Health Canada - Privacy Act - Annual Report 2014-2013

Table of Contents

• Introduction
  1. Privacy Act
  2. About Health Canada
• Privacy Infrastructure
  1. The Access to Information and Privacy (ATIP) Division
• Delegation of Authority
• Requests under the Privacy Act - Statistical Figures and Interpretation and Explanation
  1. Statistical Report
  2. Number of Privacy Requests and Case Load
  3. Disposition of Requests Completed
  4. Exemptions Invoked
  5. Exclusions Cited
  6. Completion Time
  7. Extensions
  8. Translation
  9. Format of Information Released
  10. Corrections and Notations
  11. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures
  1. ATIP Division
  2. Other Initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  1. Complaints to the Privacy Commissioner
  2. Types of Complaints and their Dispositions Completed
  3. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal
  4. Health Canada Responses to Recommendations raised by other Agents of Parliament
  5. Privacy Audits
• Privacy Impact Assessments Completed
• Disclosures made Pursuant to Subsection 8(2)(M) of the Privacy Act
• Appendix A: Access to Information Act and Privacy Act - Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how Health Canada has fulfilled its privacy responsibilities during the fiscal year 2013-2014.

II. About Health Canada

Health Canada (HC) is the federal department responsible for helping the people of Canada maintain and improve their health.

HC is committed to improving the lives of all of Canada's people and to making this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.

By working with others in a manner that fosters the trust of Canadians, HC strives to:

• Prevent and reduce risks to individual health and the overall environment;
• Promote healthier lifestyles;
• Ensure high quality health services that are efficient and accessible;
• Integrate renewal of the health care system with longer term plans in the areas of prevention, health promotion and protection;
• Reduce health inequalities in Canadian society; and
• Provide health information to help Canadians make informed decisions.

HC has regional offices in British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic and Northern Regions.

For more information about Health Canada, please visit our website.

Privacy Infrastructure

I. The Access to Information and Privacy (ATIP) Division

Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and HC. The Department takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

The Access to Information and Privacy (ATIP) Division is housed in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at Health Canada.

In June 2012, under the terms of the HC and the Public Health Agency of Canada (the Agency) Shared Services Partnership Agreement, a shared service was established for the administration of the Access to Information Act and the Privacy Act in the two institutions. 2013-2014 was the first full fiscal year under this new arrangement, and saw the implementation of a single ATIP Coordinator model for HC and the Agency.

The ATIP Coordinator is accountable for the development, coordination and implementation of effective policies, guidelines, systems and procedures in order to enable efficient processing of requests under the Act. The Coordinator is also responsible for related policies, systems and procedures stemming from the Act. The division is responsible for all privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Providing advice and guidance to staff on the application of the Act and Treasury Board of Canada policies and directives;
• Developing corporate privacy policies and practices that promote a culture of privacy awareness and understanding;
• Promoting staff awareness and providing training on the Act;
• Ensuring that personal information holdings are published in Info Source;
• Coordinating and overseeing the Privacy Impact Assessment (PIA) process;
• Coordinating the containment, assessment and reporting of privacy breaches;
• Monitoring trends in national and international privacy issues to provide informed advice to clients;
• Analyzing privacy practices in the health sector;
• Preparing the Annual Report to Parliament and providing input to the Management Accountability Framework (MAF); and,
• Liaising with the Office of the Privacy Commissioner (OPC), Treasury Board of Canada Secretariat (TBS), other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

In 2013-2014, the Act was operationally administered at HC by 9.36 full-time equivalent (FTE) employees, with the support of 0.98 FTEs in consultant services, and 0.14 part-time, casual employees and student FTEs for a total complement of 10.48 FTEs.

Additionally, there were approximately 5.65 FTEs dedicated to working on privacy policy for HC files. The total complement of privacy-related FTEs within HC amounted to 16.13 FTEs.

Delegation of Authority

On July 11, 2013, a new delegation order for the Privacy Act was signed by the Minister of Health. The new delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels within HC's Corporate Services Branch. Select authorities have also been delegated to ATIP managers and analysts in order to more effectively manage the volume of access to information requests received. This revised approach was adopted to maximize operational efficiency while continuing to minimize risks.

The Delegation Order is attached as Appendix A.

