Canada — Alberta — ANX-CA-AB: Information Manager Agreement
Document ID: ANX-CA-AB · Version: 1.0 · Language: English · Effective date: [[TO CONFIRM: publication date]]
Applies to: Clinics in Alberta. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
1. Parties
1.1 The parties. This Annex is the information manager agreement under section 66 of the Health Information Act (Alberta) (the "HIA") and section 7.2 of the Health Information Regulation (the "Regulation"). It is made between:
- each custodian listed in the acceptance certificate (each a "Custodian"); and
- VstreamX, as information manager.
1.2 Who the custodians are. Each Custodian is a regulated member of a health profession who is a custodian under the HIA, such as a dentist, dental hygienist or denturist. Each is listed with their regulatory college and registration number, which signup requires.
1.3 How it is accepted. This agreement is made with each Custodian separately. It is accepted in one of two ways:
- by each Custodian individually; or
- by the signatory on behalf of each listed Custodian, with that Custodian's authority, as MDPA clause 21 provides.
1.4 Custodians who join later. A Custodian who joins the Clinic later must accept it, or be added on these terms, before creating patient records in DentalX.
2. Responsibility stays with the Custodian
- Custody and control. Each Custodian retains custody and control of the health information of its patients that VstreamX processes, stores or manages. It remains responsible for compliance with the HIA (HIA s. 66(6)).
- VstreamX's duty. VstreamX complies with the HIA, the Regulation and this agreement in respect of that health information (HIA s. 66(5)).
3. Content required by section 7.2 of the Regulation
| Reg. s. 7.2 | Requirement | How this agreement meets it |
|---|---|---|
| (a) | Identify the objectives of the agreement and the principles to guide it | Objectives: to enable the Custodian to use DentalX to collect, use, store and manage its patients' health information in providing dental care. Principles: use and disclosure of the least amount of information, at the highest level of anonymity, on a need-to-know basis (HIA ss. 57–58); protection of confidentiality and integrity (HIA s. 60); the Custodian's control. |
| (b) | Indicate whether the information manager may collect health information from any other custodian or person and, if so, describe it and the purpose | VstreamX does not collect health information from other custodians. It receives health information only from the Custodian and its Users, and from patients' own actions in the Service at the Custodian's request (for example signing a consent form or confirming an appointment), for the purposes in MDPA Schedule 1. |
| (c) | Indicate whether the information manager may use the health information and, if so, describe it and the purpose | VstreamX uses the health information only to provide, secure, back up and support DentalX for the Custodian (MDPA Schedule 1 and clause 4). It does not use it for any purpose of its own, including training AI models. |
| (d) | Indicate whether the information manager may disclose the health information and, if so, describe it and the purpose | VstreamX discloses health information only: (i) to the Sub-processors in MDPA Schedule 3, for the services listed there; (ii) to the recipients the Custodian chooses when it sends emails or WhatsApp messages through DentalX; and (iii) where a law requires, under MDPA clause 16. |
| (e) | Describe the process for responding to access requests under Part 2 of the HIA, or for referring them to the Custodian | VstreamX does not respond to access requests. It refers any request it receives to the Custodian within 2 business days (MDPA clause 8.3). It assists the Custodian within 5 business days, and the Service lets the Custodian export a patient's record itself. |
| (f) | Describe the process for responding to requests to correct or amend health information, or for referring them to the Custodian | As item (e). The Service lets the Custodian correct or annotate a record itself. |
| (g) | Describe how the health information is to be protected, managed, returned or destroyed in accordance with the HIA | Protection: MDPA Schedule 2 and clause 6. Management: MDPA clauses 3, 4, 5 and 7. Return and destruction: MDPA clause 14 (complete export, then deletion within the stated periods). |
| (h) | Describe how the information manager is to address an expressed wish of an individual relating to the disclosure of their health information, or the process for referring it to the Custodian | VstreamX refers any such wish to the Custodian. The Custodian records the wish, and the masking or restriction it decides, in the patient's record. VstreamX does not disclose information except as item (d) allows. |
| (i) | Set out how the agreement can be terminated | This agreement ends when the Custodian's use of DentalX ends and the information has been returned and destroyed (MDPA clauses 14 and 20). A Custodian who leaves the Clinic may terminate it for its own patients' records by notice in the Service. A transfer of records to another custodian is handled by the Clinic's export. |
[[TO CONFIRM: items (a) to (i) checked against the current text of s. 7.2 of the Health Information Regulation]]
4. Storage outside Alberta
4.1 Where the information is. The health information is stored and processed outside Alberta:
- by VstreamX in Manitoba; and
- by its Sub-processors in the United States and other countries (MDPA clause 13.1 and Schedule 3).
