OTNhub Personal Computer Video Conferencing Host System: Privacy Recommendations

The following safeguards are recommended to protect patient privacy and support Ontario Health (OH) in meeting its obligations under the Personal Health Information Protection Act, 2004 (PHIPA):

• Create a list of those staff members (that is, the member organization’s primary and back-up contacts) who have been authorized to use the organizational videoconferencing account and have the login credentials to access the system. The list shall include the name of the individual(s), their role at the organization and their contact information. The member organization should ensure the list remains up to date.
• Maintain schedules which document the dates and times during which the primary and back-up contacts are scheduled to use the organizational videoconferencing account. The member should ensure the schedules are retained for a minimum of two years and that the schedules accurately capture who accessed and used the organizational videoconferencing account during a given period. The schedule will be provided to Ontario Health on a per-request basis to facilitate privacy incident management activities as required. The schedule will be used to determine which authorized users performed activities under the organizational videoconferencing account during any period in question and will support Ontario Health’s audit capabilities in the event of a breach.
• Ensure that the OTNhub videoconferencing unique account(s) and credentials being set up are limited to and not shared beyond the member organization’s primary and back-up contacts identified for and assigned.
• Ensure that the primary and back-up contacts who have been authorized to use the organizational videoconferencing account are informed:
  • that login credentials for the organizational videoconferencing account are to be kept confidential and not to be shared with any individuals who have not been authorized to access the system or shared externally;
  • the importance of maintaining the accuracy of the schedules referenced above, as well as the purpose of the schedules and their role in supporting incident investigation and management
  • of their responsibility to obtain patient consent as it relates to appointments using the OTNhub personal videoconferencing solution
• Best practice is to use the OTNhub Personal Computer Videoconferencing (PCVC) solution on a dedicated desktop computer or mobile device such as a laptop or tablet, and on equipment that does not have other applications or sensitive information.
• Lock up, secure (when not in use) and encrypt mobile devices and desktops used to operate the organizational videoconferencing account.
• Instruct authorized users of the organizational videoconferencing system to stay in the room with the patient before and immediately after their appointment where appropriate, and/or to monitor the room and/or the equipment being used to host the patient when using a mobile device or if the equipment being used could inadvertently give access to other applications or sensitive information.