Information Managers
  • Home
  • Services
    • All Services
  • Templates
  • Blog
  • Contact Us
  • Practice Management Success
  • Podcasts

Why Would a Dentist Want Access to the Alberta Netcare Portal?

Posted on April 27, 2021 by Meghan in Blog

Why Would A Dentist Want Access To The Alberta Netcare Portal?

As a dentist or dental hygienist, if you have concerns about a patient’s health history, you may want to have access to the Alberta Netcare Portal to view the patient's history of health concerns and current medications.

Alberta Netcare provides personal health information that is available through a province-wide electronic record system under the authority of the Health Information Act (HIA).

Whether a dentist uses paper records, electronic dental records (EDR), or electronic medical records (EMR), using the Alberta Netcare Portal will help dentists monitor their patient’s interactions with other parts of the health care system.

What is the Alberta Netcare Portal?

Alberta Netcare Portal is the secure vehicle through which patient health information from a variety of health care providers is shared and accessed electronically, by independent and hospital-based health service providers like dentists, physicians, nurses and pharmacists. The Alberta Netcare Portal is a data collection centre for registries and systems such as laboratories, diagnostic imaging facilities, hospitals and some specialized clinics. Alberta Health and Wellness is the Netcare information manager.

Dentist Access Alberta Netcare

Dentists and Dental Hygienists Are Custodians

Dentists were designated in 2010 as authorized custodians under the Health information Act (HIA). Dentists can now request access to Alberta Netcare by showing that they meet the Netcare requirements.

Dentists who manage patients with complex medical conditions or for the provision of treatment requiring sedation or general anaesthesia may require additional information about the patients’ health history. Dentists can use Alberta Netcare Portal to view medication profiles, laboratory data and tests results.

Ensuring reasonable safeguards to protect the privacy and security of personal health information of your patients and residents of Alberta is critical! We want everyone who has access to these health data repositories to follow the same best privacy and security practices. The HIA has regulated requirements for all custodians to follow.

Dentist Access Netcare

Everyone needs to follow the rules to play in the sandbox!

How To Get Started

Before you are granted access to Alberta Netcare Portal, you must complete the following steps.

Dentist Access Alberta Netcare

Step 1: Create or update your Health Information Management Privacy and Security Policies and Procedures including the rules governing the access, collection, use, of health information from Alberta Netcare.

Step 2: Complete a Privacy Impact Assessment (PIA) and submit this to the Office of the Information and Privacy Commissioner for review. For more information on how to complete a PIA, click here.

Step 3: Train your team on privacy awareness. I recommend the Privacy Awareness in Health Care Training — Dental Practices.

Step 4: Contact the eHealth Netcare Support Services Team.

Step 5: Complete a Provincial Organizational Readiness Assessment (pORA). See What is a pORA.

Step 6: Sign an Informational Manager Agreement (IMA) and Review Informational Exchange Protocol (IEP) with Alberta Netcare

For more tips on implementing reasonable privacy and security safeguards for your dental practice, see https://informationmanagers.ca/privacy-impact-assessment-pia/.

You can also watch the FAQ video on this topic by clicking the button below!

Watch the FAQ Video HERE!

You May Also Be Interested In:

What is a pORA?

New Health Information Policy and Procedure Manuals

Do You Need An Expedited Netcare Privacy Impact Assessment?

Who Is Doing the Recalls In Your Dental Practice?

Privacy Awareness in Healthcare Training: Dental Practices

Privacy Impact Assessment – Consultation Options Available!

Jean Eaton

When we know better, we can do better…

Jean Eaton is constructively obsessive about privacy, confidentiality, and security especially when it comes to the handling of personal health information. If you would like to discuss how I can help your practice, just send me an email. I am here to help you.

Jean L. Eaton
Your Practical Privacy Coach
INFORMATION MANAGERS

Alberta Netcare, ANP, dental hygienist, dentist, healthcare, PIA, PIA Consultant, privacy, Privacy Impact Assessment

Add Custodians To Your PIA

Posted on December 28, 2020 by Meghan in Blog

Add Custodians To Your PIA

Congratulations! You have expanded your practice and recruited a new healthcare provider to your team. Now you also need to add a custodian your PIA.

To do this, you need to orientate the provider to your practice including the policies and procedures to protect the privacy, confidentiality, and security of the personal health information and inform the Office of the Information and Privacy Commissioner (OIPC).

When the new healthcare provider is a member of a regulated health profession as defined by the health privacy legislation in Alberta, the Health Information Act (HIA), the provider also has responsibilities as a custodian.

HIA Definitions:

Custodian

A health service provider; specifically, a member of the following regulated health professions: Optometrists, Opticians, Chiropractors, Midwives, Podiatrists, Denturists, Dentists and dental hygienists, Registered nurses, Pharmacists, and Physicians (and others).

Affiliate

An employee of a custodian or as designated by the custodian, for example medical office assistant, receptionist.

The incoming custodian must ensure that the reasonable safeguards to project the administrative, technical, and physical safeguards of the personal health information are implemented in the practice. This includes ensuring that they have reviewed the current privacy impact assessment (PIA).

The lead custodian also has an obligation under the Alberta Health Information Act (HIA) to inform the Office of the Information and Privacy Commissioner (OIPC) when there are changes to the organization management of the clinic.

 

How To Add Custodians To Your PIA

In Alberta, the lead custodian in a clinic must update their PIA regularly and inform the OIPC when there are significant changes to their PIA.

One common trigger for informing the OIPC  is the addition of a custodian to the practice. Often, this PIA amendment can be as simple as a letter to the OIPC.