Requests Under the Privacy Act - Statistical Figures, Interpretation and Explanation

I. Statistical Report

This section of the report includes an interpretation and explanation of the data contained in HC's statistical report which summarizes privacy-related activity for the period between April 1, 2013 and March 31, 2014 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act
The number of new privacy requests has increased over the past five years. In 2009-2010 there were 471 Privacy requests compared to 627 in 2013-2014 which represents a 33% increase. This is due, in part, to those seeking medical records as part of Indian Residential School claims.

Case Load
During fiscal year 2013-2014, HC completed the processing of 596 of 675 (88%) active requests. Active requests included 627 new requests and 48 requests carried over from fiscal year 2012-2013.

While 2013-2014 saw a significant decrease from the previous year in the number of pages reviewed, there are a number of factors that contributed to this result. First, HC has attempted to be more strategic in the manner with which it deals with its requests, and has dedicated more resources to front-end processes. For example, requests are more closely analyzed and discussed with the requestor from the outset, in an attempt to retrieve records that respond to their needs. In a similar vein, ATIP has worked with departmental officials to help ensure that documents retrieved are relevant to the request. Finally, it is worth noting that the number of pages reviewed relate only to files closed during 2013-2014, and do not account for active requests still under review at the end of the fiscal year.

Consultations Received from Other Government Institutions
In 2013-2014, HC completed a total of 12 consultations (112 pages) from other federal government departments. This represented a marginally higher number of cases (8), while the amount of pages increased from the previous year by 967.

III. Disposition of Requests Completed

Completed requests were classified as follows:

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. Section 26 "personal information of other individuals" accounted for 95% of the all exemptions invoked in 2013-2014.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69), nor does it apply to confidences of the Queen's Privy Council, with some exceptions (section 70). Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2013-2014, HC did not exclude any information under either section 69 or 70.

VI. Completion Time

HC tracks the disposition of closed requests and the length of time taken to process them. Of the total caseload of 675 requests, HC completed 596 cases and carried over 79 active requests to fiscal year 2014-2015.

HC was able to respond within 30 days or less in 404 (68%) of completed cases. Of the remaining requests, 123 (20%) were completed in 31 to 60 days; 53 (9%) in 61 to 120 days, and 16 (3%) in 121 days or more.

VII. Extensions

Legal extensions were invoked in 150 cases (25%) of the total 596 requests completed.

VIII. Translation

There were no requests for translation of records responsive to Privacy Act requests in 2013-2014.

IX. Format of Information Released

Of requests that were fully or partially disclosed, 171 were sent out in paper format. This number, however, represents only 14% of the total pages released. Comparatively, 246 requests were released electronically, representing 86% of pages released.

HC's imaging software allows the department to respond to formal privacy requests using Portable Document Format (PDF) which provides more delivery options to the public. Released documents can be mailed on CD-ROM which eliminates the need for photocopying. It is anticipated that the use of electronic formats for the release of information will continue to grow in future years.

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during the reporting period.

XI. Costs

HC spent a total of $863,519 responding to requests related to the Act. Of this total: salaries accounted for $707,572 and administration costs accounted for $155,947, most of which was used to retain temporary help to address the volume and complexity of requests. Staffing for the fiscal year amounted to 16.13 full-time employees dedicated to privacy activities. These figures do not include administrative support, management, reporting, monitoring and policy resources, nor do they include their overhead cost which contributed to overall support of the operations of the application of the Act. It is important to note that these amounts relate only to the costs associated within the ATIP division, and do not account for costs that other areas of HC incur in responding to privacy requests.

Training and Awareness

Training for HC Employees
Within the ATIP division, there is one employee designated as a full time training coordinator. HC's main privacy training is the 'Privacy 101' session. The course covers a broad range of topics and highlights departmental and employee obligations under the Act and its supporting policies and directives. In 2013-2014, eight sessions of the 'Privacy 101' course were held, attended by 136 HC employees.

In addition to the Department's 'Privacy 101' course, program areas sometimes request customized privacy training. These courses encompass both Access to Information and Privacy components, and the content is customized for the recipient. In 2013-2014, four such courses were held, attended by a total of 44 HC employees.

