Data Privacy

All participating networks that make up the Canadian Primary Care Sentinel Surveillance Network (CPCSSN) meet Privacy by Design Principles, developed by the Information and Privacy Commissioner of Ontario.

These principles have been adopted by government ministries and privacy commissioner offices throughout the world as the standard for privacy and security of personal and health information. CPCSSN complies with the privacy legislation in each province and territory, and this includes meeting the Information Standards Organization (ISO) 27001/2 [WS1] that governs information system security and the Tri-Council Policy Statement of the Ethical Conduct of Research Involving Humans (TCPS2) [WS2] that governs the use of health information for research purposes.

• CPCSSN has completed Privacy Impact Assessments and Threat Risk Assessments across its participating networks. CPCSSN received the 2013 International Association of Privacy Professionals Privacy Innovation Award.
• CPCSSN does NOT extract all patient data. CPCSSN mainly extracts structured data, and only data managers who have undergone confidentiality training can view de-identified data.
• CPCSSN data are standardized. The data are then encrypted and stored in a secure repository that complies with the privacy legislation in each province and territory.
• Further de-identification tools are applied before data are released.

CPCSSN’s policies and procedures around the management of EMR data are inclusive of privacy, encryption, and security considerations, as they ultimately serve to build and maintain relationships with patients and primary care providers.

CPCSSN’s data are stored at the Centre for Advanced Computing (CAC) at Queen’s University, which is PHIPA, HIPPA and ISO 27002 compliant.