  1. The lead custodian or privacy officer will prepare an amendment to the previously submitted Privacy Impact Assessment when new custodians join the practice. Often a letter to the OIPC signed by the lead custodian is sufficient.
  2. The PIA amendment must include how the custodian has been made aware of the current PIA and how they are meeting their requirements to enter into an agreement with information managers as defined in the Health Information Act section 66.
  3. The lead custodian will submit the PIA amendment to the OIPC for acceptance.
  4. The new custodian must acknowledge that they have been informed of the Health Information Privacy and Security Policies and Procedures and the submitted PIA and agree to follow these practices. The new custodian will sign the letter to the OIPC and attach it to the PIA amendment from the lead custodian (in step #1 above) to the OIPC for acceptance.

 

Routine Onboarding Of New Employees

Before the new custodian is granted access to patient health information, your computer network, and your electronic medical record (EMR), you need to ensure that new custodians are aware of your Health Information Privacy and Security Policies and Procedures, PIAs, and information manager agreements, including the information management agreements with Alberta Netcare Portal, patient records management, EMR vendor, billing vendor, and/or others.

You should have a written policy and procedure ‘When a New Physician / Custodian Joins Your Practice’ to guide you when onboarding new custodians. The procedure should include the forms below and template letters to the OIPC. These templates are also available to members of Practice Management Success.

Add custodians to your PIA
Do You Need Help With Your PIA?

Did you enjoy this article? If you’d like to look at similar posts, visit these links:

Top 3 Agreements Your Healthcare Practice MUST Have (and why)

What Is a PIA?

How Do You Declare as an Affiliate?

Podcast – Close, Move, Merge Your Practice | Episode #090

Alberta, amendment, custodian, dental, Health Information Act, medical clinic, OIPC, PIA, Privacy Impact Assessment

Do You Need An Expedited Netcare Privacy Impact Assessment?

Posted on November 6, 2020 by Meghan in Blog

What Is An Expedited Netcare Privacy Impact Assessment (PIA)?

A privacy impact assessment is a requirement of the Health Information Act (HIA) in Alberta. Alberta Netcare Portal (ANP) is a data repository of health information of Alberta residents. Many healthcare providers request access to the ANP to quickly access lab test results, text reports, and health insurance information to assist them to provide continuing care and treatment to their patients.

We know that privacy and security of health information is critical to the continued accuracy and completeness of health information for all patients. Alberta Health is the custodian of the ANP data repository. To ensure that everyone with access to the ANP also has accepted reasonable standards to protect the privacy, confidentiality, and security of health information, Alberta Health requires each healthcare provider to demonstrate that they have met these reasonable standards before being granted access to the ANP.

Community based healthcare providers who work in independent practices are also known as ‘custodians' as defined in the HIA. The custodians must submit a PIA to the Office of the Information and Privacy Commissioner (OIPC) for their review and acceptance. This PIA demonstrates the custodians' commitment to protect the privacy, confidentiality, and security of health information. Alberta Health and the OIPC have agreed to a streamlined process for healthcare providers and custodians to prepare, submit, and accept the ANP PIA so that healthcare providers can request access to the ANP.

We also know that technology and business practices change over time. It is a good business practice to review your PIA annually and update your risk assessment and mitigation strategies as needed. Updating your Health Information Privacy and Security Policies and Procedures and your PIA and submitting these to the OIPC is recommended best practice and a pre-requisite for continued access to the ANP.

Is It Time To Amend Your Privacy Impact Assessment?

Maybe you want to:

  • add a new digital health app or patient portal to make it easier for patients to book appointments with you, or
  • get access to Alberta Netcare Portal, or the CII or CPAR projects,
  • expedited Netcare Privacy Impact Assessment,
  • use the internet to get telehealth on-line consultations for your patients,
  • update your participating custodians and privacy officer, and
  • regular review to ensure that you are continuing to meet the requirements of the Health Information Act (HIA).

A PIA is a practical business tool in your healthcare practice.

A PIA is an important tool that you can use to help you with project management.

It will help you anticipate risks to the project before it starts and avoid serious problems, and wasted time and money.

The PIA process requires you to have written policies and procedures so that you can implement the project effectively and train your staff consistently.

Sometimes a PIA is a requirement of legislation. But it is always a best practice whenever you implement a project that includes personal health information.

I'd Like To Help You!

I’d like to help you with your Privacy Impact Assessment amendment. Click the button below for the next complimentary workshop!

Sign up for the complimentary workshop HERE!

If you are starting your new practice and need your first Privacy Impact Assessment, see our available consultation options here.

About Jean L. Eaton

Jean Eaton, BA Admin (Healthcare), CHIM, CC is the Practical Privacy Coach and Practice Management Mentor of Information Managers Ltd.

Jean is constructively obsessive about privacy, confidentiality, and security in healthcare.

She is an experienced leader in health information management. She has worked with multi-disciplinary health care service professionals in primary, acute, and tertiary care facilities across Canada.

Jean has successfully assisted primary care physicians, chiropractics, dentists, pharmacists, primary care networks, and other health care providers across Canada to develop privacy impact assessments (PIA) and office policies and procedures and training regarding the collection, use, and disclosure of health information.

You May Also Be Interested In:

 

“What is a Privacy Impact Assessment?”

Read the article and watch the short video now to take a look at what is a PIA, what will a PIA do for you, when you need a PIA, and what is the PIA process.

You can also listen to the Practice Management Nuggets podcast episode here.  

 

“How Long Does it Take to do a New Privacy Impact Assessment?”

Ideally, you should start the Privacy Impact Assessment process 3- 6 months prior to your go-live date. Find out more by reading the article.