There is also an online learning tool available entitled "Privacy: The Basics". This e-learning course provides employees with the basic introduction to their roles and responsibilities surrounding the safeguarding of personal information. The course was designed to increase employees' awareness of privacy legislation, as well as the policies and directives that govern privacy practices.

Orientation and Awareness
HC continued to increase awareness among employees of their responsibilities under the Act by advertising sessions open to all employees through Broadcast News messages (a daily electronic newsletter sent to every HC employee).

Informal Briefing
The ATIP Coordinator provided briefings at senior level management meetings on various privacy-related initiatives, including the development of a Privacy Impact Assessment toolkit.

Recent Privacy Initiatives

Over the past year, there continued to be increased interest in privacy issues from various programs in both HC and the Agency. The ATIP division worked collaboratively with program areas to identify and mitigate privacy issues. Below are some examples of recent initiatives in which the division is working closely with program areas to address privacy considerations.

British Columbia (BC) Tripartite Framework Agreement
The transfer, under this Agreement, of all health programs and services for BC First Nations previously administered by Health Canada to the First Nations Health Authority was undertaken in 2013. The ATIP division began its involvement in the early stages and worked with the program and the First Nations Health Authority throughout the final stages to identify and mitigate privacy issues as they arose. This included assisting in the identification of the personal information, records, client files, and employee information that could be transferred, and the development of a privacy impact assessment on this initiative. The ATIP division continues to work with the program to fulfill privacy requirements as they relate to information sharing in support of this Framework Agreement.

Privacy Impact Assessment (PIA) Process and Toolkit
A PIA toolkit for HC and the Agency was approved in March 2014. The toolkit was developed to assist employees in understanding PIA requirements and to walk them through the process of putting a PIA in place. The toolkit incorporated extensive comments solicited from all areas of the HC and the Agency via the Health Partnership Privacy Committee (HPPC), which was used as a vehicle for consultations. The PIA toolkit is a key component of the department's privacy awareness activities which focus on the safeguarding of personal information within employees' control.

New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures

I. ATIP Division

The HC and Agency Shared Services Partnership, launched on June 29, 2012, enabled the streamlining and simplification of HC and Agency ATIP operations, which included processing of ATI and privacy requests as well as privacy policy and other key functions. 2013-2014 was the first complete year under the new shared services model and work continued on activities to integrate and optimize service delivery.

Privacy Delegation Order
As noted earlier, on July 11, 2013, a new delegation order was signed by the Minister of Health. The new delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels and, in select cases, to ATIP managers and analysts. The revised approach was adopted to maximize operational efficiency while continuing to minimize risks.

Organizational Review
Work continued to enhance resources to strengthen and stabilize the ATIP function at HC and the Agency. This included a strategy to move away from temporary help consultants to full-time employees. Competitive staffing processes were completed in the fourth quarter of 2013-2014 in order to position ATIP to fill vacancies in 2014-2015 to support the revised structure. It is anticipated that staffing activities will continue through 2014-2015 in order to build internal capacity.

Business Processes
In 2013-2014, work continued on harmonizing institutional processes between HC and the Agency. A major milestone was the implementation of a single ATIP Coordinator model for both institutions. This approach, believed to be the first of its kind in the federal government, was adopted following extensive departmental consultations with the Legal Services unit and human resources section. The model is fully compliant with legislative requirements and involves the cross-appointment of select delegated authorities to both institutions.

HC and the Agency also addressed the 'care and custody' of records that are owned by one department, yet used by the other. For example, HC has 'care and custody' of the Agency's human resources records, which can now be accessed through a harmonized institutional process.

The management team and staff members continue to be engaged in the implementation of strengthened processes around ATIP requests.

IT Systems Modernization
A case management and imaging system has been procured to improve the ability to track and respond to requests, enhance efficiencies, streamline ATIP processes, and enhance reporting capacity. Much of the work performed in 2013-2014 consisted of system modification and testing, in collaboration with internal and external partners.

Governance and Outreach
There is an ongoing focus on employee engagement within the division and on stakeholder engagement through meetings with branches, central agencies and other government departments. In 2013-2014, three meetings of the Health Partnership Privacy Committee (HPPC) were held. As a director-level forum with representation from all areas of HC and the Agency, the HPPC generates discussion and approval of privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

II. Other Initiatives

Internal Audits
In December 2012, an internal audit of privacy practices was completed at HC. The focus of this audit was on the privacy practices and adherence to the Act.

