Lessons in Health Privacy: Key Takeaways from 2024 | La protection de la vie privée dans le secteur de la santé : principaux enseignements de 2024
In this episode, Commissioner Patricia Kosseim delves into significant health privacy cases of 2024 with her colleagues from the IPC. The conversation highlights challenges, practical takeaways, and lessons learned from recent cases and investigations under Ontario's Personal Health Information Protection Act. Whether you're a health care provider, privacy professional, or legal expert, this episode is packed with actionable insights you won’t want to miss.Episode Highlights:Ransomware attack on a medical imaging clinic and its implications for privacy and operations [2:28]LifeLabs cyber attack: joint investigations and key legal outcomes [8:55]Unauthorized access to patient files: training gaps and remedies [16:39]Abandoned health records: risks, regulatory actions, and preventative steps [26:02]Obligations under PHIPA when abandoned records are discovered [31:41]Key Lessons:Proactive approaches to data breaches, including secure backups and notification protocolsMonitoring dormant accounts and implementing least-privilege access policiesImportance of privacy training for all staff, including physicians, on an annual basisClear policies on patient privacy and deemed uses of personal health information Succession planning to ensure records aren’t abandoned in events like closures or retirementsResources:PHIPA Decision 249PHIPA Decision 260PHIPA Decision 221PHIPA Decision 230LifeLabs 2020 Investigation ReportHow to Protect Against RansomwareResponding to a Health Privacy Breach: Guidelines for the Health SectorSuccession Planning to Help Prevent Abandoned RecordsStamping out snooping once and for all (blog)Artificial intelligence in health care: Balancing innovation with privacy (Info Matters podcast episode with Dr. Devin Singh)Unmasking digital threats: How to guard against cyber crime (Info Matters podcast episode with Jason Besner, Director of Partnerships at the Canadian Centre for Cyber Security)From the bedside to the board: Building a culture of privacy and security in health institutions (Info Matters podcast episode with The Ottawa Hospital’s Chief Information Officer, Shafique Shamji, and Chief Privacy Officer, Nyranne Martin)IPC Strategic Priorities 2021-2025Info Matters is a podcast about people, privacy, and access to information hosted by Patricia Kosseim, Information and Privacy Commissioner of Ontario. We dive into conversations with people from all walks of life and hear stories about the access and privacy issues that matter most to them. If you enjoyed the podcast, leave us a rating or a review. Have an access to information or privacy topic you want to learn more about? Interested in being a guest on the show? Post @IPCinfoprivacy or email us at
[email protected].
The information, opinions, and recommendations presented in this podcast are for general information only. It should not be relied upon as a substitute for legal advice. Unless specifically stated otherwise, the IPC does not endorse, approve, recommend, or certify any information, product, process, service, or organization presented or mentioned in this podcast, and information from this podcast should not be used or reproduced in any way to imply such approval or endorsement. None of the information, opinions and recommendations presented in this podcast bind the IPC’s Tribunal that may be called upon to independently investigate and decide upon an individual complaint or appeal based on the specific facts and unique circumstances of a given case.
Canada - english