Do You Know Where Your Policies And Procedures Are?

Do You Know Where Your Policies And Procedures Are?

Do You Know Where Your Policies and Procedures Are?

This is a cautionary tale.

And it could save you a lot of embarrassment – even legal issues.

The way a healthcare provider collects, uses and discloses personal health information (PHI) is critical to an efficient healthcare practice.

It’s also required by legislation and professional college regulations and standards.

Policies and procedures must be in writing, available to employees, and monitored to ensure that they are followed. Otherwise, you face all sorts of risks, including privacy breaches and other legal problems.


Don’t let this happen to you!

Everyone in a healthcare practice — including front office staff, wellness practitioners and physicians and other custodians — must be aware of and follow these policies and procedures.

These policies and procedures also become the foundation of your privacy impact assessment (PIA).

That’s why, in this Privacy Breach Nugget, we’ll review a privacy breach investigation report from Alberta’s Office of the Information and Privacy Commissioner (OIPC). Whether you have a new practice, or an existing practice, we have a number of services and resources designed to help you manage your practice in a way that not only meets legal requirements, but is streamlined and efficient, and keep your information secure.

What Happened

This report started with an employee suspected of accessing health information for an unauthorized purpose.

It started with at the clinic with a conflict between the employees and the employer.

An employee (Employee A) was on leave from her position at the clinic. Her access to the electronic medical record (EMR) was suspended during her leave.

Employee A wanted to access patient information to support her dispute with management. Over two months, Employee A used Employee B’s credentials to access patient records.

This action is in contravention of the Health Information Act (HIA) sections 27 and 28.

This is where this case becomes even more convoluted and, in fact, a better case study of what not to do.

Employee Dispute

Understanding the Health Information Act

The Health Information Act (HIA) requires the custodian (the physician, in this case) to take reasonable steps to maintain administrative, technical, and physical safeguards to protect patient privacy as required by sections 60 and 63 of the HIA, and section 8 of the Health Information Regulation.

In November 2013, the clinic submitted a privacy impact assessment (PIA) to the OIPC prior to its implementation of an electronic medical record (EMR).

The PIA included written policies and procedures.

The letter to the OIPC accompanying the PIA was signed by two physicians, as well as Employee A who was the privacy officer at that time.

The physician named in the investigative report is not the current custodian at the clinic. The physician was hired in 2015 and therefore not a member of the clinic in 2013 and not involved in the initial PIA submission.

During the investigation, both employees indicated that the policies and procedures to protect patient privacy were in a binder in the clinic, but it was never used or shared with the staff.

Oaths of confidentiality may have been previously signed by the employees, but the documents could not be produced during the investigation.

Section 8 (6) of the Regulation states the ‘custodian must ensure its affiliates are aware of and adhere to all of the custodians administrative, technical, and physical safeguards in respect of health information.’

It’s common practice for clinics to require employees to sign confidentiality agreements and ensure that they receive patient privacy awareness training with regular updates.

But in this investigation, the employees said they never received privacy awareness training.


Access To Patient Information

The employees also stated it was common practice at this clinic for individuals to not log off of their EMR account on the computers at the reception desks. It was common practice for other employees to access an open session to quickly perform a task in the EMR.

The investigator concluded that the physician was in contravention of the HIA section 63(1) which requires custodians to establish or adopt policies and procedures that would facilitate the implementation of the Act and regulations.

These specific findings were made:

  • The custodian failed to ensure the clinic employees were made aware of and adhered to the safeguards put in place to protect health information in contradiction contravention of section 8(6) of the regulation.
  • The custodian was in contravention of section 8(6) of the regulation which requires custodians to ensure that their affiliates are aware of and adhere to all of the custodian’s administrative, technical, and physical safeguards with respect to health information. It’s important to note any collection use or disclosure of health information by an affiliate of a custodian is considered to be the collection, use, and disclosure by the custodian.
  • The custodian failed to ensure the employee and the other clinic staff adhered to technical safeguards as required by section 60 of the HIA and section 8(6) of the regulations.

Privacy Breach Nuggets You Need to Know

Privacy breaches are in the news every day. The more you know how breaches can affect you allows you to be more proactive to prevent privacy breach pain.

Get Your Privacy Documents In Order

To protect yourself and your practice from patient privacy breaches (and massive fines, see the conclusion to this article), follow these steps.

  1. Find your policies and procedures and review them with all staff and custodians. Make sure you document that this has been done.
  2. Review and update your privacy awareness training and ensure all staff, including custodians, have completed this recently. Make sure you have this documented, including certificates of attendance if available.
  3. Oath of confidentiality documents should be signed by all of all clinic staff and custodians and maintained in a secure location.
  4. Review your privacy impact assessment and ensure all of your current custodians have read this and understand it. Visit this post for more information to help you determine if you need a PIA amendment.


This incident occurred in 2016. The OIPC office did not recommend any additional sanctions against the clinic, physicians, or employees.

To get templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership

New Amendments To The HIA

This case might have turned out differently today.

New amendments, as of 2018, provide a provision for fines under the HIA ranging from $2,000 to $200,000.

The public — and our patients — expect and trust us to make sure that their personal health information is kept secure and confidential.

It’s our responsibility to make sure we have these administrative, technical, and physical safeguards in place and are maintained in a consistent fashion.

