Detecting and deterring unauthorized access to personal health information /

The purpose of this paper is to shed light on the extent of the problem and the potential consequences for individuals, custodians and their agents, and the entire health sector, and to provide guidance to custodians on minimizing the risk of unauthorized access by their agents. [...] PRIVACY NOTICES AND PRIVACY WARNING FLAGS Privacy notices reminding custodians and their agents of their obligations and of the consequences of unauthorized access to personal health information in contravention of PHIPA and its regulations and in contravention of the privacy policies and procedures implemented, may also serve to prevent or reduce the risk of unauthorized access to personal health [...] The log should, at a minimum, include the identity of the agent who was granted access; a description of the personal health information to which the agent has been granted access; the level of access granted; the date of approval; the date the access was provided; and the termination date, if applicable. [...] With respect to the logging of all collections, uses and disclosures of personal health information, the policy and procedures should set out the types of logs that the custodian is required to create and maintain; the minimum content of each type of log; the minimum length of time each type of log must be retained; and the person responsible for retaining each type of log. [...] D etecting and Deterring Unauthorized Access to Personal Health Information 20 With respect to the auditing and monitoring of the logs, the policy and procedures should set out the types of auditing and monitoring that must be conducted using the logs; the procedure for each type of auditing and monitoring; the person responsible for each type of auditing and monitoring; the frequency with which e