Privacy Props for my Summer Employer

Nice to see this news release from the Office of the Information and Privacy Commissioner of Alberta.

NEWS RELEASE
August 14, 2007

Commissioner applauds Privacy Impact Assessment of Alberta Cancer Board

Alberta’s Information and Privacy Commissioner says advancing electronic health records and protecting privacy is not a zero-sum game. Frank Work was responding to a recent advancement in e-health by the Alberta Cancer Board.

The Board has introduced a new reporting tool, developed by Alberta surgeons, which will gradually replace the standard narrative operative report. The Alberta Web Surgical Medical Record (WebSMR) allows surgeons to access the system immediately after a surgery and, using a survey style electronic template, enter an operative note which replaces the need for transcription and provides timely reporting for care purposes. The system collects only the minimum information needed to meet the program’s goals, and individual surgeons only have access to their own patients’ records.

The Information and Privacy Commissioner is pleased that the Alberta Cancer Board completed a comprehensive Privacy Impact Assessment prior to launching the system. “I am very encouraged to see a Privacy Impact Assessment which means the Board is serious about protecting patient privacy. I have been talking about the need for Privacy Impact Assessments for quite some time, and I think other agencies and public bodies can learn from this”, said the Commissioner. “This is the kind of patient benefit we want from electronic information systems. By doing the Privacy Impact Assessment, we believe the Alberta Cancer Board has proven the need for the program and has taken reasonable steps to address privacy and security issues.”

The Privacy Impact Assessment was submitted to the Office of the Information and Privacy Commissioner for review, and Work likes the cooperative approach. “We were able to review all of the privacy measures of this new system, check to see whether custodians are using the least amount of health information needed, whether users of the information will gain access on a need to know basis and whether information security is in place. In this case we are satisfied the Board took proper privacy measures”.