Privacy Law and Information Management in Health Care

Overview of the Legal and Regulatory Regimes; Understanding What Privacy Is and Why it Matters to You

Personal Health Information

• What is a record of personal health information?
• Paper records versus electronic records
• Provincial, Canadian and local shared electronic systems
• What exists now?
• What is the future of health information recordkeeping and sharing?

Privacy Principles

• Why is privacy important?
• What are the issues you care most about?
• What opportunities exist?
• What barriers exist?

The Regulatory Landscape

• What laws apply to health information privacy in Canada?
  • PHIPA, PIPEDA, MFIPPA, FIPPA

• Interprovincial regulatory variation
• What is the role of the regulators such as the Information and Privacy Commissioner (IPC)?

Privacy in Health: The Indigenous Perspective

Communicating with Patients

• What agreements are needed?
• Drafting privacy posters or website agreements
• Essential elements of an email disclaimer form
• Best practices when using email forms

Understanding and Managing Patient Rights and Expectations

• Consent, capacity and substitute decision‑making
• Consent directives
• Access to information
• Correction requests
• Duty to assist
• Bringing class actions to enforce privacy rights
• Frivolous and vexatious requests

The Challenge of Navigating the System

• Patient, health care provider, organizational and IT perspective

A Practical Guide to Access and Correction Requests under PHIPA

The Risk of Harm Exception

Sharing without Consent – When You are Permitted or Required by Law to Share

Children’s Health Privacy Rights

Privacy Rights and Challenges in Mental Health Settings

How to Conduct a Privacy Impact Assessment

How to Make a Small Budget Go Far

Privacy, Data and Technological Supports

• Data asset identification, sensitivity classification and handling obligations
• Optimized electronic health record models
• User accountability controls (e.g. declaration of relationship, proactive alerts)
• Surveillance anomaly detection audits

Effectively Using Contracts to Share Information

• Data sharing agreements
• Electronic health record access agreements
• Agency agreements
• Health Information Network Provider agreements

Vendor Contracts

• Using privacy checklists to simplify what the agreements mean
• Tactics for vendor management
• Designing contracts so that provisions are reasonable and manageable

Creating and Drafting Policies

• What must be included?
• Plain language challenges

Privacy and Medical Research

Understanding the Freedom of Information and Protection of Privacy Act

• A practical guide you will come back to time and again

Health and Service Delivery in a Digital Environment

• What are the new technological solutions supporting health care?
• How are medical devices and apps regulated?
• Should we be afraid of technology? Is big data and artificial intelligence a threat to individual privacy?
• How does the blockchain impact the health-care industry?

Perspectives on Health Service Delivery

• What are the legal and hospital perspectives in an emerging digital environment?
• What can we expect to see from Ontario Health around health service delivery?

Information Security Stakeholder Security Perspectives: IT Security; Police

• Hacking, ransomware, phishing
• Security issues with medical devices
• Lost or stolen devices (laptops, USB keys, portable hard drives)
• Phone safety protocols and best practices

Intersection of Health Care, the Police and the CAS

Privacy Primer & Responsibilities of Generative AI

Legal and Privacy Risk Mitigation in Digital Health Acceleration

Putting what you have learned into practice, you will work through a real‑life scenario and in small groups – you will:

• Identify whether or not a breach has occurred
• Develop the investigation plan
• Conduct the risk assessment
• Suggest strategies for managing the breach, including communication protocols
• Proper responses to a breach

As a group, you will then discuss what you can learn from breaches, including:

• Compliance monitoring
• System/process improvements
• Policy improvements
• Audits ‑ how to do an audit
  • Surveillance Anomaly Detection Audits vs. Investigative Audits

• Where is tech going to help re: compliance
• Consequences of breaches
  • Reputation
  • Social media issues

During the workshop, you will get feedback from faculty members, and be able to apply what you have learned in a supportive learning environment.

Summary of IPC Decisions

• What do these decisions tell us about the current health privacy landscape?

Navigating an IPC Breach Investigation

Litigation: Cases to Discuss

• Learn from the litigators who are developing new privacy case law

Preserving Trust in the Aftermath of a Privacy Breach

NOTE: Module 5 must be done live (online) to obtain the certificate.