Alberta, amendment, expedited Netcare, PIA, privacy consultant, Privacy Impact Assessment

Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments – A Complete Step-by-Step Course

Posted on October 28, 2020 by Jean Eaton in Services, Training

Do you need a Privacy Impact Assessment?

Or do you need to amend an existing PIA?

Privacy Impact Assessments are just one of the requirements you need in order to fulfill your obligations in Alberta’s Health Information Act (HIA) and other legislation and are an important aspect of developing privacy best practices in your office.

And a little help along the way is always a good thing.

Practical Privacy Coach, Jean  L. Eaton of Information Managers, is constructively obsessive about privacy, confidentiality, and security when it comes to the handling of personal and health information, particularly in primary health care settings. Jean has helped hundreds of healthcare providers, vendors, and health and social service delivery organizations and associations complete their Privacy Impact Assessment which have been successfully accepted by organizations' management and regulators. Jean has customized and delivered privacy training programs for privacy officers, records management professionals, implementation teams, and healthcare providers across Canada and the US.

Now you can have access to five modules to help you learn everything you need in order to complete your own PIA.

     

**** New PIA Amendment Track ****

Each module includes a video training, as well as templates, tools, resources and case studies to build on in each lesson. You can use this scenario to guide you through the PIA process in healthcare. If you work in healthcare or privacy or records management and need to do a PIA, this e-course is for you.

 

You need a Privacy Impact Assessment (PIA) when

  • You  are opening a new clinic or establishing a new health services program.
  • You are changing administrative procedures or technology equipment, services, or vendors
  • You are changing how you collect and use personal information,
  • You are implementing or changing an Electronic Medical Records (EMR)
  • You are sharing health information with another healthcare provider, organization, Primary Care Network or other health program.
  • You want to prevent a privacy breach,
  • You have a Privacy Impact Assessment that was written more than 2 years ago (It is time to review and update this!)

 

If you are a healthcare provider, practice manager, and you need your first Privacy Impact Assessment, this e-course is for you

Are you in a group or solo practice with direct patient care, for example:

  • Physician
  • Pharmacist
  • Registered nurse
  • Optometrist or optician
  • Chiropractor
  • Physiotherapist
  • Midwife
  • Podiatrist
  • Dentist, dental hygienist or denturist
  • Audiologist
  • Mental health practicitioner
  • Laboratory, x-ray, and imaging technician
  • Paramedic

A PIA should be as common place to a healthcare practice as a business plan is to a business. BUT most healthcare practices don’t know this and often don’t know that a PIA is  usually part of their professional college requirements and often even a legislated requirement! Prevent malicious errors, omissions or attacks that could result in fines and even jail time for the business, healthcare provider, employee, or vendor by completing a PIA.

If your Privacy Impact Assessment was written more than 2 years ago this online on-demand course is for you!

The Clinic Manager and Physician Lead and Privacy Officer  must ensure its content is updated to reflect the current state of administrative, physical and technical controls.

BONUS! Checklist to update your PIA to meet recent changes to Alberta's Netcare Portal. If your practice has completed a PIA and now you need to update the PIA, you receive a checklist of items that you need to consider to refresh your PIA.

 

If you a vendor that supports healthcare practices this e-course is for you!

BONUS! One hour tele-consult with Jean, “Create a branded Privacy Impact Assessment Readiness Package”. Jean will work individually with you to review your documentation and coach you on how to prepare the package to give to healthcare practices.

BONUS! Vendor PIA live webinar includes Vendor non-disclosure agreement, Information Manager Agreement, GAP Analysis, Computer Network Narrative templates.

 

Jean has helped hundreds of physicians, chiropractors, pharmacists, and other healthcare providers complete their Privacy Impact Assessment. She has visited hundreds of practices across Canada. But time and geography limit my ability to visit each healthcare practice that needs a PIA. That's why I developed this on-line interactive course to help you learn everything you need in order to review, amend, or create your own PIA. Each module includes a video training as well as templates, tools, resources and two common case studies to build on each week. You can use these scenarios to guide you through the PIA process.

You know your practice better than anybody else. If you had the right tools, at the time most convenient for you and a mentor to help you, you can develop good office practices, meet legislated and college requirements, and successfully complete your Privacy Impact Assessment requirements.

Using a Webinar on-line interactive program, you will get great content and mentoring from Jean Eaton and once a month during the Q&A live training webinars. Learn the PIA process with these modules.

The modules include:

Module 1:

PIA to Protect Your Practice, Your Assets, and Your Patients

 

Module 2:

Information Flows–-the Foundation of Your PIA

 

Module 3:

Risk Analysis and Mitigation Strategies

 

Module 4:

PIA Format - Pulling it All Together

 

Module 5:

Complete Your PIA Submission

BONUS Module 6:

Create a Branded Privacy Impact Assessment Readiness Package

The replays, tools, and resources will be available to you right away.

If you are new to this field, I suggest that you first register for Privacy Awareness in Healthcare: Essentials to master the key definitions and concepts.

Corridor_Privacy_Awareness_In_Healthcare_banner

Privacy Awareness in Healthcare: Essentials

 

Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments –

A Complete Step-by-Step Course

5 Core Modules, Templates, Training, and Tools to Get Your PIA Done!

Monthly Live Q&A Training Webinars

$450.00 (plus GST)

Purchase e-course

 

You will get

  • Learning Resource Guide for EACH module – how-to explanations, templates, and resource lists
  • Checklists to help you plan your PIA
  • MindMap of the entire PIA process
  • PIA project plan timeline templates
  • Checklists of  personal and health information privacy and security policies that you need in your practice
  • Many examples of projects in medical, dental, chiropractic and more practices including new PIA project and PIA amendments.
  • Explanation and real-life examples of key terms that you need to know and include in your PIA
  • Strategies and templates of risk management assessments that you can customize
  • This E-course might qualify for CPE credits, too!

