Saskatchewan Annex: Information Management Service Provider Agreement

SECTION SK — Saskatchewan: Information Management Service Provider Agreement (HIPA, s. 18)

SK-1. Roles and timing

Roles. VstreamX is an information management service provider under section 18 of The Health Information Protection Act (Saskatchewan) ("HIPA"). Each listed trustee provides personal health information to VstreamX so that VstreamX can:

• process, store, archive and destroy it; and
• provide the trustee with information management and information technology services through DentalX.

Executed before any information is provided. For a new Clinic, this section is executed before any personal health information is provided to VstreamX, as HIPA s. 18(2) requires. DentalX does not allow a new Saskatchewan Clinic to create a patient record until this section has been accepted.

Existing Clinics. For a Saskatchewan Clinic that used DentalX before this section was published, personal health information was provided under Section 8 of the Terms, which did not contain the content that HIPA s. 18(2) and the Regulations, 2023 require. This section remedies that from its acceptance date, which the acceptance certificate records as the remediation date. It governs the information already provided and all information provided afterwards.

SK-2. Content required by HIPA s. 18(2) and The Health Information Protection Regulations, 2023, s. 7

This section, with the MDPA:

• (a) Specific service. Describes the specific service VstreamX provides, in the schedule at SK-5.
• (b) Access and handling. Governs access to and use, disclosure, storage, archiving, modification and destruction of the information. VstreamX uses and discloses it only to provide that service (MDPA clauses 3, 4 and 7). It stores it in the locations in MDPA clause 13.1, modifies it only on the trustee's instructions, and destroys it as MDPA clause 14 provides.
• (c) Protection. Provides for the protection of the information by the safeguards in MDPA Schedule 2, which protect its integrity, accuracy and confidentiality.
• (d) Trustee control. Confirms that the trustee keeps control of the information, including the right to export it, have it returned and have it destroyed.
• (e) Notice of breach of the agreement. Requires VstreamX to notify the trustee at the first reasonable opportunity of any breach of this agreement, and of any unauthorised access to, use or disclosure of the information, in any event within the 24 hours of MDPA clause 9.
• (f) Return or destruction. Requires the return or destruction of the information at the end of the service, with written confirmation (MDPA clause 14.7).

[[TO CONFIRM: items (a) to (f) checked verbatim against s. 7 of The Health Information Protection Regulations, 2023]]

SK-3. Retention and destruction log

Retention. The trustee keeps its records for the period that applies to it: at least 10 years after the last date of care, or until the patient reaches age 20, whichever is longer.

The trustee's retention policy. The trustee keeps a written retention policy and a destruction log as the Regulations require (Regs. s. 6). DentalX provides:

• a retention policy builder; and
• a destruction log with the required fields.

Readable for the whole period. VstreamX ensures that information kept in DentalX remains readable for the retention period, including through the export formats.

SK-4. Breaches

VstreamX's notice under SK-2(e) allows the trustee to meet any notice duty it has under HIPA and its professional obligations [[TO CONFIRM: whether HIPA now contains an express duty to notify individuals and the Commissioner]]. VstreamX also meets its own duties under PIPEDA.

SK-5. Schedule: description of the specific service