cyber Liability Laws in Canada Dolden Wallace Folick Welcomes
University of Limerick Data Protection Compliance Regulations June 2015
University of Limerick Data Protection Compliance Regulations June 2015 1. Purpose of Data Protection Compliance Regulations 1.1 The purpose of these Compliance Regulations is to assist University of Limerick
PLEASE NOTE. For more information concerning the history of this Act, please see the Table of Public Acts.
PLEASE NOTE This document, prepared by the Legislative Counsel Office, is an office consolidation of this Act, current to January 1, 2009. It is intended for information and reference purposes only. This
Reference Check: Is Your Boss Watching?
& Reference Check: Is Your Boss Watching? Privacy and Your Facebook Profile www.ipc.on.ca Reference Check: Is Your Boss Watching? Privacy and Your Facebook Profile Facebook and other online social networks
Applying the legislation
Applying the legislation GUIDELINE Information Privacy Act 2009 Privacy breach management and notification A privacy breach occurs when there is a failure to comply with one or more of the privacy principles
HIPAA Orientation. Health Insurance Portability and Accountability Act
HIPAA Orientation Health Insurance Portability and Accountability Act HIPAA Federal legislation enacted in 1996 to improve the efficiency and effectiveness of electronic information transfers used in the
Privacy Toolkit for the. Quality Improvement Decision Support Program. in Family Health Teams. Written by: Kate Dewhirst
Privacy Toolkit for the Quality Improvement Decision Support Program in Family Health Teams Written by: Kate Dewhirst March 2014 Copyright Copyright 2014 Association of Family Health Teams of Ontario (AFHTO),
HIPAA Privacy & Security Rules
HIPAA Privacy & Security Rules HITECH Act Applicability If you are part of any of the HIPAA Affected Areas, this training is required under the IU HIPAA Privacy and Security Compliance Plan pursuant to
Health Care Provider Guide
Health Care Provider Guide Diagnostic Imaging Common Service Project, Release 1 Version: 1.4 Copyright Notice Copyright 2014, ehealth Ontario All rights reserved No part of this document may be reproduced
Ownership, Storage, Security and Destruction of Records of Personal Health Information STANDARD OF PRACTICE S-022 INTENT DESCRIPTION OF STANDARD
Quality Assurance Committee Approved by Council: February 11, 2014 Amended: September 20, 2014 *(formerly Guideline G-017) Note to readers: In the event of any inconsistency between this document and the
PACIFIC EXPLORATION & PRODUCTION CORPORATION INSIDER TRADING POLICY
PACIFIC EXPLORATION & PRODUCTION CORPORATION INSIDER TRADING POLICY Introduction: Pacific Exploration & Production Corporation (the Corporation ) encourages all employees to become shareholders on a long-term