 

BONUS!  Monthly live Q&A webinar training with Jean to help you get un-stuck with your PIA.

BONUS! Checklist to update your PIA to meet recent changes to Alberta's Netcare Portal.

BONUS! Private discussion group with other registered participants of this course to network and support each other on your PIA journey and continue to help you after this course closes.

BONUS! Regular updates of privacy resources and templates that you can use.

 

If you hired a consultant to do the work of the PIA process for you it may cost you as much as $3,000!

And then…when the consultant is done, they take their knowledge out the door with them.

Invest only $450 in this course and you'll have what you need to do your first PIA project today…and every project in the future!

Jean Introduction Ecourse PIA (1)

I had the pleasure of working alongside Jean to develop a PIA for my Dental Office. I could not have completed this document without her. She was there to help me every step of the way. Her online course made it easy to communicate with her as well as having so many resources to use that were so helpful. Each Module had videos to watch that explained step by step what needed to be done. The PIA document is a lot of information to put together and if it's not enough information on its own, you also need to develop a policy and procedures manual. Jean has developed an amazing resource for this manual that was very user friendly and made a 300 page manual a lot more attainable than creating it on your own. I highly recommend taking Jean's PIA course and having her help throughout the process!”

~~Lindsey Cave, Office Manager, Orion Dental Group

 

What people are saying about our PIA e-courses and in-person workshops:

Q: What did you learn from this workshop?

Participant's Responses:

  • Understanding of need / use of Information Management Agreement's and an ‘Evaluation” agreement.
  • Lots – when / how to make amendments.
  • Compliance / requirements of PIA and their purpose.
  • PIA information; agreements, updating.

 

Q: What do you feel was the biggest benefit to attending this workshop?

Participant's Responses:

  • Understanding a PIA.
  • Having a better understanding of PIA's and everything included in requirements.
  • Gain a better overview of my PIA and what I need to add; organizational strategy.
  • Clear vision of work to be done.

“When Jean told us about the Protest Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments E-course and explained how the course will help us better understand the Health Information Act, our responsibilities as healthcare providers and our relationship with our vendors and partners, I signed up right away! Thanks again – it is no doubt that we have hitched our wagon to a shining star.”
~~Bill Stowe, Business Manager Synergy Respiratory & Cardiac Care

“This was my first ever time I had to work on a PIA and I was a little nervous about doing it efficiently – but you really made it as simple and straight forward as possible. Thank you for being available for my questions when I had them. I would easily recommend Privacy Impact Assessments to Protect Your Practice course for anyone to do their own PIA's! Thank you so much!”
~~Karen Sarabura, Clinic Manager and Privacy Officer, CGA Medical Imaging, Alberta

“I attended the Privacy Impact Assessment Walk-through workshop (for ARMA members). Jean shared resources and on-going networking opportunities. The biggest benefit to me is to know that there is help out there in moving forward with our Privacy Impact Assessment responsibilities.”
~~Ellen Sauvé, Parkland County

Comments from other E-course participants:

“Learning about how all the information gathering systems interact was the most valuable part of this workshop”

“Excellent presenter – variety of learning opportunities.”

“Jean is an excellent speaker and I enjoyed the audio seminar you gave today and I learned a lot from your seminar.”
~~Annette T (AHIMA webinar, Three Mistakes in Managing a Privacy Breach”)

“Jean Eaton is one of those ‘critical suppliers' you keep in your email contacts list, no matter what company you manage. She really knows her stuff and delivers prompt, accurate information on time. Her courses are interesting, informative, and I like the opportunity to meet with classmates who have similar challenges.”
~~Kevin Morris, Shape MD, Team Leader/Office Manager

 

Buy e-course

In-Person Workshops Are Now Available 

Are you a hands-on kinda person?

Are you more likely to get things done when you schedule your time for a working meeting?

Would you like help to kick-start your PIA amendment and review with other like-minded clinic managers and privacy officers?

PIA Amendment Workshops are available. Send a request to me and let's set up a workshop near you! You also get full access to the on-line course to support you after the workshop.

 

 

Not sure if the E-course is for you?

Jean will answer your questions in the free webinar, 

 

Prevent Big Fines (or Worse!) for Your Healthcare Practice

How to Plan a Privacy Impact Assessment for Your Healthcare Practice

with Jean L. Eaton
Replay Recorded Live

This webinar is for Privacy Officers, Clinic Managers, Practice Managers and anyone else responsible for doing a PIA.

You will learn what is getting in your way of getting your PIA done!

In this free webinar, you will learn:

  • 5 Manageable Steps of every PIA
  • 3 Biggest Myths about PIA’s that is preventing you from completing your PIA
  • Questions Privacy Officers, Clinic Managers, Practice Managers and Healthcare providers should ask about PIA’s but don’t
  • Biggest fears about doing a PIA and how you can kick it to the curb so that you can finally get it done

Join us for the webinar so that you can plan your PIA for your healthcare practice!

Sign me up for this FREE webinar

Get Free Access Now Arrow

Please provide your email address below and you will be re-directed to the webinar replay right away.

Check your email in-box to confirm your registration!

 Along with your webinar registration, you will also benefit from the occasional Privacy Nugget tips by email of similar privacy resources and articles that you can use right away!

 

Alberta, amendment, breach, employee training, ePIA, ePrivacy, Health Information Act, healthcare, HIA, PIA, PIA process, Practical Privacy Coach, Privacy Impact Assessment, privacy officer training, templates

Merging Your Healthcare Practice – PIA Considerations

Posted on August 3, 2020 by Meghan in Blog

Merging Your Healthcare Practice – PIA Considerations

 

Mergers and acquisitions and closing and consolidating are activities that healthcare practices undertake at various times in the life cycle of a business.

