Health Canada - Privacy Act - Annual Report 2015-2016

Table of Contents

• Introduction
  • I. Privacy Act
  • II. About Health Canada
• Privacy Delivery and Governance
  • I. Privacy Management Division
  • II. The Access to Information and Privacy Operations Division
• Delegation of Authority
• Requests Under the Privacy Act - Statistical Figures, Interpretation and Explanation
  • I. Statistical Report
  • II. Number of Privacy Requests and Case Load
  • III. Disposition of Requests Completed
  • IV. Exemptions Invoked
  • V. Exclusions Cited
  • VI. Completion Time
  • VII. Extensions
  • VIII. Translation
  • IX. Format of Information Released
  • X. Corrections and Notations
  • XI. Costs
• Training and Awareness
• Recent Privacy Initiatives
• New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures
  • I. Privacy Management Division
  • II. Other initiatives
• Key Issues Raised as a Result of Privacy Complaints and/or Investigations
  • I. Complaints to the Privacy Commissioner
  • II. Types of Complaints and their Disposition Completed
  • III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal
  • IV. Health Canada Responses to Recommendations Raised by Other Agents of Parliament
  • V. Privacy Audits
• Privacy Impact Assessments Completed
• Privacy Breaches
• Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act
• Appendix A: Access to Information Act and Privacy Act - Delegation Order
• Appendix B: Statistical Report on the Privacy Act

Introduction

I. Privacy Act

The Privacy Act (the Act) gives Canadian citizens and permanent residents of Canada the right of access to information about themselves held by the federal government with certain specific and limited exceptions. The Act protects an individual's privacy by setting out provisions related to the collection, retention, accuracy, disposal, use and disclosure of personal information.

The Act requires the head of every federal government institution to submit an annual report to Parliament on the administration of the Act following the close of each fiscal year. This annual report is prepared and is being tabled before each House of Parliament in accordance with section 72 of the Act. This report summarizes how Health Canada has fulfilled its privacy responsibilities during the fiscal year 2015-2016.

II. About Health Canada

Health Canada (HC) is the federal department responsible for helping the people of Canada maintain and improve their health.
HC is committed to improving the lives of all of Canada's people and to making this country's population among the healthiest in the world as measured by longevity, lifestyle and effective use of the public health care system.
By working with others in a manner that fosters the trust of Canadians, HC strives to:

• Prevent and reduce risks to individual health and the overall environment;
• Promote healthier lifestyles;
• Ensure high quality health services that are efficient and accessible;
• Integrate renewal of the health care system with longer term plans in the areas of prevention, health promotion and protection;
• Reduce health inequalities in Canadian society; and
• Provide health information to help Canadians make informed decisions.

HC has regional offices in British Columbia, Alberta, Saskatchewan, Manitoba, Ontario, Quebec, and the Atlantic and Northern Regions.

For more information about HC, please visit our website at: http://www.hc-sc.gc.ca/index-eng.php

Privacy Delivery and Governance

Privacy protection and the appropriate management of personal information, including personal health information, are extremely important for Canadians and HC. The Department takes its role in the management of personal information seriously and has taken steps to raise awareness and implement processes to comply with the Privacy Act. These are outlined in this report.

Privacy Act requirements are led out of the Privacy Management Division and the Access to Information and Privacy Operations Division. Both Divisions are housed in the Planning, Integration and Management Services Directorate of the Corporate Services Branch at HC. In 2015-2016, the Act was administered at HC by 25.53 full-time equivalent (FTE) employees with the support of 2.89 FTEs in consultant services, as well as some part-time and casual employees at 0.52 FTEs for a total resource complement of 28.94 FTEs.

I. Privacy Management Division

The Privacy Management Division strengthens capacity and expertise supporting HC's programs that collect, use, disclose, retain and dispose of personal information.

