1. This module focuses on Privacy, Confidentiality, and Security of Personal Health Information.
Move this to online module slides 11-56
Privacy, Confidentiality, and Security of Information: Annual Training 2018 – Part 1

2. Do I Need Privacy Training?
To understand the privacy principles and your accountability for handling patient information To understand how you apply principles everyday while working at SMGH and after you leave the hospital To reduce risk related privacy issues To outline strategies to maintain confidentiality and protect information, and reduce risk of privacy breaches To review consequences of a privacy breach
Read slide

3. What is Personal Health Information (PHI)?
Any information about a patient:
Name, address, phone number, next of kin, tests, diagnosis, treatment, discharge plans
Includes any patient information you have:
Written, read, observed, heard at the hospital
Read slide

4. SMGH is committed to protecting all patient personal health information (no matter what form) in our custody and control.
Read slide

5. All SMGH staff who have the right to access PHI in the course of their work, have an ethical and professional obligation to protect the confidentiality of the information and to access and use only as required in their work.
All staff are expected to implement good security practices consistent with the value of the information.
Read slide

6. What is Confidentiality?
What is Privacy?
Privacy is a RIGHT that is protected by law and gives an individual control on how, when and to what extent their information will be shared with others.
What is Confidentiality?
Confidentiality is a hospital’s obligation to ensure privacy by limiting access and disclosure.
Read slide

7. What is the Personal Health Information Act (PHIPA)?
PHIPA is a provincial law regulating the management of personal health information
Regulates how patients’ information is collected, used and disclosed
Under this law patients have greater control over their information
Hospitals are held accountable for informing patients of breaches
Read slide

8. Patients’ Rights
PHIPA establishes a set of rules regarding personal health information. PHIPA gives patients the right to:
be informed of the reasons for the collection, use and disclosure of their personal health information
be notified of the theft or loss or of the unauthorized use or disclosure of their personal health information
refuse or give consent to the collection, use or disclosure of their personal health information, except in certain circumstances
withdraw consent by providing notice
Read slide

9. Patients’ Rights Continued
expressly instruct that their personal health information not be used or disclosed for health care purposes without consent
access a copy of their personal health information, except in limited circumstances
request corrections be made to their health records
complain to the Information and Privacy Commissioner (IPC)
Read slide

10. How does SMGH Protect Information?
SMGH has administrative, physical, and technical measures in place to protect the information in its custody from inappropriate collection, access, and disclosure. Let’s look at these measures more closely.
Read slide

11. Examples of Administrative Measures at SMGH?
Privacy Policy & Procedures (These procedures include policies to protect against unauthorized use of PHI).
Mandatory Privacy Training
Confidentiality agreements (including annual attestations)
Record Retention & Destruction practices
Read slide

12. Examples of Physical Measures
Secure storage, locked filing cabinets, restricted access to offices, secure workstations
Ensuring hardcopy patient records and patient lists are not viewable by the public
Read slide

13. Examples of Technical Measures
Users log in with passwords. Remember to only access the computer system under your own password and log off when finished.
Read slide
Access is limited based on needs of individual staff.

14. Technical Measures Examples Continued:
Firewalls (a network security system, either hardware or software based) that controls incoming and outgoing network traffic based on rules
Audits (a process for assessing information handling practices, including using software to monitor access/use of PHI)
Read slide

15. When Can Non-Clinical Staff Access and Share Patient Information?
Non-clinical staff can only access and share patient information when they need to access and share specific information to complete their assigned duties including:
Patient Registration
Billing in Finance
Coding in Health Records
Read slide

16. Circle of Care
The ‘circle of care’ refers to those individuals who directly provide or assist in the care or treatment of a particular patient at a particular point in time and need to know the information to provide or help to provide care to the patient.
Personal health information can be released to those in the “circle of care” for the provision of care based on implied consent.
Read slide