There are many reasons why a practice may consider buying or acquiring an existing healthcare practice.

You might be expanding your practice to rapidly expand the scope of your services, location, or space. Or you might be downsizing your practice. Or maybe you're merging multiple practices into one streamlined practice so you can better manage your profit margins.

You might be looking to diversify your services or, perhaps, create an area of super-specialty that will provide a competitive advantage for your healthcare practice.

You might be wanting to acquire skilled employees or healthcare providers that you couldn't recruit in your current circumstances.

You might be acquiring or consolidating real estate infrastructure, medical equipment or electronic medical records, computer networking, or perhaps the management team. Or you might be exploring opportunities for economies of scale or cost-cutting.

As a custodian (including physicians, pharmacists, dentists, chiropractors, nurse practitioners, optometrists, and more) you need to ensure that the patient's health information remains private and secure, and that patients have continued access to their health information.

 

Thinking about merging your healthcare practice? Important privacy impact assessment steps for you to consider. #PIA #Privacy #ProtectYourPractice Click to Tweet

5 Important Steps Before You Merge Or Close Your Healthcare Practice To Ensure Your Continued Privacy Compliance

  1. Inventory All Your Existing Patient Records
  2. Patient Records Systems
  3. Agreements
  4. Existing Documents
  5. Privacy Impact Assessment Amendment Plan

 

Read the full article below!

Or listen to the podcast here

Inventory All Your Existing Patient Records

 

When you assume a new practice, you need to know where all the patient records are maintained. If you are closing your practice, you need to ensure the continued security and access of patient records to the patient.

To do this, you need to know which patient records are included in the practice. Create an inventory of the existing patient records.

Remember that you must meet the records retention period (which often is 10 years plus the age of majority) for all the patient records. Make sure that you are meeting the records retention periods and that you have correctly inventoried all of the patient records. This includes all locations and record types including paper, off-site storage, and records that have been backed up to an electronic drive or a separate memory device.

Include all types of patient records – including appointment records, appointment books or electronic scheduling software, billing records, paper records, diagnostic medical devices, electronic medical records and audit logs.

When you assume a new practice, you need to know where all the patient records are maintained.

Patient Records Systems

 

Make sure that you review all the existing patient record systems – electronic medical record, billing systems, records storage, etc. – and the associated termination clauses with the vendors. If you need to transfer the management of patient records between custodians or to a different system, you need to thoroughly explore the data migration and archiving options and the associated costs.

Remember, you must maintain the complete patient record – including the clinic notes, test results reporting, task management, internal messaging, and audit logs – for the entire retention period. Often, exporting a patient record to a PDF file format does not include the complete patient record. Instead, you may need to maintain a read-only version of the electronic medical record.

Agreements

 

Collect all the existing agreements between the custodians and the vendors and stakeholders with whom the custodian has authorized the collection, use, and disclosure of patients’ health information. This may include the EMR vendor, billing agent, custodians, Primary Care Network, and successor custodian agreements.

Existing Documents

 

Request a copy of the existing documents that support the business of managing the patient records, including the health information privacy and security policies and procedures and privacy impact assessments. This will help you to respond to inquiries about previous patient records management practices and assist you in preparing your next privacy impact assessment.

Privacy Impact Assessment Plan

 

Consider the history of the current practices and plan your new operations plan. Complete a risk assessment to ensure the appropriate reasonable safeguards of previous, current, and future patient health information. Then, complete a Privacy Impact Assessment and update the Health Information Management Privacy and Security Policies and Procedures. In Alberta, the Health Information Act (HIA) requires the custodian(s) to submit the Privacy Impact Assessment to the Office of the Information and Privacy Commissioner (OIPC) for review prior to implementing new practices.

 

If you want to know more about Privacy Impact Assessments with step by step instruction, training, and mentoring, register for the on-line training, Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments. 

Related Resources

Watch these Practice Management Nuggets For Your Healthcare Practice Videos:

  •  When You Close Your Healthcare Practice on YouTube
  • What to Consider Before Sub-Leasing on YouTube

Download:

  • Top 3 Agreements Your Healthcare Practice MUST Have (and Why)
healthcare practice, merging healthcare practice, PIA, privacy, Privacy Impact Assessment, protect your practice

Here’s a Common Telehealth Workflow Process

Posted on April 22, 2020 by Meghan in Blog

With so many changes to daily lives and schedules due to COVD-19, healthcare practices are also changing. I think that these experiences have probably advanced telehealth, virtual care, and digital health initiatives ten years in the space of six weeks.

If you have been experiencing a whiplash headache from the speed of the changes to your practice management, you are not alone!

I am committed to help you with policy, procedure, and privacy impact assessment templates and resources to support you as you implement remote working and virtual care for your patients.

Use these policy and procedure and privacy impact assessment templates to help you provide virtual care while remote working and maintain reasonable safeguards to protect the privacy and security of personal health information.

If you are moving into remote working and virtual care or telehealth, it’s important that you have anticipated the risk to privacy, confidentiality, and security of patient information and have planned appropriate safeguards to prevent harm.

Patients don’t always know to ask questions about the risks of using new virtual care technology. Custodians and clinicians have a responsibility under the Health Information Act to inform patients about any additional risks to their privacy and health information while using technology in new ways. You could include this in your workflow when the patient appointment is made and the receptionist provides this information. Immediately prior to the on-line consultation, the clinician may review the collection consent and respond to questions from the patient before beginning the clinical encounter.

