It acts as an integrated health delivery agency, providing a range of services and programs in more than 75 facilities including 10 hospitals, 29 long-term care facilities, primary health care sites, public health centres, mental health, and addictions centres.
In April of 1992, Saskatchewan proclaimed western Canada’s first comprehensive access and privacy law, The Freedom of Information and Protection of Privacy Act (FOIP). The following year, Saskatchewan enacted The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP), with the purpose of ensuring transparency and accountability within local authorities such as regional health authorities.
The Health Information Protection Act (HIPA) was enacted in 2003 to protect the privacy of personal health information of the people of Saskatchewan. At the same time, the Act provides for information to be available when needed to provide health care services and to monitor, evaluate and improve the health system in Saskatchewan on a need to know basis and deemed consent.
Saskatoon Health Region is required to record and maintain personal health information for all patients throughout the Health Region, including details of care plans, all care provided, and the results of all tests, procedures and therapies. Demographic information is also recorded for purposes of identification, billing, and registration.
Individuals have the right to read or request a copy of their health information, and may also give a family member or friend written permission to have access to this information. Members of an associated health care team may also gain access to the information in order to plan and provide appropriate care. In some situations, the law requires information to be disclosed without consent, for example, when public safety is at risk.
Breaches of privacy within the Health Region are reported to the Access and Privacy Office and investigated often in consultation with the Saskatchewan Office of the Information and Privacy Commissioner. Consultations make up 50 requests per month.
Freedom of Information legislation outlines specific exemptions which allow for non-disclosure of certain information. If a requested record includes confidential information, the sensitive portion of the record will not be released. This enables an applicant to have access to a particular record, while maintaining the duty of the Authority under the Act to protect specific information.
Managing timelines is a critical aspect to meeting the requirements of freedom of information and privacy legislation and delivering on public expectations. As prescribed by the legislation, the Privacy and Access Office has 30 days to respond to requests.
Previously, Saskatoon Health Region used tables in a word processing application to track requests and complaints. Similar to other organizations, in order to remove content subject to exemptions, they used a black marker and photocopier. Together, the process proved labour intensive, time consuming and was open to inconsistency.
Jayden Stephens, Privacy Officer for Saskatoon Health Region felt that with an automated solution, the team of 2 full-time and 2 part-time staff could perform manual tasks more effectively and turn requests around more quickly. He also suspected the team would need to handle an increased volume of requests as privacy awareness increased, and believed this could be handled with the existing headcount if he could furnish them with a proper system that could enhance productivity.
CSDC specialized in FOI was an important decision criterion, but the fact that the Health Region would also be able to manage newly mandated legislation within the same tool was the deciding factor in finalizing on CSDC’s AccessPro Suite. Explains Mr. Stephens: “We knew we were aligning with the Canadian Federal Government standard for managing FOI operations. CSDC AccessPro Suite provided an out-of-the-box solution for FOI case management. This meant that we could turn our focus towards tailoring a solution for our HIPA requirements.”
He adds “Without CSDC, we may have never taken the time to do the process mapping to the degree that we did. CSDC Process Analysts actually helped interpret for us what was brand new legislation at the time. In doing so, they were able to get us up to speed quickly and onto the business of overseeing privacy related activity within the region.”
The result was the deployment of AccessPro Case Management as a central repository for tracking and managing all requests into the Office.
AccessPro Redaction was installed to give them the ability to securely and electronically remove exempted information from requested documents.
The results have been significant. The agency is reporting an improved ability to meet aggressive response timelines often considered unreasonable.
Mr. Stephens now monitors operations systematically. He is able to keep a pulse on performance metrics, allowing him to identify educational requirements throughout the region. Through AccessPro Case Management, he ensures that applicable legislation is being followed and that all members of the team are providing responses consistently.
Internal benefits include making working together easier as a result of all stakeholders being able to refer to the same information. They continue to find additional opportunities for the AccessPro Suite to automate processes within the department. One such example was with a requirement for a report on infant mortality. When sharing it amongst physicians, they used AccessPro Redaction to remove non-disclosable information.
Based on their experience with CSDC, Saskatoon Health Region is encouraging other provincial agencies to adopt the AccessPro Suite. They cite smoother operations, improved efficiency, and the assurance of legislative compliance as some of the benefits to expect.
Create a proper automated system that could enhance productivity and safeguard private information.
CSDC AccessPro Suite
Keeping a pulse on performance metrics has become easy. So has identifying educational requirements throughout the region.
Tracking and reporting on responses has become a click button activity, accessing an audit trail that is automatically generated as a function of logging activity into the system.