When you’ve done the hard work to implement your patient privacy policies and procedures and your privacy impact assessment, make sure you continue your journey and keep these documents up-to-date and current. To help you, sign up for the Practice Management Success Membership.

There are many patient privacy breaches in the news each day, and you never know when it could happen to you.

The more you know about the breaches and how they can affect you allows you to be more proactive to prevent privacy breach pain. If you need to prepare your privacy breach management plan, start your on-line training 4-Step Response Plan right away!

If you need templates of policies and procedures for your healthcare practice, be sure to sign up for the Practice Management Success Membership. These tips, tools, templates, and training will help you save time and money to develop and maintain policies and procedures in your healthcare practice.


When we know better, we can do better…

I’ve helped hundreds of healthcare practices prevent privacy breach pain like this. If you would like to discuss how I can help your practice, just send me an email. I am here to help you protect your practice.

PRIVACY BREACH NUGGETS are provided to help you add a ‘nugget’ to your privacy education program. Share these with your staff and patients as a newsletter, poster, or staff meeting.

Jean L. Eaton, Your Practical Privacy Coach



References and Resources

Alberta Office of the Information and Privacy Commissioner. Investigation Report H2019-IR-01 Investigation into alleged unauthorized accesses and disclosures of health information at Consort and District Medical Society Clinic. May 21, 2019.

When Do You Need a PIA Amendment?

When Do You Need a PIA Amendment?

A Privacy Impact Assessment Is Good For Business

A privacy impact assessment (PIA) is part of a regular business process if you collect, use, or disclose personal health information in your healthcare practice. When you have a previous PIA that has been prepared, submitted to the Office of the Information and Privacy Commissioner (OIPC) and it has been accepted for use–well, that is not the end of your PIA journey.

You need to ensure that you are updating and amending your PIA as your practice matures and as you make administrative and technical changes to the procedures in your practice.

You need a PIA Amendment when you have a previously accepted PIA and any one of these common triggers below.

You Have a PIA That Was Written More Than 2 Years Ago

It is time to review and update this!

Under Section 8(3) of Alberta’s Health Information Regulation, custodians must periodically review the safeguards they have in place to protect health information privacy. This means that custodians need to regularly review the privacy risk mitigation plans set out in PIAs to ensure they continue to protect against reasonably foreseeable risks to the privacy of health information. The submission of your PIA to the Office of the Information and Privacy Commissioner (OIPC) is mandatory and must precede implementation of your new system or practice.

Change in Health Information Act (HIA) Legislation and Regulations

The HIA has undergone significant amendments in 2006, 2010, most recently in August 2018. Make sure that you have updated your privacy breach management program and include mandatory privacy breach notification to the (OIPC) and the Minister of Health (MOH). Again, ensure that your team training has been updated so that they know how to spot, stop, and report a privacy breach. (See Mandatory Privacy Breach Notification)

Changes In Your Electronic Medical Record or Computer Network

You have the same EMR database, but maybe the configuration has changed. For example, a change from a local to an application service provider (ASP) or cloud-based data centre or Software as a Service (SAS) model would trigger a PIA amendment.

Another trigger is a change in your computer network vendor or changes in wireless networking, remote access, or implementing mobile devices.

PIA amendment EMR computer network

Change in Participating Physicians / Privacy Officer

Since your original PIA, you may have new custodians, including physicians, registered nurses, chiropractors, and other health professionals named in the HIA that have joined or left your practice. Your Privacy Officer may have changed, too. Your amendment should include an up-to-date listing of custodians and privacy officers.

New Users / Information Sharing

There have been many recent information sharing initiatives in healthcare. You might now plan to participate in evaluation projects, patient panel management, or other community initiatives. Make sure that you have your PIA amendment and information manager agreements completed, too. (See – The Top 3 Agreements Your Healthcare Practice MUST Have (and Why).

A quick word of caution: if your new information sharing project includes data matching–the creation of new information by combining two or more sets of data—requires custodians to prepare a privacy impact assessment before performing data matching involving health information (HIA sections 70, 71). The custodian that carries out the data matching is responsible for preparing the Privacy Impact Assessment.

PIA amendment new users

Communicating With Patients

If you are adding new technology to keep in touch with patients for appointment reminders, on-line appointment booking, secure email or patient portals, these will trigger a PIA amendment or, perhaps, a project specific PIA. Make sure that your policies and procedures are up to date, too. (See – Can You Use Text Message With Your Patients? )

PIA Amendment Communicating with patients

Alberta Netcare Portal (ANP) / Community Integration Initiative (CII) / CPAR

ANP updated their PIA in 2016 and, therefore, you need to make sure that your corresponding policies and procedures and training have been updated, too. Remember – when you agreed to participate in ANP, you promised that you would review your threat risk analysis (TRA) and update your Provincial Organization Readiness Assessment (p-ORA) when changes occur and at least every two years.

Prior to applying for the Alberta  CII / CPAR Grant, your practice must have a privacy impact assessment that reflects the current clinic environment.

Maturing Practice

You have learned and grown since your original Privacy Impact Assessment submission. Have you implemented everything that you said that you would? Can you demonstrate that your teams have received privacy and security awareness training? Have you reviewed your Health Information Management Privacy and Security policies and procedures in the last two years?

Keeping up to date without any other significant changes to your practice may not trigger a Privacy Impact Assessment amendment. Make sure that you document your careful review so that you are prepared for your next Privacy Impact Assessment submission.