You might also have a legal requirement in Alberta to submit a privacy impact assessment to the Office of the Information and Privacy Commissioner.

If your healthcare practice is implementing remote working or virtual care, you need to notify the OIPC.

Health information is sensitive information. Reasonable efforts must be made to ensure that identifying and sensitive information is protected from unauthorized access, loss, or damage during and outside work hours. What a custodian may consider is reasonable efforts during a pandemic may be different than reasonable efforts from normal circumstances.

In Alberta, section 64 of the Health Information Act (HIA) requires custodians to prepare a privacy impact assessment (PIA) and submit it to the Office of the Information and Privacy Commissioner (OIPC) of Alberta prior to implementing a new administrative or technical process in a healthcare practice.

During the pandemic, the OIPC of Alberta requests an email now to outline your implementation plan. Then, promise to follow-up with a Privacy Impact Assessment submission in a few weeks.

Remote Working and Virtual Care  Policy, Procedure, and PIA Templates

Templates are a time-saving tool for anyone looking to move into remote working, telehealth or virtual care solutions. Your on-line course includes instant access to checklists and resources to help you select the best virtual care options.

The policies and procedures templates will help every clinician thinking of authorizing some (or all) of your staff to remote work from home and / or provide virtual care while ensuring the privacy and security of health information.

The templates are delivered to you inside the on-line course management platform called Ruzuku. The instructions and the templates are delivered in 6 lessons. The instructions in each lesson will take you less than 5 minutes each to read.

Then, you download the templates from Ruzuku to your computer and modify each template with your clinic-specific information. Editing the MS Word templates will take you about 3 hours. I can’t estimate the amount of time that you will require to read the templates, gather information and making decisions about your remote working and virtual care project.

As you build your policies and procedures and the supporting documents, you will copy and paste them into the key sections of your PIA.

 

Virtual Care Workflow

There are many ways to implement virtual care or telehealth in your practice. A common workflow process includes:

Schedule the Patient Appointment – Reception

Schedule the patient appointment in the EMR.

Telephone or send a secure email to the patient with the

  • Appointment confirmation and instructions on how to use the video conference solution;
  • Collection notice; and
  • Privacy Officer contact information.

Request the patient to sign or verbally consent to the use electronic communication.

Time of Appointment – MOA

Receptionist / MOA initiates the video conference call with the patient.

Ensure patient can connect and hear the audio / see the video or shared screen.

Verify the patient identity.

Invite the clinician to join the video conference / make host of the call.

Notice of Collection / Consent – Clinician

Introduce yourself.

Review the Notice of Collection and Consent and respond to any questions.

Confirm that the patient is in an appropriately private location.

Document Patient Encounter – Clinician

Confirm the patient’s understanding of the assessment and plan.

Arrange to send any prescriptions to pharmacies and any requisitions or referrals to the patient or the appropriate office/facility.

Complete the clinic note in the patient record.

Is Remote Working and Virtual Care Here To Stay?

Many practices are finding benefits to having flexibility to allow staff to work from home to accommodate illness, child care disruptions,  and business continuity planning. Many patients are finding that they appreciate the convenience of accessing health services without parking, time off of work, or child care struggles. Sometimes, both clinicians and patients are discovering that this new modality has inspired a better understanding of the patient's home environment and creates opportunities to improve care and treatment.

I don't think we can put this genie back in the bottle. Remote working and virtual care will become a new normal – for some practices – at least on a part-time basis. Consequently, I recommend that you take the time needed now to get the procedures and safeguards right so that we protect the privacy, confidentiality, and security of health information, allow our clinicians to work to their full scope of practice, and provide the appropriate care and treatment in a way that is convenient for all parties.

I'm here to help you.

Take advantage of this offer to access the templates that will help you implement remote working and virtual care solutions in your practice.

Yes, I Want the Policy, Procedure and PIA Templates!

Not sure if remote working is right for your healthcare practice?

Check out the The Practice Management Success Tip, Remote Worker Privacy and Security Checklist, which will help you:

  • Determine if remote working is appropriate for your employees.
  • Identify what clinic / business resources need to be provided to the employee remote worker.
  • What reasonable safeguards need to be implemented to protect the privacy, confidentiality, and security of personal (health) information.

Did you enjoy this article? If you’d like to look at similar posts, visit these links:

What Should I Do If I Think I Have COVID-19?

Do You Know Where Your Policies and Procedures Are? 

Is Remote Working a Good Choice for Your Healthcare Practice?

Notice of Collection for Telemedicine and Virtual Health

 

healthcare, medical, pandemic, physician, PIA, rehab, remote working, risk assessment, telehealth, virtual care, virtual healthcare, workflow

Do You Need a PIA for Remote Working or Virtual Care?

Posted on March 31, 2020 by Meghan in Blog

If your healthcare practice is implementing remote working or virtual healthcare, you need to notify the OIPC.

Health information is sensitive information. Reasonable efforts must be made to ensure that identifying and sensitive information is protected from unauthorized access, loss, or damage during and outside work hours. What a custodian may consider is reasonable efforts during a pandemic may be different than reasonable efforts from normal circumstances.

In Alberta, section 64 of the Health Information Act (HIA) requires custodians to prepare a privacy impact assessment (PIA) and submit it to the Office of the Information and Privacy Commissioner (OIPC) of Alberta prior to implementing a new administrative or technical process in a healthcare practice.

The OIPC in Alberta requests in its notice of March 19, 2020, that custodians notify the Commissioner about new administrative practices or information systems.

How Do I Notify The OIPC?

Step 1: If you have implemented, or plan to soon implement remote working, virtual care or other administrative or technical changes in response to the COVID-19 pandemic, send an email to the OIPC to inform them, in general terms, about your plans.

