I’ve delivered five team privacy training sessions for health care groups this month all over the province. One thing that has everyone talking is the new requirement to track privacy breaches and report the statistics to the Information and Privacy Commissioner of Ontario in 2019.

Here are some tools and tips to help you better understand this new requirement.

A. What do we have to keep track of?

The IPC explains the requirement here

I wrote an introductory blog about it here

B. How do we keep track?

The Ontario Hospital Association created an AMAZING tool.  It is an Excel spreadsheet and has pre-populated for you all the requirements and has an amazing “instructions” tab. They made it public for free.  Download it here: Annual Breach Reporting Tracking Tool – for 2018  

ANY health information custodian can use it. It’s not unique to hospitals. So if you are a doctor’s office or midwifery clinic or NPLC or pharmacy or mental health clinic or a sole practitioner or any other kind of health information custodian  – the OHA’s tracking tool will work for you too.

Remember: The IPC will have an online form for you to complete. So the OHA Tool is just your tracking tool.  You will need to reenter the total numbers when prompted to do so in February/March 2019 on the IPC’s web portal. Stay tuned. I’ll let you know when it is live.

C. In group practices, who has to report?

This is the million dollar question.  If you are in a group practice, like a Family Health Team or a Family Health Organization or a Nurse Practitioner Led Clinic or a Birth Centre or a multidisciplinary team or partnership – you have to know whether there is a single health information custodian or whether each clinician is individually a custodian.   How do you know?  It should be written down.  If it is not written down – you should get legal advice to determine who is the custodian or custodians.

Every health information custodian is required to track and report privacy breaches.  In group practices where individual clinicians are individual health information custodians – you will have to decide whether to report individually or collectively to the IPC.  If you need help making this decision, let me know.

D. Is this my privacy breach to record? 

What happens if you receive a fax or email that was not meant for you.  Is that your privacy breach to track and report?  No.  It is the sender’s privacy breach.  You should notify the sender that you received the communication in error – but you do not have to add that to your statistical numbers.

Privacy Officer Training: The next round of Privacy Officer training starts in May 2018.  If you want to join me or want to read more about it – click here for information and registration details.