Important Business Decisions

Creating and reviewing your PIA regularly can help you to spot errors or gaps between the way that you do the work in the clinic and the way that you said that you were going to implement in your clinic.

The questions that we ask during the PIA process are important. The time that you take now to identify the potential risks and prevent those incidents from happening may save you time, money, reputation and even jail time in the future.


3 Options to Help you Create your Privacy Impact Assessment

DIY – Do It Yourself – The Privacy Impact Assessment course, Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments – A Complete Step-by-Step Course, Includes PIA templates, training sessions live and the replays, and access to me to ask your questions and receive feedback to help you get un-stuck.

DFY – Done For You – I prepare your Health Information Management Privacy and Security Manual policies and procedures and your Privacy Impact Assessment. You receive both paper and electronic copies of all the documents.

DWY – Done With You – a hybrid solution, you register for the on-line course and do the information gathering and preparation of your Privacy Impact Assessment submission with coaching from me in the course. I will also assist you to prepare the customized privacy and security policies and procedures, and resources as needed at an hourly consulting rate.

Find out more here: Privacy Impact Assessments or send me an email.

Build a Strong Privacy Management Program for Your Clinic with These 5 Critical Modules

Build a Strong Privacy Management Program for Your Clinic with These 5 Critical Modules

Build a Strong Privacy Management Program for Your Clinic With These 5 Critical Modules

Many privacy officers in small healthcare practices have other roles—as a clinic manager, healthcare provider, computer network technician, or business owner. It is little wonder that new privacy officers can feel overwhelmed when trying to balance these responsibilities every day.

But that’s not the end of the problem. It actually gets worse!

You could continue to –

😮 Panic when a patient asks for their information for access or correction.

😔 Scramble when new employees and healthcare providers join your clinic . . .and suddenly realize that you never got around to providing privacy and cybersecurity awareness training.

😯 Hope that your practice will not be tapped on the shoulder for a practice review by your college or the OIPC.

🤐 Ignore privacy breach and hope no one else notices.

😒 Avoid difficult decisions with your owners / staff who insist on doing things their way – even when it is not privacy compliant.

😞 Never get ‘review privacy impact assessment’ and ‘review privacy policies and procedures’ off of your to-do list.

😥 Avoid discussing privacy and security with your EMR and computer networks managed service providers because you are unsure of what questions to ask and what types of answers you should receive.

If you don’t have a written privacy management program and action plan, you are missing the systems to monitor routine tasks that will protect privacy and alert you to potential problems before they become privacy and security incidents.

Carrying out the duties of a Privacy Officer correctly is vital to ensure your organization is safe from the consequences of a big privacy breach.

But did you know that those organizations who have a privacy officer and a privacy management program are:

  • Less likely to have a privacy or security incident
  • Increased staff satisfaction
  • Increased patient satisfaction and outcomes

We Know That Privacy Is Good For Business

​We know that having policies, procedures, and systems in place will improve your privacy compliance in your organization and help you make good business decision.

When we have consistent practices in place, it improves communication and prevents a multitude of problems.

I’d like to share with you what I believe are the 5 critical modules of a privacy management program

The 5 Modules of a Strong Privacy Management Program for Your Clinic includes

  1. Know Your Obligations
  2. Train
  3. Privacy Breach Management
  4. Document
  5. Access and Disclosure

We expect organizations which collect, use, or disclose health information to have key components of a privacy accountability program. These include:

Every healthcare and private organization that is subject to privacy laws must comply with them. A comprehensive privacy management program provides an effective way for organizations to create a culture of privacy in their practice, practice accountability for the collection, use, disclosure, and access of personal information, and show compliance with regulations.

Module 1—Know your Obligations

​Key accountability for your privacy management program starts with your healthcare provider(s). These are also known as “custodians”. They are ultimately responsible for the privacy, confidentiality and security of personal health information (PHI).

The key healthcare provider—physician, dentist, chiropractor, nurse—can assign or delegate a key person who is accountable to the custodian to implement and monitor a privacy management program. This is often known as a privacy officer. In many smaller healthcare practices, the clinic manager or practice manager is also the privacy officer.

The business owner (who might also be the healthcare provider) also has obligations to follow the privacy laws as it relates to the privacy of personal information of employee, customers, and general business information.

The healthcare provider, business owner, and privacy officer form a ‘trifecta’ of authority and responsibility in your practice to ensure that you comply with privacy legislation, professional standards of practice, and contractual commitments.

Knowing your obligations includes clear authority and accountability in your practice, inventory of identifying information that you have in your practice, and understanding how privacy legislation guides your business. Your privacy officer and custodians may require training in these areas to better understand their obligations.

Module 2—Training for Privacy Awareness

​Training is an important component of your privacy management program. The privacy officer in your organization ensures that privacy awareness, cybersecurity, and privacy breach management are provided in your healthcare practice.

There should be both a formal and an informal training plan. A pre-planned privacy awareness training must be available for everyone in your organization, including new and seasoned professionals. It is critical that you can provide and document that everyone in your organization completed consistent common training.