The Division's key areas of work include:

• Developing corporate privacy policies, guidelines and practices that promote a culture of privacy awareness and understanding;
• Working with programs to complete, monitor and report on privacy impact assessments and privacy breaches;
• Actively promote privacy awareness in both organization through both on-line and in person training;
• Reviewing Memorandum to Cabinet and Treasury Board submissions to ensure privacy requirements are met;
• Coordinating HC and the Public Health Agency of Canada annual input into Info Source and the development of Personal Information Banks;
• Liaising with the Office of the Privacy Commissioner of Canada on privacy aspects of new and proposed programs, legislation/regulations, policies, privacy impact assessments, breaches and complaints;
• Monitoring privacy policies, practices; and
• Liaising with other federal departments, agencies, provincial ministries of health and other key partnerships regarding privacy issues within the health portfolio to provide informed advice to clients.

II. The Access to Information and Privacy Operations Division

The management of requests and associated complaints under the Privacy Act is led by the Access to Information and Privacy Operations Division. The Division is responsible for privacy legislative requirements pursuant to the Act such as:

• Responding to privacy requests within the statutory time frame as well as meeting the duty to assist requesters;
• Promoting staff awareness and providing training on the Act;
• Preparing the Annual Report to Parliament;
• Supporting other forms of information sharing by HC by ensuring the appropriate identification and redaction of personal information (e.g., documents for litigation, information disclosure, and relating to human resource issues); and
• Liaising with the Office of the Privacy Commissioner (OPC), Treasury Board of Canada Secretariat (TBS), other federal departments and agencies, provincial ministries of health and other key partners regarding the application of the Act to develop relevant policies, tools and guidelines.

Delegation of Authority

On November 25, 2015, a new delegation order for the Privacy Act was signed by the Minister of Health. The delegation order recognizes the new Privacy Management Division and provides a distinction between the Privacy Management and ATIP Operations functions. Additionally, the delegation order recognizes the title of Deputy Director, a new position within the ATIP Operations Division.

The Delegation Order is attached as Appendix A.

Requests under the Privacy Act - Statistical Figures, Interpretation and Explanation

I. Statistical Report

This section of the report includes an interpretation and explanation of the data contained in HC's statistical report which summarizes privacy-related activity for the period between April 1, 2015 and March 31, 2016 (Appendix B).

II. Number of Privacy Requests and Case Load

Requests under the Privacy Act

For fiscal year 2015-2016, the number of privacy requests remained virtually unchanged at 531 compared to 532 in 2014-2015. A significant proportion of the privacy requests relate to individuals seeking medical records as part of Indian Residential Schools. Although these continue to represent the largest component of the requests received, they have been declining in number. The Department also receives a significant number of requests from current or past HC employees looking for their own personal information.

Case Load

During fiscal year 2015-2016, HC completed the processing of 549 requests, representing 103% of the annual volume of requests received (531), and 92% of 599 active requests. Active requests included 531 new requests and 68 requests carried over from fiscal year 2014-2015. 50 requests are being carried over into the 2016-2017 fiscal year, a decrease compared to previous years.

While the number of requests received and closed remained relatively stable compared to the previous fiscal year, the number of pages reviewed for closed files decreased by 55%. The average number of pages per file has decreased from approximately 150 pages in 2014-2015 to approximately 67 pages in 2015-2016. The specific cause of this decrease is unclear, but may be attributable to targeted efforts by the ATIP Operations Division to work with requesters to more precisely define the scope of their requests, allowing for quicker retrieval and provision of records.

Consultations Received from Other Government Institutions

In 2015-2016, HC completed a total of seven consultations (125 pages) from other federal government departments. HC also received one consultation from other jurisdiction compared to last year where no consultations were received. This represents a small change with only three fewer consultations than the previous year. No consultations were carried over to the new fiscal period.

III. Disposition of Requests Completed

Completed requests were classified as follows:

While HC has a high number of abandoned privacy requests, this is primarily due to confusion from the general public about the Department's mandate and records holdings. Most of the requests that HC reported as “closed as abandoned” were received online and were seeking personal medical records that fall within provincial jurisdiction and are not under the control of HC. Since HC does not hold this information, requesters were notified accordingly.

IV. Exemptions Invoked

Sections 18 through 28 of the Act set out the exemptions intended to protect information pertaining to a particular public or private interest. Section 26 “personal information of other individuals” accounted for 93% of the all exemptions invoked in 2015-2016.

