To Readers of this Resource Guide



OANHSS is pleased to provide its members with this resource guide on “Simplifying Privacy: a Tool Kit for Long-Term-Care and Community Care. It is intended as a practical compliment to the information provided at the October 30, 2003, Special Members Meeting on Privacy Compliance for the Not-for-Profit Sector.



In preparing this material we have sought further advice from three of the speakers with regard to the application of the Personal Information and Protection of Privacy Act (PIPEDA) to our sector.



Heather Black, Assistant Commissioner, Privacy Commissioner of Canada provided clarification on the application to municipal programs and services. Brendan Seaton, Chief Privacy & Security Officer, Smart Systems for Health Agency reviewed the complete tool to ensure it was not only comprehensive, but practical and readable. Patrick Hawkins, a lawyer with Borden Ladner, Gervais, LL.P advised us on the application of the federal Act to not-for-profit services and “commercial activities”.



Ms. Black’s interpretation of the federal privacy commissioner’s mandate indicated that organizations that are subject to the Ontario Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) (municipal and district homes, housing and community services) are not subject to PIPEDA. For specific information see Section 1 of the Guide.



As to the application of the Act to not-for-profit operations and “commercial activities” Mr. Hawkins points out the following:



“It is generally accepted that the traditional delivery of health care services (i.e. on a non-profit basis by non-profit companies), would not be captured under the definition of ‘commercial activity’. However, the courts have yet to consider the meaning of ‘commercial activity’ under PIPEDA.



PIPEDA may apply to any activities that are carried out by members on a for-profit basis. PIPEDA may also apply to your members’ fundraising activities, as this is something which is specifically considered in the Act. It is not possible to conclusively answer the question on these activities at this time, as the legislation is still relatively new, does not even potentially apply to your member organizations until January 1, 2004 and has not yet been interpreted by the courts.



That being said, whether or not PIPEDA actually applies to member organizations, I suggest that PIPEDA and the 10 principles of the CSA Code are a good model or guide for member organizations to use in developing their privacy policies. They reflect current privacy thinking. They are also in line with the health record privacy requirements that appear in many different provincial laws: for example, each of the Long Term Care Act, the Nursing Homes Act, and the Homes for the Aged and Rest Homes Act all include provisions on privacy; as well, staff people who are members of regulated health colleges must follow the privacy/confidentiality requirements of their own colleges under the Regulated Health Professions Act and its related legislation.



As well, while this obviously depends on the discretion of the new Ontario government, I think it is reasonable to expect that any new provincial privacy legislation will be similar in many respects to the federal law. The previous provincial drafts have all been similar to the existing federal law. Therefore, while your members will have to conduct a further review of their privacy policies if and when there is new provincial legislation, the steps that they take now to comply with the federal legislation will not be wasted and will likely take them a long way towards complying with any new provincial legislation.



As with any support to members such as this tool kit, we remind you to consult your own legal counsel as may be required.



With this advice in mind, OANHSS suggests that members begin to take measures to prepare themselves to respond to the privacy principles outlined in this tool-kit. It is suggested that organizations take the following initial measures by or shortly after January 2004:

• Appoint a privacy officer (job description page 38) 
• Initiate a work plan to implement a privacy program (page 20 and page 42) 
• Contact donors on their fundraising lists (letter on page 63 of the toolkit) 
• Introduce a process for handling complaints (page 78) 
• Obtain a letter from third party providers regarding privacy practices. 
• Begin working through the process outlined in the tool kit

Postscript:



While initially this Tool Kit is provided in hard copy only, our intent is to make the templates and tool available in an electronic format on our web site as soon as possible. When we do you will be able to click on an individual sample template or letter and it will automatically download to your computer. Because of this intent to provide the tools electronically, you will see that throughout this hard copy version of the kit there is reference to “For ready-to-use file go to hyperlink.” By leaving these references in the hard copy, you will be able to identify what will be accessible electronically in the near future.



We also direct you to the OANHSS web site to access the presentation slides from the October 30th workshop. The slides provide additional and valuable information for the members.