We can provide informal training throughout the year. For example, have a standing agenda item during your staff meeting to do something consistently for everyone in the organization throughout the year. Leverage activities like Data Privacy Day, Change Your Password Month, Cybersecurity Awareness Week to provide a variety of content.

frequently missed trigger for additional training happens when an employee is promoted to a new position. This is a great opportunity for the privacy officer to meet with the employee and discuss their new role and how their responsibility, for example, of authorizing new users or supervising employees contributes to the confidentiality and security of PHI.

Remember to document who attended the training opportunities and keep copies of the training content to show your actions to protect privacy.

Listen to the podcast How To Keep Privacy Awareness Top Of Mind | Episode #093 for more tips and resources to help you plan training throughout the year.

Module 3 – Effective Privacy Breach Management

​Ensure that a written privacy breach management procedure is part of your overall privacy management program. The privacy officer will document your privacy breach management policies and procedures, sanctions policies and procedures, and train all employees to identify a privacy breach and report it to their supervisor. The privacy officer will manage a (suspected) privacy breach and ensure notification to their custodians, individuals affected by the breach, and others as needed.

The privacy officer will manage mandatory privacy breach notification requirements under the health privacy legislation like the Alberta Health Information Act (HIA), Ontario Personal Health and Information Protection Act (PHIPA) and the Personal Information Protection of Electronic Documents Act (PIPEDA) and other province’s legislation.

See Understanding a Privacy Breach for more tips.

Module 4—Documentation: The Backbone of Privacy Compliance

​I think most people in healthcare are familiar with the adage, “If it is not documented, it didn’t happen.” This applies to your privacy management program, too. Your program should include written:

  • Health Information Privacy and Security Policies, Procedures
  • Risk Assessment – Safeguards
  • Practical Privacy Review
  • Privacy Impact Assessment
  • Information Management Agreement
  • Information Sharing Agreement
  • Successor Custodian
  • Training plan

These actions will help you protect the PHI of your patients and your business. They help to demonstrate your compliance with your privacy and security obligations. Review and update these key documents annually.

See Privacy Impact Assessment for more tips.

Module 5 – Access and Disclosure: Ensuring Patient Rights

​When you collect PHI from patients and PI from employees and customers, you must ensure that they can access, correct, and authorize disclosure of their information.

Release of information (ROI) policies and procedures is a critical module of your privacy management program. Your privacy officer is tasked with ensuring that your ROI plan is written, understood, includes specific training to your employees, and follows legislated standards and professional college standards of practice. When you meet your ROI obligations, you avoid complaints and breaches, work efficiently, and improve the trust of your patients.

Struggling to Learn Your Role As A Privacy Officer On Your Own?

If you are a privacy officer in a healthcare practice who needs practical privacy management strategies to protect your patients and your healthcare business but aren’t sure how to get started, register for the Practical Privacy Officer Strategies training here.

The training starts on April 11, 2024.

Not sure if this is for you?

Send me an email and ask me! I’m happy to mentor you and help you assess your practice management and privacy compliance priorities.

Listen to the replay of my recent LinkedIn Live Event here.

Do You Want To Be A Confident Healthcare Privacy Officer?

Do You Want To Be A Confident Healthcare Privacy Officer?


Understanding the Role: What Is a Privacy Officer?

privacy officer is a key employee in a healthcare organization who is named by the healthcare provider (custodian) and assigned the responsibility to oversee all activities related to the implementation of, and adherence to, the organization’s privacy practices, and to ensure operational procedures are in compliance with relevant privacy laws. The Privacy Officer monitors employees and systems about how information is collected, used, and disclosed and access to identifying information.

A privacy officer may be known by other titles like privacy compliance officer or a security officer.

If your healthcare business involves the collection, use, and disclosure of your clients’ and patients’ personal health information, a privacy officer is necessary in order to meet legislated requirements.

Consequences of Operating Without a Privacy Officer

Healthcare practices without a privacy officer often experience confusion about how patients’ personal health information should be collected, used, and disclosed. Patients may complain about lack of access to their personal health information. Without a named privacy officer to assume the responsibility to implement and monitor reasonable administrative, technical, and physical safeguards you are more likely to experience privacy and security incidents, privacy breaches, investigations, fines, and charges under the privacy legislation!

Case Studies: Real-world Implications of Privacy Officer Absence

In 2019, the British Columbia Office of the Information and Privacy Commissioner (OIPC) conducted a privacy audit of 22 medical clinics. OIPC auditors examined 22 clinics and found gaps in privacy management programs at several clinics, including the absence of a designated privacy officer, a lack of funding and resources for privacy and a failure to ensure that privacy practices keep up with technological advances.

Here’s another example. A complaint was made against a medical clinic with an employee suspected of accessing health information for an unauthorized purpose. The Alberta OIPC investigated and revealed confusion around the roles and responsibilities of privacy compliance among the custodians and the privacy officer. The OIPC determined that the custodian was in contravention of the regulation which requires custodians to ensure that their affiliates are aware of and adhere to the all of the custodian’s administrative, technical, and physical safeguards with respect to health information. 

