Health Canada - Privacy Act - Annual Report 2014-2015

Table of Contents

• Introduction
  • I. Privacy Act
  • II. About Health Canada
• Privacy Delivery and Governance
  • I. Privacy Management Division
  • II. The Access to Information and Privacy Operations Division
• Delegation of authority
• Requests Under the Privacy Act - Statistical Figures, Interpretation and Explanation
  • I. Statistical Report
  • II. Number of Privacy Requests and Case Load
  • III. Disposition of Requests Completed
  • IV. Exemptions Invoked
  • V. Exclusions Cited
  • VI. Completion Time
  • VII. Extensions
  • VIII. Translation
  • IX. Format of Information Released
  • X. Corrections and Notations
  • XI. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures
  • I. ATIP Operations Division
  • II. Privacy Management Division
  • III. Other initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  • I. Complaints to the Privacy Commissioner
  • II. Types of Complaints and their Disposition Completed
  • III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal
  • IV. Health Canada Responses to Recommendations Raised by Other Agents of Parliament
  • V. Privacy Audits
• Privacy Impact Assessments Completed
• Privacy Breaches
• Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act
• Appendix A: Access to Information Act and Privacy Act - Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how Health Canada has fulfilled its privacy responsibilities during the fiscal year 2014-2015.

II. About Health Canada

Health Canada (HC) is the federal department responsible for helping the people of Canada maintain and improve their health.

HC is committed to improving the lives of all of Canada's people and to making this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.

By working with others in a manner that fosters the trust of Canadians, HC strives to:

• Prevent and reduce risks to individual health and the overall environment;
• Promote healthier lifestyles;
• Ensure high quality health services that are efficient and accessible;
• Integrate renewal of the health care system with longer term plans in the areas of prevention, health promotion and protection;
• Reduce health inequalities in Canadian society; and
• Provide health information to help Canadians make informed decisions.

HC has regional offices in British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic and Northern Regions.

For more information about Health Canada, please visit our website.

Privacy Delivery and Governance

Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and HC. The Department takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

Privacy Act requirements are led out of the Privacy Management Division and the Access to Information and Privacy Operations Division. Both Divisions are housed in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at HC. In 2014-2015, the Act was administered at HC by 12.88 full-time equivalent (FTE) employees with the support of 0.07 FTEs in consultant services, as well as some part-time and casual employees at 0.41 FTEs for a total resource complement of 13.36 FTEs.

I. Privacy Management Division

In September 2014, a new Privacy Management Division was established to strengthen capacity and expertise supporting HC's programs in the collection, use, retention, disclosure and disposal of personal information.

The Privacy Management Division's key areas of work include:

• Developing corporate privacy policies, guidelines and practices that promote a culture of privacy awareness and understanding;
• Working with programs to complete, monitor and report on privacy impact assessments and privacy breaches;
• Actively promote privacy awareness in both organization through both on-line and in person training;
• Reviewing Memorandum to Cabinet and Treasury Board submissions to ensure privacy requirements are met;
• Coordinating HC and the Public Health Agency of Canada annual input into Info Source and the development of Personal Information Banks;
• liaising with the Office of the Privacy Commissioner of Canada on privacy aspects of new and proposed legislation/regulations, policies, privacy impact assessments, breaches and complaints
• Monitoring privacy policies, practices; and
• Liaising with other federal departments, agencies, provincial ministries of health and other key partnerships regarding privacy issues within the health portfolio to provide informed advice to clients.

II. The Access to Information and Privacy Operations Division

The management of requests and associated complaints under the Privacy Act continues to be led by the Access to Information and Privacy Operations Division. The Division is responsible for privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Promoting staff awareness and providing training on the Act;
• Preparing the Annual Report to Parliament;
• Supporting other areas of the department by reviewing various documents to ensure the appropriate identification and redaction of personal information (e.g., documents for litigation, information disclosure, and relating to human resource issues); and
• Liaising with the Office of the Privacy Commissioner (OPC), Treasury Board of Canada Secretariat (TBS), other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

Delegation of Authority

On July 11, 2013, a delegation order for the Privacy Act was signed by the Minister of Health. The delegation order extends the delegation of authorities beyond the Coordinator to the Assistant Deputy Minister and Director General levels within HC's Corporate Services Branch. Select authorities have also been delegated to ATIP managers and analysts in order to more effectively manage the volume of access to information requests received. This revised approach was adopted to maximize operational efficiency.

The Delegation Order is attached as Appendix A.

