Transcription
ATTENTION: All practice managers, healthcare providers, clinic managers of private healthcare practices.This Practice Management Success Tip has been created especially for you!Understanding Privacy Breach NotificationIt is our job to manage each privacy breach with confidence, compassion, and transparency to theindividuals affected by the breach. We need to take all reasonable steps to prevent a privacy breach and beprepared to respond to the breach when it occurs.This Practice Management Success Tip will help you Understand the requirements of mandatory privacy breach notification. Inform your team including custodians, affiliates, privacy officers, and vendors of your role to notifythe regulators and individuals when a privacy breach occurs. Assist you to prepare your privacy breach management program.What to do nextUse the attached article to discuss with your custodian(s) and your clinical, administrative, and managementteam members the impact of recent amendments of Alberta’s Health Information Act (HIA).Example that you can useWatch the free webinar “How Will Mandatory Privacy Beach Reporting Affect You”.Register reach-reporting-comes-to-alberta/Need more templates like this?Become a member of Practice Management Success! On-line tips, tools, templates and training to help youin your career and help you to start, grow, or fix the business of a healthcare practice.www.PracticeManagementSuccess.caThis is part of the Practice Management Success Tip series. July 2018.This publication provides general guidance for healthcare practices in Alberta. It is expected that you willreview and refine these documents to meet your needs. For additional assistance, please contactINFORMATION MANAGERS LTD.Jean L. Eaton, B Admin (Healthcare), CHIM, CCYour Practical Privacy Coach and Practice Management MentorINFORMATION MANAGERS LTD.www.InformationManagers.caPractice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 2 of 8
MANDATORY PRIVACY BREACH REPORTING COMES TO ALBERTA!In May of 2018, the province of Alberta proclaimed mandatory breach reporting amendments to theHealth Information Act (HIA) and the Health Information Regulation (HIR). These amendments wereaccepted by the Legislative Assembly in 2014 and will come into force on August 31, 2018.Custodians will be required to report privacy breaches with risk of harm to the Office of theInformation and Privacy Commissioner (OIPC) and the Minister of Health of Alberta. Currently,breach notification is voluntary.This will impact ALL custodians including physicians, pharmacists, chiropractors, dentists, dentalhygienists, podiatrists, midwives, optometrists, opticians, registered nurses and more!What is a Privacy Breach?A privacy breach is a loss, unauthorized access to, unauthorized use, unauthorizeddisclosure, authorized access for unauthorized use of personal information.Personal information may include your name, date of birth, address, account information, oreven your email address.Why is a Privacy Breach a Significant Problem?A privacy breach affects the individual, the business, and the healthcare industry.There is an active market for personal identities, with great financial incentive to steal ormisuse this personal information. In fact, healthcare data is more valuable than financialinformation. Once someone has access to personal health information, they can use it to makea fraudulent insurance claims, access to services, and leverage the information for identity theftand fraud. Healthcare providers are a high-value target because of the long-term value of healthinformation.Privacy breaches happen all the time. Did you know that 80% of all privacy breaches occurinternal to the business? Most of these breaches are an ‘oops’ or honest mistakes or a resultof not carefully following procedures. Sometimes there is a pattern of similar breaches thatindicate a broken work flow or automated process or carelessness or disregard to the security ofpersonal information.Sometimes information is intentionally stolen to harm a specific person or for financial gain.Sometimes the theft is by employees and sometimes by visitors to the business. Sometimes thetheft occurs from outside of the business (i.e. hackers, contracted service providers, or businessagents).The individual may be embarrassed, inconvenienced, or angry directly related to whatinformation has been breached and who now has access to the information. The individual maynow be at a real risk of harm from identity theft, stalking, loss of employment, fraud, and theunexpected expense to manage the loss of personal information. These are examples of ‘risk ofsignificant harm’.Of particular importance in healthcare, is the risk of medical identity theft where the breachedinformation is used to fraudulently access healthcare services. As a result of this, inaccurateinformation may be added to the owner’s healthcare records which can cause errors or delaysin receiving necessary care and treatment.
