Information Security and Privacy Policy IM-002 May 2018
Total Page：16
File Type：pdf, Size：1020Kb
Information Security and Privacy Policy IM-002 May 2018 1. Purpose: Patient Ombudsman will be collecting Sensitive Information that includes personal information (PI) and personal health information (PHI) in order to carry out its business functions described in the Excellent Care for All Act, 2010, S.O. 2010, c. 14 (ECFAA). This document sets out Patient Ombudsman’s policies regarding the management of information security and privacy protection. Information security refers to methodologies that protect information from unauthorized access, use, disclosure, disruption or destruction regardless of how the information is formatted or whether it is being processed or stored. Included in this document is the protection of privacy, managing security-related risks and limiting potential breach of privacy. The security of information and the protection of privacy is critical to the success of Patient Ombudsman to provide effective customer service and maintain public trust. Patient Ombudsman shall act as a responsible conservator of information assets entrusted to its care and shall promote a culture of information security and privacy. Loss of confidentiality, integrity, or availability of information and possible breach could adversely affect the achievement of Patient Ombudsman’s mandate and ability to store Sensitive Information. 2. Scope: This policy applies to all Employees of Patient Ombudsman. 3. Definitions: Business Owner: means any program director or equivalent having authority and accountability under legislation or policy for particular business activities and related business records. Employee: means a person employed by, or on contract with the Ontario Health Quality Council to work exclusively for Patient Ombudsman, and a person employed by or on contract to the Ontario Health Quality Council, operating as Health Quality Ontario, and assigned to provide Information Technology support to Patient Ombudsman. This includes the person appointed to be the Patient Ombudsman by the Lieutenant Governor in Council. Information Security & Privacy Classification (ISPC): means a system used to define sensitivity levels of information. The ISPC assigns classifications and communicates the need for safeguards and security measures according to the sensitivity level. 1 | Page Information Security and Privacy Policy Patient Ombudsman ONE Mail: means an encrypted email system supplied by eHealth Ontario to health care organizations. Personal Health Information (PHI): means personal health information as defined in the Personal Health Information Protection Act, 2004 (PHIPA). Personal Information (PI): means personal information as defined in the Freedom of Information and Protection of Privacy Act (FIPPA). In this Policy, PI includes PHI such that every reference to PI is also a reference to PHI. Personal Information Bank (PIB): means a personal information bank as defined in FIPPA. Privacy Breach: means an unauthorized internal or external access to, or collection, use or disclosure of personal information or personal health information. Privacy Impact Assessment (PIA): means a risk management tool used to identify effects that a proposed or existing information system or process may have on an individual’s privacy. Sensitive Information: includes personal information, personal health information and other information deemed confidential by Patient Ombudsman. Threat/Risk Assessment (TRA): means a method used to assess threats and vulnerabilities, document security measures and make recommendations for additional safeguards. 4. Roles & Responsibilities: In this section the Patient Ombudsman, as head of Patient Ombudsman, assigns the following roles and responsibilities to establish Employee accountabilities. The Patient Ombudsman may exercise any of the assigned responsibilities, and responsibilities assigned to the Patient Ombudsman can only be exercised by the Patient Ombudsman. In this section a Manager is a person within Patient Ombudsman with whom another Employee has a direct reporting relationship. 4.1 The Patient Ombudsman a) Review and approve the Information Security and Privacy Policy. b) Provide business direction and demonstrate priorities. c) Exercise the delegated authorities as the head under FIPPA for records in the custody or under the control of Patient Ombudsman; for example, making decisions about access requests, and authorizing the destruction of PI. d) Approve the record retention schedule that would permit the disposition of records at the end of the retention period. e) Investigate any alleged breach of privacy and/or security by an Employee who reports directly to the Patient Ombudsman and take the necessary actions to avoid similar incidents in the future. When appropriate, determine the appropriate disciplinary action for breach of the Policy. 2 | Page Information Security and Privacy Policy Patient Ombudsman 4.2 Executive Director a) Provide direction and oversight for management of security-related risks. b) As the Business Owner, manage the retention and disposition of information. c) Ensure all business operations and the use, collection and disclosure of information are in accordance with this Policy. d) Ensure adequate procedures and training are in place for this Policy and promote a culture of privacy. e) Review PIAs and TRAs and ensure the development and maintenance of a risk assessment program including developing responses and action plans to recommendations, for information security and privacy protection. f) Review privacy incidents, including complaints regarding this office’s privacy practices and privacy breaches. g) In the event of potential or actual privacy breaches relating to services provided to Patient Ombudsman by Health Quality Ontario and under Health Quality Ontario’s control, advise Health Quality Ontario’s Chief Privacy Officer. h) Monitor and track information security and privacy issues and identifiable risks. i) Investigate any alleged breach of privacy and/or security by direct reports and take the necessary actions to avoid similar incidents in the future. When appropriate, determine the appropriate disciplinary action for breach of the Policy. 4.3 Records Management & Privacy Specialist a) Provide recommendation and advice with regard to information security and privacy. b) Review, update and recommend amendments to this Policy based on changes to business functions, development of new procedures and improving trends in information security and privacy. c) Respond to access and privacy inquiries and complaints regarding this office’s privacy practices and safeguards d) Liaise with the Office of the Information and Privacy Commissioner in regard to appeals from decisions arising from freedom of information (FOI) requests, and in regard to privacy breaches. e) Maintain the PIB index f) Provide to Employees information security and privacy awareness and procedures with regard to the use, collection and disclosure of information. g) Report to the Executive Director on matters regarding information security and privacy. 4.4 Employees a) Employees must comply with the provisions of this policy and all procedures established to carry out this policy, both of which may be amended from time to time. 4.5 Executive Assistant a) Maintain a record of the current and historical versions of this Policy. 3 | Page Information Security and Privacy Policy Patient Ombudsman 5. Principles It is Patient Ombudsman’s policy to manage its functions using the following principles: 5.1 Safeguard and Protect Information Patient Ombudsman shall have physical and electronic safeguards in place to protect information including, but not limited to, PI within its custody and under its control against loss, theft, unauthorized access, disclosure, copying and use. The nature of the safeguards and method of storage will correspond to the sensitivity of the information collected. 5.2 Collection, Use, and Disclosure of Information The Patient Ombudsman’s collection, use and disclosure of personal information is governed in accordance with ECFAA and FIPPA. Employees managing PI will protect privacy based on the provisions set out in FIPPA. 5.3 Security in a Holistic Manner Patient Ombudsman will analyze the security of information and related business services in a holistic manner, with attention to people, process, and technology aspects throughout the information lifecycle and associated services. Resources will be allocated using normal business management practices to ensure alignment of security capabilities and services with the business needs of this office. 5.4 Privacy by Design (PbD) Patient Ombudsman will take an approach to protecting privacy by embedding it into the design specifications of technologies, business practices, and physical infrastructures as proscribed by the IPC’s Privacy by Design. Patient Ombudsman will take a proactive approach to prevent the invasion of privacy. Privacy protection will be built up front and taken into consideration before processes are implemented. 6. Mandatory Requirements Patient Ombudsman will ensure that the following requirements are met: 6.1 Access Controls a) Patient Ombudsman will establish defined responsibilities and delegations of authority that will assign process controls and segregate duties. b) Access to PI shall be restricted to those who require it to perform their duties and where access is necessary for the administration of this office. c) Paper-based complaint records, which are not electronically scanned, are to be stored in locked