April 2022 Board of Health Meeting - 2021 IPC Annual Statistical Reporting Information Report

PREPARED BY

Records Coordinator & Privacy Officer

DATE

April 21, 2022

SUBJECT

2021 IPC Annual Statistical Reporting 

BACKGROUND

The WECHU is a “health information custodian (HIC)” in accordance with section 3 of the Personal Health Information Protection Act (PHIPA), and an “institution” in accordance with section 2 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Under this legislation the WECHU has obligations to ensure the rights of individuals with respect to privacy, access and correction of records of personal information (PI) and personal health information (PHI), and access to general records that pertain to the WECHU operations and governance.

All institutions under MFIPPA, and HICs under PHIPA, are required to provide statistical reports to the Information and Privacy Commissioner of Ontario (IPC) on an annual basis with respect to:

• Confirmed privacy breaches under PHIPA (Appendix A)
• Access and correction requests under PHIPA (Appendix B)
• Access and correction requests under MFIPPA (Appendix C)

The WECHU submitted statistical reports for each category by the required deadline of March 1st for PHIPA reports and March 31st for MFIPPA.

DISCUSSION

Privacy breaches

In 2021, the WECHU had eight confirmed breaches, compared to thirteen in 2020. Privacy breaches in 2021 predominantly included incidents where PI and/or PHI was emailed or faxed to the wrong person and/or organization.

The WECHU is looking at various ways to prevent breaches of this manner through training and investigating additional email security options.

MFIPPA Access and correction to information requests

In 2021, the WECHU received thirty-eight formal MFIPPA access requests, compared to thirty-five in 2020, and zero correction requests during the reporting year. One of the requests was transferred to Statistics Canada. Thirty-one of the requests were completed within the reporting year and six of the requests carried over to the 2022 reporting year.

Of the thirty-eight access requests completed in 2021, the majority of requests came from an “individual by agent” or lawyer (48%). This was followed by “individual/public” (29%), “business” (13%), and “media”, “government” and “other” (3% each).

PHIPA Access and correction to information requests

In 2021, the WECHU received five formal PHIPA access requests and sixty-two formal correction requests during the reporting year. This was a significant increase from 2020 due to the WECHU’s involvement in supporting the proof of COVID-19 vaccination certificate program, as well as in the implementation of a COVax client access and correction process.

CONCLUSION

In summary, 81% of all MFIPPA requests and 100% of all PHIPA requests were completed within the statutory time limits, despite the operational impacts of the pandemic. Priorities for the coming year will include continued dedication of resources for the access to information and privacy program, including additional training, and class customization within the WECHU’s M-Files system. These actions will improve records and information management (RIM) within the program, and allow the WECHU to respond with increased efficiency to information requests.