V. Exclusions Cited

The Act does not apply to personal information that is available to the public (section 69), nor does it apply to confidences of the Queen's Privy Council (section 70), with some exceptions. Requests containing proposed exclusions under section 69 require consultation with the Department of Justice, and potentially the Privy Council Office. In 2015-2016, HC did not exclude any information under either section 69 or 70.

VI. Completion Time

HC tracks the disposition of closed requests and the length of time taken to process them. Of the total caseload of 599 requests, HC completed 549 cases and carried over 50 active requests to fiscal year 2016-2017.

HC was able to respond within 30 days or less in 457 (83%) of completed cases. Of the remaining requests, 60 (11%) were completed in 31 to 60 days; 22 (4%) in 61 to 120 days, and 10 (2%) in 121 days or more.

VII. Extensions

Legal extensions were invoked in 26 cases (5%) of the total 549 requests completed.

VIII. Translation

There were no requests for translation of records responsive to Privacy Act requests in 2015-2016.

IX. Format of Information Released

Of requests that were fully or partially disclosed, 216 were sent out in paper format. Comparatively, 80 requests were released electronically.

HC's imaging software allows the Department to respond to formal privacy requests using Portable Document Format (PDF) which provides more delivery options to the public. Released documents can be mailed on CD-ROM which eliminates the need for photocopying. It is anticipated that the use of electronic formats for the release of information will continue to grow in future years.

X. Corrections and Notations

There were no requests for the correction or the notation of personal information during this fiscal year.

XI. Costs

HC spent a total of $2,302,907 responding to requests related to the Act. Of this total: salaries accounted for $1,343,777 and administration costs accounted for $918,085, most of which was used to retain temporary help to address the volume and complexity of requests. Staffing for the fiscal year amounted to 25.53 FTEs dedicated to privacy activities with the support of 2.89 FTEs in consultant services, as well as some part-time and casual employees at 0.52 FTEs for a total resource complement of 28.94 FTEs. These figures include administrative support, management, reporting, monitoring and policy resources, and overhead cost which contribute to the overall support of the operations of the application of the Act.

Training and Awareness

Training for HC Employees

HC continues to offer privacy training through ‘Privacy 101' sessions. The course covers a broad array of topics and highlights employee's obligations when handling personal information under the Privacy Act and Treasury Board Secretariat policies and directives. In 2015-2016, 14 sessions of the ‘Privacy 101' course were delivered, attended by 174 HC employees.

Several new training sessions were developed this fiscal including Privacy Impact Assessment Boot Camp, Integrating Privacy consideration into Treasury Board Submissions as well as tailored presentations on Privacy to specific program area. Total participants in these additional training sessions was 141.

A new online learning tool was launched in March 2016 and replaces an existing tool. Total on-line participants for the year was 377.

Overall, 692 HC employees received privacy training in 2015-16 which represents a significant increase over previous years.

Orientation and Awareness

HC continues to increase the awareness among employees of privacy and their responsibilities under the Privacy Act by targeted information sessions such as promoting Privacy Day in January and Privacy Awareness Week in May, communication and general awareness messages through internal communication channels. The Privacy Management Division established an informal twitter account and had 130 followers as of year-end.

Recent Privacy Initiatives

The Privacy Management Division matured its privacy risk assessment approach by developing a strategy to improve the timely completion of Privacy Impact Assessments (PIA). PIAs completed in the first six months of the pilot project matched results for the last five years.

New and/or Revised Institution-Specific Privacy-Related Policies, Guidelines and Procedures

I. Privacy Management Division

The Privacy Management Division, with the assistance of other departments, has completed a new privacy online training resource that covers the key requirements for the collection, use, retention, disclosure and disposal of personal information, as well as specific modules on privacy oversight, privacy breach management and PIAs. The online privacy module has been launched as of March 2016 with focused testing planned for April 2016.

A Privacy Handbook that presents the legal and policy requirements in a user-friendly way was created along with a Privacy Protocol template which helps apply the requirements to specific program contexts.

II. Other Initiatives

Governance and Outreach

There is an ongoing focus on engagement through meetings with employees across the Department, central agencies and other government departments. For example, in
2015-2016, 3 meetings of the Health Partnership Privacy Committee (HPPC) were held to promote privacy issues. As a director-level forum with representation from all areas of HC, the HPPC generates discussion and approval of privacy guidance, practices and tools, collaborates in ensuring that privacy compliance requirements are met, and makes recommendations to senior management.