Requests Under the Privacy Act - Statistical Figures, Interpretation and Explanation

I. Statistical Report

This section of the report includes an interpretation and explanation of the data contained in HC's statistical report which summarizes privacy-related activity for the period between April 1, 2014 and March 31, 2015 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act

Although the number of new privacy requests increased by 13% over the past six years, requests declined from 627 in 2013-2014 to 532 in 2014-2015. The number of requests carried over into the year increased from 48 in 2013-2014 to 79 in 2014-2015. Over the past several years, a significant proportion of the requests related to those seeking medical records as part of Indian Residential Schools. Although these continue to represent the largest component of the requests received, they have been declining in number. The Department also receives a significant number of requests from current or past HC employees looking for their own personal information.

Case Load

During fiscal year 2014-2015, HC completed the processing of 543 requests, representing 102% of the annual volume of requests received (532), but only 89% of 611 active requests. Active requests included 532 new requests and 79 requests carried over from fiscal year 2013-2014, due to a higher than normal volume of requests received the previous year.

2014-2015 saw a slight decrease from the previous year in the number of pages reviewed, consistent with the decrease in number of requests closed. Over the past two years, the average file size of processed requests has remained similar at approximately 145 pages in 2013-2014 and 150 pages in 2014-2015.

Consultations Received from Other Government Institutions

In 2014-2015, HC completed a total of ten consultations (182 pages) from other federal government departments. This represented a marginally lower number of consultations (2), while the amount of pages increased from the previous year by 71. HC received 11 consultations in 2014-15. There was one consultation carried over from the previous year, of one page in length.

III. Disposition of Requests Completed

Completed requests were classified as follows:

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest.  Section 26 "personal information of other individuals" accounted for 90% of the all exemptions invoked in 2014-2015.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69), nor does it apply to confidences of the Queen's Privy Council (section 70), with some exceptions. Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2014-2015, HC did not exclude any information under either section 69 or 70.

VI. Completion Time

HC tracks the disposition of closed requests and the length of time taken to process them. Of the total caseload of 611 requests, HC completed 543 cases and carried over 68 active requests to fiscal year 2015-2016.

HC was able to respond within 30 days or less in 442 (81%) of completed cases. Of the remaining requests, 62 (11%) were completed in 31 to 60 days; 24 (5%) in 61 to 120 days, and 15 (3%) in 121 days or more.

VII. Extensions

Legal extensions were invoked in 70 cases (13%) of the total 543 requests completed.

VIII. Translation

There were no requests for translation of records responsive to Privacy Act requests in 2014-2015.

IX. Format of Information Released

Of requests that were fully or partially disclosed, 193 were sent out in paper format. This number, however, represents only 13% of the total pages released. Comparatively, 98 requests were released electronically, representing 87% of pages released.

HC's imaging software allows the department to respond to formal privacy requests using Portable Document Format (PDF) which provides more delivery options to the public. Released documents can be mailed on CD-ROM which eliminates the need for photocopying. It is anticipated that the use of electronic formats for the release of information will continue to grow in future years.

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during the reporting period.

XI. Costs

HC spent a total of $1,191,119 responding to requests related to the Act. Of this total: salaries accounted for $1,107,694 and administration costs accounted for $83,425, most of which was used to retain temporary help to address the volume and complexity of requests. Staffing for the fiscal year amounted to 12.88 FTEs dedicated to privacy activities with the support of 0.41 FTEs in consultant services, as well as some part-time and casual employees at 0.07 FTEs for a total resource complement of 13.36 FTEs. In previous years, these figures did not include administrative support, management, reporting, monitoring and policy resources, nor did they include their overhead cost which contributed to overall support of the operations of the application of the Act. In this fiscal year (2014-2015) these elements were incorporated in the above noted costs.

Training and Awareness

Training for HC Employees

HC's main privacy training is the 'Privacy 101' session. The course covers a broad range of topics and highlights departmental and employee obligations under the Act and its supporting policies and directives. In 2014-2015, 18 sessions of the 'Privacy 101' course were held, attended by 174 HC employees.

There is also an online learning tool available entitled "Privacy: The Basics". This e-learning course provides employees with the basic introduction to their roles and responsibilities surrounding the safeguarding of personal information. The course was designed to increase employees' awareness of privacy legislation, as well as the policies and directives that govern privacy practices.

Orientation and Awareness

HC continued to increase awareness among employees of their responsibilities under the Act by targeted information sessions such as promoting Privacy Day, communications and general awareness messages through internal communication channels. These communications were supported by the development of a number of tools for employees such as the Personal Information Disclosure Guide, Info Source Handbook and a checklist for privacy considerations relevant to Treasury Board submissions. These documents provide guidance to employees when they need to handle personal information.

