Translational & Personalized Medicine Initiative

Privacy & Confidentiality

Objectives

• To discuss privacy, confidentiality and security of personal, health and other data related issues.

• To discuss types of data both research and clinical

• To describe data access and authorization to access.

Privacy

Privacy refers to individual rights: the right to limit and control the disclosure of personal information.

Confidentiality….

Confidentiality refers to our obligation to ensure that information is only accessible to those who are authorized to have it.

What is your Responsibility?

It is everyone’s responsibility to think about what you share and with whom you share it!

What did you state in your ethics application? • Is the person you are sharing this with a part of the team? • Do they need to have all of the information or a portion? • If you are sharing, can the way you are sending data identify

the person, if so, should it?

Types of Information

Health Record • Facts of an individuals’ health history • The health record – physical property of the facility • The Information – property of the client

Organizational Information • Files – Organizational • Letters, Emails • Administrative Records

Types of Information - DATA • Identifiable data: Information that may reasonably be expected to

identify an individual, alone or in combination with other available information. May also be known as “Personal Information”.

• Directly identifying information: The information identifies a specific

individual through direct identifiers (e.g., name, social insurance number, personal health number).

• Indirectly identifying information: The information can reasonably be

expected to identify an individual through a combination of indirect identifiers (e.g., date of birth, place of residence or unique personal characteristic).

Adapted from TCPS2: Ethical Conduct for Research Involving Humans 2010

Legislation

• Regional Health Authority Act • Access to Information & Protection of Privacy Act • Personal Health Information Act

*Frameworks for the collection, use and disclosure of personal information

Access to Information and Protection of Privacy Act

• Promotes transparency and accountability • New bill passed on June 15th, 2015 • IAPP Office: www.mun.ca/iapp • Privacy policy: www.mun.ca/policy/site/policy.php?id=228

• Information request policy:

www.mun.ca/policy/site/policy.php?id=227

Access to Information and Protection of Privacy Act cont’d

• Privacy: – Mandatory reporting of privacy breaches by

individuals to the IAPP Office which gets forwarded to the OIPC

– Willful (not necessarily malicious) privacy breach is an offence

– Accessing (or attempting to) personal information not needed to perform a work task is an offence

• Best practices for information handling: – Use encrypted devices (USBs, laptops, etc.) – Use remote access when working from home

Privacy Breaches

Occur when there is unauthorized collection, use, or disclosure of personal information or personal health information. Examples: Accessing information that you do not need to know to do your work Discussing cases in a social gathering Sharing your passwords or leaving your computer unattended while logged on

Obligations

Researchers in any capacity (RA, RN, MD, PhD) have a moral, ethical and legal obligation to honor others’ right to privacy and especially maintain confidentiality of a client’s personal & information.

Security

• Data must be kept secure at all times!

• Researchers must ensure the safeguarding of

data and information against loss, accidental or intentional destruction and corruption.

Security

Laptops, Blackberries, I phones & Flash drives must be kept secure Filing cabinets should be locked Files must be transported in a secure manner both internally and externally Do not leave files unsecured in your vehicle Use encrypted drives only

Security – Computing

Role Based Access Control • A user has access to an object based on the assigned role. In the case of

CHIA, data being analyzed, stored or acquired for a researcher, the PI or designate in consultation with CHIA staff will define the user and grant the access to that dataset.

• Roles are defined based on job functions. • Permissions are defined based on job authority and responsibilities within

a job function. • Operations on an object are invocated based on the permissions. • The object is concerned with the user’s role and not the user.

Privilege • Roles are engineered based on the principle of least privileged.

Security

Identifiable data is not permitted to be sent via e mail. Identifiable data should be sent via VPN and encrypted Confidential information should be destroyed in a secure manner (paper – shredded in locked bins)

How to Maintain Confidentiality with Data <Layer the Data>

ID#_____CODED_ Gender____Age____ or Year of Birth___ Family Dr. _______________ First 3 digits of Postal Code_______________ Family home life: 2 parents in the home______ parents divorced________ parents never married_____ 1. Type of suicide attempted List activity:___________________ 2. Outcome Dead______ Alive_____ Alive with impairment_______ 3. Number of previous attempts________

**The red areas indicate ways to minimize the risk of identifying a person. Use year of birth instead of birthday. Do you need to know the name of the family Dr.?

Vignette #1

A researcher wishes to study a group of patients with a rare genetic condition. Database will contain the following. Name_________ Code_____Gender_____ Mutation +/- ___ Family ID code:______ Affected Y/N____ DOB_____ Address_____ DNA obtained_____ FHQ:Y/N___

Can’t always de-identify data

Paul with Orangeman’s Disease

• Paul is a member of a huge family with this recessive condition they lose sight at an early age, have kidney failure, freckles and red hair.

• Name necessary? ?Linkages required, pedigrees etc.

• From Fergville (Address) • Kidney failure starts after 30 years of age

(?Age necessary)

Response to Vignette #1

When looking at what is being collected you need to wonder if they are collecting it for a particular reason. If so how can you mitigate the risk to the patient? 1. If you have to have the name how can you protect it? 2. Why can address be such an issue? It’s a big province

after all! Rare condition might be in one small out port so the person could easily be identified.

3. If it a medical type project and you need particulars on someone can’t DOB be ok in that instance?

4. What are the big risks to the participant in this instance?

Vignette #2

A database contains information about elderly in LTC and their over or under of certain drugs: The following is going to be included in the dbase 1. Name 2. Age 3. Name of Home_____ 4. MCP_____ 5. List of medications______ 6. Diagnosis:________ 7. NLPDP Drug Card______

Response to Vignette #2

1. Don’t need the name 2. Possibly age group (65-75, 76-85 etc.) 3. Name of home or better if you could use RHA **If it is a small home in a small community it might be identifiable so it would be best if you could mask that.

Memorial University Privacy Officer:

Ms. Rosemary Thorne rosemaryt@mun.ca

All employees of Memorial University are responsible for the protection of the privacy of students, employees, alumni, donors, research participants, retirees and others whose personal information is in the custody and/or under the control of the University. All employees are expected to undertake privacy awareness training authorized by the University's Information Access and Privacy Protection (IAPP) Office.