5
Assignment 3
Privacy Video Remote Presentation
Our Team
Submitted by:
Assignment 3
Privacy Video Remote Presentation
Katyayini Thakur
Neha Sawant
Johnson Vadukut
Ammar Rangwala
Submitted to:
Professor Dr. Radica Bissoondial
Submission Date:
February 25, 2020
INTRODUCTION
Introduction
With health care data being one of the most valuable assets in today's day and age, it becomes our moral responsibility as health care custodians to protect our patients' health information.
The following presentation walks you through the different aspects of cybersecurity and how we, at Kelburn Recovery Centre, address privacy concerns and combat potential threats and risks to data security.
This teaching module ends with a short quiz to test your understanding of the topic being taught.
CYBERSECURITY
Computer Security
The Importance of Computer Security
Computer security or cybersecurity is of paramount importance because it includes everything that relates to protecting sensitive data, personally identifiable information (PII) and personal health information (PHI), from theft, damage and misuse.
For the purpose of maintaining the integrity of data, availability and confidentiality of information protective measures needs to be set into place.
(Tunggal, 2020)
Addressing Potential Threats
Kelburn Recovery Centre handles potential threats to cybersecurity through:
1. Malware Prevention
2. Password Security
3. Network Security
4. Secure Configuration
5. User Privileges
6. Incident Management
(Global Knowledge Solutions Organization, n.d.)
Addressing Potential Threats
LEGISLATION AT HAND
Kelburn Recovery Centre complies with Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Health Information Protection Act (PHIPA) guidelines to maintain data integrity and protect patient confidentiality.
KEY FOCUS
Confidentiality:
Patient confidentiality can be ensured by maintaining restrictions on access to patient’s personal health information.
Integrity:
Data integrity is maintained by taking adequate measures to avoid unauthorized or improper modification and/or duplication of information, and to maintain its authenticity.
Availability:
Personal health Information is made easily available in a reliable and timely manner to those in the patient’s circle of care.
Authenticity:
We make sure to carry complete authenticity of data and the user who is accessing the information.
Accountability:
We, at Kelburn Recovery Centre, are accountable for the personal health information of our patients and have adequate resources to trace data integrity breaches, should they occur.
THREATS AND RISK ASSESSMENT
RISK ASSESSMENT AND TESTING
Our patients come to Kelburn Recovery Centre with hopes to improve their lives and it is our innate duty to protect their identity and ensure that their personal health information is secure with us.
A potential threat that would always wander around is the threat of personal health information privacy breach. The patient’s personal health information being leaked out can happen either through a network security breach, such as hacking or introducing viruses or malwares, or physical callousness at our employee’s end.
This could prove catastrophic as crucial patient data could be exploited for various reasons and it would lead to patient’s losing faith towards our organization, followed by legal complications.
(Kelburn Recovery Centre, n.d.)
VULNERABILITY ASSESSMENT
Vulnerability Assessment
To prevent crucial patient information from leaking out, we have a dedicated Health Information Management (HIM) team, with trained IT professionals who work round the clock to maintain data integrity.
Our HIM team conducts vulnerability assessment, in the form of both automated and manual checks, every 6 months to ensure that the system is free from potential threats and fixes any fault in the system that is detected.
(Hitachi Systems Security, 2018)
PENETRATION TESTING AND ETHICAL HACKING
Penetration Test and Ethical Hacking
Penetration testing is conducted as a part of our vulnerability assessment check.
Every 6 months our hired IT engineers carry out ethical hacking into our databases and system to look for loopholes that could lead to a potential privacy breach. On finding any error or loophole in the security systems, our engineers work tirelessly towards fixing the issue, thus preventing any potential future hacks.
Ethical hacking is carried out in a controlled environment to ensure that there is no loss of information during vulnerability assessment.
(Veracode, n.d.)
PRIVACY IMPACT ASSESSMENT (PIA)
Privacy Impact Assessment (PIA)
“PIAs are meant to describe and document what personal information is collected, how it is collected, used, transmitted and stored; how and why it can be shared, and how it is protected from inappropriate disclosure at each step. In short, it is a risk mitigation tool.”
(Privacy Commissioner of Canada, 2015)
PIA ( Cont.)
Principle 1: Accountability for Personal Health Information Organization and Governance
The PHI of a patient undergoing treatment at the centre is the responsibility of Kelburn Recovery Centre. A Chief Privacy Officer is appointed who oversees compliance with this necessary PIPEDA principle.
Principle 2: Identifying Purposes for Personal Health Information
Kelburn Recovery Centre ensures that the patients being treated at the Centre are well-informed of the reason and purposes for which their PHI is being collected.
Principle 3: Consent for the Collection, Use or Disclosure of Personal Health Information
Before undergoing any type of treatment or procedure at Kelburn Recovery Centre, an informed consent is taken from the patient with regards to collecting, using or disclosing their PHI.