4.2 Terms for storage outside Alberta. VstreamX agrees to the following terms [[TO CONFIRM: the exact requirements of the current Regulation for storage outside Alberta (s. 8(4) as cited in the matrix)]]:
- (a) Custodian control. The Custodian keeps control of the information, including the right to export it at any time and to have it returned and destroyed (MDPA clause 14).
- (b) Risk treatment. VstreamX identifies the risks of storage outside Alberta in the PIA support it provides (clause 5), and applies the measures in MDPA Schedule 2 to treat them.
- (c) Safeguards. VstreamX applies the reasonable administrative, technical and physical safeguards in MDPA Schedule 2. These protect the confidentiality, privacy and integrity of the information against reasonably anticipated threats and unauthorised use, disclosure or modification (HIA s. 60).
- (d) Monitoring. The Custodian may monitor VstreamX's compliance through the audit trail, the information in MDPA clause 12.1 and audits under MDPA clause 12.2.
- (e) Remedies. If VstreamX breaches this agreement, the Custodian may require it to remedy the breach without delay. If the breach is not remedied, the Custodian may terminate with export. MDPA clause 17.2(c) applies to any handling of information outside the Custodian's instructions.
5. Privacy impact assessment
5.1 Before patient data is entered. Before using DentalX to collect, use or disclose health information, each Custodian prepares a privacy impact assessment and submits it to the Office of the Information and Privacy Commissioner of Alberta ("OIPC") under section 64 of the HIA. One assessment may be submitted for all the Custodians of the Clinic where the OIPC allows it.
5.2 What VstreamX provides. VstreamX provides a pre-filled HIA PIA kit in the format the OIPC uses. The kit contains the system description, data flows, safeguards, Sub-processors and the risks of storage outside Alberta.
5.3 Patient data gate. The Clinic cannot add patient records in DentalX until each Custodian (or the signatory on behalf of each) attests in the Service that the PIA has been submitted to the OIPC.
6. Information security policy
- The OIPC filing. Where section 64.2 of the HIA is in force and applies to VstreamX, VstreamX submits its information security policy for DentalX to the OIPC.
- Until then. VstreamX gives each Custodian a plain-language description of DentalX and its safeguards that meets section 64.2(6). [[TO CONFIRM: proclamation date and current text of HIA s. 64.2 as amended]]
7. Breaches
7.1 Notice to the Custodian. VstreamX notifies the Custodian within the 24 hours of MDPA clause 9 of any loss of, or unauthorised access to or disclosure of, health information in its custody.
7.2 What the Custodian must do. This allows the Custodian to assess the risk of harm. Where there is a risk of harm, the Custodian notifies, as soon as practicable:
- the OIPC;
- the Minister of Health; and
- the individual (HIA s. 60.1).
7.3 Assistance. VstreamX provides the information it holds for those three notices.
8. Retention
- The Custodian's duty. Under the Alberta Dental Association's standards, dental records must be kept for at least 10 years after the last entry, and for minors at least 10 years after the patient reaches 18. [[TO CONFIRM: current ADA standard reference]]
- No auto-deletion. DentalX does not auto-delete clinical records.
9. Applicable law
- The HIA applies. The HIA and the Regulation apply to the health information whatever law governs the commercial relationship.
- No waiver. Nothing in the Terms or the MDPA limits a Custodian's duties, or VstreamX's duties as information manager, under them.
Items to confirm before publication (Alberta)
- Publication date.
- Items (a) to (i), checked against the current text of s. 7.2 of the Health Information Regulation (§3).
- The exact requirements of the current Regulation for storage outside Alberta (§4.2).
- The proclamation date and current text of HIA s. 64.2 (§6).
- The current Alberta Dental Association retention standard (§8).