Say No to Snooping: The Need for Privacy Enforcement

Employees are not aware of privacy requirements and engage in snooping into personal health information. Consequences of employee snooping include firing, charges under the Health Information Act and court ordered fines, jail time, probation, community service and more. 

say not so snooping animation of thief taking papers from folder

Roles and Responsibilities of a Healthcare Privacy Officer

So, what does a privacy officer do? The roles and responsibilities of a privacy officer in a typical healthcare practices include the following:

  • Identify privacy compliance issues for the business.
  • Ensure privacy and security policies and procedures are developed and keep them up to date.
  • Ensure that everyone working at your clinic and your vendors are aware of their privacy obligations.
  • Monitor your clinic’s ongoing compliance with privacy legislation like the Health Information Act (HIA) in Alberta.
  • Provide advice and interpretation of related legislation for the business.
  • Respond to requests for access and corrections to personal information.
  • Ensure the security and protection of personal information in the custody or control of the business.
  • Act as the primary point of privacy and access contact for staff, patients, vendors, regulators and other stakeholders.

Get the FREE Practice Management Success Tip, Privacy Officer Job Description Template.


Do You Need to Build a Privacy Awareness Training Plan in Your Healthcare Practice?

Do You Need to Build a Privacy Awareness Training Plan in Your Healthcare Practice?

One of the most frequent questions that I receive is “Jean, how often do we need to do privacy awareness training?”

Structured training should be available at least annually.  Just-in-time training and informal reminders can keep privacy top of mind year-round.

In the fast-paced world of healthcare, safeguarding patient privacy isn’t just a legal obligation—it’s a fundamental aspect of quality care delivery. However, ensuring that every staff member understands their role in maintaining confidentiality can be a complex challenge. This is where a robust privacy awareness training program comes into play.

When you have a written practical privacy awareness training plan, you will save clinic managers’ time, manage the risk of employee compliance, and motivate employees to become informed privacy advocates for your patients.

Not Just for New Employees

Privacy awareness training is more than a checklist when new employees are hired.

From receptionists to physicians, every member of a healthcare practice plays a pivotal role in protecting patient information. Contrary to common belief, privacy awareness training isn’t a onetime event; it’s an ongoing necessity. By conducting regular training sessions, staff members are kept up to date on regulations and best practices, which helps to prevent compliance breaches.

As an employer and health care provider, you are responsible for providing regular training to all your employees about privacy awareness.

The Vital Role of the Privacy Officer

The privacy officer spearheads the planning, implementation, and monitoring of privacy training initiatives. Their active involvement is crucial in protecting the organization from legal and reputational risks, through facilitating sessions and ensuring policy compliance.

Mitigating Risks and Ensuring Compliance

Without adequate training, healthcare providers face increased risks of privacy breaches. Ignorance of policies and procedures is not an excuse in the eyes of the law. Organizations that neglect privacy awareness training not only jeopardize patient trust but also expose themselves to severe penalties.

Protect Your Organization and Your Patients

Equip your staff with the information they need to confidently and correctly handle personal health information. Healthcare businesses who want employee and supervisor level privacy awareness training to support key policies, procedures and risk management programs need a privacy awareness training program.

Crafting Your Comprehensive Training Plan

Crafting an effective privacy awareness training plan need not be overwhelming. That’s why we’re excited to offer a **60-minute free webinar** designed specifically for clinic managers and privacy officers. In this webinar, you’ll learn how to design and implement a year-round training plan tailored to your practice’s needs.

Webinar Highlights

  • Practical strategies for developing a comprehensive training plan
  • Real-life scenarios and best practices for mitigating privacy risks
  • Tips for managing staff members who may struggle to grasp privacy concepts
  • Resources to kick-start your training initiatives immediately


Don’t miss this opportunity to elevate privacy standards within your healthcare practice. Register now for our **free 60-minute webinar** and equip your team with the knowledge and skills to safeguard patient confidentiality effectively.

When you invest in training, medical clinics show their commitment to protecting patient privacy and upholding the highest standards of professionalism. Join us for our upcoming webinar and take the first step towards fostering a culture of privacy excellence in your practice.


Build a Privacy Awareness Training Plan for Your Healthcare Practice

Oops, you missed the live training event.

But don’t worry! This replay is available as a ‘Webinar on Demand’ in your Practice Management Success membership.

Not a member, yet?

What are you waiting for?

Click here to start your membership today and watch this training webinar right away!


This Webinar Includes

  • Live on-line training
  • Q&A with Jean Eaton, Your Practical Privacy Coach when you join the webinar live
  • Access to the replay for a limited time
  • Learning Resources Guide
  • Training Plan Template
privacy awareness training plan image
Data Privacy Day 2024 Events and Resources For You!

Data Privacy Day 2024 Events and Resources For You!

Data Privacy Day 2024 Events and Resources for You!

Data Privacy Day is an internationally recognized day dedicated to creating awareness about the importance of privacy and protecting personal information.

That means a lot to me and I think it means a lot to you, too. I think it is important that we give our patients and clients the gift of privacy. And that we have the right tools and resources for our employees to make good privacy and security decisions in our businesses.

Information Managers Ltd. is a Data Privacy Champion!

Data Privacy Week Champion badge 2024
As a DPD Champion, Information Managers recognizes and supports the principle that organizations, businesses, and government all share the responsibility to be conscientious stewards of data by respecting privacy, safeguarding data, and enabling trust.
Each of us is responsible to manage our name and our identity. When you share your personal information, you have the right and responsibility to ask the person or business why they need the information and how they will protect your personal information.
Jean L. Eaton

Your Practical Privacy Coach, Information Managers Ltd.

