Health Information Network Provider (HINP) accountability statement eServices “eReferral”

Under PHIPA and for the purposes of the eReferral, The Centre for Family Medicine Care Innovations (CFFM CI, operating as Amplify Care) acts variously as:

• an agent of participating HIC’s
• an Electronic Service Provider
• a Health Information Network Provider (HINP)

HINP role

As a HINP, for the eService eReferral Network, CFFM CI is accountable for the provision of

services to two or more HICs, where the services are provided primarily to enable the HICs to use electronic means to disclose PHI (referral information), to one another (PHIPA, 2004). CFFM CI provides oversight and coordination of eServices eReferral within Ontario and has engaged the Think Research Consortium (TRC), as a third-party service provider to assist Amplify Care to perform its role as a HINP to provide the service via the Ocean eReferral platform.

The Ocean eReferral platform is used by referring clinicians (“Referrers”) to send patient data (including personal health information) to “Referral Targets”, i.e. specialists or other health service providers to which the Referrer wishes to refer the patient.

Accountabilities as a HINP

This accountability statement applies to the provision of services by CFFM CI in the capacity of a HINP. under PHIPA Section 6(3). To fulfill HINP requirements, CFFM CI contracts with service providers in order to reasonably ensure that requirements, to which HINPs are subject under the Regulation, are also met.

The broad accountabilities which CFFM CI accepts as a HINP are:

1: Providing Participants with a Plain Language Description of Services and Safeguards that they may share with their patients
CFFM CI will supply a plain language description of the services provided and safeguards that have been implemented to protect PHI against unauthorized use or disclosure, and to protect the integrity of the information

2: Public Description of Services, Safeguards, Directives, Guidelines and Policies
CFFM CI will make available, to the public, a plain language description of the services provided, and the safeguards employed to keep PHI secure and confidential. This public description will include any directives, guidelines, and polices that apply to these services

3: Written Agreement with Respect to Services and Safeguards
CFFM CI will enter into a written agreement with each HIC describing the services provided, the administrative, technical and physical safeguards in place to protect the confidentiality and security of the information, and that requires the HINP to comply with PHIPA and its Regulations

4: Providing HICs with a Privacy Impact Assessment and Threat Risk Assessment of Services Provided
CFFM CI will perform and provide to each applicable HIC a written copy of the results of a privacy impact assessment and threat risk assessment related to the services provided

5: Restrictions on Employees and Third Parties
CFFM CI will ensure that all employees or contracted third parties retained, comply with CFFM CI’s privacy and security policies and standards, or policies and standards deemed substantially similar. CFFM CI will have in place agreements with Third Parties, which clearly delineate accountabilities of each of the parties.

6: Provision of Access and Transfer Logs
CFFM CI will make available to the applicable HIC upon request, and to the extent reasonably practical, an electronic record of all accesses and transfers of PHI, associated with the HIC and held in equipment controlled by the HINP or it’s service providers

7: Breach Notification
CFFM CI will notify every applicable HIC, at the first reasonable opportunity, of any privacy breach, suspected privacy breach or privacy risk related to the unauthorized access, use, disclosure, or disposal of PHI managed by the HINP via its third-party Service Providers