Health Shared Services Ontario Privacy

While we do not directly provide care to Ontario patients, we do provide digital programs and tools to help health care organizations coordinate the delivery of patient care across multiple regions. We will have access to patients’ personal health information (PHI) when providing digital services to health care organizations. That access to PHI means that we are subject to privacy requirements outlined in the Personal Health Information Protection Act, 2004 (PHIPA) for service providers of health care organizations classified as health information custodians¹.

Securing Personal Health Information

Ontario Health maintains comprehensive and robust administrative, physical and technical controls, consistent with industry best practices, to protect the confidentiality, integrity and availability of personal health information while it is being transferred, processed or stored. There are multiple layers of security controls, including industry security best practices for:

• system protection
• encryption protocols
• firewalls
• physical access controls
• privacy impact assessments
• threat and risk assessments

All Ontario Health staff are required to complete privacy and security awareness training annually and sign confidentiality or non-disclosure agreements.

Health Information Custodians

Some health information custodians that use digital tools from the former Health Shared Services Ontario to support home and community care are:

• Home and Community Care Support Services organizations (formerly the 14 Local Health Integration Networks in Ontario)
• Ontario hospitals
• Long-term care homes
• Primary care
• Community support service agencies (that is, those agencies that are health information custodians)
• Health service provider organizations
• Emergency medical services

Our Role Under PHIPA for Legacy Health Shared Services Ontario Programs

Ontario Health manages patient information for the purposes of operating and maintaining information systems and digital support services. We conduct our services in compliance with PHIPA for our roles as follows:

Health Information Network Provider (HINP)

As a HINP, we provide services that allow two or more health information custodians, such as those listed in the previous section, to use electronic means to disclose PHI to each other.

When we take on the role of a HINP, we must adhere to the requirements outlined in the regulation that accompanies PHIPA². We have put in place measures to address all the stipulated requirements, some of which include the following:

• Providing to each applicable health information custodian a plain language description of the services that Ontario Health provides to the custodians including a general description of the safeguards in place
• Public posting of the plain language description of services (see the Statement of Information Practices)
• Documented protocols, specific to the HINP services
• Written agreements with each health information custodian organization that participates in the respective HINP service

We manage the following legacy Health Shared Services Ontario digital services as a HINP:

• Client Health and Related Information System (CHRIS)
• Health Partner Gateway
• Health Care Connect
• Integrated Assessment Record (IAR)

Electronic Service Provider (ESP)

As an ESP, we provide electronic services that allow a health information custodian to collect, use, modify, disclose, retain or dispose of personal health information.

When we take on the role of an ESP, we must adhere to the requirements outlined in the regulation that accompanies PHIPA³. We have put in place measures to address the stipulated requirements, some of which include the following:

• Agreements with health information custodians that describe the scope of electronic services provided
• Privacy controls that allow us to audit user access to any custodian data, to ensure the access was appropriate

We provide various digital support services as an ESP, which are mostly aligned with or emerge from the services we offer as a HINP and PHIPA Agent. ESP responsibilities are often customized for the needs of the health information custodian and the level of electronic services support required.

PHIPA Agent (Agent)

As an Agent under PHIPA⁴, we provide support services to health information custodians in the furtherance of the custodians’ objectives, as it relates to the custodians’ PHI. We have put in place practices to address any PHIPA requirements for agents⁵ for each relevant project, some of which include the following:

• Putting in place agreements with health information custodians that describe the scope of services we will provide
• Ensuring all services required by the health information custodian comply with PHIPA
• Confirming that existing privacy protocols are applied as they relate to the health information custodians’ PHI and any unauthorized activities

Most work we undertake as an Agent aligns with or emerges from the services we offer as a HINP. Agent responsibilities are determined by the scope of the services and are often customized for the needs of the health information custodian and the level of support required.

Digital Services and System Integrations Formerly Managed by Health Shared Services Ontario

Client Health & Related Information System

Client Health & Related Information System (CHRIS) is a web-based technology platform that holds the patient health records for each of the 14 Home and Community Care Support Services organizations in Ontario and 3 bundled care hospitals. CHRIS provides them with detailed client records, case-management tracking and support, while enabling health-system integration to and from the community. It allows their intake staff to assess patients, refer patients to community services, and initiate and execute on documented care plans.