Data Privacy Day Pop-Up Privacy Chats on

LinkedIn Live

Friday, January 26, 2024



Data Privacy Day 2024 Champion bdge

🔒 Join Us for Privacy Chat Pop-Up on LinkedIn Live Event! 🔒

In celebration of Data Privacy Day, we invite you to an engaging and insightful Privacy Chat Pop-Up on LinkedIn Live. Mark your calendars for Friday, January 26, 2024, as we bring together experts to share valuable insights and practical tips for safeguarding personal information and enhancing privacy practices in your small business.

🗣 Event Highlights:

Friday, January 26, 2024 0900-1600

Pop in for 15 minute segments throughout the day!

Add your comments and join the conversation!

Free to attend!

🎙 Live on LinkedIn:

Visit our Information Managers business page on LinkedIn to catch the privacy chats live or enjoy replays at your convenience!


👥 Guest Speakers:


💡 Agenda:

  • Privacy vs Confidentiality
  • Cross Border Data Transfers
  • Know Your Data
  • Website Privacy Statements
  • Emerging Privacy Legislation
  • Tips to Select Your Canadian Practice Management Software
  • Privacy Tips for Parents
  • 6 Steps To Small Business Privacy Compliance
  • Plan Privacy Awareness Education for Your Team


🤝 Why Attend?

  • Gain practical privacy tips for immediate implementation
  • Equip your business with the right tools for privacy and security decisions
  • Elevate awareness about the importance of data privacy in your professional community


Data privacy is not just a buzzword; it’s a commitment to ensuring the security of personal information. Together, let’s empower ourselves, our clients, and our employees to make informed decisions in the realm of privacy.


🔗 Event Link:

Sign into your LinkedIn account

Navigate to Information Managers Ltd page

Select the Pop-Up Chat to Join us Live!

📅 Save the Date and Let’s Chat Privacy!


#DataPrivacyWeek #PrivacyChat #SmallBusinessPrivacy #DataPrivacyDay #LinkedInLiveEvent #Healthcare #medical #dental #therapists

Data Privacy Day Resources

5 Steps To Prevent Employee Snooping


If an individual affiliate knowingly breaches the privacy and security of health information, and the custodian can demonstrate that reasonable safeguards (including privacy awareness training) were in place, the individual affiliate can be charged under the Health Information Act. Fines of up to $50,000 may be applied to the individual, in addition to other sanctions from their employers and/or their professional regulatory colleges where applicable (HIA s.107).

What Is Snooping?

Looking at someone’s personal information without having an authorized purpose to access that information to do your job is known as ‘snooping’.

Even when you are “just looking” at personal information but don’t share that information with anyone else, this is still a privacy breach.

It is illegal.

Snooping incidents are on the rise and can cost you time, money, heartache, and headache in your practice.

When there is an offence under the privacy legislation like the Health Information Act, there may be an investigation, charges and court appearances, fines, penalties, and loss of employment.

Snooping is entirely preventable.

How Can You Prevent Employee Snooping?

Let’s take a look at the pro-active steps that you can take today to prevent employee snooping.


prevent employee snooping

Download the Practice Management Success Tip 5 Steps to Prevent Employee Snooping

The Practice Management Success Tip, 5 Steps to Prevent Employee Snooping, will help you

  • Take 5 practical steps to prevent employee snooping.
  • Provide clarity about what is considered a privacy breach.
  • Contribute to the health information privacy compliance in your healthcare practice.

Protect Your Organization and Your Patients With a Privacy Awareness Quiz

Equip your staff with the information they need to confidently and correctly handle personal health information.

Healthcare businesses need privacy awareness training to support key policies and procedures, and risk management programs need a privacy awareness training program.

Reasonable Safeguards

As an employer and healthcare provider, you are responsible to provide training to all of your employees about privacy awareness.

If you don’t provide the training, or if the employees don’t understand the policies and there is a privacy breach, then the healthcare provider is more likely to be held accountable under the legislation and face penalties, including fines and even prison!

Patients value the privacy and security of their information.

Healthcare providers and clinic managers value privacy and security, and they value not having adverse results as a lack of compliance or patient safety issues.

Data Privacy Day Privacy Awareness Quiz

Patients trust their healthcare providers with their sensitive, personal, and financial information.

If patients don’t feel that the healthcare provider will keep their information confidential and secure, patients may choose not to share their information, which may impact their healthcare and treatment.

When we are privacy aware, we can better respond to patients’ questions and build their trust in the quality of services that we provide.

Download the Privacy Awareness Quiz to use today to train your employees and protect your patients’ health information.

Online Legal Essentials Review

Online Legal Essentials Review

Online Legal Essentials Helps Canadian Entrepreneurs move from Overwhelm to Legal Easy!

Do you have a small business in Canada?

Then you need customizable templates to help you set up your business, operate your bricks and mortar local business or your online business!

Corrine Boudreau of Online Legal Essentials can help you!

Corinne has developed guided legal templates for Canadians doing business online.

Corinne has a knack for making things practical and easy to implement.  Being a lawyer since 2002 has given her perspective and experience to boil things down to the essentials.

You know that I love templates – and tips, tools, and training to make it easy!

Corinne delivers this for you!


Online legal essentials review
Online Legal Essentials Library Canadian Templates

Not Sure What Legal Documents You Need for Your Business?

Many healthcare providers are excited to open their first independent practice but have many questions about how to build a legal foundation for their practice.

