I’m Kate Dewhirst.

I’m a lawyer who writes about legal issues affecting healthcare in Canada

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

Tracking Privacy Breaches in 2018 – Tools and Tips

Posted by

I’ve delivered five team privacy training sessions for health care groups this month all over the province. One thing that has everyone talking is the new requirement to track privacy breaches and report the statistics to the Information and Privacy Commissioner of Ontario in 2019.

Here are some tools and tips to help you better understand this new requirement.

A. What do we have to keep track of?

The IPC explains the requirement here

I wrote an introductory blog about it here

B. How do we keep track?

The Ontario Hospital Association created an AMAZING tool.  It is an Excel spreadsheet and has pre-populated for you all the requirements and has an amazing “instructions” tab. They made it public for free.  Download it here: Annual Breach Reporting Tracking Tool – for 2018  

ANY health information custodian can use it. It’s not unique to hospitals. So if you are a doctor’s office or midwifery clinic or NPLC or pharmacy or mental health clinic or a sole practitioner or any other kind of health information custodian  – the OHA’s tracking tool will work for you too.

Remember: The IPC will have an online form for you to complete. So the OHA Tool is just your tracking tool.  You will need to reenter the total numbers when prompted to do so in February/March 2019 on the IPC’s web portal. Stay tuned. I’ll let you know when it is live.

C. In group practices, who has to report?

This is the million dollar question.  If you are in a group practice, like a Family Health Team or a Family Health Organization or a Nurse Practitioner Led Clinic or a Birth Centre or a multidisciplinary team or partnership – you have to know whether there is a single health information custodian or whether each clinician is individually a custodian.   How do you know?  It should be written down.  If it is not written down – you should get legal advice to determine who is the custodian or custodians.

Every health information custodian is required to track and report privacy breaches.  In group practices where individual clinicians are individual health information custodians – you will have to decide whether to report individually or collectively to the IPC.  If you need help making this decision, let me know.

D. Is this my privacy breach to record? 

What happens if you receive a fax or email that was not meant for you.  Is that your privacy breach to track and report?  No.  It is the sender’s privacy breach.  You should notify the sender that you received the communication in error – but you do not have to add that to your statistical numbers.

Privacy Officer Training: The next round of Privacy Officer training starts in May 2018.  If you want to join me or want to read more about it – click here for information and registration details.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Team Privacy Training Events
December 11, January 16-17

For Primary Care clinics, Children’s Aid and FHTs

Kate trains health professionals from many more primary care organizations how being privacy-respectful can improve therapeutic relationships. More details...

Speaking event February 4, 2020

Osgoode Professional Development – Health Law Certificate

Kate joins the faculty for this training event. More details...

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our December webinar is an employment law update, and the January program is a legal update for EDs and Board members.
Full details of the 2020 webinar series and registration here.

Advanced Privacy Officer training
December 10, 2019

For experienced Privacy Officers within healthcare organisations.

This one day training course focuses on how to handle difficult privacy situations using real-life (but anonymized) case studies and role-play. Full details and registration here...

Osgoode Health Privacy training
January 20 & 27 and February 3,10 & 18, 2020

Kate is the program chair for the Osgoode Certificate in Privacy in Healthcare.

This program explores the range of privacy interests that must be protected in the day-to-day treatment of patients, the development of information systems and the creation of institutional policies. More details...

Free healthcare privacy webinar - ask me anything!
December 4 (cancelled) but back January 8

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

Law2Life Coaching is the best place successful lawyers can go to unlock more fun and fulfillment from life and work… https://t.co/WUshA9UCqK

about 16 hours ago

It’s not enough for health care organizations to respect patient privacy rights. I believe we have an obligation t… https://t.co/dTMI2lfrOx

about 17 hours ago

contact details

901 King Street West Suite 400 East Tower
Toronto Ontario M5V 3H5

(416) 855 9557

.