FNHSO Panorama Data Governance Forum Regular Forum Meeting June 9, 2015

Agenda Roll-call Update on items from Provincial Panorama Data Governance Committee New FNHSO support function: Monitoring inactive users FNHSO CBOC / User Support Forum initiation Feedback from last week’s eHealth Conference Roundtable review (i.e. future agenda items; other items; etc.)

Role Call Na’kazdli KDC TCHSS WFN Tla’amin OKIB NTC Seabird Saulteau Cowichan Scw’exmx Nazko Pauquachin ITHA

Updates from the Provincial Committee Formal transition of remaining iPHIS data to PDGC Framework/policies Formally transition stewardship responsibilities for all data currently within iPHIS from the iPHIS Governance Council Committee to the Panorama Data Governance Committee, effective on the signing of this decision document and in advance of formal iPHIS decommissioning; Data access provisions under section 6 of the iPHIS ASP signed between each Health Authority and BCCDC will be superseded by the data access provisions in the Panorama Data Governance Committee Policy and Procedures Manual. Transition of stewardship to the Panorama Data Governance Committee will ensure: data within iPHIS is administered by the same robust governance model and privacy controls as data held within Panorama; and, transparency with respect to the collection, access, use and/or disclosure of the data within iPHIS, in alignment with the Panorama data access policies.

Updates from the Provincial Committee Data retention policy update See next 4 slides from May 19 PDGC meeting

Data Retention Policy Statements BCY Panorama Project Data Retention Policy Statements To protect data integrity, all data elements relating to a single individual shall be treated as a whole. There are certain data elements within an individual’s Panorama record that have clinical value throughout the lifespan of an individual (e.g. immunization data). The combination of the preceding 2 policy statements result in the need to retain Panorama data in an identifiable, viewable, and accessible form from “cradle to grave”.

Data Retention Policy Statements BCY Panorama Project Data Retention Policy Statements Beyond the death of an individual, there continues to be value in certain data elements for the purposes of surveillance, program and population management. In order to realize that long-term value, Panorama data will be retained indefinitely in a de-identified form, held within a Data Warehouse such as the Public Health Reporting Data Warehouse. An individual’s record within Panorama will be soft deleted in the following circumstances: X years following the death of an adult, their record will be soft deleted. X years following the death of a minor, their record will be soft deleted. X years following a change of address to an address outside of BC or Yukon.

Data Retention Policy Statements BCY Panorama Project Data Retention Policy Statements A record will be soft deleted immediately if it has been flagged as “inactive” in Panorama for the following reasons: The individual has been adopted and pertinent clinical information has been entered in on the new client’s chart. The individual is a child that has been returned to the Birth Parent, and a new client record, with the child’s biological birth information is created.

Data Retention Policy Statements Soft Deletion: Records that have been soft deleted will remain in Panorama but will no longer be available to Panorama Users. Records in Panorama that have been soft deleted may still exist in other systems (e.g. PHRDW). Soft deleted records will still be available to database administrators, and may be “undeleted” in the following circumstances: An “inactive” record becomes active Others? Soft deleted records are subject to FOI requests(?)

Updates from the Provincial Committee

Updates from the Provincial Committee Panorama read-only access for Physicians Call for members: subgroup on co-managed records

New FNHSO support function: Monitoring inactive users Context The British Columbia eHealth Professional and Software Conformance Standards - Volume 7: Information Privacy states that any user account that has not initiated activity in Panorama within the preceding five (5) months must be inactivated. A user account is considered active if it has generated one or more records in the Panorama Access Audit log. The AA004-User Activity Report has been provided to support Solution Partners in identifying their organization’s user accounts that are not being actively used. This report looks at activity in the audit log for all of the organizations assigned to the user account and considers the user account active if an audit record was created that is associated with any of the organizations. The user does not have to generate an audit record in each of the organizations assigned to their user account. Some staff may have a user account but have legitimate reasons for not using Panorama on a regular basis. For example, a nurse educator does not have to use Panorama under their own user account to provide support to staff. In this situation it is not appropriate to inactivate their user account but they should be advised to generate an audit record.

New FNHSO support function: Monitoring inactive users Generating an Audit Log Record To generate an audit log record, the user must actively touch a client record or generate a report. To avoid potential privacy issues by accessing a client with no clinical reason to do so, the user must, at a minimum, complete the steps identified below. It is not sufficient to just log on and then log off as these actions are not currently captured in the audit log (Note: In Release 3.0 a change will be made so that the audit log will capture the log on and log off. This bulletin will be retired when that change has migrated to production). Log on; Select an aggregate report (e.g. Imm008-Immunization Count by Provider); Enter the mandatory report filters; Select the “Generate Report” button; Terminate the report. An audit log entry will be made whether or not the report completes execution; and Log off.

New FNHSO support function: Monitoring inactive users Identifying Inactive User Accounts To identify user accounts that are candidates for making inactive, execute AA004-User Activity Report. Because it is a mandatory requirement to inactivate the user account, the inactivation does not require approval from the user’s manager. Should the user return to work (from a short leave, maternity leave, job exchange, etc.), she/he would not be able to login. The normal process is for that user to contact their manager who would request user account reactivation. If the user has not been on a leave and has simply not been using their account, the manager would become aware of the situation and could take any necessary corrective steps. Tip: To provide a warning to users who are candidates for inactivation, execute the User Activity Report and notify all users who have not been active in the preceding four months (120 days) that their user account will be inactivated in 30 days. Distribute the same report to all managers so that managers have the opportunity to address access issues with any of their staff identified on the report. Tip: Managers should be reminded when reviewing AA004-User Activity Report to consider system proficiency and data quality for their staff that are maintaining an active user account. A user who has not accessed the system for a period of time may require additional training or support.

FNHSO CBOC / User Support Forum initiation The provincial Clinical and Business Oversight Committee (CBOC) has recently been initiated The FN PIP Team has been in communication with the clinical reps from each FNHSO to develop and validate a model for ensuring FNHSO input into CBOC discussions and decisions We are now in the process of establishing monthly FNHSO CBOC / Clinical User Support Forum meetings These meetings will provide FNHSO clinical reps with the opportunity to provide input and direction to the CBOC and will also serve as a forum to discussion necessary clinical items related to FNHSO use of Panorama

COACH eHealth Data Governance Presentation Feedback from presentation in Toronto was positive Presentation has been posted in June 2015 Data Governance Forum folder on FNHSO Panorama Support Website: https://fnpip-public.sharepoint.com/data-governance-support

Roundtable Questions? Request for agenda items to be included in next meeting?