The Ultimate Business Checklist will help you

  • Build a legal foundation for your healthcare business
  • Portray a professional appearance to your patients and clients
  • Guide you to make good decisions in the right order without missing steps

Grab the FREE Checklist from Online Legal Essentials


Ultimate Business Checklist

Do You Have a Website for Your Healthcare Practice?

Well then, you are required by law to have a Privacy Policy on it.

Online Legal Essentials is here to help you with a simple, easy to complete Privacy Policy (with Canadian PIPEDA and EU GDPR provisions).

You will also find in this program the following templates to protect your business online:

– Copyright Notices

– Website Legal Disclaimers

– Website Terms of Use

Videos and easy-to-use templates will have these tasks checked off your to-do list in no time!

Check out the Website Legal Essentials templates!

Roadmap for Healthcare Providers

Corinne Boudreau and I believe in the power of education and templates to help healthcare providers start profitable businesses in Canada.

When you register for this free on-demand webinar, you get access to the Roadmap guide and the Roadmap Timeline google sheet to help you with your project management for your business.

Make sure to check out the legal templates from Corinne–ideal to help you prepare the Canada specific legal documents for your new business. 

Are You Hiring Employees?

Make sure your contract terms are clear when you are hiring people for your business. 

The Legal Hiring Template Pack provides the necessary information and contract templates to help you start your new hires on the right foot.  

So Much MORE!

Corinne Boudreau has created so many more Canadian legal templates to help you in your business. 

Check out these titles, too!

Online Legal Essentials Templates

Lady in business suit Jean Eaton

“When we know better, we can we do better.”

I help healthcare practices with practical tips, tools, templates and training to help you in your career and help you to start, grow, or fix the business of a healthcare practice.

Affiliate Compensation: From time to time, I promote, endorse, or suggest products or services of others. In most cases, I will be compensated – either as an affiliate with a commission based on sales, or with a free product to review or use. My recommendations are always based on (i) my personal belief in the high quality and value of the product or service, and (ii) my review of the product or service, or a prior relationship or positive experience with the sponsoring person or organization.

Jean L. Eaton, Your Practical Privacy Coach with Information Managers Ltd.

Small Business Tech Day

Small Business Tech Day

Click on the >> Arrow above and watch the short (5 min) video to watch my 6 steps to help you right away!

The Privacy Playbook: 6 Steps to Small Business Privacy Compliance

I’m Jean L. Eaton, your Practical Privacy Coach and Practice Management Mentor. I help healthcare providers and clinic managers implement privacy best practices, like pulling together the right forms and paperwork to use with their employees and patients and implementing privacy best practices.

Whether it’s improving privacy workflow, understanding the impact of breaches, working with privacy legislation, privacy impact assessments, or mentoring privacy practices among staff, I make privacy in healthcare simple and straightforward.

I have found that when small business use these 6 steps to small business privacy compliance:

  • your privacy management program operates smoothly every month
  • you avoid nasty privacy and security incidents
  • your business operates more efficiently

When you focus on proper privacy and security practices, compliance falls into place.

Information Managers Is Proud to be an Official Partner of the Small Business Tech Day.

To access more replays recorded on November 16, 2023, 

Register here! It’s FREE!


How To Use Current Technology To Maximize Productivity And Profits In Your Business While Staying Protected And Secure

Small businesses must be nimble to prevent cybersecurity crime and continue to boost profitability and productivity. Technology automation and AI can help–when you implement wisely.

We can help you with that!

This Free Online Event Features Speakers Shark Tank’s Robert Herjavec, Co-Founder Of Siri Adam Cheyer And Best-Selling Author And Entrepreneur Extraordinaire Mike Michalowicz.

Solid Technology Solutions has been named as the official host of Edmonton Small Business Tech Day happening on November 16th.

This online event is designed to help small businesses navigate the future of technology, especially with the recent emergence of AI.

We’ll ensure you are equipped with the best advice from these world-renowned experts when it comes to changes in your day-to-day business.

Featuring well-known business leaders, tech experts and leading minds showing small businesses how to compete and succeed in many aspects of their business with a concentration on utilizing technology to be productive, profitable, and protected.

Learn how to maximize productivity, profits, and security in your business!

Discover cutting-edge technologies in these presentations that can streamline your business operations, saving you time and increasing overall efficiency.

“A Shark’s-Eye View Of The Future Of Small Business Tech” with Robert Herjavec

Shark Tank Celebrity Robert Herjavec will discuss the distinct differences between businesses losing money and those that are becoming more profitable and growing.

“New Business Protections You Need In Place NOW To Safeguard Your Assets” with Grant Dakin

Roughly 61% of all SMBs were the target of at least one cyber-attack in the past few years, which can equal hundreds of thousands of dollars in lost revenue. It’s no longer a question of IF you’ll get hacked, but WHEN. Millions of organizations are being held hostage by cybercriminals and hackers. During this session, you’ll get actionable steps to take to proactively protect your business from lost profits and irreparable reputational damage.

“The Good, The Bad, And The Ugly Of AI In Small Business” with Adam Cheyer

Your business needs to be prepared for current programs and technology and what’s on track to possibly disrupt it further.

“How To Get Your Business To Run On Its Own” with Mike Michalowicz

You can have the freedom to take a vacation or some well-deserved time off.

“The Privacy Playbook: 6 Steps to Small Business Privacy Compliance” with Jean L. Eaton

When you focus on proper privacy and security practices, compliance falls into place. Grab my 6 steps to help you right away.

