Privacy Policy

Introduction

The Canadian Stroke Network (CSN) is supported by the Networks of Centres of Excellence and provides funding to research projects with the aim of reducing the effects of stroke on the lives of Canadians. The CSN funds projects undertaken by its partners who include researchers at Canadian universities, government departments, not for profit agencies and in industry. The CSN has a central office, located in Ottawa, which administers the funding of research undertaken by such partners. Occasionally the CSN central office is directly involved in research projects.

This privacy policy is designed to ensure CSN’s compliance with the Federal privacy legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to “personal information about an “identifiable individual” but does not include name, title, business address and business phone number.

In addition the CSN is designated as a prescribed person for purposes of section 39(1) (c) of the Personal Health Information Protection Act, 2004 (PHIPA), Ontario’s health privacy legislation, in respect of the Registry of the Canadian Stroke Network. Section 39(1) (c) of PHIPA permits health information custodians to disclose personal health information without consent to prescribed persons who compile or maintain registries for purposes of facilitating or improving the provision of health care. It also permits these prescribed persons who compile or maintain registries to use and disclose personal health information without consent for the purposes of facilitating or improving the provision of health care and to use and disclose personal health information, again without consent, for other purposes permitted by PHIPA and its regulation.

The CSN in respect of the Registry of the Canadian Stroke Network (RCSN) is one such prescribed person. The CSN has developed its privacy policy and practices and procedures to protect the privacy of individuals whose personal health information is received and to maintain the confidentiality of that information.

The CSN may update this policy in accordance with changes in the law, technology or CSN activities. Any changes will be posted on the CSN websites www.canadianstrokenetwork.ca/ and www.rcsn.org

Scope of CSN Privacy Policy

This privacy policy pertains to all personal information about identifiable individuals that is collected, used or disclosed by CSN in relation to the funding of, or conduct of, research related to reducing the effects of stroke on the lives of Canadians. This privacy policy also pertains to all personal health information collected, used and disclosed by CSN in its role as a prescribed person with respect to the RCSN pursuant to section 39(1) (c) of PHIPA and contains the practices and procedures implemented by CSN to protect the privacy of individuals whose personal health information is received by the RCSN and to maintain the confidentiality of that information.

CSN collects personal information on occasions when it is directly involved in research projects and uses the information for the purposes of the research project. Also, when administering projects undertaken by CSN partners, CSN collects and uses personal information about researchers and employees of the institutions involved in order to facilitate decision-making with respect to funding and administration of projects. The CSN restricts the collection and use of personal information to that which is necessary for the identified purposes.

In the case of CSN research projects where the research is undertaken by CSN partners, the CSN does not itself collect or receive personal information. In these circumstances, the collection, use and disclosure of personal information are governed by the laws and policies applicable to the institution, agency or company engaged in the research.

The RCSN collects personal health information on patients with stroke or transient ischemic attack (TIA) seen across the continuum of care. The personal health information is collected at acute care institutions and ambulatory stroke prevention clinics in Canada. Personal health information is collected by one of two methods, either through specially trained chart abstractors who collect the personal health information by chart review for the RCSN or through a web-based data collection tool known as SPIRIT (Stroke Performance Indicators for Reporting, Improvement and Translation) where personal health information is entered at the point of care by healthcare professionals and administrative staff directly involved in the care of stroke patients.

The RCSN collects the following personal health information:

• Patient demographics, including gender, date of birth, province and postal code of residence, marital status, ethnic origin, and language;
• Health Card Number and Medical Record Number;
• Information about the acute stroke or TIA event, including date and time of onset, symptoms and signs, mode of arrival to hospital, stroke type and stroke severity, and vital signs;
• Pre-existing medical conditions and medications;
• Emergency department and in-hospital investigations, consultations, treatments and complications;
• Length of stay, discharge destination, follow-up arrangements, symptoms at time of discharge and medications at discharge;
• Wait times and frequency of stroke clinic appointments; and
• Follow-up investigations and treatments in the outpatient clinic.