Managing a Privacy Breach is ExpensiveThe healthcare business can spend 150 to 2,000 or more for each individual that requiresnotification about a privacy breach. When a privacy breach is identified, the business must (withsome few exceptions) notify the individuals affected (including the patient and the healthcareproviders identified in the breach) to let them know about the breach, advise them how theymight be affected by the breach, and how they can protect themselves from further harm.Your internal privacy beach investigation takes time and may require additional support fromexternal experts including a consulting privacy officer, lawyer, investigator, human resources,communications and marketing experts.The process of managing the notification also costs time, resources, and money. The incidentmight cause negative publicity for the business. Addressing and correcting the cause of thebreach, improving processes to prevent further incidents, and the administrative tasks ofmanaging and reporting the breach all contribute to a significant expense to the business.Why Have Mandatory Privacy Breach Reporting?A privacy breach in one healthcare organization affects all healthcare businesses. Thehealthcare system is a highly integrated information sharing system designed to providetimely and accurate care and treatment to patients, and to receive financial compensation forthose services. A weakness or problem at one business may have down-stream implications toother businesses. When one business has a privacy or security breach, there is a risk that thepublic (including patients and clients) may think that all healthcare businesses have the sameproblems.Mandatory privacy breach reporting to the Privacy Commissioner of Alberta (OIPC), and theMinister of Health in Alberta will help to ensure that the breach response and notification iscomprehensive. A central oversight with the OIPC and the Minster will provide the opportunity toanticipate any additional risks to privacy and security within the broader health care system inAlberta.It is our job to manage each privacy breach with confidence, compassion, andtransparency to the individuals affected by the breach. We need to take all reasonable steps toprevent a privacy breach and be prepared to respond to the breach when it occurs.The importance of securing health information and to appear to appropriately respond to aprivacy breach is part of the desired outcomes of the new mandatory privacy breach reporting.Notification TriggersThe trigger for notifying the OIPC, the Minister, and individuals about an incident is presentwhen there is a ‘risk of harm’ to an individual as result of the loss or unauthorized disclosure(HIA s. 60.1(4).Custodians are required to consider five categories of triggers to assess the likelihood of riskof harm (HIR s.8.1(a to e)). In addition to any other relevant factors, custodians must assess ifthere is a reasonable basis to believe that the information: Has been or may be accessed by or disclosed to a person Has been misused or will be misused Could be used for the purpose of identity theft or to commit fraudPractice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 4 of 8
Could cause embarrassment or physical, mental or financial harm or damage to thereputation of the individual who is the subject of the information Has adversely affected or will adversely affect the provision of a health service to theindividual who is the subject of the informationMitigating Risk of Harm When custodians implement reasonable safeguards as part of their routine privacy andsecurity strategies, the likelihood of risk of harm is reduced. These situations (HIR s.8.1(f to i))occur when the information included in the loss or unauthorized access has been Encrypted or otherwise secured (applicable to electronic information), or Destroyed or rendered inaccessibleWhen information is lost or disclosed and subsequently recovered by the custodian, and thecustodian can demonstrate: The information was not accessed before it was recovered, or The only person who access the information is a custodian, affiliate, informationmanager subject to section 60 of the Act or, Accessed the information as part of their role as a custodian or affiliate and not for animproper use and Did not improperly use or disclose the information,the custodian is not required to give notice of the loss or unauthorized access or disclosureunder HIA s.60.1(2).Remember that the custodian must record each privacy breach in their practice includingtheir reasons for their decision to notify and their decision not to notify.When you record each privacy breach, including ‘oops’, errors, or mistakes that, individually,may not trigger notification requirements, you may find that there is a pattern of breaches thatmay indicate: broken work flow, or broken automated process, or carelessness or disregard to the security of personal information.These situations may trigger mandatory privacy breach notification requirements.It's an Offence to Fail to Protect Personal Health InformationThe new amendments detail the reporting responsibilities of custodians and affiliates in theevent of a privacy breach.For CustodiansThe new regulations also include new penalties for custodians and affiliates who:Practice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 5 of 8
