OTNhub Teleophthalmology Program: Description of Services

The Teleophthalmology Program provided by Ontario Health supports retinopathy screening across the province by providing a store forward service for the sharing and storage of ocular images and timely access to specialists for consultations that require visualization of an image. Ontario Health makes available the use of store forward technology to allow for data and images to be captured, stored, and shared for later use. The referring physician sends patients for retinal screening at a teleophthalmology site. Patients will undergo testing and the data generated is then securely forwarded or “uploaded” to an ophthalmologist for centralized reading of images and to support use cases such as diabetic retinal screening assessment, diagnosis and/or treatment recommendations. The digital images are ‘stored’ on secure servers with restricted access based on role and on a need-to-know basis.

The Teleophthalmology Program uses a secure web-based connection and software that allows referring and consulting health care providers to capture and review digital images of the retina. In connection with the Teleophthalmology Program, Ontario Health uses a third-party hosted solution – iVision SCREEN - a cloud-based, commercial off-the-shelf web-based solution designed exclusively for eye care and retinal screening programs sourced from Retina Labs. The iVision SCREEN is a standalone and self-contained web application that users will access through a web browser provided by Ontario Health. It integrates ocular imaging, clinical workflows and reporting into a single-source solution. The iVision SCREEN solution is hosted, on behalf of Ontario Health, in a cloud-based solution located in Canada including backup facilities. As the service provider, Ontario Health is responsible for delivering the Teleophthalmology Program to individuals and organizations in Ontario, as well as supporting the recruitment and provisioning of new users and providing change management guidance to promote growth. Ontario Health has assessed the services used for the Teleophthalmology Program to ensure compliance with PHIPA and mitigate any identified risks and maintains an agreement with Retina Labs that requires compliance with PHIPA.

Safeguards

For information about Ontario Health safeguards, visit Safeguards for the Protection of Personal Information and Personal Health Information.

Retina Labs Administrative Safeguards

Teleophthalmology adheres to a privacy policy to ensure PHI is protected. This policy includes the following:

• Privacy and Security policies and procedures are in place as set out in frameworks. Upon hire, personnel are required to complete mandatory privacy and security training courses in accordance with applicable laws, including PHIPA.
• Employees sign an Employment Agreement; as well as an annual Confidentiality Agreement, in addition to having to comply with various HR/Privacy/Security Policies outlining user responsibilities.
• Personnel with access to Personal Health Information are required to undergo Criminal Background Checks.
• There are designated Privacy and Information Security team personnel to lead the compliance efforts.
• The flow-down of all such requirements to any subcontractors.

Retina Labs Physical Safeguards

• The Retina Labs production servers hosting the Teleophthalmology Service are in a cloud-based data centre located in Canada with strict physical access controls, including access controls, security guards, and Closed-circuit television (CCTV) monitoring.

Retina Labs Technical Safeguards

• All data is transmitted through encrypted HTTPs channels.
• Access to the Teleophthalmology solution is password protected, using industry recommended password complexity requirements.
• Teleophthalmology data resides on a server that is both logically and physically segregated from other servers and services. The servers, including for contingency plans and data backup, are in Canada.
• All activities on the Teleophthalmology solution are logged and available for review as required including routine audits of access and changes.
• The program employs a role-based access control.

See our Contact page to find information on how to contact the Ontario Health Privacy Office.