GRH hosts the Cerner system for this partnership. Under s.10(4) of the Personal Health Information Protection Act (PHIPA) and ss.6(3) of Regulation 329/04 made under PHIPA, a person who provides services to two or more health information custodians to use electronic means to disclose personal health information to one another is a health information network provider (HINP).
Our responsibilities include:
- Managing changes in roles and responsibilities as they pertain to PHIPA and establishing appropriate agreements
- Assessing the privacy and security of the information system to help ensure that it protects personal health information
- Appointing one or more individuals who will be responsible for the privacy and security of the personal health information in the shared system
- Establishing logging, auditing and monitoring policies and procedures, including the communication of these controls to the participants
- Providing incident and breach management support to the participants by informing the parties in the event of a Privacy Breach or unauthorized access
- Making plain language safeguards available to both the public and participating organizations
- Completing a Privacy Impact Assessment (PIA) and Threat/Risk Assessment (TRA)
For more information about our information privacy practices, please contact the Information Privacy & Security Office at 519-749-4300 ext. 4275 or email firstname.lastname@example.org.
Plain Language Description of Health Information Network Provider Services
The Personal Health Information and Protection Act (PHIPA, 2004) defines a Health Information Network Provider (HINP) as an organization that hosts two or more organizations hospital information system for patients personal health information. Grand River Hospital and St. Mary’s General Hospital share a system called Cerner.
Grand River Hospital hosts the Cerner system for this partnership with St. Mary’s General Hospital. Under s.10(4) and ss.6(3) of Regulation 329/04 made under PHIPA. As part of that responsibility Grand River Hospital assesses the threats, risks and impacts associated with the shared system and works to safeguard the Personal Health Information and meet its obligations related to privacy and security.
Summary of Privacy and Security Safeguards
We understand the importance of ensuring the privacy and security of personal health information and have developed a HINP framework that describes the standards used to protect this information. There are numerous controls built into the system that protect personal health information (PHI) including:
The Cerner System is hosted in a secure environment with effective administrative, physical, technical and information security safeguards in compliance with industry best practices.
Access controls are used to prevent unauthorized or inappropriate access to PHI, ensure protection of Grand River Hospital systems, prevent unauthorized computer access, detect unauthorized or inappropriate activities and ensure the integrity and reliability of information systems.
GRH only grants PHI access to authorized persons based on roles and responsibilities for each position within the organization and only to the extent they require to fulfill the requirements of their job. Any HIC’s that are considered to be a subscriber are expected to adhere to similar principles based on their corporate policies and procedures.
All users are authenticated through an enhanced authentication mechanism prior to accessing the Cerner system.
Strict password policy parameters are required and enforced
Data is encrypted during transmission and while stored in Cerner
Data retention and disposal policies are in place to ensure PHI is kept as long as required and is disposed of properly to ensure confidentiality.
To ensure that appropriate safeguards are in place to protect the privacy and security of all data, GRH will require the PA to complete a privacy compliance survey on an annual basis.
Audits and Monitoring
Audits are performed to ensure the privacy, confidentiality and security of personal health information (PHI) housed within the shared electronic health system. GRH as a HINP has the responsibility to ensure that PHI it has under custody and control is not inappropriately accessed.
A Technical Vulnerability Assessment (TVA) and Privacy Impact Assessment (PIA) were conducted to identify privacy and security gaps and deficiencies.
Penetration testing has been performed to prevent any unauthorized access and modification to the Cerner system and its data.
Each subscriber and GRH have implemented and follow privacy practices that comply with the Personal Health Information Protection Act, 2004 and its regulations regarding the collection, use, disclosure, retention and disposal of PHI.
A privacy incident and breach management policy is in place to address any privacy events (breach or incidents) collaboratively among the appropriate parties.
A consent management process is in place to manage and enforce Client/Patient’s consent among participating organizations.
A client privacy support process is in place to manage Clients/Patients’ requests to access and/or correct their PHI in the Cerner System, and to challenge the privacy compliance of the participating HIC.
GRH, as a HINP and agent complies with the Personal Health Information Protection Act, 2004 and regulations thereunder as well as industry best practices, and uses a variety of administrative, physical, technical and information security safeguards to protect PHI. In addition, GRH has policies and procedures in place to ensure that its employees and authorized users understand their obligations with respect to the system and protection of PHI.