The RCSN uses personal health information for the following purposes:

• To monitor and evaluate the quality of stroke care delivery in participating hospitals in Canada across the stroke continuum of care;
• To monitor and evaluate the performance of the Ontario Stroke System across the stroke continuum of care;
• To provide feedback to Ontario institutions, to the Ontario Stroke System Evaluation Advisory Committee and to the Ontario Ministry of Health and Long- Term Care on the quality of stroke care delivery and on the performance of the Ontario Stroke System in each region and Local Integrated Health Network (LHIN);
• To investigate and propose testable solutions to health and social issues related to stroke;
• To decrease the functional, economic and social consequences of stroke on the individual, the healthcare system and society;
• To facilitate or contribute to the effectiveness, quality, equity, and efficiency of stroke health care;
• To carry out health services research in areas of clinical relevance from a population-wide perspective in accordance with the provisions of PHIPA and its regulation;
• To document national and provincial patterns of stroke care; and
• To develop and disseminate information for use by patients, practitioners, clinician-managers, administrators, policymakers and the general public about stroke.

PHIPA and its regulation are the foundation of the CSN's privacy policies, procedures and practices in relation to the RCSN. PHIPA is rooted in the ten principles-known as the CSA Model Code or the Fair Information Practices-found in PIPEDA.

The 10 principles are:

1. Accountability
2. Identifying purposes
3. Consent
4. Limiting collection
5. Limiting use, disclosure and retention
6. Accuracy
7. Safeguards & Openness
8. Openness
9. Individual access
10. Challenging compliance

The CSN is responsible for all personal information, including personal health information, under its custody or control. The CSN Director of Partnerships has been appointed as Privacy Officer for the CSN including the RCSN.

This document discusses each principle individually as it applies to the collection, use, and disclosure of personal health information at the RCSN.

Principle 1: Accountability

Principles and procedures for ensuring confidentiality and security of personal health information are strictly enforced in order to respect the privacy of individuals whose personal health information is contained in the RCSN, to maintain the confidentiality of that information and to protect personal health information against theft, loss and unauthorized use, disclosure, copying, modification or disposal. As a prescribed person within the meaning of section of PHIPA, the CSN in respect of the RCSN is responsible for the collection, use and disclosure of all personal health information in the RCSN and has designated individuals who are accountable for the CSN's compliance with PHIPA and with the principles in this privacy policy.

The CSN's CEO/ Scientific Director, who reports directly to the CSN Board of Directors, is ultimately accountable for ensuring that CSN complies with PHIPA, that CSN complies with the principles in this privacy policy and that research studies are conducted in accordance with current legal requirements and standards for ethical acceptability, but has delegated day to day responsibility for the privacy program to the Privacy Officer, who reports directly to the CSN’s CEO/ Scientific Director.

When the CSN sends personal health information to third parties for the purpose of processing on behalf of the CSN, such third parties are required to use the personal health information only for the purposes for which it has been provided to them and are required to protect the security of personal health information in accordance with privacy laws, including PHIPA.

• 1.1 Designated personnel are responsible for the day-to-day collection and use of personal health information.
• 1.2 The CSN has implemented policies and practices with respect to the RCSN to give effect to these principles, including:
  • Procedures to protect personal health information;
  • Orientation and training of new staff about RCSN privacy and confidentiality policies, procedures and practices;
  • The establishment of procedures to receive and respond to complaints and inquiries;
  • The development of information to explain RCSN privacy policies and procedures.

Principle 2: Identifying Purposes

The RCSN will identify the purposes for which it collects and uses personal health information in this privacy policy and, in the context of collections and uses of personal health information for research purposes, through the development of research plans prepared in accordance with PHIPA and its regulation before the personal health information is collected or used. Personal health information will only be used for research purposes and for purposes of facilitating or improving the provision of health care related to stroke in accordance with PHIPA.