Step 2: As soon as possible, submit a project specific Privacy Impact Assessment to the OIPC.

To help you get started with Step 1, I have prepared a sample email that you can use.

Yes, send me the Sample Email to the OIPC!

Not sure if remote working is right for your healthcare practice?

Check out the The Practice Management Success Tip, Remote Worker Privacy and Security Checklist, will help you:

  • Determine if remote working is appropriate for your employees.
  • Identify what clinic / business resources need to be provided to the employee remote worker.
  • What reasonable safeguards need to be implemented to protect the privacy, confidentiality, and security of personal (health) information.

Did you enjoy this article? If you’d like to look at similar posts, visit these links:

What Should I Do If I Think I Have COVID-19?

Do You Know Where Your Policies and Procedures Are? 

Is Remote Working a Good Choice for Your Healthcare Practice?

Notice of Collection for Telemedicine and Virtual Health

 

healthcare, medical, OIPC, pandemic, physician, PIA, remote working, risk assessment, virtual healthcare, work from home

When Do You Need a PIA Amendment?

Posted on July 23, 2019 by Jean Eaton in Blog

A Privacy Impact Assessment Is Good For Business

A privacy impact assessment (PIA) is part of a regular business process if you collect, use, or disclose personal health information in your healthcare practice. When you have a previous PIA that has been prepared, submitted to the Office of the Information and Privacy Commissioner (OIPC) and it has been accepted for use–well, that is not the end of your PIA journey.

You need to ensure that you are updating and amending your PIA as your practice matures and as you make administrative and technical changes to the procedures in your practice.

You need a PIA Amendment when you have a previously accepted PIA and any one of these common triggers below.

You Have a PIA That Was Written More Than 2 Years Ago

It is time to review and update this!

Under Section 8(3) of Alberta’s Health Information Regulation, custodians must periodically review the safeguards they have in place to protect health information privacy. This means that custodians need to regularly review the privacy risk mitigation plans set out in PIAs to ensure they continue to protect against reasonably foreseeable risks to the privacy of health information. The submission of your PIA to the Office of the Information and Privacy Commissioner (OIPC) is mandatory and must precede implementation of your new system or practice.

Change in Health Information Act (HIA) Legislation and Regulations

The HIA has undergone significant amendments in 2006, 2010, most recently in August 2018. Make sure that you have updated your privacy breach management program and include mandatory privacy breach notification to the (OIPC) and the Minister of Health (MOH). Again, ensure that your team training has been updated so that they know how to spot, stop, and report a privacy breach. (See Mandatory Privacy Breach Notification)

Changes In Your Electronic Medical Record or Computer Network

You have the same EMR database, but maybe the configuration has changed. For example, a change from a local to an application service provider (ASP) or cloud-based data centre or Software as a Service (SAS) model would trigger a PIA amendment.

Another trigger is a change in your computer network vendor or changes in wireless networking, remote access, or implementing mobile devices.

PIA amendment EMR computer network

Change in Participating Physicians / Privacy Officer

Since your original PIA, you may have new custodians, including physicians, registered nurses, chiropractors, and other health professionals named in the HIA that have joined or left your practice. Your Privacy Officer may have changed, too. Your amendment should include an up-to-date listing of custodians and privacy officers.

New Users / Information Sharing

There have been many recent information sharing initiatives in healthcare. You might now plan to participate in evaluation projects, patient panel management, or other community initiatives. Make sure that you have your PIA amendment and information manager agreements completed, too. (See – The Top 3 Agreements Your Healthcare Practice MUST Have (and Why).

A quick word of caution: if your new information sharing project includes data matching–the creation of new information by combining two or more sets of data—requires custodians to prepare a privacy impact assessment before performing data matching involving health information (HIA sections 70, 71). The custodian that carries out the data matching is responsible for preparing the Privacy Impact Assessment.

PIA amendment new users

Communicating With Patients

If you are adding new technology to keep in touch with patients for appointment reminders, on-line appointment booking, secure email or patient portals, these will trigger a PIA amendment or, perhaps, a project specific PIA. Make sure that your policies and procedures are up to date, too. (See – Can You Use Text Message With Your Patients? )

PIA Amendment Communicating with patients

Alberta Netcare Portal (ANP) / Community Integration Initiative (CII) / CPAR

ANP updated their PIA in 2016 and, therefore, you need to make sure that your corresponding policies and procedures and training have been updated, too. Remember – when you agreed to participate in ANP, you promised that you would review your threat risk analysis (TRA) and update your Provincial Organization Readiness Assessment (p-ORA) when changes occur and at least every two years.

If you want to participate in new initiatives like CII and CPAR, you need to review and update both your PIA and your p-ORA, too.

Maturing Practice

You have learned and grown since your original Privacy Impact Assessment submission. Have you implemented everything that you said that you would? Can you demonstrate that your teams have received privacy and security awareness training? Have you reviewed your Health Information Management Privacy and Security policies and procedures in the last two years?

Keeping up to date without any other significant changes to your practice may not trigger a Privacy Impact Assessment amendment. Make sure that you document your careful review so that you are prepared for your next Privacy Impact Assessment submission.

Important Business Decisions

Creating and reviewing your PIA regularly can help you to spot errors or gaps between the way that you do the work in the clinic and the way that you said that you were going to implement in your clinic.

The questions that we ask during the PIA process are important. The time that you take now to identify the potential risks and prevent those incidents from happening may save you time, money, reputation and even jail time in the future.

You Know Your Practice Better Than Anyone Else

When you have a coach to guide you through the PIA amendment process, provide you with templates, and give you feedback on your work in regular live training webinars, join me in the on-line step-by-step course, Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments.

Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments

Find out more here: Protect Your Practice, Your Assets, and Your Patients with Privacy Impact Assessments or send me an email.

Practice Management Nuggets Podcast

This topic is included in our Practice Management Nuggets podcast! Be sure to tune in to the podcast episode

When Do You Need a PIA Amendment? | Episode #078

Listen to the Podcast
#PrivacyImpactAssessment, #ProtectYourPractice, Alberta, clinic, health care, Health Information Act, healthcare, HIA, how to do a pia, medical, Netcare, PIA, Privacy Impact Assessment, privacy impact assessment amendment, training

What is a PIA?

Posted on March 11, 2019 by Jean Eaton in Blog

Have you ever been in a situation where you had a great idea that you wanted to implement and then someone asked you if have a PIA for that?

     
Enter your name and email below to watch the entire video right away! [mc4wp_form id="50026"] By entering your email address above, you are requesting about upcoming training and related resources. You can opt out at any time, and we'll never rent or sell your email address.

Click on the >> arrow above to play the video.

Maybe you wanted to add a new digital health app to make it easier for patients to book appointments with you, or get access to Alberta Netcare Portal, use the internet to get on-line consultations for your patients, or start using a new EMR.

Or maybe you have a new healthcare practice and you are excited about choosing the right location, the right equipment, the right vendors that fit your budget and your goals.

A PIA is a practical business tool in your healthcare practice.

A PIA is an important tool that you can use to help you with that project management.

It will help you anticipate risks to the project before it starts and avoid serious problems, wasted time and money.

The PIA process requires you to have written policies and procedures so that you can implement the project effectively and train your staff consistently. Sometimes a PIA is a requirement of legislation. But it is always a best practice whenever you implement a project that includes personal health information.

Watch the video now to take a look at what is a PIA, what will a PIA do for you, and when you need a PIA. Just click on the image above to play the video.

Would you like more information about Privacy Impact Assessments for your healthcare practice?

By entering your email address above, you are requesting about upcoming training and related resources. You can opt out at any time, and we'll never rent or sell your email address.

health care, Health Information Act, healthcare, HIA, Netcare, PIA, privacy, Privacy Impact Assessment, What is a PIA?, what is a privacy impact assessment

Does a Dentist Need a PIA?

Posted on May 22, 2018 by Jean Eaton in Blog
Have you ever said…

“If only I had someone to ask!”

Each month, we discuss your questions about practice management, human resources issues, clinic management best practices, procedures, resources, practical privacy tips, and more in Practice Management Success membership.

 

In this Q&A, we're talking about: Does a Dentist Need a PIA?

If you are a member of Practice Management Success, login and join me now on the webinar. The replay will be available in your membership area.

I’ve had a dental practice for 10 years. Do I need a PIA?

 

In Alberta, the Health Information Act (HIA) was proclaimed in 2001.

Dentists and dental hygienists were named as a designated health professional under the HIA in March 2011.

A custodian as defined by the HIA is defined

1) as a member of a Regulated Health Profession

2) the Health Profession is named in the HIA as a custodian

3) the individual is acting as a custodian

There is a ‘grandfathering’ period when custodians who were already in practice at the time are not required to submit a privacy impact assessment (PIA). The dental practice, of course, must meet all of their dental college requirements including appropriate privacy and security policies, procedures, and reasonable safeguards to protect the privacy, confidentiality, and security of personal health information.

If  (when) you have had any changes to your practice, you need to complete a PIA. For example, since 2011, have you had any changes to:

  • administrative practice, for example, changes to billing practices, third party contractors, moving to a new location, etc.
  • information system, for example, computer network changes, remote backup, or practice management or EMR software
  • practices relating to the collection, use, disclosure of personal (health) information
  • new or changes to your current information flow (for example new projects, stakeholders, Netcare)
  • legislation (i.e. research)
  • any new risks to the privacy of health information
  • custodians, for example custodians (including dentists and dental hygienists) leaving or joining your practice

The PIA is a process that assists custodians to review the impact that an implementation of a new administrative practice, information system, or change to existing practices or systems relating to the collection, use and disclosure of individually identifying health information, may have on individual privacy.

A PIA describes the information flows in the project, identifies the legal authorities that allow for the flow of information, assesses potential impacts on and risks to privacy and identifies mitigation strategies to minimize the risks.

The process is designed to ensure that the custodian evaluates the new practice or proposed change to ensure technical compliance with the HIA as well as assessing the broader privacy implications for individuals.

Often, the Privacy Officer of the dental practice completes the Privacy Impact Assessment.  However, the custodian or CEO is responsible for the Privacy Impact Assessment.

Privacy principles and legal authority determine compliance obligations.

If you don't have a PIA already for your dental practice, and you were in practice prior to 2011, you probably will need a PIA soon. If you opened your practice after 2011, or are just planning your practice now, you need a PIA.

For more information about PIA's, pop over to our resource page here:

Tell me more about PIA's

Want more content like this?

Get Your Practice Management Success membership
dental, dental hygienist, dentist, healthcare, PIA, Privacy Impact Assessment
12

Search the site

What is the elephant in the room?

The Elephant in the Room Find out here...

Privacy Policy

"The 15 Day Privacy Challenge has given me some great resource information and helped me to identify the areas that I need to work on. I found value in almost all of the Privacy Challenges, but I would say Risk Assessment, Social Media, Email Phishing and Spam, and Confidentiality are the top four."

- Sharon

Register for Free On-line Privacy Breach Awareness Training!

Privacy Policy

Copyright 2022 Information Managers Ltd.

Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage vendors Read more about these purposes
View preferences
{title} {title} {title}