Fail to report a breach Fail to take reasonable steps to maintain safeguards to protect health information, whichincludes administrative, technical and physical safeguards (HIA s.107(1.1)(a))A custodian or affiliate found guilty of one of the above offences can face a fine of up to 50,000per occurrence.For AffiliatesAffiliates (generally, the employees of the custodian) must report any loss, unauthorized accessor disclosure of identifying health information to their custodian. This applies to informationmanagers (vendors and service providers to custodians), too.New Notification RequirementsIf the custodian believes the breach could result in harm to the individual, the custodian, as soonas practicable, is required to notify (HIA s60.1): The Privacy Commissioner of Alberta (OIPC), and the Minister of Health in Alberta and The Individual(s) affected by the privacy breachDon’t forget that there continues to be other people you may need to notify. Depending on theunique circumstances this may include the police, insurance, primary care networks, Netcare,and other information sharing partners.The notice to the Privacy Commissioner of Alberta (OIPC) must be in writing in a formapproved by the Commissioner and must include (HIR s.8.2(2)): Name of the custodian Description of the circumstances Date or time period which the incident occurred Date which the incident was discovered Description of the type of information that was lost, accessed, or disclosed Risk of harm to an individual and an explanation of how the risk of harm was assessed Number of individuals affected by the incident Description of the steps that the custodian has or intends to take to reduce the risk ofharm Plans to prevent the risk of future loss, or unauthorized access or disclosure Copy of the notice that will be provided to the individual(s) and a description of how thenotice will be provided directly or by substitutional serviceoIf the custodian believes that notifying the individual about the incident may resultin harm to the individual, the custodian must immediately notify theCommissioner (HIA s.60.1(5))Practice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 6 of 8
Contact information for the custodian or their responsible affiliate (privacy officer) Any other relevant informationThe notice to the Minister of Health in Alberta must be in writing in a form approved by theMinister and must include (HIR s.8.3): Name of the custodian Description of the circumstances Description of the type of information that was lost, accessed, or disclosed Risk of harm to an individual and an explanation of how the risk of harm was assessed Number of individuals affected by the incident Description of the steps that the custodian has or intends to take to reduce the risk ofharm Contact information for the custodian or their responsible affiliate (privacy officer) Any other relevant informationThe notice to the individual must be in writing and include (HIR s.8.4): Description of the circumstances Date or time period which the incident occurred Name of the custodian Description of the type of information that was lost, accessed, or disclosed Risk of harm to an individual and an explanation of how the risk of harm was assessed Description of the steps that the custodian has or intends to take to reduce the risk ofharm to the individual Plans to prevent the risk of future loss, or unauthorized access or disclosure Advice that the custodian believes the individual may be able to take to reduce the riskof harm to the individual A statement that the individual may ask the Commissioner to investigate the incident andthe contact information of the OIPC Contact information for the custodian or their responsible affiliate (privacy officer) Any other relevant informationYOUR NEXT STEPSPrepare your Privacy Breach Management Program in your healthcare practice. Review (orcreate) your privacy breach management program including these 5 key elements: Privacy breach management policyPractice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 7 of 8
Privacy and security incident response plan Training for your privacy officer, management team, and custodians Human resources privacy breach discipline policy and Privacy breach reporting record keeping proceduresIf you are a privacy officer, clinic manager, orhealthcare provider you can prevent privacy breachpain with the“4 Step Response Plan”This on-line education with quick and helpful 6 interactive lessons, 60 minute training webinar Video introduction to each lesson Scenarios and examples, Template policy and procedures Downloadable resources, checklists, andtemplateswill guide you to properly manage a privacy breach, create your Privacy Breach ManagementProgram, and be prepared for Mandatory Privacy Breach Notification requirements.This is critical to the continued success of your business!See: se amendments were passed under the Statutes Amendments Act, 2014 in May 2014 andwill be proclaimed in force August 31, 2018Health Information Amendment RegulationOffice of the Information and Privacy CommissionerStatutes Amendment Act, 2014, Chapter 8, Health Information ActYou need to know how mandatory privacy breach reportingwill affect you!Register for the Free Webinarwith Jean L. EatonYour Practical Privacy -privacy-breach-reportingPractice Management Success TipPrevent Privacy Breach Pain Understanding Privacy Breach NotificationInformation Managers Ltd June 2018Page 8 of 8
This Practice Management Success Tip will help you Understand the requirements of mandatory privacy breach notification. Inform your team including custodians, affiliates, privacy officers, and vendors of your role to notify the regulators and individuals when a privacy breach occurs.
![Index [beckassets.blob.core.windows ]](/img/66/30639857-1119689333-14.jpg)