• 2.1 RCSN collects and uses personal health information in accordance with PHIPA to conduct research that contributes to the effectiveness, quality, equity, and efficiency of stroke care in Canada, and to facilitate or improve the provision of health care related to stroke pursuant to section 39(1) (c) of PHIPA.
• 2.2 Identifying the purposes for which the CSN uses personal health information before collection allows careful determination of the information needed to fulfil these purposes. The CSN only collects, uses and discloses the personal health information necessary to meet the pre-identified purposes.
• 2.3 Subsequent or new purposes identified for the use of anonymous RCSN data will be identified prior to use and will be articulated in a written and ethically-approved research proposal.

Principle 3: Consent

The CSN in respect of the RCSN is a prescribed person under section 39 (1)(c) of PHIPA and therefore can receive personal health information without consent from health information custodians and can use and disclose personal health information without consent for the purpose of facilitating or improving the provision of health care and for other purposes permitted by PHIPA and its regulation if it has:

1. put in place practices and procedures to protect the confidentiality of the personal health information and the privacy of individuals with respect to the personal health information, and
2. has provided the public with notice and educational materials about the functions of the RCSN, about the purposes for which personal health information is collected, used and disclosed and contact information for those members of the public who have questions and/or concerns about the practices and procedures of the CSN in respect of the RCSN.

Approval for these practices and procedures is provided by the Information and Privacy Commissioner of Ontario. All research proposals are prepared in accordance with PHIPA and are submitted for research ethics board (REB) approval to ensure scientific integrity and that sufficient protections are in place.

Upon request, the CSN will inform an individual of the existence, use and disclosure of his or her personal health information. Requests may be made by contacting the Privacy Officer. On receiving a request, the CSN will disclose:

• whether or not it holds personal health information about the individual;
• the source of the personal health information; and
• an account of third parties to whom the personal health information has been disclosed.

The CSN will endeavour to respond to such requests within 30 days. There may be circumstances in which the CSN cannot provide the information requested. In those situations, the CSN will explain the reasons it cannot meet the request.

Principle 4: Limiting Collection

The RCSN will limit the collection of personal health information to that which is necessary for the purposes of the proposed research study or for purposes of facilitating or improving the provision of health care related to stroke pursuant to PHIPA.

• 4.1 The RCSN will not collect personal health information indiscriminately. Both the amount and the type of personal health information collected will be limited to that which is necessary to fulfil the research or section 39(1) (c) purposes identified.

Principle 5: Limiting Use, Disclosure and Retention

All personal health information collected by RCSN is used only for research purposes outlined in REB-approved research proposals prepared in accordance with PHIPA or for purposes of facilitating or improving the provision of health care related to stroke pursuant to section 39(1) (c) of PHIPA. The RCSN presents data in an aggregated fashion, in other words, data are grouped together (aggregated).

Personal health information is retained/securely archived as is required for clinical research projects for a period of twenty years. In a project-specific research agreement, earlier destruction may be a requirement. Personal health information collected for purposes of facilitating or improving the provision of health care pursuant to section 39(1)(c) is retained for long-term analysis and reporting.

The RCSN has developed guidelines and implemented procedures with respect to the secure retention of personal health information. Personal health information that is no longer required to fulfill the identified purposes will be securely destroyed or erased after the agreed-upon retention period has been met. The RCSN has developed guidelines and implemented procedures to govern the secure destruction of personal health information such that the reconstruction of the personal health information is not reasonably foreseeable in the circumstances (e.g. shredding of documents in-house, data tape magnetization).

Principle 6: Accuracy

Data which has been made anonymous cannot be updated, unless the organization collecting the data verifies and updates the personal health information.

• 6.1 The RCSN will not update personal health information collected, unless such a process is necessary to fulfill the purposes for which the personal health information was collected.
• 6.2 The RCSN will take steps that are reasonable in the circumstances to ensure that personal health information collected is accurate, complete and up-to-date at the time of collection. This is a requirement to ensure the personal health information derived from the RCSN databases are valid.