PIA Based on the 10 Principles of PIPEDA
(Privacy Commissioner of Canada, 2019).
PIA ( Cont.)
Principle 4: Limiting Collection of Personal Health Information
Kelburn Recovery Centre believes in collecting PHI in a lawful manner and on a ‘need-to-know’ basis, in order to provide its patients with the best in-class experience.
Principle 5: Limiting Use, Disclosure and Retention of Personal Health Information
The usage, disclosure and retention of PHI is only intended for the purpose for which it was collected. A patient’s personal health information may only be disclosed to a third party if a patient signs an informed consent for the same, or if it is required by law to do so.
Principle 6: Accuracy of Personal Health Information
Kelburn Recovery Centre takes special steps to ensure that the PHI of patients is accurate, complete and kept up-to-date to provide the best care to them.
(Privacy Commissioner of Canada, 2019)
PIA ( Cont.)
Principle 7: Safeguards for Personal Health Information
Kelburn Recovery Centre ensures that all PHI is kept and maintained in a secure manner. Various hardware, software and technical safeguards are set into place to ensure its complete safety against potential threats and breaches.
Principle 8: Openness about the management of personal information
Kelburn Recovery Centre provides public disclosure of information about its policies related to the management of its patients’ PHI. It makes sure that such policies are constantly revised, kept up to date and readily available for public consumption.
(Privacy Commissioner of Canada, 2019)
Principle 9: Individual access to, and amendment of Personal Health Information
An individual must be informed of the nature, use and disclosure of their PHI upon request, and access to that information must be provided, should a patient demand the same. Patients have the right to question the accuracy and completeness of their PHI information and have it corrected, if needed.
Principle 10: Complaints Handling of Personal Health Information
Should a patient need to raise a complaint or challenge Kelburn Recovery Centre’s compliance with the principles of PIPEDA, they can do so by meeting with the Chief Privacy Officer at our Centre.
PIA (Cont.)
(Privacy Commissioner of Canada, 2019)
CONFIDENTIALITY QUIZ
Quick Confidentiality Quiz
Now let’s reflect and test what we have learnt so far on patient confidentiality.
Question 1
Q1) Patient- related information that should be protected:
a) Clinical information
b) Demographic information
c) Financial information
d) All of the above
d) All of the above
And the correct answer is...
Q2) When should covered entities share the Notice of Privacy practices?
a) If the patient requests it
b) Every time the patient presents for care.
c) No later than the second visit
d) At all times
Question 2
a) If the patient requests it
And the correct answer is...
Question 3
Q3) Which of the following is considered a breach of confidentiality?
a) Two physicians discuss a mutual patient in the elevator
b) A worker reviews the medical record of their parent
c) A receptionist views lab results for HIV test of a patient out of curiosity
d) All of the above
d) All of the above
And the correct answer is...
Question 4
Q4) Professionalism can be defined as exhibiting courteous and business-like behaviours in the workplace. Which of the following is an example of professionalism?
a) Adhering to legal standards
b) Arriving for work on time
c) Maintaining appropriate dressing attire and body language
d) All of the above
d) All of the above
And the correct answer is...
Q5) Consider the following scenario and select the most appropriate response:
A patient calls to schedule an appointment and is hard of hearing. They have asked that you speak up so they can hear you better.
a) Speak louder, as the patient requested.
b) Apologize and explain that you don't want to do that. Other patients may overhear.
c) Move to a more private location so no one overhears your conversation.
d) Transfer the call to someone else.
Question 5
c) Move to a more private location so no one overhears your conversation.
And the correct answer is...
REFERENCES
References
Global Knowledge Solutions Organization. (n.d.). How protected is your organization
from cyber-attack? Retrieved on February 19, 2020 from https://www.intuition.com/vulnerable-organization-cyber-attack/
Hitachi Systems Security Admin. (2018). Penetration Testing vs. Vulnerability
Assessment. Retrieved on February 21, 2020 from https://www.hitachi-systems-security.com/blog/penetration-testing-vs-vulnerability-assessment/
Kelburn Recovery Centre. (n.d.). Admission. What is provided?. Retrieved on
February21, 2020 from https://www.kelburnrecoverycentre.com/services/admission/
Office of the Privacy Commissioner of Canada. (2019). PIPEDA fair information
principles. Retrieved on February 20, 2020 from https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/p_principle/
Office of the Privacy Commissioner of Canada. (2011). Privacy Impact Assessments:
Frequently asked questions. Retrieved on February 20, 2020 from https://www.priv.gc.ca/en/privacy-topics/privacy-impact-assessments/02_05_d_33/
Tunggal, A. T. (2020). Why is Cybersecurity Important? Retrieved on February 19,
2020 from https://www.upguard.com/blog/cybersecurity-important
Veracode. (n.d.). Vulnerability Assessment and Penetration Testing. Retrieved on
February 21, 2020 from https://www.veracode.com/security/vulnerability-assessment-and-penetration-testing.