March 2023 Board of Health Meeting - Annual Report on Access to Information and Privacy Information Report

PREPARED BY:

Planning and Strategic Initiatives Department

DATE:

March 2023

SUBJECT:

2022 Annual Statistical Reporting 

BACKGROUND

The WECHU is a “health information custodian (HIC)” in accordance with section 3 of the Personal Health Information Protection Act (PHIPA), and an “institution” in accordance with section 2 of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Under this legislation the WECHU has obligations to ensure the rights of individuals with respect to privacy, access, and correction of records of personal information (PI) and personal health information (PHI), and access to general records that pertain to the WECHU operations and governance.

All institutions under MFIPPA, and HICs under PHIPA, are required to provide statistical reports to the Information and Privacy Commissioner of Ontario (IPC) on an annual basis with respect to:

• Confirmed privacy breaches under PHIPA
• Access and correction requests under PHIPA
• Access and correction requests under MFIPPA

The WECHU submitted statistical reports for each category by the required deadline of March 1st for PHIPA reports and March 31st for MFIPPA.

DISCUSSION

Privacy breaches

In 2022, the WECHU had eight confirmed breaches, the same as in 2021. Privacy breaches in 2022 predominantly included incidents where Personal Information (PI) and/or Personal Health Information (PHI) was disclosed without authority and emailed or faxed to the wrong person and/or organization.

The WECHU is looking at various ways to prevent breaches of this manner through training and investigating additional electronic information management systems.

MFIPPA Access and correction to information requests

In 2022, the WECHU received twenty-one formal MFIPPA access requests, compared to thirty-eight in 2021, and one correction request during the reporting year. All requests were completed within the reporting year.

Of the twenty-one access requests completed in 2022, the majority of requests came from an “individual /public” (43%) and “individual by agent” or lawyer (43%). This was followed by “media” (9%), and “government” (5% each).

PHIPA Access and correction to information requests

In 2022, the WECHU received 1540 formal PHIPA access requests and 169 formal correction requests during the reporting year. This was a significant increase from 2021 due to the WECHU’s involvement in supporting the proof of COVID-19 vaccination certificate program, as well as in the implementation of a COVax client access and correction process.

CONCLUSION

In summary, 95% of all MFIPPA requests and 99.9% of all PHIPA requests were completed within the statutory time limits, despite the operational impacts of the pandemic. Priorities for the coming year will include continued dedication of resources for the access to information and privacy program, including additional training, and updated workflows to improve request handling processes. These actions will improve records and information management (RIM) within the program, and allow the WECHU to respond with increased efficiency to information requests.