Health Information Privacy Group

HC continues to participate as a member of the Canada Health Infoway's Federal-Provincial Territorial Health Information Privacy Working Group focused on privacy issues related to the development of electronic health records in Canada.

Key Issues Raised as a Result of Privacy Complaints and/or Investigations

I. Complaints to the Privacy Commissioner

As illustrated in Part 8 of the Statistical Report (Appendix B), no complaints were received under Section 31 related to the processing of Privacy Act requests by HC. No Section 33 notices were sent by the OPC to the Department; these notices provide the opportunity to make formal representations relating to active investigations. This is a substantial decrease from last year where 12 such notices were received by HC. Lastly, three Letters of Finding (Section 35) relating to complaints were received from the OPC.

II. Types of Complaints and their Disposition Completed

During 2015-2016, three investigations into complaints that related to the processing of Privacy Act requests were completed by the OPC. All 3 findings were not well founded.

The Department reviews the outcomes of all OPC investigations, and where appropriate, incorporates lessons learned into business processes.

III. Applications/Appeals Submitted to the Federal Court/Federal Court of Appeal

There were no applications or appeals submitted to the Federal Court or the Federal Court of Appeal during fiscal year 2015-2016.

IV. Health Canada Responses to Recommendations raised by other Agents of Parliament

There were no recommendations raised by other Agents of Parliament during fiscal year 2015-2016.

V. Privacy Audits

There were no privacy audits concluded during fiscal year 2015-2016 for HC.

Privacy Impact Assessments Completed

Four privacy impact assessments were completed during the fiscal year 2015-2016.

Privacy Breaches

Health Canada reported 15 privacy breaches during this fiscal year that affected individuals. The majority of the breaches were of low sensitivity and caused by human error, however, one breach was determined to be a “material breach' and was reported to the Office of the Privacy Commissioner of Canada and the Treasury Board Secretariat as per requirements.

Disclosures made Pursuant to Paragraph 8(2)(m) of the Privacy Act

HC made two (2) disclosures under section 8(2)(m) related to a disclosure of medical records to a First Nations community following an unexpected death of a client who had reported for care at a HC Nursing Station.

8(5) disclosures:
The 8(2)(m) disclosures noted above were reported to the Privacy Commissioner of Canada as per requirements under s.8(5).

Additional disclosures s8(2)(e):
Three (3) disclosures were made under s8(2)(e) pursuant to requests made by the RCMP (schedule 3 investigative bodies). Two (2) were from British Columbia; one (1) from Yukon.

Appendix A: Access to Information Act and Privacy Act - Delegation Order

Delegation of Authority

Access to Information Act and Privacy Act

I, the Minister of Health, pursuant to section 73 of the Access to Information Act and section 73 of the Privacy Act, hereby designate the persons holding the positions set out in the Delegation of Authority Schedule attached hereto, or the persons occupying on an acting basis those positions, to exercise the powers, duties and functions of the Minister responsible for Health Canada, under the provisions of the Act and related regulations set out in the schedule opposite each position. This designation supersedes all previous delegation orders.

The Honourable Jane Philpott MP
Minister of Health
Nov 25, 2015

Appendix B:  Statistical Report on the Privacy Act

TBS/SCT 350-63

Name of institution:  Health Canada
Reporting period: 2015-04-01 to 2016-03-31

Part 1: Requests Under the Privacy Act

Part 2: Requests Closed During the Reporting Period

2.5 Complexity

2.6 Deemed refusals

Part 3: Disclosures Under Subsections 8(2) and 8(5)

Part 4: Requests for Correction of Personal Information and Notations

Part 5: Extensions

Part 6: Consultations Received From Other Institutions and Organizations

Part 7: Completion Time of Consultations on Cabinet Confidences

Part 8: Complaints and Investigations Notices Received

Part 9: Privacy Impact Assessments (PIAs)

Part 10: Resources Related to the Privacy Act

Note: Enter values to two decimal places.