We manage CHRIS in our role as a HINP and/or an ESP. We may also operate as a PHIPA Agent for some health information custodians registered for CHRIS.

CHRIS also provides users with access from the application to the following digital tools. These tools may be managed by Ontario Health (transitioned from other legacy agencies) or other health organizations.

• eNotification is a web-service interface managed by Ontario Health that enables participating HCCSSs to be notified via CHRIS when their active clients are:
  • visited by Emergency Medical Services
  • presented to a hospital emergency department
  • admitted to or discharged from an Ontario hospital
• eReferral is a web-service interface managed by Ontario Health that supports an automated method for a referring partner organization’s staff (acute-care hospital and primary care) to refer clients being discharged from a care setting to HCCSS for services. Referring partner users can refer a patient directly to an HCCSS organization from their system of record, which then automatically sends the information to CHRIS. Referrals are received by the intended HCCSS, right in CHRIS.
• Document Management System (DMS) is a patient-based document library managed by Ontario Health and integrated with CHRIS. A DMS provides secure storage for the personal health information of a single HCCSS. There is a DMS in place for each of the 14 HCCSS organizations, which is only for use by the authorized users of a specific HCCSS. The DMS includes, for example:
  • documents received as part of a patient referral from a hospital or family physician
  • updated medical referrals for a patient's treatment
  • documents completed by care coordinator
  • reports completed and received from contracted service providers
  • communications from long-term care (LTC) homes
• Bed Board Management is a bed inventory management tool, managed by Ontario Health and used by HCCSSs for long-term care, complex care and rehabilitation placement. It matches patients waiting for service to suitable provider organizations such as long-term care, short stay or respite. It also allows long-term care homes and hospitals to view a waitlist for bed types and services at their organization.
• ConnectingOntario is a tool managed by Ontario Health that enables health care providers and health organizations to share and access electronic patient information across the care continuum. Clinicians can securely access their patients' health information through a clinical viewer (portal) and/or via their electronic medical record system. CHRIS users can seamlessly access the patient health information available through the clinical viewer.
• Resource Matching & Referral (RM&R) is a shared web-based system hosted by the University Health Network containing personal health information in the form of referrals. The RM&R integration is expected to launch within the CHRIS application in the fall of 2023. RM&R matches patients to appropriate clinical programs and services such as acute care, rehabilitation, complex continuing care, home care and long-term care. Once launched, the Toronto Central and Central HCCSSs will be able to access RM&R directly from CHRIS.
• Ontario Ministry of Health has server connections with the CHRIS application that allow users in CHRIS to validate a patient’s identity and health card data, and use a single sign-on service to access other digital health platforms (where available). A connection in CHRIS also is in place to streamline Ontario Drug Benefit authorizations.

Health Partner Gateway

Health Partner Gateway is a portal application system that supports the timely and secure exchange of information between an HCCSS and a service provider. Service providers can access Health Partner Gateway to receive and respond to service offers, and access referrals and important patient records required for quality health care delivery. This allows HCCSS care coordinators to receive prompt patient status updates to better coordinate patient care.

Health Partner Gateway is managed by Ontario Health in our role as a HINP.

Health Care Connect

Health Care Connect is an application that helps Ontario residents who do not have a family physician to find one in their region who has agreed to take on new patients. Unattached patients can register with a valid OHIP card and complete a health questionnaire to determine their needs for family health care services. Submitted questionnaires are reviewed by a care coordinator at one of the HCCSSs, and patients are notified by mail when a suitable match is made to an available physician in the region. Data in Health Care Connect may be shared between regions and with those physicians’ offices that accept new patients.

The Health Care Connect infrastructure is managed by Ontario Health in our role as a HINP.

Integrated Assessment Record

The Integrated Assessment Record is a clinical assessment repository managed by Ontario Health. This repository allows authorized users to view a consenting patient’s assessment information to effectively plan and deliver services to that patient. Assessments are conducted by care coordinators in different assessment tools; copies are submitted and stored in the Integrated Assessment Record only if the patient grants their express consent. Assessments in the Integrated Assessment Record are viewable by staff in HCCSSs, hospitals and long-term care homes, and other health partners who a need to view the data to provide care to the patient.

The Integrated Assessment Record is managed by Ontario Health with the express consent of each patient.