Development of a Customized First Nations Privacy & Security Toolkit

1. Development of a Customized First Nations Privacy & Security Toolkit Margie Kennedy, Lily Menominee Batise, Nicolette Kaszor May 28, 2013

2. Presenter Disclosure • Presenters • Margie Kennedy • Lily Menominee Batise • Nicolette Kaszor • No Conflict of Interest

3. Objectives • Highlight the unique privacy needs and challenges of First Nations • Highlight the development of a Privacy and Security plan for the First Nation Panorama Deployment in Ontario (FNPDiO) Project • Identify community needs that informed development • Provide an overview of the Privacy & Security Toolkit • Identify priorities and anticipated uses of the Toolkit • Share the partner model adopted to ensure broad partner engagement and development

4. FNPDiO Evolution • Governance: Tri-partite partnership • Chiefs of Ontario, First Nations and Inuit Health Branch, and the Ontario Ministry of Health and Long Term Care • Mandate to deploy Panorama to all First Nations in Ontario who wish to do so • Started in 2007 • Technical and Policy Direction • Knowledge Management Advisory Group (KMAG) • Various Working groups • Privacy, Data Management, Change Management, Information Management/ Information Technology, Communications

5. Project Guidance

6. Privacy Innovation • Broad perspective on First Nation privacy as an enabler for eHealth initiatives • First customized development of a privacy plan and associated resources informed by First Nation needs and priorities

7. Privacy and Security Priorities at the Community Level • Overall plan • Meet current needs (Panorama deployment) • Support capacity development in First Nations • Be scalable for future eHealth developments • Principles • Easy to understand & use • Ready for immediate use by First Nations with varying human resources • Deliverables • Video • Toolkit • Engagement • Leverage knowledge of First Nation Initial Subscribers for subsequent deployment & use • Privacy Sub-Group to lead development

8. Unique Privacy Needs of First Nations • Small communities – resource constraints, etc. • Not every community has extensive health personnel to engage in projects • Balancing the PHI protection vs the value of community support where “in a small community, everybody knows your business” • First Nation/band administration professional development • General principles and execution of health information privacy • Provincial legislation (PHIPA) • OCAPTMprinciples need to be embedded in any solution related to First Nation information • Ownership, Control, Access, and Possession • Consistent protection of PHI in health care settings and in the communities

9. Privacy Challenges among First Nations • Non-standard privacy procedures • Each First Nation is independent and may have own internal practices, laws, and/or policies • Reconciling varying privacy requirements • Variable community-based privacy infrastructure • Many First Nations have limited privacy infrastructure to support health delivery • Resources • Resources who have experience and can take on the responsibility for privacy leadership and accountability (e.g. privacy officers) • Political/governance factors • Understanding of privacy obligations by Health Information Custodian (HIC)

10. FNPDiO Privacy Video • Developed in collaboration with FNPDiO PrivacyWorking Group, and representatives from the Initial Subscribers and the FNPDiO Elder Advisor • Focus on the value and priority of privacy related to health information from a First Nations perspective • URL for Privacy Video • http://www.youtube.com/watch?v=Uu-iBSj7ypg&feature=youtu.be

11. From the Community Perspective…

12. FNPDiO Privacy & Security Toolkit • Purpose • Comprehensive resource to assess current state and gaps • Provide tools that will cover the gaps • Components • Two Assessments • Privacy • Security • Tools • Templates for immediate use • Fact Sheets • Frequently Asked Questions (FAQs) • Glossary, PHIPA Obligations, additional resources • Methodology • Conduct assessments to identify gaps • Use tools • Review gaps

13. Privacy Assessment

14. Toolkit Resources PRIVACY • Privacy Policy • Responsibilities of Privacy Contact • Staff FAQs • Confidentiality Agreement • Privacy Notice • Client FAQs • Staff Guide for Consent • Consent templates • Immunization • General • PHI Inventory Tool • De-identifying PHI • Record of Assessment: Determination of Capacity to Consent • Request for for PHI SECURITY • Security Policy • Business Continuity Management Plan • Access to Network Services Request Form • Acceptable Use Policy • IT Asset Management Inventory • Mobile Devices Security Fact Sheet • Faxing PHI Fact Sheet • Privacy & Security Incident Response Plan • P&S Breach Investigation Report • Notice of Breach – Letter to Clients

15. FNPDiO Toolkit Use Outcomes • Communities reviewed existing policies and resources • Within Health facilities/portfolio • Across operations • Tools in the Toolkit were used to: • Generate completely new policy structures • Fill gaps • Supplement existing policies • Identify Privacy Resources to comply with PHIPA • Privacy Officer • Privacy Notice

16. Next Steps • Updates based on experience with pilot use • Future versions of the FNPDiO Privacy & Security Toolkit • For use with Secondary Subscribers • Share Initial Subscriber Privacy Policies • with other First Nations • general distribution/availability to others interested or potentially benefitting from this work after September 2013

17. Acknowledgements The presenters acknowledge the contributions of the members of the Knowledge Management Advisory Group (KMAG), our First Nation Elder Advisor Barney Batise, and the Privacy Sub-Committee in the development of this plan and Toolkit • Pam Nolan (Co-Chair) • Ida Cornelius (Co-Chair) • Krista Yao • Cheri Corbiere and community reviewers • Nipissing First Nation • Mohawks of Akwesasne • Garden River First Nation

18. For more information on the P&S Toolkit: • Chiefs of Ontario • Lily Menominee-Batise(menominee@personainternet.com) • 705-465-0060

19. MeegwetchNia:wen Thank you Questions & Discussion