Privacy Impact Assessment - Medical Device Problem Reporting (August 2013)

Government Institution

Health Canada - Marketed Health Products Directorate (MHPD)

Name of Program

Medical Devices - Medical Device Problem Reporting Program

Government Officials Responsible for the Privacy Impact Assessment:

Heather Sutcliffe, Director - Marketed Health Products Safety Effectiveness and Information Bureau / Marketed Health Products Directorate, Health Canada

Amanda Wilson (Director) and Louise Meyer (Senior Policy Analyst) - Access to Information and Privacy, Health Canada

Description of Program or Activity

The Program monitors and evaluates the safety, efficacy and quality of diagnostic and therapeutic medical devices in Canada so that Consumers and Health Care Professionals can use them with confidence. The Medical Device System (MDS) database is Canada's official repository for the medical device problem reports and operates in the Therapeutic Products Directorate (TPD), Medical Devices Bureau (MDB) within the Health Products and Food Branch (HPFB) of HC. Within the HPFB, three Directorates are involved in the Medical Device Problem Reporting Program: Marketed Health Products Directorate (MHPD), Health Products and Food Branch Inspectorate (HPFBI) and Therapeutic Products Directorate (TPD). All three groups have access to the MDS and specific user 'rights' depending on their responsibilities. The Program is currently managed under a matrix structure within HPFB, where decision-making authority is shared among the Directorates for staff and funds.

Legal Authority for Program or Activity

Legal authority for the collection of personal information in the Medical Device Problem Reporting Program is pursuant to the Department of Health Act, Section 4, and the Food and Drugs Act, Section23 (1) (c) and associated Medical Devices Regulations, Section(s) 59 (1) (a) (b) (2), 60, 61.1 (1), 63, 64 and 65, 77, 81 (k) (v) (2) and 88.

Related Personal Information Bank

The collection and use of personal information with the Medical Device Problem Reporting Program is described in the Personal Information Bank (PIB) - Medical Device Problem Reporting Program - PIB, HC PPU 415.

a) Type of program or activity

Program or activity that does NOT involve a decision about an identifiable individual

Risk scale: 1

b) Type of personal information involved and context

Sensitive personal information, including detailed profiles, allegations or suspicions and bodily samples, or the context surrounding the personal information is particularly sensitive.

Risk scale: 4

c) Program or activity partners and private sector involvement

Private sector organizations, international organizations or foreign governments

Risk scale: 4

d) Duration of the program or activity

Long-term program or activity

Risk scale: 3

e) Program population

The program's use of personal information for external administrative purposes affects certain individuals.

Risk scale: 3

f) Technology and privacy

Does the new or substantially modified program or activity involve implementation of a new electronic system or the use of a new application or software, including collaborative software (or groupware), to support the program or activity in terms of the creation, collection or handling of personal information?

Yes ^{Footnote 1}

 

Does the new or substantially modified program or activity require any modifications to information technology (IT) legacy systems?

No ^{Footnote 1}

 

Specific technological issues and privacy

Does the new or substantially modified program or activity involve implementation of new technologies or one or more of the following activities:

• enhanced identification methods;
• surveillance; or
• automated personal information analysis, personal information matching and knowledge discovery techniques?

No ^{Footnote 1}

 

g) Personal information transmission

The personal information is used in a system that has connections to at least one other system.

Risk scale: 2

h) Impact on the individual or employee

Potential risk of Breach that in the event of a privacy breach, there will be an impact on the individual or employee.

Risk scale: 4