P33 Policy and Procedures for Privacy Inquiries updated timelines for complaint acknowledgement from 3 days to 2 days to correspond with changes to HHS policy for managing patient inquiries and complaints An additional review of P22 – Policy and Procedures for the Linkage of Records of Personal Health Information was conducted in November 2015 by the CCIS Data Stewardship Committee: P22 - Policy and Procedures for the Linkage of Records of Personal Health Information was revised to allow for data linkages and to document the related conditions and requirements Reviewed and approved by CCIS Data Stewardship Committee at the January 6th 2016 meeting. Whether new privacy policies and procedures were developed and implemented as a result of the review, and if so, a brief description of each of the policies and procedures developed and implemented. P10- Policy and Procedures for the Use of PHI for Research had been created or submitted to the IPC for initial review; although HHS/CritiCall Ontario does not use PHI from the CCIS for internal research purposes (which is likely why the policy was not created initially) a policy and procedures was drafted to reflect the requirements of the Manual and the current position of HHS/CritiCall with respect to this use of PHI. The date that each amended and developed privacy policy and procedure was communicated to agents and, the nature of the communication for each policy/procedure. The CCIS privacy and security policies were highlighted to CritiCall Ontario staff with CCIS functions during the annual CCIS Role Based Privacy and Security Education sessions on: November 6, 2013 November 20, 2014 Updates to these policies were highlighted during the annual CCIS Role Based Privacy and Security Education session on: December 11, 2015 Additional communications related to updates or amendments to CCIS privacy policies and procedure included:
Communication of change period to update to Patient Discharge List from 7 days after ICU patient discharge to 3 days. October 1, 2014 New CCIS Privacy and Security Policies and Procedures have been added to the Document Library. December 16, 2013 New Influenza Like Illness (ILI) Indicators to the CCIS to help build knowledge and understanding of requirements of patients who present with or acquire ILI upon admission or during the patient’s stay in one of Ontario’s Critical Care Units. Whether the communication materials available to the public and other stakeholders were amended as result of the review, and if so, a brief description of the amendments. Communication materials available to the public and other stakeholders were not amended as a result of the review. Collection The number and data holdings containing PHI maintained by the prescribed person. HHS/CritiCall Ontario maintains one data holding, the CCIS Data Holding. The number of statements of purpose developed for data holdings containing PHI. The CCIS Data Holding has one statement of purpose is contained within P7: Statements of Purpose for Data Holdings Containing Personal Health Information The number and a list of statements of purpose for data holdings containing PHI that were reviewed since the prior review by the IPC. The Statement of Purpose for the CCIS Data Holding has been reviewed since the initial review by the Information and Privacy Commissioner of Ontario. Whether amendments were made to existing statements of purpose for data holdings containing PHI as a result of the review, and if so, a list of the amended statements of purpose and, for each statement of purpose amended, a brief description of the amendments made. HHS/CritiCall Ontario has not made any amendments to the Statement of Purpose for the CCIS. Use
Whether the communication materials available to the public and other stakeholders were amended as a result of the review, and if so, a brief description of the amendments. Communication materials available to the public and stakeholders were not amended as a result of the review Physical Security The dates of audits of agents granted approval to access the premises and locations within the premises where records of PHI are retained since prior review by the IPC and for each audit A brief description of each recommendation made The date each recommendation was addressed or is proposed to be addressed, and The manner in which each recommendation was addressed or is proposed to be addressed Refer to Appendix 2- Security Audits for details Security Audit Program The dates of the review of system control and audit logs since the prior review by the IPC and a general description of the findings if any, arising from the review. Refer to Appendix 2- Security Audits for details The number and a list of security audits completed since prior review by the IPC and for each audit: A description of the nature and type of audit completed The date of completion A brief description of each recommendation made The date that each recommendation was addressed or is proposed to be addressed and The manner in which each recommendation was Refer to Appendix 2- Security Audits for details
2 Review of CCIS accounts with Administrative and Support privileges Feb. 1, 2016 Disable accounts that no longer require this level of access Ensure user access forms are completed for all account creation, role change or disable/ termination February 1, 2016 1, 2016 Accounts were disabled IT Manager implemented mandatory user access form for Help Desk; a related communication was sent to all management staff and Help Desk June 22, 2016 Develop to manage and control all vendor and service access accounts. January 2017 CCIS access matrix developed and implemented for vendor and service accounts 2 Ensure managers receive list of employees’ access/roles and confirm/update as necessary Mar. 2, 2016 Sept. 1, 2016 No recommendations No recommendations No recommendations 1 Audit access to CCIS data base to ensure only staff with CCIS responsibilities are accessing it Aug. 15, 2016 Terminate two accounts for former employees Modify two accounts for staff who had changed roles Aug. 15, 2016 Accounts terminated Accounts were modified 1 Physical Security Log Audit Aug. 11, 2016 No recommendations No recommendations No recommendations
The date(s) that the containment measures were implemented July 25, 2016 The dates that notification was provided to the HIC or any other organization No notifications beyond interaction with user The date that the investigation was commenced July 25, 2016 The date that the investigation was completed July 25, 2016 A brief description of each recommendation made That the incident be reviewed with the Help Desk Technician involved That processes for account provisioning be reviewed with the Helpdesk technician involved in this incident The date each recommendation was addressed or is proposed to be addressed July 25, 2016 The manner in which each recommendation was addressed or is proposed to be addressed The Manager of IT/Security Lead met with the staff member to review the incident and processes for account provisioning