No decisions relating to future health care of an individual are based on personal health information gathered by the RCSN at any time. All personal health information is only used for research and for purposes of facilitating or improving the provision of health care related to stroke pursuant to PHIPA.

Principle 7: Safeguards

The RCSN will protect all personal health information within its custody or control. RCSN personnel consider all data to be highly sensitive; thus personal health information protection is paramount and accomplished with physical, organizational and technological safeguards appropriate to the sensitivity of the personal health information.

• 7.1 Without exception, all personal health information is considered to be sensitive.
• 7.2 Safeguards protect personal health information against loss or theft, as well as unauthorized access, disclosure, copying, use, modification or disposal. The RCSN will protect personal health information regardless of the format in which it is held.
• 7.3 The nature of the safeguards will vary depending on the amount, distribution, format of the personal health information and the method of storage. The methods of protection in place include:
• • a) Physical measures: e.g., locked facilities with tracked key access, locked filing cabinets and restricted access to offices, internal/external video monitoring of the facilities housing the servers;
  • b) Organizational measures: e.g., research agreements, strict employee confidentiality agreements (with immediate dismissal as a sanction) and access limited to a need-to-use basis;
  • c) Technological measures: e.g., the use of firewalls, "moating" of data making it inaccessible externally, passwords, and encryption; and,
  • d) Anonymization of data by stripping conventional identifiers.
• 7.4 The RCSN requires signed confidentiality agreements from all its employees and agents. Privacy orientation training is provided to all staff so they are made aware of the importance of maintaining the confidentiality of personal health information.
• 7.5 The RCSN has policies and procedures in place pertaining to the disposal or destruction of personal health information to prevent unauthorized parties from gaining access to the personal health information.

Principle 8: Openness

Information about CSN policies and practices, as related to the management and protection of personal health information, is available on our web sites http://www.canadianstrokenetwork.ca/ and http://www.rcsn.org

Descriptions of research in progress and publications from completed research projects are available at http://www.rcsn.org

Principle 9: Individual Access

Upon request, the CSN will inform an individual of the existence, use and disclosure of his or her personal health information. Requests may be made by contacting the Privacy Officer. On receiving a request, the CSN will disclose:

• whether or not it holds personal health information about the individual;
• the source of the personal health information; and
• an account of third parties to whom the personal health information has been disclosed.

The CSN will endeavor to respond to such requests within 30 days. There may be circumstances in which the CSN cannot provide the information requested. In those situations, the CSN will explain the reasons it cannot meet the request.

Principle 10: Challenging Compliance

An individual can challenge compliance with the principles in this privacy policy and with the provisions in PHIPA and its regulation through the Chief Executive Officer of the CSN or through the Privacy Officer.

• 10.1 The RCSN has put simple and accessible procedures in place to receive and respond to complaints or inquiries about their policies and practices relating to the handling of personal health information.
• 10.2 Individuals with inquiries or complaints will be informed by RCSN staff about the relevant procedures.
• 10.3 Appropriate RCSN staff will investigate all complaints in a timely fashion. If a complaint is found to be justified, the CSN will take appropriate measures including, if necessary, amending its policies and practices.

Individuals may obtain further information or submit complaints about the CSN’s personal health information practices by writing to Dr. Kevin Willis, Director of Partnerships and Privacy Officer at 600 Peter Morand Crescent, Suite 301 Ottawa, Ontario K1G 5Z3 (613) 562-5800 ex 8593. The Privacy Officer will alert the Executive Committee of the Board of Directors who will define the appropriate action.

In addition, an individual can challenge compliance with the provisions in PHIPA and its regulation by making a complaint to the Information and Privacy Commissioner/Ontario at:
Information and Privacy Commissioner/Ontario
2 Bloor Street East, Suite 1400
Toronto, Ontario
M4W 1A8

This privacy policy is based upon PHIPA and the ten guiding principles which make up the "Fair Information Practices" found in the CSA Model Code, Schedule A to PIPEDA.

Click here to download the RCSN Information Brochure