The audit found that overall, personal information under the institution's control is being managed with care and consideration, and that there is a strong culture of security and confidentiality in the delivery of core program activities.

The audit made six recommendations to strengthen privacy practices and a management action plan has been developed to address the items identified in the audit. The recommendations are being addressed from a shared service perspective and will be implemented as appropriate in both HC and the Agency.

During the last reporting period, the results of work on the audit recommendations included implementation of an enterprise-wide Privacy Management Framework and updated PIA processes and tools. Ongoing work includes the development and implementation of privacy notice tools, and guidance on the collection, use, disclosure and retention of personal information.

The division is also responding to audit recommendations in other areas of the department that have privacy implications. One item in development as a result is a Permissible Disclosure Framework that will be used by programs and services within both institutions to guide disclosures pursuant to subsection 8(2) of the Privacy Act.

Privacy Management Framework
In 2013-2014, HC and the Agency continued to implement the Privacy Management Framework (PMF) to strengthen privacy management in both institutions. The PMF is comprised of four components: i) legislation, policy, and governance; ii) privacy risk management; iii) awareness and training; and iv) compliance assurance, and work continued on various initiatives in all four areas during the year.

New Guidelines and Standardized Risk Tools
Work continued in 2013-2014 to standardize PIA tools, the privacy breach management process and the registration of personal information banks. An updated PIA toolkit was approved for use by HC and Agency in March 2014.

Health Information Privacy Group
HC continues to participate as a member of the Federal-Provincial-Territorial group focused on privacy issues related to the development of electronic health records in Canada.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

During 2013-2014, twelve complaints related to the processing of Privacy Act requests by HC were filed with the OPC.

The Department also received one Commissioner-initiated complaint regarding a November 2013 mail-out from the Marihuana Medical Access Program (MMAP). The MMAP information package, sent to over 40,000 individuals, included a return address block that referenced the name of the program. The OPC investigation into this matter is ongoing.

II. Types of Complaints and their Disposition Completed

During 2013-2014, six investigations into complaints that related to the processing of Privacy Act requests by HC were completed by the OPC. All six complaints were related to deemed refusal and were well founded.

The department reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.

III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or the Federal Court of Appeal during fiscal year 2013-2014.

IV. Health Canada Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2013-2014.

V. Privacy Audits

There were no privacy audits concluded during fiscal year 2013-2014.

Privacy Impact Assessments Completed

Privacy impact assessments were completed for the following HC activities during the last reporting period:

• National Dose Registry: A registry that contains the dose records of individuals who are monitored for occupational exposures to ionizing radiation.
• Mandatory and Voluntary Medical Devices Problem Reporting: A program whose intent is to improve monitoring and reduce the recurrence of incidents related to medical devices in Canada, and to ensure that the risk to Canadians of problematic devices is managed appropriately.

Disclosures Made Pursuant to Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) allows for the disclosure of personal information where the head of a government institution is of the opinion that the public interest in the disclosure clearly outweighs any invasion of privacy that could result from the disclosure.

In 2013-2014, HC made one disclosure of personal information pursuant to subparagraph 8(2)(m)(i) of the Act. This disclosure involved the release of contact information and personal opinions, which was used to support testimony provided to a provincial legislative assembly standing committee investigating oversight, monitoring and regulation in the pharmaceutical industry. The OPC was notified prior to the disclosure.

Appendix A: Access to Information Act and Privacy Act - Delegation Order

Delegation of Authority

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Health Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

The Honorable Leona Aglukkaq, P.C., M.P.
Minister of Health
July 11, 2013

Appendix B: Statistical Report on the Privacy Act

TBS/SCT 350-63
Name of institution: Health Canada
Reporting period: 2013-04-01 to 2014-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests closed during the reporting period

Part 3 - Disclosures under subsection 8(2)

Part 4 - Requests for correction of personal information and notations

Part 5 - Extensions

Part 6 Consultations received from other institutions and organizations

Part 7 - Completion time of consultations on Cabinet confidences

Part 8 - Resources related to the Privacy Act