FNHSO Privacy and Security Framework Forum Nov 19, 2014 BC First Nations Panorama Support

Agenda  Roll-call  Panorama Access Audit – Update on Privacy Reports being developed to support audit requirements  Client Personal Information Collection  Updates to Client / Guardian Notification and Consent Policy  Updates to Breach Management Procedures  ISA Compliance  Round table discussion FNSHO P&S Framework Forum

Roll Call  Kwakiutl District Council Health Services  Seabird Island Band's Health Services Department  Three Corners Health Services Society  Tla’amin Community Health Services  Westbank First Nation Health and Wellness  Saulteau First Nation Health Services  Nuu-chah-nulth Tribal Council – Community and Human Services  Okanagan Indian Band Health Services  Cowichan Tribes - Ts’ewulhtun Health Services FNSHO P&S Framework Forum

Access Audit Requirements  Identified in  B.C. Ministry of Health eHealth conformance Standards – Information Privacy  ISA  eHeath Best Practices  Panorama Data Governance Framework  Require each organization to conduct  Regular proactive audits  Random audits or spot checks  Reactive audits FNSHO P&S Framework Forum

Update on Privacy Reports to Support Access Audit Requirements FNSHO P&S Framework Forum

Same Name Lookup (AA005)  Purpose  Identify users who have accessed their record or a record of a family member with the same last name FNSHO P&S Framework Forum

High Volume Client Accesses All Users (AA006)  Purpose  Identify clients with an unusually high number of accesses relative to other clients accessed within the same date range and JORG FNSHO P&S Framework Forum

AA007 High Volume Client Accesses Unique Users  Purpose  Identify clients with an unusually high number of unique user accesses relative to other clients accessed within the same date range and JORG FNSHO P&S Framework Forum

AA008 High Volume User Accesses Unique Clients  Purpose  Identify users with an unusually high number of unique client accesses relative to other user access within the same date range and JORG FNSHO P&S Framework Forum

Client Personal Information Collection FNSHO P&S Framework Forum  Three modes of collecting personal information from clients  In person  Home-visits  On the phone  Informed, implied consent for the collection, user and disclosure of personal information  Verbal  Posters  Pamphlets  Telephone Scripts

Updates to Client / Guardian Notification and Consent Policy  Client/Guardian Notification and Consent Policy:  Update to include collection of personal information over the telephone  Appendix Tool: Telephone Privacy Script FNSHO P&S Framework Forum

Updates to Privacy Breach Management Procedures  Procedures specific to Panorama breaches  Contact Panorama Operations Privacy Services and Central Data Steward FNSHO P&S Framework Forum

Panorama Data Governance Committee: ISA Compliance FNSHO P&S Framework Forum

ISA Compliance Options (1) 1. Invoke clause 12.2 of the Panorama ISA and request each Party provide the Central Data Steward with a copy of its most recent (within the previous month) audit and privacy and security review reports. 2. Invoke clause 12.1 of the Panorama ISA with the Central Data Steward conducting audits on the privacy and security practices of all Parties.

ISA Compliance Options (2) 3. Development of a simplified standard assessment template for Parties to assess their own compliance to certain key requirements. The template would be used by each Party to report their level of compliance to the Panorama Data Governance Committee immediately and then on an annual basis going forward. 4. Addressing the issues of non-compliance on a case-by-case basis, with the Central Data Steward working with a Party to resolve a specific issue.

ISA Compliance Options (3)  Option 3 is being recommended  Overall, the compliance approach being described seems to be well aligned with the eHealth Conformance Standards compliance model followed by FN PIP and FNHSOs implementing Panorama  The “assessment template” described for option 3 is similar in concept and content to the FN PIP “P&S Checklist”  More frequent, structured assessment and reporting to MoH may be necessary  The FN PIP team will continue to provide info on this topic as it becomes available

Roundtable Review  Any changes to Panorama users (add/remove) ?  Questions or concerns?  Agenda items for next meeting? FNSHO P&S Framework Forum