Manitoba Health blamed for ‘significant privacy breach’

The ombudsman’s recommendations:

1. Manitoba Health should appoint a chief privacy officer to co-ordinate “all aspects of the department’s privacy responsibilities.

Response: This recommendation is very timely since the health system provincially is being reorganized and issues related to information management and governance are being examined at a provincial level.

2. Manitoba Health should undertake a thorough review of its existing privacy management and governance structure with the goal of creating a more centralized and co-ordinated approach to privacy compliance.

Response: This recommendation is very timely since the health system provincially is being reorganized and issues related to information management and governance are being examined at a provincial level.

3. Manitoba Health should complete an inventory of its personal health information holdings to make sure it is in compliance with the Personal Health Information Act. This inventory should include information already held, data elements being collected, used and disclosed, the authority for these activities, security measures and retention periods.

Response: This recommendation is accepted. However, given the health system transformation that is underway, no timeline for completion can be provided at this time as the department’s health information holdings may change as a result of this process.

4. Manitoba Health should review its policies and procedures pertaining to the Personal Health Information Act. This review should await the new governance and management structure, as well as the appointment of a chief privacy officer.

Response: This recommendation is accepted.

5. Manitoba Health should make sure user activity records are kept in a form that complies with its current guidance on auditing such records. It should also consider ensuring new or upgraded systems can track and capture whether a user has printed or downloaded personal health information as well as information about the date, time, duration and frequency of access by each user, if possible.

Response: The department will ensure that its records of user activity are maintained in a form that complies with the current guidance on auditing records of user activity. The department will consider the portion of the recommendation relating to new or upgraded systems in the PHIA legislated review already underway.

6. Manitoba Health should create comprehensive audit processes for auditing records of user activities when it comes to personal health information if it has not already done so as part of its auditing process template. Documents developed on this should be provided to the ombudsman’s office and the department should make clear when ongoing auditing processes will be completed.

Response: This recommendation is accepted and the work on this is well underway.

7. Manitoba Health should implement auditing processes developed per the ombudsman’s recommendations and that should include random, targeted audits of user activity. Audits completed to date should be given to the ombudsman and going forward the government should consider creating an annual report for the previous year’s audit program. That should be made public on the department’s website.

Response: The portion of this recommendation dealing with the implementation of audits and providing the results of completed audits to your office is accepted and the work on this is nearing completion. The portion of this recommendation suggesting the creation and publishing of an annual report will be considered as part of the above-noted information management and governance activities.

8. Manitoba Health should ensure that user activity audits are reviewed on an ongoing basis before they are destroyed. These audits should also be included in the suggested annual report mentioned in the seventh recommendation.

Response: The portion of this recommendation dealing with ensuring that each record of user activity is audited before the record is destroyed is accepted. The portion of the recommendation suggesting that these audits be included in the suggested annual report mentioned in recommendation 7 will be considered as part of the health system transformation work currently underway as indicated in the responses to recommendations 1 and 2.

9. Manitoba Health should do a comprehensive review of its approach to managing its privacy obligations to Manitobans. That review should not only audit the department’s personal health information holdings but also assess its privacy policies and management structure for compliance. This review should be made public and all of its recommendations should be implemented.

Response: As indicated in the deputy minister’s letter to the ombudsman, with respect to the recommendations regarding the structure and management of privacy practices and the reporting of same, the health system provincially is in a state of transformation. Issues relating to information management and governance are being examined at a provincial level, and these recommendations will be taken into account in this work.

10. Employee training for those who can access personal health information should be mandatory and ongoing and include the provincial drug program branch. Training should be mandatory upon hiring and refreshed every three years.

Response: This recommendation is accepted and is reflected in the department’s policy respecting staff orientation and training respecting PHIA.

11. Manitoba Health should make sure all employees sign a confidentiality pledge when hired that makes clear they know the expectations and responsibilities of the Personal Health Information Act and that they agree to comply with the act and the department’s policies on it.

Response: This recommendation is accepted.