Canada — Manitoba, Saskatchewan, Nova Scotia and New Brunswick — Provincial Annexes
Document IDs: ANX-CA-MB, ANX-CA-SK, ANX-CA-NS, ANX-CA-NB · Version: 1.0 each · Effective date: [[TO CONFIRM: publication date]]
Language: English. For New Brunswick, a French version is offered, and the Clinic chooses the version it accepts. Both versions are equally authoritative. [[TO CONFIRM: French version of ANX-CA-NB produced before New Brunswick clinics are offered the choice]]
Applies to: Clinics in the named province. Only the section for the Clinic's province applies. Each section is part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
Status by province. The SK and NB sections are offered now. The MB and NS sections are not offered to new Clinics until DentalX records every read access to patient data (MDPA Schedule 2, C.12), which Man. Reg. 245/97 s. 4 and PHIA-NS s. 63 require. An existing Manitoba or Nova Scotia Clinic accepts its section now, with the dated logging plan in MB-4(d) or NS-4.
Common provisions for all four sections.
- Trustees and custodians. The trustees or custodians listed in the acceptance certificate are parties to the section for their province. That list covers each dentist or other regulated professional who holds patient records, or the Clinic where it is itself the trustee or custodian. The section is accepted as MDPA clause 21 provides. A trustee or custodian who joins later accepts it before creating patient records.
- Provincial law applies. The provincial statute applies to the health information whatever law governs the commercial relationship. Nothing in the Terms or the MDPA waives or limits a trustee's or custodian's duties, or VstreamX's duties, under it.
- Agency for statutory purposes. Section 22 of the Terms says the parties are independent contractors. That statement does not prevent VstreamX from being an agent or information manager for the purposes of the provincial statute.
SECTION MB — Manitoba: Information Manager Agreement (PHIA, s. 25)
MB-1. Roles
Roles. VstreamX is an information manager under section 25 of The Personal Health Information Act (Manitoba) ("PHIA"). Each listed trustee provides personal health information to VstreamX so that VstreamX can:
- process, store and destroy it; and
- provide the trustee with information management and information technology services through DentalX (PHIA s. 25(2)).
Deemed maintained by the trustee. Personal health information provided to VstreamX is deemed to be maintained by the trustee for the purposes of PHIA (s. 25(5)).
MB-2. Protection against risks (s. 25(3))
VstreamX protects the personal health information against such risks as unauthorised access, use, disclosure, destruction or alteration, by the measures in MDPA Schedule 2 and this section. Those measures meet the requirements of the Personal Health Information Regulation (Man. Reg. 245/97, the "Regulation").
MB-3. Same requirements as the trustee (s. 25(4))
VstreamX complies with:
- (a) the same requirements concerning the protection, retention and destruction of personal health information that PHIA and the Regulation impose on the trustee; and
- (b) the duties imposed on it by this section and the MDPA.
MB-4. Security covenants mirroring the Regulation
VstreamX:
- (a) Policies. Maintains written security policies and procedures for DentalX (Reg. s. 2).
- (b) Need to know. Limits its personnel's access to personal health information to those who need it to carry out their duties, and to the information they need (Reg. ss. 2–3).
- (c) Pledges. Requires each member of its personnel with access to personal health information to sign a pledge of confidentiality. The pledge includes an acknowledgement that they are bound by the security policies and are aware of the consequences of breaching them (Reg. s. 7).
- (d) Record of user activity. Has DentalX create and maintain a record of user activity for every access, including every read: the person who accessed the information, the time and the information accessed, as the Regulation requires for an electronic information system (Reg. s. 4). VstreamX keeps the record for at least 3 years and makes it available to the trustee on request and through export. This record is a condition for offering DentalX to new Manitoba Clinics. Until it is live, DentalX's audit trail records chart openings, exports, deletions and changes only, and for an existing Manitoba Clinic VstreamX delivers the full record on this dated plan: [[TO CONFIRM: dated plan for read-access logging]].
- (e) Biennial audit. Cooperates with the trustee's audit of its security safeguards, which must be carried out at least every two years (Reg. s. 8). For this, VstreamX provides the information in MDPA clause 12.1 and allows the audit in MDPA clause 12.2.
- (f) Remedying deficiencies. Promptly corrects any deficiency the audit identifies, and tells the trustee what it has done.
MB-5. Breaches
Notice to the trustee. VstreamX notifies the trustee within the 24 hours of MDPA clause 9 of any theft or loss of, or unauthorised access to, use of or disclosure of, personal health information.
What the trustee must do. This allows the trustee to notify the individual as soon as practicable, where PHIA requires, and the Manitoba Ombudsman in the prescribed form.
VstreamX's own duty. VstreamX also meets its own duties under PIPEDA (MDPA clause 9.4).
MB-6. Retention
The trustee's retention. The trustee keeps its records for the period its regulatory body requires [[TO CONFIRM: Manitoba Dental Association retention requirement; the matrix's working default is at least 10 years, and for minors until age 28]].
No auto-deletion. DentalX does not auto-delete clinical records.