Implement Change. These steps may need to take place simultaneously, or in rapid succession, depending upon the circumstances. Each step does not have to be completed before beginning the next. Each step of the protocol is described below and includes suggested roles and responsibilities for the key players. Appendix 1 contains a checklist of key questions to consider and answer when determining if you have taken adequate or appropriate measures to complete each step.
Implement Change. When determining what changes and remedial action needs to be implemented, consider if it is necessary to: review your relevant information management systems to enhance compliance with FIPPA; amend or reinforce your existing policies and practices for managing and safeguarding personal information; develop and implement new security or privacy measures; train your staff on legislative requirements, security and privacy policies, practices and procedures to reduce the potential of future breaches; or test and evaluate remedial actions to determine if they have been implemented correctly, and if your policies and practices need to be modified. In addition, evaluate whether the notice to the data subjects and other relevant parties was effective (e.g., was it done in a reasonably timely manner, were the tone and content of the notice appropriate, and was there sufficient support provided to data subjects?). Key Players Suggested Responsibilities Program Manager Ensure all appropriate remedial action is undertaken, including necessary modifications to privacy and security measures, policies, practices and procedures. Work with Coordinator to train staff in a timely and effective manner. Follow-up to assess effectiveness of remedial action. Make changes, as necessary. Coordinator Evaluate effectiveness of your institution’s response to particular breach, as well as your response plan, and implement improvements, as necessary. Work with Program Manager to answer questions in Step 4 Checklist related to remedial actions and their implementation. Delegated Decision- Maker Monitor implementation of remedial action. Key Players Suggested Responsibilities Third Party Service Provider Take all necessary remedial action to decrease risk of future privacy breaches (e.g., training, enhanced security measures, etc.), in accordance with contractual obligations. HELPFUL RESOURCES Access and Privacy Branch, Alberta Government Services, Conducting a Privacy Audit, December 2004. British Columbia Medical Association, Office of the Information and Privacy Commissioner for British Columbia, and the British Columbia College of Physicians and Surgeons, Key Steps for Physicians in Responding to Privacy Breaches, June 2006. British Columbia Medical Association, Office of the Information and Privacy Commissioner for British Columbia, and the British Columbia College of Physicians and Surgeons, Physicians and Security of Personal Information, June 2006. Office of the Inform...
