This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Is Jane PIPA compliant?
Yes, Jane is compliant with British Columbia's Personal Information Protection Act (PIPA).
Does PIPA apply to my clinic?
Private-sector businesses in BC, including allied health clinics and solo practitioners, must handle personal information in accordance with PIPA. PIPA is deemed "substantially similar" to Canada's federal privacy law, PIPEDA, so in most cases PIPA is the legislation that will apply to your clinic.
If you're unsure whether PIPA applies to your organization, contact your regulatory body for guidance.
What are my responsibilities under PIPA?
Develop procedures and appoint a Privacy Officer
Designate one person in your clinic as the Privacy Officer, and make their name and professional contact information publicly available. This person is responsible for compliance with PIPA and for responding to any inquiries about your clinic's collection, use, and disclosure of personal information.
To meet obligations respecting authorized use of personal information, your clinic must remain in control of personal information at all times, including when it's stored by a third-party service provider. Make sure any contracts with service providers confirm that your clinic retains control of the data.
Obtain consent before collecting information
In almost all cases, you must have an individual's consent before you collect, use, or disclose their personal information. To obtain valid consent:
- Identify and document a reasonable purpose for collecting the information. The information must be integral to providing your service, not merely convenient.
- Notify the individual of that purpose before collection.
- Obtain one of the following types of consent:
- Express consent: the individual actively agrees, with full knowledge of the purpose.
- Deemed consent: the individual volunteers information for a clearly reasonable purpose without explicit agreement.
- Opt-out consent: the individual is given a clear opportunity to decline (such as an unchecked checkbox) and does not do so. The purpose must still be clearly explained.
PIPA does allow collection without consent in limited circumstances, for example, when a patient is unable to give consent and a medical professional must act in their interest.
Collect only what you need
Limit the personal information you collect to only what is directly required to provide your service. Document your purposes for collection before you begin, and be as specific as possible.
Limit the use of personal information
Use personal information only for the purposes for which it was collected. "Using" personal information can mean viewing, interpreting, or otherwise working with it internally. It does not include sharing it externally.
Limit disclosure and notify when required
Disclosing personal information means sharing it with an outside individual or organization. Under PIPA, disclosing personal information generally requires the individual's consent, but you may disclose personal information without consent in some cases, such as:
- To assist an investigation of an offence under Canadian or provincial law
- To respond to an emergency that threatens health, safety, or life
- To contact next of kin for a deceased or ill individual
Respond to patient requests for their information
Patients have the right to request access, and your clinic must respond to requests within 30 business days. Legal representatives of minors may also make requests.
When you respond, you must tell the patient:
- Whether your clinic holds their personal information
- Whether you will provide full or partial access
- When and how access will be provided
There are certain circumstances in which you can refuse to share access. If you refuse access, you must explain why, provide the name of the person in your clinic who can answer questions about the refusal, and inform the patient that they can request a review by the Office of the Information and Privacy Commissioner (OIPC).
Keep personal information accurate and correct it when needed
Your clinic is responsible for ensuring that the personal information it holds is accurate and complete. Patients can request corrections to their information, and you must make them when warranted.
Protect personal information with appropriate safeguards
Use physical, administrative, and technical safeguards to protect the personal information your clinic holds. Patient records in a medical practice are expected to be held to a high standard of security.
Examples of safeguards:
- Physical: Lock file cabinets for paper records, restrict employee access to records areas, shred printed records rather than disposing of them in the trash, and position computer monitors to prevent unauthorized viewing.
- Administrative: Train staff on privacy obligations, require staff to sign confidentiality agreements, create individual staff accounts with role-based access, and use privacy cover sheets when faxing records.
- Technical: Use password-protected screensavers set to activate automatically, enforce strong passwords, run anti-virus software on Windows devices, keep all devices updated with the latest patches, encrypt devices and USB drives, wipe devices before discarding them, and never write down credit card information in plain text.
PIPA also has special rules for collecting, using, and disclosing personal information in business transactions (such as buying or selling a business), as well as for your organization's practices respecting employee personal information. These rules are not necessarily related to patient data, and this guide does not cover them, but they're important to be aware of.
How does Jane enable my compliance with PIPA?
Jane includes a number of technical features to help BC clinics meet PIPA safeguard requirements.
- Signed, locked, and timestamped charts: to support integrity of clinical records.
- Access controls: the Account Owner determines which staff members can access which information in Jane.
- Individual user accounts: all Jane users can log in individually, and all activity in Jane is tied to their account. Passwords can be easily reset at any time.
- Behaviour tracking: actions taken by a logged-in user are recorded, and clinic owners can audit this through the Activity Log.
- Secure data storage: personal information is stored in secure and compliant data centres, with regular backups performed on secondary servers.
- Flexible charting: to help meet regulatory documentation requirements.
- Intentional deletion: Jane restricts the ability to delete patient records for which health information has been added.
- Controlled disclosure: sharing of personal information is managed at the patient level.
- Intake Forms: customizable electronic forms for alerting patients of their privacy rights and collecting consent.
- Keyboard shortcut to blur patient names: for added privacy in busy clinic settings.
- Real-time data saving: information is saved as it's entered in Jane.
- Privacy commitments from Jane: see Jane's Privacy Policy and Terms of Use.
Have questions about this guide or anything else related to privacy? Email Privacy and Security Support at [email protected].