Therapist Assisted Internet-Based Cognitive Behaviour Therapy(iCBT) Solution for Depression, Anxiety and Post Traumatic Stress Disorder (MindBeacon): Description of Services

The Mental Health and Addictions Center of Excellence at Ontario Health was established to support the delivery and implementation of the provincial Mental Health and Addictions strategy. A key component of achieving this strategy is providing coordinated access to mental health services through the implementation of the Ontario Structured Psychotherapy (OSP) program.

The OSP program provides access to evidence-based, short-term, cognitive behavioural therapy (CBT) and related approaches to Ontarians with depression and anxiety-related conditions, with no out-of-pocket costs to participants. The program is delivered through 10 regional psychotherapy networks as a coordinated provincial program. Adopting a ‘hub and spoke’ model, each network is comprised of several organisations working collaboratively to administer and deliver high-quality services for individuals (collectively, ‘clients’ and individually a ‘client’) within a defined region of Ontario.

Access to the program is centralized within each network which means that all individuals are referred directly to a Network Lead Organization (NLO) for screening and assessment. Following the centralized screening and assessment process, clients are directed to the service that best meets their needs with all available and appropriate client data. Based on ongoing monitoring of client progress throughout treatment, clients will either complete treatment or be referred back to the NLO for service navigation, as required.

The Ministry of Health has provided funding to Ontario Health to add an iCBT service offering to the OSP program as another treatment option available to eligible and interested OSP clients. The Mental Health and Addictions Center of Excellence is collaborating with external stakeholders, including the Provincial System Support Program (PSSP) from the Centre for Addiction and Mental Health (CAMH) and the Ministry of Health to acquire and implement the iCBT service.

Given that personal health information (PHI) is being collected, used, stored, and disclosed as a function of the iCBT solution, Ontario Health has mandated that a Privacy Impact Assessment (PIA) be conducted to ensure that the information is privacy-protected. The PIA focused on the iCBT service provided by MindBeacon that will be embedded into the OSP model and implemented as an available service offering at each of the NLOs.

MindBeacon Services

Ontario Health has procured the MindBeacon service for use within the OSP program. MindBeacon will receive client referrals from NLOs through the MindBeacon portal. The application's collection of PHI comes from Clients (account setup/enrollment, questionnaires), Therapists (for example, case notes), and NLOs (pre-loaded via .csv files prior to Client enrollment). PHI will be disclosed to NLOs for service navigation, and to CAMH as an Agent (as defined in the Personal Health Information Protection Act (PHIPA)) to MindBeacon for the reporting and evaluation function.

SAFEGUARDS

For information about Ontario Health safeguards, visit Safeguards for the Protection of Personal Information and Personal Health Information.

MindBeacon Administrative Safeguards

• MindBeacon has implemented privacy and security programs, policies and procedures as set out in frameworks. Upon hire, personnel are required to complete mandatory privacy and security training courses in accordance with applicable laws, including PHIPA.
• Employees sign annual Confidentiality Agreement and have to comply with various HR/Privacy/Security Policies outlining User Responsibilities.
• There are designated Privacy and Information Security team personnel to lead the compliance efforts.
• The requirements flow-down to all subcontractors utilized in the OSP program.
• Users are granted access to the minimum amount of data required to perform their job functions. This applies equally to users of the MindBeacon platform and technical resources involved in development and maintenance.
• MindBeacon utilizes their cloud provider for fundamental audit event tracking, which captures infrastructure changes regardless of circumstances. In addition, the MindBeacon platform provides service and application-level security auditing.
• Therapists are also governed by privacy obligations set by applicable governing regulatory colleges.
• MindBeacon has implemented policies and procedures to manage privacy and security incidents and breaches.

MindBeacon Physical Safeguards

• MindBeacon applies strict access controls. Roles are regularly reviewed and modified to ensure they meet minimum access requirements. Roles are assigned to users on an individual basis as part of the user onboarding.
• Corporate laptops are provided to therapists to access client files.
• Production servers hosting the service are located in a cloud-based data centre located in Canada with strict physical access controls, including access controls, security guards, and CCTV monitoring.

MindBeacon Technical Safeguards

• All data is transmitted through encrypted channels.
• The MindBeacon platform leverages role-based access using industry recommended password complexity requirements.
• MindBeacon uses a cloud-based platform for services and applications with various levels of security for infrastructure, system integration and applications programming interface (APIs).
• iCBT data resides on servers that are both logically and physically segregated from other servers and services. The servers, including for contingency plans and data backup, are located in Canada.
• Audit logs capture all access events and record “who” did “what” activity and “how” the system behaved. A log file event is logged indicating what action was attempted and if it was successful. Audit logs are stored in manner that prevent tapering. Access to audit logs is limited and tracked to avoid tampering.
• MindBeacon creates authentication credentials for therapists including multi-factor authentication.

See our Contact page to find information on how to contact the Ontario Health Privacy Office.