Development of a Customized First Nations Privacy & Security Toolkit Margie Kennedy, Lily Menominee Batise, Nicolette Kaszor May 28, 2013

Presenter Disclosure Presenters No Conflict of Interest Margie Kennedy Lily Menominee Batise Nicolette Kaszor No Conflict of Interest

Objectives Highlight the unique privacy needs and challenges of First Nations Highlight the development of a Privacy and Security plan for the First Nation Panorama Deployment in Ontario (FNPDiO) Project Identify community needs that informed development Provide an overview of the Privacy & Security Toolkit Identify priorities and anticipated uses of the Toolkit Share the partner model adopted to ensure broad partner engagement and development Transition to NK for Slides 4-6 inclusive

FNPDiO Evolution Governance: Tri-partite partnership Chiefs of Ontario, First Nations and Inuit Health Branch, and the Ontario Ministry of Health and Long Term Care Mandate to deploy Panorama to all First Nations in Ontario who wish to do so Started in 2007 Technical and Policy Direction Knowledge Management Advisory Group (KMAG) Various Working groups Privacy, Data Management, Change Management, Information Management/ Information Technology, Communications

Project Guidance

Privacy Innovation Broad perspective on First Nation privacy as an enabler for eHealth initiatives First customized development of a privacy plan and associated resources informed by First Nation needs and priorities Transition to LAMB for Slide 7-12

Privacy and Security Priorities at the Community Level Overall plan Meet current needs (Panorama deployment) Support capacity development in First Nations Be scalable for future eHealth developments Principles Easy to understand & use Ready for immediate use by First Nations with varying human resources Deliverables Video Toolkit Engagement Leverage knowledge of First Nation Initial Subscribers for subsequent deployment & use Privacy Sub-Group to lead development Check fonts

Unique Privacy Needs of First Nations Small communities – resource constraints, etc. Not every community has extensive health personnel to engage in projects Balancing the PHI protection vs the value of community support where “in a small community, everybody knows your business” First Nation/band administration professional development General principles and execution of health information privacy Provincial legislation (PHIPA) OCAPTM principles need to be embedded in any solution related to First Nation information Ownership, Control, Access, and Possession Consistent protection of PHI in health care settings and in the communities

Privacy Challenges among First Nations Non-standard privacy procedures Each First Nation is independent and may have own internal practices, laws, and/or policies Reconciling varying privacy requirements Variable community-based privacy infrastructure Many First Nations have limited privacy infrastructure to support health delivery Resources Resources who have experience and can take on the responsibility for privacy leadership and accountability (e.g. privacy officers) Political/governance factors Understanding of privacy obligations by Health Information Custodian (HIC)

FNPDiO Privacy Video Developed in collaboration with FNPDiO Privacy Working Group, and representatives from the Initial Subscribers and the FNPDiO Elder Advisor Focus on the value and priority of privacy related to health information from a First Nations perspective URL for Privacy Video http://www.youtube.com/watch?v=Uu-iBSj7ypg&feature=youtu.be

From the Community Perspective…

FNPDiO Privacy & Security Toolkit Purpose Comprehensive resource to assess current state and gaps Provide tools that will cover the gaps Components Two Assessments Privacy Security Tools Templates for immediate use Fact Sheets Frequently Asked Questions (FAQs) Glossary, PHIPA Obligations, additional resources Methodology Conduct assessments to identify gaps Use tools Review gaps Iterations led by Privacy & Security Sub Group in consultation with project team. Priorities of ease of use, literacy burden, and scalability guided revisions and refinement of the tools.

Privacy Assessment

Toolkit Resources Confidentiality Agreement PRIVACY Privacy Policy Responsibilities of Privacy Contact Staff FAQs Confidentiality Agreement Privacy Notice Client FAQs Staff Guide for Consent Consent templates Immunization General PHI Inventory Tool De-identifying PHI Record of Assessment: Determination of Capacity to Consent Request for for PHI SECURITY Security Policy Business Continuity Management Plan Access to Network Services Request Form Acceptable Use Policy IT Asset Management Inventory Mobile Devices Security Fact Sheet Faxing PHI Fact Sheet Privacy & Security Incident Response Plan P&S Breach Investigation Report Notice of Breach – Letter to Clients Transition to MK for Slides 16-19 inclusive

FNPDiO Toolkit Use Outcomes Communities reviewed existing policies and resources Within Health facilities/portfolio Across operations Tools in the Toolkit were used to: Generate completely new policy structures Fill gaps Supplement existing policies Identify Privacy Resources to comply with PHIPA Privacy Officer Privacy Notice The final version of the Privacy video was released in October 2012 and is available via the Chiefs of Ontario website. The Toolkit contains 2 assessments and 24 tools as well as several appendices providing supporting resources. The Toolkit was developed and refined over a period of 24 months, and involved the Privacy & Security Toolkit Working Group, volunteer community reviewers, and iterative refinement cycles. The Toolkit was approved for use among Initial Subscribers in November 2012.

Next Steps Updates based on experience with pilot use Future versions of the FNPDiO Privacy & Security Toolkit For use with Secondary Subscribers Share Initial Subscriber Privacy Policies with other First Nations general distribution/availability to others interested or potentially benefitting from this work after September 2013

Acknowledgements The presenters acknowledge the contributions of the members of the Knowledge Management Advisory Group (KMAG), our First Nation Elder Advisor Barney Batise, and the Privacy Sub-Committee in the development of this plan and Toolkit Pam Nolan (Co-Chair) Ida Cornelius (Co-Chair) Krista Yao Cheri Corbiere and community reviewers Nipissing First Nation Mohawks of Akwesasne Garden River First Nation

For more information on the P&S Toolkit: Chiefs of Ontario Lily Menominee-Batise (menominee@personainternet.com) 705-465-0060

Questions & Discussion Meegwetch Nia:wen Thank you Questions & Discussion