Recent Privacy Initiatives

Over the past year, there continued to be increased interest in the effective identification and management of privacy issues from various programs in HC. The Privacy Management Division worked collaboratively with program areas to identify and mitigate privacy risks.

In addition, the Privacy Management Division continued to collaborate with other government departments in developing common training resources, including an on-line module on privacy, which is expected to become available in 2015-16.

New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures

I. ATIP Operations Division

Organizational Capacity

Work continued to strengthen ATIP Operations function at HC, including a benchmarking exercise against selected other government departments. Competitive staffing processes were completed in the first quarter of 2014-2015 in order to position the ATIP Division to fill vacancies. Staffing activities will continue through 2015-2016 in order to continue to build internal capacity.

IT Systems Modernization

Case management tools used to manage/process requests were adapted to Windows 7, the new government standard operating system. Efforts to modernize tools continued throughout the year, and implementation of a new case management system and the addition of new imaging and document processing capacity are planned for the fall of 2015.

II. Privacy Management Division

Privacy Tools

The Privacy Management Division created a number of tools for employees. These tools provide guidance and advice on all stages of handling personal information and include an Info Source Handbook, Privacy Notice Statement Guide and a Personal Information Disclosure Guide, as well as a checklist for privacy considerations relevant to Treasury Board submissions. These documents along with the existing Privacy Management Framework (2013) and the Privacy Impact Assessment (PIA) Toolkit (2014) ensure that HC employees have the information they need to handle personal information appropriately.

Governance and Outreach

There is an ongoing focus on engagement through meetings with employees across the Department, central agencies and other government departments. For example, in 2014-15, several meetings of the Health Partnership Privacy Committee (HPPC) were held. As a director-level forum with representation from all areas of HC, the HPPC generates discussion and approval of privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

III. Other Initiatives

Internal Audit response

Privacy Management Division completed all outstanding recommendations from an internal audit of privacy practices.

Health Information Privacy Group

HC continues to participate as a member of the Federal-Provincial-Territorial Health Information Privacy Working Group focused on privacy issues related to the development of electronic health records in Canada.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

As illustrated in Part 8 of the Statistical Report (Appendix B), eight complaints under Section 31 related to the processing of Privacy Act requests by HC were filed with the Office of the Privacy Commissioner (OPC). The OPC sent twelve notices (Section 33) to the Department providing opportunity to make formal representations relating to active investigations. Lastly, five Letters of Finding (Section 35) relating to complaints were received from the OPC.

II. Types of Complaints and their Disposition Completed

During 2014-2015, five investigations into complaints that related to the processing of Privacy Act requests were completed by the OPC. It should be noted that one finding for a delay complaint was well founded, one finding for disclosure was well founded, another finding for an exemption complaint was not well founded and two complaints required no further action.

The Department reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.

III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or the Federal Court of Appeal during fiscal year 2014-2015.

IV. Health Canada Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2014-2015.

V. Privacy Audits

There were no privacy audits concluded during fiscal year 2014-2015 for HC.

Privacy Impact Assessments Completed

No privacy impact assessments were completed during fiscal year 2014-2015 for HC.

Privacy Breaches

HC reported 23 privacy breaches during the fiscal year that affected 37 individuals. The major cause of the breaches is attributed to human errors and the majority of the breaches were of low sensitivity. Two breaches were rated as medium sensitivity and one of those breaches was reported to the Office of the Privacy Commissioner of Canada.

Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act

Paragraph 8(2)(m) allows for the disclosure of personal information where the head of a government institution is of the opinion that the public interest in the disclosure clearly outweighs any invasion of privacy that could result from the disclosure.

There were no 8(2)(m) disclosures made this fiscal year.

Appendix A: Access to Information Act and Privacy Act - Delegation Order

Delegation of Authority

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister as the head of Health Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

The Honorable Leona Aglukkaq, P.C., M.P.
Minister of Health
July 11, 2013

Appendix B: Statistical Report on the Privacy Act

TBS/SCT 350-63
Name of institution: Health Canada
Reporting period: 2014-04-01 to 2015-03-31

Part 1 - Requests under the Privacy Act

Part 2 - Requests closed during the reporting period

2.5 Complexity

2.6 Deemed refusals

Part 3 - Disclosures under subsections 8(2) and 8(5)

Part 4 - Requests for correction of personal information and notations

Part 5 - Extensions

Part 6 - Consultations received from other institutions and organizations

Part 7 - Completion time of consultations on Cabinet confidences

Part 8 - Complaints and investigations notices received

Part 9 - Privacy Impact Assessments (PIAs)

Part 10 - Resources related to the Privacy Act