Solid Technology Solutions is Your Proud Host

Solid Technology Solutions helps small businesses equip themselves with the best technology and practices available today to increase productivity and profitability and protect them against online threats.

Get your no-cost invitation!

Information Managers Is Proud to be an Official Partner of the Small Business Tech Day

Information Managers Partner image

No matter what happens with the economy, there are strategies you can use to keep growing profitably while keeping your business secure.

Today you can get these strategies when you join us at

Think Like a Hacker: Safeguarding Your Business in the Digital Age

Think Like a Hacker: Safeguarding Your Business in the Digital Age

I’m tickled pink to be a member of the discussion panel at

‘Think Like a Hacker: Safeguarding Your Business in the Digital Age’

Cyber Crime is Climbing in Healthcare

The rise of cybercrime in healthcare is alarming.

“The Healthcare vertical is highly targeted by ransomware gangs, which results in both the loss of use of their systems—potentially with life-threatening consequences—as well as data breaches.” 

Verizon 2023 Data Breach Investigations Report (DBIR)

Accurate Networks and Armour Insurance Help You To Prevent Cyber Crime

‘Think Like a Hacker: Safeguarding Your Business in the Digital Age’ event is sponsored by Accurate Network Services and Armour Insurance.

Cybercrime, hacking, and privacy breaches are the biggest risks facing any organization today. Regardless of your size or industry—you are a target.

Think Like a Hacker to Protect Your Practice

Constable Jon Cook, an RCMP Cybercrimes Investigator, will share his experience from the front lines of this new frontier of cybercrime. Find out how hackers use social engineering and other common hacking methods that threaten your practice. Use these examples to identify potential weak spots and risk in your healthcare practice.

Safeguard Personal Health Information and Your Business

Join us for an interactive Q&A session with industry experts in Medical, Privacy, Insurance, IT, and Law Enforcement. We will answer your questions and offer you practical advice on how to protect against cyber risks.

I’ll be there to discuss privacy compliance and safeguards that you can take to prevent hackers in your medical or dental practice.

Stay and mingle with other attendees while enjoying complimentary appetizers and drinks at the historic Bell in Scona.

Don’t wait until it’s too late!

Join me at ‘Think Like a Hacker: Safeguarding Your Business in the Digital Age’ on Sept 27, 2023, in Edmonton.

Let’s tackle cyber threats in healthcare together!

#CyberSecurity #Healthcare

Get your no-cost invitation!

5 Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

5 Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

Strategies for Writing Engaging Social Media Posts for your Practice with Guest Expert Kayla Das

Are you a new clinic owner and wondering if social media marketing is for you?

Maybe you have been dabbling into social media marketing but now you are feeling overwhelmed?

Or, maybe you have an established social media presence but you want to learn new ways to get social media engagement.

In this Episode #109 of the Practice Management Nuggets Podcast For Your Healthcare Practice, guest expert Kayla Das of Evaspare Inc. provides 5 strategies for writing engaging social media posts for your practice!

Why Is Using Social Media Important?

​Kayla Das believes that the purpose of social media marketing is to inspire, entertain and to give more than you try to sell.

People are on social media because they want to be taken away temporarily from their day so they are much more likely to click on things that inspire, entertain or provide them some type of guidance and support.

After they gain trust with what you have to say you’ll be the first person they think of when they need professional support.

Interview Right to Hire Right Nelson Scott #1 Tip
Interview Right to Hire Right Nelson Scott #1 Tip

Kayla’s #1 Tip

​“My number #1 tip for clinic managers about social media marketing is when you are starting out is to start small. Choose only one or two social media platforms. You do not need to be on every social media platform to get engagement. Start with a social media platform that you are familiar with and that you believe that your ideal client uses.” – Kayla Das

Listen To The Podcast

5 Strategies for Writing Engaging Social Media Posts for your Practice | Episode #109

Listen to the Practice Management Nuggets for Your Healthcare Practice podcast. Get practical practice management, and privacy tips to help you start, grow, and improve your healthcare practice. If you are a clinic manager, team lead, healthcare provider or practice owner, these practical tips will save you time and money.

I help you manage the pink elephant in the room.

Listen here: Practice Management Nuggets Podcast

social media engagement for healthcare providers Kayla Das contact
engaging social media templates Kayla Das

Featured Guest: Kayla Das, Evaspare Inc.

Kayla Das is a Social Worker and Business Coach for therapists and coaches. Kayla works with therapists to:

  • create a strong private practice foundation based on values;
  • develop marketing strategies that are authentic and generate profits; and
  • establish business systems and processes that are designed for practice sustainability.

Would you like more social media and business strategy tips from Kayla?

Pop over to the podcast show notes here to listen to the podcast!

Be sure to grab Kayla’s gift to help you create engaging social media images.

You may also be interested in:

Social media is about creating a strong digital presence and building relationships – with your clients, with employees and new recruits, and with other colleagues and allies in your field.

If you decide to use social media in your business, you need clear rules about who will authorize messages. You also need a strong social media policy to provide direction and education to your employees about what they can – and can’t – say on-line.

Social Media Practice Management Success Tip – Social media policies, procedures templates to help ensure a professional and privacy compliant presence online while also positively representing and supporting your business brand.

social media management practice management success tip